@blamejs/blamejs-shop 0.5.6 → 0.5.8

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.5.x
 
+- v0.5.8 (2026-07-03) — **Inventory cost-layer consumption and subscription plan-change execution are now correct under concurrent requests; vendored framework refreshed to 0.16.3.** Two ledger-atomicity fixes for concurrent requests, plus a vendored framework security refresh. Cost-layer (COGS) consumption debited each inventory layer with an unguarded read-modify-write against a snapshot, so two overlapping sales or write-offs of the same SKU could both draw from the same layer — driving a layer's remaining quantity negative, stranding a later layer, and understating cost of goods sold. Each layer debit is now an atomic guarded claim (the decrement only applies while the layer still holds the planned quantity); a losing claim reverts its own partial work and re-plans against a fresh snapshot, and the cost attribution rows are written only after every layer in the plan is claimed, so the combined consumption is exact regardless of interleaving. Separately, an immediate subscription plan change wrote its history row as executed before claiming the plan transition, so a double-submitted or retried change that lost the transition claim left a phantom executed row — carrying charge and credit amounts even though no plan moved, no invoice was recorded, and no credit was issued. The losing change now voids that row, so subscription history and any revenue rollup over executed changes reflect only changes that actually happened. The vendored framework is refreshed to 0.16.3, which redacts credential-shaped values in the rendered /metrics exposition (they were masked only in the internal cardinality key), closes a SQL-guard fragment-mode bypass for PostgreSQL dollar-quoted strings, and fails closed on MCP tool input whose JSON Schema omits an explicit object type — all inherited without shop code changes. **Changed:** *Vendored framework refreshed to 0.16.3* — Refreshes the framework the shop builds on from 0.16.2 to 0.16.3, a security and robustness patch across the observability, SQL-guard, MCP, YAML-parser, content-credentials, and resumable-upload primitives. Most consequential: a credential-shaped metric label value was redacted only in the internal cardinality key, not in the rendered exposition, so a raw token on a label leaked to every /metrics scrape — redaction now covers the rendered labels; and the SQL guard's raw-fragment escape hatch now rejects a PostgreSQL dollar-quoted string and a lone statement terminator, closing a bypass of the placeholder-binding floor. The minimum Node.js engine is unchanged at 24.18.0. **Fixed:** *Concurrent cost-layer consumption no longer double-debits a layer* — FIFO, LIFO, and weighted-average COGS consumption planned each layer debit from a snapshot and then applied an unconditional decrement, so two concurrent consumptions of the same SKU could both debit the same front layer — driving its remaining quantity negative and understating COGS while a later layer was left stranded. Each debit is now an atomic guarded claim that only applies while the layer still holds the planned quantity; a losing claim reverts the attempt's earlier claims and re-plans against a re-read of the active layers, within a bounded retry. Cost attribution rows are persisted only after every layer in the plan is claimed, so a mid-plan contention loss leaves no orphaned rows and the summed consumption and attributed cost are exact. · *A lost immediate plan-change claim voids its row instead of leaving a phantom executed change* — An immediate subscription plan change inserted its history row as executed and then claimed the plan transition with a conditional update. A double-submit or retry could have two changes both insert an executed row while only one wins the transition; the loser previously returned leaving a phantom executed change with a charge and credit amount even though no plan moved, no proration invoice was recorded, and no store credit was issued. The losing change now voids its row (cancelled, reason recorded), matching how the same path already handles a failed processor push, so history and any rollup over executed changes count only changes that actually settled.
+
+- v0.5.7 (2026-07-03) — **Storefront redirect targets route through the framework open-redirect guard, closing a TAB-injection open redirect on return_to / redirect_to.** Closes an open-redirect (CWE-601) in the storefront's post-action redirects. The cookie-consent submit, currency and locale switchers, and the wishlist and compare toggles validated their return_to / redirect_to target with a hand-rolled leading-slash regex that accepted a horizontal TAB (0x09) at the second byte. A user agent strips ASCII TAB, CR, and LF from a URL before resolving it, so a target like /<TAB>/evil.example collapsed to the protocol-relative //evil.example and navigated the shopper off-origin under the shop's trust — a phishing bounce. Every request-derived redirect target now routes through the framework's b.safeRedirect.resolve primitive (exposed once as a shared same-origin helper), which rejects every control character including TAB, protocol-relative //host and \\host forms, and full URLs — only genuine same-origin relative paths survive; anything else falls back to a safe default. The two guards that already rejected control characters are consolidated onto the same primitive so there is one redirect-safety path to reason about, and a codebase check refuses any future hand-rolled leading-slash redirect guard. No operator action and no configuration change. **Security:** *Open-redirect on storefront return_to / redirect_to closed* — The post-action redirect guards (cookie consent, currency switch, locale switch, wishlist toggle, compare toggle, announcement dismiss) accepted a leading-slash target whose second byte was a control character. A horizontal TAB there is stripped by the browser before URL parsing, turning /<TAB>/evil.example into the protocol-relative //evil.example — an off-origin redirect an attacker could use to launder a phishing link through the shop's origin. All these targets now resolve through b.safeRedirect.resolve, which rejects control characters (TAB, CR, LF, NUL), protocol-relative and backslash forms, and off-origin absolute URLs; an invalid target falls back to a same-origin default. A codebase-patterns check prevents a hand-rolled leading-slash redirect guard from reappearing.
+
 - v0.5.6 (2026-07-03) — **Minimum Node is now 24.18.0; the vendored framework refresh brings a broad batch of request-path and mail-authentication security hardening.** Refreshes the vendored framework to 0.16.2 and raises the minimum supported Node.js to 24.18.0 — operators must run Node 24.18.0 or newer before upgrading. The floor moves with the framework, which requires 24.18.0 for its bundled SQLite 3.53.1, a backup-path fix, and the native OpenSSL 3.5 SLH-DSA surface. The refresh carries a large batch of security and correctness fixes that harden the request lifecycle the storefront and account portal already run on, at no code cost to the shop: the router refuses an encoded path separator or null byte and decodes the request path once, so a path-scoped security gate and the resource it guards can no longer disagree; res.redirect rejects a horizontal TAB that user agents strip before URL parsing, closing an open-redirect bypass; OAuth refresh-token and step-up replay gates treat any truthy store result as seen and bind grants to the authenticated principal; SAML Single-Logout fails closed when a verification key arrives without its algorithm; the mail-authentication builders (Authentication-Results, delivery-status, ARC) refuse CR/LF/NUL header injection and SPF evaluation fails closed on a malformed ip4 CIDR; file uploads enforce per-upload ownership and reject path-traversal ids; recursive parsers refuse pathologically deep input instead of overflowing the stack; and shared-cache counters (lockout, byte quotas, rate caps) accumulate with an atomic compare-and-set so distributed requests cannot lose increments. Every Node-version pin — engines, .nvmrc, the container base image, CI, and the docs — is synced to the new floor from the framework's own engines constraint. **Changed:** *Minimum Node.js raised to 24.18.0* — engines.node is now >=24.18.0 (was >=24.16.0). Operators must run Node 24.18.0 or newer. The floor is dictated by the vendored framework, which requires 24.18.0 for its bundled SQLite 3.53.1, a database backup-path fix, and the native OpenSSL 3.5 SLH-DSA sign/verify surface. The .nvmrc, the container base image, the CI runner pins, and the README/architecture docs are all synced to the new floor. · *Vendored framework refreshed to 0.16.2* — The framework the shop builds on is refreshed from 0.15.38 to 0.16.2. Beyond the request-path and mail hardening in this release's summary, the refresh includes: the router rejects percent-encoded path separators so a security middleware and the route it guards agree on the path; ARC and DKIM verification reject forged or body-length-truncated signatures; OCSP validation binds the response to the certificate's issuer; status-list verification binds the token type against replay; and OAuth authorization-URL builders refuse operator parameters that collide with framework-managed ones. These land in the request lifecycle the storefront and account portal already compose, with no shop code change required.
 
 - v0.5.5 (2026-06-27) — **Customers can change their subscription plan — proration-aware upgrades and downgrades from the account portal.** Adds a self-serve plan-change surface to the customer subscription portal. From /account/subscriptions a customer can switch an active subscription to any other plan in the same currency: the page previews the proration for each candidate plan and offers two timings. An immediate change applies now and prorates the rest of the current period — an upgrade is charged the prorated difference (recorded on the subscription invoice ledger), and a downgrade is issued the unused remainder as store credit. A next-billing-cycle change is queued and applied automatically when the period rolls over, with the new plan starting clean and no proration. The transition is exactly-once: the immediate path claims the plan switch atomically before recording the charge or credit, and the scheduled path claims each due change with a single guarded update, so a retry or an overlapping scheduler run cannot double-charge or double-credit. A downgrade that owes a credit is never applied without paying it — if the credit write fails the change rolls back and retries. The surface mounts automatically when subscriptions and store credit are composed (the default for a configured storefront); the scheduler runs on the existing cron, and the tables it uses already shipped, so there are no schema changes and no operator action is required. **Added:** *Self-serve subscription plan changes with proration* — Customers can change the plan on an active subscription from /account/subscriptions/:id/change. The page lists every plan in the subscription's currency (excluding the current and archived plans) with a proration preview, and offers an immediate switch or a switch at the next billing date. An immediate upgrade charges the prorated difference for the rest of the period and records it on the subscription invoice ledger; an immediate downgrade issues the unused remainder of the outgoing plan as store credit. A still-pending change is shown on the subscription with a one-click cancel. Cross-currency, same-plan, and archived-plan requests are refused server-side, and the surface enforces subscription ownership before any read or write. · *Scheduler applies next-billing-cycle changes automatically* — A change queued for the next billing cycle is applied without operator involvement: a minute-cadence tick flips every due change to its new plan, records the proration, and issues any owed credit. Each due change is claimed with a single guarded update so an overlapping or retried run cannot apply it twice, and a change that owes a credit is left queued rather than applied if no credit can be issued — the credit is never dropped. The scheduler is inert on a deploy without subscriptions or store credit composed. **Changed:** *Dunning step failures are logged with their cause* — When a dunning step (reminder send, retry-charge record, pause, or cancel) fails, the schedule still advances and the step is recorded as failed — but the underlying error is now written to the server log instead of being discarded, so an operator can see why a step failed rather than only that it did.

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.5.6",
+  "version": "0.5.8",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-imfe0otYErcB8rr2h6KLSGTtStirysptpXETSPY4zLv3bZoIT75Lo1dOvkOav+xL",

package/lib/cost-layers.js

@@ -388,6 +388,21 @@ function create(opts) {
 
       var method = await _methodFor(sku);
       var direction = method === "lifo" ? "lifo" : "fifo";
+      // Consuming is a check-then-write against a snapshot of the active
+      // layers, so it runs under a bounded claim-retry loop. Each planned
+      // layer debit is an ATOMIC guarded UPDATE (`... AND quantity_remaining
+      // >= take`); the cost attribution rows are written only after EVERY
+      // layer in the plan has been claimed. If a concurrent consumer moved a
+      // layer since the snapshot, the losing attempt reverts its own winning
+      // claims — a compensating add restores exactly what it subtracted — and
+      // re-reads. Without the guard, two concurrent consumes of the same SKU
+      // both debit the same front layer(s) from a stale snapshot, driving
+      // quantity_remaining negative and misstating COGS.
+      var MAX_CLAIM_ATTEMPTS = 8;
+      var consumed, totalCogs, currency;
+      var attributionTs = requested;
+
+      for (var attempt = 1; ; attempt += 1) {
       var layers = await _activeLayers(sku, direction);
 
       // Pre-flight: confirm on-hand >= requested. No partial
@@ -403,7 +418,7 @@ function create(opts) {
       // same currency. Mixed currencies are refused at the primitive
       // layer (the operator reconciles via a manual receipt rather
       // than getting a mysteriously-FX-blended COGS row).
-      var currency = layers[0].currency;
+      currency = layers[0].currency;
       for (var c = 1; c < layers.length; c += 1) {
         if (layers[c].currency !== currency) {
           throw new TypeError("cost-layers.consumeForSale: layers for sku " +
@@ -412,14 +427,11 @@ function create(opts) {
         }
       }
 
-      // The sale's `occurred_at` is the operator-supplied timestamp
-      // (defaulting to now when omitted). `cogsForPeriod` filters
-      // attribution rows by this column — using the sale time, not
-      // the wall-clock at write time, keeps backfilled imports
-      // accurate.
-      var consumed = [];
-      var totalCogs = 0;
-      var attributionTs = requested;
+      // Build the debit PLAN for this attempt without writing anything.
+      // Each entry: { layer_id, take, attrs: [{ qty, unit_cost_minor }] }.
+      // `planCogs` is the line's total COGS in minor units.
+      var plan = [];
+      var planCogs = 0;
 
       if (method === "weighted_average") {
         // Compute weighted-average unit cost in minor units. Round
@@ -493,11 +505,6 @@ function create(opts) {
             if (attrCogs > residual) attrCogs = residual;
             residual -= attrCogs;
           }
-          // Debit the layer by the full consumed quantity (one update).
-          await query(
-            "UPDATE cost_layers SET quantity_remaining = quantity_remaining - ?1 WHERE id = ?2",
-            [dRow.qty, dRow.layer.id],
-          );
           // Attribute the debit's cost so `qty * unit_cost_minor` summed over
           // its attribution rows reconstructs attrCogs EXACTLY — the COGS
           // reports (cogsForOrder / cogsForPeriod) recover each line's cost
@@ -513,60 +520,90 @@ function create(opts) {
           var floorUnit = dRow.qty > 0 ? Math.floor(attrCogs / dRow.qty) : avgUnitCost;
           var rem       = dRow.qty > 0 ? attrCogs - (floorUnit * dRow.qty) : 0;
           var parts = [];
-          if (dRow.qty - rem > 0) parts.push({ qty: dRow.qty - rem, unit: floorUnit });
-          if (rem > 0)            parts.push({ qty: rem,            unit: floorUnit + 1 });
-          for (var p = 0; p < parts.length; p += 1) {
-            var attrId = b.uuid.v7();
-            await query(
-              "INSERT INTO cogs_attributions " +
-              "(id, order_id, line_id, sku, layer_id, qty, unit_cost_minor, " +
-              "currency, reversed, reversal_reason, occurred_at) " +
-              "VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 0, NULL, ?9)",
-              [attrId, orderId, lineId, sku, dRow.layer.id, parts[p].qty, parts[p].unit, currency, attributionTs],
-            );
-            consumed.push({
-              layer_id:        dRow.layer.id,
-              qty:             parts[p].qty,
-              unit_cost_minor: parts[p].unit,
-            });
-          }
-          totalCogs += attrCogs;
+          if (dRow.qty - rem > 0) parts.push({ qty: dRow.qty - rem, unit_cost_minor: floorUnit });
+          if (rem > 0)            parts.push({ qty: rem,            unit_cost_minor: floorUnit + 1 });
+          plan.push({ layer_id: dRow.layer.id, take: dRow.qty, attrs: parts });
         }
-        // Edge case: residual unspent (impossible given the math
-        // above, but defensive). Push it onto the last attribution.
-        if (residual !== 0 && consumed.length) {
-          totalCogs += residual;
-        }
-        totalCogs = lineCogs;
+        planCogs = lineCogs;
       } else {
-        // FIFO / LIFO: walk layers in order, debit each one until
-        // the requested quantity is satisfied.
+        // FIFO / LIFO: walk layers in order, planning a debit against each
+        // one until the requested quantity is satisfied.
         var remaining = quantity;
         for (var f = 0; f < layers.length && remaining > 0; f += 1) {
           var lay = layers[f];
           var take = lay.quantity_remaining;
           if (take > remaining) take = remaining;
+          plan.push({
+            layer_id: lay.id,
+            take:     take,
+            attrs:    [{ qty: take, unit_cost_minor: lay.unit_cost_minor }],
+          });
+          planCogs += take * lay.unit_cost_minor;
+          remaining -= take;
+        }
+      }
+
+      // Claim every planned layer atomically. A guarded decrement loses (0
+      // rows) when a concurrent consumer has drawn the layer below `take`
+      // since this attempt's snapshot was read.
+      var claimed = [];
+      var lostClaim = false;
+      for (var g = 0; g < plan.length; g += 1) {
+        var claimRes = await query(
+          "UPDATE cost_layers SET quantity_remaining = quantity_remaining - ?1 " +
+          "WHERE id = ?2 AND quantity_remaining >= ?1",
+          [plan[g].take, plan[g].layer_id],
+        );
+        if (b.sql.casWon(claimRes).won) {
+          claimed.push(plan[g]);
+        } else {
+          lostClaim = true;
+          break;
+        }
+      }
+
+      if (lostClaim) {
+        // Revert this attempt's winning claims — a compensating add restores
+        // exactly what was subtracted — then re-read the layers and re-plan.
+        for (var rv = 0; rv < claimed.length; rv += 1) {
           await query(
-            "UPDATE cost_layers SET quantity_remaining = quantity_remaining - ?1 WHERE id = ?2",
-            [take, lay.id],
+            "UPDATE cost_layers SET quantity_remaining = quantity_remaining + ?1 WHERE id = ?2",
+            [claimed[rv].take, claimed[rv].layer_id],
           );
-          var attrIdF = b.uuid.v7();
+        }
+        if (attempt >= MAX_CLAIM_ATTEMPTS) {
+          throw new Error("cost-layers.consumeForSale: layer contention on sku " +
+            JSON.stringify(sku) + " — claim retries exhausted after " + attempt + " attempts");
+        }
+        continue;
+      }
+
+      // Every planned layer was claimed — persist the attribution rows. The
+      // row set (layer / qty / unit_cost_minor) is identical to the pre-fix
+      // interleaved write; only the ordering (claim-all, then insert-all)
+      // changed so a lost mid-plan claim reverts cleanly with no orphan rows.
+      consumed = [];
+      totalCogs = planCogs;
+      for (var pj = 0; pj < plan.length; pj += 1) {
+        for (var pa = 0; pa < plan[pj].attrs.length; pa += 1) {
+          var attrRow   = plan[pj].attrs[pa];
+          var attrRowId = b.uuid.v7();
           await query(
             "INSERT INTO cogs_attributions " +
             "(id, order_id, line_id, sku, layer_id, qty, unit_cost_minor, " +
             "currency, reversed, reversal_reason, occurred_at) " +
             "VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, 0, NULL, ?9)",
-            [attrIdF, orderId, lineId, sku, lay.id, take, lay.unit_cost_minor, currency, attributionTs],
+            [attrRowId, orderId, lineId, sku, plan[pj].layer_id, attrRow.qty, attrRow.unit_cost_minor, currency, attributionTs],
           );
           consumed.push({
-            layer_id:        lay.id,
-            qty:             take,
-            unit_cost_minor: lay.unit_cost_minor,
+            layer_id:        plan[pj].layer_id,
+            qty:             attrRow.qty,
+            unit_cost_minor: attrRow.unit_cost_minor,
           });
-          totalCogs += take * lay.unit_cost_minor;
-          remaining -= take;
         }
       }
+      break;
+      } // end bounded claim-retry loop
 
       return {
         consumed_layers:   consumed,

package/lib/plan-changes.js

@@ -635,6 +635,20 @@ function create(opts) {
           periodEnd:      sub.current_period_end,
           planChangeId:   id,
         });
+      } else {
+        // Lost the transition claim — a concurrent executeChange (double-submit
+        // or retry) already flipped this subscription's plan. This row was
+        // inserted 'executed' before the claim, but no plan moved, no credit
+        // was issued, and no invoice was recorded under it. Void it rather than
+        // leave a phantom 'executed' history row that carries money columns yet
+        // reflects nothing — a naive revenue rollup
+        // (SUM(first_charge_minor) WHERE status='executed') would double-count
+        // it. Mirrors the stripe-push-failed / credit-settlement-failed voids.
+        await query(
+          "UPDATE subscription_plan_changes SET status = 'cancelled', cancelled_at = ?1, " +
+          "cancel_reason = ?2 WHERE id = ?3",
+          [_now(), "transition-lost", id],
+        );
       }
 
       return await _getById(id);

package/lib/storefront.js

@@ -59,6 +59,25 @@ var _localeAls = new AsyncLocalStorage();
 // the client only ever sees a generic message + the correlating id.
 var _log = b.log.create({});
 
+// Same-origin redirect-target guard shared by every post-action redirect
+// (return_to / redirect_to / next). Delegates to the framework open-redirect
+// (CWE-601) primitive rather than a hand-rolled path regex: it rejects
+// protocol-relative targets ("//host", "\\host"), refuses full URLs (no
+// base/allowlist is passed, so only same-origin relatives survive), and
+// rejects EVERY control char including a horizontal TAB. A hand-rolled
+// `/^\/[^/]/` guard misses the TAB: a user agent strips ASCII TAB/CR/LF from
+// a URL before resolving it, so a `Location: /\t/evil.example` collapses to
+// the protocol-relative `//evil.example` and navigates off-origin. Returns
+// the safe same-origin path (query/fragment preserved) or `fallback` — pass
+// "" as the fallback to use it as an accepted/rejected sentinel.
+function _sameOriginRedirect(raw, fallback) {
+  var fb = typeof fallback === "string" ? fallback : "/";
+  // A pathological over-length target (header bloat) falls back before the
+  // primitive even parses it.
+  if (typeof raw === "string" && raw.length > 2048) return fb;
+  return b.safeRedirect.resolve(raw, { fallback: fb });
+}
+
 // Generic 500 for an auth/ceremony route: log the real error server-side
 // (correlated by the framework request id) and return a fixed message to
 // the client so no internal error string (stack frame, DB column, vault
@@ -12485,10 +12504,7 @@ function mount(router, deps) {
     router.post("/announcements/:slug/dismiss", async function (req, res) {
       var slug = (req.params && typeof req.params.slug === "string") ? req.params.slug : "";
       var body = req.body || {};
-      var to = (typeof body.return_to === "string") ? body.return_to : "/";
-      if (to.charAt(0) !== "/" || to.charAt(1) === "/" || to.indexOf("\\") !== -1 || /[\x00-\x1f\x7f]/.test(to)) {
-        to = "/";
-      }
+      var to = _sameOriginRedirect(body.return_to, "/");
       if (/^[a-z0-9-]{1,64}$/.test(slug)) {
         // Durable record (best-effort — keyed on the cart session id; absent
         // a session the cookie still carries the dismissal for this browser).
@@ -13125,13 +13141,9 @@ function mount(router, deps) {
   // setting a cookie, so a hostile link can't 500 the route.
   router.get("/locale", function (req, res) {
     var q = req.query || {};
-    var to = (typeof q.to === "string") ? q.to : "/";
-    // Same-origin path only: must start with a single "/" (not "//" — a
-    // protocol-relative URL — and not a scheme). Anything else falls
-    // back to the home path.
-    if (to.charAt(0) !== "/" || to.charAt(1) === "/" || to.indexOf("\\") !== -1 || /[\x00-\x1f\x7f]/.test(to)) {
-      to = "/";
-    }
+    // Same-origin path only (rejects protocol-relative "//", backslash, and
+    // control chars including TAB); anything else falls back to home.
+    var to = _sameOriginRedirect(q.to, "/");
     var lang = (typeof q.lang === "string") ? q.lang : "";
     if (lang && LOCALE_COOKIE_RE.test(lang) && lang.length <= LOCALE_COOKIE_MAX && supportedTags.indexOf(lang) !== -1) {
       _setLocaleCookie(res, lang);
@@ -13898,7 +13910,7 @@ function mount(router, deps) {
       // slash, no scheme / host / protocol-relative `//`) so the switcher
       // can't be turned into an open redirect.
       var rawTo = typeof body.redirect_to === "string" ? body.redirect_to : "/";
-      var to = (/^\/(?!\/)/.test(rawTo)) ? rawTo : "/";
+      var to = _sameOriginRedirect(rawTo, "/");
       if (chosen === _ccyBase || _ccyOptions.indexOf(chosen) === -1) {
         _clearCurrencyCookie(res);
       } else {
@@ -14445,7 +14457,8 @@ function mount(router, deps) {
       // failure still lands the shopper somewhere sane.
       var rt = (req.body || {}).return_to;
       var dest = null;
-      if (typeof rt === "string" && /^\/[^/]/.test(rt)) dest = rt;
+      var safeRt = _sameOriginRedirect(rt, "");
+      if (safeRt) dest = safeRt;
 
       var notice;
       try {
@@ -17801,10 +17814,11 @@ function mount(router, deps) {
         var okKind = removed ? "removed" : "added";
         var rt = (req.body || {}).return_to;
         var dest;
-        if (typeof rt === "string" && /^\/[^/]/.test(rt)) {
+        var safeRt = _sameOriginRedirect(rt, "");
+        if (safeRt) {
           // Only thread the success marker when returning to the wishlist
           // page (the PDP heart toggle is its own visible cue).
-          dest = rt.indexOf("/account/wishlist") === 0 ? "/account/wishlist?ok=" + okKind : rt;
+          dest = safeRt.indexOf("/account/wishlist") === 0 ? "/account/wishlist?ok=" + okKind : safeRt;
         } else {
           var product = null;
           try { product = await deps.catalog.products.get(productId); } catch (_e) { product = null; }
@@ -22131,8 +22145,7 @@ function mount(router, deps) {
   // refused), capping length defensively. Anything else collapses to the
   // safe default the caller passes.
   function _consentReturnTo(raw, fallback) {
-    if (typeof raw === "string" && raw.length <= 512 && /^\/[^/]/.test(raw)) return raw;
-    return fallback;
+    return _sameOriginRedirect(raw, fallback);
   }
 
   // Translate a posted choice + per-category checkboxes into the four

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.16.2",
-      "tag": "v0.16.2",
+      "version": "0.16.3",
+      "tag": "v0.16.3",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",
@@ -838,6 +838,7 @@
         "release-notes/v0.16.0.json": "lib/vendor/blamejs/release-notes/v0.16.0.json",
         "release-notes/v0.16.1.json": "lib/vendor/blamejs/release-notes/v0.16.1.json",
         "release-notes/v0.16.2.json": "lib/vendor/blamejs/release-notes/v0.16.2.json",
+        "release-notes/v0.16.3.json": "lib/vendor/blamejs/release-notes/v0.16.3.json",
         "release-notes/v0.2.x.json": "lib/vendor/blamejs/release-notes/v0.2.x.json",
         "release-notes/v0.3.x.json": "lib/vendor/blamejs/release-notes/v0.3.x.json",
         "release-notes/v0.4.x.json": "lib/vendor/blamejs/release-notes/v0.4.x.json",
@@ -1100,6 +1101,7 @@
         "test/layer-0-primitives/config-drift.test.js": "lib/vendor/blamejs/test/layer-0-primitives/config-drift.test.js",
         "test/layer-0-primitives/config.test.js": "lib/vendor/blamejs/test/layer-0-primitives/config.test.js",
         "test/layer-0-primitives/consent-purposes.test.js": "lib/vendor/blamejs/test/layer-0-primitives/consent-purposes.test.js",
+        "test/layer-0-primitives/content-credentials-coverage.test.js": "lib/vendor/blamejs/test/layer-0-primitives/content-credentials-coverage.test.js",
         "test/layer-0-primitives/content-credentials.test.js": "lib/vendor/blamejs/test/layer-0-primitives/content-credentials.test.js",
         "test/layer-0-primitives/content-digest.test.js": "lib/vendor/blamejs/test/layer-0-primitives/content-digest.test.js",
         "test/layer-0-primitives/cors.test.js": "lib/vendor/blamejs/test/layer-0-primitives/cors.test.js",
@@ -1132,6 +1134,7 @@
         "test/layer-0-primitives/csrf-protect.test.js": "lib/vendor/blamejs/test/layer-0-primitives/csrf-protect.test.js",
         "test/layer-0-primitives/csv.test.js": "lib/vendor/blamejs/test/layer-0-primitives/csv.test.js",
         "test/layer-0-primitives/cwt.test.js": "lib/vendor/blamejs/test/layer-0-primitives/cwt.test.js",
+        "test/layer-0-primitives/cycle2-bugfixes.test.js": "lib/vendor/blamejs/test/layer-0-primitives/cycle2-bugfixes.test.js",
         "test/layer-0-primitives/daemon.test.js": "lib/vendor/blamejs/test/layer-0-primitives/daemon.test.js",
         "test/layer-0-primitives/daily-byte-quota.test.js": "lib/vendor/blamejs/test/layer-0-primitives/daily-byte-quota.test.js",
         "test/layer-0-primitives/dane.test.js": "lib/vendor/blamejs/test/layer-0-primitives/dane.test.js",
@@ -1235,6 +1238,7 @@
         "test/layer-0-primitives/guard-saga-config.test.js": "lib/vendor/blamejs/test/layer-0-primitives/guard-saga-config.test.js",
         "test/layer-0-primitives/guard-smtp-command.test.js": "lib/vendor/blamejs/test/layer-0-primitives/guard-smtp-command.test.js",
         "test/layer-0-primitives/guard-snapshot-envelope.test.js": "lib/vendor/blamejs/test/layer-0-primitives/guard-snapshot-envelope.test.js",
+        "test/layer-0-primitives/guard-sql-coverage.test.js": "lib/vendor/blamejs/test/layer-0-primitives/guard-sql-coverage.test.js",
         "test/layer-0-primitives/guard-stream-args.test.js": "lib/vendor/blamejs/test/layer-0-primitives/guard-stream-args.test.js",
         "test/layer-0-primitives/guard-svg.test.js": "lib/vendor/blamejs/test/layer-0-primitives/guard-svg.test.js",
         "test/layer-0-primitives/guard-tenant-id.test.js": "lib/vendor/blamejs/test/layer-0-primitives/guard-tenant-id.test.js",
@@ -1324,12 +1328,15 @@
         "test/layer-0-primitives/mail-store.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mail-store.test.js",
         "test/layer-0-primitives/mail-unsubscribe.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mail-unsubscribe.test.js",
         "test/layer-0-primitives/mail.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mail.test.js",
+        "test/layer-0-primitives/mcp-coverage.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mcp-coverage.test.js",
         "test/layer-0-primitives/mcp-tool-registry.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mcp-tool-registry.test.js",
         "test/layer-0-primitives/mcp.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mcp.test.js",
         "test/layer-0-primitives/mdoc.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mdoc.test.js",
+        "test/layer-0-primitives/metrics-coverage.test.js": "lib/vendor/blamejs/test/layer-0-primitives/metrics-coverage.test.js",
         "test/layer-0-primitives/metrics-shadow-registry.test.js": "lib/vendor/blamejs/test/layer-0-primitives/metrics-shadow-registry.test.js",
         "test/layer-0-primitives/metrics-snapshot.test.js": "lib/vendor/blamejs/test/layer-0-primitives/metrics-snapshot.test.js",
         "test/layer-0-primitives/middleware-compose-pipeline.test.js": "lib/vendor/blamejs/test/layer-0-primitives/middleware-compose-pipeline.test.js",
+        "test/layer-0-primitives/middleware-tus-upload-coverage.test.js": "lib/vendor/blamejs/test/layer-0-primitives/middleware-tus-upload-coverage.test.js",
         "test/layer-0-primitives/mime-parse.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mime-parse.test.js",
         "test/layer-0-primitives/money.test.js": "lib/vendor/blamejs/test/layer-0-primitives/money.test.js",
         "test/layer-0-primitives/mtls-ca-paths.test.js": "lib/vendor/blamejs/test/layer-0-primitives/mtls-ca-paths.test.js",
@@ -1367,6 +1374,7 @@
         "test/layer-0-primitives/output-header-hardening.test.js": "lib/vendor/blamejs/test/layer-0-primitives/output-header-hardening.test.js",
         "test/layer-0-primitives/pagination.test.js": "lib/vendor/blamejs/test/layer-0-primitives/pagination.test.js",
         "test/layer-0-primitives/parser-verify-hardening.test.js": "lib/vendor/blamejs/test/layer-0-primitives/parser-verify-hardening.test.js",
+        "test/layer-0-primitives/parsers-safe-yaml-coverage.test.js": "lib/vendor/blamejs/test/layer-0-primitives/parsers-safe-yaml-coverage.test.js",
         "test/layer-0-primitives/parsers-standalone.test.js": "lib/vendor/blamejs/test/layer-0-primitives/parsers-standalone.test.js",
         "test/layer-0-primitives/passkey-real-vectors.test.js": "lib/vendor/blamejs/test/layer-0-primitives/passkey-real-vectors.test.js",
         "test/layer-0-primitives/passkey.test.js": "lib/vendor/blamejs/test/layer-0-primitives/passkey.test.js",
@@ -1552,7 +1560,7 @@
         ".github/workflows/ci.yml": "sha256:c9cd093403b410d14f6cf61bfc864b8862cc0d8f5c8dbf01a979881a4204fe83",
         ".github/workflows/codeql.yml": "sha256:9622f111e4da9028dc94507fe5a7c9ee4cd19dfcfbffeed1edbefde284133fea",
         ".github/workflows/npm-publish.yml": "sha256:cac26b6d72101e882a59d8d25fb6977973e1f8d67c87b491297712fca479b93d",
-        ".github/workflows/release-container.yml": "sha256:17ccd9081d26e69d258efeb37ba135e68949b7d4e1f4444697071ac57ccee75e",
+        ".github/workflows/release-container.yml": "sha256:89c6722c30f1a69f2367086f46eeb213fe384f0aa44a44e81f64866f4c19a6e2",
         ".github/workflows/scorecard.yml": "sha256:8a3a8a25eafe6e7c965983fe550a3e7a945386a5e9e88341c801b10b504d94be",
         ".github/workflows/sha-to-tag-verify.yml": "sha256:6ed546bdb518514c79a69aa9afe87c92903a8663afb57d4d07b5e81fbda8b844",
         ".github/zizmor.yml": "sha256:fe08e66c5763dfb4edf1ea33e715f04e514b1baceb3a242241d8a60793db51d2",
@@ -1562,7 +1570,7 @@
         ".npmrc": "sha256:66f104e7d07c496d2d0409988225e8c0e4ceb8d247dbcac3be75b2128d20ce66",
         ".pinact.yaml": "sha256:0213ffda55961dc49b64c0a5dfa3c0567419633b1499d57eaf7c8d842d7da6c7",
         "ARCHITECTURE.md": "sha256:9b1c8d2b1b7a41838eb348b0a008e4b4369718fd72bfe2974b37155f7536d35b",
-        "CHANGELOG.md": "sha256:62fb356e0451a9500a2e74e1cfc49bdfacf99c579c0ead43b9282f22603c736c",
+        "CHANGELOG.md": "sha256:4fa997c021b50ee725c66753a8ee6ea86b26fa4233101dd9070d5702b1adaed9",
         "CODE_OF_CONDUCT.md": "sha256:148a281960fff7c2fe6554dab66da572c72245ddeb00b0d14811558397bff386",
         "CONTRIBUTING.md": "sha256:3e4575c3cd57e72317773a80faabcabb611133ace5ee523db4b8d631e80bdaa8",
         "GOVERNANCE.md": "sha256:906df6afb1f552b27b9acb50f7f96c47b917a2f1021cd4e987dbf4ee0e0a821b",
@@ -1573,7 +1581,7 @@
         "README.md": "sha256:e1c6d401d81c959a0f264d73b3640a26465921f0ceb1103be6936816d99d21b4",
         "ROADMAP.md": "sha256:d66be1de21603794608395c57ecc17381b673452ea74159bd805c85684821ecd",
         "SECURITY.md": "sha256:e47271ef5094205c0ce38c10c8674c42a59b7210311f0e27ecc028c7a387c2cc",
-        "api-snapshot.json": "sha256:626f0081f7985e9d85b9135eec545a12aeb950c9e7983e706b9dc24488057a55",
+        "api-snapshot.json": "sha256:765b6929a2fde973e67fb49fd49942d4053eabd6e858b0b5f3942cf06e3400ec",
         "assets/BlameJS_Logo.png": "sha256:3c65699753c771b48ef9ac7f45bb40815ec19a23afcdd0cd30ef4601bbbe293e",
         "assets/BlameJS_Logo.svg": "sha256:dda44f3fb1343d5de9db6b1fcdb75fc649c57e7a99a8e8239fcf852e3841e1a8",
         "bench/README.md": "sha256:74202f2507fd840bfc1ac6c681975d9273cf36cca6e0f72655f138337304033c",
@@ -1632,7 +1640,7 @@
         "examples/wiki/lib/source-doc-parser.js": "sha256:e39a1701dbe6940987b11e9318e535039e8a5d1dbc67ba7b7e6bac4ef87ef638",
         "examples/wiki/lib/symbol-index.js": "sha256:abd133b4aa8e582cf72b7c92fafe7f342b2d06d1a9f3d1082eb0c4df8a743b0e",
         "examples/wiki/migrations/0001-pages-schema.js": "sha256:b4459ee6d1d4f1130dbf0c7a22b39ffa0f972a7ca3a0ef19215abe4bf35e46a5",
-        "examples/wiki/package-lock.json": "sha256:66cf7211967af7f63784a84db80287b63a7ccd4db69fdc400af16986753f459e",
+        "examples/wiki/package-lock.json": "sha256:ceb2632eea43f0b167da990fee70ae16dbd24577673c0f5e0f9c3c0781ce1170",
         "examples/wiki/package.json": "sha256:8efb9ee3012107f9631ce23e7846ff2b10cadf643ec449e7940de496728aaedb",
         "examples/wiki/public/img/blamejs-logo.png": "sha256:3c65699753c771b48ef9ac7f45bb40815ec19a23afcdd0cd30ef4601bbbe293e",
         "examples/wiki/public/img/blamejs-logo.svg": "sha256:dda44f3fb1343d5de9db6b1fcdb75fc649c57e7a99a8e8239fcf852e3841e1a8",
@@ -1904,7 +1912,7 @@
         "lib/config.js": "sha256:7f28de45331b39de8bb3b9281ef0641c4b3fdf928088a22fdb51ecac2a1c21d7",
         "lib/consent.js": "sha256:0eb93f281d05ac35895cd1e0b8bf7c0cf121bf6c72901f844b52028c6bd3a14c",
         "lib/constants.js": "sha256:31897caa2604b53c5365e9e054373b29c753c226beefd3a47e515a9f441c105c",
-        "lib/content-credentials.js": "sha256:d548860bb5c658698509c7245df8e6c117a855bfdd2f43a1566c1eb3f2a333ce",
+        "lib/content-credentials.js": "sha256:df200fe8945fcbf4783c81a52b552dc9fc5630fdc4674275a1521f88175bbeb8",
         "lib/content-digest.js": "sha256:ae9052c1d3f54a314c3d25b2e45a173459efc12a470b5b632b8c31db0e89c5ff",
         "lib/cookies.js": "sha256:5230ca525e8d618a0cb9df607235b5fd194b2138915e8089dc4ea3824aa92675",
         "lib/cose.js": "sha256:89c8672c0a5a019bc70e7889f4441a8ba6a6a3a52d288f0515199982046810cc",
@@ -2014,7 +2022,7 @@
         "lib/guard-shell.js": "sha256:bc866a05afba17004ce5ce7497d884d0a59fbec3aa8b81c76840eeddd2c3b9a3",
         "lib/guard-smtp-command.js": "sha256:a761c4f5d5d8f5083339e095dca2ede035330b760735bcf76693b9e6484ab4ae",
         "lib/guard-snapshot-envelope.js": "sha256:13eab8a92ef38c9d0a58adf30844a0a41030e9d0b67e447480a2d21c6db052ff",
-        "lib/guard-sql.js": "sha256:1f2a18e1f7e603377d898900eef0636d49f2a6c2f7a2d8fd746982e5b25c201f",
+        "lib/guard-sql.js": "sha256:fef254470a15a7b9be78300c8fa86d5dd26ae88f654f5230f5f3051597f6f108",
         "lib/guard-stream-args.js": "sha256:3d20d6a57639c38fb406b40540d4bd738387ec2f1eca3e63c3a586a75527e61a",
         "lib/guard-svg.js": "sha256:c9fbca850273d43fddaf6232949b963fbe48cfa73068540fb30aee8ce8d6f017",
         "lib/guard-template.js": "sha256:861a566fd25a7abaf541c0e7875f8dc30ae5b34832ee81ee37f1ee26ae96b58b",
@@ -2107,9 +2115,9 @@
         "lib/markup-escape.js": "sha256:7cb287780b9bb8a5ab37b1f8c36427df432331def15e2ef4d63c4b29809357ee",
         "lib/markup-tokenizer.js": "sha256:b02048184fb1a55e410cdf15049935b3f1ab4895c595b0bd2a6589bcdab9f87e",
         "lib/mcp-tool-registry.js": "sha256:57722b488a0977704997acbb61d2fad13155040007516f996b6b574c64d482ee",
-        "lib/mcp.js": "sha256:d914512443b33bbe047f68e1ae5358ac5b9a1b25f6801f2bc360adbea1b857dc",
+        "lib/mcp.js": "sha256:d0d40b1ee3cc4d66d249f6ad15ba5e1bdb0db66c689a940206c25a1d51a2c694",
         "lib/mdoc.js": "sha256:536d6ad327e15f11f3279781f93a779bffeddfec06222b0e601728f905561d21",
-        "lib/metrics.js": "sha256:f0f677ac7b2c82ab89059ed2d1bbe580a84bea0e93f6ae37990314a123a3e503",
+        "lib/metrics.js": "sha256:f12e30587a8a2c7f74be480dbb7c8f5e11a8e2ddca644cb88a225367168b241e",
         "lib/middleware/age-gate.js": "sha256:ef9113093151494eca51bbcd60bd334aa2e8865969e2f3ad34cc6d8ce180fc25",
         "lib/middleware/ai-act-disclosure.js": "sha256:e6f5bb9aab37bcec5ecef2ec5b3688ed0eb069eb61279d297e1ddd8460bc4568",
         "lib/middleware/api-encrypt.js": "sha256:48c59f52ffc9b05e38c58e193e2df743b62c3f80ac61336bf2c4abade18437a7",
@@ -2164,7 +2172,7 @@
         "lib/middleware/sse.js": "sha256:5bf672e6a9f2988719b820ed8d67bda34b9b7a4d54d170620614ed24bc688bfc",
         "lib/middleware/trace-log-correlation.js": "sha256:abf2339adddc2a2b3f61b26e9c1cb6ebffae5fc02ca51bf9ee002df99dfe622f",
         "lib/middleware/trace-propagate.js": "sha256:ddfebd2947bca77be6023fd4833bd80f8d03bef7ca2d63c7fc27f447108cd451",
-        "lib/middleware/tus-upload.js": "sha256:bc9a7d002f36b3d121d606e4b2f1b683461f003f6d33f6e3f44c5c99d10effac",
+        "lib/middleware/tus-upload.js": "sha256:0e85b893fdd1e081a3d32fd6a1e47ddf56730c7e855c670b1dfdb50ed7dd6e46",
         "lib/middleware/web-app-manifest.js": "sha256:d2e50696b4c49d4a089a79b7514fb89fe4c765b9e7edfd9bc7e0e3bf31ca1d23",
         "lib/migration-files.js": "sha256:6381dd46fdcb5796ac094ec9353ce6c4996d56f826f70bc4939349b934a7cef1",
         "lib/migrations.js": "sha256:229a067f388db89d74d7f1c6b2a5b4c48840966bf90d918fc786f489995e4b83",
@@ -2218,7 +2226,7 @@
         "lib/parsers/safe-ini.js": "sha256:58287b28aa6f0dbeb0f45526e671790a8647b3b3e4c78ae8961042e11ff22ae9",
         "lib/parsers/safe-toml.js": "sha256:148e874454ae1ed6f882f450b38e08e6b73b64b100b499b5eaa739c0fd8064be",
         "lib/parsers/safe-xml.js": "sha256:82a3bb0c0e08d7437c478d74a50b7ba949a2e090c8e4600f5f18c69de681a48a",
-        "lib/parsers/safe-yaml.js": "sha256:47702d747136220b2edaae310274b328c589d32cdf27c651f8f107742179e23e",
+        "lib/parsers/safe-yaml.js": "sha256:bb91ee487c4599333d7d87ed2aa670bea939ed776108eed5f8e92093e2d36353",
         "lib/permissions.js": "sha256:c18f53a53c4e9b0c9a212bc39703000ea844a7beb407d19f82455bb1d4a48cdf",
         "lib/pick.js": "sha256:7e4f5aca12ed39311afbb71885332884cb7fbaeb02dd9a2d6ecf9cb53dba1b57",
         "lib/pipl-cn.js": "sha256:4855a8653ef6c91fc2dec0a1c997ac7ba4d38ec737add5f77a5733ee2d56b1b2",
@@ -2254,7 +2262,7 @@
         "lib/router.js": "sha256:1225dbe9a51d846bbfdaa29041b19675b4d0c01084b70e9ae795026c0b382651",
         "lib/safe-archive.js": "sha256:43a81f432e1cf9f294cbcf60636514cf2a5f3c67ec8e36aa8f8521c4cc657d39",
         "lib/safe-async.js": "sha256:4095c238c1fb0ca788946c757aea2371d832648865ef1810bd2f3a95dbe30bf4",
-        "lib/safe-buffer.js": "sha256:99f64bc544a46037cc43fe3faadd81e2757e039dade46469f3d274591c8434c3",
+        "lib/safe-buffer.js": "sha256:881cf46b90f17f0e36d360a627aa4d10b9d9928472fd2254ae8ddff7bdf49789",
         "lib/safe-decompress.js": "sha256:f06a4d1e31453a94b6722cbb305111b10d0a683fe36c186a174954f45f4a521a",
         "lib/safe-dns.js": "sha256:e1c2c381bae7fa7e0ee2b84a7f09870b95760a007aa0ae0793679f78982cb902",
         "lib/safe-ical.js": "sha256:ad3cc9810d538aba86fed57b2e4bc79eaa8760bc9ef146dae898b1d496058ea9",
@@ -2348,8 +2356,8 @@
         "oss-fuzz/projects/blamejs/README.md": "sha256:ae13b7bb79ed8d69b1b3276e5562807a0349fb6e6b7d11cf1f683aad1eafdb4b",
         "oss-fuzz/projects/blamejs/build.sh": "sha256:0ced1cf21782c97be7f8d74faf5e27a308b60b2f858836fb5ca3b8c4e939a8f7",
         "oss-fuzz/projects/blamejs/project.yaml": "sha256:59f2cb83aa622325a175b77416fe155be15b70a9c798bd1a78bba05763b1b03d",
-        "package-lock.json": "sha256:a993222d15820ddfccda00518ea1dcc788873a851a8258799dd0995c5b34b1bf",
-        "package.json": "sha256:b82adb1c4fd61687844feeb477960e33787de640bde9680e962152ae2122f838",
+        "package-lock.json": "sha256:e09ec4b072f8f1f38ddb0b59b855e0ca1bca293a9568daa4be3e765dd237047e",
+        "package.json": "sha256:ed80932595218a5a1da1c3f405a1dfc989ab3910f27b39df5f15b601f95225e9",
         "release-notes/v0.0.x.json": "sha256:7a49819f30068ee119000cad7010194882bb8bfaa12acbdab4dfc066efb7982f",
         "release-notes/v0.1.x.json": "sha256:6742a8c17f947c5cb76f69dead7eea86b942d80621d914b774ba5488e09937e5",
         "release-notes/v0.10.x.json": "sha256:fe498045daf88337bd3d987e5964aa42c99a50e1685b6f09e51f698b8687726f",
@@ -2361,6 +2369,7 @@
         "release-notes/v0.16.0.json": "sha256:70def9578a6ae184dfb2f82c2f2b1bda15c4d9b8f987f0047da7f68f06a7e41b",
         "release-notes/v0.16.1.json": "sha256:67f5833cf682266b0ea93d410fdeedfa427e80781532d15e64c7d440dfefa95c",
         "release-notes/v0.16.2.json": "sha256:54d139821c154cffcd5b87b2cad1cff696f1db2af49742a144cd86c3194b3ece",
+        "release-notes/v0.16.3.json": "sha256:0de1e0284e41575b8480d26f99b49d9dea550ef035f5c45e0b1723620d84f49d",
         "release-notes/v0.2.x.json": "sha256:985e27ff5de04cfc7869a3986dd0b9f0fcdfcddfb67d3fae3f4ae70856722d7e",
         "release-notes/v0.3.x.json": "sha256:e2db5eae66977b272bb185cad668386afb8fd33998a17c22eb6e411c0f8ca588",
         "release-notes/v0.4.x.json": "sha256:c3d19cb9c50a976432fc0bb612c87741d8728ae37562b501e6f1eccd01dd574d",
@@ -2623,6 +2632,7 @@
         "test/layer-0-primitives/config-drift.test.js": "sha256:75371225fef23f472e26444e672c7822668e0400407e05652bc73f3a368b97aa",
         "test/layer-0-primitives/config.test.js": "sha256:6adc4278b64f960ea2649779d7048c90ff54dbd849832c088700fbdca150ef94",
         "test/layer-0-primitives/consent-purposes.test.js": "sha256:a1669c7fb9c999ced399a4d93dccf5195008c422f28a669c25a9832f2114ce2d",
+        "test/layer-0-primitives/content-credentials-coverage.test.js": "sha256:81a1942e6306e69159d3da8da97c55e70e3c66d19d8d6ad187e6f2a627e57ddc",
         "test/layer-0-primitives/content-credentials.test.js": "sha256:10014ff2e44cd5185d6c3401cb797db4813c4aa794cd01f07a221953cd4f029f",
         "test/layer-0-primitives/content-digest.test.js": "sha256:7b28731f3806576e04669a62919be1d79df3881b1b80b6eaf7cf101a2aa56c91",
         "test/layer-0-primitives/cors.test.js": "sha256:74b0feee302861b3a6385cf43dfb286b008a10c37794e7074f34236124d924f2",
@@ -2655,6 +2665,7 @@
         "test/layer-0-primitives/csrf-protect.test.js": "sha256:4b7d07492a1f1a218aa8106a387401cd3d6f3b43d3c6833ee4db5386bc2bc712",
         "test/layer-0-primitives/csv.test.js": "sha256:1367035130388f4cf75c9bc03cc88b4d4ac1aca3fb6c62d7a98c34d256f89e7a",
         "test/layer-0-primitives/cwt.test.js": "sha256:2e992ab7445db02581275ae5fd8b38de210e21f38a1594f27942f1bb1f9495e4",
+        "test/layer-0-primitives/cycle2-bugfixes.test.js": "sha256:d23919a13e58a84d61a1a3d2eb95ec6f9d24ab94e3f2221e7002e07438d48341",
         "test/layer-0-primitives/daemon.test.js": "sha256:5e75c56ad03579293561ce8708a4289f2b8967a6b28bec31d5e3138bc49c17b3",
         "test/layer-0-primitives/daily-byte-quota.test.js": "sha256:f8ac102047451f6dd04050096674b739f012117b1845215bf4f1b47df25be72f",
         "test/layer-0-primitives/dane.test.js": "sha256:0fff14dfa609fa04a30f6a5a644288bcfafb3292044797cdc89674e5dc9485e2",
@@ -2758,6 +2769,7 @@
         "test/layer-0-primitives/guard-saga-config.test.js": "sha256:f35eb034a7b53cb7f3219998d546834cfc2b0c7b6af71a5f6d127e59152f8648",
         "test/layer-0-primitives/guard-smtp-command.test.js": "sha256:a31c1f379ff873253e165359ad251a6574b8aff532b6c177e0af1c52caca7702",
         "test/layer-0-primitives/guard-snapshot-envelope.test.js": "sha256:7fb6a0c76febd6576ca47c0712eb8f2db4305e7000fbee1450f98450a58caae9",
+        "test/layer-0-primitives/guard-sql-coverage.test.js": "sha256:8ce355a7ff8b1923090b2f2409a0a0726a418221eb4b901920216f387784ecde",
         "test/layer-0-primitives/guard-stream-args.test.js": "sha256:7c7401b88eccfbd50964d41c826a1f75be3ac3bdb4caa1ac929add180ca01976",
         "test/layer-0-primitives/guard-svg.test.js": "sha256:057b281464de02d03e5e1a5c76a0a7efb23904bbcc7be43095924d6a73e5bbfe",
         "test/layer-0-primitives/guard-tenant-id.test.js": "sha256:4083f32ea58e4b350fd6b40e7ada751e4b213ae4a03b85500505863fb72d800a",
@@ -2847,12 +2859,15 @@
         "test/layer-0-primitives/mail-store.test.js": "sha256:80f98a73baf628158df0bc879ca9f35c4c534e3e5562e2a25fae41b0b5a1bbc1",
         "test/layer-0-primitives/mail-unsubscribe.test.js": "sha256:b745189403f7574e4845c2366a05fcdb9a3fcaf21c6930e2fe53ac94f1d1dec8",
         "test/layer-0-primitives/mail.test.js": "sha256:c83e3d7a9d22ad072104ac6d3c360a2b272f16f364ad8206b5eff7043fe97e48",
+        "test/layer-0-primitives/mcp-coverage.test.js": "sha256:b27f9f19be15c0f5308d1fe88534bd979d4b84439f1a6ecb117bc085cae4626b",
         "test/layer-0-primitives/mcp-tool-registry.test.js": "sha256:57bc395acf4e7bac1bd4385ba6bf3d749ecee20dacd20b97ae1a6ca7b439a201",
         "test/layer-0-primitives/mcp.test.js": "sha256:21d45e7d498b5d7404294709b0031fa1882505ee81681090190aaeeece066a20",
         "test/layer-0-primitives/mdoc.test.js": "sha256:d89818a74820c8729d9c9b6024311468fcc72c3333474a5658f57fa79f514e07",
+        "test/layer-0-primitives/metrics-coverage.test.js": "sha256:1ee32f903567bc9451d7f0257b3fb830a438283e0714c5ee38af37ec5cdeffef",
         "test/layer-0-primitives/metrics-shadow-registry.test.js": "sha256:60e3a71c5ec83f83901a9484db09079d1d8e32768538fb953fd3732ce1c15076",
         "test/layer-0-primitives/metrics-snapshot.test.js": "sha256:57b4686c1d472c07e85ee32ab8f08e7ba9332ccdb1e6000363be87815e4eef32",
         "test/layer-0-primitives/middleware-compose-pipeline.test.js": "sha256:012ccb0976f5fddbc6ef370a7c2dabed7c24a9619e0cfb0ea1532551b40fc0c0",
+        "test/layer-0-primitives/middleware-tus-upload-coverage.test.js": "sha256:c8a54bc3116804a8ca6b7a8d8ddce75de6771af421af531b5c8043918e8bffed",
         "test/layer-0-primitives/mime-parse.test.js": "sha256:d6d843a250c6dccac9c125668de5cb3885bf043a0c24eb176ab871d9cadbe878",
         "test/layer-0-primitives/money.test.js": "sha256:76fb9d1071d72cdf7f26bbd0a69dc5329a5a35f436d52b0a041c30afef602831",
         "test/layer-0-primitives/mtls-ca-paths.test.js": "sha256:e770ce593b1f7c271be6aea5c4245fbda32ba22b66466c9cff9c35b0886262e9",
@@ -2890,6 +2905,7 @@
         "test/layer-0-primitives/output-header-hardening.test.js": "sha256:3c31c56bb1ac63783c40832cf35d0748c801ad7a74e385fc8d46f63ad2907206",
         "test/layer-0-primitives/pagination.test.js": "sha256:19364aa49ce2808b5ab20cc16d59ffe6dc41a2d05ff868cdd83b076f0adb7793",
         "test/layer-0-primitives/parser-verify-hardening.test.js": "sha256:cba2f34efc631efe95c5cc10ffb8af75d4fbd7f8586520149cf6f05b96bede19",
+        "test/layer-0-primitives/parsers-safe-yaml-coverage.test.js": "sha256:5717cc0b7d36264f40f833d3284245c30f09573942218731702450c7f1341633",
         "test/layer-0-primitives/parsers-standalone.test.js": "sha256:21ea49f2722bf595f4d04491f08626dcbee6d1be4241667a33ac6f9450671ef7",
         "test/layer-0-primitives/passkey-real-vectors.test.js": "sha256:5ac058d841807fe15a9d44f823e6cfbcf028efbedd14c3cc7e902eb5e31aaa92",
         "test/layer-0-primitives/passkey.test.js": "sha256:a46e1f12c969efaa3d1fd04bcc248a0d8f80f976f52404cb772683d56091a80d",

package/lib/vendor/blamejs/.github/workflows/release-container.yml

@@ -135,7 +135,7 @@ jobs:
 
       - name: Log in to GHCR
         if: ${{ !inputs.dry_run }}
-        uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4  # v4.3.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -340,7 +340,7 @@ jobs:
       # against a public package, so this is the right shape regardless
       # of visibility.
       - name: Log in to GHCR
-        uses: docker/login-action@c99871dec2022cc055c062a10cc1a1310835ceb4  # v4.3.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}