@blamejs/core 0.18.14 → 0.18.15

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.18.x
 
+- v0.18.15 (2026-08-06) — **Broader offline test coverage across the backup manifest, bundle writer, and backup crypto — and a backup restore-drill test the suite was not actually running.** The backup manifest's detached-signature verification is now under explicit test end to end: every rejection reason, both verifier-dispatch paths, and the expectedFingerprint pin that binds a signature to the key it actually verified under rather than to the fingerprint the signature block claims. The bundle writer's include-list refusals and the backup crypto guards are covered alongside. No behaviour changes to any of them — exercising every path confirmed each already behaves per its documented contract. Separately, the restore-drill test for b.backup.scheduleTest was written in a shape the test runner does not await, so its 24 assertions were never executed by the suite; it now runs, and the runner convention that allows it is enforced by a detector. Running it revealed one real defect: the best-effort final audit checkpoint that db.close() anchors could resume against the database it had just closed and report a failure for work that was never possible. **Changed:** *Verification- and refusal-path tests for the backup manifest, bundle writer, and backup crypto* — b.backupManifest now has explicit tests for the schema guards that had no failing case (an absent encryptedPath, an odd-length hex salt, a signature block missing its algorithm), for the signer-unavailable and signer-threw refusals, and for every reason verifySignature/verifyBytes can return — including both verifier-dispatch paths, so a downstream process that never initialised the signing keypair is covered as well as one that did. The expectedFingerprint pin is driven from both sides: a block that misstates its own fingerprint still verifies when pinned to the real key, and a block signed by a different keypair is refused even when it claims the trusted fingerprint, which is the substitution the pin exists to stop. b.backupBundle.create covers the include-list refusals (an entry with no relativePath, a traversal or drive-letter or data-stream path, a directory named where a file was expected, an unknown blob kind, an absent required file, and a bundle whose every entry was skipped), the isolation of a throwing progress callback, and the three signing postures — unsigned when no signer has been initialised, fatal on any other signer failure, and tolerated only when the caller opts in. b.backupCrypto covers the passphrase, salt, plaintext and associated-data guards, the derived-key length check, and the associated-data binding that refuses a blob presented under a path other than the one it was sealed with. · *The backup restore-drill test now runs as part of the suite* — The restore-drill test for b.backup.scheduleTest invoked its own entry function at the top of the module instead of exporting it. The runner requires each test module and awaits only its exported entry point, so the drill's body ran detached at require time and the runner recorded the file as finished before any of its 24 assertions had executed — a failing assertion would not have failed the suite. The test now exports its entry point and is awaited like every other. b.backup.scheduleTest itself is unchanged; only the test's execution was affected. The runner-contract check that permits this shape has been widened accordingly: it previously matched only an entry function named run, so the same mistake under any other name went undetected. · *Vendored @blamejs/pki refreshed to 0.4.0* — The vendored @blamejs/pki bundle behind the mutual-TLS CA engine is refreshed from 0.3.33 to 0.4.0. The minor is a stability graduation: that toolkit's CRL issuance and verification, PKCS#12 build/open/verify-MAC, attribute-certificate issuance, and key-material lifecycle move from experimental to stable, which changes their support contract rather than their behaviour — the modules the CA engine calls differ only in that declared status. The release's one behavioural change is to the C509 (CBOR-encoded certificate) schema, which adds the compact policy-mappings and policy-constraints value forms and bounds their skip counts; the CA engine does not use C509. No behaviour change to the certificate-authority surface — this is a supply-chain currency refresh. · *Every test file can be run on its own* — Forty-two test files exported their entry point for the runner but never invoked it when executed directly, so running one of them on its own loaded the module and exited without evaluating a single assertion — reporting success while testing nothing. They now invoke their entry point when run directly, and report the number of assertions evaluated. **Fixed:** *The final audit checkpoint no longer reports a failure when its database closes underneath it* — b.db.close() anchors a best-effort final checkpoint of the audit chain without awaiting it — close() is synchronous so callers need not await it across shutdown — and then closes the database handle. Anchoring spans several await points (read the chain tip, read the last checkpoint, sign, insert), so that checkpoint could resume at any of them against the database close() had just torn down, reject, and be logged as "close: final checkpoint failed". Nothing was mis-anchored — the write was already guarded against landing a tip from a database that no longer exists — but the error was reported for work that could never have completed, and because close() only logs it, it surfaced as a stray error attributable to no caller. The attempt is now bound to the database it started on and resolves without an anchor once that database is gone; a failure against a database that is still open is unchanged and still raised. Operators who need a guaranteed-flushed checkpoint should still call b.audit.checkpoint() explicitly before b.db.close(), as before.
+
 - v0.18.14 (2026-08-06) — **Broader offline test coverage across the error-page renderer, the request body parser, and the safe-YAML parser.** Error, edge, and fallback branches of b.errorPage, b.middleware.bodyParser, and b.parsers.yaml are now under explicit test — b.errorPage gains its first dedicated test suite. No behaviour changes: exercising every path confirmed each already behaves per its documented contract. One unreachable duplicate of the multipart parser's per-part reset — dead code that was never called — was removed. The vendored @noble/curves and @blamejs/pki bundles are refreshed. **Changed:** *Error- and edge-path tests for the error-page renderer, request body parser, and safe-YAML parser* — b.errorPage (classification of every recognized error class and the generic-500 fallback, JSON-vs-HTML content negotiation, the development-vs-production render difference, sensitive-header redaction, the write-response fallbacks when the response object lacks writeHead, and the audit record's redaction, outcome, stack-only-for-5xx, and trusted-proxy actor-IP invariants), b.middleware.bodyParser (RFC 5987 filename* decoding, multipart part-header and body framing split across socket reads, disk-mode temp-directory creation failure, repeated-field aggregation, and the request-stream-error refusal), and b.parsers.yaml (numeric-literal overflow falling back to the string form, block- and flow-collection edges, merge-key and duplicate-key refusals, block-scalar header parsing, and the prototype-pollution key guard across every decode path) now have explicit tests for their boundary branches. Alongside the tests, an unreachable duplicate of the multipart parser's per-part reset — a helper that was never called, its logic already performed inline where each part finalizes — was removed. Behaviour is unchanged. · *Vendored @noble/curves refreshed to 2.3.0* — The vendored @noble/curves bundle behind b.crypto.oprf is refreshed from 2.2.0 to 2.3.0. Upstream reworked the oblivious-pseudorandom-function batch path to a shared-doubling multi-scalar multiplication — applied only to values that are public by construction (hash-derived transcript weights, wire-decoded points, and proof scalars) — and now rejects a non-function rng option outright. The verified outputs are unchanged; no blamejs public API changes. · *Vendored @blamejs/pki refreshed to 0.3.33* — The vendored @blamejs/pki bundle behind the mutual-TLS CA engine is refreshed from 0.3.32 to 0.3.33, which adds the compact certificate-policies value form for C509 (CBOR-encoded) certificates and the accompanying certificate-policy and policy-qualifier identifiers to that toolkit's OID registry. The CA engine uses only the toolkit's X.509, PKCS#12, and CRL surfaces, so there is no behaviour change to the certificate-authority surface — this is a supply-chain currency refresh.
 
 - v0.18.13 (2026-08-06) — **`b.db.collection` no longer corrupts a BLOB overflow column (its bytes were spread as numeric keys, destroying the JSON payload); broader offline test coverage across db-collection, TLS, external-db residency, notify, and BIMI.** A schemaless collection with a BLOB overflow column read that column back as a byte array. Because a byte array is a JavaScript object, the collection treated it as an already-parsed overflow object and spread its bytes as numeric keys on read, on update, and on insert — silently destroying the stored JSON payload. The overflow value is now decoded as JSON at every one of those points. The release also closes offline test-coverage gaps and adds an explicit test that the external-database residency boundary is enforced. **Changed:** *Broader offline test coverage and an explicit external-database residency-enforcement test* — b.db.collection (BLOB overflow round-trips, introspection-error wrapping, overflow-as-jsonColumn), b.network.tls.connectWithEch (the connect success, timeout, unreachable-peer, and synchronous-throw paths driven against local servers), b.externalDb (the boot-time data-residency check now has an explicit test that a personal-data backend outside the declared region is refused and compliant backends are admitted), b.notify (the default HTTP client is bound at send time), and b.mail.bimi (a certificate chain deeper than the maximum is rejected) now have tests for these boundary paths. **Fixed:** *b.db.collection no longer corrupts a BLOB overflow column* — A collection configured with an overflow column (unknown fields folded into a JSON column) reads that column back as a byte array when the column is declared BLOB. A byte array's typeof is "object", so the collection took it to be an already-parsed overflow object and spread its raw bytes as numeric-index keys — on read (surfacing { "0": …, "1": … } onto the row), on a $set/$unset update (rewriting the column to the byte spread and destroying the original keys), and on an insert that supplied a Buffer overflow value. The overflow value is now decoded from its bytes as JSON at all three points, so the stored payload survives; a BLOB holding non-JSON bytes falls back to an empty object instead of corrupting, matching the existing non-JSON-string behaviour.

package/NOTICE

@@ -60,7 +60,7 @@ Used for:    WebAuthn / passkey registration + authentication response
              server.cjs).
 --------------------------------------------------------------------------------
 Component:   @blamejs/pki
-Version:     0.3.33
+Version:     0.4.0
 Source:      https://github.com/blamejs/pki
 License:     Apache-2.0
 Copyright:   Copyright (c) blamejs contributors

package/lib/audit.js

@@ -1050,17 +1050,41 @@ function _checkpointPayload(atMonotonicCounter, atRowHash, createdAt) {
  *     console.log("anchored at counter", ckpt.atMonotonicCounter);
  *   }
  */
+// The live db generation, or null when the database is closed or not yet
+// initialized. A checkpoint that resumes after its database went away has to be
+// able to ASK whether that happened without the asking itself throwing.
+function _dbGenerationOrNull() {
+  try { return db()._dbGeneration(); }
+  catch (_e) { return null; }
+}
+
+// Anchor the audit chain tip.
+//
+// db.close() launches this without awaiting it and then tears the handle down
+// synchronously, so a checkpoint can resume at ANY of its awaits — the tip
+// read, the last-checkpoint read, the insert — against a database that no
+// longer exists. Every one of those resumptions is the ordinary end of a
+// best-effort anchor rather than a failure to report: there is no tip left to
+// read and no database to anchor it into, and close() can only log, so a
+// rejection surfaces as a stray error line attributable to no caller.
+//
+// Bind the whole attempt to the database it started on and resolve to null the
+// moment that database is gone. A failure against the database we entered with
+// is genuine and still throws.
 async function checkpoint(opts) {
+  var dbGenAtEntry = _dbGenerationOrNull();
+  try {
+    return await _checkpointOnDatabase(opts, dbGenAtEntry);
+  } catch (e) {
+    if (_dbGenerationOrNull() !== dbGenAtEntry) return null;
+    throw e;
+  }
+}
+
+async function _checkpointOnDatabase(opts, dbGenAtEntry) {
   cluster.requireLeader();
   opts = opts || {};
 
-  // Bind this checkpoint to the database it reads the tip from. checkpoint()
-  // spans async boundaries (tip read → sign → insert); a fire-and-forget call
-  // launched by db.close() can have its insert resume AFTER the database it
-  // read closed and a fresh one opened, anchoring the old tip into the wrong
-  // database. Capture the live db generation now and re-check before the write.
-  var dbGenAtEntry = db()._dbGeneration();
-
   var tipReadBuilt = sql.select("audit_log", _sqlOpts())
     .columns(["_id", "monotonicCounter", "rowHash"])
     .orderBy("monotonicCounter", "desc")
@@ -1093,7 +1117,7 @@ async function checkpoint(opts) {
   // (e.g. a close()-launched checkpoint resuming after a fresh db opened). The
   // tip we signed belongs to a database that is gone; anchoring it into the
   // current one would forge a checkpoint. Write nothing.
-  if (db()._dbGeneration() !== dbGenAtEntry) return null;
+  if (_dbGenerationOrNull() !== dbGenAtEntry) return null;
 
   var ckptId = generateToken(TRACE_ID_BYTES);
   var fencingToken = cluster.fencingToken();

package/lib/vendor/MANIFEST.json

@@ -18,7 +18,7 @@
       "hashes": {
         "server": "sha256:2b30a26f728c5349f4c4b47834f862a4f77393b1224fc12b22abe3ce2cfab78f"
       },
-      "refreshedAt": "2026-08-06T21:56:25.536Z"
+      "refreshedAt": "2026-08-07T00:15:06.175Z"
     },
     "@noble/curves": {
       "version": "2.3.0",
@@ -40,7 +40,7 @@
       "hashes": {
         "server": "sha256:b5fe88d1ea780d0581dee6145d666f89d46fc9531b5db35db2e5b16627840890"
       },
-      "refreshedAt": "2026-08-06T21:56:25.536Z"
+      "refreshedAt": "2026-08-07T00:15:06.175Z"
     },
     "@noble/post-quantum": {
       "version": "0.6.1",
@@ -71,7 +71,7 @@
       "hashes": {
         "server": "sha256:f9c94094b3c10fe73dac5343289da582454ea6053494fab2bf66099d9103d6c3"
       },
-      "refreshedAt": "2026-08-06T21:56:25.536Z"
+      "refreshedAt": "2026-08-07T00:15:06.175Z"
     },
     "@simplewebauthn/server": {
       "version": "13.3.2",
@@ -94,7 +94,7 @@
       "hashes": {
         "server": "sha256:e83195dc9f189385da9c856ef38843f4466f93ea8f3d7fc2efcb1e1b18da6f20"
       },
-      "refreshedAt": "2026-08-06T21:56:25.536Z"
+      "refreshedAt": "2026-08-07T00:15:06.175Z"
     },
     "SecLists-common-passwords-top-10000": {
       "version": "10k-most-common (master)",
@@ -114,7 +114,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-06T21:56:25.536Z"
+      "refreshedAt": "2026-08-07T00:15:06.175Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -139,7 +139,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-06T21:56:25.536Z"
+      "refreshedAt": "2026-08-07T00:15:06.175Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -159,10 +159,10 @@
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-06T21:56:25.536Z"
+      "refreshedAt": "2026-08-07T00:15:06.175Z"
     },
     "@blamejs/pki": {
-      "version": "0.3.33",
+      "version": "0.4.0",
       "license": "Apache-2.0",
       "author": "blamejs",
       "source": "https://github.com/blamejs/pki",
@@ -183,11 +183,11 @@
       },
       "bundler": "esbuild --format=cjs --platform=node --external:crypto --external:node:crypto",
       "bundledAt": "2026-08-06T00:00:00Z",
-      "cpe": "cpe:2.3:a:blamejs:pki:0.3.33:*:*:*:*:node.js:*:*",
+      "cpe": "cpe:2.3:a:blamejs:pki:0.4.0:*:*:*:*:node.js:*:*",
       "hashes": {
-        "server": "sha256:2c297ccbbb48e04306bd6cb681e80f41549fd12267dde9db2a771d55d688745b"
+        "server": "sha256:07acf69f09e6f87f939343d49c23438f56a0a6f0b135ba2880eaa0e712192fd4"
       },
-      "refreshedAt": "2026-08-06T21:56:25.536Z"
+      "refreshedAt": "2026-08-07T00:15:06.175Z"
     }
   }
 }

package/lib/vendor/blamejs-pki.cjs

@@ -1,4 +1,4 @@
-// @blamejs/pki v0.3.33 — vendored (Apache-2.0). Zero-dep pure CJS.
+// @blamejs/pki v0.4.0 — vendored (Apache-2.0). Zero-dep pure CJS.
 // https://github.com/blamejs/pki  Exports: x509, crl, pkcs12, key, webcrypto, schema, csr, cms, ...
 // Backs lib/mtls-engine-default.js (PQC-capable CA + PKCS#12 engine).
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -137,7 +137,7 @@ var require_package = __commonJS({
   "node_modules/@blamejs/pki/package.json"(exports2, module2) {
     module2.exports = {
       name: "@blamejs/pki",
-      version: "0.3.33",
+      version: "0.4.0",
       description: "Pure-JavaScript PKI toolkit that owns its stack \u2014 X.509, ASN.1/DER, CMS, PQC-first.",
       license: "Apache-2.0",
       author: "blamejs contributors",
@@ -7541,6 +7541,8 @@ var require_schema_c509 = __commonJS({
       9: _name("authorityInfoAccess"),
       25: _name("issuerAltName"),
       26: _name("nameConstraints"),
+      27: _name("policyMappings"),
+      28: _name("policyConstraints"),
       29: _name("freshestCRL"),
       30: _name("inhibitAnyPolicy"),
       31: _name("subjectInfoAccess"),
@@ -7563,7 +7565,9 @@ var require_schema_c509 = __commonJS({
       freshestCRL: 1,
       authorityInfoAccess: 1,
       subjectInfoAccess: 1,
-      certificatePolicies: 1
+      certificatePolicies: 1,
+      policyMappings: 1,
+      policyConstraints: 1
     };
     var EKU_BY_INT = {
       0: _name("anyExtendedKeyUsage"),
@@ -7734,6 +7738,9 @@ var require_schema_c509 = __commonJS({
       if (node.majorType !== 0 && node.majorType !== 1) throw _err("c509/bad-extensions", "a " + label + " value must be a CBOR integer");
       return cbor.read.int(node);
     }
+    function _boundCount(value, label) {
+      return guard.range.uint31(value, _err, "c509/bad-extensions", label + " (0..2^31-1)");
+    }
     function _ekuPurposeOid(node) {
       if (node.majorType === 0 || node.majorType === 1) {
         var i = Number(cbor.read.int(node));
@@ -8106,7 +8113,7 @@ var require_schema_c509 = __commonJS({
           var iv = _cborIntVal(node, "basicConstraints");
           if (iv === -2n) return b.sequence([]);
           if (iv === -1n) return b.sequence([b.boolean(true)]);
-          if (iv >= 0n) return b.sequence([b.boolean(true), b.integer(iv)]);
+          if (iv >= 0n) return b.sequence([b.boolean(true), b.integer(_boundCount(iv, "a basicConstraints pathLenConstraint"))]);
           throw _err("c509/bad-extensions", "a basicConstraints int " + iv + " is outside the -2/-1/pathLen range");
         }
         case "authorityKeyIdentifier":
@@ -8136,7 +8143,7 @@ var require_schema_c509 = __commonJS({
           }));
         }
         case "inhibitAnyPolicy":
-          return b.integer(_cborUint(node, "inhibitAnyPolicy"));
+          return b.integer(_boundCount(_cborUint(node, "inhibitAnyPolicy"), "an inhibitAnyPolicy SkipCerts"));
         case "ocspNoCheck":
           if (node.majorType !== 7 || !(Buffer.isBuffer(node.bytes) && node.bytes.length === 1 && node.bytes[0] === 246)) throw _err("c509/bad-extensions", "an ocspNoCheck value must be the CBOR simple value null");
           return b.nullValue();
@@ -8196,6 +8203,22 @@ var require_schema_c509 = __commonJS({
           }
           return b.sequence(polInfos);
         }
+        case "policyMappings": {
+          if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "a policyMappings value must be a CBOR array");
+          var pmKids = node.children;
+          if (pmKids.length === 0 || pmKids.length % 2 !== 0) throw _err("c509/bad-extensions", "a policyMappings array must be non-empty (issuerDomainPolicy, subjectDomainPolicy) pairs (sec. 3.3)");
+          var maps = [];
+          for (var mi = 0; mi + 1 < pmKids.length; mi += 2) maps.push(b.sequence([b.oid(_policyIdToDerOid(pmKids[mi])), b.oid(_policyIdToDerOid(pmKids[mi + 1]))]));
+          return b.sequence(maps);
+        }
+        case "policyConstraints": {
+          if (node.majorType !== 4 || !node.children || node.children.length !== 2) throw _err("c509/bad-extensions", "a policyConstraints value must be a 2-element CBOR array [ requireExplicitPolicy, inhibitPolicyMapping ] (sec. 3.3)");
+          var pcFields = [], repN = node.children[0], ipmN = node.children[1];
+          if (!_isCborNull(repN)) pcFields.push(b.implicit(0, b.integer(_boundCount(_cborUint(repN, "a policyConstraints requireExplicitPolicy"), "a policyConstraints requireExplicitPolicy"))));
+          if (!_isCborNull(ipmN)) pcFields.push(b.implicit(1, b.integer(_boundCount(_cborUint(ipmN, "a policyConstraints inhibitPolicyMapping"), "a policyConstraints inhibitPolicyMapping"))));
+          if (pcFields.length === 0) throw _err("c509/bad-extensions", "policyConstraints must contain requireExplicitPolicy or inhibitPolicyMapping (RFC 5280 sec. 4.2.1.11)");
+          return b.sequence(pcFields);
+        }
         default:
           throw _err("c509/bad-extensions", "extension " + name + " has no compact value decoder");
       }
@@ -8248,8 +8271,8 @@ var require_schema_c509 = __commonJS({
             asn1.read.nullValue(node);
             return cbor.build.nullValue();
           case "tlsFeature":
-            return cbor.build.array((node.children || []).map(function(f) {
-              return cbor.build.uint(asn1.read.integer(f));
+            return cbor.build.array((node.children || []).map(function(f2) {
+              return cbor.build.uint(asn1.read.integer(f2));
             }));
           case "subjectAltName":
           case "issuerAltName": {
@@ -8335,6 +8358,32 @@ var require_schema_c509 = __commonJS({
             }
             return cbor.build.array(cpOut);
           }
+          case "policyMappings": {
+            if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children || node.children.length < 1) return null;
+            var pmOut = [];
+            for (var pm = 0; pm < node.children.length; pm++) {
+              var mp = node.children[pm];
+              if (mp.tagClass !== "universal" || mp.tagNumber !== asn1.TAGS.SEQUENCE || !mp.children || mp.children.length !== 2) return null;
+              pmOut.push(_policyIdFromDer(asn1.read.oid(mp.children[0])));
+              pmOut.push(_policyIdFromDer(asn1.read.oid(mp.children[1])));
+            }
+            return cbor.build.array(pmOut);
+          }
+          case "policyConstraints": {
+            if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children || node.children.length < 1 || node.children.length > 2) return null;
+            var repC = cbor.build.nullValue(), ipmC = cbor.build.nullValue(), pcLast = -1;
+            for (var pci = 0; pci < node.children.length; pci++) {
+              var f = node.children[pci];
+              if (f.tagClass !== "context" || f.tagNumber <= pcLast) return null;
+              pcLast = f.tagNumber;
+              var sv = asn1.read.integerImplicit(f, f.tagNumber);
+              if (sv < 0n) return null;
+              if (f.tagNumber === 0) repC = cbor.build.uint(sv);
+              else if (f.tagNumber === 1) ipmC = cbor.build.uint(sv);
+              else return null;
+            }
+            return cbor.build.array([repC, ipmC]);
+          }
           default:
             return null;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.18.14",
+  "version": "0.18.15",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:58445663-bba2-4a2e-8868-fe5dcf65dc21",
+  "serialNumber": "urn:uuid:d185ee70-6e20-401c-9995-8fa238305f0d",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-06T23:32:39.618Z",
+    "timestamp": "2026-08-07T00:45:36.418Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.18.14",
+      "bom-ref": "@blamejs/core@0.18.15",
       "type": "application",
       "name": "blamejs",
-      "version": "0.18.14",
+      "version": "0.18.15",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.18.14",
+      "purl": "pkg:npm/%40blamejs/core@0.18.15",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.18.14",
+      "ref": "@blamejs/core@0.18.15",
       "dependsOn": []
     }
   ]