@blamejs/blamejs-shop 0.5.0 → 0.5.2

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.5.x
 
+- v0.5.2 (2026-06-27) — **Vendored framework refreshed to 0.15.36.** Updates the vendored blamejs framework to 0.15.36. The upstream release is internal test-suite tooling only: it re-verifies the guard-suite class that allows a bare comma/semicolon split on token-only RFC header grammars (RRULE, RFC 9421 signature components, TLS-RPT rua, SCIM attribute paths), renames its marker to a descriptive token, and prunes five inert marker comments. No runtime code, public API, or wire format changed upstream, so there is no runtime or behavior change for this storefront and no operator action is required. **Changed:** *Vendored framework refreshed to 0.15.36* — Refreshes the vendored blamejs framework to 0.15.36, an upstream release scoped to test-suite tooling — a guard-suite class re-verified and its marker renamed, plus five inert marker comments removed. The shipped framework runtime, public API, and wire format are unchanged, so no operator action is required.
+
+- v0.5.1 (2026-06-27) — **Vendored framework refreshed to 0.15.35 — Prometheus label-injection fix in the metrics shadow registry.** Updates the vendored blamejs framework to 0.15.35. The upstream release fixes a label-injection in the framework's metrics shadow registry: it built a metric's cardinality key by joining label pairs with commas and re-split that string when rendering the Prometheus exposition, so a comma (or `=`) inside a label VALUE forged additional label pairs in the scrape output — which downstream tenant-scoping filters, authorization selectors, recording rules, and alerting trust as a boundary — and two distinct label sets could collide into one cardinality bucket. The key now uses canonical-JSON of the label set and the render emits the structured labels instead of re-splitting, so a value's commas/equals stay inside the value and a label named `constructor` / `prototype` / `__proto__` is preserved. This storefront does not compose the metrics shadow registry, so there is no runtime change for it; the fix ships in the vendored framework regardless and no operator action is required. **Changed:** *Vendored framework refreshed to 0.15.35 (Prometheus label-injection fix)* — Refreshes the vendored blamejs framework to 0.15.35. The upstream fix stops a comma or `=` in a metric label value from forging extra Prometheus label pairs in the shadow registry's scrape output — the cardinality key is now canonical-JSON of the label set and the render emits the structured labels rather than splitting a joined string, so distinct label sets stay distinct and reserved-name labels survive. The shipped storefront does not expose the metrics shadow registry, so its runtime, public API, and wire format are unchanged; the hardened framework simply rides along.
+
 - v0.5.0 (2026-06-27) — **Affiliate commissions gain a tamper-evident hash chain, joining the gift-card, store-credit, and loyalty ledgers.** The affiliate-commission ledger was the last money ledger without tamper-evidence. Each commission is now linked into a per-affiliate SHA3-512 hash chain: a row names its predecessor, a uniqueness fence allows exactly one child per chain tip (so concurrent commissions for the same affiliate serialize instead of forking), and editing a commission's money fields or deleting a row from the middle breaks the linkage. Unlike the append-only gift-card / store-credit / loyalty ledgers, an affiliate commission walks a pending → paid → voided payout lifecycle in place, so the chain hashes only the immutable money facts — order, affiliate, order total, commission, currency, and time — and leaves the lifecycle columns out, meaning a legitimate payout or void never breaks the chain while an inflated amount or a removed row still does. A new `affiliates.verifyChain(affiliateId)` recomputes an affiliate's chain end to end and reports the first divergence, and accepts a trusted anchor (row count + head hash from an earlier snapshot) to also catch a truncation that deletes the most-recent commissions. Migration 0238 adds the chain columns + fence; commissions recorded before it are tolerated as an unverifiable legacy prefix, and the chain anchors fresh from the first commission recorded afterward. **Added:** *Affiliate commissions are a verifiable, fork-proof per-affiliate hash chain* — Recording a commission now links it into the affiliate's SHA3-512 hash chain — `row_hash = SHA3-512(prev_hash || canonical-json(immutable fields))` — under a `UNIQUE(affiliate_id, prev_hash)` parent fence, so a commission derived from a stale tip collides and retries instead of forking the chain, and concurrent commissions for one affiliate serialize. Because a commission's status, paid-at, payout reference, and void reason are stamped in place over its lifetime, only the immutable money facts are hashed, so a `pending → paid → voided` transition leaves the chain valid while tampering with the order total or commission amount, or deleting a commission, is detected. `affiliates.verifyChain(affiliateId)` walks the chain and reports the first break; pass `{ anchor: { count, head } }` to also rule out a tail truncation. Commissions written before this release are tolerated as an unverifiable legacy prefix and the chain anchors fresh from the next one — no backfill required. Migration 0238 adds the columns and the fence.
 
 ## v0.4.x

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.5.0",
+  "version": "0.5.2",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-imfe0otYErcB8rr2h6KLSGTtStirysptpXETSPY4zLv3bZoIT75Lo1dOvkOav+xL",

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.15.34",
-      "tag": "v0.15.34",
+      "version": "0.15.36",
+      "tag": "v0.15.36",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",
@@ -857,6 +857,8 @@
         "release-notes/v0.15.32.json": "lib/vendor/blamejs/release-notes/v0.15.32.json",
         "release-notes/v0.15.33.json": "lib/vendor/blamejs/release-notes/v0.15.33.json",
         "release-notes/v0.15.34.json": "lib/vendor/blamejs/release-notes/v0.15.34.json",
+        "release-notes/v0.15.35.json": "lib/vendor/blamejs/release-notes/v0.15.35.json",
+        "release-notes/v0.15.36.json": "lib/vendor/blamejs/release-notes/v0.15.36.json",
         "release-notes/v0.15.4.json": "lib/vendor/blamejs/release-notes/v0.15.4.json",
         "release-notes/v0.15.5.json": "lib/vendor/blamejs/release-notes/v0.15.5.json",
         "release-notes/v0.15.6.json": "lib/vendor/blamejs/release-notes/v0.15.6.json",
@@ -1534,7 +1536,7 @@
         "test/smoke.js": "lib/vendor/blamejs/test/smoke.js"
       },
       "bundler": "shallow git clone of release tag from github.com/blamejs/blamejs",
-      "bundledAt": "2026-06-26",
+      "bundledAt": "2026-06-27",
       "hashes": {
         ".clusterfuzzlite/Dockerfile": "sha256:6587c80f02f3d622b782380ff1aaa7753b948023ff1d4af8ac27709d1876c218",
         ".clusterfuzzlite/build.sh": "sha256:b9f5a627272c65f6569fa20dcbb32c383ca3a1183ce2562d481408a2fbaf9881",
@@ -1565,7 +1567,7 @@
         ".npmrc": "sha256:66f104e7d07c496d2d0409988225e8c0e4ceb8d247dbcac3be75b2128d20ce66",
         ".pinact.yaml": "sha256:0213ffda55961dc49b64c0a5dfa3c0567419633b1499d57eaf7c8d842d7da6c7",
         "ARCHITECTURE.md": "sha256:9b1c8d2b1b7a41838eb348b0a008e4b4369718fd72bfe2974b37155f7536d35b",
-        "CHANGELOG.md": "sha256:98f034fdf893233e36e89e1f8eaa1548f1de448d67f5afef4e07b401bccb4aa2",
+        "CHANGELOG.md": "sha256:7b4cf6d91c65bf01fda536a83f26198e722bf97cef6c88f3cfd58436ebc2e43a",
         "CODE_OF_CONDUCT.md": "sha256:148a281960fff7c2fe6554dab66da572c72245ddeb00b0d14811558397bff386",
         "CONTRIBUTING.md": "sha256:bb4dbdbc8598da31dbce653a8ed322e08ff46560173f2eb67a4d684653948332",
         "GOVERNANCE.md": "sha256:906df6afb1f552b27b9acb50f7f96c47b917a2f1021cd4e987dbf4ee0e0a821b",
@@ -1575,7 +1577,7 @@
         "NOTICE": "sha256:f487fa47a11aca0f89e2615cdd3c713e9842abf7a30d8d328eeeae1c864aa774",
         "README.md": "sha256:3ddcc197b003da0b02db8bdd1aef1e943c94f7eab613c633d6a45bb11d0a80e9",
         "SECURITY.md": "sha256:77d8c2bcc04b425a08ef30e51204cebddbd48954b028a259c7a8412dbfeab40a",
-        "api-snapshot.json": "sha256:610a4caba49d95d48cd4a129b4071e1756903eaea0de8eb904e6d76e1a887501",
+        "api-snapshot.json": "sha256:204692f40f115ba8cc211fd485feb2a11bfae877b9c013aba085c0729cf267bc",
         "assets/BlameJS_Logo.png": "sha256:3c65699753c771b48ef9ac7f45bb40815ec19a23afcdd0cd30ef4601bbbe293e",
         "assets/BlameJS_Logo.svg": "sha256:dda44f3fb1343d5de9db6b1fcdb75fc649c57e7a99a8e8239fcf852e3841e1a8",
         "bench/README.md": "sha256:74202f2507fd840bfc1ac6c681975d9273cf36cca6e0f72655f138337304033c",
@@ -1872,7 +1874,7 @@
         "lib/cache-redis.js": "sha256:661ba39417085682cee1e5524685c9cb1e1277c6f1cef9ca4ae808e457d5499e",
         "lib/cache-status.js": "sha256:f82bf22698c9b4fa10b7dc581fd39b83709267f105195908eee29612a14df15d",
         "lib/cache.js": "sha256:e38929b261a6c9ea2dd822f39f2669c2ee5bbc6729517ced49471227d1d5ddb9",
-        "lib/calendar.js": "sha256:08896ec0e8e07e7da3a94c18046cba9ea082e5a5af16ab459604862f70fd11ef",
+        "lib/calendar.js": "sha256:040bcf1385ffea3eb5779f1192f7f01889e498a3773de4c81d3cd37fc5b98307",
         "lib/canonical-json.js": "sha256:3546e2a4b7692c4f8c77602e8804a8aaebff29b2183329588578c1d6f0df3eee",
         "lib/cbor.js": "sha256:9b6a6799b10646e50705f9e0839fbac2f3b8df6e41943170c15e308215936feb",
         "lib/cdn-cache-control.js": "sha256:adc1e5bdc59492de9e2f688dbee279a0ab09166adba609c4b5355028c4d3e0d1",
@@ -2028,10 +2030,10 @@
         "lib/handlers.js": "sha256:860d07682bc6199c5d06f2d91f4ba9ab26ff5e2d9a97c72af6a700505d0e44e2",
         "lib/honeytoken.js": "sha256:288a69a6c22107d41185c88ec86ca1bf424b3c10d349d90d5fc5037749db0568",
         "lib/html-balance.js": "sha256:da49a83a2b17e9e5feb3f061e59bb595ceb37d8dfb6a7c1da7ab230705b7259f",
-        "lib/http-client-cache.js": "sha256:a4d41376c761d731427844e1aba76822ffb597e1d892b6df93d5ef807489ede3",
+        "lib/http-client-cache.js": "sha256:52a0ef4ce9bfa99886f0e26c7fd4649b6cb6294c0f7e46279f23c76437a8fc64",
         "lib/http-client-cookie-jar.js": "sha256:50aee1674d2c2ac73fc153fffd6be6d2628326cf85ac15e7d19b9bcd1e727826",
         "lib/http-client.js": "sha256:99f1a4faf97e858794d4422a8cc9a813154d251413ffce328635a7e93e85d62b",
-        "lib/http-message-signature.js": "sha256:45fbc4462af19f6237ba678aed38341c8702301220c79d61a05d08114aafcf63",
+        "lib/http-message-signature.js": "sha256:3d5faf7637ceea9dfa1d281848d11e790100e113f5ef3366fc4c733d5f29b4b9",
         "lib/http2-teardown.js": "sha256:61d291c34e321e18b64d60a4c0253e638550fff7dc32568b980d3aa13bb178e2",
         "lib/i18n-messageformat.js": "sha256:2c5012ac3fbc6f56191765bda090889ab58206d130cf05c81963d965744d63d6",
         "lib/i18n.js": "sha256:e2663046590798f2dde5cb73f14973ca509070841dff7c9697546e5dc0ec195a",
@@ -2107,7 +2109,7 @@
         "lib/mcp-tool-registry.js": "sha256:df3480e6a0d29a9734bdb19d322f83bff5ebfdd756620f947cf593878dea8776",
         "lib/mcp.js": "sha256:c65af74fdb3cf30436699aba5051c4d6e8cb972887cbaaecc46250d557599953",
         "lib/mdoc.js": "sha256:bc31d38d6fdfac8db8f040dfa4d33ab40405f56340bb4ec978f3ba98e93f6433",
-        "lib/metrics.js": "sha256:edc2a3f08a48ab67c9e805cb75839cc9d326ac334478b0f30db0423102ee5713",
+        "lib/metrics.js": "sha256:55d445b738b2cfc8ceb1bfa7a1e69b306497e8065ea86d61e4f4087873acce1b",
         "lib/middleware/age-gate.js": "sha256:dc8c61a4d41f4a781220c9c97eb475fb2867f5ee444eb2756badcbc5b8411795",
         "lib/middleware/ai-act-disclosure.js": "sha256:6fc62940d85813019b31c586fc86853570329a939565a6947f81052d50977c42",
         "lib/middleware/api-encrypt.js": "sha256:f90210bfc4fe04b50f6d72e14676a140c5759e255ed359567066a1e80ab5fb63",
@@ -2115,7 +2117,7 @@
         "lib/middleware/asyncapi-serve.js": "sha256:a0f0b62b264a5cd8a24e3cfddae722a84b5e2206729f77403906a1d1cfcd7c7b",
         "lib/middleware/attach-user.js": "sha256:776424918bf302378da99a85ff20c91a42f8c9f528ab435cd7a06b95ec523d6d",
         "lib/middleware/bearer-auth.js": "sha256:d0cb9d65a724a0badf9a5164397d12bf6a3afa9a2ae5e75922799b832741ee59",
-        "lib/middleware/body-parser.js": "sha256:488ec4572f7208d05a664b285ad3b6c888f623127d6bb50bbc1659a67a259f73",
+        "lib/middleware/body-parser.js": "sha256:a2a0af8ac8cecd9e6c842680029d6b409122d0639e33cc7204089e9c0daf6b73",
         "lib/middleware/bot-disclose.js": "sha256:2b98da494ee51ba7c8efc0d5fccbf11ba335649e71726d83847116c340720bf0",
         "lib/middleware/bot-guard.js": "sha256:ba724a897f646fcab7c384eb6e5c076e77e83b8e1c8d82a5aab79e8df616af8c",
         "lib/middleware/clear-site-data.js": "sha256:9b489c42aa6d4ee9f4b1e6e410b211f5d28134fc1d3933502f7504d64bc68c26",
@@ -2154,7 +2156,7 @@
         "lib/middleware/require-methods.js": "sha256:3b1b7ee5844969e813a46f26e78ed116ccfa28d2c6a9b821bb5d8c998ae95ea9",
         "lib/middleware/require-mtls.js": "sha256:f823a6d26af0969f28bced4ab166533dc6a5547df2f9120392d77acdbff3ba97",
         "lib/middleware/require-step-up.js": "sha256:dd8967633dc9133e54b1c4965247c77be087d6d34c395746d319b3af8e81e2eb",
-        "lib/middleware/scim-server.js": "sha256:2f38d77c7e949df9e219e4b351a6eb047dc85a7337aca932ac4b598e953c471d",
+        "lib/middleware/scim-server.js": "sha256:edb2b85326310247c19e2b9005df6b9af92d689d611759a824649f67b8283b15",
         "lib/middleware/security-headers.js": "sha256:87506e572454033b33955d58d9f0cbfdc14edc63c1cbe7e01f0dc4f07753c64d",
         "lib/middleware/security-txt.js": "sha256:3140d6537aa09a7052d83088840358949dd36393697fa2215f8f915d31aaa112",
         "lib/middleware/span-http-server.js": "sha256:8f22bf4feb5f05a201da20b89425f0e904ed6368c91b2fcd1be9a0f5cb067696",
@@ -2179,7 +2181,7 @@
         "lib/network-heartbeat.js": "sha256:f14ec7fa4667cbb04477d91ae59d6253b6c9ccc43071bc558e737cc672f43975",
         "lib/network-nts.js": "sha256:90ce47584ad58c171e8029eb1d5df8ba4ba130c4038d1fe260109685c34c8f75",
         "lib/network-proxy.js": "sha256:9342c534863f905000d2432b67c26dd7a5ea02be25aaf9ebe05976079e61d4c9",
-        "lib/network-smtp-policy.js": "sha256:95927f23bb7cafaf716dee869bb89d1a3d84bc307167365d08c12e9db9c50370",
+        "lib/network-smtp-policy.js": "sha256:4d10a339d5c471cdff217c5514038eb2e30f4ecb97a38cb4405165ee0f9dcf7e",
         "lib/network-tls.js": "sha256:554b64c77389e1c961da8d061c63c806be994960466fb26f2b2268dbec0a369b",
         "lib/network-tsig.js": "sha256:41dc85a6e816cce1c58c36891dfc6bafc612b68978936107a09a5a553563e0d7",
         "lib/network.js": "sha256:40cb01627bf45741cac22ef79f5985f69323e47732d54cf3ce28c06882830c25",
@@ -2346,7 +2348,7 @@
         "oss-fuzz/projects/blamejs/README.md": "sha256:ae13b7bb79ed8d69b1b3276e5562807a0349fb6e6b7d11cf1f683aad1eafdb4b",
         "oss-fuzz/projects/blamejs/build.sh": "sha256:0ced1cf21782c97be7f8d74faf5e27a308b60b2f858836fb5ca3b8c4e939a8f7",
         "oss-fuzz/projects/blamejs/project.yaml": "sha256:59f2cb83aa622325a175b77416fe155be15b70a9c798bd1a78bba05763b1b03d",
-        "package.json": "sha256:ca031cc44ce6ade614e436bd1f29d01cd2d495ad41c55a819c02c85a5f3a2f96",
+        "package.json": "sha256:585a646ad04f1afaa7faf4d273a16f5d8c6d530071d20db7b83f045ddaeaff73",
         "release-notes/v0.0.x.json": "sha256:7a49819f30068ee119000cad7010194882bb8bfaa12acbdab4dfc066efb7982f",
         "release-notes/v0.1.x.json": "sha256:6742a8c17f947c5cb76f69dead7eea86b942d80621d914b774ba5488e09937e5",
         "release-notes/v0.10.x.json": "sha256:fe498045daf88337bd3d987e5964aa42c99a50e1685b6f09e51f698b8687726f",
@@ -2383,6 +2385,8 @@
         "release-notes/v0.15.32.json": "sha256:af99a8a782dcc30aff3a135c27179b064d63181fc4c302c31da632c1615b68ce",
         "release-notes/v0.15.33.json": "sha256:295ea9939b74498c7f0be6afdc8bc511f97cb2383a436c3040c58b0600598b19",
         "release-notes/v0.15.34.json": "sha256:2a1b36d897d8e9f2cece051c098030f08d9c6ee6bef136800bd19453ad65f188",
+        "release-notes/v0.15.35.json": "sha256:e317b2252734aace7a0f734e3ab40c3a0c4ac208d678c0e9834be34eb424d15b",
+        "release-notes/v0.15.36.json": "sha256:392c15724efc02fad5825aaf93b3f5dcef90a0cb9909d61f86e777f3061045ec",
         "release-notes/v0.15.4.json": "sha256:6ac7fa0ef1728c27e71b2050d1b07a810f9b4b1440ccddbf28ad56e2f54d8585",
         "release-notes/v0.15.5.json": "sha256:cca1d0edd5d6fc41b512d19d98be224b990dcab41478622c11962f0fcb1bb09a",
         "release-notes/v0.15.6.json": "sha256:0e3b9e5e43b70b61dd258c3003d1b8729cd3c26c62a34dedcca81bbec5d31077",
@@ -2629,7 +2633,7 @@
         "test/layer-0-primitives/cluster-storage.test.js": "sha256:238b3b3db0eba3e6312a863710533178f566347b90e161e564481aa826707647",
         "test/layer-0-primitives/cluster-vault-rotation.test.js": "sha256:3514e9e71d6c39e805248f58ad2f41528d091e196c0f3766a032675677161b2d",
         "test/layer-0-primitives/cms-codec.test.js": "sha256:7e46078ed82be5b69d22c48f22dba37ea5015371c2a8cf5f94fb1a792fb7bb78",
-        "test/layer-0-primitives/codebase-patterns.test.js": "sha256:69d9da97b002a40c9edb39a6848d7369c2b43e2e09b935bdf9e9e8228765f40a",
+        "test/layer-0-primitives/codebase-patterns.test.js": "sha256:4180fd47eef2c81248ec83433e31f4975eefb0441bb3f3366a25a5a98ce5d0b9",
         "test/layer-0-primitives/codepoint-class.test.js": "sha256:19d1b69efa7e0e9f7ef2392ca264167767a5ec5890ee339b2cfd8a7818035d27",
         "test/layer-0-primitives/compliance-ai-act.test.js": "sha256:5ee4ad05d12233cb3c5457ef10a727833710bbc1ce1318838f9f9ef5d2cb8d4b",
         "test/layer-0-primitives/compliance-cascade.test.js": "sha256:ee02cf14541a837a9d7977c6ea6bf7f9210bed293925d93c976e31f270aebec4",
@@ -2862,7 +2866,7 @@
         "test/layer-0-primitives/mcp-tool-registry.test.js": "sha256:4d9a9a367489d93afcc8e0bca3442e0aefc683e40ddd29e6e2cddbe3a3b8732f",
         "test/layer-0-primitives/mcp.test.js": "sha256:896a9b55fd9d21a1ec2b0d0753b5796eb045911ad28992ba17338285406ac2f9",
         "test/layer-0-primitives/mdoc.test.js": "sha256:2fe1086192385e71f858554d676b299b86594d34226e1d774ffefc97b5fa03a4",
-        "test/layer-0-primitives/metrics-shadow-registry.test.js": "sha256:8ea834fd6b549c18976b535660a53aafccb1c6f0b7762086e8dbbc7ab8d832b6",
+        "test/layer-0-primitives/metrics-shadow-registry.test.js": "sha256:a91a9efdb4aa28caed846b969d7c1e5ebfc57067afad85800daa430942d02725",
         "test/layer-0-primitives/metrics-snapshot.test.js": "sha256:aa405be22acb6680b062d1de1aa7ce00029e414218a0e4e521e10a14b2254851",
         "test/layer-0-primitives/middleware-compose-pipeline.test.js": "sha256:a779468bde043b6de4add5d4405a33973163890ee667b833e3330373ee64f77d",
         "test/layer-0-primitives/mime-parse.test.js": "sha256:73ccfea7d08b0c3b5fb899215806d4f430c02bf63e21835024a4cdcfc4254b31",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.36 (2026-06-27) — **Internal test-suite hardening only — the published library's runtime behavior and public API are unchanged (source-comment marker text aside).** The codebase-patterns guard class that allows a bare comma/semicolon split on token-only RFC header grammars was re-verified from scratch and renamed to a descriptive token, with its old name recorded as retired. Each live marked site (RRULE, RFC 9421 component identifiers, TLS-RPT rua, SCIM attribute paths) was re-read and confirmed to split a grammar with no quoted-string members. Five marker comments that suppressed nothing were removed or turned into plain explanatory comments. No runtime code, public API, or wire format changed. **Detectors:** *Bare token-only header-split suppression class re-verified, renamed, and pruned of inert markers* — Each marked bare `.split(",")` / `.split(";")` on an RFC header value was re-read and confirmed to operate on a token-only grammar (no quoted-string members, so a quote-aware splitter is unnecessary): RFC 5545 RRULE, RFC 9421 signature component identifiers, RFC 8460 TLS-RPT rua, and RFC 7644 SCIM attribute paths. The guard class was renamed to a descriptive token and its old name added to the retired-token set. Five marker comments that the detector never actually evaluated (two sat on a date-normalizing `.replace`, three in header parsers the guard intentionally does not scan) were removed or converted to plain comments. This is test-suite tooling plus source-comment text; no shipped framework behavior changed.
+
+- v0.15.35 (2026-06-26) — **`b.metrics` shadow registry no longer lets a comma in a label value forge extra Prometheus label pairs — a label-injection that downstream tenant-scoping or authorization selectors could be tricked by.** The shadow registry serialized a metric's label set into a `name=value,name=value` string key and re-split it on `,` to build the Prometheus exposition. A label VALUE containing a comma therefore split into multiple label pairs, so a single operator-set label could forge additional label pairs in the scrape output (for example turning one `route` label into a `route` plus an attacker-named label), which downstream tenant-scoping filters, authorization selectors, recording rules, and alerting trust as a boundary; two distinct label sets could also collide into one cardinality bucket. The label key now uses canonical-JSON of the string-coerced label set (the same approach the main registry already used) and the render path emits the structured label set kept alongside that key rather than splitting or re-parsing, so a `,` or `=` inside a label value stays inside the value and a label NAMED `constructor`, `prototype`, or `__proto__` (all valid Prometheus label names) is preserved instead of being dropped. Note: the cardinality keys exposed by `shadowRegistry().snapshot()` are now canonical-JSON strings (e.g. `{"route":"/api"}`) rather than `route=/api`. **Changed:** *shadowRegistry().snapshot() cardinality keys are canonical-JSON* — As a consequence of the label-injection fix, the per-series cardinality keys in a shadow-registry snapshot are now canonical-JSON strings (e.g. `{"tenant":"a"}`) instead of the previous `tenant=a` form. Code that reads those keys directly from snapshot() should parse them as JSON; the Prometheus render output is unchanged for conforming label values. **Security:** *Label values can no longer forge extra Prometheus label pairs in the shadow registry* — b.metrics shadowRegistry built a metric's cardinality key by joining `name=value` pairs with commas, then split that string on commas when rendering the Prometheus exposition. A comma (and `=`) in a label value therefore broke one value into several forged label pairs in the scrape output, and two different label sets could collide into the same cardinality bucket. The key is now canonical-JSON of the string-coerced label set and the render emits the structured label set kept alongside that key rather than splitting or re-parsing, so a label value is emitted as a single quoted value with its commas/equals intact, distinct label sets get distinct keys, and a label NAMED `constructor`, `prototype`, or `__proto__` (each a valid Prometheus label name) is preserved rather than dropped. Deterministic regression tests assert a comma-bearing label value produces exactly one label pair and that the reserved-name labels survive render.
+
 - v0.15.34 (2026-06-26) — **`b.mail.crypto.pgp.verify` now accepts every valid RSA OpenPGP signature — one whose value happened to have a high zero byte (about 1 in 256) was being rejected.** An OpenPGP RSA signature is an integer modulo the key's modulus, and ~1 in 256 signatures have a value that begins with a zero byte. The MPI encoding strips those leading zero bytes (RFC 9580 §3.2), but b.mail.crypto.pgp.verify passed the stripped value straight to the RSA verification, which requires a signature exactly the modulus byte length — so a perfectly valid signature was intermittently reported invalid. The signature is now left-padded back to the modulus width before verification, exactly as the Ed25519 path already pads its components. Verification of every valid RSA signature is now reliable, including signatures produced by other OpenPGP implementations. Also includes internal test-tooling: two more guard-suite suppression classes were re-verified and their tokens retired. **Fixed:** *RSA OpenPGP signatures with a high zero byte now verify reliably* — b.mail.crypto.pgp.verify read the RSA signature MPI (whose leading zero bytes the OpenPGP wire format strips) and handed it to the RSA verification without restoring the stripped bytes. Node's RSA verify requires the signature to be exactly the modulus byte length, so a signature whose value had one or more high zero bytes — about 1 in 256 of all signatures, for any key — was rejected as invalid even though it was correct. The signature is now left-padded to the modulus width before verification (the same correction the Ed25519 verification path already applied to its R/S components). This affects signatures the framework produces and signatures from other OpenPGP implementations alike. A deterministic regression test searches for a short-MPI signature and asserts it verifies. **Detectors:** *Two more suppression-marker classes re-verified and their tokens retired* — The raw-hash-compare and seal-without-aad guard classes were re-read and confirmed (a data-residency region tag compared with === — not a secret; and two intentional non-AEAD-bound seals — a non-regulated plain-mode column whose AAD is enforced by the posture seal-envelope floor where it matters, and a throwaway vault-readiness probe), then renamed to descriptive tokens with their old names added to the retired-token set. Test-suite tooling only.
 
 - v0.15.33 (2026-06-26) — **Internal test-suite hardening only — the published library's runtime behavior and public API are unchanged (source-comment marker text aside).** Three more suppression classes in the codebase-patterns guard suite were re-verified from scratch and renamed to descriptive tokens, with their old names recorded as retired and their in-source marker comments updated to match. No runtime code, public API, or wire format changed. **Detectors:** *Three more suppression-marker classes re-verified and their tokens retired* — Continuing the re-verification pass: each marked site for the math-random-noncrypto, raw-new-url, and dynamic-require guard classes was re-read and confirmed (non-security jitter/sampling; URL parsing for shape/origin inspection or behind the safe wrapper; operator-supplied module loads), then the class was renamed to a descriptive token and its old name added to the retired-token set. This is test-suite tooling; no shipped framework behavior changed.

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.15.34",
-  "createdAt": "2026-06-26T23:09:44.793Z",
+  "frameworkVersion": "0.15.36",
+  "createdAt": "2026-06-27T07:23:28.597Z",
   "exports": {
     "a2a": {
       "type": "object",

package/lib/vendor/blamejs/lib/calendar.js

@@ -1119,7 +1119,7 @@ function _firstParamValue(prop, paramName) {
 
 function _icalRruleToJscal(rrule) {
   var out = { "@type": "RecurrenceRule", frequency: "daily" };
-  var parts = String(rrule).split(";");                                                                // allow:bare-split-on-quoted-header — RFC 5545 RRULE grammar has no quoted-string members; values are token-only
+  var parts = String(rrule).split(";");                                                                // allow:bare-split-on-quoted-header-token-grammar — RFC 5545 RRULE grammar has no quoted-string members; values are token-only
   for (var i = 0; i < parts.length; i += 1) {
     var kv = parts[i].split("=");
     if (kv.length !== 2) continue;
@@ -1129,11 +1129,11 @@ function _icalRruleToJscal(rrule) {
     else if (key === "INTERVAL") out.interval = parseInt(val, 10);
     else if (key === "COUNT") out.count = parseInt(val, 10);
     else if (key === "UNTIL") out.until = _icalDateTimeToUtc(val);
-    else if (key === "BYDAY") out.byDay = val.split(",").map(function (d) {                            // allow:bare-split-on-quoted-header — RFC 5545 BYDAY values are token-only
+    else if (key === "BYDAY") out.byDay = val.split(",").map(function (d) {                            // allow:bare-split-on-quoted-header-token-grammar — RFC 5545 BYDAY values are token-only
       return { "@type": "NDay", day: d.slice(-2).toLowerCase() };
     });
-    else if (key === "BYMONTH") out.byMonth = val.split(",");                                          // allow:bare-split-on-quoted-header — RFC 5545 BYMONTH values are integer-only
-    else if (key === "BYMONTHDAY") out.byMonthDay = val.split(",").map(function (n) { return parseInt(n, 10); }); // allow:bare-split-on-quoted-header — RFC 5545 BYMONTHDAY values are integer-only
+    else if (key === "BYMONTH") out.byMonth = val.split(",");                                          // allow:bare-split-on-quoted-header-token-grammar — RFC 5545 BYMONTH values are integer-only
+    else if (key === "BYMONTHDAY") out.byMonthDay = val.split(",").map(function (n) { return parseInt(n, 10); }); // allow:bare-split-on-quoted-header-token-grammar — RFC 5545 BYMONTHDAY values are integer-only
   }
   return out;
 }
@@ -1168,13 +1168,13 @@ function _utcDateTimeToIcal(s) {
   // JSCalendar UTCDateTime "2026-05-22T10:00:00.123Z" →
   // "20260522T100000Z" (RFC 5545 §3.3.5 form 2 has NO fractional
   // seconds; strict ICS consumers reject `T100000.123Z`).
-  return String(s).replace(/\.\d+/, "").replace(/[-:]/g, "");                                          // allow:bare-split-on-quoted-header — not a header split
+  return String(s).replace(/\.\d+/, "").replace(/[-:]/g, "");
 }
 
 function _localDateTimeToIcal(s) {
   // JSCalendar LocalDateTime "2026-05-22T09:00:00.123" →
   // "20260522T090000" (same fractional-second strip as the UTC form).
-  return String(s).replace(/\.\d+/, "").replace(/[-:]/g, "");                                          // allow:bare-split-on-quoted-header — not a header split
+  return String(s).replace(/\.\d+/, "").replace(/[-:]/g, "");
 }
 
 function _isUtcDateTime(s) {

package/lib/vendor/blamejs/lib/http-client-cache.js

@@ -212,7 +212,7 @@ function _buildCacheKey(method, url, varyHeaderValues) {
 // uncacheable.
 function _extractVaryValues(varyHeader, requestHeaders) {
   if (typeof varyHeader !== "string" || varyHeader.length === 0) return [];
-  var names = varyHeader.split(",").map(function (s) {                                          // allow:bare-split-on-quoted-header — RFC 9110 §12.5.5 Vary is a comma-list of field-names (token grammar); no quoted-string
+  var names = varyHeader.split(",").map(function (s) {                                          // RFC 9110 §12.5.5 Vary is a comma-list of field-names (token grammar); no quoted-string, so a bare split is correct
     return s.trim().toLowerCase();
   }).filter(function (s) { return s.length > 0; });
   if (names.indexOf("*") !== -1) return null;  // sentinel: "uncacheable"
@@ -262,7 +262,7 @@ function _evaluateStorage(method, statusCode, responseHeaders, sharedCache) {
 
   // Vary: * is uncacheable per RFC 9110 §12.5.5.
   if (typeof varyHeader === "string" && varyHeader.indexOf("*") !== -1) {
-    var trimmed = varyHeader.split(",").map(function (s) { return s.trim(); });                  // allow:bare-split-on-quoted-header — RFC 9110 §12.5.5 Vary field-names; token grammar only
+    var trimmed = varyHeader.split(",").map(function (s) { return s.trim(); });                  // RFC 9110 §12.5.5 Vary field-names; token grammar only, so a bare split is correct
     if (trimmed.indexOf("*") !== -1) {
       return { cacheable: false, reason: "vary-star", freshnessMs: -1, directives: directives, varyHeader: varyHeader };
     }

package/lib/vendor/blamejs/lib/http-message-signature.js

@@ -319,7 +319,7 @@ function sign(msg, opts) {
   // header isn't already supplied. Operators wanting to use the
   // RFC 9530 "sha-512" identifier (SHA-512 instead of SHA3-512) supply
   // the header themselves; the framework emits SHA3-512.
-  var coveredLower = opts.covered.map(function (c) { return c.split(";")[0].toLowerCase(); });  // allow:bare-split-on-quoted-header — opts.covered is operator-supplied component-id list (e.g. "content-digest;sf"); component identifiers are RFC 9421 §2.1 derived-field names with token-only grammar; no quoted-string
+  var coveredLower = opts.covered.map(function (c) { return c.split(";")[0].toLowerCase(); });  // allow:bare-split-on-quoted-header-token-grammar — opts.covered is operator-supplied component-id list (e.g. "content-digest;sf"); component identifiers are RFC 9421 §2.1 derived-field names with token-only grammar; no quoted-string
   if (coveredLower.indexOf("content-digest") !== -1 &&
       _resolveHeader(m.headers, "content-digest") === null) {
     if (m.body == null) {
@@ -451,7 +451,7 @@ function _parseSignature(headerValue, label) {
   if (headerValue.indexOf(prefix) !== 0) {
     // Multiple signature labels can appear; comma-separated. Find the
     // matching label.
-    var parts = headerValue.split(",");                                                        // allow:bare-split-on-quoted-header — RFC 9421 §2.4 Signature header values are `label=:b64:` form; base64 alphabet excludes `,` and the label tokens are RFC 8941 §3.3.4 sf-token (no DQUOTE in practice)
+    var parts = headerValue.split(",");                                                        // allow:bare-split-on-quoted-header-token-grammar — RFC 9421 §2.4 Signature header values are `label=:b64:` form; base64 alphabet excludes `,` and the label tokens are RFC 8941 §3.3.4 sf-token (no DQUOTE in practice)
     for (var i = 0; i < parts.length; i++) {
       var p = parts[i].trim();
       if (p.indexOf(prefix) === 0) {
@@ -519,7 +519,7 @@ function verify(msg, opts) {
   // If content-digest is covered, recompute and compare. RFC 9421 §B.2.5
   // mandates that verifiers re-run the digest over the body — a stale
   // header from a proxy would otherwise verify trivially.
-  var coveredLower = parsedInput.covered.map(function (c) { return c.split(";")[0].toLowerCase(); });  // allow:bare-split-on-quoted-header — same as sign() above: covered items are RFC 9421 §2.1 component-ids, token grammar
+  var coveredLower = parsedInput.covered.map(function (c) { return c.split(";")[0].toLowerCase(); });  // allow:bare-split-on-quoted-header-token-grammar — same as sign() above: covered items are RFC 9421 §2.1 component-ids, token grammar
   if (coveredLower.indexOf("content-digest") !== -1) {
     if (m.body == null) {
       return { valid: false, reason: "content-digest-no-body" };

package/lib/vendor/blamejs/lib/metrics.js

@@ -1352,6 +1352,14 @@ function shadowRegistry(opts) {
   var counters = Object.create(null);
   var gauges   = Object.create(null);
   var info     = Object.create(null);
+  // Maps a canonical-JSON cardinality key → the string-coerced, null-prototype
+  // label object that produced it, so the render path reads the structured
+  // labels directly instead of re-parsing the key. Re-parsing would both lose a
+  // label NAMED `constructor` / `prototype` / `__proto__` (all valid Prometheus
+  // label names) to a prototype-pollution-hardened JSON parse, and reintroduce a
+  // serialize-then-split round-trip. Populated only when a value is actually
+  // stored, so it stays bounded by the cardinality cap.
+  var labelSets = Object.create(null);
   var lastCardinalityAuditMs = 0;
 
   function _cardinalityHit(metric) {
@@ -1375,19 +1383,27 @@ function shadowRegistry(opts) {
     }
   }
 
-  function _labelKey(labels) {
-    if (!labels || typeof labels !== "object") return "";
-    var keys = Object.keys(labels).sort();                                                            // allow:bare-canonicalize-walk — label-set canonicalization for cardinality keying
-    var parts = [];
-    for (var i = 0; i < keys.length; i += 1) {
-      parts.push(keys[i] + "=" + String(labels[keys[i]]));
-    }
-    return parts.join(",");
+  function _coerceLabels(labels) {
+    // → { key, set }: the canonical-JSON cardinality key (collision-proof and
+    // injection-proof, matching the main registry's _labelsKey) plus the
+    // string-coerced, null-prototype label object it came from. The render path
+    // reads `set` directly rather than re-parsing `key`, so a `,` or `=` in a
+    // label VALUE can never forge extra label pairs and a label NAMED
+    // `constructor` / `prototype` / `__proto__` survives verbatim. The
+    // null-prototype object makes a `__proto__` label a normal own property
+    // rather than a prototype assignment.
+    if (!labels || typeof labels !== "object") return { key: "", set: null };
+    var keys = Object.keys(labels);
+    if (keys.length === 0) return { key: "", set: null };
+    var coerced = Object.create(null);
+    for (var i = 0; i < keys.length; i += 1) coerced[keys[i]] = String(labels[keys[i]]);
+    return { key: canonicalJson.stringify(coerced), set: coerced };
   }
 
   function inc(name, labels) {
     if (!counterSet[name]) return;
-    var lk = _labelKey(labels);
+    var ck = _coerceLabels(labels);
+    var lk = ck.key;
     if (!counters[name]) counters[name] = Object.create(null);
     var current = counters[name][lk];
     if (current === undefined) {
@@ -1396,6 +1412,7 @@ function shadowRegistry(opts) {
         return;
       }
       counters[name][lk] = 1;
+      if (ck.set) labelSets[lk] = ck.set;
     } else {
       counters[name][lk] = current + 1;
     }
@@ -1407,13 +1424,15 @@ function shadowRegistry(opts) {
       throw new MetricsError("metrics-shadow/bad-gauge-value",
         "shadowRegistry.set: '" + name + "' value must be a finite number");
     }
-    var lk = _labelKey(labels);
+    var ck = _coerceLabels(labels);
+    var lk = ck.key;
     if (!gauges[name]) gauges[name] = Object.create(null);
     if (gauges[name][lk] === undefined && Object.keys(gauges[name]).length >= cap) {
       _cardinalityHit(name);
       return;
     }
     gauges[name][lk] = value;
+    if (ck.set) labelSets[lk] = ck.set;
   }
 
   function setInfo(name, value) {
@@ -1449,22 +1468,21 @@ function shadowRegistry(opts) {
         for (var li = 0; li < lks.length; li += 1) {
           var lk = lks[li];
           if (lk === "") { out.push(metric + " " + labelMap[lk]); continue; }
-          // The label-key string was assembled by `_labelKey` from a
-          // single shadow-registry call's `labels` object — values
-          // are framework-internal (operator code that supplied them
-          // is bounded by guards upstream); split on `,` is safe.
-          // Not a header-value parse (which would need a quoted-
-          // string aware split per RFC 9110).
-          var lpairs = lk.split(",");                                                                // allow:bare-split-on-quoted-header — framework-internal label-key (assembled by _labelKey), not an HTTP header parse
+          // Read the structured label set kept alongside the canonical key (see
+          // _coerceLabels) rather than re-parsing the key. No serialize-then-
+          // split round-trip, so a `,` or `=` in a label value stays inside the
+          // value and can never forge extra label pairs; and a label NAMED
+          // `constructor` / `prototype` / `__proto__` survives instead of being
+          // stripped by a prototype-pollution-hardened parse.
+          var labelObj = labelSets[lk];
+          if (!labelObj || typeof labelObj !== "object") { out.push(metric + " " + labelMap[lk]); continue; }
+          var lnames = Object.keys(labelObj).sort();                                                 // allow:bare-canonicalize-walk — deterministic label ordering in the exposition line
           var formatted = [];
-          for (var pi = 0; pi < lpairs.length; pi += 1) {
-            var eqIdx = lpairs[pi].indexOf("=");
-            if (eqIdx === -1) continue;
-            var lname = lpairs[pi].slice(0, eqIdx);
-            var lvalue = lpairs[pi].slice(eqIdx + 1);
+          for (var pi = 0; pi < lnames.length; pi += 1) {
+            var lname = lnames[pi];
             if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(lname)) continue;                                   // allow:regex-no-length-cap — Prometheus label-name shape
             // Prometheus exposition: escape `\`, `"`, `\n` in label values.
-            lvalue = String(lvalue).replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n"); // allow:regex-no-length-cap — fixed-char-set escape // allow:duplicate-regex — Prometheus value escape shape
+            var lvalue = String(labelObj[lname]).replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n"); // allow:regex-no-length-cap — fixed-char-set escape // allow:duplicate-regex — Prometheus value escape shape
             formatted.push(lname + '="' + lvalue + '"');
           }
           out.push(metric + "{" + formatted.join(",") + "} " + labelMap[lk]);
@@ -1516,9 +1534,10 @@ function shadowRegistry(opts) {
   }
 
   function reset() {
-    counters = Object.create(null);
-    gauges   = Object.create(null);
-    info     = Object.create(null);
+    counters  = Object.create(null);
+    gauges    = Object.create(null);
+    info      = Object.create(null);
+    labelSets = Object.create(null);
     lastCardinalityAuditMs = 0;
   }
 

package/lib/vendor/blamejs/lib/middleware/body-parser.js

@@ -351,7 +351,7 @@ function _detectSmuggling(req) {
   //    (RFC 9112 §6.1). Anything else is a smuggling vector or
   //    server-side decode error.
   if (typeof te === "string" && te.length > 0) {
-    var tokens = te.toLowerCase().split(",").map(function (t) { return t.trim(); });               // allow:bare-split-on-quoted-header — RFC 9112 §6.1 Transfer-Encoding values (chunked / gzip / deflate / identity) are token-only; no quoted-string in the grammar
+    var tokens = te.toLowerCase().split(",").map(function (t) { return t.trim(); });               // RFC 9112 §6.1 Transfer-Encoding values (chunked / gzip / deflate / identity) are token-only; no quoted-string in the grammar, so a bare split is correct
     var last = tokens[tokens.length - 1];
     if (last !== "chunked") {
       return {

package/lib/vendor/blamejs/lib/middleware/scim-server.js

@@ -237,8 +237,8 @@ async function _dispatch(req, res, basePath, bearer, opts, maxPageSize, bulkCfg)
       count:              pageSize,
       sortBy:             query.sortBy || null,
       sortOrder:          query.sortOrder || null,
-      attributes:         query.attributes ? query.attributes.split(",") : null,                  // allow:bare-split-on-quoted-header — RFC 7644 §3.9 attributes/excludedAttributes are SCIM attribute paths (URN-ish identifiers); grammar excludes DQUOTE
-      excludedAttributes: query.excludedAttributes ? query.excludedAttributes.split(",") : null,    // allow:bare-split-on-quoted-header — same SCIM attribute-name grammar
+      attributes:         query.attributes ? query.attributes.split(",") : null,                  // allow:bare-split-on-quoted-header-token-grammar — RFC 7644 §3.9 attributes/excludedAttributes are SCIM attribute paths (URN-ish identifiers); grammar excludes DQUOTE
+      excludedAttributes: query.excludedAttributes ? query.excludedAttributes.split(",") : null,    // allow:bare-split-on-quoted-header-token-grammar — same SCIM attribute-name grammar
     }, ctx);
     _writeJson(res, H.OK, {
       schemas:      [SCIM_MESSAGE_LIST],

package/lib/vendor/blamejs/lib/network-smtp-policy.js

@@ -613,7 +613,7 @@ async function tlsRptFetchPolicy(domain, opts) {
   var rua = [];
   for (var p = 0; p < pairs.length; p += 1) {
     if (pairs[p][0] === "rua") {
-      var uris = pairs[p][1].split(",");                                                      // allow:bare-split-on-quoted-header — allow:raw-time-literal — TLS-RPT rua grammar (RFC 8460 §3): rua = tlsrpt-uri *("," tlsrpt-uri); URIs percent-encode reserved chars, no quoted-string
+      var uris = pairs[p][1].split(",");                                                      // allow:bare-split-on-quoted-header-token-grammar — allow:raw-time-literal — TLS-RPT rua grammar (RFC 8460 §3): rua = tlsrpt-uri *("," tlsrpt-uri); URIs percent-encode reserved chars, no quoted-string
       for (var u = 0; u < uris.length; u += 1) {
         var uri = uris[u].trim();
         if (uri.length > 0) rua.push(uri);

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.34",
+  "version": "0.15.36",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.15.35.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.15.35",
+  "date": "2026-06-26",
+  "headline": "`b.metrics` shadow registry no longer lets a comma in a label value forge extra Prometheus label pairs — a label-injection that downstream tenant-scoping or authorization selectors could be tricked by",
+  "summary": "The shadow registry serialized a metric's label set into a `name=value,name=value` string key and re-split it on `,` to build the Prometheus exposition. A label VALUE containing a comma therefore split into multiple label pairs, so a single operator-set label could forge additional label pairs in the scrape output (for example turning one `route` label into a `route` plus an attacker-named label), which downstream tenant-scoping filters, authorization selectors, recording rules, and alerting trust as a boundary; two distinct label sets could also collide into one cardinality bucket. The label key now uses canonical-JSON of the string-coerced label set (the same approach the main registry already used) and the render path emits the structured label set kept alongside that key rather than splitting or re-parsing, so a `,` or `=` inside a label value stays inside the value and a label NAMED `constructor`, `prototype`, or `__proto__` (all valid Prometheus label names) is preserved instead of being dropped. Note: the cardinality keys exposed by `shadowRegistry().snapshot()` are now canonical-JSON strings (e.g. `{\"route\":\"/api\"}`) rather than `route=/api`.",
+  "sections": [
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "Label values can no longer forge extra Prometheus label pairs in the shadow registry",
+          "body": "b.metrics shadowRegistry built a metric's cardinality key by joining `name=value` pairs with commas, then split that string on commas when rendering the Prometheus exposition. A comma (and `=`) in a label value therefore broke one value into several forged label pairs in the scrape output, and two different label sets could collide into the same cardinality bucket. The key is now canonical-JSON of the string-coerced label set and the render emits the structured label set kept alongside that key rather than splitting or re-parsing, so a label value is emitted as a single quoted value with its commas/equals intact, distinct label sets get distinct keys, and a label NAMED `constructor`, `prototype`, or `__proto__` (each a valid Prometheus label name) is preserved rather than dropped. Deterministic regression tests assert a comma-bearing label value produces exactly one label pair and that the reserved-name labels survive render."
+        }
+      ]
+    },
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "shadowRegistry().snapshot() cardinality keys are canonical-JSON",
+          "body": "As a consequence of the label-injection fix, the per-series cardinality keys in a shadow-registry snapshot are now canonical-JSON strings (e.g. `{\"tenant\":\"a\"}`) instead of the previous `tenant=a` form. Code that reads those keys directly from snapshot() should parse them as JSON; the Prometheus render output is unchanged for conforming label values."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.15.36.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.15.36",
+  "date": "2026-06-27",
+  "headline": "Internal test-suite hardening only — the published library's runtime behavior and public API are unchanged (source-comment marker text aside)",
+  "summary": "The codebase-patterns guard class that allows a bare comma/semicolon split on token-only RFC header grammars was re-verified from scratch and renamed to a descriptive token, with its old name recorded as retired. Each live marked site (RRULE, RFC 9421 component identifiers, TLS-RPT rua, SCIM attribute paths) was re-read and confirmed to split a grammar with no quoted-string members. Five marker comments that suppressed nothing were removed or turned into plain explanatory comments. No runtime code, public API, or wire format changed.",
+  "sections": [
+    {
+      "heading": "Detectors",
+      "items": [
+        {
+          "title": "Bare token-only header-split suppression class re-verified, renamed, and pruned of inert markers",
+          "body": "Each marked bare `.split(\",\")` / `.split(\";\")` on an RFC header value was re-read and confirmed to operate on a token-only grammar (no quoted-string members, so a quote-aware splitter is unnecessary): RFC 5545 RRULE, RFC 9421 signature component identifiers, RFC 8460 TLS-RPT rua, and RFC 7644 SCIM attribute paths. The guard class was renamed to a descriptive token and its old name added to the retired-token set. Five marker comments that the detector never actually evaluated (two sat on a date-normalizing `.replace`, three in header parsers the guard intentionally does not scan) were removed or converted to plain comments. This is test-suite tooling plus source-comment text; no shipped framework behavior changed."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -319,7 +319,7 @@ var VALID_ALLOW_CLASSES = {
   "backup-adapter-storage-without-posture-check": 1,
   "bare-canonicalize-walk": 1,
   "bare-error-throw": 1,
-  "bare-split-on-quoted-header": 1,
+  "bare-split-on-quoted-header-token-grammar": 1,
   "console-direct": 1,
   "deny-path-hardcoded-response": 1,
   "duplicate-regex": 1,
@@ -389,6 +389,7 @@ var RETIRED_ALLOW_TOKENS = {
   "dynamic-require": "renamed to 'dynamic-require-operator-module' (2026-06-26 re-verify pass) — every site loads an operator-supplied path (migration / seed / extensibility entry, centralized in module-loader.js) or is diagnostic message text; re-verify before reusing",
   "raw-hash-compare": "renamed to 'raw-hash-compare-nonsecret-tag' (2026-06-26 re-verify pass) — the one site compares a data-residency region tag with ===, not a secret hash; re-verify before reusing",
   "seal-without-aad": "renamed to 'seal-without-aad-by-design' (2026-06-26 re-verify pass) — both sites intentionally seal without AAD (a non-regulated plain-mode table whose AAD is enforced by the posture sealEnvelopeFloor where required, and a throwaway vault-readiness probe sentinel); re-verify before reusing",
+  "bare-split-on-quoted-header": "renamed to 'bare-split-on-quoted-header-token-grammar' (2026-06-26 re-verify pass) — every live marker splits an RFC token-only header grammar with no quoted-string members (RRULE / RFC 9421 component-ids / TLS-RPT rua / SCIM attribute paths), so a bare comma/semicolon split is correct; re-verify the grammar before reusing. The re-verify also found 5 markers were inert (detector pre-filter skips their file, or the line is a .replace not a split) and cleared them",
 };
 
 function testNoRetiredAllowTokenReRegistered() {
@@ -10320,7 +10321,7 @@ function testNoBoolStringCoerceShape() {
 //
 // Surfaced 2026-05-11 — `b.cdnCacheControl.parse` did this.
 function testNoBareCommaSplitOnQuotedHeader() {
-  // class: bare-split-on-quoted-header
+  // class: bare-split-on-quoted-header-token-grammar
   var files = _libFiles();
   var bad = [];
   for (var fi = 0; fi < files.length; fi++) {
@@ -10342,7 +10343,7 @@ function testNoBareCommaSplitOnQuotedHeader() {
       });
     }
   }
-  bad = _filterMarkers(bad, "bare-split-on-quoted-header");
+  bad = _filterMarkers(bad, "bare-split-on-quoted-header-token-grammar");
   _report("RFC structured-fields parser must use quote-aware top-level splitter, not bare `.split(\",\") / .split(\";\")` (RFC 8941 §3.3.3 quoted-string values can contain delimiter chars — cdn-cache-control.parse bug class)",
     bad);
 }

package/lib/vendor/blamejs/test/layer-0-primitives/metrics-shadow-registry.test.js

@@ -28,7 +28,7 @@ function testInc() {
   shadow.inc("hits", { route: "/api" });
   var snap = shadow.snapshot();
   check("counter incremented",      snap.counters.hits[""] === 2);
-  check("labeled counter tracked",  snap.counters.hits["route=/api"] === 1);
+  check("labeled counter tracked",  snap.counters.hits['{"route":"/api"}'] === 1);
   // Non-mirrored counter silently ignored.
   shadow.inc("not_mirrored");
   check("non-mirrored ignored",     snap.counters.not_mirrored === undefined);
@@ -43,7 +43,7 @@ function testSet() {
   shadow.set("queue_depth", 7, { tenant: "a" });
   var snap = shadow.snapshot();
   check("gauge set",                snap.gauges.queue_depth[""] === 42);
-  check("labeled gauge",            snap.gauges.queue_depth["tenant=a"] === 7);
+  check("labeled gauge",            snap.gauges.queue_depth['{"tenant":"a"}'] === 7);
 }
 
 function testCardinalityCap() {
@@ -83,6 +83,60 @@ function testPrometheusPreservesLabels() {
     out.indexOf("# TYPE tenant_b_hits_total counter") !== -1);
 }
 
+function testPrometheusLabelValueInjection() {
+  // A `,` or `=` in a label VALUE must stay inside the value — it must NOT
+  // forge extra label pairs in the exposition output (label injection that
+  // downstream tenant-scoping / authz selectors / recording rules would trust
+  // as a boundary). The shadow registry previously serialized the label set to
+  // a `name=value,...` key and re-split it on `,` for rendering, so a comma in
+  // a value split into multiple forged pairs.
+  var shadow = b.metrics.snapshot.shadowRegistry({
+    namespace: "tenant_x",
+    counters:  ["hits_total"],
+  });
+  shadow.inc("hits_total", { route: 'a,evil="bad' });
+  var out = shadow.render({ format: "prometheus" });
+  // The full value (comma + escaped quote) stays inside route's quotes.
+  check("label value with a comma stays inside the value (no forged pair)",
+    out.indexOf('route="a,evil=\\"bad"') !== -1);
+  // The series line carries exactly ONE label pair (no injected second label).
+  var line = out.split("\n").filter(function (l) { return l.indexOf("tenant_x_hits_total{") === 0; })[0] || "";
+  var braces = line.slice(line.indexOf("{") + 1, line.lastIndexOf("}"));
+  var labelNames = (braces.match(/(^|,)[a-zA-Z_][a-zA-Z0-9_]*="/g) || []).length;                     // allow:regex-no-length-cap — counts top-level label-name= boundaries in a bounded exposition line
+  check("exactly one label pair (no injected label)", labelNames === 1);
+}
+
+function testPrometheusReservedLabelNames() {
+  // A label whose NAME is `constructor`, `prototype`, or `__proto__` is a valid
+  // Prometheus label name ([a-zA-Z_][a-zA-Z0-9_]*) and must survive render. The
+  // shadow registry must NOT route the label key through a prototype-pollution-
+  // hardened JSON parse (which strips those names), nor lose the dimension.
+  var shadow = b.metrics.snapshot.shadowRegistry({
+    namespace: "tenant_y",
+    counters:  ["hits_total"],
+  });
+  shadow.inc("hits_total", { constructor: "a" });
+  shadow.inc("hits_total", { prototype: "b" });
+  // `{ __proto__: "c" }` as a literal sets the prototype (a no-op for a string);
+  // the real vector is a labels object that came from parsed external data, so
+  // its `__proto__` is an own enumerable property.
+  shadow.inc("hits_total", JSON.parse('{"__proto__":"c"}'));
+  var out = shadow.render({ format: "prometheus" });
+  check("label named constructor survives render",
+    out.indexOf('tenant_y_hits_total{constructor="a"} 1') !== -1);
+  check("label named prototype survives render",
+    out.indexOf('tenant_y_hits_total{prototype="b"} 1') !== -1);
+  check("label named __proto__ survives render",
+    out.indexOf('tenant_y_hits_total{__proto__="c"} 1') !== -1);
+  // No dimension collapsed into a bare unlabeled series: every value line for
+  // this metric carries a label brace.
+  var valueLines = out.split("\n").filter(function (l) {
+    return l.indexOf("tenant_y_hits_total") === 0 && l.indexOf("# TYPE") !== 0;
+  });
+  var bare = valueLines.filter(function (l) { return l.indexOf("{") === -1; });
+  check("no unlabeled bare series leaked", bare.length === 0);
+}
+
 function testRefusalsAtConfigTime() {
   var threw;
   threw = false; try { b.metrics.snapshot.shadowRegistry({}); } catch (_e) { threw = true; }
@@ -105,6 +159,8 @@ function run() {
   testSet();
   testCardinalityCap();
   testPrometheusPreservesLabels();
+  testPrometheusLabelValueInjection();
+  testPrometheusReservedLabelNames();
   testRefusalsAtConfigTime();
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.5.0",
+  "version": "0.5.2",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {