@blamejs/blamejs-shop 0.4.128 → 0.5.1

package/CHANGELOG.md

@@ -6,6 +6,12 @@ Pre-1.0 the surface is intentionally evolving — every release may
 change something operators depend on. Read each entry before
 upgrading across more than a few patches at a time.
 
+## v0.5.x
+
+- v0.5.1 (2026-06-27) — **Vendored framework refreshed to 0.15.35 — Prometheus label-injection fix in the metrics shadow registry.** Updates the vendored blamejs framework to 0.15.35. The upstream release fixes a label-injection in the framework's metrics shadow registry: it built a metric's cardinality key by joining label pairs with commas and re-split that string when rendering the Prometheus exposition, so a comma (or `=`) inside a label VALUE forged additional label pairs in the scrape output — which downstream tenant-scoping filters, authorization selectors, recording rules, and alerting trust as a boundary — and two distinct label sets could collide into one cardinality bucket. The key now uses canonical-JSON of the label set and the render emits the structured labels instead of re-splitting, so a value's commas/equals stay inside the value and a label named `constructor` / `prototype` / `__proto__` is preserved. This storefront does not compose the metrics shadow registry, so there is no runtime change for it; the fix ships in the vendored framework regardless and no operator action is required. **Changed:** *Vendored framework refreshed to 0.15.35 (Prometheus label-injection fix)* — Refreshes the vendored blamejs framework to 0.15.35. The upstream fix stops a comma or `=` in a metric label value from forging extra Prometheus label pairs in the shadow registry's scrape output — the cardinality key is now canonical-JSON of the label set and the render emits the structured labels rather than splitting a joined string, so distinct label sets stay distinct and reserved-name labels survive. The shipped storefront does not expose the metrics shadow registry, so its runtime, public API, and wire format are unchanged; the hardened framework simply rides along.
+
+- v0.5.0 (2026-06-27) — **Affiliate commissions gain a tamper-evident hash chain, joining the gift-card, store-credit, and loyalty ledgers.** The affiliate-commission ledger was the last money ledger without tamper-evidence. Each commission is now linked into a per-affiliate SHA3-512 hash chain: a row names its predecessor, a uniqueness fence allows exactly one child per chain tip (so concurrent commissions for the same affiliate serialize instead of forking), and editing a commission's money fields or deleting a row from the middle breaks the linkage. Unlike the append-only gift-card / store-credit / loyalty ledgers, an affiliate commission walks a pending → paid → voided payout lifecycle in place, so the chain hashes only the immutable money facts — order, affiliate, order total, commission, currency, and time — and leaves the lifecycle columns out, meaning a legitimate payout or void never breaks the chain while an inflated amount or a removed row still does. A new `affiliates.verifyChain(affiliateId)` recomputes an affiliate's chain end to end and reports the first divergence, and accepts a trusted anchor (row count + head hash from an earlier snapshot) to also catch a truncation that deletes the most-recent commissions. Migration 0238 adds the chain columns + fence; commissions recorded before it are tolerated as an unverifiable legacy prefix, and the chain anchors fresh from the first commission recorded afterward. **Added:** *Affiliate commissions are a verifiable, fork-proof per-affiliate hash chain* — Recording a commission now links it into the affiliate's SHA3-512 hash chain — `row_hash = SHA3-512(prev_hash || canonical-json(immutable fields))` — under a `UNIQUE(affiliate_id, prev_hash)` parent fence, so a commission derived from a stale tip collides and retries instead of forking the chain, and concurrent commissions for one affiliate serialize. Because a commission's status, paid-at, payout reference, and void reason are stamped in place over its lifetime, only the immutable money facts are hashed, so a `pending → paid → voided` transition leaves the chain valid while tampering with the order total or commission amount, or deleting a commission, is detected. `affiliates.verifyChain(affiliateId)` walks the chain and reports the first break; pass `{ anchor: { count, head } }` to also rule out a tail truncation. Commissions written before this release are tolerated as an unverifiable legacy prefix and the chain anchors fresh from the next one — no backfill required. Migration 0238 adds the columns and the fence.
+
 ## v0.4.x
 
 - v0.4.128 (2026-06-27) — **Email sign-in links are now rate-limited per recipient, bounding inbox-flood and token-minting abuse.** The email magic-link sign-in — the no-passkey backup on the login screen — minted a new single-use sign-in token and sent an email on every POST for a registered address, bounded only by the per-IP request limiter. An attacker submitting a victim's address from many IP addresses could therefore flood that inbox with sign-in links and mint an unbounded number of valid single-use tokens. The route now applies a per-recipient cooldown: at most one sign-in link (and one minted token) per registered address per minute. The cooldown runs after the unchanged, enumeration-safe confirmation response, so a registered and an unregistered address stay indistinguishable by the reply; a transient lookup failure falls through to sending, keeping availability ahead of the rate cap. **Fixed:** *Email sign-in links are rate-limited per recipient* — Requesting an email sign-in link minted a single-use portal token and sent a message every time it was submitted for a registered address, with only the per-IP limiter in front of it — which a distributed sender (many IPs, one victim address) sails past. The request now checks whether a sign-in link was already minted for that account within the last minute and, if so, sends nothing further. The check runs on the request's background path, after the identical confirmation response is returned, so it does not reintroduce an account-existence oracle (a registered and an unregistered address still get the same reply at the same speed); an address with no account still triggers no mint or send at all. A transient failure of the cooldown lookup falls through to sending, so a degraded datastore can't lock legitimate shoppers out of signing in.

package/SECURITY.md

@@ -319,17 +319,22 @@ node -e "
   (success / failure / denied) and paginated. Opening the log is itself
   recorded (an `audit.read` row), so reviewing the audit trail leaves
   its own forensic mark.
-- **The gift-card, store-credit, and loyalty ledgers are hash-chained,
-  fork-proof, and verifiable.** Every ledger entry — credits, debits, and
-  expirations alike — links to its predecessor through a SHA3-512 chain,
-  keyed per card (gift cards) or per customer (store credit, loyalty), so
-  editing a row or deleting one from the middle breaks the linkage. A
-  uniqueness fence (one child per chain tip) makes concurrent writes
-  serialize rather than fork the chain, and each loyalty / gift-card /
-  store-credit balance change is written in that same single guarded row,
-  so a points or balance mutation is exactly-once even on a backend without
-  interactive transactions. `giftCardLedger.verifyChain(cardId)` /
-  `storeCredit.verifyChain(customerId)` / `loyalty.verifyChain(customerId)`
+- **The gift-card, store-credit, loyalty, and affiliate-commission ledgers
+  are hash-chained, fork-proof, and verifiable.** Every ledger entry — credits,
+  debits, and expirations alike — links to its predecessor through a SHA3-512
+  chain, keyed per card (gift cards), per customer (store credit, loyalty), or
+  per affiliate (commissions), so editing a row or deleting one from the middle
+  breaks the linkage. A uniqueness fence (one child per chain tip) makes
+  concurrent writes serialize rather than fork the chain, and each loyalty /
+  gift-card / store-credit balance change is written in that same single guarded
+  row, so a points or balance mutation is exactly-once even on a backend without
+  interactive transactions. The affiliate-commission chain hashes only the
+  immutable money facts (order, affiliate, totals, currency, time), so a
+  commission walking its pending → paid → voided payout lifecycle never breaks
+  the chain while inflating an amount or deleting a row still does.
+  `giftCardLedger.verifyChain(cardId)` /
+  `storeCredit.verifyChain(customerId)` / `loyalty.verifyChain(customerId)` /
+  `affiliates.verifyChain(affiliateId)`
   recompute a ledger's chain end to end and report the first divergence — run them whenever a balance is
   disputed; pass a trusted anchor (a row count + head hash from an earlier
   snapshot) to also catch a truncation that deletes the most-recent rows,

package/lib/affiliates.js

@@ -336,6 +336,56 @@ function _normalizeEmail(input) {
 
 function _now() { return Date.now(); }
 
+// ---- commission tamper-evidence chain -----------------------------------
+
+// SHA3-512 hex width + the all-zero genesis anchor every affiliate's chain
+// links its first commission off.
+var SHA3_512_HEX_LEN = 128;
+var ZERO_HASH        = "0".repeat(SHA3_512_HEX_LEN);
+
+// The IMMUTABLE money facts a commission row's hash attests. The lifecycle
+// columns (status / paid_at / voided_at / payout_reference / void_reason) are
+// deliberately EXCLUDED — they are stamped in place as a commission walks
+// pending -> paid -> voided, and hashing them would break the chain on every
+// legitimate payout. Only the facts that must never change after the
+// commission is recorded are bound.
+function _commissionHashFields(row) {
+  return {
+    id:                row.id,
+    order_id:          row.order_id,
+    affiliate_id:      row.affiliate_id,
+    order_total_minor: Number(row.order_total_minor),
+    commission_minor:  Number(row.commission_minor),
+    currency:          row.currency,
+    occurred_at:       Number(row.occurred_at),
+  };
+}
+
+// row_hash = SHA3-512(prev_hash-bytes || canonical-json(immutable fields)),
+// the same construction the gift-card / store-credit / loyalty ledgers use
+// (b.auditChain.canonicalize is the RFC 8785 sorted-key walker).
+function _commissionRowHash(prevHash, fields) {
+  var canonical = b.auditChain.canonicalize(fields, ["prev_hash", "row_hash"]);
+  var preimage  = Buffer.concat([
+    Buffer.from(prevHash, "hex"),
+    Buffer.from(canonical, "utf8"),
+  ]);
+  return b.crypto.sha3Hash(preimage);
+}
+
+// How many times recordCommissionEvent re-derives the chain tip when the
+// parent fence refuses its INSERT (a competing commission for the SAME
+// affiliate landed first). Each fence round lets exactly one racing writer
+// win, so a burst of N concurrent commissions for one affiliate needs up to N
+// rounds — the cap is the max same-affiliate fan-in that fully succeeds, so it
+// is sized for the PER-AFFILIATE chain: unlike a gift-card chain (one
+// customer's wallet), an affiliate's chain aggregates order completions across
+// every customer they referred, so a large affiliate during a campaign spike
+// can drive many near-simultaneous commissions. 256 covers that with wide
+// margin; AFFILIATE_COMMISSION_CONTENTION (thrown past the cap) is a retryable
+// signal, never silent loss — the caller may re-invoke for that order.
+var COMMISSION_CHAIN_ATTEMPTS = 256;
+
 // ---- code generation + canonicalization ---------------------------------
 
 function _generateCode() {
@@ -446,6 +496,28 @@ function create(opts) {
     return r.rows[0] || null;
   }
 
+  // The affiliate's current chain tip — the highest-chain_index commission's
+  // row_hash (the next commission links off it as its prev_hash) plus that
+  // chain_index. Ordering by chain_index (not occurred_at) keeps the read order
+  // equal to the prev_hash linkage WITHOUT touching the operator's timestamp.
+  // The `(chain_index IS NULL) ASC` key prefers any chained row over a legacy
+  // NULL row, so once the chain has anchored the tip is always a hashed row; an
+  // affiliate with only legacy pre-chain rows (NULL chain_index / NULL row_hash)
+  // anchors fresh from genesis (ZERO_HASH, index -1 so the first child is 0).
+  async function _readCommissionTip(affiliateId) {
+    var r = await query(
+      "SELECT row_hash, chain_index FROM affiliate_commissions WHERE affiliate_id = ?1 " +
+      "ORDER BY (chain_index IS NULL) ASC, chain_index DESC, id DESC LIMIT 1",
+      [affiliateId],
+    );
+    if (!r.rows.length) return { row_hash: ZERO_HASH, chain_index: -1 };
+    var row = r.rows[0];
+    if (row.chain_index == null || row.row_hash == null) {
+      return { row_hash: ZERO_HASH, chain_index: -1 };
+    }
+    return { row_hash: row.row_hash, chain_index: Number(row.chain_index) };
+  }
+
   // Inserting an affiliate row. Code generation retries on UNIQUE
   // violation up to a small bound; on the 32^8 space the chance of
   // running out is vanishingly low, but the retry keeps the boot
@@ -818,32 +890,56 @@ function create(opts) {
         aff.commission_kind, Number(aff.commission_value), orderTotal
       );
 
-      var id = b.uuid.v7();
-      try {
-        await query(
-          "INSERT INTO affiliate_commissions " +
-          "(id, order_id, affiliate_id, order_total_minor, commission_minor, " +
-          " currency, status, occurred_at, paid_at, voided_at, payout_reference, void_reason) " +
-          "VALUES (?1, ?2, ?3, ?4, ?5, ?6, 'pending', ?7, NULL, NULL, NULL, NULL)",
-          [id, orderId, affiliateId, orderTotal, commissionMinor, currency, occurredAt],
-        );
-      } catch (e) {
-        // Concurrent recordCommissionEvent for the same (order_id,
-        // affiliate_id): the pre-read above missed a racing insert, so this
-        // writer loses on the UNIQUE constraint. Matching on the error MESSAGE
-        // is unreliable — the production D1 service-binding redacts the SQLite
-        // "UNIQUE constraint failed" text to a generic "HTTP 500" — so converge
-        // message-agnostically: re-read, and if the row now exists the failure
-        // was the duplicate, so return it (idempotent). If no row exists the
-        // insert failed for some other reason, so re-throw.
-        var raced = await query(
-          "SELECT * FROM affiliate_commissions WHERE order_id = ?1 AND affiliate_id = ?2",
-          [orderId, affiliateId],
-        );
-        if (raced.rows.length) return raced.rows[0];
-        throw e;
+      // Append to the affiliate's tamper-evidence chain under the parent fence
+      // (UNIQUE(affiliate_id, prev_hash), migration 0238): the row links off the
+      // affiliate's current tip, and a write derived from a STALE tip collides
+      // instead of forking the chain — so we re-read the tip and retry. Two
+      // UNIQUE constraints can refuse this INSERT, and the production D1
+      // service-binding redacts the SQLite "UNIQUE constraint failed" text to a
+      // generic "HTTP 500", so converge MESSAGE-AGNOSTICALLY: (1) re-read by
+      // (order_id, affiliate_id) — if a row now exists, this was the idempotency
+      // duplicate, return it; (2) else re-read the chain tip — if it advanced
+      // past the parent we tried to chain off, a competing commission for this
+      // affiliate claimed our slot, so retry; (3) else the insert failed for an
+      // unrelated reason, re-throw.
+      for (var attempt = 0; attempt < COMMISSION_CHAIN_ATTEMPTS; attempt += 1) {
+        var tip        = await _readCommissionTip(affiliateId);
+        var prevHash   = tip.row_hash;
+        var chainIndex = tip.chain_index + 1;
+        var id = b.uuid.v7();
+        var rowHash = _commissionRowHash(prevHash, {
+          id:                id,
+          order_id:          orderId,
+          affiliate_id:      affiliateId,
+          order_total_minor: orderTotal,
+          commission_minor:  commissionMinor,
+          currency:          currency,
+          occurred_at:       occurredAt,
+        });
+        try {
+          await query(
+            "INSERT INTO affiliate_commissions " +
+            "(id, order_id, affiliate_id, order_total_minor, commission_minor, " +
+            " currency, status, occurred_at, paid_at, voided_at, payout_reference, void_reason, " +
+            " prev_hash, row_hash, chain_index) " +
+            "VALUES (?1, ?2, ?3, ?4, ?5, ?6, 'pending', ?7, NULL, NULL, NULL, NULL, ?8, ?9, ?10)",
+            [id, orderId, affiliateId, orderTotal, commissionMinor, currency, occurredAt, prevHash, rowHash, chainIndex],
+          );
+          return await _getCommissionRaw(id);
+        } catch (e) {
+          var raced = await query(
+            "SELECT * FROM affiliate_commissions WHERE order_id = ?1 AND affiliate_id = ?2",
+            [orderId, affiliateId],
+          );
+          if (raced.rows.length) return raced.rows[0];
+          var newTip = await _readCommissionTip(affiliateId);
+          if (newTip.row_hash !== prevHash) continue;
+          throw e;
+        }
       }
-      return await _getCommissionRaw(id);
+      var contention = new Error("affiliates.recordCommissionEvent: persistent commission-chain contention — retry the write");
+      contention.code = "AFFILIATE_COMMISSION_CONTENTION";
+      throw contention;
     },
 
     commissionsForAffiliate: async function (listOpts) {
@@ -1004,6 +1100,110 @@ function create(opts) {
       return await _getCommissionRaw(id);
     },
 
+    // Recompute one affiliate's commission hash chain and flag the first
+    // divergence — the tamper-evidence READ side of the chain recordCommission-
+    // Event maintains. Walks the affiliate's rows in (occurred_at, id) order
+    // over the IMMUTABLE money fields only (lifecycle columns are not hashed, so
+    // a paid/voided transition is not a break). Rows from before the chain
+    // existed (NULL row_hash) are tolerated as an unverifiable legacy PREFIX and
+    // counted, but once a hashed row appears every later row must link — an
+    // unhashed row after the anchor, a prev_hash that doesn't name its parent,
+    // or a row_hash that doesn't recompute is a break. A populated ledger that
+    // never anchors (every row NULL-hashed — what a full rewrite leaves behind)
+    // fails as unanchored; only a genuinely empty ledger passes with no anchor.
+    // An optional trusted anchor { count, head } rules out a tail truncation.
+    // O(n) per affiliate; operator-audit use, not hot-path.
+    verifyChain: async function (affiliateId, opts) {
+      var aff = _uuid(affiliateId, "affiliate_id");
+      opts = opts || {};
+      var anchor = null;
+      if (opts.anchor != null) {
+        if (typeof opts.anchor !== "object"
+            || typeof opts.anchor.count !== "number" || !Number.isInteger(opts.anchor.count) || opts.anchor.count < 1
+            || typeof opts.anchor.head !== "string" || opts.anchor.head.length !== SHA3_512_HEX_LEN) {
+          throw new TypeError("affiliates.verifyChain: anchor must be { count: positive integer, head: " + SHA3_512_HEX_LEN + "-hex-char string }");
+        }
+        anchor = opts.anchor;
+      }
+      // Walk in chain order: the legacy NULL-chain_index prefix first (sorted by
+      // id for a stable count), then the hashed chain by chain_index. This is
+      // the prev_hash linkage order independent of occurred_at, so a backdated
+      // commission verifies in its chain position, not its timestamp position.
+      var rows = (await query(
+        "SELECT * FROM affiliate_commissions WHERE affiliate_id = ?1 " +
+        "ORDER BY (chain_index IS NULL) DESC, chain_index ASC, id ASC",
+        [aff],
+      )).rows;
+      var legacyPrefix = 0;
+      var anchored = false;
+      var prevHash = ZERO_HASH;
+      for (var i = 0; i < rows.length; i += 1) {
+        var row = rows[i];
+        if (!anchored && row.row_hash == null) { legacyPrefix += 1; continue; }
+        anchored = true;
+        var breakBase = {
+          ok:            false,
+          rows_verified: i - legacyPrefix,
+          legacy_prefix: legacyPrefix,
+          break_at:      i,
+          break_row_id:  row.id,
+        };
+        if (row.row_hash == null) {
+          return Object.assign(breakBase, { reason: "unhashed row after chain anchor" });
+        }
+        if (row.prev_hash !== prevHash) {
+          return Object.assign(breakBase, { reason: "prev_hash mismatch", expected: prevHash, actual: row.prev_hash });
+        }
+        var computed = _commissionRowHash(prevHash, _commissionHashFields(row));
+        if (computed !== row.row_hash) {
+          return Object.assign(breakBase, { reason: "row_hash mismatch", expected: computed, actual: row.row_hash });
+        }
+        prevHash = row.row_hash;
+      }
+      if (!anchored && rows.length > 0) {
+        return {
+          ok:            false,
+          rows_verified: 0,
+          legacy_prefix: legacyPrefix,
+          break_at:      0,
+          break_row_id:  rows[0].id,
+          reason:        "unanchored chain (no hashed row in a populated ledger)",
+        };
+      }
+      if (anchor) {
+        if (rows.length < anchor.count) {
+          return {
+            ok:             false,
+            rows_verified:  rows.length - legacyPrefix,
+            legacy_prefix:  legacyPrefix,
+            anchor_checked: true,
+            reason:         "row count below anchor (possible tail truncation)",
+            expected_count: anchor.count,
+            actual_count:   rows.length,
+          };
+        }
+        var anchorRow = rows[anchor.count - 1];
+        if (!anchorRow || anchorRow.row_hash !== anchor.head) {
+          return {
+            ok:             false,
+            rows_verified:  rows.length - legacyPrefix,
+            legacy_prefix:  legacyPrefix,
+            anchor_checked: true,
+            reason:         "anchor row hash mismatch (possible tail truncation or divergence)",
+            expected:       anchor.head,
+            actual:         anchorRow ? anchorRow.row_hash : null,
+          };
+        }
+      }
+      return {
+        ok:             true,
+        rows_verified:  rows.length - legacyPrefix,
+        legacy_prefix:  legacyPrefix,
+        head:           prevHash,
+        anchor_checked: !!anchor,
+      };
+    },
+
     // Operator dashboard — which affiliates are owed at least
     // `min_payout_minor` as of `as_of`. Returns one row per affiliate
     // whose sum-of-pending commissions (occurred_at <= as_of) meets

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.4.128",
+  "version": "0.5.1",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-imfe0otYErcB8rr2h6KLSGTtStirysptpXETSPY4zLv3bZoIT75Lo1dOvkOav+xL",

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.15.34",
-      "tag": "v0.15.34",
+      "version": "0.15.35",
+      "tag": "v0.15.35",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",
@@ -857,6 +857,7 @@
         "release-notes/v0.15.32.json": "lib/vendor/blamejs/release-notes/v0.15.32.json",
         "release-notes/v0.15.33.json": "lib/vendor/blamejs/release-notes/v0.15.33.json",
         "release-notes/v0.15.34.json": "lib/vendor/blamejs/release-notes/v0.15.34.json",
+        "release-notes/v0.15.35.json": "lib/vendor/blamejs/release-notes/v0.15.35.json",
         "release-notes/v0.15.4.json": "lib/vendor/blamejs/release-notes/v0.15.4.json",
         "release-notes/v0.15.5.json": "lib/vendor/blamejs/release-notes/v0.15.5.json",
         "release-notes/v0.15.6.json": "lib/vendor/blamejs/release-notes/v0.15.6.json",
@@ -1534,7 +1535,7 @@
         "test/smoke.js": "lib/vendor/blamejs/test/smoke.js"
       },
       "bundler": "shallow git clone of release tag from github.com/blamejs/blamejs",
-      "bundledAt": "2026-06-26",
+      "bundledAt": "2026-06-27",
       "hashes": {
         ".clusterfuzzlite/Dockerfile": "sha256:6587c80f02f3d622b782380ff1aaa7753b948023ff1d4af8ac27709d1876c218",
         ".clusterfuzzlite/build.sh": "sha256:b9f5a627272c65f6569fa20dcbb32c383ca3a1183ce2562d481408a2fbaf9881",
@@ -1565,7 +1566,7 @@
         ".npmrc": "sha256:66f104e7d07c496d2d0409988225e8c0e4ceb8d247dbcac3be75b2128d20ce66",
         ".pinact.yaml": "sha256:0213ffda55961dc49b64c0a5dfa3c0567419633b1499d57eaf7c8d842d7da6c7",
         "ARCHITECTURE.md": "sha256:9b1c8d2b1b7a41838eb348b0a008e4b4369718fd72bfe2974b37155f7536d35b",
-        "CHANGELOG.md": "sha256:98f034fdf893233e36e89e1f8eaa1548f1de448d67f5afef4e07b401bccb4aa2",
+        "CHANGELOG.md": "sha256:52a0cf964a432750c3cfb566dd024b55286cb1036a0e5c4c3cbaf56c6b7a1da6",
         "CODE_OF_CONDUCT.md": "sha256:148a281960fff7c2fe6554dab66da572c72245ddeb00b0d14811558397bff386",
         "CONTRIBUTING.md": "sha256:bb4dbdbc8598da31dbce653a8ed322e08ff46560173f2eb67a4d684653948332",
         "GOVERNANCE.md": "sha256:906df6afb1f552b27b9acb50f7f96c47b917a2f1021cd4e987dbf4ee0e0a821b",
@@ -1575,7 +1576,7 @@
         "NOTICE": "sha256:f487fa47a11aca0f89e2615cdd3c713e9842abf7a30d8d328eeeae1c864aa774",
         "README.md": "sha256:3ddcc197b003da0b02db8bdd1aef1e943c94f7eab613c633d6a45bb11d0a80e9",
         "SECURITY.md": "sha256:77d8c2bcc04b425a08ef30e51204cebddbd48954b028a259c7a8412dbfeab40a",
-        "api-snapshot.json": "sha256:610a4caba49d95d48cd4a129b4071e1756903eaea0de8eb904e6d76e1a887501",
+        "api-snapshot.json": "sha256:097e1361a6d64b9b25830f0ba1c0440b39f7efce8770d5b7a9d0545d73cc5439",
         "assets/BlameJS_Logo.png": "sha256:3c65699753c771b48ef9ac7f45bb40815ec19a23afcdd0cd30ef4601bbbe293e",
         "assets/BlameJS_Logo.svg": "sha256:dda44f3fb1343d5de9db6b1fcdb75fc649c57e7a99a8e8239fcf852e3841e1a8",
         "bench/README.md": "sha256:74202f2507fd840bfc1ac6c681975d9273cf36cca6e0f72655f138337304033c",
@@ -2107,7 +2108,7 @@
         "lib/mcp-tool-registry.js": "sha256:df3480e6a0d29a9734bdb19d322f83bff5ebfdd756620f947cf593878dea8776",
         "lib/mcp.js": "sha256:c65af74fdb3cf30436699aba5051c4d6e8cb972887cbaaecc46250d557599953",
         "lib/mdoc.js": "sha256:bc31d38d6fdfac8db8f040dfa4d33ab40405f56340bb4ec978f3ba98e93f6433",
-        "lib/metrics.js": "sha256:edc2a3f08a48ab67c9e805cb75839cc9d326ac334478b0f30db0423102ee5713",
+        "lib/metrics.js": "sha256:55d445b738b2cfc8ceb1bfa7a1e69b306497e8065ea86d61e4f4087873acce1b",
         "lib/middleware/age-gate.js": "sha256:dc8c61a4d41f4a781220c9c97eb475fb2867f5ee444eb2756badcbc5b8411795",
         "lib/middleware/ai-act-disclosure.js": "sha256:6fc62940d85813019b31c586fc86853570329a939565a6947f81052d50977c42",
         "lib/middleware/api-encrypt.js": "sha256:f90210bfc4fe04b50f6d72e14676a140c5759e255ed359567066a1e80ab5fb63",
@@ -2346,7 +2347,7 @@
         "oss-fuzz/projects/blamejs/README.md": "sha256:ae13b7bb79ed8d69b1b3276e5562807a0349fb6e6b7d11cf1f683aad1eafdb4b",
         "oss-fuzz/projects/blamejs/build.sh": "sha256:0ced1cf21782c97be7f8d74faf5e27a308b60b2f858836fb5ca3b8c4e939a8f7",
         "oss-fuzz/projects/blamejs/project.yaml": "sha256:59f2cb83aa622325a175b77416fe155be15b70a9c798bd1a78bba05763b1b03d",
-        "package.json": "sha256:ca031cc44ce6ade614e436bd1f29d01cd2d495ad41c55a819c02c85a5f3a2f96",
+        "package.json": "sha256:680de6ef3cb4b04dc38a51d9671f5bc817199fe7724290a05b6404af36318b45",
         "release-notes/v0.0.x.json": "sha256:7a49819f30068ee119000cad7010194882bb8bfaa12acbdab4dfc066efb7982f",
         "release-notes/v0.1.x.json": "sha256:6742a8c17f947c5cb76f69dead7eea86b942d80621d914b774ba5488e09937e5",
         "release-notes/v0.10.x.json": "sha256:fe498045daf88337bd3d987e5964aa42c99a50e1685b6f09e51f698b8687726f",
@@ -2383,6 +2384,7 @@
         "release-notes/v0.15.32.json": "sha256:af99a8a782dcc30aff3a135c27179b064d63181fc4c302c31da632c1615b68ce",
         "release-notes/v0.15.33.json": "sha256:295ea9939b74498c7f0be6afdc8bc511f97cb2383a436c3040c58b0600598b19",
         "release-notes/v0.15.34.json": "sha256:2a1b36d897d8e9f2cece051c098030f08d9c6ee6bef136800bd19453ad65f188",
+        "release-notes/v0.15.35.json": "sha256:e317b2252734aace7a0f734e3ab40c3a0c4ac208d678c0e9834be34eb424d15b",
         "release-notes/v0.15.4.json": "sha256:6ac7fa0ef1728c27e71b2050d1b07a810f9b4b1440ccddbf28ad56e2f54d8585",
         "release-notes/v0.15.5.json": "sha256:cca1d0edd5d6fc41b512d19d98be224b990dcab41478622c11962f0fcb1bb09a",
         "release-notes/v0.15.6.json": "sha256:0e3b9e5e43b70b61dd258c3003d1b8729cd3c26c62a34dedcca81bbec5d31077",
@@ -2862,7 +2864,7 @@
         "test/layer-0-primitives/mcp-tool-registry.test.js": "sha256:4d9a9a367489d93afcc8e0bca3442e0aefc683e40ddd29e6e2cddbe3a3b8732f",
         "test/layer-0-primitives/mcp.test.js": "sha256:896a9b55fd9d21a1ec2b0d0753b5796eb045911ad28992ba17338285406ac2f9",
         "test/layer-0-primitives/mdoc.test.js": "sha256:2fe1086192385e71f858554d676b299b86594d34226e1d774ffefc97b5fa03a4",
-        "test/layer-0-primitives/metrics-shadow-registry.test.js": "sha256:8ea834fd6b549c18976b535660a53aafccb1c6f0b7762086e8dbbc7ab8d832b6",
+        "test/layer-0-primitives/metrics-shadow-registry.test.js": "sha256:a91a9efdb4aa28caed846b969d7c1e5ebfc57067afad85800daa430942d02725",
         "test/layer-0-primitives/metrics-snapshot.test.js": "sha256:aa405be22acb6680b062d1de1aa7ce00029e414218a0e4e521e10a14b2254851",
         "test/layer-0-primitives/middleware-compose-pipeline.test.js": "sha256:a779468bde043b6de4add5d4405a33973163890ee667b833e3330373ee64f77d",
         "test/layer-0-primitives/mime-parse.test.js": "sha256:73ccfea7d08b0c3b5fb899215806d4f430c02bf63e21835024a4cdcfc4254b31",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.35 (2026-06-26) — **`b.metrics` shadow registry no longer lets a comma in a label value forge extra Prometheus label pairs — a label-injection that downstream tenant-scoping or authorization selectors could be tricked by.** The shadow registry serialized a metric's label set into a `name=value,name=value` string key and re-split it on `,` to build the Prometheus exposition. A label VALUE containing a comma therefore split into multiple label pairs, so a single operator-set label could forge additional label pairs in the scrape output (for example turning one `route` label into a `route` plus an attacker-named label), which downstream tenant-scoping filters, authorization selectors, recording rules, and alerting trust as a boundary; two distinct label sets could also collide into one cardinality bucket. The label key now uses canonical-JSON of the string-coerced label set (the same approach the main registry already used) and the render path emits the structured label set kept alongside that key rather than splitting or re-parsing, so a `,` or `=` inside a label value stays inside the value and a label NAMED `constructor`, `prototype`, or `__proto__` (all valid Prometheus label names) is preserved instead of being dropped. Note: the cardinality keys exposed by `shadowRegistry().snapshot()` are now canonical-JSON strings (e.g. `{"route":"/api"}`) rather than `route=/api`. **Changed:** *shadowRegistry().snapshot() cardinality keys are canonical-JSON* — As a consequence of the label-injection fix, the per-series cardinality keys in a shadow-registry snapshot are now canonical-JSON strings (e.g. `{"tenant":"a"}`) instead of the previous `tenant=a` form. Code that reads those keys directly from snapshot() should parse them as JSON; the Prometheus render output is unchanged for conforming label values. **Security:** *Label values can no longer forge extra Prometheus label pairs in the shadow registry* — b.metrics shadowRegistry built a metric's cardinality key by joining `name=value` pairs with commas, then split that string on commas when rendering the Prometheus exposition. A comma (and `=`) in a label value therefore broke one value into several forged label pairs in the scrape output, and two different label sets could collide into the same cardinality bucket. The key is now canonical-JSON of the string-coerced label set and the render emits the structured label set kept alongside that key rather than splitting or re-parsing, so a label value is emitted as a single quoted value with its commas/equals intact, distinct label sets get distinct keys, and a label NAMED `constructor`, `prototype`, or `__proto__` (each a valid Prometheus label name) is preserved rather than dropped. Deterministic regression tests assert a comma-bearing label value produces exactly one label pair and that the reserved-name labels survive render.
+
 - v0.15.34 (2026-06-26) — **`b.mail.crypto.pgp.verify` now accepts every valid RSA OpenPGP signature — one whose value happened to have a high zero byte (about 1 in 256) was being rejected.** An OpenPGP RSA signature is an integer modulo the key's modulus, and ~1 in 256 signatures have a value that begins with a zero byte. The MPI encoding strips those leading zero bytes (RFC 9580 §3.2), but b.mail.crypto.pgp.verify passed the stripped value straight to the RSA verification, which requires a signature exactly the modulus byte length — so a perfectly valid signature was intermittently reported invalid. The signature is now left-padded back to the modulus width before verification, exactly as the Ed25519 path already pads its components. Verification of every valid RSA signature is now reliable, including signatures produced by other OpenPGP implementations. Also includes internal test-tooling: two more guard-suite suppression classes were re-verified and their tokens retired. **Fixed:** *RSA OpenPGP signatures with a high zero byte now verify reliably* — b.mail.crypto.pgp.verify read the RSA signature MPI (whose leading zero bytes the OpenPGP wire format strips) and handed it to the RSA verification without restoring the stripped bytes. Node's RSA verify requires the signature to be exactly the modulus byte length, so a signature whose value had one or more high zero bytes — about 1 in 256 of all signatures, for any key — was rejected as invalid even though it was correct. The signature is now left-padded to the modulus width before verification (the same correction the Ed25519 verification path already applied to its R/S components). This affects signatures the framework produces and signatures from other OpenPGP implementations alike. A deterministic regression test searches for a short-MPI signature and asserts it verifies. **Detectors:** *Two more suppression-marker classes re-verified and their tokens retired* — The raw-hash-compare and seal-without-aad guard classes were re-read and confirmed (a data-residency region tag compared with === — not a secret; and two intentional non-AEAD-bound seals — a non-regulated plain-mode column whose AAD is enforced by the posture seal-envelope floor where it matters, and a throwaway vault-readiness probe), then renamed to descriptive tokens with their old names added to the retired-token set. Test-suite tooling only.
 
 - v0.15.33 (2026-06-26) — **Internal test-suite hardening only — the published library's runtime behavior and public API are unchanged (source-comment marker text aside).** Three more suppression classes in the codebase-patterns guard suite were re-verified from scratch and renamed to descriptive tokens, with their old names recorded as retired and their in-source marker comments updated to match. No runtime code, public API, or wire format changed. **Detectors:** *Three more suppression-marker classes re-verified and their tokens retired* — Continuing the re-verification pass: each marked site for the math-random-noncrypto, raw-new-url, and dynamic-require guard classes was re-read and confirmed (non-security jitter/sampling; URL parsing for shape/origin inspection or behind the safe wrapper; operator-supplied module loads), then the class was renamed to a descriptive token and its old name added to the retired-token set. This is test-suite tooling; no shipped framework behavior changed.

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.15.34",
-  "createdAt": "2026-06-26T23:09:44.793Z",
+  "frameworkVersion": "0.15.35",
+  "createdAt": "2026-06-27T05:20:14.742Z",
   "exports": {
     "a2a": {
       "type": "object",

package/lib/vendor/blamejs/lib/metrics.js

@@ -1352,6 +1352,14 @@ function shadowRegistry(opts) {
   var counters = Object.create(null);
   var gauges   = Object.create(null);
   var info     = Object.create(null);
+  // Maps a canonical-JSON cardinality key → the string-coerced, null-prototype
+  // label object that produced it, so the render path reads the structured
+  // labels directly instead of re-parsing the key. Re-parsing would both lose a
+  // label NAMED `constructor` / `prototype` / `__proto__` (all valid Prometheus
+  // label names) to a prototype-pollution-hardened JSON parse, and reintroduce a
+  // serialize-then-split round-trip. Populated only when a value is actually
+  // stored, so it stays bounded by the cardinality cap.
+  var labelSets = Object.create(null);
   var lastCardinalityAuditMs = 0;
 
   function _cardinalityHit(metric) {
@@ -1375,19 +1383,27 @@ function shadowRegistry(opts) {
     }
   }
 
-  function _labelKey(labels) {
-    if (!labels || typeof labels !== "object") return "";
-    var keys = Object.keys(labels).sort();                                                            // allow:bare-canonicalize-walk — label-set canonicalization for cardinality keying
-    var parts = [];
-    for (var i = 0; i < keys.length; i += 1) {
-      parts.push(keys[i] + "=" + String(labels[keys[i]]));
-    }
-    return parts.join(",");
+  function _coerceLabels(labels) {
+    // → { key, set }: the canonical-JSON cardinality key (collision-proof and
+    // injection-proof, matching the main registry's _labelsKey) plus the
+    // string-coerced, null-prototype label object it came from. The render path
+    // reads `set` directly rather than re-parsing `key`, so a `,` or `=` in a
+    // label VALUE can never forge extra label pairs and a label NAMED
+    // `constructor` / `prototype` / `__proto__` survives verbatim. The
+    // null-prototype object makes a `__proto__` label a normal own property
+    // rather than a prototype assignment.
+    if (!labels || typeof labels !== "object") return { key: "", set: null };
+    var keys = Object.keys(labels);
+    if (keys.length === 0) return { key: "", set: null };
+    var coerced = Object.create(null);
+    for (var i = 0; i < keys.length; i += 1) coerced[keys[i]] = String(labels[keys[i]]);
+    return { key: canonicalJson.stringify(coerced), set: coerced };
   }
 
   function inc(name, labels) {
     if (!counterSet[name]) return;
-    var lk = _labelKey(labels);
+    var ck = _coerceLabels(labels);
+    var lk = ck.key;
     if (!counters[name]) counters[name] = Object.create(null);
     var current = counters[name][lk];
     if (current === undefined) {
@@ -1396,6 +1412,7 @@ function shadowRegistry(opts) {
         return;
       }
       counters[name][lk] = 1;
+      if (ck.set) labelSets[lk] = ck.set;
     } else {
       counters[name][lk] = current + 1;
     }
@@ -1407,13 +1424,15 @@ function shadowRegistry(opts) {
       throw new MetricsError("metrics-shadow/bad-gauge-value",
         "shadowRegistry.set: '" + name + "' value must be a finite number");
     }
-    var lk = _labelKey(labels);
+    var ck = _coerceLabels(labels);
+    var lk = ck.key;
     if (!gauges[name]) gauges[name] = Object.create(null);
     if (gauges[name][lk] === undefined && Object.keys(gauges[name]).length >= cap) {
       _cardinalityHit(name);
       return;
     }
     gauges[name][lk] = value;
+    if (ck.set) labelSets[lk] = ck.set;
   }
 
   function setInfo(name, value) {
@@ -1449,22 +1468,21 @@ function shadowRegistry(opts) {
         for (var li = 0; li < lks.length; li += 1) {
           var lk = lks[li];
           if (lk === "") { out.push(metric + " " + labelMap[lk]); continue; }
-          // The label-key string was assembled by `_labelKey` from a
-          // single shadow-registry call's `labels` object — values
-          // are framework-internal (operator code that supplied them
-          // is bounded by guards upstream); split on `,` is safe.
-          // Not a header-value parse (which would need a quoted-
-          // string aware split per RFC 9110).
-          var lpairs = lk.split(",");                                                                // allow:bare-split-on-quoted-header — framework-internal label-key (assembled by _labelKey), not an HTTP header parse
+          // Read the structured label set kept alongside the canonical key (see
+          // _coerceLabels) rather than re-parsing the key. No serialize-then-
+          // split round-trip, so a `,` or `=` in a label value stays inside the
+          // value and can never forge extra label pairs; and a label NAMED
+          // `constructor` / `prototype` / `__proto__` survives instead of being
+          // stripped by a prototype-pollution-hardened parse.
+          var labelObj = labelSets[lk];
+          if (!labelObj || typeof labelObj !== "object") { out.push(metric + " " + labelMap[lk]); continue; }
+          var lnames = Object.keys(labelObj).sort();                                                 // allow:bare-canonicalize-walk — deterministic label ordering in the exposition line
           var formatted = [];
-          for (var pi = 0; pi < lpairs.length; pi += 1) {
-            var eqIdx = lpairs[pi].indexOf("=");
-            if (eqIdx === -1) continue;
-            var lname = lpairs[pi].slice(0, eqIdx);
-            var lvalue = lpairs[pi].slice(eqIdx + 1);
+          for (var pi = 0; pi < lnames.length; pi += 1) {
+            var lname = lnames[pi];
             if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(lname)) continue;                                   // allow:regex-no-length-cap — Prometheus label-name shape
             // Prometheus exposition: escape `\`, `"`, `\n` in label values.
-            lvalue = String(lvalue).replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n"); // allow:regex-no-length-cap — fixed-char-set escape // allow:duplicate-regex — Prometheus value escape shape
+            var lvalue = String(labelObj[lname]).replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n"); // allow:regex-no-length-cap — fixed-char-set escape // allow:duplicate-regex — Prometheus value escape shape
             formatted.push(lname + '="' + lvalue + '"');
           }
           out.push(metric + "{" + formatted.join(",") + "} " + labelMap[lk]);
@@ -1516,9 +1534,10 @@ function shadowRegistry(opts) {
   }
 
   function reset() {
-    counters = Object.create(null);
-    gauges   = Object.create(null);
-    info     = Object.create(null);
+    counters  = Object.create(null);
+    gauges    = Object.create(null);
+    info      = Object.create(null);
+    labelSets = Object.create(null);
     lastCardinalityAuditMs = 0;
   }
 

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.34",
+  "version": "0.15.35",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.15.35.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.15.35",
+  "date": "2026-06-26",
+  "headline": "`b.metrics` shadow registry no longer lets a comma in a label value forge extra Prometheus label pairs — a label-injection that downstream tenant-scoping or authorization selectors could be tricked by",
+  "summary": "The shadow registry serialized a metric's label set into a `name=value,name=value` string key and re-split it on `,` to build the Prometheus exposition. A label VALUE containing a comma therefore split into multiple label pairs, so a single operator-set label could forge additional label pairs in the scrape output (for example turning one `route` label into a `route` plus an attacker-named label), which downstream tenant-scoping filters, authorization selectors, recording rules, and alerting trust as a boundary; two distinct label sets could also collide into one cardinality bucket. The label key now uses canonical-JSON of the string-coerced label set (the same approach the main registry already used) and the render path emits the structured label set kept alongside that key rather than splitting or re-parsing, so a `,` or `=` inside a label value stays inside the value and a label NAMED `constructor`, `prototype`, or `__proto__` (all valid Prometheus label names) is preserved instead of being dropped. Note: the cardinality keys exposed by `shadowRegistry().snapshot()` are now canonical-JSON strings (e.g. `{\"route\":\"/api\"}`) rather than `route=/api`.",
+  "sections": [
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "Label values can no longer forge extra Prometheus label pairs in the shadow registry",
+          "body": "b.metrics shadowRegistry built a metric's cardinality key by joining `name=value` pairs with commas, then split that string on commas when rendering the Prometheus exposition. A comma (and `=`) in a label value therefore broke one value into several forged label pairs in the scrape output, and two different label sets could collide into the same cardinality bucket. The key is now canonical-JSON of the string-coerced label set and the render emits the structured label set kept alongside that key rather than splitting or re-parsing, so a label value is emitted as a single quoted value with its commas/equals intact, distinct label sets get distinct keys, and a label NAMED `constructor`, `prototype`, or `__proto__` (each a valid Prometheus label name) is preserved rather than dropped. Deterministic regression tests assert a comma-bearing label value produces exactly one label pair and that the reserved-name labels survive render."
+        }
+      ]
+    },
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "shadowRegistry().snapshot() cardinality keys are canonical-JSON",
+          "body": "As a consequence of the label-injection fix, the per-series cardinality keys in a shadow-registry snapshot are now canonical-JSON strings (e.g. `{\"tenant\":\"a\"}`) instead of the previous `tenant=a` form. Code that reads those keys directly from snapshot() should parse them as JSON; the Prometheus render output is unchanged for conforming label values."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/metrics-shadow-registry.test.js

@@ -28,7 +28,7 @@ function testInc() {
   shadow.inc("hits", { route: "/api" });
   var snap = shadow.snapshot();
   check("counter incremented",      snap.counters.hits[""] === 2);
-  check("labeled counter tracked",  snap.counters.hits["route=/api"] === 1);
+  check("labeled counter tracked",  snap.counters.hits['{"route":"/api"}'] === 1);
   // Non-mirrored counter silently ignored.
   shadow.inc("not_mirrored");
   check("non-mirrored ignored",     snap.counters.not_mirrored === undefined);
@@ -43,7 +43,7 @@ function testSet() {
   shadow.set("queue_depth", 7, { tenant: "a" });
   var snap = shadow.snapshot();
   check("gauge set",                snap.gauges.queue_depth[""] === 42);
-  check("labeled gauge",            snap.gauges.queue_depth["tenant=a"] === 7);
+  check("labeled gauge",            snap.gauges.queue_depth['{"tenant":"a"}'] === 7);
 }
 
 function testCardinalityCap() {
@@ -83,6 +83,60 @@ function testPrometheusPreservesLabels() {
     out.indexOf("# TYPE tenant_b_hits_total counter") !== -1);
 }
 
+function testPrometheusLabelValueInjection() {
+  // A `,` or `=` in a label VALUE must stay inside the value — it must NOT
+  // forge extra label pairs in the exposition output (label injection that
+  // downstream tenant-scoping / authz selectors / recording rules would trust
+  // as a boundary). The shadow registry previously serialized the label set to
+  // a `name=value,...` key and re-split it on `,` for rendering, so a comma in
+  // a value split into multiple forged pairs.
+  var shadow = b.metrics.snapshot.shadowRegistry({
+    namespace: "tenant_x",
+    counters:  ["hits_total"],
+  });
+  shadow.inc("hits_total", { route: 'a,evil="bad' });
+  var out = shadow.render({ format: "prometheus" });
+  // The full value (comma + escaped quote) stays inside route's quotes.
+  check("label value with a comma stays inside the value (no forged pair)",
+    out.indexOf('route="a,evil=\\"bad"') !== -1);
+  // The series line carries exactly ONE label pair (no injected second label).
+  var line = out.split("\n").filter(function (l) { return l.indexOf("tenant_x_hits_total{") === 0; })[0] || "";
+  var braces = line.slice(line.indexOf("{") + 1, line.lastIndexOf("}"));
+  var labelNames = (braces.match(/(^|,)[a-zA-Z_][a-zA-Z0-9_]*="/g) || []).length;                     // allow:regex-no-length-cap — counts top-level label-name= boundaries in a bounded exposition line
+  check("exactly one label pair (no injected label)", labelNames === 1);
+}
+
+function testPrometheusReservedLabelNames() {
+  // A label whose NAME is `constructor`, `prototype`, or `__proto__` is a valid
+  // Prometheus label name ([a-zA-Z_][a-zA-Z0-9_]*) and must survive render. The
+  // shadow registry must NOT route the label key through a prototype-pollution-
+  // hardened JSON parse (which strips those names), nor lose the dimension.
+  var shadow = b.metrics.snapshot.shadowRegistry({
+    namespace: "tenant_y",
+    counters:  ["hits_total"],
+  });
+  shadow.inc("hits_total", { constructor: "a" });
+  shadow.inc("hits_total", { prototype: "b" });
+  // `{ __proto__: "c" }` as a literal sets the prototype (a no-op for a string);
+  // the real vector is a labels object that came from parsed external data, so
+  // its `__proto__` is an own enumerable property.
+  shadow.inc("hits_total", JSON.parse('{"__proto__":"c"}'));
+  var out = shadow.render({ format: "prometheus" });
+  check("label named constructor survives render",
+    out.indexOf('tenant_y_hits_total{constructor="a"} 1') !== -1);
+  check("label named prototype survives render",
+    out.indexOf('tenant_y_hits_total{prototype="b"} 1') !== -1);
+  check("label named __proto__ survives render",
+    out.indexOf('tenant_y_hits_total{__proto__="c"} 1') !== -1);
+  // No dimension collapsed into a bare unlabeled series: every value line for
+  // this metric carries a label brace.
+  var valueLines = out.split("\n").filter(function (l) {
+    return l.indexOf("tenant_y_hits_total") === 0 && l.indexOf("# TYPE") !== 0;
+  });
+  var bare = valueLines.filter(function (l) { return l.indexOf("{") === -1; });
+  check("no unlabeled bare series leaked", bare.length === 0);
+}
+
 function testRefusalsAtConfigTime() {
   var threw;
   threw = false; try { b.metrics.snapshot.shadowRegistry({}); } catch (_e) { threw = true; }
@@ -105,6 +159,8 @@ function run() {
   testSet();
   testCardinalityCap();
   testPrometheusPreservesLabels();
+  testPrometheusLabelValueInjection();
+  testPrometheusReservedLabelNames();
   testRefusalsAtConfigTime();
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.4.128",
+  "version": "0.5.1",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {