@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/release-notes/v0.17.4.json

@@ -0,0 +1,35 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.17.4",
+  "date": "2026-07-17",
+  "headline": "Three fail-open holes closed: a raw cross-border write could evade the data-residency gate by wedging a comment or eliding whitespace, safe decompression returned undecompressed bytes for an unknown algorithm name, and the shared anti-replay helper admitted a replay when its store signalled a duplicate with a non-boolean value",
+  "summary": "A raw SQL write submitted through b.db.runSql / b.db.prepare().run() could slip past the cross-border data-residency gate: the gate's write-detection matched tokens on whitespace boundaries, but SQL lets tokens abut with no whitespace when a comment or a quoted identifier sits between them, so INSERT/**/INTO, an INSERT whose quoted table name abuts INTO, and UPDATE/**/table all executed while the gate never engaged -- landing or moving a row across a residency boundary under a regulated posture. b.safeDecompress resolved its algorithm allowlist with a truthiness lookup, so an algorithm name that collides with an inherited object member (constructor, toString) reached the dispatch and returned the input undecompressed instead of refusing the unknown algorithm -- a fail-open for any caller that maps a client Content-Encoding onto the algorithm. And b.nonceStore.enforceReplay -- the anti-replay helper JWT and DPoP verification use -- detected a replay only when its store returned a literal false, so a store signalling a duplicate with another falsy value (a Redis SETNX null, a SQL INSERT rowcount of 0) let the replayed token through.",
+  "sections": [
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "Data-residency gate catches a raw write that hides behind a comment or elided whitespace",
+          "body": "The cross-border data-residency gate that guards raw SQL writes (b.db.runSql, b.db.prepare().run()) detected the write and extracted its target table with regexes that assume tokens are separated by whitespace. SQL does not require whitespace between tokens when a comment or a quoted-identifier boundary separates them, so three forms that every engine executes as ordinary writes slipped the detection entirely and the gate never engaged: an INSERT whose double-quoted table name abuts INTO with no space, an INSERT with a block comment wedged between INSERT and INTO, and the same for UPDATE and its table. Under a regulated residency posture a row could therefore be inserted or moved across a residency boundary with no tag check (CWE-863; a GDPR Chapter V transfer-restriction bypass). The gate now normalizes a parse-only copy of the statement through the new b.safeSql.normalizeForScan before matching -- collapsing comments to a space and inserting a boundary where a quoted token abuts a word character -- so every write is detected and gated regardless of how its tokens are spaced. The executed SQL is unchanged."
+        },
+        {
+          "title": "Safe decompression refuses an unknown algorithm instead of returning the input undecompressed",
+          "body": "b.safeDecompress resolved opts.algorithm against its allowlist of supported codecs (gzip, deflate, deflate-raw, brotli) with a truthiness lookup on a plain object. An algorithm name that names an inherited object member -- constructor, toString, valueOf -- read back a truthy inherited value, slipped the unsupported-algorithm refusal, and reached the dispatch, where invoking the inherited member returned the raw input buffer. The primitive therefore silently returned undecompressed bytes with no error, contrary to its contract that any algorithm outside the allowlist is refused -- a fail-open for a consumer that maps a client-supplied Content-Encoding token onto the algorithm, which also sidesteps the decompression-bomb size and ratio caps. The allowlist is now resolved with an own-property check, so any unsupported name -- however it collides with a built-in member -- is refused."
+        },
+        {
+          "title": "Shared anti-replay helper fails closed on a non-boolean store result",
+          "body": "b.nonceStore.enforceReplay is the anti-replay helper that b.auth.jwt and b.auth.dpop route their replay defense through; it calls the store's checkAndInsert and treated the result as a replay only when it was the literal false. The recommended stores signal a duplicate with a different falsy value -- a Redis SET ... NX returns null and a SQL INSERT ... ON CONFLICT returns a rowcount of 0 -- so a store using either would have its duplicate signal missed and the replayed nonce admitted (a replay-protection bypass for a JWT or DPoP proof). enforceReplay now admits a nonce only on a truthy first-seen confirmation and treats every other result as a replay, matching the fail-closed check the framework's inline anti-replay consumers already use."
+        }
+      ]
+    },
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "b.safeSql.normalizeForScan",
+          "body": "A parse-only SQL normalizer that produces a copy whose token boundaries are real whitespace, so a scanner built with whitespace-anchored patterns cannot be evaded by a comment or a quoted-identifier boundary that lets two tokens abut. It collapses line and block comments to a single space and inserts a separating space where a quoted string or identifier follows a word character, in the same quote- and comment-aware single pass as the existing b.safeSql placeholder scanners (a comment marker inside a string literal is preserved, never collapsed). The executed SQL is never derived from this copy -- it only feeds a scanner."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.17.5.json

@@ -0,0 +1,26 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.17.5",
+  "date": "2026-07-17",
+  "headline": "A tampered or over-filtered backup can no longer silently wipe the live data directory on restore, DNSSEC-strict resolution stays enforced when a stale answer is served, and a family of guards that matched a name against a lookup table now reject a prototype-member name instead of misclassifying it",
+  "summary": "Restoring a backup whose manifest lists zero files -- because a tampered unsigned bundle stripped every entry, or an opts.filter matched nothing -- extracted an empty staging directory and swapped it over the live data directory: a silent, full data-directory wipe reported to the operator as a successful restore. The manifest validator now refuses an empty file list, and the restore path refuses to swap a zero-file extract over a non-empty data directory. Separately, b.network.dns.resolver's validate: true DNSSEC gate was skipped on the serve-stale path, so an upstream outage could downgrade a DNSSEC-strict lookup (including DANE TLSA resolution) to unauthenticated stale data; the gate now holds on the stale path too. And a group of guards resolved a host, scheme, tag, method, or agent name against a plain-object lookup table with a truthiness read, so a name colliding with an inherited object member (constructor) was misclassified -- over-rejected as reserved/forbidden, or, for the mail-server method catalogue, passed the catalogue gate unregistered. All now match against the table's own keys.",
+  "sections": [
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "Restore refuses a zero-file backup instead of wiping the data directory",
+          "body": "b.backupManifest.validate accepted a manifest with an empty files array. The bundle writer never emits one, but the validator is the single guard the restore path parses an untrusted manifest through, so a tampered unsigned bundle that stripped every file entry (while keeping the still-valid wrapped vault key, which needs no passphrase knowledge) parsed cleanly, extracted an empty staging directory, and had the atomic swap move that empty directory over the live data directory -- a silent, destructive wipe of every file, reported to the operator as a successful restore with a file count of zero. The validator now refuses an empty file list (fixing every consumer -- parse, create, serialize -- at once), so a tampered manifest is rejected before extraction. As defense in depth, b.restore.run now also refuses to swap a zero-file extract over a non-empty data directory, which additionally catches an opts.filter that matched no manifest entry; the swap is refused with the data directory left intact rather than destroyed."
+        },
+        {
+          "title": "DNSSEC-strict resolution stays enforced on the serve-stale path",
+          "body": "b.network.dns.resolver's validate: true option refuses a response that is not DNSSEC-authenticated (AD=0), but the RFC 8767 serve-stale short-circuit returned a cached stale answer before that gate ran. An attacker who can force an upstream outage (denying the DoH endpoint) could therefore downgrade a DNSSEC-strict lookup -- including b.network.dns.resolver.queryTlsa for DANE, queryDs, or a CNAME chase -- to unauthenticated stale data cached earlier at AD=0, with the caller seeing a success rather than the documented validate-failed refusal. The AD-bit gate now applies on the serve-stale path too (the DNSSEC verdict is per-response), so a stale answer that was not authenticated is refused rather than served to a validating caller."
+        },
+        {
+          "title": "Name-lookup guards reject a prototype-member name instead of misclassifying it",
+          "body": "A group of guards tested whether a caller- or peer-supplied name was in a fixed table -- a reserved-HELO-name set, a reserved-local-host set, a dangerous-URL-scheme denylist, a reserved agent-name set, a Tiny-PS forbidden-element set, an HTML void-element set, and the mail-server method catalogue -- with a plain-object truthiness read (TABLE[name]) that walks the prototype chain. A name that collides with an inherited object member -- constructor is the one that survives a lowercased key -- read the inherited value as truthy and was misclassified: over-rejected as reserved or forbidden (b.mail.helo, b.guardListUnsubscribe, b.guardAgentRegistry, b.mailBimi, b.htmlBalance), or, for the mail-server method catalogue, passed the catalogue gate as if it were a registered method (a fail-open at registration). Every site now matches against the table's own keys with an own-property check, so a prototype-member name is treated as any other unknown name; supported names are unaffected."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.17.6.json

@@ -0,0 +1,26 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.17.6",
+  "date": "2026-07-17",
+  "headline": "PDF disarm now refuses JavaScript, launch actions, and polyglots even when an operator opt says allow, a renewed cluster lease no longer stretches its own expiry into the future, and a credential-issuance proof is refused when its replay nonce is absent",
+  "summary": "b.guardPdf.sanitize is documented to strip a PDF down to inert content and to refuse -- under every profile -- the JavaScript, launch-action, and polyglot classes it cannot safely neutralize. But its forced-reject override pinned only the exfiltration and encryption policies, omitting the JavaScript, launch-action, and polyglot policies; those default to reject, so the gap was invisible until an operator passed an explicit permissive opt, which then let sanitize hand back a live PDF still carrying JavaScript or a launch action. b.clusterProviderDb.renewLease computed a lease's time-to-live as the span between its acquire time and its expiry, but on renewal advanced only the expiry and left the acquire time frozen, so each renewal re-derived an ever-larger TTL and pushed the expiry unboundedly into the future -- a dead leader's lease then never lapsed and no follower could take over. And b.auth.oid4vci's issuer skipped the credential-proof replay/holder-binding nonce check when the expected nonce was null, the miss sentinel that a Redis-, Map-, or SQL-backed nonce store commonly returns, so a forged proof could mint a credential bound to an attacker-chosen key.",
+  "sections": [
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "PDF disarm refuses active content even against a permissive operator opt",
+          "body": "b.guardPdf.sanitize is the disarm-by-refusal primitive: it guarantees it never returns a PDF that still carries JavaScript, a launch/open action, an embedded file, or encryption, and that the JavaScript, launch-action, and polyglot classes are refused under every profile. To hold that guarantee regardless of the operator's configuration, sanitize builds a forced override that pins the relevant policies to reject -- but the override pinned only the embedded-file, open-action, magic, and encryption policies and omitted the JavaScript, launch-action, and polyglot policies. Because those three already default to reject in every shipped profile, the omission was invisible in normal use; an operator who passed an explicit permissive opt (javascriptPolicy, launchActionPolicy, or polyglotPolicy set to allow or audit) turned that opt back on inside sanitize and received a live PDF still carrying JavaScript or a launch action -- exactly the remote-code-execution and polyglot classes the primitive promises to refuse. The forced override now pins all three, so sanitize refuses them unconditionally; the overridable validate and gate entry points, which document these policies as operator-tunable, are unchanged."
+        },
+        {
+          "title": "Cluster lease renewal keeps a bounded expiry so a dead leader can be taken over",
+          "body": "b.clusterProviderDb models a leader lease as a sliding window whose span -- expiry minus acquire time -- equals the configured lease TTL. renewLease recovered the TTL from that span but then advanced only the expiry while leaving the acquire time frozen at the original acquisition, so the next renewal measured a span that had grown by one renewal interval and re-derived an ever-larger TTL, pushing the expiry unboundedly into the future. A leader that renewed even a few times and then died left a lease whose expiry was far beyond the configured TTL, so it never lapsed within the takeover window and no follower could steal it -- the cluster could stall with no active leader. renewLease now slides both ends of the window forward on every renewal (acquire time and expiry both move to now and now-plus-TTL), keeping the span at the configured TTL so a lapsed leader's lease expires on schedule and bounded takeover works."
+        },
+        {
+          "title": "Credential-issuance proof is refused when its replay nonce is absent",
+          "body": "b.auth.oid4vci's issuer verifies the wallet's key-binding proof against the c_nonce it minted with the access token -- the challenge that binds the proof to this issuance and prevents replay. The verifier treated three states of the expected nonce differently: a string was compared, an undefined value (the miss sentinel b.cache returns) was refused, and a null value was treated as no check required. But a nonce store fronting Redis, a Map, or a SQL row -- all accepted through the documented store option -- commonly signals a miss with null, which fell straight through the comparison and disabled the replay and holder-binding defense entirely: after the short-lived c_nonce expired (while the access token was still valid, in batch issuance), an attacker holding that token could submit a proof signed by an arbitrary key with any nonce and have a credential minted bound to that attacker-controlled key. The verifier now requires the expected nonce to be a non-empty string and fails closed on any other value, so an absent or expired nonce is refused regardless of the store's miss sentinel."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.17.7.json

@@ -0,0 +1,35 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.17.7",
+  "date": "2026-07-17",
+  "headline": "A histogram exemplar's label name can no longer forge a line into the metrics scrape, the CSP report endpoint bounds how many reports one request can carry, and a cron field of the form N/step now fires on the whole repeating series instead of once",
+  "summary": "A histogram exemplar's label VALUES were scrubbed before rendering but its label NAMES were written verbatim into the OpenMetrics exposition, and a Prometheus label name -- unlike a value -- cannot be quoted or escaped, so a name containing a newline forged an entire metric line into every /metrics scrape (the label-name sibling of the exemplar value injection already closed). The CSP report endpoint processed an unbounded number of reports per request: a single unauthenticated POST within the body-size cap could pack well over a thousand tiny reports, each driving a full audit-chain append and report hook, an amplification vector now bounded by a per-request report cap. And the shared cron parser mis-read a field of the form N/step -- e.g. 5/15 -- as the single value N instead of the standard N, N+step, ... through the field maximum, so a job scheduled that way fired once per period instead of on the intended repeating series; a recurring queue job also silently dropped its configured retry limit when it re-enqueued the next occurrence.",
+  "sections": [
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "Metrics exemplar label names cannot inject a line into the scrape",
+          "body": "b.metrics histogram exemplars carry their own label set, stored through the same redaction step the regular labels use -- but that step scrubbed only the label VALUES (for credential shapes) and passed every label NAME through verbatim to the shared exposition renderer. A regular label name is validated against the Prometheus name grammar at registration and refused if undeclared, but the exemplar path had no equivalent gate, and because a label name cannot be quoted or escaped in the OpenMetrics wire format, an exemplar label name containing a newline (or a quote or brace) forged a complete, attacker-shaped metric line into every /metrics scrape -- reachable wherever an operator routes request-derived data into an exemplar label name (CWE-93). The exemplar redaction step now drops any label name that is not a valid Prometheus label name (length-bounded so a hostile oversized name cannot itself become a denial of service), matching the gate regular labels already get; valid names such as trace_id are unaffected. This closes the label-name sibling of the exemplar value injection fixed earlier."
+        },
+        {
+          "title": "CSP report endpoint bounds the number of reports per request",
+          "body": "b.middleware.cspReport accepts a batch of reports in one POST (the Reporting API delivers them batched). The body-size cap bounded the request bytes but not the number of reports inside it, so a single unauthenticated request could carry well over a thousand small report objects, and the handler drove a full audit-chain append (a hash, a seal, and a serialized database insert) plus an operator report hook for every one of them -- a per-request amplification denial-of-service against an endpoint that is public by design. The endpoint now caps the batch length at a configurable maxReports (default 100, generous for a real browser batch): an over-cap batch is refused with 413 and the documented too-many-reports rejection reason, processing none of its reports, so the amplification is bounded while a normal browser report is unaffected."
+        }
+      ]
+    },
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "A cron field of the form N/step fires on the full repeating series",
+          "body": "The shared cron parser read a field of the form N/step -- a bare number followed by a step, such as 5/15 in the minute field -- as the single value N, dropping the step entirely, instead of the standard Vixie-cron meaning N, N+step, ... up to the field maximum (5/15 in minutes is 5, 20, 35, 50, the same way */15 is 0, 15, 30, 45). A schedule written that way therefore fired once per period instead of on the intended repeating series -- and a job that runs less often than intended (a rotation, a cleanup, a scan) is a silent operational-safety gap. The parser now anchors the range at the field maximum whenever a step is present, so N/step expands to the full series; a bare number with no step is still the single value N. The cron-recurring queue backends (local and Redis) parse through this shared code and inherit the fix."
+        },
+        {
+          "title": "A recurring queue job keeps its configured retry limit across occurrences",
+          "body": "A cron-recurring queue job re-enqueues itself for its next firing time and carried its priority, classification, and trace id forward -- but silently dropped the operator's configured maxAttempts, so every occurrence after the first reverted to the enqueue default retry budget rather than the one the operator set. Both queue backends now carry maxAttempts forward (guarded to a positive finite value, falling back to the enqueue default only when it is unset), so a recurring job's retry limit is stable across every occurrence."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.17.8.json

@@ -0,0 +1,22 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.17.8",
+  "date": "2026-07-17",
+  "headline": "The AI-Act transparency HTML emitters now escape every interpolated value, closing a reflected-XSS through a banner's language attribute and a script-context breakout through the JSON-LD disclosure",
+  "summary": "b.compliance.aiAct.transparency.htmlBanner rendered its lang value -- a free-form string that is typically a request locale, Accept-Language, or query parameter when the banner is server-rendered -- into a double-quoted HTML attribute by raw concatenation, so a lang containing a double quote broke out of the attribute and injected active content (reflected XSS). Only the element text was escaped before; the attribute values were not. And b.compliance.aiAct.transparency.jsonLdDisclosure embedded the watermark manifest (operator-supplied strings such as the model id and deployer name) inside a <script type=\"application/ld+json\"> element with raw JSON.stringify, which does not escape </script>; the HTML parser ends a script element at the first </script> regardless of its type, so a manifest value carrying that sequence terminated the block early and injected markup. Both emitters now escape at the sink -- every attribute value through the HTML-entity escaper and the JSON-LD payload through the script-safe serializer -- so no interpolated value can break out of its context.",
+  "sections": [
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "AI-Act transparency banner escapes its attribute values",
+          "body": "b.compliance.aiAct.transparency.htmlBanner builds a status banner whose lang attribute carries a free-form language value -- in a server-rendered banner that value commonly comes from the request (a locale, an Accept-Language header, or a query parameter). The banner escaped its visible text but concatenated the lang, article, and kind values into their double-quoted HTML attributes raw, so a lang value containing a double quote closed the attribute early and let the remainder inject an element or event handler into the page (reflected cross-site scripting, CWE-79). Every attribute value is now passed through the HTML-entity escaper before interpolation, matching the escaping the banner text already had, so a hostile value is rendered as inert text inside the attribute rather than breaking out of it; the escape-at-the-sink handling also covers the article and kind values even though their range is currently constrained."
+        },
+        {
+          "title": "AI-Act JSON-LD disclosure cannot break out of its script element",
+          "body": "b.compliance.aiAct.transparency.jsonLdDisclosure emits the watermark manifest as JSON-LD inside a <script type=\"application/ld+json\"> element, serializing operator-supplied manifest strings (the model id, deployer name, prompt hash, and similar). It used raw JSON.stringify, which does not escape the sequence </script>; because an HTML parser terminates a script element at the first </script> regardless of the element's type, a manifest value containing </script> (or an HTML comment opener) ended the disclosure block early and injected arbitrary markup that the browser then parsed and could execute. The disclosure now serializes the manifest with the framework's script-safe serializer, which escapes <, >, & and the U+2028/U+2029 separators to their \\uXXXX form so the parsed JSON is unchanged but no substring can break out of the script context."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.17.9.json

@@ -0,0 +1,26 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.17.9",
+  "date": "2026-07-17",
+  "headline": "A prototype-member regime name no longer voids a breach-notification clock into reporting a missed deadline as met, a planted plaintext file can no longer stand in for the sealed keyed-hash MAC key, and content-safety sanitization recomputes the integrity descriptor over the bytes actually delivered",
+  "summary": "The incident-report deadline clock resolved its per-regime statutory table by a plain-object lookup with no own-property check, so a regime name equal to an inherited object member (valueOf, toString, constructor) resolved to a prototype function instead of the default deadlines -- every due-by became NaN, and a notification filed long past a statutory wall was recorded on-time, reporting a missed regulatory deadline as met. The retention posture-floor lookup had the same defect. The vault's keyed-hash MAC key reader trusted the vault's documented pass-through of a non-sealed value, so a plaintext file substituted on disk was accepted as the secret MAC key without the vault passphrase. And the static file server and the upload finalizer both replaced the served/stored payload when a content-safety gate sanitized it but kept advertising the ORIGINAL bytes' ETag/SRI (static) and sha3/size descriptor (upload), so a client validating the integrity of the delivered body -- or an operator storing the reported hash as the dedup/integrity key -- got a digest that did not match what was actually delivered.",
+  "sections": [
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "Breach-notification and retention lookups reject a prototype-member name",
+          "body": "b.incident.report's deadline clock resolves the statutory deadline set for an incident's regime (GDPR 72h, NIS2 24h, DORA 4h initial, HIPAA 60 days, ...) by indexing a per-regime table with the operator-supplied regime string. The lookup used a truthiness check with no own-property guard, so a regime equal to an inherited object member -- valueOf, toString, constructor, hasOwnProperty -- resolved to the prototype function instead of falling back to the default deadlines. Every computed due-by then became NaN, and because a late comparison against NaN is never true, a notification filed long past the real statutory wall was recorded on-time (not late) and the clock's late count stayed zero -- a genuinely missed regulatory deadline reported to a regulator as met. b.retention's compliance-posture floor lookup (hipaa, pci-dss, gdpr, soc2) had the identical defect, resolving a prototype-member posture to an inherited function as the retention floor. Both now resolve the name through an own-property check, so a prototype-member name falls back to the default deadlines (incident-report) or is rejected as an unknown posture (retention); real regimes and postures are unaffected."
+        },
+        {
+          "title": "Vault refuses a non-sealed file as the keyed-hash MAC key",
+          "body": "b.vault derives a keyed-hash MAC key (used by field-level encryption's keyed derived-hash mode to keep an attacker with disk access from correlating low-entropy plaintexts) and seals it at rest. The reader loaded the sealed file and called the vault's unseal, which by its documented idempotent-read contract returns any value lacking the vault seal prefix verbatim -- so a plaintext 32-byte value planted on disk passed straight through and was accepted as the MAC key. In wrapped-vault mode this let an attacker with disk-write access but no vault passphrase (and therefore unable to forge a genuine seal) inject a known MAC key, downgrading the keyed derived-hash to an attacker-known key. The reader now requires the on-disk value to actually be sealed (carry the vault prefix) before unsealing, refusing a substituted plaintext or otherwise-unsealed file -- the same load-bearing prefix check the database key loader and the key-rotation pipeline already apply to their sealed key material."
+        },
+        {
+          "title": "Content-safety sanitization recomputes the served body's integrity descriptor",
+          "body": "When a content-safety gate returns a sanitize action it replaces the payload with the cleaned bytes. b.staticServe still emitted the strong ETag and subresource-integrity (SRI) header derived from the original file on disk, and b.fileUpload's finalizer still handed onFinalize (and recorded in the audit) the sha3 and size of the original assembled bytes -- so the integrity descriptor advertised for the delivered/stored bytes did not match them. A browser performing SRI verification of the sanitized static response would fail the check, a strong-validator or If-None-Match cache would be keyed to a representation the client never receives, and an operator storing the upload's reported sha3 as the integrity or dedup key of the stored (sanitized) file would record a hash that never matches it. Both now recompute the ETag/SRI (static) and the sha3/size descriptor (upload) over the bytes actually delivered whenever a gate sanitized the payload; an unsanitized response keeps the on-disk/reassembly digest, which already describes the delivered bytes."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/scripts/validate-source-comment-blocks.js

@@ -74,6 +74,10 @@ var findings = engine.validate({
   curationPages: curationPages,
   parser:        parser,
   // optsResolver intentionally omitted — see comment block above.
+  // testDirs feeds the primitive-without-test check: every @primitive
+  // must be referenced from the test corpus (full dotted form, or
+  // namespace / owning-module reference plus a method invocation).
+  testDirs:      [path.join(ROOT, "test")],
 });
 
 process.exit(_report(findings));

package/lib/vendor/blamejs/scripts/vendor-update.sh

@@ -6,10 +6,17 @@
 #   ./scripts/vendor-update.sh --check                # show outdated vendored packages
 #   ./scripts/vendor-update.sh --diff <package>       # show vendored vs latest + changelog url
 #   ./scripts/vendor-update.sh --diff-all             # diff every outdated package
+#   ./scripts/vendor-update.sh --refresh-data [entry] # refresh + re-sign vendored data files
+#                                                     # (publicsuffix-list, SecLists-common-
+#                                                     # passwords-top-10000, bimi-trust-anchors;
+#                                                     # default: all)
 #
 # What it does:
 #   1. installs the package(s) temporarily via npm
-#   2. bundles with esbuild (CJS, server-side)
+#   2. bundles with esbuild (CJS, server-side, unminified — vendored
+#      bundles ship as reviewable source so operators can diff them
+#      against upstream; esbuild still tree-shakes and keeps upstream
+#      license comments)
 #   3. copies native prebuilds where applicable (argon2)
 #   4. updates lib/vendor/MANIFEST.json (version + bundledAt)
 #   5. removes the temporarily-installed npm package
@@ -113,6 +120,250 @@ if [ "${1:-}" = "--diff-all" ]; then
   exit 0
 fi
 
+# ---- refresh-data mode ----
+#
+# Vendored DATA files (not code bundles): fetch the upstream where one
+# exists, re-append the in-payload integrity canary, and regenerate +
+# re-sign the .data.js carrier via scripts/vendor-data-gen.js whenever
+# the raw file changed. bimi-trust-anchors is operator-managed (no
+# upstream to fetch) — it is re-signed only when the local .pem was
+# edited per its file-header procedure. Runs of the CI vendor-currency
+# gate that report the publicsuffix-list entry as stale are resolved by
+# this mode. Requires the operator-local SLH-DSA signing key
+# (.keys/vendor-data-private.pem; see scripts/vendor-data-keygen.js).
+
+DATA_SIGNING_KEY=".keys/vendor-data-private.pem"
+REFRESH_DATA_ANY_REGEN=false
+
+fetch_upstream_raw() {
+  # $1 url, $2 dest tmp path, $3.. fixed strings that must all appear
+  # in the body (sanity gate — a truncated or error body must never
+  # reach the signer).
+  #
+  # NOTE for this function and everything refresh_data_entry calls:
+  # the entry functions run as `refresh_data_entry ... || exit 1`, and
+  # bash suspends errexit inside a function invoked under || — every
+  # state-changing command here must carry its own explicit failure
+  # handling; none may rely on `set -e`.
+  local url="$1" tmp="$2"
+  shift 2
+  if ! curl -fsSL --connect-timeout 30 --max-time 300 "$url" -o "$tmp"; then
+    echo "ERROR: fetch failed: $url"
+    rm -f "$tmp"
+    return 1
+  fi
+  if [ ! -s "$tmp" ]; then
+    echo "ERROR: fetched $url is empty — refusing to sign it"
+    rm -f "$tmp"
+    return 1
+  fi
+  local needle
+  for needle in "$@"; do
+    if ! grep -qF -- "$needle" "$tmp"; then
+      echo "ERROR: fetched $url failed the sanity check (missing '$needle') — refusing to sign it"
+      rm -f "$tmp"
+      return 1
+    fi
+  done
+  return 0
+}
+
+regen_data_module_if_changed() {
+  # $1 manifest key, $2 raw file, $3 .data.js carrier, $4 generator
+  # --name, $5 --source-url, $6 --license, $7 --canary ("" = none),
+  # $8 NOTICE component match string ("" = no dated NOTICE stamp)
+  #
+  # Regenerates when the raw payload no longer matches the carrier's
+  # recorded SHA-256 OR when the carrier itself fails four-layer
+  # verification (a payload-identical carrier with a corrupted
+  # signature block, a stripped header, or a signature from a rotated
+  # key must be re-signable through this documented path, not by
+  # reverse-engineering a manual generator invocation).
+  local key="$1" raw="$2" datajs="$3" name="$4" srcurl="$5" license="$6" canary="$7" noticekey="$8"
+  local rawsha datasha carrier_ok
+  rawsha=$(node -e "var c=require('node:crypto'),f=require('node:fs');console.log(c.createHash('sha256').update(f.readFileSync(process.argv[1])).digest('hex'))" "$raw" 2>/dev/null) || rawsha=""
+  if [ -z "$rawsha" ]; then
+    echo "ERROR: cannot hash $raw — file missing or unreadable"
+    return 1
+  fi
+  # Empty datasha (carrier missing, or its provenance header stripped)
+  # is a regeneration trigger, never a match.
+  datasha=$(node -e "var f=require('node:fs');var m=f.readFileSync(process.argv[1],'utf8').match(/^\/\/ SHA-256:\s+([0-9a-f]{64})/m);console.log(m?m[1]:'')" "$datajs" 2>/dev/null) || datasha=""
+  carrier_ok=$(BLAMEJS_VENDOR_DATA_DEFER_BOOT_VERIFY=1 \
+    BLAMEJS_VENDOR_DATA_DEFER_BOOT_VERIFY_REASON="vendor-update:per-entry-refresh-probe" \
+    node -e "try { require('./lib/vendor-data.js').get(process.argv[1]); console.log('ok'); } catch (e) { console.log('bad'); }" "$name" 2>/dev/null) || carrier_ok="bad"
+  if [ -n "$datasha" ] && [ "$rawsha" = "$datasha" ] && [ "$carrier_ok" = "ok" ]; then
+    echo "  $name: carrier verified and matches the raw file — nothing to re-sign"
+    return 0
+  fi
+  if [ -n "$datasha" ] && [ "$rawsha" = "$datasha" ]; then
+    echo "  $name: carrier fails verification — regenerating + re-signing"
+  else
+    echo "  $name: raw file changed — regenerating + re-signing the carrier"
+  fi
+  local gen_args=(--src "$raw" --dst "$datajs" --name "$name" --source-url "$srcurl" --license "$license" --signing-key "$DATA_SIGNING_KEY")
+  if [ -n "$canary" ]; then gen_args+=(--canary "$canary"); fi
+  node scripts/vendor-data-gen.js "${gen_args[@]}" || return 1
+  node -e "
+var fs = require('fs');
+var m = JSON.parse(fs.readFileSync('$MANIFEST', 'utf8'));
+var key = process.argv[1];
+if (m.packages[key]) {
+  m.packages[key].bundledAt = process.argv[2] + 'T00:00:00Z';
+  fs.writeFileSync('$MANIFEST', JSON.stringify(m, null, 2) + '\n');
+  console.log('  MANIFEST.json: ' + key + ' bundledAt -> ' + process.argv[2]);
+}
+" "$key" "$DATE" || { echo "ERROR: MANIFEST.json bundledAt update failed for $key"; return 1; }
+  if [ -n "$noticekey" ]; then
+    node -e "
+var fs = require('fs');
+var sep = Array(81).join('-');
+var noticeKey = process.argv[1];
+var date = process.argv[2];
+var blocks = fs.readFileSync('NOTICE', 'utf8').split(sep);
+var touched = false;
+for (var i = 0; i < blocks.length; i++) {
+  if (blocks[i].indexOf('Component:') === -1 || blocks[i].indexOf(noticeKey) === -1) continue;
+  var next = blocks[i].replace(/\(bundled \d{4}-\d{2}-\d{2}\)/, '(bundled ' + date + ')');
+  if (next !== blocks[i]) { blocks[i] = next; touched = true; }
+}
+if (touched) {
+  fs.writeFileSync('NOTICE', blocks.join(sep));
+  console.log('  NOTICE: ' + noticeKey + ' bundled date -> ' + date);
+}
+" "$noticekey" "$DATE" || { echo "ERROR: NOTICE date update failed for $noticekey"; return 1; }
+  fi
+  REFRESH_DATA_ANY_REGEN=true
+  return 0
+}
+
+refresh_data_entry() {
+  local key="$1" tmp
+  case "$key" in
+    publicsuffix-list)
+      tmp="lib/vendor/public-suffix-list.dat.refresh-tmp"
+      fetch_upstream_raw "https://publicsuffix.org/list/public_suffix_list.dat" "$tmp" \
+        "===END PRIVATE DOMAINS===" "// VERSION:" "// COMMIT:" || return 1
+      { printf '\n// ===BEGIN blamejs canary===\n'
+        printf '// Honeytoken — vendor-data integrity defense (lib/vendor-data.js).\n'
+        printf '_blamejs_canary_v0_9_8_.local\n'
+        printf '// ===END blamejs canary===\n'; } >> "$tmp"
+      # Directional freshness guard: the list is CDN-served and an edge
+      # can return an OLDER cached copy than the snapshot already
+      # vendored (publication reaches edges at different times). The
+      # VERSION header is a sortable UTC timestamp — never replace the
+      # local file with a fetch whose VERSION is older than the local
+      # one; a genuinely newer local copy is what the CI currency gate
+      # already treats as current.
+      local fetchv localv
+      fetchv=$(grep -m1 '^// VERSION:' "$tmp" | awk '{print $3}') || fetchv=""
+      localv=$(grep -m1 '^// VERSION:' "lib/vendor/public-suffix-list.dat" 2>/dev/null | awk '{print $3}') || localv=""
+      if [ -n "$fetchv" ] && [ -n "$localv" ] && [[ "$fetchv" < "$localv" ]]; then
+        echo "  public-suffix-list: fetched copy ($fetchv) is older than the vendored one ($localv) — lagging CDN edge; keeping the local file"
+        rm -f "$tmp"
+      elif cmp -s "$tmp" "lib/vendor/public-suffix-list.dat"; then
+        echo "  public-suffix-list: upstream unchanged"
+        rm -f "$tmp"
+      else
+        mv "$tmp" "lib/vendor/public-suffix-list.dat" || { echo "ERROR: could not replace lib/vendor/public-suffix-list.dat"; return 1; }
+        echo "  public-suffix-list: raw file refreshed from upstream"
+      fi
+      regen_data_module_if_changed "publicsuffix-list" \
+        "lib/vendor/public-suffix-list.dat" \
+        "lib/vendor/public-suffix-list.data.js" \
+        "public-suffix-list" \
+        "https://publicsuffix.org/list/public_suffix_list.dat" \
+        "MPL-2.0 (Mozilla Public Suffix List)" \
+        "_blamejs_canary_v0_9_8_.local" \
+        "publicsuffix-list"
+      ;;
+    SecLists-common-passwords-top-10000)
+      tmp="lib/vendor/common-passwords-top-10000.txt.refresh-tmp"
+      fetch_upstream_raw "https://raw.githubusercontent.com/danielmiessler/SecLists/master/Passwords/Common-Credentials/10k-most-common.txt" "$tmp" \
+        "password" || return 1
+      if [ "$(grep -c . "$tmp")" -lt 9000 ]; then
+        echo "ERROR: fetched password list has fewer than 9000 lines — refusing to sign it"
+        rm -f "$tmp"
+        return 1
+      fi
+      printf '\n_blamejs_canary_password_2026_05_13_blamejs_internal_\n' >> "$tmp"
+      if cmp -s "$tmp" "lib/vendor/common-passwords-top-10000.txt"; then
+        echo "  common-passwords-top-10000: upstream unchanged"
+        rm -f "$tmp"
+      else
+        mv "$tmp" "lib/vendor/common-passwords-top-10000.txt" || { echo "ERROR: could not replace lib/vendor/common-passwords-top-10000.txt"; return 1; }
+        echo "  common-passwords-top-10000: raw file refreshed from upstream"
+      fi
+      regen_data_module_if_changed "SecLists-common-passwords-top-10000" \
+        "lib/vendor/common-passwords-top-10000.txt" \
+        "lib/vendor/common-passwords-top-10000.data.js" \
+        "common-passwords-top-10000" \
+        "https://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/10k-most-common.txt" \
+        "CC-BY-3.0 (SecLists / Daniel Miessler)" \
+        "_blamejs_canary_password_2026_05_13_blamejs_internal_" \
+        "SecLists"
+      ;;
+    bimi-trust-anchors)
+      # Operator-managed — never fetched. Re-signs only when the local
+      # .pem was edited per the refresh procedure in its file header.
+      regen_data_module_if_changed "bimi-trust-anchors" \
+        "lib/vendor/bimi-trust-anchors.pem" \
+        "lib/vendor/bimi-trust-anchors.data.js" \
+        "bimi-trust-anchors" \
+        "https://bimigroup.org/resources/vmc-trust-anchors.pem" \
+        "Public domain (BIMI Group VMC trust anchors)" \
+        "" \
+        ""
+      ;;
+    *)
+      echo "ERROR: unknown data entry: $key"
+      echo "       valid: publicsuffix-list, SecLists-common-passwords-top-10000, bimi-trust-anchors"
+      return 1
+      ;;
+  esac
+}
+
+if [ "${1:-}" = "--refresh-data" ]; then
+  if [ ! -f "$DATA_SIGNING_KEY" ]; then
+    echo "ERROR: $DATA_SIGNING_KEY not found — the vendored-data SLH-DSA signing"
+    echo "       key is operator-local. Generate a keypair with"
+    echo "       scripts/vendor-data-keygen.js (shipping a new PUBLIC key is a"
+    echo "       lib/vendor-data.js change and a breaking data-integrity event)."
+    exit 1
+  fi
+  # A Ctrl-C'd or failed fetch must not leave a partial download inside
+  # the shipped lib/vendor/ tree (the printed next step is `git add
+  # lib/vendor/`). Belt: this trap. Braces: *.refresh-tmp is gitignored.
+  trap 'rm -f lib/vendor/*.refresh-tmp' EXIT
+  echo "=== Refreshing vendored data files ==="
+  if [ -n "${2:-}" ]; then
+    refresh_data_entry "$2" || exit 1
+  else
+    refresh_data_entry "publicsuffix-list" || exit 1
+    refresh_data_entry "SecLists-common-passwords-top-10000" || exit 1
+    refresh_data_entry "bimi-trust-anchors" || exit 1
+  fi
+  if [ "$REFRESH_DATA_ANY_REGEN" = true ]; then
+    echo ""
+    echo "=== Refreshing MANIFEST.json sha256 hashes ==="
+    node scripts/refresh-vendor-manifest.js || { echo "Manifest hash refresh failed."; exit 1; }
+  fi
+  echo ""
+  echo "=== Verifying vendored data (dual-hash + SLH-DSA + canary) ==="
+  node -e "require('./lib/vendor-data.js').verifyAll(); console.log('  vendor-data verifyAll: OK');" || exit 1
+  if [ "$REFRESH_DATA_ANY_REGEN" = true ]; then
+    echo ""
+    echo "Next steps:"
+    echo "  1. node scripts/check-vendor-currency.js"
+    echo "  2. node test/smoke.js"
+    echo "  3. git add lib/vendor/ lib/vendor/MANIFEST.json NOTICE && git commit"
+  else
+    echo ""
+    echo "Nothing changed — every vendored data file already matches upstream."
+  fi
+  exit 0
+fi
+
 # ---- update mode ----
 PKG="${1:?Usage: vendor-update.sh <package> [version]}"
 VER="${2:-latest}"
@@ -128,8 +379,9 @@ fi
 case "$PKG" in
   "@noble/ciphers")
     echo 'export { xchacha20poly1305 } from "@noble/ciphers/chacha.js";' > _entry.mjs
-    npx esbuild _entry.mjs --bundle --format=cjs --minify --platform=node --outfile=lib/vendor/noble-ciphers.cjs
+    npx esbuild _entry.mjs --bundle --format=cjs --platform=node --outfile=lib/vendor/noble-ciphers.cjs
     rm _entry.mjs
+    BUNDLER_DESC="esbuild --format=cjs --platform=node"
     sed -i "1s|^|// XChaCha20-Poly1305 — vendored from @noble/ciphers v${INSTALLED_VER} by Paul Miller\n// License: MIT — https://github.com/paulmillr/noble-ciphers\n// Bundled with esbuild. Exports: xchacha20poly1305\n|" lib/vendor/noble-ciphers.cjs
     ;;
 
@@ -138,8 +390,9 @@ case "$PKG" in
 export { ristretto255_oprf } from "@noble/curves/ed25519.js";
 export { p256_oprf, p384_oprf, p521_oprf } from "@noble/curves/nist.js";
 ENTRY
-    npx esbuild _entry.mjs --bundle --format=cjs --minify --platform=node --outfile=lib/vendor/noble-curves.cjs
+    npx esbuild _entry.mjs --bundle --format=cjs --platform=node --outfile=lib/vendor/noble-curves.cjs
     rm _entry.mjs
+    BUNDLER_DESC="esbuild --format=cjs --platform=node"
     sed -i "1s|^|// @noble/curves v${INSTALLED_VER} — vendored from Paul Miller\n// License: MIT — https://github.com/paulmillr/noble-curves\n// Bundled with esbuild. Exports the RFC 9497 OPRF suites:\n//   ristretto255_oprf (ristretto255-SHA512), p256_oprf (P-256-SHA256),\n//   p384_oprf (P-384-SHA384), p521_oprf (P-521-SHA512) — each with\n//   oprf / voprf / poprf modes. Backs b.crypto.oprf.\n|" lib/vendor/noble-curves.cjs
     ;;
 
@@ -149,15 +402,22 @@ export { ml_kem512, ml_kem768, ml_kem1024 } from "@noble/post-quantum/ml-kem.js"
 export { ml_dsa44, ml_dsa65, ml_dsa87 } from "@noble/post-quantum/ml-dsa.js";
 export { slh_dsa_sha2_128f, slh_dsa_sha2_192f, slh_dsa_sha2_256f, slh_dsa_shake_128f, slh_dsa_shake_192f, slh_dsa_shake_256f } from "@noble/post-quantum/slh-dsa.js";
 ENTRY
-    npx esbuild _entry.mjs --bundle --format=cjs --minify --platform=node --outfile=lib/vendor/noble-post-quantum.cjs
+    npx esbuild _entry.mjs --bundle --format=cjs --platform=node --outfile=lib/vendor/noble-post-quantum.cjs
     rm _entry.mjs
+    BUNDLER_DESC="esbuild --format=cjs --platform=node"
     sed -i "1s|^|// @noble/post-quantum v${INSTALLED_VER} — vendored from Paul Miller\n// License: MIT — https://github.com/paulmillr/noble-post-quantum\n// Bundled with esbuild. Exports: ml_kem512 / ml_kem768 / ml_kem1024 (FIPS 203 KEM),\n//   ml_dsa44 / ml_dsa65 / ml_dsa87 (FIPS 204 lattice signatures),\n//   slh_dsa_sha2_*f / slh_dsa_shake_*f (FIPS 205 hash signatures).\n|" lib/vendor/noble-post-quantum.cjs
     ;;
 
   "@simplewebauthn/server")
+    # reflect-metadata (pulled in via @peculiar/x509) resolves to its upstream
+    # ./lite entry: identical metadata API and cross-copy registry, but built
+    # for runtimes with native globalThis / Map / Set / WeakMap — it has none
+    # of the legacy global-object probes (Function("return this") / indirect
+    # eval) that can never execute on the Node versions the framework supports.
     echo "module.exports = require(\"@simplewebauthn/server\");" > _entry.cjs
-    npx esbuild _entry.cjs --bundle --format=cjs --platform=node --minify --external:crypto --external:node:crypto --outfile=lib/vendor/simplewebauthn-server.cjs
+    npx esbuild _entry.cjs --bundle --format=cjs --platform=node --alias:reflect-metadata=reflect-metadata/lite --external:crypto --external:node:crypto --outfile=lib/vendor/simplewebauthn-server.cjs
     rm _entry.cjs
+    BUNDLER_DESC="esbuild --format=cjs --platform=node --alias:reflect-metadata=reflect-metadata/lite --external:crypto --external:node:crypto"
     sed -i "1s|^|// @simplewebauthn/server v${INSTALLED_VER} — vendored. License: MIT\n// https://github.com/MasterKale/SimpleWebAuthn\n|" lib/vendor/simplewebauthn-server.cjs
     ;;
 
@@ -174,11 +434,25 @@ ENTRY
     # ASN.1 schema package, packed into one CJS file. lib/mtls-ca.js loads the
     # bundle via the default engine in lib/mtls-engine-default.js for CA gen,
     # client-cert signing, and PKCS#12 packaging — no openssl CLI at runtime.
+    #
+    # Version argument: "latest" (default) bundles the newest @peculiar/x509 +
+    # pkijs; the MANIFEST version form "<x509ver>+pkijs-<pkijsver>" (e.g.
+    # "2.0.0+pkijs-3.4.0") rebundles those exact component versions.
+    X509_REQ="latest"
+    PKIJS_REQ="latest"
+    if [ "$VER" != "latest" ]; then
+      X509_REQ="${VER%%+pkijs-*}"
+      PKIJS_REQ="${VER##*+pkijs-}"
+      if [ -z "$X509_REQ" ] || [ -z "$PKIJS_REQ" ] || [ "$X509_REQ" = "$VER" ]; then
+        echo "ERROR: peculiar-pki version must be 'latest' or '<x509ver>+pkijs-<pkijsver>' (e.g. 2.0.0+pkijs-3.4.0)"
+        exit 1
+      fi
+    fi
     npm install --no-save --ignore-scripts \
       reflect-metadata \
       pvutils pvtsutils asn1js \
       "@peculiar/asn1-schema" "@peculiar/asn1-x509" "@peculiar/asn1-ecc" "@peculiar/asn1-rsa" \
-      "@peculiar/x509" pkijs 2>/dev/null
+      "@peculiar/x509@${X509_REQ}" "pkijs@${PKIJS_REQ}" 2>/dev/null
     X509_VER=$(node -e "console.log(require('./node_modules/@peculiar/x509/package.json').version)")
     PKIJS_VER=$(node -e "console.log(require('./node_modules/pkijs/package.json').version)")
     echo "Installed: @peculiar/x509@$X509_VER, pkijs@$PKIJS_VER"
@@ -197,10 +471,17 @@ export const pkijs = pkijsLib;
 export const x509 = x509Lib;
 export const crypto = webcrypto;
 ENTRY
-    npx esbuild _pki-entry.mjs --bundle --format=cjs --platform=node --minify \
+    # reflect-metadata resolves to its upstream ./lite entry: identical
+    # metadata API and cross-copy registry, but built for runtimes with native
+    # globalThis / Map / Set / WeakMap — it has none of the legacy
+    # global-object probes (Function("return this") / indirect eval) that can
+    # never execute on the Node versions the framework supports.
+    npx esbuild _pki-entry.mjs --bundle --format=cjs --platform=node \
+      --alias:reflect-metadata=reflect-metadata/lite \
       --external:node:crypto --external:crypto \
       --outfile=lib/vendor/pki.cjs
     rm _pki-entry.mjs
+    BUNDLER_DESC="esbuild --format=cjs --platform=node --alias:reflect-metadata=reflect-metadata/lite --external:node:crypto --external:crypto"
     sed -i "1s|^|// Peculiar PKI — vendored @peculiar/x509 v${X509_VER} + pkijs v${PKIJS_VER}\n// License: MIT. Bundled with esbuild.\n// Exports: { pkijs, x509, crypto (node:webcrypto bound) }\n// Includes: reflect-metadata, pvutils, pvtsutils, asn1js, @peculiar/asn1-*\n// Used by lib/mtls-engine-default.js for pure-JS CA + PKCS#12 operations.\n|" lib/vendor/pki.cjs
     INSTALLED_VER="${X509_VER}+pkijs-${PKIJS_VER}"
     # Structured SBOM component versions, derived from the ACTUALLY-INSTALLED
@@ -222,14 +503,17 @@ esac
 # Update MANIFEST.json. COMPONENT_VERSIONS_JSON (set only for meta-bundles that
 # carry a structured components[] sub-object, e.g. peculiar-pki) is passed via
 # the environment so its JSON braces/quotes don't fight the bash interpolation
-# into the inline node script.
-COMPONENT_VERSIONS_JSON="${COMPONENT_VERSIONS_JSON:-}" node -e "
+# into the inline node script. BUNDLER_DESC records the esbuild invocation that
+# actually produced the artifact, so the manifest's bundler field can never
+# drift from the command in the case-block above.
+COMPONENT_VERSIONS_JSON="${COMPONENT_VERSIONS_JSON:-}" BUNDLER_DESC="${BUNDLER_DESC:-}" node -e "
 var fs = require('fs');
 var m = JSON.parse(fs.readFileSync('$MANIFEST', 'utf8'));
 var pkg = '$PKG';
 if (m.packages[pkg]) {
   m.packages[pkg].version = '$INSTALLED_VER';
   m.packages[pkg].bundledAt = '$DATE';
+  if (process.env.BUNDLER_DESC) { m.packages[pkg].bundler = process.env.BUNDLER_DESC; }
   // Derive structured SBOM component versions from the ACTUALLY-INSTALLED
   // packages (issue #366) so components[].version — the field CycloneDX / Trivy
   // / Grype key on — can never drift from the bundled version string.