@blamejs/blamejs-shop 0.4.108 → 0.4.110

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.4.x
 
+- v0.4.110 (2026-06-26) — **Inbound webhook bodies and external API responses are parsed through the size-bounded, prototype-pollution-stripping JSON primitive instead of a raw parse.** The remaining places that parsed externally-supplied JSON with a raw JSON.parse — the Stripe and PayPal inbound webhook bodies, the captcha provider's verification response, and the Stripe / PayPal / R2 API responses — now route through the framework's safe-JSON parser, which strips prototype-pollution keys ("__proto__") and bounds parse depth, key count, and byte size. This matters most for the PayPal webhook body, which is parsed up front before its signature is verified, and for every inbound or provider response that previously had no size bound. An audit confirmed the rest of the app's JSON parsing already reads only values it wrote itself to the database (validated at write time) or already used the safe parser, so those are unchanged. Valid payloads parse identically; a malformed, prototype-pollution-laden, or oversized body is now defused. No configuration changes. **Changed:** *Externally-supplied JSON (webhook bodies, provider responses) is parsed with the safe-JSON primitive* — The inbound Stripe and PayPal webhook bodies, the captcha siteverify response, and the Stripe / PayPal / R2 API responses were parsed with a raw JSON.parse, which keeps a "__proto__" member as an own key and imposes no size bound. These now route through the framework's safe-JSON parser (prototype-pollution-key strip + depth / key / size caps), so an inbound or external payload can no longer carry a prototype-pollution gadget or force an unbounded parse — notably the PayPal webhook body, which is decoded before its signature is verified. The change is parse-only: valid payloads decode exactly as before, each call keeps its existing error fallback, and the rest of the app's JSON parsing (values it serialized to its own database, validated at write time) is left as-is.
+
+- v0.4.109 (2026-06-26) — **Vendored framework refreshed to 0.15.29.** Updates the vendored blamejs framework to 0.15.29, an upstream security-hardening release. Upstream now routes the parsing of operator- and untrusted-supplied JSON through the framework's safe-JSON primitive — which strips prototype-pollution keys ("__proto__" and friends) and bounds parse depth, key count, and byte size — instead of a raw JSON.parse, across the OpenAPI and AsyncAPI document parsers, the sandbox result decoder, and the internal sealed-store and VEX parses. This storefront consumes those surfaces through the vendored framework, so the hardening applies on upgrade with no API or configuration change and no operator action required. Valid input parses identically; a "__proto__"-laden or oversized payload is defused. **Changed:** *Vendored framework refreshed to 0.15.29* — Refreshes the vendored blamejs framework to 0.15.29. Upstream routes operator- and untrusted-supplied JSON through the safe-JSON primitive (prototype-pollution-key strip + depth / key / size caps, fail-closed) rather than a raw JSON.parse — in the OpenAPI / AsyncAPI parsers, the sandbox result decoder, and the internal sealed-store and VEX parses — and adds a parse-string-or-object helper so a raw JSON.parse on operator input can't be reintroduced one call site at a time. Valid documents are unaffected; a prototype-pollution-laden or oversized payload is now stripped and bounded. No runtime API change and no operator action required.
+
 - v0.4.108 (2026-06-26) — **Vendored framework refreshed to 0.15.28.** Updates the vendored blamejs framework to 0.15.28. The upstream change corrects the terminal-vs-transient retry signal (err.permanent) on the framework's DNS and TLS network errors, so the vendored HTTP client's internal retry behavior only re-attempts failures a retry can actually fix and stops retrying hopeless ones. This storefront consumes those network primitives only transitively through the vendored HTTP client (payment-provider and outbound-webhook calls), so the improvement applies automatically with no API or configuration change and no operator action required. **Changed:** *Vendored framework refreshed to 0.15.28* — Refreshes the vendored blamejs framework to 0.15.28. Upstream, the DNS and TLS network errors now expose a correct err.permanent flag (fail-closed: an unknown code is treated as permanent), so a retry loop re-attempts only transient network round-trip failures and never spins on a permanent one — while a trust-verification failure stays terminal and is never silently retried. This storefront uses these primitives only through the vendored HTTP client, so the better retry behavior applies transitively to payment-provider and outbound-webhook calls; there is no API change and no operator action required.
 
 - v0.4.107 (2026-06-25) — **Vendored framework refreshed to 0.15.27.** Updates the vendored blamejs framework to 0.15.27. The 0.15.27 release is an upstream test-harness reliability change only — its published library is byte-for-byte identical to 0.15.26, with no runtime API or behavior change. No operator action required. **Changed:** *Vendored framework refreshed to 0.15.27* — Refreshes the vendored blamejs framework to 0.15.27, an upstream release whose shipped library is byte-for-byte identical to 0.15.26 (the change is to the framework's own test harness). There are no runtime API changes and no operator-visible behavior change; no action is required.

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.4.108",
+  "version": "0.4.110",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-imfe0otYErcB8rr2h6KLSGTtStirysptpXETSPY4zLv3bZoIT75Lo1dOvkOav+xL",

package/lib/payment.js

@@ -280,7 +280,7 @@ async function _verifyWebhook(headers, rawBody, secret, opts) {
   }
 
   try {
-    return { ok: true, event: JSON.parse(rawBody) };
+    return { ok: true, event: b.safeJson.parse(rawBody) };
   } catch (_e) {
     return { ok: false, reason: "bad-json" };
   }
@@ -335,7 +335,7 @@ async function _stripeCall(opts, method, path, params, idempotencyKey) {
     });
     var text = res.body && res.body.toString ? res.body.toString("utf8") : "";
     var parsed = null;
-    try { parsed = text.length ? JSON.parse(text) : {}; } catch (_e) { parsed = { _raw: text }; }
+    try { parsed = text.length ? b.safeJson.parse(text) : {}; } catch (_e) { parsed = { _raw: text }; }
     if (res.statusCode < 200 || res.statusCode >= 300) {
       var err = new Error("stripe: " + method + " " + path + " → HTTP " + res.statusCode +
                           (parsed && parsed.error && parsed.error.message ? " — " + parsed.error.message : ""));
@@ -919,7 +919,7 @@ async function _paypalToken(opts, state) {
       allowedHosts: [_paypalAllowedHost(opts)],
     });
     var text = res.body && res.body.toString ? res.body.toString("utf8") : "";
-    var parsed; try { parsed = text.length ? JSON.parse(text) : {}; } catch (_e) { parsed = {}; }
+    var parsed; try { parsed = text.length ? b.safeJson.parse(text) : {}; } catch (_e) { parsed = {}; }
     if (res.statusCode < 200 || res.statusCode >= 300 || !parsed.access_token) {
       var err = new Error("paypal: OAuth2 token exchange failed → HTTP " + res.statusCode +
                           (parsed && parsed.error_description ? " — " + parsed.error_description : ""));
@@ -974,7 +974,7 @@ async function _paypalCall(opts, state, method, path, bodyObj, requestId, breake
       allowedHosts: [allowedHost],
     });
     var text = res.body && res.body.toString ? res.body.toString("utf8") : "";
-    var parsed; try { parsed = text.length ? JSON.parse(text) : {}; } catch (_e) { parsed = { _raw: text }; }
+    var parsed; try { parsed = text.length ? b.safeJson.parse(text) : {}; } catch (_e) { parsed = { _raw: text }; }
     if (res.statusCode < 200 || res.statusCode >= 300) {
       var detail = parsed && (parsed.message || (parsed.details && parsed.details[0] && parsed.details[0].description)) || "";
       var err = new Error("paypal: " + method + " " + path + " → HTTP " + res.statusCode + (detail ? " — " + detail : ""));
@@ -1130,7 +1130,7 @@ function paypal(opts) {
         return { ok: false, reason: "missing-transmission-headers" };
       }
       var event;
-      try { event = typeof rawBody === "string" ? JSON.parse(rawBody) : rawBody; }
+      try { event = typeof rawBody === "string" ? b.safeJson.parse(rawBody) : rawBody; }
       catch (_e) { return { ok: false, reason: "malformed-body" }; }
       var verifyBody = {
         auth_algo:         authAlgo,

package/lib/r2-bridge.js

@@ -140,7 +140,7 @@ function create(opts) {
       }
       var text = res.body && res.body.toString ? res.body.toString("utf8") : "";
       var json = null;
-      try { json = text.length ? JSON.parse(text) : null; } catch (_e) { json = null; }
+      try { json = text.length ? b.safeJson.parse(text) : null; } catch (_e) { json = null; }
       if (res.statusCode < 200 || res.statusCode >= 300) {
         var err = _httpErr(res.statusCode, "upload");
         if (json && json.error) {

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.15.28",
-      "tag": "v0.15.28",
+      "version": "0.15.29",
+      "tag": "v0.15.29",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",
@@ -850,6 +850,7 @@
         "release-notes/v0.15.26.json": "lib/vendor/blamejs/release-notes/v0.15.26.json",
         "release-notes/v0.15.27.json": "lib/vendor/blamejs/release-notes/v0.15.27.json",
         "release-notes/v0.15.28.json": "lib/vendor/blamejs/release-notes/v0.15.28.json",
+        "release-notes/v0.15.29.json": "lib/vendor/blamejs/release-notes/v0.15.29.json",
         "release-notes/v0.15.3.json": "lib/vendor/blamejs/release-notes/v0.15.3.json",
         "release-notes/v0.15.4.json": "lib/vendor/blamejs/release-notes/v0.15.4.json",
         "release-notes/v0.15.5.json": "lib/vendor/blamejs/release-notes/v0.15.5.json",
@@ -1559,7 +1560,7 @@
         ".npmrc": "sha256:66f104e7d07c496d2d0409988225e8c0e4ceb8d247dbcac3be75b2128d20ce66",
         ".pinact.yaml": "sha256:0213ffda55961dc49b64c0a5dfa3c0567419633b1499d57eaf7c8d842d7da6c7",
         "ARCHITECTURE.md": "sha256:9b1c8d2b1b7a41838eb348b0a008e4b4369718fd72bfe2974b37155f7536d35b",
-        "CHANGELOG.md": "sha256:44632bfff523c7ec344cf3394b536b476c3ff41ec7c2926f50d5f8b8322a863d",
+        "CHANGELOG.md": "sha256:12cbd8cd887ee507d270a0be83d2e5572cb034eaf7d47ff9ddaf69322b57a817",
         "CODE_OF_CONDUCT.md": "sha256:148a281960fff7c2fe6554dab66da572c72245ddeb00b0d14811558397bff386",
         "CONTRIBUTING.md": "sha256:bb4dbdbc8598da31dbce653a8ed322e08ff46560173f2eb67a4d684653948332",
         "GOVERNANCE.md": "sha256:906df6afb1f552b27b9acb50f7f96c47b917a2f1021cd4e987dbf4ee0e0a821b",
@@ -1569,7 +1570,7 @@
         "NOTICE": "sha256:f487fa47a11aca0f89e2615cdd3c713e9842abf7a30d8d328eeeae1c864aa774",
         "README.md": "sha256:3ddcc197b003da0b02db8bdd1aef1e943c94f7eab613c633d6a45bb11d0a80e9",
         "SECURITY.md": "sha256:77d8c2bcc04b425a08ef30e51204cebddbd48954b028a259c7a8412dbfeab40a",
-        "api-snapshot.json": "sha256:99a6f96b8f2044cace0fa369fd1cebc772043fd6bb1fdb76c722a5cb0729a502",
+        "api-snapshot.json": "sha256:58e5c4106b1fd4f10e1b838057abc26b4f28d2f2b6f1396ddcb5e72021c8623b",
         "assets/BlameJS_Logo.png": "sha256:3c65699753c771b48ef9ac7f45bb40815ec19a23afcdd0cd30ef4601bbbe293e",
         "assets/BlameJS_Logo.svg": "sha256:dda44f3fb1343d5de9db6b1fcdb75fc649c57e7a99a8e8239fcf852e3841e1a8",
         "bench/README.md": "sha256:74202f2507fd840bfc1ac6c681975d9273cf36cca6e0f72655f138337304033c",
@@ -1813,7 +1814,7 @@
         "lib/asn1-der.js": "sha256:bf085ff06bc12f08207ee641e63373ea2bf20e3dd52b8f6f026fd67700cf905c",
         "lib/asyncapi-bindings.js": "sha256:2f6f3d7ea836d0483e40f08b8202d78bae54bdc3d76b5faf57d918e699ebeac8",
         "lib/asyncapi-traits.js": "sha256:82ec58b77f0a65ef1b5e8b67ee9555e9cb984de769c3393fe5c6d4d0640546f0",
-        "lib/asyncapi.js": "sha256:c26da54ab6760da0043178abb85960e857b6e8f77f31dc3ced8db95760e25a00",
+        "lib/asyncapi.js": "sha256:cd48847ed363023e248cf0fbe275b545b0002b85e93ed91315990ef8a6abe483",
         "lib/atomic-file.js": "sha256:b93b008c121f785d149d4450681467b18785781c3a82b9b001bb2a7d636c3ad1",
         "lib/audit-chain.js": "sha256:1c9895a2bbf6ce3b4c546b1b3c95ac9d5ed55d82a2b58c0de4e3ecc1947c3c31",
         "lib/audit-daily-review.js": "sha256:61cebe47d6e5eeeedcab45515473acfaab623217810a7ab3629b3aeca5028519",
@@ -1848,7 +1849,7 @@
         "lib/auth/sd-jwt-vc-disclosure.js": "sha256:bc1eff5def71d2eedb6f17c8bede650050af9d790145e8697871c75ddc8431ae",
         "lib/auth/sd-jwt-vc-holder.js": "sha256:9d22b691e6a698aa2240c3ac611bc91e5b8d6acaa4b8fa03e28077ddb5fd56df",
         "lib/auth/sd-jwt-vc-issuer.js": "sha256:8cbfd25af7df5db7e7f61d004059530c46cc18fd1afbcebbe94f8f81f503c413",
-        "lib/auth/sd-jwt-vc.js": "sha256:3485b354f420e8e6fe4d5231dd00e4037dcc7e0a014695e3ed5a20ec535d3815",
+        "lib/auth/sd-jwt-vc.js": "sha256:717df0e7162e11c76e47221d6877d2bf07dba9974c58cf84719bb365fce52ee0",
         "lib/auth/status-list.js": "sha256:2861dafbe8dab3d6fba161663850c35acf2eb1d29c481dd030339c5c013602a2",
         "lib/auth/step-up-policy.js": "sha256:dca5810bd13d1e4d279b9d34b3e777cf2455c938502b25b41c773e513d90b379",
         "lib/auth/step-up.js": "sha256:3c426fc31ccf4180a9958f3c9e81573fd90ea7afa7688e52b8547a74ea987fbd",
@@ -1932,7 +1933,7 @@
         "lib/dora.js": "sha256:1b2ed45582623978c9f1087a0a45b6707d1a3d7b5da9eb420f780ec44c6ddd37",
         "lib/dr-runbook.js": "sha256:4da7ce04f88e79e103c8cb349d833b716259b99dff4fceb40d2edbac638e6cbf",
         "lib/dsa.js": "sha256:93240f4a5477e06a1f76c90ddf27f0209324261bc841b237aa6d6023b796a32b",
-        "lib/dsr.js": "sha256:1d2cc42afffbf40ea917a1a8a952f77b87398c13d03e0e4107494f1cc27db545",
+        "lib/dsr.js": "sha256:784102f593cf3f42bda74288b291f5005fef7bf4f8569ef60f32d5fe1b0c7231",
         "lib/dual-control.js": "sha256:7b0bc61722be7df45d2ae161ed2a2ec7e33ac5f118175f29b4c58fec364b54e3",
         "lib/early-hints.js": "sha256:cb0daba98c9259f1ad7694db888e25a1f8df866ecbca6c19f7a976a22236b475",
         "lib/eat.js": "sha256:35030327fb3349f7f32ebea939a0d98d93cfca4c2c31a51bd2aaeb272d2a9e6a",
@@ -2201,7 +2202,7 @@
         "lib/openapi-schema-walk.js": "sha256:8a46b681dce7887902f59a86adf3fc6226eeb903e5205228a7397f7fec036efe",
         "lib/openapi-security.js": "sha256:091ca0f5ee89bda7474850eecb90be9501054f28390e9825139e1cad2bf997d7",
         "lib/openapi-yaml.js": "sha256:25b03bcd1c3d0c336aa597eaf79879c840a6b87b729195c573620a47cadaa0b4",
-        "lib/openapi.js": "sha256:94280b4945d8ddbe7f7484e8b425789f6380264f0a7f3ed8c0d9dc1c179140b8",
+        "lib/openapi.js": "sha256:497f251cf81a2b02c8ed9a17c99c5b3eec49f7d8fa1ed95ff363adf4c5d54a2a",
         "lib/otel-export.js": "sha256:c2f33ee7584638b5b27e2c52223eef111e1486da056d4cc5ef19e2e8a0322d9d",
         "lib/outbox.js": "sha256:7ce4a9540fc6a6f0b78897647e7b3cc1f4df900341b0966142228f45c6504486",
         "lib/pagination.js": "sha256:0b5141bc978dd727707cf4006fc928282c1c88508c8a4dec5bc7c42585d2e303",
@@ -2251,7 +2252,7 @@
         "lib/safe-dns.js": "sha256:60fbf77f8dfcc0ac66a943ba94f960a4a4b724c78f07f9150779525d3d460001",
         "lib/safe-ical.js": "sha256:a8f40466b21a1416d5aa3a5a09b75cd48c29be2f9aabec6632db26b9b7868e23",
         "lib/safe-icap.js": "sha256:23f334de6ee463238e26bf9612fc7bfc623519630674c48bf1590f2952c0568b",
-        "lib/safe-json.js": "sha256:be211b9ba0da82c95dd655eb764c06e4db6b76b901f4193a886761c062f57c7b",
+        "lib/safe-json.js": "sha256:fa42506b545f78dc8e184dd989843e777d0b04e1f61d38a7e062b4515ad76146",
         "lib/safe-jsonpath.js": "sha256:0d5a0191de5cba7564847d6419a63c9949fb310f6a77c5637d2ad7b8ca30623c",
         "lib/safe-mime.js": "sha256:885bf0b2932d5ad492ec981f21068e1f85bb6738383a140b27e33659b690931e",
         "lib/safe-mount-info.js": "sha256:790d047481e0a2c04d3dd1f6f1645e2d6fada2f1dd1efde93ca647d2177ca7d4",
@@ -2264,7 +2265,7 @@
         "lib/safe-url.js": "sha256:36e3d2c72e7adc5c90cce7f80e469cf50451ccadd3791a1e3aa406754a4ce6e1",
         "lib/safe-vcard.js": "sha256:be2964d302b9317206fab1740ebbd0acff00258b138810aa6d64ad6cc1797ce5",
         "lib/sandbox-worker.js": "sha256:eefe4e76b2a736208f2e2e90347fc1ff2c2018a98e06bca3103aeb6f96298c6b",
-        "lib/sandbox.js": "sha256:6b3a16b248864f090b172481d008009e47e7a1db7506b552e2ca460bff27ddea",
+        "lib/sandbox.js": "sha256:0fa2d3c7d52afa3091826083ec5b08fd8273e0a6fd33b207e714fd16b734d5b5",
         "lib/scheduler.js": "sha256:1e7ddf15a27776c738dc8112a3ef1c8fcc616f1c6f909ec2d549d3c96cdd9c80",
         "lib/scitt.js": "sha256:c094cef31630aed5dc7adbf494701ab0a825c79a4e406277cbc757ce54bfec9f",
         "lib/sd-notify.js": "sha256:2ef7395bbdab2ac4eb96083c57d401921c94278545f14427fc88cdd970bdb9eb",
@@ -2323,7 +2324,7 @@
         "lib/vendor/public-suffix-list.data.js": "sha256:c840d9ae5c6bf4a07967340a5c649df2c6a66a287db41e408461c46cc32348e6",
         "lib/vendor/simplewebauthn-server.cjs": "sha256:49411d893f5e9b0e2fcaa564b4ec7921f73a9a06229b5e53d49c1453ea1a365c",
         "lib/vendor/vendor-data-pubkey.js": "sha256:a12afa34cd7472e2eaebad2fcd44714102d3edd0601e45769404124a513926d0",
-        "lib/vex.js": "sha256:b45c1c9729dfc69f2140478d46eec91f47da94b5f440be36fa825cb733a718fc",
+        "lib/vex.js": "sha256:bed6880980e7f166fd30bbddab57d7fa06085aaae0dc13ed82a17531b76878b7",
         "lib/watcher.js": "sha256:8618da919affabbe4c4d33915647b3ee4b27e6ea091638f032d4bfead797baf8",
         "lib/web-push-vapid.js": "sha256:54d7d4beb764681bc97dc338490fc2afc3996a032e080401830206814b8c97f0",
         "lib/webhook-dispatcher.js": "sha256:f879d127c0c9ba81ee43ee2b1f38c3fac99d8ff97df1555707beda48caad53f8",
@@ -2340,7 +2341,7 @@
         "oss-fuzz/projects/blamejs/README.md": "sha256:ae13b7bb79ed8d69b1b3276e5562807a0349fb6e6b7d11cf1f683aad1eafdb4b",
         "oss-fuzz/projects/blamejs/build.sh": "sha256:0ced1cf21782c97be7f8d74faf5e27a308b60b2f858836fb5ca3b8c4e939a8f7",
         "oss-fuzz/projects/blamejs/project.yaml": "sha256:59f2cb83aa622325a175b77416fe155be15b70a9c798bd1a78bba05763b1b03d",
-        "package.json": "sha256:0e42d663df6e40194fe8542b545b73f46681f6e81b0047a4a6b87284f6ab27bf",
+        "package.json": "sha256:4f8db3f9b9bee033a270a974dd57ba37387f0d41073c8b6ce260073876edd105",
         "release-notes/v0.0.x.json": "sha256:7a49819f30068ee119000cad7010194882bb8bfaa12acbdab4dfc066efb7982f",
         "release-notes/v0.1.x.json": "sha256:6742a8c17f947c5cb76f69dead7eea86b942d80621d914b774ba5488e09937e5",
         "release-notes/v0.10.x.json": "sha256:fe498045daf88337bd3d987e5964aa42c99a50e1685b6f09e51f698b8687726f",
@@ -2370,6 +2371,7 @@
         "release-notes/v0.15.26.json": "sha256:a96b1c7409f863b5a920f51a92b653d5f7a0b671e000bb5dfc2e9bf47e4120dc",
         "release-notes/v0.15.27.json": "sha256:f9e8309bc32c2245ec8d0682e6205417879f090403727d4780b42c0536125f02",
         "release-notes/v0.15.28.json": "sha256:86d4b034ccd17a51abd706fcd3ec0c1dfca224ae92a74e8d501af1e6f57cb6aa",
+        "release-notes/v0.15.29.json": "sha256:9e912ac2c32bb84bf1d89b8cc5f04d73a78d74a2ac1be24e42e6462f5135b4f5",
         "release-notes/v0.15.3.json": "sha256:19a0074c445545468ca3cc411b21ec8bdb27be2669ae1950347cc244f6aa348c",
         "release-notes/v0.15.4.json": "sha256:6ac7fa0ef1728c27e71b2050d1b07a810f9b4b1440ccddbf28ad56e2f54d8585",
         "release-notes/v0.15.5.json": "sha256:cca1d0edd5d6fc41b512d19d98be224b990dcab41478622c11962f0fcb1bb09a",
@@ -2411,7 +2413,7 @@
         "scripts/vendor-data-gen.js": "sha256:76b627bc6e19b4a122edfca6f514bcb8ca11af02902f0957e641f503337a8a0f",
         "scripts/vendor-data-keygen.js": "sha256:94eaa4d8f832b4aac9ccbcb2a07e6b99cd35cf7b044e1412079cebdefc1f4c0e",
         "scripts/vendor-update.sh": "sha256:373d7f024b7caa3345a3598fa3a586078dd842f0071e6fdad00a473f48a3a929",
-        "test/00-primitives.js": "sha256:99992ebfdf1bcd14a8ac20c71d96741c11b9ff793c788f220226261652b07152",
+        "test/00-primitives.js": "sha256:918967f91118ca29fc24b7d25465c840c8fe2e3fd4e19fe09075db986e3fe230",
         "test/10-state.js": "sha256:45c177da8158bda413b783f68d9b01ef72796aec114c26acea084f92de874f57",
         "test/20-db.js": "sha256:241ef6b7ef305d077aeafb22ee3bcc75b6b549a8fa9b1a6b5d6d5fba43b48d7d",
         "test/30-chain.js": "sha256:81d3615c276138d9b71136047ce80f03170951a7ce1e6aa6be117cb673cca4f8",
@@ -2617,7 +2619,7 @@
         "test/layer-0-primitives/cluster-storage.test.js": "sha256:238b3b3db0eba3e6312a863710533178f566347b90e161e564481aa826707647",
         "test/layer-0-primitives/cluster-vault-rotation.test.js": "sha256:3514e9e71d6c39e805248f58ad2f41528d091e196c0f3766a032675677161b2d",
         "test/layer-0-primitives/cms-codec.test.js": "sha256:7e46078ed82be5b69d22c48f22dba37ea5015371c2a8cf5f94fb1a792fb7bb78",
-        "test/layer-0-primitives/codebase-patterns.test.js": "sha256:59c479be996fdec3635bbc75d05f4c8582043fbb026e2e67085f19b6b9412cce",
+        "test/layer-0-primitives/codebase-patterns.test.js": "sha256:38c5ad5bf99da425f563b892451a39a4ed3a323694c2fb9b43271f63e9075266",
         "test/layer-0-primitives/codepoint-class.test.js": "sha256:19d1b69efa7e0e9f7ef2392ca264167767a5ec5890ee339b2cfd8a7818035d27",
         "test/layer-0-primitives/compliance-ai-act.test.js": "sha256:5ee4ad05d12233cb3c5457ef10a727833710bbc1ce1318838f9f9ef5d2cb8d4b",
         "test/layer-0-primitives/compliance-cascade.test.js": "sha256:ee02cf14541a837a9d7977c6ea6bf7f9210bed293925d93c976e31f270aebec4",
@@ -2699,7 +2701,7 @@
         "test/layer-0-primitives/dr-runbook.test.js": "sha256:9665caaa90f356d0237e0e6c6889c56a3467b20c7eaf78d2e2afa51c4b3af2cb",
         "test/layer-0-primitives/dsa.test.js": "sha256:2cdbdd29b9c58d738920bb4f82f73492eab56e7d7f8111f1cdb14838de3a3ab3",
         "test/layer-0-primitives/dsr-state-rules.test.js": "sha256:0ddc7fd6d5d3f8817d8f4aad7bb66c6bf6e64eafe61fdedaafa8f60957d20bd0",
-        "test/layer-0-primitives/dsr.test.js": "sha256:e930c1cd058ac8de7280fd7e9a27373bf5d971ebe4e9133726c8f615811cd7c0",
+        "test/layer-0-primitives/dsr.test.js": "sha256:d7be3fcf28348936ffd73ec6bc06d59ea7ab22b40fa3316eba18c587d7575680",
         "test/layer-0-primitives/dual-control.test.js": "sha256:2d9255f96bddbb45d75182ef826a355536e40caeb5864483c56eaf5ba3c7e0ac",
         "test/layer-0-primitives/early-hints.test.js": "sha256:9827c66c7558ebeb39a448ec69129517a517d440865ac5341afcbc7c1047e085",
         "test/layer-0-primitives/eat.test.js": "sha256:6f0b0180f659b008a6a86f9af4f8674e2ddb98d00408e10d52d03291bda96f6e",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.29 (2026-06-25) — **JSON parsing of operator and untrusted input is routed through `b.safeJson` everywhere, so a `"__proto__"` member is stripped and the parse is size-bounded — `b.openapi.parse`, `b.asyncapi.parse`, and `b.sandbox.run` were using a raw `JSON.parse`.** b.openapi.parse and b.asyncapi.parse parsed an operator-supplied document string with a raw JSON.parse, which re-creates a "__proto__" member as an own key and imposes no size bound; b.sandbox.run parsed the untrusted sandboxed code's serialized result the same way (proto member kept, depth unbounded). All three now route through b.safeJson, which strips the prototype-pollution keys and applies the depth / key / size caps. A new b.safeJson.parseStringOrObject primitive captures the recurring "accept a document as a JSON string OR a pre-built object" shape (a string is parsed safely, an object passes through) that openapi and asyncapi had each hand-rolled, with each consumer's typed error class and a generous document size cap passed as data. Valid input parses identically to before; a malicious or oversized document is now defused rather than accepted. **Added:** *b.safeJson.parseStringOrObject(input, opts?)* — Accepts either a JSON string — parsed through b.safeJson.parse, so the prototype-pollution-key strip and depth / key / size caps apply — or an already-decoded plain object (returned unchanged). For the recurring "operator hands me a document as a JSON string or a pre-built object" surface (b.openapi / b.asyncapi). The consumer's typed error class, error codes, label, and size cap are passed as options, so a raw JSON.parse on operator input cannot be hand-rolled per consumer. **Security:** *Operator and untrusted JSON parses strip __proto__ and bound size (no raw JSON.parse)* — A raw JSON.parse keeps a "__proto__" object member as an own key (a prototype-pollution gadget for any downstream merge) and parses unbounded input. b.openapi.parse and b.asyncapi.parse used it on operator document strings, and b.sandbox.run used it on the untrusted sandboxed code's JSON-serialized result. All now route through b.safeJson — the prototype-pollution keys are stripped and the depth / key / size caps apply (a 16 MiB document cap for openapi/asyncapi, the existing result-bytes cap for the sandbox). Internal JSON parses (the sealed DSR store payloads, the VEX canonical re-format) route through the same primitive too, so the guarantee cannot be bypassed one call site at a time. Valid input is unaffected; a "__proto__"-laden or oversized payload is defused.
+
 - v0.15.28 (2026-06-25) — **`b.network.dns` and `b.network.tls` errors now carry a usable terminal-vs-transient signal on `err.permanent`, so a caller's retry loop re-attempts only the failures a retry can fix.** DnsError was declared always-transient and NetworkTlsError always-permanent, so a consumer driving its own retry loop got the wrong signal in both directions: it would retry a permanent DNS failure (a bad host, bad options, an unsupported query, an NXDOMAIN-style no-result, or a caller-shape/config error such as an unconfigured transport or an invalid resolver list) forever, and it would refuse to retry a transient TLS-over-network failure (an ECH connection failure, a handshake timeout, DNS momentarily unavailable). err.permanent now reflects each error's actual transience, derived from its code and failing closed (an unknown code is permanent, so a hopeless target is not retried indefinitely): for DnsError only a failed network round-trip (a lookup timeout, a resolve/reverse query that failed on the wire, a failed DoH/DoT exchange, a DDR discovery that found nothing) is transient — config, input, and environment errors raised before any network work are permanent; for NetworkTlsError only the network-layer ECH failures are transient. TlsTrustError remains always-permanent by design — a trust-verification failure (bad CA, fingerprint mismatch, OCSP not-good, CT violation, an unreachable OCSP responder) must never be silently retried past the trust decision. **Fixed:** *DnsError / NetworkTlsError expose a correct terminal/transient signal; TlsTrustError stays terminal* — b.network.dns's DnsError was always-transient and b.network.tls's NetworkTlsError always-permanent, so err.permanent misled a consumer's retry loop in both directions — retrying a permanent DNS error (bad host / options / unsupported type / no-result) indefinitely, and never retrying a transient TLS network error (ECH connect failure, handshake timeout, DNS unavailable). err.permanent now reflects each error's actual transience by code and fails closed (unknown codes are permanent): DnsError is transient only for a failed network round-trip (dns/lookup-timeout, dns/resolve-failed, dns/reverse-failed, dns/doh-failed, dns/dot-failed, dns/dot-handshake-failed, dns/ddr-not-discovered, dns/system-failed), and permanent otherwise — including the caller-shape / environment errors raised before any network work (dns/transport-unavailable for an unconfigured transport, dns/dnr-no-resolvers for an empty/invalid resolver list, dns/setservers-failed for an invalid address, dns/no-system-resolvers when none are configured). NetworkTlsError is transient only for the network-layer ECH failures (tls/ech-connect-failed, tls/ech-timeout, tls/ech-dns-unavailable), permanent otherwise. TlsTrustError remains always-permanent so a trust-verification failure is never silently retried.
 
 - v0.15.27 (2026-06-25) — **Internal test-harness reliability only — the published library is byte-for-byte identical to 0.15.26.** The legacy single-layer smoke files used fixed-duration setTimeout sleeps to wait for asynchronous conditions (a job processed, a lease TTL lapsing, an audit flush completing). On a contended CI runner a fixed sleep is both flake-prone (too short under load) and slow (it always burns the full budget). Those condition-waits are converted to the harness's polling helpers — waitUntil for observable predicates, passiveObserve for deliberate real-time elapses, withTestTimeout for hang guards — which exit early on fast platforms and give contended platforms the full budget. No shipped framework code changed; this release is byte-for-byte identical to 0.15.26 for operators. **Fixed:** *Smoke layer files poll for conditions instead of fixed setTimeout sleeps* — The single-layer smoke files waited on asynchronous conditions with fixed-duration setTimeout sleeps, which flake under SMOKE_PARALLEL load and always burn their full budget. The condition-waits are converted to the polling helpers (waitUntil / passiveObserve / withTestTimeout) so they exit early on fast platforms and stay robust on contended ones; non-wait timers (abort triggers, child/socket watchdogs, simulated-latency mocks) are unchanged. This is test-harness reliability only — no shipped framework behavior changed.

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.15.28",
-  "createdAt": "2026-06-26T05:54:16.583Z",
+  "frameworkVersion": "0.15.29",
+  "createdAt": "2026-06-26T06:52:58.579Z",
   "exports": {
     "a2a": {
       "type": "object",
@@ -50884,6 +50884,10 @@
           "type": "function",
           "arity": 3
         },
+        "parseStringOrObject": {
+          "type": "function",
+          "arity": 2
+        },
         "registerFormat": {
           "type": "function",
           "arity": 2

package/lib/vendor/blamejs/lib/asyncapi.js

@@ -40,6 +40,8 @@ var openapiSecurity     = require("./openapi-security");
 var openapiYaml         = require("./openapi-yaml");
 var bindingsMod         = require("./asyncapi-bindings");
 var traitsMod           = require("./asyncapi-traits");
+var safeJson            = require("./safe-json");
+var C                   = require("./constants");
 var { defineClass }     = require("./framework-error");
 var AsyncApiError = defineClass("AsyncApiError", { alwaysPermanent: true });
 
@@ -470,19 +472,17 @@ function _validateServerEntry(entry, label) {
  *   bad.errors[0];      // → 'operations.pub.channel: $ref "#/channels/missing" does not resolve to a declared channel'
  */
 function parse(jsonStringOrObject) {
-  var doc;
-  if (typeof jsonStringOrObject === "string") {
-    try { doc = JSON.parse(jsonStringOrObject); }                                       // allow:bare-json-parse — operator-supplied AsyncAPI doc; size-bounded by caller
-    catch (e) {
-      throw new AsyncApiError("asyncapi/bad-json",
-        "asyncapi.parse: invalid JSON — " + e.message);
-    }
-  } else if (jsonStringOrObject != null && typeof jsonStringOrObject === "object") {
-    doc = jsonStringOrObject;
-  } else {
-    throw new AsyncApiError("asyncapi/bad-input",
-      "asyncapi.parse: input must be a JSON string or a plain object");
-  }
+  // A JSON string is parsed through safeJson (proto-pollution-key strip + depth
+  // / size caps — a raw JSON.parse here kept a "__proto__" member and was
+  // unbounded on an operator-supplied document); a pre-built object passes
+  // through. The 16 MiB cap is generous for any real AsyncAPI document.
+  var doc = safeJson.parseStringOrObject(jsonStringOrObject, {
+    maxBytes:   C.BYTES.mib(16),
+    errorClass: AsyncApiError,
+    jsonCode:   "asyncapi/bad-json",
+    inputCode:  "asyncapi/bad-input",
+    label:      "asyncapi.parse",
+  });
   var errors = [];
   if (typeof doc.asyncapi !== "string") {
     errors.push("missing or non-string `asyncapi` version field (must be 3.0.x)");

package/lib/vendor/blamejs/lib/auth/sd-jwt-vc.js

@@ -165,8 +165,8 @@ function _verifyJwt(token, publicKey, algorithm) {
   var headerStr = _b64uDecodeStr(parts[0]);
   var payloadStr = _b64uDecodeStr(parts[1]);
   return {
-    header:  safeJson.parse(headerStr, { maxBytes: 64 * 1024 }),                    // allow:bare-json-parse — header from cryptographically-verified JWT; signature verifies the bytes // allow:raw-byte-literal — JWT header cap (64 KB)
-    payload: safeJson.parse(payloadStr, { maxBytes: 1024 * 1024 }),                 // allow:bare-json-parse — payload from cryptographically-verified JWT; signature verifies the bytes // allow:raw-byte-literal — JWT payload cap (1 MB)
+    header:  safeJson.parse(headerStr, { maxBytes: 64 * 1024 }),                    // allow:raw-byte-literal — JWT header cap (64 KB)
+    payload: safeJson.parse(payloadStr, { maxBytes: 1024 * 1024 }),                 // allow:raw-byte-literal — JWT payload cap (1 MB)
   };
 }
 
@@ -330,7 +330,7 @@ function present(opts) {
   if (_jwtParts.length === 3) {
     try {
       _issuerPayload = safeJson.parse(_b64uDecodeStr(_jwtParts[1]),
-        { maxBytes: 64 * 1024 });                                                                  // allow:bare-json-parse — payload only read to pull _sd_alg; final auth happens in verify() // allow:raw-byte-literal — JWT payload cap (64 KB)
+        { maxBytes: 64 * 1024 });                                                                  // allow:raw-byte-literal — JWT payload cap (64 KB)
     } catch (_e) { _issuerPayload = null; }
   }
   var _sdAlg = (_issuerPayload && typeof _issuerPayload._sd_alg === "string")
@@ -448,7 +448,7 @@ async function verify(presentation, opts) {
       "verify: JWT must have 3 dot-separated parts");
   }
   var headerObj;
-  try { headerObj = safeJson.parse(_b64uDecodeStr(jwtParts[0]), { maxBytes: 64 * 1024 }); }  // allow:bare-json-parse — pre-verify header parse to look up the key resolver; checked again post-signature // allow:raw-byte-literal — JWT header cap (64 KB)
+  try { headerObj = safeJson.parse(_b64uDecodeStr(jwtParts[0]), { maxBytes: 64 * 1024 }); }  // allow:raw-byte-literal — JWT header cap (64 KB)
   catch (e) {
     throw new AuthError("auth-sd-jwt-vc/bad-header",
       "verify: malformed JWT header: " + e.message);
@@ -622,7 +622,7 @@ async function verify(presentation, opts) {
     }
     // Verify KB-JWT signature
     var kbHeaderObj;
-    try { kbHeaderObj = safeJson.parse(_b64uDecodeStr(maybeKbJwt.split(".")[0]), { maxBytes: 4096 }); }  // allow:bare-json-parse — kb header from validated KB-JWT; signature verifies
+    try { kbHeaderObj = safeJson.parse(_b64uDecodeStr(maybeKbJwt.split(".")[0]), { maxBytes: 4096 }); }
     catch (e) {
       throw new AuthError("auth-sd-jwt-vc/bad-kb-header",
         "verify: malformed KB-JWT header: " + e.message);

package/lib/vendor/blamejs/lib/dsr.js

@@ -114,6 +114,7 @@ var bCrypto = require("./crypto");
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
 var safeSql = require("./safe-sql");
+var safeJson = require("./safe-json");
 var boundedMap = require("./bounded-map");
 var { defineClass } = require("./framework-error");
 
@@ -1142,12 +1143,23 @@ function dbTicketStore(opts) {
   // the derived lookup hashes are computed from the plaintext; vault-less
   // it stores plaintext (matching the agent-* fallback).
   function _sealColumns(id, ticket) {
+    // The payload column is read back through safeJson.parse, whose hard
+    // ceiling (safeJson.ABSOLUTE_MAX_BYTES) caps what any read can accept.
+    // Refuse a ticket whose serialized form exceeds that same ceiling on
+    // write so the store never holds a payload it cannot read back later
+    // (write cap == read cap, measured the same way: UTF-8 byte length).
+    var serializedPayload = JSON.stringify(ticket);
+    if (Buffer.byteLength(serializedPayload, "utf8") > safeJson.ABSOLUTE_MAX_BYTES) {
+      throw new DsrError("dsr/ticket-too-large",
+        "_sealColumns: ticket " + id + " payload exceeds the " +
+          safeJson.ABSOLUTE_MAX_BYTES + "-byte store limit");
+    }
     var row = {
       id:            id,
       subject_id:    (ticket.subject && ticket.subject.subjectId) || null,
       subject_email: (ticket.subject && ticket.subject.email)     || null,
       subject_phone: (ticket.subject && ticket.subject.phone)     || null,
-      payload:       JSON.stringify(ticket),
+      payload:       serializedPayload,
     };
     var out = {
       $sid:       row.subject_id,
@@ -1252,7 +1264,7 @@ function dbTicketStore(opts) {
       var rows = db.prepare("SELECT id, payload FROM " + qTable + " WHERE id = $id")
                    .all({ $id: id });
       if (!rows || rows.length === 0) return null;
-      return JSON.parse(_unsealPayload(rows[0].payload, rows[0].id));               // allow:bare-json-parse — payload was JSON.stringify-ed by this same store (unsealed above), never from operator/network input
+      return safeJson.parse(_unsealPayload(rows[0].payload, rows[0].id), { maxBytes: safeJson.ABSOLUTE_MAX_BYTES });
     },
     list: async function (filter) {
       filter = filter || {};
@@ -1267,7 +1279,7 @@ function dbTicketStore(opts) {
       if (conds.length > 0) sql += " WHERE " + conds.join(" AND ");
       sql += " ORDER BY submitted_at DESC";
       var rows = db.prepare(sql).all(params);
-      return rows.map(function (r) { return JSON.parse(_unsealPayload(r.payload, r.id)); });  // allow:bare-json-parse — payload was JSON.stringify-ed by this same store (unsealed above), never from operator/network input
+      return rows.map(function (r) { return safeJson.parse(_unsealPayload(r.payload, r.id), { maxBytes: safeJson.ABSOLUTE_MAX_BYTES }); });
     },
     update: async function (id, ticket) {
       var cols = _sealColumns(id, ticket);
@@ -1314,7 +1326,7 @@ function dbTicketStore(opts) {
       var del = db.prepare("DELETE FROM " + qTable + " WHERE id = $id");
       for (var i = 0; i < rows.length; i++) {
         try {
-          var t = JSON.parse(_unsealPayload(rows[i].payload, rows[i].id));          // allow:bare-json-parse — payload was JSON.stringify-ed by this same store (unsealed above), never from operator/network input
+          var t = safeJson.parse(_unsealPayload(rows[i].payload, rows[i].id), { maxBytes: safeJson.ABSOLUTE_MAX_BYTES });
           if (t.retentionUntil && t.retentionUntil < asOf) {
             del.run({ $id: rows[i].id });
             purged += 1;

package/lib/vendor/blamejs/lib/openapi.js

@@ -47,6 +47,8 @@ var schemaWalk            = require("./openapi-schema-walk");
 var pathsBuilderMod       = require("./openapi-paths-builder");
 var openapiSecurity       = require("./openapi-security");
 var openapiYaml           = require("./openapi-yaml");
+var safeJson              = require("./safe-json");
+var C                     = require("./constants");
 var { defineClass }       = require("./framework-error");
 var audit                 = lazyRequire(function () { return require("./audit"); });
 
@@ -520,19 +522,17 @@ function _validateItemOperations(item, label, errors, securitySchemes) {
  *   bad.errors[0];      // → 'path "users" must start with \'/\''
  */
 function parse(jsonStringOrObject) {
-  var doc;
-  if (typeof jsonStringOrObject === "string") {
-    try { doc = JSON.parse(jsonStringOrObject); }                                       // allow:bare-json-parse — operator-supplied OpenAPI doc; size-bounded by caller
-    catch (e) {
-      throw new OpenApiError("openapi/bad-json",
-        "openapi.parse: invalid JSON — " + e.message);
-    }
-  } else if (jsonStringOrObject != null && typeof jsonStringOrObject === "object") {
-    doc = jsonStringOrObject;
-  } else {
-    throw new OpenApiError("openapi/bad-input",
-      "openapi.parse: input must be a JSON string or a plain object");
-  }
+  // A JSON string is parsed through safeJson (proto-pollution-key strip + depth
+  // / size caps — a raw JSON.parse here kept a "__proto__" member and was
+  // unbounded on an operator-supplied document); a pre-built object passes
+  // through. The 16 MiB cap is generous for any real OpenAPI document.
+  var doc = safeJson.parseStringOrObject(jsonStringOrObject, {
+    maxBytes:   C.BYTES.mib(16),
+    errorClass: OpenApiError,
+    jsonCode:   "openapi/bad-json",
+    inputCode:  "openapi/bad-input",
+    label:      "openapi.parse",
+  });
   var errors = [];
   if (typeof doc.openapi !== "string") {
     errors.push("missing or non-string `openapi` version field (must be 3.1.x or 3.2.x)");

package/lib/vendor/blamejs/lib/safe-json.js

@@ -240,6 +240,61 @@ function parseOrDefault(input, fallback, opts) {
   catch (_e) { return fallback; }
 }
 
+/**
+ * @primitive b.safeJson.parseStringOrObject
+ * @signature b.safeJson.parseStringOrObject(input, opts?)
+ * @since     0.15.29
+ * @status    stable
+ * @related   b.safeJson.parse
+ *
+ * Accept EITHER a JSON string — parsed through `parse`, so the
+ * proto-pollution-key strip, depth/key caps, and size cap all apply — OR an
+ * already-decoded plain object (returned unchanged). This is the recurring
+ * "operator hands me a document as a JSON string or a pre-built object" surface
+ * (b.openapi / b.asyncapi). Routing it here means a raw `JSON.parse` on operator
+ * input — which keeps a `"__proto__"` member as an own key and imposes no size
+ * bound — cannot be hand-rolled per consumer. The divergence each consumer needs
+ * (its typed error class + codes + a generous document size cap) is carried as
+ * data, so there is no per-consumer branch.
+ *
+ * @opts
+ *   maxBytes:   number,    // forwarded to parse (default 1 MiB; capped 64 MiB)
+ *   maxDepth:   number,    // forwarded to parse
+ *   maxKeys:    number,    // forwarded to parse
+ *   errorClass: function,  // typed error class to throw (else SafeJsonError)
+ *   jsonCode:   string,    // error code for invalid JSON (used with errorClass)
+ *   inputCode:  string,    // error code for a non-string/non-object input
+ *   label:      string,    // message prefix (default "safeJson.parseStringOrObject")
+ *
+ * @example
+ *   var doc = b.safeJson.parseStringOrObject(input, {
+ *     maxBytes: C.BYTES.mib(16), errorClass: OpenApiError,
+ *     jsonCode: "openapi/bad-json", inputCode: "openapi/bad-input",
+ *     label: "openapi.parse",
+ *   });
+ */
+function parseStringOrObject(input, opts) {
+  opts = opts || {};
+  var label = opts.label || "safeJson.parseStringOrObject";
+  if (typeof input === "string") {
+    try { return parse(input, opts); }
+    catch (e) {
+      if (typeof opts.errorClass === "function") {
+        throw new opts.errorClass(opts.jsonCode, label + ": invalid JSON — " + (e && e.message));
+      }
+      throw e;
+    }
+  }
+  if (input !== null && typeof input === "object" &&
+      !Buffer.isBuffer(input) && !(input instanceof Uint8Array)) {
+    return input;
+  }
+  if (typeof opts.errorClass === "function") {
+    throw new opts.errorClass(opts.inputCode, label + ": input must be a JSON string or a plain object");
+  }
+  throw new SafeJsonError(label + ": input must be a JSON string or a plain object", "json/wrong-input-type");
+}
+
 function _stripProtoKeys(key, value) {
   if (pick.isPoisonedKey(key)) return undefined;
   return value;
@@ -997,6 +1052,7 @@ function isJsonObject(value) {
 module.exports = {
   parse:          parse,
   parseOrDefault: parseOrDefault,
+  parseStringOrObject: parseStringOrObject,
   isJsonObject:   isJsonObject,
   stringify:      stringify,
   stringifyForScript: stringifyForScript,

package/lib/vendor/blamejs/lib/sandbox.js

@@ -31,7 +31,9 @@
  *   - Timeout (default: 250ms, max: 10s) terminates the worker.
  *   - Heap caps (maxOldGenerationSizeMb / maxYoungGenerationSizeMb)
  *     derived from maxBytes; v8 kills the worker on overflow.
- *   - Result size cap = maxBytes / 4.
+ *   - Result size cap = min(maxBytes / 4, 64 MiB) - the host re-parses
+ *     the untrusted result through safeJson, whose hard ceiling bounds
+ *     it at 64 MiB regardless of a larger maxBytes.
  *
  * Allowed-globals list:
  *   The allowed opt names which extra globals operator source may
@@ -63,7 +65,7 @@
  *   - sandbox/bad-input           - input is not JSON-serializable
  *   - sandbox/input-too-large     - JSON.stringify(input).length > maxBytes
  *   - sandbox/timeout             - worker exceeded timeoutMs
- *   - sandbox/oversized-result    - worker output > maxBytes / 4
+ *   - sandbox/oversized-result    - worker output > min(maxBytes / 4, 64 MiB)
  *   - sandbox/parse-error         - source did not parse inside the worker
  *   - sandbox/runtime-error       - operator transform threw
  *   - sandbox/spawn-failed        - worker thread failed to spawn
@@ -83,6 +85,7 @@ var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
 var numericBounds = require("./numeric-bounds");
 var safeBuffer = require("./safe-buffer");
+var safeJson = require("./safe-json");
 var C = require("./constants");
 var { SandboxError } = require("./framework-error");
 
@@ -236,9 +239,14 @@ function run(opts) {
     stackSizeMb:              stackMib,
   };
 
-  // Reserve 1/4 of maxBytes as the per-result hard cap. The worker
-  // refuses any result whose stringified form exceeds this.
-  var maxResultBytes = Math.floor(maxBytes / 4);
+  // Reserve 1/4 of maxBytes as the per-result hard cap, clamped to the
+  // host-side JSON parse ceiling so the worker's output cap and the host's
+  // safeJson.parse cap agree exactly. Without the clamp a sandbox with
+  // maxBytes over 256 MiB would let the worker emit a result the host then
+  // refuses (safeJson hard-caps at ABSOLUTE_MAX_BYTES) — the worker refuses
+  // it too, so an oversized untrusted result fails the same way on both
+  // sides rather than passing the worker and crossing to a rejecting host.
+  var maxResultBytes = Math.min(Math.floor(maxBytes / 4), safeJson.ABSOLUTE_MAX_BYTES);
 
   return new Promise(function (resolve, reject) {
     var startedAt = Date.now();
@@ -312,7 +320,11 @@ function run(opts) {
       var peakBytes = (typeof msg.peakBytes === "number") ? msg.peakBytes : 0;
       if (msg.ok) {
         var parsed;
-        try { parsed = (msg.resultJson === undefined) ? undefined : JSON.parse(msg.resultJson); }   // allow:bare-json-parse — resultJson is produced by lib/sandbox-worker.js via JSON.stringify and bounded by maxResultBytes; never directly from operator/network input
+        // resultJson is the JSON.stringify of UNTRUSTED sandboxed code's return
+        // value: parse it through safeJson so a "__proto__" member is stripped
+        // and a pathologically deep/large result is bounded (maxResultBytes), not
+        // a raw JSON.parse that re-creates the key and is depth-unbounded.
+        try { parsed = (msg.resultJson === undefined) ? undefined : safeJson.parse(msg.resultJson, { maxBytes: maxResultBytes }); }
         catch (eParse) {
           _emitAudit("sandbox.run.refused", "failure", {
             reason: "sandbox/bad-result-json", runtimeMs: runtimeMs, peakBytes: peakBytes, sourceBytes: sourceBytes,

package/lib/vendor/blamejs/lib/vex.js

@@ -48,6 +48,8 @@
  */
 
 var canonicalJson = require("./canonical-json");
+var safeJson = require("./safe-json");
+var C = require("./constants");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -633,7 +635,10 @@ function serialize(doc) {
   // of truth for sort/scrub behaviour across the framework (rule
   // §canonicalize).
   var canonical = canonicalJson.stringify(doc);
-  return JSON.stringify(JSON.parse(canonical), null, 2);   // allow:bare-json-parse — canonical is canonicalJson.stringify output, not operator input
+  // Re-indent the canonical bytes for human-diffable output. allowProto keeps
+  // the canonicalizer's exact key set (this is a faithful re-format of trusted
+  // framework output, not a defense boundary); the size cap bounds the parse.
+  return JSON.stringify(safeJson.parse(canonical, { allowProto: true, maxBytes: C.BYTES.mib(16) }), null, 2);
 }
 
 module.exports = {

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.28",
+  "version": "0.15.29",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.15.29.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.15.29",
+  "date": "2026-06-25",
+  "headline": "JSON parsing of operator and untrusted input is routed through `b.safeJson` everywhere, so a `\"__proto__\"` member is stripped and the parse is size-bounded — `b.openapi.parse`, `b.asyncapi.parse`, and `b.sandbox.run` were using a raw `JSON.parse`",
+  "summary": "b.openapi.parse and b.asyncapi.parse parsed an operator-supplied document string with a raw JSON.parse, which re-creates a \"__proto__\" member as an own key and imposes no size bound; b.sandbox.run parsed the untrusted sandboxed code's serialized result the same way (proto member kept, depth unbounded). All three now route through b.safeJson, which strips the prototype-pollution keys and applies the depth / key / size caps. A new b.safeJson.parseStringOrObject primitive captures the recurring \"accept a document as a JSON string OR a pre-built object\" shape (a string is parsed safely, an object passes through) that openapi and asyncapi had each hand-rolled, with each consumer's typed error class and a generous document size cap passed as data. Valid input parses identically to before; a malicious or oversized document is now defused rather than accepted.",
+  "sections": [
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "Operator and untrusted JSON parses strip __proto__ and bound size (no raw JSON.parse)",
+          "body": "A raw JSON.parse keeps a \"__proto__\" object member as an own key (a prototype-pollution gadget for any downstream merge) and parses unbounded input. b.openapi.parse and b.asyncapi.parse used it on operator document strings, and b.sandbox.run used it on the untrusted sandboxed code's JSON-serialized result. All now route through b.safeJson — the prototype-pollution keys are stripped and the depth / key / size caps apply (a 16 MiB document cap for openapi/asyncapi, the existing result-bytes cap for the sandbox). Internal JSON parses (the sealed DSR store payloads, the VEX canonical re-format) route through the same primitive too, so the guarantee cannot be bypassed one call site at a time. Valid input is unaffected; a \"__proto__\"-laden or oversized payload is defused."
+        }
+      ]
+    },
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "b.safeJson.parseStringOrObject(input, opts?)",
+          "body": "Accepts either a JSON string — parsed through b.safeJson.parse, so the prototype-pollution-key strip and depth / key / size caps apply — or an already-decoded plain object (returned unchanged). For the recurring \"operator hands me a document as a JSON string or a pre-built object\" surface (b.openapi / b.asyncapi). The consumer's typed error class, error codes, label, and size cap are passed as options, so a raw JSON.parse on operator input cannot be hand-rolled per consumer."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/00-primitives.js

@@ -13645,6 +13645,41 @@ function testJsonParse() {
   check("parse accepts Buffer input",                     fromBuf.y === 2);
 }
 
+function testJsonParseStringOrObject() {
+  // String → parsed through parse() (proto strip + caps); valid input is
+  // byte-identical to a raw JSON.parse.
+  var fromStr = b.safeJson.parseStringOrObject('{"a":1,"b":[2,3]}');
+  check("parseStringOrObject parses a string",            fromStr.a === 1 && fromStr.b[1] === 3);
+  // Object → passed through unchanged (same reference).
+  var obj = { openapi: "3.0.0" };
+  check("parseStringOrObject passes an object through",   b.safeJson.parseStringOrObject(obj) === obj);
+  // The proto-pollution defense applies to the STRING path (a raw JSON.parse
+  // would keep "__proto__" as an own key); the marker'd hand-rolls bypassed it.
+  var stripped = b.safeJson.parseStringOrObject('{"__proto__":{"isAdmin":true},"name":"alice"}');
+  check("parseStringOrObject strips __proto__ from a string", stripped.isAdmin === undefined && stripped.name === "alice");
+  check("parseStringOrObject does not pollute Object.prototype", ({}).isAdmin === undefined);
+  // maxBytes is enforced on the string path.
+  var capped = false;
+  try { b.safeJson.parseStringOrObject('{"x":"' + new Array(2000).join("y") + '"}', { maxBytes: 100 }); }
+  catch (e) { capped = e.code === "json/too-large"; }
+  check("parseStringOrObject enforces maxBytes",          capped);
+  // A typed errorClass wraps invalid JSON / wrong input type with the caller's codes.
+  function MyErr(code, msg) { this.code = code; this.message = msg; }
+  var jc = null;
+  try { b.safeJson.parseStringOrObject("{not json", { errorClass: MyErr, jsonCode: "x/bad-json", inputCode: "x/bad-input" }); }
+  catch (e) { jc = e.code; }
+  check("parseStringOrObject wraps invalid JSON via errorClass",   jc === "x/bad-json");
+  var ic = null;
+  try { b.safeJson.parseStringOrObject(42, { errorClass: MyErr, jsonCode: "x/bad-json", inputCode: "x/bad-input" }); }
+  catch (e) { ic = e.code; }
+  check("parseStringOrObject wraps wrong input via errorClass",    ic === "x/bad-input");
+  // Without errorClass, a non-string/non-object throws the framework SafeJsonError.
+  var sje = false;
+  try { b.safeJson.parseStringOrObject(123); }
+  catch (e) { sje = e.code === "json/wrong-input-type"; }
+  check("parseStringOrObject throws SafeJsonError without errorClass", sje);
+}
+
 function testJsonStringify() {
   var s = b.safeJson.stringify({ a: 1, b: [1, 2, 3] });
   check("stringify produces valid JSON",                  JSON.parse(s).a === 1);
@@ -19005,6 +19040,7 @@ async function run() {
   // json-safe primitive
   testJsonModuleSurface();
   testJsonParse();
+  testJsonParseStringOrObject();
   testJsonStringify();
   testJsonCanonical();
   testJsonValidate();
@@ -19598,6 +19634,7 @@ module.exports = {
   testLazyRequire:                           testLazyRequire,
   testJsonModuleSurface:                     testJsonModuleSurface,
   testJsonParse:                             testJsonParse,
+  testJsonParseStringOrObject:               testJsonParseStringOrObject,
   testJsonStringify:                         testJsonStringify,
   testJsonCanonical:                         testJsonCanonical,
   testJsonValidate:                          testJsonValidate,

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -299,7 +299,6 @@ var VALID_ALLOW_CLASSES = {
   "backup-adapter-storage-without-posture-check": 1,
   "bare-canonicalize-walk": 1,
   "bare-error-throw": 1,
-  "bare-json-parse": 1,
   "bare-split-on-quoted-header": 1,
   "console-direct": 1,
   "deny-path-hardcoded-response": 1,
@@ -1595,17 +1594,18 @@ function testRawNewURL() {
 // ---- Pattern 14: silent JSON.parse() on operator-supplied data ----
 
 function testNoBareJsonParse() {
-  // `JSON.parse(operatorInput)` lacks the maxBytes / depth / proto
-  // pollution defenses that `safeJson.parse` adds. Internal JSON
-  // (vendor manifest, tests, internal state) is fine with bare parse.
+  // Inverse guard (NO allow path): every JSON parse in lib/ routes through
+  // `safeJson.parse` / `safeJson.parseStringOrObject`, which add the
+  // proto-pollution-key strip + depth / key / size caps a raw `JSON.parse`
+  // lacks. A raw `JSON.parse` re-creates a `"__proto__"` member as an own key
+  // and is unbounded — even "internal" callers (a sealed store payload, a
+  // sandbox worker's result, a canonical re-format) route through the primitive
+  // so the guarantee can't be bypassed one site at a time. safe-json.js IS the
+  // wrapper, so its own `JSON.parse` (the thing being wrapped) is the sole site.
   var matches = _scan(/\bJSON\.parse\(/);
-  // safe-json.js IS the safe wrapper; the bare JSON.parse call lives
-  // there by definition (it's what safe-json wraps with maxBytes /
-  // depth / proto-pollution defenses).
   matches = matches.filter(function (m) { return m.file !== "lib/safe-json.js"; });
-  matches = _filterMarkers(matches, "bare-json-parse");
-  _report("JSON.parse on operator input routes through safeJson.parse " +
-          "(or has allow marker)",
+  _report("JSON parse in lib/ routes through safeJson.parse / safeJson.parseStringOrObject " +
+          "(no raw JSON.parse — use the primitive; it carries the proto / depth / size defenses)",
     matches);
 }
 

package/lib/vendor/blamejs/test/layer-0-primitives/dsr.test.js

@@ -833,6 +833,42 @@ async function testDbStoreSealsAtRest() {
   }
 }
 
+async function testDbStoreLargePayloadRoundTrips() {
+  // A completed access/portability ticket can carry a data export larger
+  // than safeJson's 1 MiB parse default. The store reads its payload column
+  // back with the store-matched ceiling, so a multi-MiB ticket round-trips
+  // through get() and list() rather than failing json/too-large.
+  var tmpDir = _tmp();
+  await setupTestDb(tmpDir);
+  try {
+    var h = _dbDsr();
+    var bigExport = "x".repeat(C.BYTES.mib(2)); // ~2 MiB > the 1 MiB read default
+    var ticket = {
+      id:                "dsr-big-1",
+      type:              "access",
+      status:            "completed",
+      subject:           { subjectId: "u-1", email: "alice@example.com", phone: "+15550001111" },
+      submittedAt:       Date.now(),
+      deadlineAt:        Date.now() + C.TIME.minutes(1),
+      processedAt:       Date.now(),
+      verificationLevel: "primary",
+      posture:           "gdpr",
+      export:            bigExport,
+    };
+    await h.store.insert(ticket);
+
+    var got = await h.store.get("dsr-big-1");
+    check("dbStore: >1 MiB ticket round-trips through get()",
+          got && got.export === bigExport && got.status === "completed");
+
+    var listed = await h.store.list({ subject: { email: "alice@example.com" } });
+    check("dbStore: >1 MiB ticket round-trips through list()",
+          listed.length === 1 && listed[0].export === bigExport);
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
 async function testDbStoreErasurePurgesPriorTickets() {
   var tmpDir = _tmp();
   await setupTestDb(tmpDir);
@@ -1056,6 +1092,7 @@ async function run() {
 
   // dbTicketStore at-rest sealing + erasure purge + upgrade path
   await testDbStoreSealsAtRest();
+  await testDbStoreLargePayloadRoundTrips();
   await testDbStoreErasurePurgesPriorTickets();
   await testDbStoreUpgradePath();
   await testDbStoreFindsLegacyKeyedMacRows();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.4.108",
+  "version": "0.4.110",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {