@blamejs/blamejs-shop 0.5.0 → 0.5.1

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.5.x
 
+- v0.5.1 (2026-06-27) — **Vendored framework refreshed to 0.15.35 — Prometheus label-injection fix in the metrics shadow registry.** Updates the vendored blamejs framework to 0.15.35. The upstream release fixes a label-injection in the framework's metrics shadow registry: it built a metric's cardinality key by joining label pairs with commas and re-split that string when rendering the Prometheus exposition, so a comma (or `=`) inside a label VALUE forged additional label pairs in the scrape output — which downstream tenant-scoping filters, authorization selectors, recording rules, and alerting trust as a boundary — and two distinct label sets could collide into one cardinality bucket. The key now uses canonical-JSON of the label set and the render emits the structured labels instead of re-splitting, so a value's commas/equals stay inside the value and a label named `constructor` / `prototype` / `__proto__` is preserved. This storefront does not compose the metrics shadow registry, so there is no runtime change for it; the fix ships in the vendored framework regardless and no operator action is required. **Changed:** *Vendored framework refreshed to 0.15.35 (Prometheus label-injection fix)* — Refreshes the vendored blamejs framework to 0.15.35. The upstream fix stops a comma or `=` in a metric label value from forging extra Prometheus label pairs in the shadow registry's scrape output — the cardinality key is now canonical-JSON of the label set and the render emits the structured labels rather than splitting a joined string, so distinct label sets stay distinct and reserved-name labels survive. The shipped storefront does not expose the metrics shadow registry, so its runtime, public API, and wire format are unchanged; the hardened framework simply rides along.
+
 - v0.5.0 (2026-06-27) — **Affiliate commissions gain a tamper-evident hash chain, joining the gift-card, store-credit, and loyalty ledgers.** The affiliate-commission ledger was the last money ledger without tamper-evidence. Each commission is now linked into a per-affiliate SHA3-512 hash chain: a row names its predecessor, a uniqueness fence allows exactly one child per chain tip (so concurrent commissions for the same affiliate serialize instead of forking), and editing a commission's money fields or deleting a row from the middle breaks the linkage. Unlike the append-only gift-card / store-credit / loyalty ledgers, an affiliate commission walks a pending → paid → voided payout lifecycle in place, so the chain hashes only the immutable money facts — order, affiliate, order total, commission, currency, and time — and leaves the lifecycle columns out, meaning a legitimate payout or void never breaks the chain while an inflated amount or a removed row still does. A new `affiliates.verifyChain(affiliateId)` recomputes an affiliate's chain end to end and reports the first divergence, and accepts a trusted anchor (row count + head hash from an earlier snapshot) to also catch a truncation that deletes the most-recent commissions. Migration 0238 adds the chain columns + fence; commissions recorded before it are tolerated as an unverifiable legacy prefix, and the chain anchors fresh from the first commission recorded afterward. **Added:** *Affiliate commissions are a verifiable, fork-proof per-affiliate hash chain* — Recording a commission now links it into the affiliate's SHA3-512 hash chain — `row_hash = SHA3-512(prev_hash || canonical-json(immutable fields))` — under a `UNIQUE(affiliate_id, prev_hash)` parent fence, so a commission derived from a stale tip collides and retries instead of forking the chain, and concurrent commissions for one affiliate serialize. Because a commission's status, paid-at, payout reference, and void reason are stamped in place over its lifetime, only the immutable money facts are hashed, so a `pending → paid → voided` transition leaves the chain valid while tampering with the order total or commission amount, or deleting a commission, is detected. `affiliates.verifyChain(affiliateId)` walks the chain and reports the first break; pass `{ anchor: { count, head } }` to also rule out a tail truncation. Commissions written before this release are tolerated as an unverifiable legacy prefix and the chain anchors fresh from the next one — no backfill required. Migration 0238 adds the columns and the fence.
 
 ## v0.4.x

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.5.0",
+  "version": "0.5.1",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-imfe0otYErcB8rr2h6KLSGTtStirysptpXETSPY4zLv3bZoIT75Lo1dOvkOav+xL",

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.15.34",
-      "tag": "v0.15.34",
+      "version": "0.15.35",
+      "tag": "v0.15.35",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",
@@ -857,6 +857,7 @@
         "release-notes/v0.15.32.json": "lib/vendor/blamejs/release-notes/v0.15.32.json",
         "release-notes/v0.15.33.json": "lib/vendor/blamejs/release-notes/v0.15.33.json",
         "release-notes/v0.15.34.json": "lib/vendor/blamejs/release-notes/v0.15.34.json",
+        "release-notes/v0.15.35.json": "lib/vendor/blamejs/release-notes/v0.15.35.json",
         "release-notes/v0.15.4.json": "lib/vendor/blamejs/release-notes/v0.15.4.json",
         "release-notes/v0.15.5.json": "lib/vendor/blamejs/release-notes/v0.15.5.json",
         "release-notes/v0.15.6.json": "lib/vendor/blamejs/release-notes/v0.15.6.json",
@@ -1534,7 +1535,7 @@
         "test/smoke.js": "lib/vendor/blamejs/test/smoke.js"
       },
       "bundler": "shallow git clone of release tag from github.com/blamejs/blamejs",
-      "bundledAt": "2026-06-26",
+      "bundledAt": "2026-06-27",
       "hashes": {
         ".clusterfuzzlite/Dockerfile": "sha256:6587c80f02f3d622b782380ff1aaa7753b948023ff1d4af8ac27709d1876c218",
         ".clusterfuzzlite/build.sh": "sha256:b9f5a627272c65f6569fa20dcbb32c383ca3a1183ce2562d481408a2fbaf9881",
@@ -1565,7 +1566,7 @@
         ".npmrc": "sha256:66f104e7d07c496d2d0409988225e8c0e4ceb8d247dbcac3be75b2128d20ce66",
         ".pinact.yaml": "sha256:0213ffda55961dc49b64c0a5dfa3c0567419633b1499d57eaf7c8d842d7da6c7",
         "ARCHITECTURE.md": "sha256:9b1c8d2b1b7a41838eb348b0a008e4b4369718fd72bfe2974b37155f7536d35b",
-        "CHANGELOG.md": "sha256:98f034fdf893233e36e89e1f8eaa1548f1de448d67f5afef4e07b401bccb4aa2",
+        "CHANGELOG.md": "sha256:52a0cf964a432750c3cfb566dd024b55286cb1036a0e5c4c3cbaf56c6b7a1da6",
         "CODE_OF_CONDUCT.md": "sha256:148a281960fff7c2fe6554dab66da572c72245ddeb00b0d14811558397bff386",
         "CONTRIBUTING.md": "sha256:bb4dbdbc8598da31dbce653a8ed322e08ff46560173f2eb67a4d684653948332",
         "GOVERNANCE.md": "sha256:906df6afb1f552b27b9acb50f7f96c47b917a2f1021cd4e987dbf4ee0e0a821b",
@@ -1575,7 +1576,7 @@
         "NOTICE": "sha256:f487fa47a11aca0f89e2615cdd3c713e9842abf7a30d8d328eeeae1c864aa774",
         "README.md": "sha256:3ddcc197b003da0b02db8bdd1aef1e943c94f7eab613c633d6a45bb11d0a80e9",
         "SECURITY.md": "sha256:77d8c2bcc04b425a08ef30e51204cebddbd48954b028a259c7a8412dbfeab40a",
-        "api-snapshot.json": "sha256:610a4caba49d95d48cd4a129b4071e1756903eaea0de8eb904e6d76e1a887501",
+        "api-snapshot.json": "sha256:097e1361a6d64b9b25830f0ba1c0440b39f7efce8770d5b7a9d0545d73cc5439",
         "assets/BlameJS_Logo.png": "sha256:3c65699753c771b48ef9ac7f45bb40815ec19a23afcdd0cd30ef4601bbbe293e",
         "assets/BlameJS_Logo.svg": "sha256:dda44f3fb1343d5de9db6b1fcdb75fc649c57e7a99a8e8239fcf852e3841e1a8",
         "bench/README.md": "sha256:74202f2507fd840bfc1ac6c681975d9273cf36cca6e0f72655f138337304033c",
@@ -2107,7 +2108,7 @@
         "lib/mcp-tool-registry.js": "sha256:df3480e6a0d29a9734bdb19d322f83bff5ebfdd756620f947cf593878dea8776",
         "lib/mcp.js": "sha256:c65af74fdb3cf30436699aba5051c4d6e8cb972887cbaaecc46250d557599953",
         "lib/mdoc.js": "sha256:bc31d38d6fdfac8db8f040dfa4d33ab40405f56340bb4ec978f3ba98e93f6433",
-        "lib/metrics.js": "sha256:edc2a3f08a48ab67c9e805cb75839cc9d326ac334478b0f30db0423102ee5713",
+        "lib/metrics.js": "sha256:55d445b738b2cfc8ceb1bfa7a1e69b306497e8065ea86d61e4f4087873acce1b",
         "lib/middleware/age-gate.js": "sha256:dc8c61a4d41f4a781220c9c97eb475fb2867f5ee444eb2756badcbc5b8411795",
         "lib/middleware/ai-act-disclosure.js": "sha256:6fc62940d85813019b31c586fc86853570329a939565a6947f81052d50977c42",
         "lib/middleware/api-encrypt.js": "sha256:f90210bfc4fe04b50f6d72e14676a140c5759e255ed359567066a1e80ab5fb63",
@@ -2346,7 +2347,7 @@
         "oss-fuzz/projects/blamejs/README.md": "sha256:ae13b7bb79ed8d69b1b3276e5562807a0349fb6e6b7d11cf1f683aad1eafdb4b",
         "oss-fuzz/projects/blamejs/build.sh": "sha256:0ced1cf21782c97be7f8d74faf5e27a308b60b2f858836fb5ca3b8c4e939a8f7",
         "oss-fuzz/projects/blamejs/project.yaml": "sha256:59f2cb83aa622325a175b77416fe155be15b70a9c798bd1a78bba05763b1b03d",
-        "package.json": "sha256:ca031cc44ce6ade614e436bd1f29d01cd2d495ad41c55a819c02c85a5f3a2f96",
+        "package.json": "sha256:680de6ef3cb4b04dc38a51d9671f5bc817199fe7724290a05b6404af36318b45",
         "release-notes/v0.0.x.json": "sha256:7a49819f30068ee119000cad7010194882bb8bfaa12acbdab4dfc066efb7982f",
         "release-notes/v0.1.x.json": "sha256:6742a8c17f947c5cb76f69dead7eea86b942d80621d914b774ba5488e09937e5",
         "release-notes/v0.10.x.json": "sha256:fe498045daf88337bd3d987e5964aa42c99a50e1685b6f09e51f698b8687726f",
@@ -2383,6 +2384,7 @@
         "release-notes/v0.15.32.json": "sha256:af99a8a782dcc30aff3a135c27179b064d63181fc4c302c31da632c1615b68ce",
         "release-notes/v0.15.33.json": "sha256:295ea9939b74498c7f0be6afdc8bc511f97cb2383a436c3040c58b0600598b19",
         "release-notes/v0.15.34.json": "sha256:2a1b36d897d8e9f2cece051c098030f08d9c6ee6bef136800bd19453ad65f188",
+        "release-notes/v0.15.35.json": "sha256:e317b2252734aace7a0f734e3ab40c3a0c4ac208d678c0e9834be34eb424d15b",
         "release-notes/v0.15.4.json": "sha256:6ac7fa0ef1728c27e71b2050d1b07a810f9b4b1440ccddbf28ad56e2f54d8585",
         "release-notes/v0.15.5.json": "sha256:cca1d0edd5d6fc41b512d19d98be224b990dcab41478622c11962f0fcb1bb09a",
         "release-notes/v0.15.6.json": "sha256:0e3b9e5e43b70b61dd258c3003d1b8729cd3c26c62a34dedcca81bbec5d31077",
@@ -2862,7 +2864,7 @@
         "test/layer-0-primitives/mcp-tool-registry.test.js": "sha256:4d9a9a367489d93afcc8e0bca3442e0aefc683e40ddd29e6e2cddbe3a3b8732f",
         "test/layer-0-primitives/mcp.test.js": "sha256:896a9b55fd9d21a1ec2b0d0753b5796eb045911ad28992ba17338285406ac2f9",
         "test/layer-0-primitives/mdoc.test.js": "sha256:2fe1086192385e71f858554d676b299b86594d34226e1d774ffefc97b5fa03a4",
-        "test/layer-0-primitives/metrics-shadow-registry.test.js": "sha256:8ea834fd6b549c18976b535660a53aafccb1c6f0b7762086e8dbbc7ab8d832b6",
+        "test/layer-0-primitives/metrics-shadow-registry.test.js": "sha256:a91a9efdb4aa28caed846b969d7c1e5ebfc57067afad85800daa430942d02725",
         "test/layer-0-primitives/metrics-snapshot.test.js": "sha256:aa405be22acb6680b062d1de1aa7ce00029e414218a0e4e521e10a14b2254851",
         "test/layer-0-primitives/middleware-compose-pipeline.test.js": "sha256:a779468bde043b6de4add5d4405a33973163890ee667b833e3330373ee64f77d",
         "test/layer-0-primitives/mime-parse.test.js": "sha256:73ccfea7d08b0c3b5fb899215806d4f430c02bf63e21835024a4cdcfc4254b31",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.35 (2026-06-26) — **`b.metrics` shadow registry no longer lets a comma in a label value forge extra Prometheus label pairs — a label-injection that downstream tenant-scoping or authorization selectors could be tricked by.** The shadow registry serialized a metric's label set into a `name=value,name=value` string key and re-split it on `,` to build the Prometheus exposition. A label VALUE containing a comma therefore split into multiple label pairs, so a single operator-set label could forge additional label pairs in the scrape output (for example turning one `route` label into a `route` plus an attacker-named label), which downstream tenant-scoping filters, authorization selectors, recording rules, and alerting trust as a boundary; two distinct label sets could also collide into one cardinality bucket. The label key now uses canonical-JSON of the string-coerced label set (the same approach the main registry already used) and the render path emits the structured label set kept alongside that key rather than splitting or re-parsing, so a `,` or `=` inside a label value stays inside the value and a label NAMED `constructor`, `prototype`, or `__proto__` (all valid Prometheus label names) is preserved instead of being dropped. Note: the cardinality keys exposed by `shadowRegistry().snapshot()` are now canonical-JSON strings (e.g. `{"route":"/api"}`) rather than `route=/api`. **Changed:** *shadowRegistry().snapshot() cardinality keys are canonical-JSON* — As a consequence of the label-injection fix, the per-series cardinality keys in a shadow-registry snapshot are now canonical-JSON strings (e.g. `{"tenant":"a"}`) instead of the previous `tenant=a` form. Code that reads those keys directly from snapshot() should parse them as JSON; the Prometheus render output is unchanged for conforming label values. **Security:** *Label values can no longer forge extra Prometheus label pairs in the shadow registry* — b.metrics shadowRegistry built a metric's cardinality key by joining `name=value` pairs with commas, then split that string on commas when rendering the Prometheus exposition. A comma (and `=`) in a label value therefore broke one value into several forged label pairs in the scrape output, and two different label sets could collide into the same cardinality bucket. The key is now canonical-JSON of the string-coerced label set and the render emits the structured label set kept alongside that key rather than splitting or re-parsing, so a label value is emitted as a single quoted value with its commas/equals intact, distinct label sets get distinct keys, and a label NAMED `constructor`, `prototype`, or `__proto__` (each a valid Prometheus label name) is preserved rather than dropped. Deterministic regression tests assert a comma-bearing label value produces exactly one label pair and that the reserved-name labels survive render.
+
 - v0.15.34 (2026-06-26) — **`b.mail.crypto.pgp.verify` now accepts every valid RSA OpenPGP signature — one whose value happened to have a high zero byte (about 1 in 256) was being rejected.** An OpenPGP RSA signature is an integer modulo the key's modulus, and ~1 in 256 signatures have a value that begins with a zero byte. The MPI encoding strips those leading zero bytes (RFC 9580 §3.2), but b.mail.crypto.pgp.verify passed the stripped value straight to the RSA verification, which requires a signature exactly the modulus byte length — so a perfectly valid signature was intermittently reported invalid. The signature is now left-padded back to the modulus width before verification, exactly as the Ed25519 path already pads its components. Verification of every valid RSA signature is now reliable, including signatures produced by other OpenPGP implementations. Also includes internal test-tooling: two more guard-suite suppression classes were re-verified and their tokens retired. **Fixed:** *RSA OpenPGP signatures with a high zero byte now verify reliably* — b.mail.crypto.pgp.verify read the RSA signature MPI (whose leading zero bytes the OpenPGP wire format strips) and handed it to the RSA verification without restoring the stripped bytes. Node's RSA verify requires the signature to be exactly the modulus byte length, so a signature whose value had one or more high zero bytes — about 1 in 256 of all signatures, for any key — was rejected as invalid even though it was correct. The signature is now left-padded to the modulus width before verification (the same correction the Ed25519 verification path already applied to its R/S components). This affects signatures the framework produces and signatures from other OpenPGP implementations alike. A deterministic regression test searches for a short-MPI signature and asserts it verifies. **Detectors:** *Two more suppression-marker classes re-verified and their tokens retired* — The raw-hash-compare and seal-without-aad guard classes were re-read and confirmed (a data-residency region tag compared with === — not a secret; and two intentional non-AEAD-bound seals — a non-regulated plain-mode column whose AAD is enforced by the posture seal-envelope floor where it matters, and a throwaway vault-readiness probe), then renamed to descriptive tokens with their old names added to the retired-token set. Test-suite tooling only.
 
 - v0.15.33 (2026-06-26) — **Internal test-suite hardening only — the published library's runtime behavior and public API are unchanged (source-comment marker text aside).** Three more suppression classes in the codebase-patterns guard suite were re-verified from scratch and renamed to descriptive tokens, with their old names recorded as retired and their in-source marker comments updated to match. No runtime code, public API, or wire format changed. **Detectors:** *Three more suppression-marker classes re-verified and their tokens retired* — Continuing the re-verification pass: each marked site for the math-random-noncrypto, raw-new-url, and dynamic-require guard classes was re-read and confirmed (non-security jitter/sampling; URL parsing for shape/origin inspection or behind the safe wrapper; operator-supplied module loads), then the class was renamed to a descriptive token and its old name added to the retired-token set. This is test-suite tooling; no shipped framework behavior changed.

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.15.34",
-  "createdAt": "2026-06-26T23:09:44.793Z",
+  "frameworkVersion": "0.15.35",
+  "createdAt": "2026-06-27T05:20:14.742Z",
   "exports": {
     "a2a": {
       "type": "object",

package/lib/vendor/blamejs/lib/metrics.js

@@ -1352,6 +1352,14 @@ function shadowRegistry(opts) {
   var counters = Object.create(null);
   var gauges   = Object.create(null);
   var info     = Object.create(null);
+  // Maps a canonical-JSON cardinality key → the string-coerced, null-prototype
+  // label object that produced it, so the render path reads the structured
+  // labels directly instead of re-parsing the key. Re-parsing would both lose a
+  // label NAMED `constructor` / `prototype` / `__proto__` (all valid Prometheus
+  // label names) to a prototype-pollution-hardened JSON parse, and reintroduce a
+  // serialize-then-split round-trip. Populated only when a value is actually
+  // stored, so it stays bounded by the cardinality cap.
+  var labelSets = Object.create(null);
   var lastCardinalityAuditMs = 0;
 
   function _cardinalityHit(metric) {
@@ -1375,19 +1383,27 @@ function shadowRegistry(opts) {
     }
   }
 
-  function _labelKey(labels) {
-    if (!labels || typeof labels !== "object") return "";
-    var keys = Object.keys(labels).sort();                                                            // allow:bare-canonicalize-walk — label-set canonicalization for cardinality keying
-    var parts = [];
-    for (var i = 0; i < keys.length; i += 1) {
-      parts.push(keys[i] + "=" + String(labels[keys[i]]));
-    }
-    return parts.join(",");
+  function _coerceLabels(labels) {
+    // → { key, set }: the canonical-JSON cardinality key (collision-proof and
+    // injection-proof, matching the main registry's _labelsKey) plus the
+    // string-coerced, null-prototype label object it came from. The render path
+    // reads `set` directly rather than re-parsing `key`, so a `,` or `=` in a
+    // label VALUE can never forge extra label pairs and a label NAMED
+    // `constructor` / `prototype` / `__proto__` survives verbatim. The
+    // null-prototype object makes a `__proto__` label a normal own property
+    // rather than a prototype assignment.
+    if (!labels || typeof labels !== "object") return { key: "", set: null };
+    var keys = Object.keys(labels);
+    if (keys.length === 0) return { key: "", set: null };
+    var coerced = Object.create(null);
+    for (var i = 0; i < keys.length; i += 1) coerced[keys[i]] = String(labels[keys[i]]);
+    return { key: canonicalJson.stringify(coerced), set: coerced };
   }
 
   function inc(name, labels) {
     if (!counterSet[name]) return;
-    var lk = _labelKey(labels);
+    var ck = _coerceLabels(labels);
+    var lk = ck.key;
     if (!counters[name]) counters[name] = Object.create(null);
     var current = counters[name][lk];
     if (current === undefined) {
@@ -1396,6 +1412,7 @@ function shadowRegistry(opts) {
         return;
       }
       counters[name][lk] = 1;
+      if (ck.set) labelSets[lk] = ck.set;
     } else {
       counters[name][lk] = current + 1;
     }
@@ -1407,13 +1424,15 @@ function shadowRegistry(opts) {
       throw new MetricsError("metrics-shadow/bad-gauge-value",
         "shadowRegistry.set: '" + name + "' value must be a finite number");
     }
-    var lk = _labelKey(labels);
+    var ck = _coerceLabels(labels);
+    var lk = ck.key;
     if (!gauges[name]) gauges[name] = Object.create(null);
     if (gauges[name][lk] === undefined && Object.keys(gauges[name]).length >= cap) {
       _cardinalityHit(name);
       return;
     }
     gauges[name][lk] = value;
+    if (ck.set) labelSets[lk] = ck.set;
   }
 
   function setInfo(name, value) {
@@ -1449,22 +1468,21 @@ function shadowRegistry(opts) {
         for (var li = 0; li < lks.length; li += 1) {
           var lk = lks[li];
           if (lk === "") { out.push(metric + " " + labelMap[lk]); continue; }
-          // The label-key string was assembled by `_labelKey` from a
-          // single shadow-registry call's `labels` object — values
-          // are framework-internal (operator code that supplied them
-          // is bounded by guards upstream); split on `,` is safe.
-          // Not a header-value parse (which would need a quoted-
-          // string aware split per RFC 9110).
-          var lpairs = lk.split(",");                                                                // allow:bare-split-on-quoted-header — framework-internal label-key (assembled by _labelKey), not an HTTP header parse
+          // Read the structured label set kept alongside the canonical key (see
+          // _coerceLabels) rather than re-parsing the key. No serialize-then-
+          // split round-trip, so a `,` or `=` in a label value stays inside the
+          // value and can never forge extra label pairs; and a label NAMED
+          // `constructor` / `prototype` / `__proto__` survives instead of being
+          // stripped by a prototype-pollution-hardened parse.
+          var labelObj = labelSets[lk];
+          if (!labelObj || typeof labelObj !== "object") { out.push(metric + " " + labelMap[lk]); continue; }
+          var lnames = Object.keys(labelObj).sort();                                                 // allow:bare-canonicalize-walk — deterministic label ordering in the exposition line
           var formatted = [];
-          for (var pi = 0; pi < lpairs.length; pi += 1) {
-            var eqIdx = lpairs[pi].indexOf("=");
-            if (eqIdx === -1) continue;
-            var lname = lpairs[pi].slice(0, eqIdx);
-            var lvalue = lpairs[pi].slice(eqIdx + 1);
+          for (var pi = 0; pi < lnames.length; pi += 1) {
+            var lname = lnames[pi];
             if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(lname)) continue;                                   // allow:regex-no-length-cap — Prometheus label-name shape
             // Prometheus exposition: escape `\`, `"`, `\n` in label values.
-            lvalue = String(lvalue).replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n"); // allow:regex-no-length-cap — fixed-char-set escape // allow:duplicate-regex — Prometheus value escape shape
+            var lvalue = String(labelObj[lname]).replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n"); // allow:regex-no-length-cap — fixed-char-set escape // allow:duplicate-regex — Prometheus value escape shape
             formatted.push(lname + '="' + lvalue + '"');
           }
           out.push(metric + "{" + formatted.join(",") + "} " + labelMap[lk]);
@@ -1516,9 +1534,10 @@ function shadowRegistry(opts) {
   }
 
   function reset() {
-    counters = Object.create(null);
-    gauges   = Object.create(null);
-    info     = Object.create(null);
+    counters  = Object.create(null);
+    gauges    = Object.create(null);
+    info      = Object.create(null);
+    labelSets = Object.create(null);
     lastCardinalityAuditMs = 0;
   }
 

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.34",
+  "version": "0.15.35",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.15.35.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.15.35",
+  "date": "2026-06-26",
+  "headline": "`b.metrics` shadow registry no longer lets a comma in a label value forge extra Prometheus label pairs — a label-injection that downstream tenant-scoping or authorization selectors could be tricked by",
+  "summary": "The shadow registry serialized a metric's label set into a `name=value,name=value` string key and re-split it on `,` to build the Prometheus exposition. A label VALUE containing a comma therefore split into multiple label pairs, so a single operator-set label could forge additional label pairs in the scrape output (for example turning one `route` label into a `route` plus an attacker-named label), which downstream tenant-scoping filters, authorization selectors, recording rules, and alerting trust as a boundary; two distinct label sets could also collide into one cardinality bucket. The label key now uses canonical-JSON of the string-coerced label set (the same approach the main registry already used) and the render path emits the structured label set kept alongside that key rather than splitting or re-parsing, so a `,` or `=` inside a label value stays inside the value and a label NAMED `constructor`, `prototype`, or `__proto__` (all valid Prometheus label names) is preserved instead of being dropped. Note: the cardinality keys exposed by `shadowRegistry().snapshot()` are now canonical-JSON strings (e.g. `{\"route\":\"/api\"}`) rather than `route=/api`.",
+  "sections": [
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "Label values can no longer forge extra Prometheus label pairs in the shadow registry",
+          "body": "b.metrics shadowRegistry built a metric's cardinality key by joining `name=value` pairs with commas, then split that string on commas when rendering the Prometheus exposition. A comma (and `=`) in a label value therefore broke one value into several forged label pairs in the scrape output, and two different label sets could collide into the same cardinality bucket. The key is now canonical-JSON of the string-coerced label set and the render emits the structured label set kept alongside that key rather than splitting or re-parsing, so a label value is emitted as a single quoted value with its commas/equals intact, distinct label sets get distinct keys, and a label NAMED `constructor`, `prototype`, or `__proto__` (each a valid Prometheus label name) is preserved rather than dropped. Deterministic regression tests assert a comma-bearing label value produces exactly one label pair and that the reserved-name labels survive render."
+        }
+      ]
+    },
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "shadowRegistry().snapshot() cardinality keys are canonical-JSON",
+          "body": "As a consequence of the label-injection fix, the per-series cardinality keys in a shadow-registry snapshot are now canonical-JSON strings (e.g. `{\"tenant\":\"a\"}`) instead of the previous `tenant=a` form. Code that reads those keys directly from snapshot() should parse them as JSON; the Prometheus render output is unchanged for conforming label values."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/metrics-shadow-registry.test.js

@@ -28,7 +28,7 @@ function testInc() {
   shadow.inc("hits", { route: "/api" });
   var snap = shadow.snapshot();
   check("counter incremented",      snap.counters.hits[""] === 2);
-  check("labeled counter tracked",  snap.counters.hits["route=/api"] === 1);
+  check("labeled counter tracked",  snap.counters.hits['{"route":"/api"}'] === 1);
   // Non-mirrored counter silently ignored.
   shadow.inc("not_mirrored");
   check("non-mirrored ignored",     snap.counters.not_mirrored === undefined);
@@ -43,7 +43,7 @@ function testSet() {
   shadow.set("queue_depth", 7, { tenant: "a" });
   var snap = shadow.snapshot();
   check("gauge set",                snap.gauges.queue_depth[""] === 42);
-  check("labeled gauge",            snap.gauges.queue_depth["tenant=a"] === 7);
+  check("labeled gauge",            snap.gauges.queue_depth['{"tenant":"a"}'] === 7);
 }
 
 function testCardinalityCap() {
@@ -83,6 +83,60 @@ function testPrometheusPreservesLabels() {
     out.indexOf("# TYPE tenant_b_hits_total counter") !== -1);
 }
 
+function testPrometheusLabelValueInjection() {
+  // A `,` or `=` in a label VALUE must stay inside the value — it must NOT
+  // forge extra label pairs in the exposition output (label injection that
+  // downstream tenant-scoping / authz selectors / recording rules would trust
+  // as a boundary). The shadow registry previously serialized the label set to
+  // a `name=value,...` key and re-split it on `,` for rendering, so a comma in
+  // a value split into multiple forged pairs.
+  var shadow = b.metrics.snapshot.shadowRegistry({
+    namespace: "tenant_x",
+    counters:  ["hits_total"],
+  });
+  shadow.inc("hits_total", { route: 'a,evil="bad' });
+  var out = shadow.render({ format: "prometheus" });
+  // The full value (comma + escaped quote) stays inside route's quotes.
+  check("label value with a comma stays inside the value (no forged pair)",
+    out.indexOf('route="a,evil=\\"bad"') !== -1);
+  // The series line carries exactly ONE label pair (no injected second label).
+  var line = out.split("\n").filter(function (l) { return l.indexOf("tenant_x_hits_total{") === 0; })[0] || "";
+  var braces = line.slice(line.indexOf("{") + 1, line.lastIndexOf("}"));
+  var labelNames = (braces.match(/(^|,)[a-zA-Z_][a-zA-Z0-9_]*="/g) || []).length;                     // allow:regex-no-length-cap — counts top-level label-name= boundaries in a bounded exposition line
+  check("exactly one label pair (no injected label)", labelNames === 1);
+}
+
+function testPrometheusReservedLabelNames() {
+  // A label whose NAME is `constructor`, `prototype`, or `__proto__` is a valid
+  // Prometheus label name ([a-zA-Z_][a-zA-Z0-9_]*) and must survive render. The
+  // shadow registry must NOT route the label key through a prototype-pollution-
+  // hardened JSON parse (which strips those names), nor lose the dimension.
+  var shadow = b.metrics.snapshot.shadowRegistry({
+    namespace: "tenant_y",
+    counters:  ["hits_total"],
+  });
+  shadow.inc("hits_total", { constructor: "a" });
+  shadow.inc("hits_total", { prototype: "b" });
+  // `{ __proto__: "c" }` as a literal sets the prototype (a no-op for a string);
+  // the real vector is a labels object that came from parsed external data, so
+  // its `__proto__` is an own enumerable property.
+  shadow.inc("hits_total", JSON.parse('{"__proto__":"c"}'));
+  var out = shadow.render({ format: "prometheus" });
+  check("label named constructor survives render",
+    out.indexOf('tenant_y_hits_total{constructor="a"} 1') !== -1);
+  check("label named prototype survives render",
+    out.indexOf('tenant_y_hits_total{prototype="b"} 1') !== -1);
+  check("label named __proto__ survives render",
+    out.indexOf('tenant_y_hits_total{__proto__="c"} 1') !== -1);
+  // No dimension collapsed into a bare unlabeled series: every value line for
+  // this metric carries a label brace.
+  var valueLines = out.split("\n").filter(function (l) {
+    return l.indexOf("tenant_y_hits_total") === 0 && l.indexOf("# TYPE") !== 0;
+  });
+  var bare = valueLines.filter(function (l) { return l.indexOf("{") === -1; });
+  check("no unlabeled bare series leaked", bare.length === 0);
+}
+
 function testRefusalsAtConfigTime() {
   var threw;
   threw = false; try { b.metrics.snapshot.shadowRegistry({}); } catch (_e) { threw = true; }
@@ -105,6 +159,8 @@ function run() {
   testSet();
   testCardinalityCap();
   testPrometheusPreservesLabels();
+  testPrometheusLabelValueInjection();
+  testPrometheusReservedLabelNames();
   testRefusalsAtConfigTime();
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {