@blamejs/blamejs-shop 0.4.107 → 0.4.109

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.4.x
 
+- v0.4.109 (2026-06-26) — **Vendored framework refreshed to 0.15.29.** Updates the vendored blamejs framework to 0.15.29, an upstream security-hardening release. Upstream now routes the parsing of operator- and untrusted-supplied JSON through the framework's safe-JSON primitive — which strips prototype-pollution keys ("__proto__" and friends) and bounds parse depth, key count, and byte size — instead of a raw JSON.parse, across the OpenAPI and AsyncAPI document parsers, the sandbox result decoder, and the internal sealed-store and VEX parses. This storefront consumes those surfaces through the vendored framework, so the hardening applies on upgrade with no API or configuration change and no operator action required. Valid input parses identically; a "__proto__"-laden or oversized payload is defused. **Changed:** *Vendored framework refreshed to 0.15.29* — Refreshes the vendored blamejs framework to 0.15.29. Upstream routes operator- and untrusted-supplied JSON through the safe-JSON primitive (prototype-pollution-key strip + depth / key / size caps, fail-closed) rather than a raw JSON.parse — in the OpenAPI / AsyncAPI parsers, the sandbox result decoder, and the internal sealed-store and VEX parses — and adds a parse-string-or-object helper so a raw JSON.parse on operator input can't be reintroduced one call site at a time. Valid documents are unaffected; a prototype-pollution-laden or oversized payload is now stripped and bounded. No runtime API change and no operator action required.
+
+- v0.4.108 (2026-06-26) — **Vendored framework refreshed to 0.15.28.** Updates the vendored blamejs framework to 0.15.28. The upstream change corrects the terminal-vs-transient retry signal (err.permanent) on the framework's DNS and TLS network errors, so the vendored HTTP client's internal retry behavior only re-attempts failures a retry can actually fix and stops retrying hopeless ones. This storefront consumes those network primitives only transitively through the vendored HTTP client (payment-provider and outbound-webhook calls), so the improvement applies automatically with no API or configuration change and no operator action required. **Changed:** *Vendored framework refreshed to 0.15.28* — Refreshes the vendored blamejs framework to 0.15.28. Upstream, the DNS and TLS network errors now expose a correct err.permanent flag (fail-closed: an unknown code is treated as permanent), so a retry loop re-attempts only transient network round-trip failures and never spins on a permanent one — while a trust-verification failure stays terminal and is never silently retried. This storefront uses these primitives only through the vendored HTTP client, so the better retry behavior applies transitively to payment-provider and outbound-webhook calls; there is no API change and no operator action required.
+
 - v0.4.107 (2026-06-25) — **Vendored framework refreshed to 0.15.27.** Updates the vendored blamejs framework to 0.15.27. The 0.15.27 release is an upstream test-harness reliability change only — its published library is byte-for-byte identical to 0.15.26, with no runtime API or behavior change. No operator action required. **Changed:** *Vendored framework refreshed to 0.15.27* — Refreshes the vendored blamejs framework to 0.15.27, an upstream release whose shipped library is byte-for-byte identical to 0.15.26 (the change is to the framework's own test harness). There are no runtime API changes and no operator-visible behavior change; no action is required.
 
 - v0.4.106 (2026-06-25) — **A capped discount rule's redemption counter no longer drifts toward its limit after a transient database error mid-claim.** Claiming a redemption against a discount rule with a total-redemption cap reserves a slot by incrementing the rule's used-count, then writes the per-order claim row. If writing that claim row failed for a reason other than the expected duplicate-claim collision — a transient backend error — the reserved slot was not returned, so the rule's used-count drifted one higher than the claims actually made and a capped rule could reach its limit early and start refusing legitimate redemptions. The claim path already returns the reservation when it reuses an existing claim and when the per-customer cap refuses; it now also returns it on this transient-failure path. The return is safe and cannot over-grant: the code re-reads the claim by its unique key and only returns the slot when that read confirms no claim row was written, so there is no case where a slot is returned for a claim that actually landed. **Fixed:** *A failed redemption claim returns its reserved cap slot instead of leaking it* — A redemption claim against a total-capped discount rule increments the rule's used-count to reserve a slot before inserting the per-order claim row. A failure inserting that row that was not the expected duplicate-claim collision (a transient backend error) left the reserved slot un-returned, drifting the used-count above the real claim count so the rule could hit its cap and refuse valid redemptions prematurely. The claim path now returns the reserved slot on that path too, matching the existing reuse and per-customer-cap refusals. It is safe against over-granting because it returns the slot only after a re-read on the claim's unique key confirms no row was written — a claim that actually landed is detected and reused, never double-counted.

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.4.107",
+  "version": "0.4.109",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-imfe0otYErcB8rr2h6KLSGTtStirysptpXETSPY4zLv3bZoIT75Lo1dOvkOav+xL",

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.15.27",
-      "tag": "v0.15.27",
+      "version": "0.15.29",
+      "tag": "v0.15.29",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",
@@ -849,6 +849,8 @@
         "release-notes/v0.15.25.json": "lib/vendor/blamejs/release-notes/v0.15.25.json",
         "release-notes/v0.15.26.json": "lib/vendor/blamejs/release-notes/v0.15.26.json",
         "release-notes/v0.15.27.json": "lib/vendor/blamejs/release-notes/v0.15.27.json",
+        "release-notes/v0.15.28.json": "lib/vendor/blamejs/release-notes/v0.15.28.json",
+        "release-notes/v0.15.29.json": "lib/vendor/blamejs/release-notes/v0.15.29.json",
         "release-notes/v0.15.3.json": "lib/vendor/blamejs/release-notes/v0.15.3.json",
         "release-notes/v0.15.4.json": "lib/vendor/blamejs/release-notes/v0.15.4.json",
         "release-notes/v0.15.5.json": "lib/vendor/blamejs/release-notes/v0.15.5.json",
@@ -1527,7 +1529,7 @@
         "test/smoke.js": "lib/vendor/blamejs/test/smoke.js"
       },
       "bundler": "shallow git clone of release tag from github.com/blamejs/blamejs",
-      "bundledAt": "2026-06-25",
+      "bundledAt": "2026-06-26",
       "hashes": {
         ".clusterfuzzlite/Dockerfile": "sha256:1eed98fcc49172efc1c1a7740dba20ce6cfcb3830cccd9f28cf114b4b39794f3",
         ".clusterfuzzlite/build.sh": "sha256:b9f5a627272c65f6569fa20dcbb32c383ca3a1183ce2562d481408a2fbaf9881",
@@ -1558,7 +1560,7 @@
         ".npmrc": "sha256:66f104e7d07c496d2d0409988225e8c0e4ceb8d247dbcac3be75b2128d20ce66",
         ".pinact.yaml": "sha256:0213ffda55961dc49b64c0a5dfa3c0567419633b1499d57eaf7c8d842d7da6c7",
         "ARCHITECTURE.md": "sha256:9b1c8d2b1b7a41838eb348b0a008e4b4369718fd72bfe2974b37155f7536d35b",
-        "CHANGELOG.md": "sha256:36801b1ca30771a1ecf59838fbbeb76ea5b5a8aa52ef09f9d786ef713f8264b0",
+        "CHANGELOG.md": "sha256:12cbd8cd887ee507d270a0be83d2e5572cb034eaf7d47ff9ddaf69322b57a817",
         "CODE_OF_CONDUCT.md": "sha256:148a281960fff7c2fe6554dab66da572c72245ddeb00b0d14811558397bff386",
         "CONTRIBUTING.md": "sha256:bb4dbdbc8598da31dbce653a8ed322e08ff46560173f2eb67a4d684653948332",
         "GOVERNANCE.md": "sha256:906df6afb1f552b27b9acb50f7f96c47b917a2f1021cd4e987dbf4ee0e0a821b",
@@ -1568,7 +1570,7 @@
         "NOTICE": "sha256:f487fa47a11aca0f89e2615cdd3c713e9842abf7a30d8d328eeeae1c864aa774",
         "README.md": "sha256:3ddcc197b003da0b02db8bdd1aef1e943c94f7eab613c633d6a45bb11d0a80e9",
         "SECURITY.md": "sha256:77d8c2bcc04b425a08ef30e51204cebddbd48954b028a259c7a8412dbfeab40a",
-        "api-snapshot.json": "sha256:cf6ac2360a4e975efd8027bd75cc5b9ff6bc969e41186142a05af30c0030d94f",
+        "api-snapshot.json": "sha256:58e5c4106b1fd4f10e1b838057abc26b4f28d2f2b6f1396ddcb5e72021c8623b",
         "assets/BlameJS_Logo.png": "sha256:3c65699753c771b48ef9ac7f45bb40815ec19a23afcdd0cd30ef4601bbbe293e",
         "assets/BlameJS_Logo.svg": "sha256:dda44f3fb1343d5de9db6b1fcdb75fc649c57e7a99a8e8239fcf852e3841e1a8",
         "bench/README.md": "sha256:74202f2507fd840bfc1ac6c681975d9273cf36cca6e0f72655f138337304033c",
@@ -1812,7 +1814,7 @@
         "lib/asn1-der.js": "sha256:bf085ff06bc12f08207ee641e63373ea2bf20e3dd52b8f6f026fd67700cf905c",
         "lib/asyncapi-bindings.js": "sha256:2f6f3d7ea836d0483e40f08b8202d78bae54bdc3d76b5faf57d918e699ebeac8",
         "lib/asyncapi-traits.js": "sha256:82ec58b77f0a65ef1b5e8b67ee9555e9cb984de769c3393fe5c6d4d0640546f0",
-        "lib/asyncapi.js": "sha256:c26da54ab6760da0043178abb85960e857b6e8f77f31dc3ced8db95760e25a00",
+        "lib/asyncapi.js": "sha256:cd48847ed363023e248cf0fbe275b545b0002b85e93ed91315990ef8a6abe483",
         "lib/atomic-file.js": "sha256:b93b008c121f785d149d4450681467b18785781c3a82b9b001bb2a7d636c3ad1",
         "lib/audit-chain.js": "sha256:1c9895a2bbf6ce3b4c546b1b3c95ac9d5ed55d82a2b58c0de4e3ecc1947c3c31",
         "lib/audit-daily-review.js": "sha256:61cebe47d6e5eeeedcab45515473acfaab623217810a7ab3629b3aeca5028519",
@@ -1847,7 +1849,7 @@
         "lib/auth/sd-jwt-vc-disclosure.js": "sha256:bc1eff5def71d2eedb6f17c8bede650050af9d790145e8697871c75ddc8431ae",
         "lib/auth/sd-jwt-vc-holder.js": "sha256:9d22b691e6a698aa2240c3ac611bc91e5b8d6acaa4b8fa03e28077ddb5fd56df",
         "lib/auth/sd-jwt-vc-issuer.js": "sha256:8cbfd25af7df5db7e7f61d004059530c46cc18fd1afbcebbe94f8f81f503c413",
-        "lib/auth/sd-jwt-vc.js": "sha256:3485b354f420e8e6fe4d5231dd00e4037dcc7e0a014695e3ed5a20ec535d3815",
+        "lib/auth/sd-jwt-vc.js": "sha256:717df0e7162e11c76e47221d6877d2bf07dba9974c58cf84719bb365fce52ee0",
         "lib/auth/status-list.js": "sha256:2861dafbe8dab3d6fba161663850c35acf2eb1d29c481dd030339c5c013602a2",
         "lib/auth/step-up-policy.js": "sha256:dca5810bd13d1e4d279b9d34b3e777cf2455c938502b25b41c773e513d90b379",
         "lib/auth/step-up.js": "sha256:3c426fc31ccf4180a9958f3c9e81573fd90ea7afa7688e52b8547a74ea987fbd",
@@ -1931,7 +1933,7 @@
         "lib/dora.js": "sha256:1b2ed45582623978c9f1087a0a45b6707d1a3d7b5da9eb420f780ec44c6ddd37",
         "lib/dr-runbook.js": "sha256:4da7ce04f88e79e103c8cb349d833b716259b99dff4fceb40d2edbac638e6cbf",
         "lib/dsa.js": "sha256:93240f4a5477e06a1f76c90ddf27f0209324261bc841b237aa6d6023b796a32b",
-        "lib/dsr.js": "sha256:1d2cc42afffbf40ea917a1a8a952f77b87398c13d03e0e4107494f1cc27db545",
+        "lib/dsr.js": "sha256:784102f593cf3f42bda74288b291f5005fef7bf4f8569ef60f32d5fe1b0c7231",
         "lib/dual-control.js": "sha256:7b0bc61722be7df45d2ae161ed2a2ec7e33ac5f118175f29b4c58fec364b54e3",
         "lib/early-hints.js": "sha256:cb0daba98c9259f1ad7694db888e25a1f8df866ecbca6c19f7a976a22236b475",
         "lib/eat.js": "sha256:35030327fb3349f7f32ebea939a0d98d93cfca4c2c31a51bd2aaeb272d2a9e6a",
@@ -2167,13 +2169,13 @@
         "lib/network-byte-quota.js": "sha256:79eafbf602a10ced990d89cfd26bea3992e42b177407b8e512bd4790999d17e3",
         "lib/network-dane.js": "sha256:1f60a47618bd99a487d6c2faad423546896f753e33b516bdbc354138438d06f8",
         "lib/network-dns-resolver.js": "sha256:3fd08605a077a8de1c15b3f436d2c2910af77e0078d27ce9d62fdce2e5949b7e",
-        "lib/network-dns.js": "sha256:b9d92448d25c220ad784a4540da04747797bfc5e4edc2c8ff20de827574af136",
+        "lib/network-dns.js": "sha256:ff986202f7800719efe32d6f49900432783eb40a21185f4e8acdb7da45ba4139",
         "lib/network-dnssec.js": "sha256:2b0758d09d5af89b49c69892fabaebabba125c3f9f162996c12b9abbbbae4bca",
         "lib/network-heartbeat.js": "sha256:f14ec7fa4667cbb04477d91ae59d6253b6c9ccc43071bc558e737cc672f43975",
         "lib/network-nts.js": "sha256:90ce47584ad58c171e8029eb1d5df8ba4ba130c4038d1fe260109685c34c8f75",
         "lib/network-proxy.js": "sha256:9342c534863f905000d2432b67c26dd7a5ea02be25aaf9ebe05976079e61d4c9",
         "lib/network-smtp-policy.js": "sha256:a7b6c91983b312a16c436d3e15259f8f6a84579e2e55f64106285b22795e1510",
-        "lib/network-tls.js": "sha256:e3207b0fbeaf209b9fa678aff7a7bb465c3258f6696fb70e96507cfd57d654a0",
+        "lib/network-tls.js": "sha256:554b64c77389e1c961da8d061c63c806be994960466fb26f2b2268dbec0a369b",
         "lib/network-tsig.js": "sha256:41dc85a6e816cce1c58c36891dfc6bafc612b68978936107a09a5a553563e0d7",
         "lib/network.js": "sha256:40cb01627bf45741cac22ef79f5985f69323e47732d54cf3ce28c06882830c25",
         "lib/nis2-report.js": "sha256:fa106a4f95dd9301d7da966c5792197bdbebac477a4f1d2fd2ac2481fbd818fd",
@@ -2200,7 +2202,7 @@
         "lib/openapi-schema-walk.js": "sha256:8a46b681dce7887902f59a86adf3fc6226eeb903e5205228a7397f7fec036efe",
         "lib/openapi-security.js": "sha256:091ca0f5ee89bda7474850eecb90be9501054f28390e9825139e1cad2bf997d7",
         "lib/openapi-yaml.js": "sha256:25b03bcd1c3d0c336aa597eaf79879c840a6b87b729195c573620a47cadaa0b4",
-        "lib/openapi.js": "sha256:94280b4945d8ddbe7f7484e8b425789f6380264f0a7f3ed8c0d9dc1c179140b8",
+        "lib/openapi.js": "sha256:497f251cf81a2b02c8ed9a17c99c5b3eec49f7d8fa1ed95ff363adf4c5d54a2a",
         "lib/otel-export.js": "sha256:c2f33ee7584638b5b27e2c52223eef111e1486da056d4cc5ef19e2e8a0322d9d",
         "lib/outbox.js": "sha256:7ce4a9540fc6a6f0b78897647e7b3cc1f4df900341b0966142228f45c6504486",
         "lib/pagination.js": "sha256:0b5141bc978dd727707cf4006fc928282c1c88508c8a4dec5bc7c42585d2e303",
@@ -2250,7 +2252,7 @@
         "lib/safe-dns.js": "sha256:60fbf77f8dfcc0ac66a943ba94f960a4a4b724c78f07f9150779525d3d460001",
         "lib/safe-ical.js": "sha256:a8f40466b21a1416d5aa3a5a09b75cd48c29be2f9aabec6632db26b9b7868e23",
         "lib/safe-icap.js": "sha256:23f334de6ee463238e26bf9612fc7bfc623519630674c48bf1590f2952c0568b",
-        "lib/safe-json.js": "sha256:be211b9ba0da82c95dd655eb764c06e4db6b76b901f4193a886761c062f57c7b",
+        "lib/safe-json.js": "sha256:fa42506b545f78dc8e184dd989843e777d0b04e1f61d38a7e062b4515ad76146",
         "lib/safe-jsonpath.js": "sha256:0d5a0191de5cba7564847d6419a63c9949fb310f6a77c5637d2ad7b8ca30623c",
         "lib/safe-mime.js": "sha256:885bf0b2932d5ad492ec981f21068e1f85bb6738383a140b27e33659b690931e",
         "lib/safe-mount-info.js": "sha256:790d047481e0a2c04d3dd1f6f1645e2d6fada2f1dd1efde93ca647d2177ca7d4",
@@ -2263,7 +2265,7 @@
         "lib/safe-url.js": "sha256:36e3d2c72e7adc5c90cce7f80e469cf50451ccadd3791a1e3aa406754a4ce6e1",
         "lib/safe-vcard.js": "sha256:be2964d302b9317206fab1740ebbd0acff00258b138810aa6d64ad6cc1797ce5",
         "lib/sandbox-worker.js": "sha256:eefe4e76b2a736208f2e2e90347fc1ff2c2018a98e06bca3103aeb6f96298c6b",
-        "lib/sandbox.js": "sha256:6b3a16b248864f090b172481d008009e47e7a1db7506b552e2ca460bff27ddea",
+        "lib/sandbox.js": "sha256:0fa2d3c7d52afa3091826083ec5b08fd8273e0a6fd33b207e714fd16b734d5b5",
         "lib/scheduler.js": "sha256:1e7ddf15a27776c738dc8112a3ef1c8fcc616f1c6f909ec2d549d3c96cdd9c80",
         "lib/scitt.js": "sha256:c094cef31630aed5dc7adbf494701ab0a825c79a4e406277cbc757ce54bfec9f",
         "lib/sd-notify.js": "sha256:2ef7395bbdab2ac4eb96083c57d401921c94278545f14427fc88cdd970bdb9eb",
@@ -2322,7 +2324,7 @@
         "lib/vendor/public-suffix-list.data.js": "sha256:c840d9ae5c6bf4a07967340a5c649df2c6a66a287db41e408461c46cc32348e6",
         "lib/vendor/simplewebauthn-server.cjs": "sha256:49411d893f5e9b0e2fcaa564b4ec7921f73a9a06229b5e53d49c1453ea1a365c",
         "lib/vendor/vendor-data-pubkey.js": "sha256:a12afa34cd7472e2eaebad2fcd44714102d3edd0601e45769404124a513926d0",
-        "lib/vex.js": "sha256:b45c1c9729dfc69f2140478d46eec91f47da94b5f440be36fa825cb733a718fc",
+        "lib/vex.js": "sha256:bed6880980e7f166fd30bbddab57d7fa06085aaae0dc13ed82a17531b76878b7",
         "lib/watcher.js": "sha256:8618da919affabbe4c4d33915647b3ee4b27e6ea091638f032d4bfead797baf8",
         "lib/web-push-vapid.js": "sha256:54d7d4beb764681bc97dc338490fc2afc3996a032e080401830206814b8c97f0",
         "lib/webhook-dispatcher.js": "sha256:f879d127c0c9ba81ee43ee2b1f38c3fac99d8ff97df1555707beda48caad53f8",
@@ -2339,7 +2341,7 @@
         "oss-fuzz/projects/blamejs/README.md": "sha256:ae13b7bb79ed8d69b1b3276e5562807a0349fb6e6b7d11cf1f683aad1eafdb4b",
         "oss-fuzz/projects/blamejs/build.sh": "sha256:0ced1cf21782c97be7f8d74faf5e27a308b60b2f858836fb5ca3b8c4e939a8f7",
         "oss-fuzz/projects/blamejs/project.yaml": "sha256:59f2cb83aa622325a175b77416fe155be15b70a9c798bd1a78bba05763b1b03d",
-        "package.json": "sha256:018da0233b136be17f4b1919f6c03bcb474db6d62d53362639d47662aa756e4d",
+        "package.json": "sha256:4f8db3f9b9bee033a270a974dd57ba37387f0d41073c8b6ce260073876edd105",
         "release-notes/v0.0.x.json": "sha256:7a49819f30068ee119000cad7010194882bb8bfaa12acbdab4dfc066efb7982f",
         "release-notes/v0.1.x.json": "sha256:6742a8c17f947c5cb76f69dead7eea86b942d80621d914b774ba5488e09937e5",
         "release-notes/v0.10.x.json": "sha256:fe498045daf88337bd3d987e5964aa42c99a50e1685b6f09e51f698b8687726f",
@@ -2368,6 +2370,8 @@
         "release-notes/v0.15.25.json": "sha256:6f7c4eb0d57068317bfb68f739d93b5926f9723a57a0701c966b0f96eb46ed69",
         "release-notes/v0.15.26.json": "sha256:a96b1c7409f863b5a920f51a92b653d5f7a0b671e000bb5dfc2e9bf47e4120dc",
         "release-notes/v0.15.27.json": "sha256:f9e8309bc32c2245ec8d0682e6205417879f090403727d4780b42c0536125f02",
+        "release-notes/v0.15.28.json": "sha256:86d4b034ccd17a51abd706fcd3ec0c1dfca224ae92a74e8d501af1e6f57cb6aa",
+        "release-notes/v0.15.29.json": "sha256:9e912ac2c32bb84bf1d89b8cc5f04d73a78d74a2ac1be24e42e6462f5135b4f5",
         "release-notes/v0.15.3.json": "sha256:19a0074c445545468ca3cc411b21ec8bdb27be2669ae1950347cc244f6aa348c",
         "release-notes/v0.15.4.json": "sha256:6ac7fa0ef1728c27e71b2050d1b07a810f9b4b1440ccddbf28ad56e2f54d8585",
         "release-notes/v0.15.5.json": "sha256:cca1d0edd5d6fc41b512d19d98be224b990dcab41478622c11962f0fcb1bb09a",
@@ -2409,7 +2413,7 @@
         "scripts/vendor-data-gen.js": "sha256:76b627bc6e19b4a122edfca6f514bcb8ca11af02902f0957e641f503337a8a0f",
         "scripts/vendor-data-keygen.js": "sha256:94eaa4d8f832b4aac9ccbcb2a07e6b99cd35cf7b044e1412079cebdefc1f4c0e",
         "scripts/vendor-update.sh": "sha256:373d7f024b7caa3345a3598fa3a586078dd842f0071e6fdad00a473f48a3a929",
-        "test/00-primitives.js": "sha256:99992ebfdf1bcd14a8ac20c71d96741c11b9ff793c788f220226261652b07152",
+        "test/00-primitives.js": "sha256:918967f91118ca29fc24b7d25465c840c8fe2e3fd4e19fe09075db986e3fe230",
         "test/10-state.js": "sha256:45c177da8158bda413b783f68d9b01ef72796aec114c26acea084f92de874f57",
         "test/20-db.js": "sha256:241ef6b7ef305d077aeafb22ee3bcc75b6b549a8fa9b1a6b5d6d5fba43b48d7d",
         "test/30-chain.js": "sha256:81d3615c276138d9b71136047ce80f03170951a7ce1e6aa6be117cb673cca4f8",
@@ -2484,9 +2488,9 @@
         "test/integration/ws-client-roundtrip.test.js": "sha256:e6e9592dcc3962fffbc2ad399567befea6177fd48e31541a79f4cb630fcf7006",
         "test/layer-0-primitives/a2a-tasks.test.js": "sha256:094532bd9306e76c87db08b678edd88792b64855147501963b156f612bb8ec2f",
         "test/layer-0-primitives/a2a.test.js": "sha256:fb5d0ad7e3d0e4fb3d4b2e85acb344a4ba5140f9a9dc533b75d7ab81a64bba43",
-        "test/layer-0-primitives/access-lock.test.js": "sha256:5a2da39439988c54d671f8b28853262a88431194636b16e7dbfb772affec0368",
+        "test/layer-0-primitives/access-lock.test.js": "sha256:26f14cad57db47c88546186393fbdd7a4adc47675d7b45407cd803c3ee3fa080",
         "test/layer-0-primitives/acme.test.js": "sha256:23ac86ef3b4ab261a9bf55ee936ea543e245d6600ab79c00d167aa4e145e2cba",
-        "test/layer-0-primitives/age-gate.test.js": "sha256:ef9ff7b387d0944e2f0f68b41d1fce46ecf67948a80c1c172f9b6a2f92f1ab4b",
+        "test/layer-0-primitives/age-gate.test.js": "sha256:b5b2813c423a2dd817c69bb05dbce1aa690ffb40cac7a76227ebf515244cabfc",
         "test/layer-0-primitives/agent-event-bus.test.js": "sha256:d428f6237d48a101837ff77ae62a94de885a1d99864346c8d78561dcf97351d2",
         "test/layer-0-primitives/agent-idempotency.test.js": "sha256:cfe26bf5890d70d634659199292a525efd4885c55bfd1384e05bd3dca07ac398",
         "test/layer-0-primitives/agent-orchestrator.test.js": "sha256:122bc275b5dbec60efc541f48d8e121f37d1d1e9f0d3b914a2c27d8ebe28a0e2",
@@ -2615,11 +2619,11 @@
         "test/layer-0-primitives/cluster-storage.test.js": "sha256:238b3b3db0eba3e6312a863710533178f566347b90e161e564481aa826707647",
         "test/layer-0-primitives/cluster-vault-rotation.test.js": "sha256:3514e9e71d6c39e805248f58ad2f41528d091e196c0f3766a032675677161b2d",
         "test/layer-0-primitives/cms-codec.test.js": "sha256:7e46078ed82be5b69d22c48f22dba37ea5015371c2a8cf5f94fb1a792fb7bb78",
-        "test/layer-0-primitives/codebase-patterns.test.js": "sha256:59c479be996fdec3635bbc75d05f4c8582043fbb026e2e67085f19b6b9412cce",
+        "test/layer-0-primitives/codebase-patterns.test.js": "sha256:38c5ad5bf99da425f563b892451a39a4ed3a323694c2fb9b43271f63e9075266",
         "test/layer-0-primitives/codepoint-class.test.js": "sha256:19d1b69efa7e0e9f7ef2392ca264167767a5ec5890ee339b2cfd8a7818035d27",
         "test/layer-0-primitives/compliance-ai-act.test.js": "sha256:5ee4ad05d12233cb3c5457ef10a727833710bbc1ce1318838f9f9ef5d2cb8d4b",
         "test/layer-0-primitives/compliance-cascade.test.js": "sha256:ee02cf14541a837a9d7977c6ea6bf7f9210bed293925d93c976e31f270aebec4",
-        "test/layer-0-primitives/compliance-eaa.test.js": "sha256:8afb3fa66f3f9452592995e77f5e0644d8c82de2321c551c6f5be6002b2c27a4",
+        "test/layer-0-primitives/compliance-eaa.test.js": "sha256:2eb41e48e9face72cb0d21ee0cd2b69ca7fcaba305cb9e30741d35cd2bd9f4a7",
         "test/layer-0-primitives/compliance-eu-ai-act-posture.test.js": "sha256:3f45bb76ef390b7cc4396a37153d48f0f9465c5abc59851f0971fcc40c28dcea",
         "test/layer-0-primitives/compliance-sanctions.test.js": "sha256:e4cb4e7b73cb0834958c1c18c9d3bb70087ee784216a888991dbe41b518b87f0",
         "test/layer-0-primitives/compliance.test.js": "sha256:d743b6e2df985daed1df4a7808e7e5bf91207d5909f5bd7d8f882e0c27dcfe1b",
@@ -2697,7 +2701,7 @@
         "test/layer-0-primitives/dr-runbook.test.js": "sha256:9665caaa90f356d0237e0e6c6889c56a3467b20c7eaf78d2e2afa51c4b3af2cb",
         "test/layer-0-primitives/dsa.test.js": "sha256:2cdbdd29b9c58d738920bb4f82f73492eab56e7d7f8111f1cdb14838de3a3ab3",
         "test/layer-0-primitives/dsr-state-rules.test.js": "sha256:0ddc7fd6d5d3f8817d8f4aad7bb66c6bf6e64eafe61fdedaafa8f60957d20bd0",
-        "test/layer-0-primitives/dsr.test.js": "sha256:e930c1cd058ac8de7280fd7e9a27373bf5d971ebe4e9133726c8f615811cd7c0",
+        "test/layer-0-primitives/dsr.test.js": "sha256:d7be3fcf28348936ffd73ec6bc06d59ea7ab22b40fa3316eba18c587d7575680",
         "test/layer-0-primitives/dual-control.test.js": "sha256:2d9255f96bddbb45d75182ef826a355536e40caeb5864483c56eaf5ba3c7e0ac",
         "test/layer-0-primitives/early-hints.test.js": "sha256:9827c66c7558ebeb39a448ec69129517a517d440865ac5341afcbc7c1047e085",
         "test/layer-0-primitives/eat.test.js": "sha256:6f0b0180f659b008a6a86f9af4f8674e2ddb98d00408e10d52d03291bda96f6e",
@@ -2724,7 +2728,7 @@
         "test/layer-0-primitives/fsm.test.js": "sha256:7037831083426478ed4efd7d1c17d4b96c3609816a41819b5c9da71d2b6187e8",
         "test/layer-0-primitives/gate-contract-content-gate.test.js": "sha256:d9f8b94231efb0e02a94b7934bf58a3f8e343829ce11346b7302e69e13efd551",
         "test/layer-0-primitives/gcs-bucket-ops.test.js": "sha256:c1a0982190506dba72430c16972a296abc2de865786cc72c63c971edf450502c",
-        "test/layer-0-primitives/gdpr-ropa.test.js": "sha256:ebed2f001ddc79e42a9cd0ee5319536662dcb4c601b3eb65077161ab81e243a4",
+        "test/layer-0-primitives/gdpr-ropa.test.js": "sha256:de4d2b6db19c87a0ea00c49bc865c39802a664f0ee6b6a3f98f62319d79a4fe7",
         "test/layer-0-primitives/graphql-federation.test.js": "sha256:c920cdc6f8740733b712d139d11da08c4fa5c8add3b0749fa74c6fbce04965cf",
         "test/layer-0-primitives/guard-agent-registry.test.js": "sha256:d432339273cde552cde8101ac1b32df44c36e7dd9381a328669f63884ac9016b",
         "test/layer-0-primitives/guard-all.test.js": "sha256:fdd9a746ecfa6e29f0e5f727fbd66c5ab2e29a263ef0d8c2c1d62fc430cdd59f",
@@ -2737,7 +2741,7 @@
         "test/layer-0-primitives/guard-event-bus-topic.test.js": "sha256:538e6d338541b724fc5bedb7f2fd33fae12777d292c771bb5d70720e30bf9156",
         "test/layer-0-primitives/guard-filename.test.js": "sha256:6718194054554e246e171e1c23a970dfc5e618fa3bd6a79a8925289fd339fd06",
         "test/layer-0-primitives/guard-gate-disposition-coverage.test.js": "sha256:e4e3a971fe2659593bb76aebed6d65ddea937eda558191085c1ad31fb1c5eaf3",
-        "test/layer-0-primitives/guard-html-wcag.test.js": "sha256:11deaf7b28ed574731fb2d6a922dd2ca78c7f1c5e41635c0bed7ff0697c0f0f9",
+        "test/layer-0-primitives/guard-html-wcag.test.js": "sha256:cdbec2cc892cbe615865a1cfc6b69fe128af81ad953fc35fb6f00c284a5a7fc4",
         "test/layer-0-primitives/guard-html.test.js": "sha256:31ac5ba5728ad18df1e188c5251ec97698f7d7bd840011c2870fccd115b35969",
         "test/layer-0-primitives/guard-idempotency-key.test.js": "sha256:18b233de627ea68cc289cb2fcd6ad5ca18db3bf911581747fd293e1bd3ee8789",
         "test/layer-0-primitives/guard-image.test.js": "sha256:0f45eae95851d2e9f5b8338d2a99dddabb59b60e1be69ac9ec5d0e4d7cd21428",
@@ -2861,12 +2865,12 @@
         "test/layer-0-primitives/network-dns-lookup-timeout-default.test.js": "sha256:6251b8d093f6402a13d08afea2d7164fccdb8d2edbbbe63915b88b4e2bcba47b",
         "test/layer-0-primitives/network-dns-resolver-timeout.test.js": "sha256:9ba8ca49b8095ec4780959134520ac869c80ca9b9664b5beadce2d135037777d",
         "test/layer-0-primitives/network-dns-resolver.test.js": "sha256:8966ba1b24c9ceb5754a3ef21a6d6e61a6cade983367bece1034110b7928fc1c",
-        "test/layer-0-primitives/network-dns.test.js": "sha256:c300d176f391ce3a12b8d8dd4ddd68f0d5f16b3b837b80066406c6e698a9433d",
+        "test/layer-0-primitives/network-dns.test.js": "sha256:b627a0c6006229be8d0c3409857dcff6bd7b97a22f5ff5c3b4f9fdd28178997a",
         "test/layer-0-primitives/network-heartbeat-passive.test.js": "sha256:4dae1d9f61c85489d1a91a6f4a242198d0bee89fdbacff9efba143e78e882ad0",
         "test/layer-0-primitives/network-nts-handshake-byte-cap.test.js": "sha256:b20b7a6e218613282d7d817d7a675f9ee81ba07af1ed5c089283e62736e2c515",
         "test/layer-0-primitives/network-tls-build-options.test.js": "sha256:0380ef886acc0a3bb0f7bc032c11991891fe9f19648e9f8d38829c7ea16b61b0",
         "test/layer-0-primitives/network-tls-ct-inclusion.test.js": "sha256:951b5eeded5762f667c534c0433e4b5f4b0a6a48c7c66a88492c0d4cebd21636",
-        "test/layer-0-primitives/network-tls.test.js": "sha256:75605314bf5093ab040c46cdc17327cd609145c4b0b7a17fbbaa9679b94a3b46",
+        "test/layer-0-primitives/network-tls.test.js": "sha256:f914692bc98176d2f425bcca7a7023eee5f0258eb293da2d56afc8232c10fa2f",
         "test/layer-0-primitives/network-tsig.test.js": "sha256:8845cb8f23876e6c68436491a412bbbd2c5415af23438c5ab2613358b3a4168f",
         "test/layer-0-primitives/network.test.js": "sha256:5424adaab9c3fe6e1b96e21eef90e51c5cf4c7fa8e96132306399d95cdfacdf1",
         "test/layer-0-primitives/nis2-report.test.js": "sha256:4ee2d6a5c6e05c317c34a4f7eef91a0c91079d227b8b69c65e1d58e4444613e0",
@@ -2920,7 +2924,7 @@
         "test/layer-0-primitives/request-id-async-context.test.js": "sha256:3aad8f145e7ca37c7220767779050ffaa5da2b2bb2cb7e4b65d3652d554b0322",
         "test/layer-0-primitives/request-log.test.js": "sha256:31479f63311b31a74aa7f636b7f9ef04c2f6bcb152b8b8c465a40d08461cc03f",
         "test/layer-0-primitives/require-auth-cache-control.test.js": "sha256:36b9d77791285e2b2606a5d2f8f8c8536a46e7ec1f4f2c5e54ee1b17a3dece3d",
-        "test/layer-0-primitives/require-mtls.test.js": "sha256:ba041e00d098090b4ffa578bb8b3f01927043842a5057069502dc69ade2dc23d",
+        "test/layer-0-primitives/require-mtls.test.js": "sha256:355759e9a2e03add272af8f18f8297c60444d30fceac99455dd6ce339e8980f6",
         "test/layer-0-primitives/resource-access-lock.test.js": "sha256:f436bcd187b317229266b4f27d89e7f87cb28c7dc400643594b22d05232dbac4",
         "test/layer-0-primitives/restore-blob-remap.test.js": "sha256:8caee31bd1c75dc15fb51ffc3db7981660c7bc20a01ff8e82e9dccbdefe9e671",
         "test/layer-0-primitives/retention-dryrun-no-vacuum.test.js": "sha256:b454fb508b22418097839a20f7b1ff5240a57f8ee37e575768780e7b8cc772b6",
@@ -2951,7 +2955,7 @@
         "test/layer-0-primitives/safe-url-canonicalize.test.js": "sha256:5a85baeec34770f9efef04fe8036fc75f80278188ed6f09adcb97f72d39a0dc8",
         "test/layer-0-primitives/safe-url-idn-homograph.test.js": "sha256:a68b8307a0711270ce865d80937793c3bd48445f0ac6adb5814bd9b948e06193",
         "test/layer-0-primitives/safe-vcard.test.js": "sha256:10a0695050afee64599411352b34382e15b8f9bd9045ed3951cc6bc561918c89",
-        "test/layer-0-primitives/safe-xml.test.js": "sha256:dc94bdc968449a87843a2403e4f9d402cd22fb7479cae30ae42e297ffec5a449",
+        "test/layer-0-primitives/safe-xml.test.js": "sha256:0a2127b6803bea6e028a0350c02ffd6812c17de5c6c0a260c54ea2c642eb0c93",
         "test/layer-0-primitives/saml-slo.test.js": "sha256:b8b3a5e71ad28a0a3e9b69bca9f570410bc8b8eab6a7fdfd186fdf12cd90854f",
         "test/layer-0-primitives/saml-subjectconfirmation-notbefore.test.js": "sha256:2deac25891a4eb2c5d1073d99c352a01322e6fab6497616209ec6a15cc1fbf71",
         "test/layer-0-primitives/saml-subjectconfirmation-notonorafter.test.js": "sha256:1396afcc34135ab025880ac74738f3eb1984f5725dcf2e676e6a2f1bd7f852c2",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.29 (2026-06-25) — **JSON parsing of operator and untrusted input is routed through `b.safeJson` everywhere, so a `"__proto__"` member is stripped and the parse is size-bounded — `b.openapi.parse`, `b.asyncapi.parse`, and `b.sandbox.run` were using a raw `JSON.parse`.** b.openapi.parse and b.asyncapi.parse parsed an operator-supplied document string with a raw JSON.parse, which re-creates a "__proto__" member as an own key and imposes no size bound; b.sandbox.run parsed the untrusted sandboxed code's serialized result the same way (proto member kept, depth unbounded). All three now route through b.safeJson, which strips the prototype-pollution keys and applies the depth / key / size caps. A new b.safeJson.parseStringOrObject primitive captures the recurring "accept a document as a JSON string OR a pre-built object" shape (a string is parsed safely, an object passes through) that openapi and asyncapi had each hand-rolled, with each consumer's typed error class and a generous document size cap passed as data. Valid input parses identically to before; a malicious or oversized document is now defused rather than accepted. **Added:** *b.safeJson.parseStringOrObject(input, opts?)* — Accepts either a JSON string — parsed through b.safeJson.parse, so the prototype-pollution-key strip and depth / key / size caps apply — or an already-decoded plain object (returned unchanged). For the recurring "operator hands me a document as a JSON string or a pre-built object" surface (b.openapi / b.asyncapi). The consumer's typed error class, error codes, label, and size cap are passed as options, so a raw JSON.parse on operator input cannot be hand-rolled per consumer. **Security:** *Operator and untrusted JSON parses strip __proto__ and bound size (no raw JSON.parse)* — A raw JSON.parse keeps a "__proto__" object member as an own key (a prototype-pollution gadget for any downstream merge) and parses unbounded input. b.openapi.parse and b.asyncapi.parse used it on operator document strings, and b.sandbox.run used it on the untrusted sandboxed code's JSON-serialized result. All now route through b.safeJson — the prototype-pollution keys are stripped and the depth / key / size caps apply (a 16 MiB document cap for openapi/asyncapi, the existing result-bytes cap for the sandbox). Internal JSON parses (the sealed DSR store payloads, the VEX canonical re-format) route through the same primitive too, so the guarantee cannot be bypassed one call site at a time. Valid input is unaffected; a "__proto__"-laden or oversized payload is defused.
+
+- v0.15.28 (2026-06-25) — **`b.network.dns` and `b.network.tls` errors now carry a usable terminal-vs-transient signal on `err.permanent`, so a caller's retry loop re-attempts only the failures a retry can fix.** DnsError was declared always-transient and NetworkTlsError always-permanent, so a consumer driving its own retry loop got the wrong signal in both directions: it would retry a permanent DNS failure (a bad host, bad options, an unsupported query, an NXDOMAIN-style no-result, or a caller-shape/config error such as an unconfigured transport or an invalid resolver list) forever, and it would refuse to retry a transient TLS-over-network failure (an ECH connection failure, a handshake timeout, DNS momentarily unavailable). err.permanent now reflects each error's actual transience, derived from its code and failing closed (an unknown code is permanent, so a hopeless target is not retried indefinitely): for DnsError only a failed network round-trip (a lookup timeout, a resolve/reverse query that failed on the wire, a failed DoH/DoT exchange, a DDR discovery that found nothing) is transient — config, input, and environment errors raised before any network work are permanent; for NetworkTlsError only the network-layer ECH failures are transient. TlsTrustError remains always-permanent by design — a trust-verification failure (bad CA, fingerprint mismatch, OCSP not-good, CT violation, an unreachable OCSP responder) must never be silently retried past the trust decision. **Fixed:** *DnsError / NetworkTlsError expose a correct terminal/transient signal; TlsTrustError stays terminal* — b.network.dns's DnsError was always-transient and b.network.tls's NetworkTlsError always-permanent, so err.permanent misled a consumer's retry loop in both directions — retrying a permanent DNS error (bad host / options / unsupported type / no-result) indefinitely, and never retrying a transient TLS network error (ECH connect failure, handshake timeout, DNS unavailable). err.permanent now reflects each error's actual transience by code and fails closed (unknown codes are permanent): DnsError is transient only for a failed network round-trip (dns/lookup-timeout, dns/resolve-failed, dns/reverse-failed, dns/doh-failed, dns/dot-failed, dns/dot-handshake-failed, dns/ddr-not-discovered, dns/system-failed), and permanent otherwise — including the caller-shape / environment errors raised before any network work (dns/transport-unavailable for an unconfigured transport, dns/dnr-no-resolvers for an empty/invalid resolver list, dns/setservers-failed for an invalid address, dns/no-system-resolvers when none are configured). NetworkTlsError is transient only for the network-layer ECH failures (tls/ech-connect-failed, tls/ech-timeout, tls/ech-dns-unavailable), permanent otherwise. TlsTrustError remains always-permanent so a trust-verification failure is never silently retried.
+
 - v0.15.27 (2026-06-25) — **Internal test-harness reliability only — the published library is byte-for-byte identical to 0.15.26.** The legacy single-layer smoke files used fixed-duration setTimeout sleeps to wait for asynchronous conditions (a job processed, a lease TTL lapsing, an audit flush completing). On a contended CI runner a fixed sleep is both flake-prone (too short under load) and slow (it always burns the full budget). Those condition-waits are converted to the harness's polling helpers — waitUntil for observable predicates, passiveObserve for deliberate real-time elapses, withTestTimeout for hang guards — which exit early on fast platforms and give contended platforms the full budget. No shipped framework code changed; this release is byte-for-byte identical to 0.15.26 for operators. **Fixed:** *Smoke layer files poll for conditions instead of fixed setTimeout sleeps* — The single-layer smoke files waited on asynchronous conditions with fixed-duration setTimeout sleeps, which flake under SMOKE_PARALLEL load and always burn their full budget. The condition-waits are converted to the polling helpers (waitUntil / passiveObserve / withTestTimeout) so they exit early on fast platforms and stay robust on contended ones; non-wait timers (abort triggers, child/socket watchdogs, simulated-latency mocks) are unchanged. This is test-harness reliability only — no shipped framework behavior changed.
 
 - v0.15.26 (2026-06-25) — **Internal test-harness correctness only — the published library is byte-for-byte identical to 0.15.25.** The smoke runner requires each test module and awaits its exported run(). Several tests were instead written as a top-level (async function () {...})() IIFE that runs detached at require-time, so the runner measured and reported the test's result before the IIFE's post-await assertions executed — those checks silently never ran (one parser test exercised 4 of its 26 assertions, and a failure after the first await would have gone unseen as a false pass). Those tests are converted to the exported-run form so the runner awaits their full assertion set, and a codebase-patterns detector now refuses a top-level async IIFE in a test file so the pattern cannot return. No shipped framework code changed; this release is byte-for-byte identical to 0.15.25 for operators. **Fixed:** *Detached-IIFE tests now run their full assertion set under the smoke runner* — A test written as a top-level (async function () {...})() IIFE runs detached when the runner requires it: the runner only awaits an exported run(), so it reported the file's result before the IIFE's awaited assertions executed, and every check after the first await silently did not count (one parsers test ran 4 of 26). Such tests are rewritten to define async function run(), export it, and invoke it under if (require.main === module), so the runner awaits the complete set; a detector refuses a re-introduced top-level async IIFE in a test file. This is test-harness correctness only — no shipped framework behavior changed.

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.15.27",
-  "createdAt": "2026-06-26T01:18:53.911Z",
+  "frameworkVersion": "0.15.29",
+  "createdAt": "2026-06-26T06:52:58.579Z",
   "exports": {
     "a2a": {
       "type": "object",
@@ -50884,6 +50884,10 @@
           "type": "function",
           "arity": 3
         },
+        "parseStringOrObject": {
+          "type": "function",
+          "arity": 2
+        },
         "registerFormat": {
           "type": "function",
           "arity": 2

package/lib/vendor/blamejs/lib/asyncapi.js

@@ -40,6 +40,8 @@ var openapiSecurity     = require("./openapi-security");
 var openapiYaml         = require("./openapi-yaml");
 var bindingsMod         = require("./asyncapi-bindings");
 var traitsMod           = require("./asyncapi-traits");
+var safeJson            = require("./safe-json");
+var C                   = require("./constants");
 var { defineClass }     = require("./framework-error");
 var AsyncApiError = defineClass("AsyncApiError", { alwaysPermanent: true });
 
@@ -470,19 +472,17 @@ function _validateServerEntry(entry, label) {
  *   bad.errors[0];      // → 'operations.pub.channel: $ref "#/channels/missing" does not resolve to a declared channel'
  */
 function parse(jsonStringOrObject) {
-  var doc;
-  if (typeof jsonStringOrObject === "string") {
-    try { doc = JSON.parse(jsonStringOrObject); }                                       // allow:bare-json-parse — operator-supplied AsyncAPI doc; size-bounded by caller
-    catch (e) {
-      throw new AsyncApiError("asyncapi/bad-json",
-        "asyncapi.parse: invalid JSON — " + e.message);
-    }
-  } else if (jsonStringOrObject != null && typeof jsonStringOrObject === "object") {
-    doc = jsonStringOrObject;
-  } else {
-    throw new AsyncApiError("asyncapi/bad-input",
-      "asyncapi.parse: input must be a JSON string or a plain object");
-  }
+  // A JSON string is parsed through safeJson (proto-pollution-key strip + depth
+  // / size caps — a raw JSON.parse here kept a "__proto__" member and was
+  // unbounded on an operator-supplied document); a pre-built object passes
+  // through. The 16 MiB cap is generous for any real AsyncAPI document.
+  var doc = safeJson.parseStringOrObject(jsonStringOrObject, {
+    maxBytes:   C.BYTES.mib(16),
+    errorClass: AsyncApiError,
+    jsonCode:   "asyncapi/bad-json",
+    inputCode:  "asyncapi/bad-input",
+    label:      "asyncapi.parse",
+  });
   var errors = [];
   if (typeof doc.asyncapi !== "string") {
     errors.push("missing or non-string `asyncapi` version field (must be 3.0.x)");

package/lib/vendor/blamejs/lib/auth/sd-jwt-vc.js

@@ -165,8 +165,8 @@ function _verifyJwt(token, publicKey, algorithm) {
   var headerStr = _b64uDecodeStr(parts[0]);
   var payloadStr = _b64uDecodeStr(parts[1]);
   return {
-    header:  safeJson.parse(headerStr, { maxBytes: 64 * 1024 }),                    // allow:bare-json-parse — header from cryptographically-verified JWT; signature verifies the bytes // allow:raw-byte-literal — JWT header cap (64 KB)
-    payload: safeJson.parse(payloadStr, { maxBytes: 1024 * 1024 }),                 // allow:bare-json-parse — payload from cryptographically-verified JWT; signature verifies the bytes // allow:raw-byte-literal — JWT payload cap (1 MB)
+    header:  safeJson.parse(headerStr, { maxBytes: 64 * 1024 }),                    // allow:raw-byte-literal — JWT header cap (64 KB)
+    payload: safeJson.parse(payloadStr, { maxBytes: 1024 * 1024 }),                 // allow:raw-byte-literal — JWT payload cap (1 MB)
   };
 }
 
@@ -330,7 +330,7 @@ function present(opts) {
   if (_jwtParts.length === 3) {
     try {
       _issuerPayload = safeJson.parse(_b64uDecodeStr(_jwtParts[1]),
-        { maxBytes: 64 * 1024 });                                                                  // allow:bare-json-parse — payload only read to pull _sd_alg; final auth happens in verify() // allow:raw-byte-literal — JWT payload cap (64 KB)
+        { maxBytes: 64 * 1024 });                                                                  // allow:raw-byte-literal — JWT payload cap (64 KB)
     } catch (_e) { _issuerPayload = null; }
   }
   var _sdAlg = (_issuerPayload && typeof _issuerPayload._sd_alg === "string")
@@ -448,7 +448,7 @@ async function verify(presentation, opts) {
       "verify: JWT must have 3 dot-separated parts");
   }
   var headerObj;
-  try { headerObj = safeJson.parse(_b64uDecodeStr(jwtParts[0]), { maxBytes: 64 * 1024 }); }  // allow:bare-json-parse — pre-verify header parse to look up the key resolver; checked again post-signature // allow:raw-byte-literal — JWT header cap (64 KB)
+  try { headerObj = safeJson.parse(_b64uDecodeStr(jwtParts[0]), { maxBytes: 64 * 1024 }); }  // allow:raw-byte-literal — JWT header cap (64 KB)
   catch (e) {
     throw new AuthError("auth-sd-jwt-vc/bad-header",
       "verify: malformed JWT header: " + e.message);
@@ -622,7 +622,7 @@ async function verify(presentation, opts) {
     }
     // Verify KB-JWT signature
     var kbHeaderObj;
-    try { kbHeaderObj = safeJson.parse(_b64uDecodeStr(maybeKbJwt.split(".")[0]), { maxBytes: 4096 }); }  // allow:bare-json-parse — kb header from validated KB-JWT; signature verifies
+    try { kbHeaderObj = safeJson.parse(_b64uDecodeStr(maybeKbJwt.split(".")[0]), { maxBytes: 4096 }); }
     catch (e) {
       throw new AuthError("auth-sd-jwt-vc/bad-kb-header",
         "verify: malformed KB-JWT header: " + e.message);

package/lib/vendor/blamejs/lib/dsr.js

@@ -114,6 +114,7 @@ var bCrypto = require("./crypto");
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
 var safeSql = require("./safe-sql");
+var safeJson = require("./safe-json");
 var boundedMap = require("./bounded-map");
 var { defineClass } = require("./framework-error");
 
@@ -1142,12 +1143,23 @@ function dbTicketStore(opts) {
   // the derived lookup hashes are computed from the plaintext; vault-less
   // it stores plaintext (matching the agent-* fallback).
   function _sealColumns(id, ticket) {
+    // The payload column is read back through safeJson.parse, whose hard
+    // ceiling (safeJson.ABSOLUTE_MAX_BYTES) caps what any read can accept.
+    // Refuse a ticket whose serialized form exceeds that same ceiling on
+    // write so the store never holds a payload it cannot read back later
+    // (write cap == read cap, measured the same way: UTF-8 byte length).
+    var serializedPayload = JSON.stringify(ticket);
+    if (Buffer.byteLength(serializedPayload, "utf8") > safeJson.ABSOLUTE_MAX_BYTES) {
+      throw new DsrError("dsr/ticket-too-large",
+        "_sealColumns: ticket " + id + " payload exceeds the " +
+          safeJson.ABSOLUTE_MAX_BYTES + "-byte store limit");
+    }
     var row = {
       id:            id,
       subject_id:    (ticket.subject && ticket.subject.subjectId) || null,
       subject_email: (ticket.subject && ticket.subject.email)     || null,
       subject_phone: (ticket.subject && ticket.subject.phone)     || null,
-      payload:       JSON.stringify(ticket),
+      payload:       serializedPayload,
     };
     var out = {
       $sid:       row.subject_id,
@@ -1252,7 +1264,7 @@ function dbTicketStore(opts) {
       var rows = db.prepare("SELECT id, payload FROM " + qTable + " WHERE id = $id")
                    .all({ $id: id });
       if (!rows || rows.length === 0) return null;
-      return JSON.parse(_unsealPayload(rows[0].payload, rows[0].id));               // allow:bare-json-parse — payload was JSON.stringify-ed by this same store (unsealed above), never from operator/network input
+      return safeJson.parse(_unsealPayload(rows[0].payload, rows[0].id), { maxBytes: safeJson.ABSOLUTE_MAX_BYTES });
     },
     list: async function (filter) {
       filter = filter || {};
@@ -1267,7 +1279,7 @@ function dbTicketStore(opts) {
       if (conds.length > 0) sql += " WHERE " + conds.join(" AND ");
       sql += " ORDER BY submitted_at DESC";
       var rows = db.prepare(sql).all(params);
-      return rows.map(function (r) { return JSON.parse(_unsealPayload(r.payload, r.id)); });  // allow:bare-json-parse — payload was JSON.stringify-ed by this same store (unsealed above), never from operator/network input
+      return rows.map(function (r) { return safeJson.parse(_unsealPayload(r.payload, r.id), { maxBytes: safeJson.ABSOLUTE_MAX_BYTES }); });
     },
     update: async function (id, ticket) {
       var cols = _sealColumns(id, ticket);
@@ -1314,7 +1326,7 @@ function dbTicketStore(opts) {
       var del = db.prepare("DELETE FROM " + qTable + " WHERE id = $id");
       for (var i = 0; i < rows.length; i++) {
         try {
-          var t = JSON.parse(_unsealPayload(rows[i].payload, rows[i].id));          // allow:bare-json-parse — payload was JSON.stringify-ed by this same store (unsealed above), never from operator/network input
+          var t = safeJson.parse(_unsealPayload(rows[i].payload, rows[i].id), { maxBytes: safeJson.ABSOLUTE_MAX_BYTES });
           if (t.retentionUntil && t.retentionUntil < asOf) {
             del.run({ $id: rows[i].id });
             purged += 1;

package/lib/vendor/blamejs/lib/network-dns.js

@@ -16,7 +16,34 @@ var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 var { boundedMap } = require("./bounded-map");
 
-var DnsError = defineClass("DnsError", { alwaysPermanent: false });
+// DnsError carries a terminal-vs-transient signal on err.permanent so a caller
+// driving a retry loop knows which failures are worth re-attempting. Fail
+// CLOSED: only a failure of an actual network round-trip that a retry can
+// plausibly fix is transient (a lookup timeout, a resolve/reverse query that
+// failed on the wire, a DoH/DoT exchange that failed, a DDR discovery query that
+// found nothing). Everything else is permanent — bad config / options, an
+// unsupported query, a malformed or empty/NXDOMAIN-style reply, AND the
+// caller-shape / environment errors raised BEFORE any network work: requesting a
+// transport that was never configured (dns/transport-unavailable), an
+// empty/invalid designated-resolver list (dns/dnr-no-resolvers), an invalid
+// setServers address (dns/setservers-failed), or no system resolvers configured
+// (dns/no-system-resolvers). A retry cannot make invalid input or absent
+// configuration valid.
+var DNS_TRANSIENT_CODES = {
+  "dns/lookup-timeout":       true,
+  "dns/system-failed":        true,
+  "dns/resolve-failed":       true,
+  "dns/reverse-failed":       true,
+  "dns/doh-http":             true,
+  "dns/doh-failed":           true,
+  "dns/dot-handshake-failed": true,
+  "dns/dot-failed":           true,
+  "dns/ddr-not-discovered":   true,
+};
+function _dnsErrorIsPermanent(code) {
+  return !Object.prototype.hasOwnProperty.call(DNS_TRANSIENT_CODES, code);
+}
+var DnsError = defineClass("DnsError", { permanentClassifier: _dnsErrorIsPermanent });
 
 // Protocol-fixed byte counts and radixes — passthrough through C.BYTES
 // keeps every numeric literal routed through one helper.

package/lib/vendor/blamejs/lib/network-tls.js

@@ -16,8 +16,28 @@ var lazyRequire = require("./lazy-require");
 var safeAsync = require("./safe-async");
 var { defineClass } = require("./framework-error");
 
+// TlsTrustError is a TRUST-verification failure (bad CA/PEM, fingerprint
+// mismatch, OCSP not-good / revoked, CT violation, hostname/PKIX failure, an
+// unreachable OCSP responder). These are ALWAYS permanent: a caller must never
+// silently retry past a trust decision — a transient-looking OCSP-fetch failure
+// is the operator's soft-fail policy to make explicitly, not something a retry
+// loop should paper over. Fail closed.
 var TlsTrustError = defineClass("TlsTrustError", { alwaysPermanent: true });
-var NetworkTlsError = defineClass("NetworkTlsError", { alwaysPermanent: true });
+
+// NetworkTlsError carries a terminal-vs-transient signal on err.permanent. Fail
+// CLOSED: only the network-layer ECH failures a retry can plausibly fix (a
+// connect failure, a timeout, DNS being momentarily unavailable) are transient;
+// bad options, a malformed ECH config, and PKIX hostname/SAN validation failures
+// are permanent (config / validation errors a retry cannot fix).
+var TLS_TRANSIENT_CODES = {
+  "tls/ech-connect-failed": true,
+  "tls/ech-timeout":        true,
+  "tls/ech-dns-unavailable": true,
+};
+function _networkTlsErrorIsPermanent(code) {
+  return !Object.prototype.hasOwnProperty.call(TLS_TRANSIENT_CODES, code);
+}
+var NetworkTlsError = defineClass("NetworkTlsError", { permanentClassifier: _networkTlsErrorIsPermanent });
 
 var observability = lazyRequire(function () { return require("./observability"); });
 var audit = lazyRequire(function () { return require("./audit"); });

package/lib/vendor/blamejs/lib/openapi.js

@@ -47,6 +47,8 @@ var schemaWalk            = require("./openapi-schema-walk");
 var pathsBuilderMod       = require("./openapi-paths-builder");
 var openapiSecurity       = require("./openapi-security");
 var openapiYaml           = require("./openapi-yaml");
+var safeJson              = require("./safe-json");
+var C                     = require("./constants");
 var { defineClass }       = require("./framework-error");
 var audit                 = lazyRequire(function () { return require("./audit"); });
 
@@ -520,19 +522,17 @@ function _validateItemOperations(item, label, errors, securitySchemes) {
  *   bad.errors[0];      // → 'path "users" must start with \'/\''
  */
 function parse(jsonStringOrObject) {
-  var doc;
-  if (typeof jsonStringOrObject === "string") {
-    try { doc = JSON.parse(jsonStringOrObject); }                                       // allow:bare-json-parse — operator-supplied OpenAPI doc; size-bounded by caller
-    catch (e) {
-      throw new OpenApiError("openapi/bad-json",
-        "openapi.parse: invalid JSON — " + e.message);
-    }
-  } else if (jsonStringOrObject != null && typeof jsonStringOrObject === "object") {
-    doc = jsonStringOrObject;
-  } else {
-    throw new OpenApiError("openapi/bad-input",
-      "openapi.parse: input must be a JSON string or a plain object");
-  }
+  // A JSON string is parsed through safeJson (proto-pollution-key strip + depth
+  // / size caps — a raw JSON.parse here kept a "__proto__" member and was
+  // unbounded on an operator-supplied document); a pre-built object passes
+  // through. The 16 MiB cap is generous for any real OpenAPI document.
+  var doc = safeJson.parseStringOrObject(jsonStringOrObject, {
+    maxBytes:   C.BYTES.mib(16),
+    errorClass: OpenApiError,
+    jsonCode:   "openapi/bad-json",
+    inputCode:  "openapi/bad-input",
+    label:      "openapi.parse",
+  });
   var errors = [];
   if (typeof doc.openapi !== "string") {
     errors.push("missing or non-string `openapi` version field (must be 3.1.x or 3.2.x)");

package/lib/vendor/blamejs/lib/safe-json.js

@@ -240,6 +240,61 @@ function parseOrDefault(input, fallback, opts) {
   catch (_e) { return fallback; }
 }
 
+/**
+ * @primitive b.safeJson.parseStringOrObject
+ * @signature b.safeJson.parseStringOrObject(input, opts?)
+ * @since     0.15.29
+ * @status    stable
+ * @related   b.safeJson.parse
+ *
+ * Accept EITHER a JSON string — parsed through `parse`, so the
+ * proto-pollution-key strip, depth/key caps, and size cap all apply — OR an
+ * already-decoded plain object (returned unchanged). This is the recurring
+ * "operator hands me a document as a JSON string or a pre-built object" surface
+ * (b.openapi / b.asyncapi). Routing it here means a raw `JSON.parse` on operator
+ * input — which keeps a `"__proto__"` member as an own key and imposes no size
+ * bound — cannot be hand-rolled per consumer. The divergence each consumer needs
+ * (its typed error class + codes + a generous document size cap) is carried as
+ * data, so there is no per-consumer branch.
+ *
+ * @opts
+ *   maxBytes:   number,    // forwarded to parse (default 1 MiB; capped 64 MiB)
+ *   maxDepth:   number,    // forwarded to parse
+ *   maxKeys:    number,    // forwarded to parse
+ *   errorClass: function,  // typed error class to throw (else SafeJsonError)
+ *   jsonCode:   string,    // error code for invalid JSON (used with errorClass)
+ *   inputCode:  string,    // error code for a non-string/non-object input
+ *   label:      string,    // message prefix (default "safeJson.parseStringOrObject")
+ *
+ * @example
+ *   var doc = b.safeJson.parseStringOrObject(input, {
+ *     maxBytes: C.BYTES.mib(16), errorClass: OpenApiError,
+ *     jsonCode: "openapi/bad-json", inputCode: "openapi/bad-input",
+ *     label: "openapi.parse",
+ *   });
+ */
+function parseStringOrObject(input, opts) {
+  opts = opts || {};
+  var label = opts.label || "safeJson.parseStringOrObject";
+  if (typeof input === "string") {
+    try { return parse(input, opts); }
+    catch (e) {
+      if (typeof opts.errorClass === "function") {
+        throw new opts.errorClass(opts.jsonCode, label + ": invalid JSON — " + (e && e.message));
+      }
+      throw e;
+    }
+  }
+  if (input !== null && typeof input === "object" &&
+      !Buffer.isBuffer(input) && !(input instanceof Uint8Array)) {
+    return input;
+  }
+  if (typeof opts.errorClass === "function") {
+    throw new opts.errorClass(opts.inputCode, label + ": input must be a JSON string or a plain object");
+  }
+  throw new SafeJsonError(label + ": input must be a JSON string or a plain object", "json/wrong-input-type");
+}
+
 function _stripProtoKeys(key, value) {
   if (pick.isPoisonedKey(key)) return undefined;
   return value;
@@ -997,6 +1052,7 @@ function isJsonObject(value) {
 module.exports = {
   parse:          parse,
   parseOrDefault: parseOrDefault,
+  parseStringOrObject: parseStringOrObject,
   isJsonObject:   isJsonObject,
   stringify:      stringify,
   stringifyForScript: stringifyForScript,

package/lib/vendor/blamejs/lib/sandbox.js

@@ -31,7 +31,9 @@
  *   - Timeout (default: 250ms, max: 10s) terminates the worker.
  *   - Heap caps (maxOldGenerationSizeMb / maxYoungGenerationSizeMb)
  *     derived from maxBytes; v8 kills the worker on overflow.
- *   - Result size cap = maxBytes / 4.
+ *   - Result size cap = min(maxBytes / 4, 64 MiB) - the host re-parses
+ *     the untrusted result through safeJson, whose hard ceiling bounds
+ *     it at 64 MiB regardless of a larger maxBytes.
  *
  * Allowed-globals list:
  *   The allowed opt names which extra globals operator source may
@@ -63,7 +65,7 @@
  *   - sandbox/bad-input           - input is not JSON-serializable
  *   - sandbox/input-too-large     - JSON.stringify(input).length > maxBytes
  *   - sandbox/timeout             - worker exceeded timeoutMs
- *   - sandbox/oversized-result    - worker output > maxBytes / 4
+ *   - sandbox/oversized-result    - worker output > min(maxBytes / 4, 64 MiB)
  *   - sandbox/parse-error         - source did not parse inside the worker
  *   - sandbox/runtime-error       - operator transform threw
  *   - sandbox/spawn-failed        - worker thread failed to spawn
@@ -83,6 +85,7 @@ var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
 var numericBounds = require("./numeric-bounds");
 var safeBuffer = require("./safe-buffer");
+var safeJson = require("./safe-json");
 var C = require("./constants");
 var { SandboxError } = require("./framework-error");
 
@@ -236,9 +239,14 @@ function run(opts) {
     stackSizeMb:              stackMib,
   };
 
-  // Reserve 1/4 of maxBytes as the per-result hard cap. The worker
-  // refuses any result whose stringified form exceeds this.
-  var maxResultBytes = Math.floor(maxBytes / 4);
+  // Reserve 1/4 of maxBytes as the per-result hard cap, clamped to the
+  // host-side JSON parse ceiling so the worker's output cap and the host's
+  // safeJson.parse cap agree exactly. Without the clamp a sandbox with
+  // maxBytes over 256 MiB would let the worker emit a result the host then
+  // refuses (safeJson hard-caps at ABSOLUTE_MAX_BYTES) — the worker refuses
+  // it too, so an oversized untrusted result fails the same way on both
+  // sides rather than passing the worker and crossing to a rejecting host.
+  var maxResultBytes = Math.min(Math.floor(maxBytes / 4), safeJson.ABSOLUTE_MAX_BYTES);
 
   return new Promise(function (resolve, reject) {
     var startedAt = Date.now();
@@ -312,7 +320,11 @@ function run(opts) {
       var peakBytes = (typeof msg.peakBytes === "number") ? msg.peakBytes : 0;
       if (msg.ok) {
         var parsed;
-        try { parsed = (msg.resultJson === undefined) ? undefined : JSON.parse(msg.resultJson); }   // allow:bare-json-parse — resultJson is produced by lib/sandbox-worker.js via JSON.stringify and bounded by maxResultBytes; never directly from operator/network input
+        // resultJson is the JSON.stringify of UNTRUSTED sandboxed code's return
+        // value: parse it through safeJson so a "__proto__" member is stripped
+        // and a pathologically deep/large result is bounded (maxResultBytes), not
+        // a raw JSON.parse that re-creates the key and is depth-unbounded.
+        try { parsed = (msg.resultJson === undefined) ? undefined : safeJson.parse(msg.resultJson, { maxBytes: maxResultBytes }); }
         catch (eParse) {
           _emitAudit("sandbox.run.refused", "failure", {
             reason: "sandbox/bad-result-json", runtimeMs: runtimeMs, peakBytes: peakBytes, sourceBytes: sourceBytes,

package/lib/vendor/blamejs/lib/vex.js

@@ -48,6 +48,8 @@
  */
 
 var canonicalJson = require("./canonical-json");
+var safeJson = require("./safe-json");
+var C = require("./constants");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -633,7 +635,10 @@ function serialize(doc) {
   // of truth for sort/scrub behaviour across the framework (rule
   // §canonicalize).
   var canonical = canonicalJson.stringify(doc);
-  return JSON.stringify(JSON.parse(canonical), null, 2);   // allow:bare-json-parse — canonical is canonicalJson.stringify output, not operator input
+  // Re-indent the canonical bytes for human-diffable output. allowProto keeps
+  // the canonicalizer's exact key set (this is a faithful re-format of trusted
+  // framework output, not a defense boundary); the size cap bounds the parse.
+  return JSON.stringify(safeJson.parse(canonical, { allowProto: true, maxBytes: C.BYTES.mib(16) }), null, 2);
 }
 
 module.exports = {

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.27",
+  "version": "0.15.29",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.15.28.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.15.28",
+  "date": "2026-06-25",
+  "headline": "`b.network.dns` and `b.network.tls` errors now carry a usable terminal-vs-transient signal on `err.permanent`, so a caller's retry loop re-attempts only the failures a retry can fix",
+  "summary": "DnsError was declared always-transient and NetworkTlsError always-permanent, so a consumer driving its own retry loop got the wrong signal in both directions: it would retry a permanent DNS failure (a bad host, bad options, an unsupported query, an NXDOMAIN-style no-result, or a caller-shape/config error such as an unconfigured transport or an invalid resolver list) forever, and it would refuse to retry a transient TLS-over-network failure (an ECH connection failure, a handshake timeout, DNS momentarily unavailable). err.permanent now reflects each error's actual transience, derived from its code and failing closed (an unknown code is permanent, so a hopeless target is not retried indefinitely): for DnsError only a failed network round-trip (a lookup timeout, a resolve/reverse query that failed on the wire, a failed DoH/DoT exchange, a DDR discovery that found nothing) is transient — config, input, and environment errors raised before any network work are permanent; for NetworkTlsError only the network-layer ECH failures are transient. TlsTrustError remains always-permanent by design — a trust-verification failure (bad CA, fingerprint mismatch, OCSP not-good, CT violation, an unreachable OCSP responder) must never be silently retried past the trust decision.",
+  "sections": [
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "DnsError / NetworkTlsError expose a correct terminal/transient signal; TlsTrustError stays terminal",
+          "body": "b.network.dns's DnsError was always-transient and b.network.tls's NetworkTlsError always-permanent, so err.permanent misled a consumer's retry loop in both directions — retrying a permanent DNS error (bad host / options / unsupported type / no-result) indefinitely, and never retrying a transient TLS network error (ECH connect failure, handshake timeout, DNS unavailable). err.permanent now reflects each error's actual transience by code and fails closed (unknown codes are permanent): DnsError is transient only for a failed network round-trip (dns/lookup-timeout, dns/resolve-failed, dns/reverse-failed, dns/doh-failed, dns/dot-failed, dns/dot-handshake-failed, dns/ddr-not-discovered, dns/system-failed), and permanent otherwise — including the caller-shape / environment errors raised before any network work (dns/transport-unavailable for an unconfigured transport, dns/dnr-no-resolvers for an empty/invalid resolver list, dns/setservers-failed for an invalid address, dns/no-system-resolvers when none are configured). NetworkTlsError is transient only for the network-layer ECH failures (tls/ech-connect-failed, tls/ech-timeout, tls/ech-dns-unavailable), permanent otherwise. TlsTrustError remains always-permanent so a trust-verification failure is never silently retried."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.15.29.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.15.29",
+  "date": "2026-06-25",
+  "headline": "JSON parsing of operator and untrusted input is routed through `b.safeJson` everywhere, so a `\"__proto__\"` member is stripped and the parse is size-bounded — `b.openapi.parse`, `b.asyncapi.parse`, and `b.sandbox.run` were using a raw `JSON.parse`",
+  "summary": "b.openapi.parse and b.asyncapi.parse parsed an operator-supplied document string with a raw JSON.parse, which re-creates a \"__proto__\" member as an own key and imposes no size bound; b.sandbox.run parsed the untrusted sandboxed code's serialized result the same way (proto member kept, depth unbounded). All three now route through b.safeJson, which strips the prototype-pollution keys and applies the depth / key / size caps. A new b.safeJson.parseStringOrObject primitive captures the recurring \"accept a document as a JSON string OR a pre-built object\" shape (a string is parsed safely, an object passes through) that openapi and asyncapi had each hand-rolled, with each consumer's typed error class and a generous document size cap passed as data. Valid input parses identically to before; a malicious or oversized document is now defused rather than accepted.",
+  "sections": [
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "Operator and untrusted JSON parses strip __proto__ and bound size (no raw JSON.parse)",
+          "body": "A raw JSON.parse keeps a \"__proto__\" object member as an own key (a prototype-pollution gadget for any downstream merge) and parses unbounded input. b.openapi.parse and b.asyncapi.parse used it on operator document strings, and b.sandbox.run used it on the untrusted sandboxed code's JSON-serialized result. All now route through b.safeJson — the prototype-pollution keys are stripped and the depth / key / size caps apply (a 16 MiB document cap for openapi/asyncapi, the existing result-bytes cap for the sandbox). Internal JSON parses (the sealed DSR store payloads, the VEX canonical re-format) route through the same primitive too, so the guarantee cannot be bypassed one call site at a time. Valid input is unaffected; a \"__proto__\"-laden or oversized payload is defused."
+        }
+      ]
+    },
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "b.safeJson.parseStringOrObject(input, opts?)",
+          "body": "Accepts either a JSON string — parsed through b.safeJson.parse, so the prototype-pollution-key strip and depth / key / size caps apply — or an already-decoded plain object (returned unchanged). For the recurring \"operator hands me a document as a JSON string or a pre-built object\" surface (b.openapi / b.asyncapi). The consumer's typed error class, error codes, label, and size cap are passed as options, so a raw JSON.parse on operator input cannot be hand-rolled per consumer."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/00-primitives.js

@@ -13645,6 +13645,41 @@ function testJsonParse() {
   check("parse accepts Buffer input",                     fromBuf.y === 2);
 }
 
+function testJsonParseStringOrObject() {
+  // String → parsed through parse() (proto strip + caps); valid input is
+  // byte-identical to a raw JSON.parse.
+  var fromStr = b.safeJson.parseStringOrObject('{"a":1,"b":[2,3]}');
+  check("parseStringOrObject parses a string",            fromStr.a === 1 && fromStr.b[1] === 3);
+  // Object → passed through unchanged (same reference).
+  var obj = { openapi: "3.0.0" };
+  check("parseStringOrObject passes an object through",   b.safeJson.parseStringOrObject(obj) === obj);
+  // The proto-pollution defense applies to the STRING path (a raw JSON.parse
+  // would keep "__proto__" as an own key); the marker'd hand-rolls bypassed it.
+  var stripped = b.safeJson.parseStringOrObject('{"__proto__":{"isAdmin":true},"name":"alice"}');
+  check("parseStringOrObject strips __proto__ from a string", stripped.isAdmin === undefined && stripped.name === "alice");
+  check("parseStringOrObject does not pollute Object.prototype", ({}).isAdmin === undefined);
+  // maxBytes is enforced on the string path.
+  var capped = false;
+  try { b.safeJson.parseStringOrObject('{"x":"' + new Array(2000).join("y") + '"}', { maxBytes: 100 }); }
+  catch (e) { capped = e.code === "json/too-large"; }
+  check("parseStringOrObject enforces maxBytes",          capped);
+  // A typed errorClass wraps invalid JSON / wrong input type with the caller's codes.
+  function MyErr(code, msg) { this.code = code; this.message = msg; }
+  var jc = null;
+  try { b.safeJson.parseStringOrObject("{not json", { errorClass: MyErr, jsonCode: "x/bad-json", inputCode: "x/bad-input" }); }
+  catch (e) { jc = e.code; }
+  check("parseStringOrObject wraps invalid JSON via errorClass",   jc === "x/bad-json");
+  var ic = null;
+  try { b.safeJson.parseStringOrObject(42, { errorClass: MyErr, jsonCode: "x/bad-json", inputCode: "x/bad-input" }); }
+  catch (e) { ic = e.code; }
+  check("parseStringOrObject wraps wrong input via errorClass",    ic === "x/bad-input");
+  // Without errorClass, a non-string/non-object throws the framework SafeJsonError.
+  var sje = false;
+  try { b.safeJson.parseStringOrObject(123); }
+  catch (e) { sje = e.code === "json/wrong-input-type"; }
+  check("parseStringOrObject throws SafeJsonError without errorClass", sje);
+}
+
 function testJsonStringify() {
   var s = b.safeJson.stringify({ a: 1, b: [1, 2, 3] });
   check("stringify produces valid JSON",                  JSON.parse(s).a === 1);
@@ -19005,6 +19040,7 @@ async function run() {
   // json-safe primitive
   testJsonModuleSurface();
   testJsonParse();
+  testJsonParseStringOrObject();
   testJsonStringify();
   testJsonCanonical();
   testJsonValidate();
@@ -19598,6 +19634,7 @@ module.exports = {
   testLazyRequire:                           testLazyRequire,
   testJsonModuleSurface:                     testJsonModuleSurface,
   testJsonParse:                             testJsonParse,
+  testJsonParseStringOrObject:               testJsonParseStringOrObject,
   testJsonStringify:                         testJsonStringify,
   testJsonCanonical:                         testJsonCanonical,
   testJsonValidate:                          testJsonValidate,

package/lib/vendor/blamejs/test/layer-0-primitives/access-lock.test.js

@@ -124,7 +124,7 @@ function testCreateRefusesBadStartMode() {
   check("create refuses bad startMode", threw);
 }
 
-(function run() {
+function run() {
   testOpenModePassesEverything();
   testReadOnlyModeRefusesWrites();
   testLockedModeRefusesEverythingExceptPassthrough();
@@ -133,4 +133,7 @@ function testCreateRefusesBadStartMode() {
   testSetRefusesUnknownMode();
   testCreateRefusesBadStartMode();
   console.log("OK — access-lock tests");
-})();
+}
+
+module.exports = { run: run };
+if (require.main === module) run();

package/lib/vendor/blamejs/test/layer-0-primitives/age-gate.test.js

@@ -18,7 +18,7 @@ function _mockRes() {
   };
 }
 
-(function run() {
+function run() {
   var aboveCalls = 0;
   var ag = b.middleware.ageGate({
     audit: false,
@@ -88,4 +88,7 @@ function _mockRes() {
   check("ageGate refuses non-fn getAge", threwBadGetAge);
 
   console.log("OK — ageGate tests");
-})();
+}
+
+module.exports = { run: run };
+if (require.main === module) run();

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -299,7 +299,6 @@ var VALID_ALLOW_CLASSES = {
   "backup-adapter-storage-without-posture-check": 1,
   "bare-canonicalize-walk": 1,
   "bare-error-throw": 1,
-  "bare-json-parse": 1,
   "bare-split-on-quoted-header": 1,
   "console-direct": 1,
   "deny-path-hardcoded-response": 1,
@@ -1595,17 +1594,18 @@ function testRawNewURL() {
 // ---- Pattern 14: silent JSON.parse() on operator-supplied data ----
 
 function testNoBareJsonParse() {
-  // `JSON.parse(operatorInput)` lacks the maxBytes / depth / proto
-  // pollution defenses that `safeJson.parse` adds. Internal JSON
-  // (vendor manifest, tests, internal state) is fine with bare parse.
+  // Inverse guard (NO allow path): every JSON parse in lib/ routes through
+  // `safeJson.parse` / `safeJson.parseStringOrObject`, which add the
+  // proto-pollution-key strip + depth / key / size caps a raw `JSON.parse`
+  // lacks. A raw `JSON.parse` re-creates a `"__proto__"` member as an own key
+  // and is unbounded — even "internal" callers (a sealed store payload, a
+  // sandbox worker's result, a canonical re-format) route through the primitive
+  // so the guarantee can't be bypassed one site at a time. safe-json.js IS the
+  // wrapper, so its own `JSON.parse` (the thing being wrapped) is the sole site.
   var matches = _scan(/\bJSON\.parse\(/);
-  // safe-json.js IS the safe wrapper; the bare JSON.parse call lives
-  // there by definition (it's what safe-json wraps with maxBytes /
-  // depth / proto-pollution defenses).
   matches = matches.filter(function (m) { return m.file !== "lib/safe-json.js"; });
-  matches = _filterMarkers(matches, "bare-json-parse");
-  _report("JSON.parse on operator input routes through safeJson.parse " +
-          "(or has allow marker)",
+  _report("JSON parse in lib/ routes through safeJson.parse / safeJson.parseStringOrObject " +
+          "(no raw JSON.parse — use the primitive; it carries the proto / depth / size defenses)",
     matches);
 }
 

package/lib/vendor/blamejs/test/layer-0-primitives/compliance-eaa.test.js

@@ -3,7 +3,7 @@ var helpers = require("../helpers");
 var b = helpers.b;
 var check = helpers.check;
 
-(function run() {
+function run() {
   var eaa = b.compliance.eaa.create({
     audit: false,
     productName: "Acme Portal",
@@ -33,4 +33,7 @@ var check = helpers.check;
   check("eaa refuses bad conformance", threwBadConformance);
 
   console.log("OK — compliance.eaa tests");
-})();
+}
+
+module.exports = { run: run };
+if (require.main === module) run();

package/lib/vendor/blamejs/test/layer-0-primitives/dsr.test.js

@@ -833,6 +833,42 @@ async function testDbStoreSealsAtRest() {
   }
 }
 
+async function testDbStoreLargePayloadRoundTrips() {
+  // A completed access/portability ticket can carry a data export larger
+  // than safeJson's 1 MiB parse default. The store reads its payload column
+  // back with the store-matched ceiling, so a multi-MiB ticket round-trips
+  // through get() and list() rather than failing json/too-large.
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    var h = _dbDsr();
+    var bigExport = "x".repeat(C.BYTES.mib(2)); // ~2 MiB > the 1 MiB read default
+    var ticket = {
+      id:                "dsr-big-1",
+      type:              "access",
+      status:            "completed",
+      subject:           { subjectId: "u-1", email: "alice@example.com", phone: "+15550001111" },
+      submittedAt:       Date.now(),
+      deadlineAt:        Date.now() + C.TIME.minutes(1),
+      processedAt:       Date.now(),
+      verificationLevel: "primary",
+      posture:           "gdpr",
+      export:            bigExport,
+    };
+    await h.store.insert(ticket);
+
+    var got = await h.store.get("dsr-big-1");
+    check("dbStore: >1 MiB ticket round-trips through get()",
+          got && got.export === bigExport && got.status === "completed");
+
+    var listed = await h.store.list({ subject: { email: "alice@example.com" } });
+    check("dbStore: >1 MiB ticket round-trips through list()",
+          listed.length === 1 && listed[0].export === bigExport);
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
 async function testDbStoreErasurePurgesPriorTickets() {
   var tmpDir = _tmp();
   await setupTestDb(tmpDir);
@@ -1056,6 +1092,7 @@ async function run() {
 
   // dbTicketStore at-rest sealing + erasure purge + upgrade path
   await testDbStoreSealsAtRest();
+  await testDbStoreLargePayloadRoundTrips();
   await testDbStoreErasurePurgesPriorTickets();
   await testDbStoreUpgradePath();
   await testDbStoreFindsLegacyKeyedMacRows();

package/lib/vendor/blamejs/test/layer-0-primitives/gdpr-ropa.test.js

@@ -3,7 +3,7 @@ var helpers = require("../helpers");
 var b = helpers.b;
 var check = helpers.check;
 
-(function run() {
+function run() {
   var ropa = b.gdpr.ropa.create({
     audit: false,
     controller: { name: "Acme", contact: "dpo@acme.example" },
@@ -38,4 +38,7 @@ var check = helpers.check;
   check("ropa.remove deletes",       ropa.list().length === 0);
 
   console.log("OK — gdpr.ropa tests");
-})();
+}
+
+module.exports = { run: run };
+if (require.main === module) run();

package/lib/vendor/blamejs/test/layer-0-primitives/guard-html-wcag.test.js

@@ -844,7 +844,7 @@ function testFormsStandalone() {
 
 // ---- Run all ----
 
-(function run() {
+function run() {
   testHtmlLangMissing();
   testHtmlLangPresent();
   testPageTitleMissing();
@@ -915,4 +915,7 @@ function testFormsStandalone() {
   testInputEmailNoAutocomplete();
   testSkipForms();
   testFormsStandalone();
-})();
+}
+
+module.exports = { run: run };
+if (require.main === module) run();

package/lib/vendor/blamejs/test/layer-0-primitives/network-dns.test.js

@@ -220,6 +220,35 @@ async function _drainTcpHandles() {
   }, { timeoutMs: 5000, label: "network-dns: TCP handle drain after _resetForTest" });
 }
 
+// DnsError carries a terminal-vs-transient signal on err.permanent so a caller
+// driving a retry loop re-attempts only the failures a retry can fix. Fails
+// CLOSED: network / resolver-availability failures are transient; bad config,
+// malformed input, NXDOMAIN-style no-result, and any unknown code are permanent.
+function testDnsErrorPermanentClassification() {
+  var DnsError = dnsModule.DnsError;
+  check("DnsError exported", typeof DnsError === "function");
+  // Permanent — config / input / no-answer (retrying cannot fix these).
+  check("DnsError dns/bad-host is permanent",        new DnsError("dns/bad-host", "x").permanent === true);
+  check("DnsError dns/bad-transport is permanent",   new DnsError("dns/bad-transport", "x").permanent === true);
+  check("DnsError dns/unsupported-type is permanent", new DnsError("dns/unsupported-type", "x").permanent === true);
+  check("DnsError dns/no-result is permanent",       new DnsError("dns/no-result", "x").permanent === true);
+  check("DnsError unknown code is permanent (fail closed)", new DnsError("dns/never-defined", "x").permanent === true);
+  // Caller-shape / environment config errors raised before any network work are
+  // permanent — a retry cannot make absent config or invalid input valid.
+  check("DnsError dns/transport-unavailable is permanent (transport not configured)",
+        new DnsError("dns/transport-unavailable", "x").permanent === true);
+  check("DnsError dns/dnr-no-resolvers is permanent (empty/invalid resolver list)",
+        new DnsError("dns/dnr-no-resolvers", "x").permanent === true);
+  check("DnsError dns/setservers-failed is permanent (invalid resolver address)",
+        new DnsError("dns/setservers-failed", "x").permanent === true);
+  check("DnsError dns/no-system-resolvers is permanent (none configured)",
+        new DnsError("dns/no-system-resolvers", "x").permanent === true);
+  // Transient — a network round-trip that a retry can plausibly fix.
+  check("DnsError dns/lookup-timeout is transient",  new DnsError("dns/lookup-timeout", "x").permanent === false);
+  check("DnsError dns/resolve-failed is transient",  new DnsError("dns/resolve-failed", "x").permanent === false);
+  check("DnsError dns/dot-failed is transient",      new DnsError("dns/dot-failed", "x").permanent === false);
+}
+
 async function run() {
   try { await _runTests(); }
   finally { await _drainTcpHandles(); }
@@ -228,6 +257,8 @@ async function run() {
 async function _runTests() {
   _resetAll();
 
+  testDnsErrorPermanentClassification();
+
   // ============================================================
   // Item B4 — SVCB / HTTPS rdata parsing
   // ============================================================

package/lib/vendor/blamejs/test/layer-0-primitives/network-tls.test.js

@@ -452,7 +452,40 @@ function testInsecureTlsAudit() {
   check("auditInsecureTls is drop-silent on bad input (never throws into a connect)", threw === false);
 }
 
+// NetworkTlsError carries a terminal-vs-transient signal on err.permanent;
+// TlsTrustError is always permanent (a trust-verification failure must never be
+// silently retried). Fails CLOSED: only the network-layer ECH failures are
+// transient; bad options, malformed config, PKIX validation, and unknown codes
+// are permanent.
+function testNetworkTlsErrorPermanentClassification() {
+  var NetworkTlsError = b.network.tls.NetworkTlsError;
+  var TlsTrustError   = b.network.tls.TlsTrustError;
+  // NetworkTlsError — permanent (config / validation, retry cannot fix).
+  check("NetworkTlsError bad-tls-options is permanent",
+        new NetworkTlsError("network-tls/bad-tls-options", "x").permanent === true);
+  check("NetworkTlsError pkix-hostname-mismatch is permanent",
+        new NetworkTlsError("tls/pkix-hostname-mismatch", "x").permanent === true);
+  check("NetworkTlsError ech-config-malformed is permanent",
+        new NetworkTlsError("tls/ech-config-malformed", "x").permanent === true);
+  check("NetworkTlsError unknown code is permanent (fail closed)",
+        new NetworkTlsError("tls/never-defined", "x").permanent === true);
+  // NetworkTlsError — transient (network-layer ECH failure, a retry may succeed).
+  check("NetworkTlsError ech-connect-failed is transient",
+        new NetworkTlsError("tls/ech-connect-failed", "x").permanent === false);
+  check("NetworkTlsError ech-timeout is transient",
+        new NetworkTlsError("tls/ech-timeout", "x").permanent === false);
+  check("NetworkTlsError ech-dns-unavailable is transient",
+        new NetworkTlsError("tls/ech-dns-unavailable", "x").permanent === false);
+  // TlsTrustError — ALWAYS permanent (trust failures, incl. a network failure
+  // during the trust check, must not auto-retry past a trust decision).
+  check("TlsTrustError ocsp-not-good is permanent",
+        new TlsTrustError("tls/ocsp-not-good", "x").permanent === true);
+  check("TlsTrustError connect-failed during trust is still permanent",
+        new TlsTrustError("tls/connect-failed", "x").permanent === true);
+}
+
 async function run() {
+  testNetworkTlsErrorPermanentClassification();
   testInsecureTlsAudit();
   testEchSurface();
   testEchParseDraft22();

package/lib/vendor/blamejs/test/layer-0-primitives/require-mtls.test.js

@@ -24,11 +24,14 @@ function _mockRes() {
   };
 }
 
-(function run() {
+function run() {
   var requireMtls = b.middleware.requireMtls({ audit: false });
   var noPeerRes = _mockRes();
   requireMtls(_mockReq({ authorized: false }), noPeerRes, function () {});
   check("requireMtls refuses unauthorized peer 401", noPeerRes._captured.status === 401);
 
   console.log("OK — requireMtls tests");
-})();
+}
+
+module.exports = { run: run };
+if (require.main === module) run();

package/lib/vendor/blamejs/test/layer-0-primitives/safe-xml.test.js

@@ -124,7 +124,7 @@ function testConstructorAttributeNoFalseDuplicate() {
         threw && threw.code === "xml/forbidden-name");
 }
 
-(function run() {
+function run() {
   try {
     testParsesAttributedElement();
     testRejectsDoctype();
@@ -140,4 +140,7 @@ function testConstructorAttributeNoFalseDuplicate() {
     process.exit(1);
   }
   console.log("OK — safe-xml tests");
-})();
+}
+
+module.exports = { run: run };
+if (require.main === module) run();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.4.107",
+  "version": "0.4.109",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {