@blamejs/blamejs-shop 0.0.108 → 0.0.110

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.0.x
 
+- v0.0.110 (2026-05-23) — **Unblock Cloudflare production deploys + vendor blamejs v0.12.11 + vendor-drift demoted to warning.** Production Cloudflare Workers deploys have been failing on every push since v0.0.102. Root cause: the container image excludes `worker/` via `.dockerignore` (the worker is deployed separately by `wrangler deploy`, the container only ships the long-running backend), but `test/smoke.js` runs inside the container build's `RUN node test/smoke.js` step and calls the `worker-syntax` gate, which tries to read `worker/index.js` and crashes with `ENOENT`. The Docker build exits 1, `wrangler deploy` aborts, and the production worker is left frozen at the last successful build. The fix: `scripts/check-worker-syntax.js` now skips with a no-op stderr message and exits 0 when its entry file isn't present in the current build context — outside the container (host smoke / CI / npm-publish) the entry is always present and the strict scan runs unchanged. Vendor refresh: blamejs v0.12.11 (carries upstream's matching disciplines). Vendor-drift gate demoted from failure to warning: drift surfaces on stderr (still visible in CI logs + operator terminal) but no longer blocks `npm test` — the committed vendor tree is the source of truth, and operators don't need to refresh on every blamejs release before they can ship an unrelated patch. **Changed:** *`vendor-update.sh --check` warns instead of failing on drift* — Drift between vendored blamejs and the latest upstream tag now surfaces on stderr as `[vendor-check] WARNING — vendored vA.B.C, latest vX.Y.Z` and exits 0. The committed vendor tree is the source of truth — there's no integrity loss from an older-but-still-supported vendor version, and forcing a refresh on every minor blamejs release before any unrelated patch could ship was friction without a corresponding safety win. CI logs and the operator's terminal still display the warning prominently. · *Vendor refresh: blamejs v0.12.10 → v0.12.11* — Standard shallow-clone refresh via `scripts/vendor-update.sh blamejs v0.12.11`. No code changes outside `lib/vendor/blamejs/`. **Fixed:** *Worker-syntax gate skips gracefully when `worker/index.js` is absent* — `scripts/check-worker-syntax.js` now checks for the existence of its entry file before scanning. When the file is missing (Cloudflare container build context, where `worker/` is excluded by `.dockerignore`), the gate logs `[worker-syntax] SKIPPED — <entry> not present in this build context (no worker tree to scan)` to stderr and exits 0. When the file IS present (host smoke runs, CI runners, npm-publish workflow, edge-render checks) the strict balance-walker scan runs unchanged and a missing trailing `}` still fails the build. Unblocks production deploys that have been failing since v0.0.102.
+
+- v0.0.109 (2026-05-23) — **Blog-table-resilient D1 queries + tighter `edge-handler-catch-returns-null` regex.** Live probing surfaced that `/feed.xml` (503), `/sitemap.xml` (503), and `/blog` (500) all fail when the live D1 doesn't have the `blog_articles` table — migration `0189` ships with the blogArticles primitive (v0.0.75) but hadn't been applied to the live deployment yet. The four blog-touching queries in `worker/data/catalog.js` now treat `"no such table"` errors as "no published articles" and return empty rows, so the dependent edge routes degrade gracefully (feed renders no items, sitemap renders only the product + static URLs, /blog shows the empty-state). The `edge-handler-catch-returns-null` detector also tightens — the previous regex spanned 400 chars after the catch's opening `{`, which reached across function boundaries into the next function's guard-clause `return null;` and tripped a false positive. The new regex uses `[^}]` to stay inside the catch body. **Fixed:** *Blog-table-resilient queries in `worker/data/catalog.js`* — `listPublishedBlogSlugs`, `listBlogArticles`, `getBlogArticleBySlug`, and `recentBlogArticles` now catch `"no such table"` errors from D1 and return empty rows / null. Operators who haven't applied migration `0189_blog_articles.sql` (or who deploy the worker before the migrations land) get a clean degradation instead of `/feed.xml` 503 / `/sitemap.xml` 503 / `/blog` 500. Non-table-missing errors still propagate to the caller's `_edgeError` for the canonical 5xx render. · *`edge-handler-catch-returns-null` regex tightened — no more cross-function false positives* — Previous regex: `catch\s*\(\s*[\w$]+\s*\)\s*\{[\s\S]{0,400}?return\s+null\s*;` — the `[\s\S]` matches anything including the catch's closing `}`, so a small catch body followed shortly by a function-guard `return null;` was matching as if the null were inside the catch. New regex: `catch\s*\(\s*[\w$]+\s*\)\s*\{[^}]{0,400}return\s+null\s*;` — `[^}]` keeps the match inside the catch body. Catches still flagged for injection-tested anti-pattern (`catch (e) { return null; }`); the blog-query data layer's guard-clause `return null` outside any catch is no longer flagged. · *Blog-query refactor — null-return moves outside the catch body* — `getBlogArticleBySlug` now uses a `var row = null` outer binding and assigns inside the try; the catch swallows the missing-table case without an inner `return null`. The function's contract ("returns the row or null when not found") is preserved; the tightened detector regex doesn't flag the new shape.
+
 - v0.0.108 (2026-05-23) — **ETag + `If-None-Match` 304 handling on `/privacy` + `/terms` — saves the body bytes on every browser revalidate.** `/privacy` and `/terms` carry `max-age=3600` so a returning visitor's browser revalidates the resource every hour. Previously the revalidate downloaded the full body each time (~5KB); now the response carries an `ETag` derived from a FNV-1a hash of the minified body, and the handler compares incoming `If-None-Match` against the same etag — on a match it returns `304 Not Modified` with no body. The Edge cache (24h s-maxage) holds the 200 response; revalidates hit the Worker, run the cheap hash, and 99% of the time return a few hundred bytes instead of the full page. FNV-1a is chosen for speed + zero allocation — collision irrelevant because operators (not visitors) control the policy text, so the attacker-controlled input space at this surface is empty. **Added:** *ETag + `If-None-Match` 304 handling in `_staticHtml`* — `_staticHtml(body, method, env, request)` minifies the body, computes a 32-bit FNV-1a hash of the minified bytes, formats as a quoted hex ETag (`"<hash>"`), and returns 304 (with the ETag header repeated per RFC 7232 §4.1) when the incoming `If-None-Match` matches. The hash is content-stable — a re-render of the same operator-set policy text produces the same ETag across edge instances. Carries through to `/privacy` and `/terms`; the dynamic edge-rendered routes (`/`, `/search`, `/products/:slug`, `/blog`, `/blog/:slug`) keep their `no-store` posture since their D1-sourced content changes per-request.
 
 - v0.0.107 (2026-05-23) — **`X-Robots-Tag: noindex, nofollow` on `/cart` — crawlers stop indexing the session-bound empty-state.** The guest `/cart` route ships an empty-cart render at the edge for visitors without a session cookie. Crawlers reaching the page were indexing it as if it were content; the empty-state snippet ("Your cart is empty") was appearing in SERPs as a stale search result for unrelated queries. The handler now sets `X-Robots-Tag: noindex, nofollow` on the response so well-behaved crawlers skip indexing. `robots.txt` already `Disallow`s the route — the response header is belt-and-suspenders. **Changed:** *`_edgeCartEmpty` sets `X-Robots-Tag: noindex, nofollow`* — The handler now builds its own Response (instead of routing through `_html`) so the response carries the X-Robots-Tag header alongside the full security-header set + Link preload + minification. Per-route headers compose cleanly without changing `_html`'s signature for one outlier.

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.12.10",
-      "tag": "v0.12.10",
+      "version": "0.12.11",
+      "tag": "v0.12.11",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.12.x
 
+- v0.12.11 (2026-05-23) — **`b.archive.wrapWithPassphrase` + `b.archive.unwrapWithPassphrase` — Argon2id + XChaCha20-Poly1305 archive envelope + `b.backup` `cryptoStrategy: "passphrase"` with HIPAA / PCI-DSS 128-bit entropy floor.** Passphrase wrap lands as the second `b.archive` envelope strategy alongside v0.12.10's recipient wrap. `b.archive.wrapWithPassphrase(bytes, { passphrase, minEntropyBits })` produces a `BAWPP`-prefixed envelope under Argon2id (RFC 9106; framework-default 64 MiB / 3 iterations / 4 parallelism) key derivation with XChaCha20-Poly1305 AEAD; each envelope carries its own fresh salt in the wire format (5-byte magic + 1-byte version + 1-byte saltLen + salt + 24-byte nonce + ciphertext+tag) so KDF parameters can rotate in future minors without per-envelope version bumps. `b.archive.unwrapWithPassphrase(sealed, { passphrase })` verifies the `BAWPP` header before any Argon2id compute so non-envelope inputs fail with `archive-wrap/bad-magic` rather than burning the KDF on bad bytes. `b.backup.bundleAdapterStorage({ cryptoStrategy: "passphrase", passphrase })` composes the wrap layer transparently — bundle bytes hitting the adapter's `writeFile` are an opaque passphrase-derived envelope. Default `passphraseMinEntropyBits: 80` matches OWASP strong-password guidance; HIPAA + PCI-DSS postures raise the floor to 128 bits automatically (matching the framework's existing crypto-grade-password discipline for sealed-storage). The recipient strategy from v0.12.10 + passphrase strategy from v0.12.11 + plaintext strategy from v0.12.7 cover the operator's posture matrix: HIPAA / PCI-DSS pick recipient or passphrase; non-regulated deployments may stay on `"none"` when the storage layer is itself the protective boundary. **Added:** *`b.archive.wrapWithPassphrase(bytes, { passphrase, minEntropyBits })` — Argon2id-derived archive envelope* — Composes `b.backupCrypto.encryptWithFreshSalt(bytes, passphrase)` (Argon2id KDF + XChaCha20-Poly1305 AEAD, fresh per-envelope salt) and prepends a 7-byte `BAWPP` envelope header (5-byte magic + 1-byte version + 1-byte saltLen) so format sniffers can identify passphrase wrap output without trial KDF work. Entropy estimate uses observed-alphabet bit-count (the standard NIST/OWASP character-class approximation). `minEntropyBits` defaults to 80; the gate refuses upfront with `archive-wrap/weak-passphrase` when the estimate falls short. · *`b.archive.unwrapWithPassphrase(sealed, { passphrase })` — inverse with magic-check upfront* — Verifies the 7-byte `BAWPP` header (magic + version + saltLen) before any cryptographic work so non-envelope inputs (raw archives, recipient-wrap envelopes, truncated buffers) fail with `archive-wrap/bad-magic` / `archive-wrap/bad-version` / `archive-wrap/truncated-envelope` rather than wasting Argon2id compute. Routes through `b.backupCrypto.decryptWithPassphrase(encrypted, passphrase, saltHex)` so the framework's locked Argon2id parameters apply. · *`b.backup.bundleAdapterStorage({ cryptoStrategy: "passphrase", passphrase })` — Argon2id-keyed bundle storage* — Composes `b.archive.wrapWithPassphrase` transparently — every `writeBundle` payload is wrapped before `adapter.writeFile`; every `readBundle` payload is unwrapped after `adapter.readFile`. The `passphraseMinEntropyBits` opt defaults to 80 (OWASP strong-password floor); HIPAA + PCI-DSS postures raise the floor to 128 bits automatically. Passphrase + directory format combination refused upfront (same contract as recipient + directory). Wire-format envelope on disk is opaque ciphertext — no information leakage about archive contents through the storage adapter. · *HIPAA + PCI-DSS postures raise entropy floor to 128 bits under passphrase strategy* — `bundleAdapterStorage({ posture: "hipaa", cryptoStrategy: "passphrase", passphrase })` enforces `passphraseMinEntropyBits >= 128` regardless of the operator-supplied opt. The 128-bit floor matches the framework's existing crypto-grade-password discipline for sealed-storage cells. Operators sourcing passphrases from a CSPRNG (`b.crypto.generateBytes(16).toString("base64url")` → ~128 bits) pass without issue; operators typing dictionary phrases trip the gate. **Security:** *Magic-check before KDF work — non-envelope inputs can't burn Argon2id compute* — Adversarial inputs that look like passphrase envelopes but aren't (random bytes, recipient envelopes, raw archives) fail at byte 0-4 (magic check) rather than after a 64 MiB Argon2id round. Operators handing user-supplied bundles to readBundle on a server with concurrent load get bounded refusal latency rather than worst-case KDF compute under a chosen-bytes attack.
+
 - v0.12.10 (2026-05-23) — **`b.archive.wrap` + `b.archive.unwrap` — recipient-encrypted archive envelopes (Flavor 1) + `b.backup` `cryptoStrategy: "recipient"` + HIPAA/PCI-DSS posture refusal.** Flavor 1 lands as the whole-archive recipient-wrap substrate. `b.archive.wrap(bytes, { recipient })` produces a sealed envelope under the framework's hybrid PQC seal (ML-KEM-1024 + P-384 ECDH + SHAKE256 + XChaCha20-Poly1305) prefixed with a 6-byte `BAWRP` archive-wrap header so format sniffers can identify wrap envelopes without trial decryption. `b.archive.unwrap(sealed, { recipient })` is the inverse with magic-check upfront so non-envelope inputs throw `archive-wrap/bad-magic` rather than a crypto-level error. Recipient strategies: static keypair (`{ publicKey, ecPublicKey }`) and peer-cert (`{ peerCertDer, peerKemPubkey }`); the tenant strategy lands in v0.12.11 alongside the backup-crypto refactor + per-tenant key resolution. `b.backup.bundleAdapterStorage({ cryptoStrategy: "recipient", recipient })` composes the wrap/unwrap layer transparently: the bytes hitting the adapter's `writeFile` are a `BAWRP`-prefixed envelope, never the raw tar / tar.gz / directory bundle. HIPAA + PCI-DSS postures refuse `cryptoStrategy: "none"` upfront with `backup/posture-requires-encryption` — the storage adapter cannot itself satisfy the encryption-at-rest requirement; the recipient envelope is the framework-side gate. Flavor 2 (per-entry ZIP wrap with the 0xBADC extra-field marker) and the backup-crypto refactor into `lib/_crypto-base.js` ship in v0.12.11. **Added:** *`b.archive.wrap(bytes, { recipient })` — recipient-encrypted archive envelope* — Composes `b.crypto.encrypt` (or `b.crypto.encryptEnvelopeAsCertPeer` for the peer-cert strategy) under the framework's hybrid PQC seal. The output is a Buffer carrying a 6-byte `BAWRP` archive-wrap header (5-byte magic + 1-byte version) followed by the base64-encoded envelope bytes. Recipient strategies: `{ publicKey, ecPublicKey }` for the static-keypair path (ML-KEM-1024 PEM + P-384 ECDH PEM); `{ peerCertDer, peerKemPubkey }` for the peer-cert path (extracts the P-384 half from the cert per `b.crypto.encryptEnvelopeAsCertPeer`). `"tenant"` returns `archive-wrap/tenant-strategy-deferred` upfront — that strategy lands in v0.12.11 with the per-tenant key resolution. · *`b.archive.unwrap(sealed, { recipient })` — inverse with upfront magic check* — Verifies the 6-byte `BAWRP` header before any cryptographic work so non-envelope inputs (raw archives, other-magic envelopes, truncated buffers) fail with `archive-wrap/bad-magic` / `archive-wrap/bad-version` rather than a downstream `crypto/*` error. Routes through `b.crypto.decrypt(envelope, recipient, { raw: true })` so binary archive payloads (gzip, ZIP, tar) round-trip losslessly — `raw: true` is the contract that preserves bytes vs the default utf-8 decoding. · *`b.backup.bundleAdapterStorage({ cryptoStrategy: "recipient", recipient })` — opt-in envelope storage* — `cryptoStrategy: "none"` (default, v0.12.7-9 behaviour) writes plaintext bundle bytes to the adapter — safe for storage layers that are themselves the protective boundary (S3 SSE, disk-encrypted hosts). `cryptoStrategy: "recipient"` requires `opts.recipient` and wraps every `writeBundle` payload through `b.archive.wrap` before `adapter.writeFile`; `readBundle` unwraps after `adapter.readFile`. The wrap layer sits OUTSIDE the gz / tar layers so the bundle on disk is opaque ciphertext under the operator-controlled recipient key. Passphrase strategy is deferred to v0.12.11 alongside the `_crypto-base.js` refactor. · *HIPAA + PCI-DSS posture refuses plaintext bundles* — `bundleAdapterStorage({ posture: "hipaa" })` (or `"pci-dss"`) refuses `cryptoStrategy: "none"` upfront with `backup/posture-requires-encryption` — adapter-storage's plaintext default cannot itself satisfy encryption-at-rest requirements. Operators under these postures pass `cryptoStrategy: "recipient"` + a recipient key. The refusal message includes the posture name + the strategy that fails so audit-trail operators see exactly which gate blocked the call. **Security:** *Wrap envelope is the framework's hybrid PQC seal — ML-KEM-1024 + P-384 ECDH + SHAKE256 + XChaCha20-Poly1305* — Defence-in-depth posture: a CRQC against ML-KEM-1024 alone still has to defeat the classical P-384 ECDH leg; a future ECDH break alone still has to defeat ML-KEM-1024. The 4-byte envelope header (magic + KEM ID + cipher ID + KDF ID) is bound as AEAD AAD so a header-substitution attack fails Poly1305 verification. `b.archive.wrap` prepends a separate 6-byte archive-wrap header BEFORE the base64 envelope so format sniffing can identify wrap output without trial decryption — non-envelope inputs are refused at byte 0-4 (magic check) instead of after fruitless decapsulation work. **Detectors:** *`backup-adapter-storage-without-posture-check` — postures that mandate encryption must propagate to `cryptoStrategy`* — When a primitive that wires `b.backup.bundleAdapterStorage` carries a `posture:` opt drawn from the HIPAA / PCI-DSS / etc. set, the same code path must propagate `cryptoStrategy: "recipient"` (or refuse before reaching writeBundle). The detector matches `bundleAdapterStorage({ ... posture: ... })` invocations in `lib/` and requires a matching `cryptoStrategy` opt; missing it surfaces during the codebase-patterns gate so a future caller can't silently drop the contract. **Migration:** *Flavor 2 — per-entry ZIP recipient wrap with 0xBADC extra-field* — Per-entry encryption inside the carrier ZIP (method=STORE with the encrypted bytes as the stored payload + a 0xBADC user-defined-range extra-field marker carrying the recipient hint). Inspect-without-decrypt is the operator value: entry list + name-safety gating happens BEFORE any key resolution. Lands in v0.12.11 alongside the backup-crypto refactor. · *`lib/_crypto-base.js` refactor — backup-crypto, Flavor 1, Flavor 2 share substrate* — The legacy per-file Argon2id + XChaCha20-Poly1305 path in `lib/backup/crypto.js` gets factored into a private `_crypto-base.js` helper so all three encryption flavors compose the same primitive set. No operator-visible API change; closes the each-feature-rolls-its-own-crypto smell. · *`cryptoStrategy: "passphrase"` + tenant strategy* — Passphrase strategy on `bundleAdapterStorage` (Argon2id-derived key + XChaCha20-Poly1305) and the `"tenant"` recipient string (composes `b.vault.derivedKey({ tenant, purpose: "archive-wrap" })`) both ship in v0.12.11. The v0.12.10 surface is the recipient substrate; v0.12.11 lights up the per-tenant + passphrase strategies that consume it.
 
 - v0.12.9 (2026-05-23) — **`b.archive.gz` + `b.archive.read.gz` — gzip composition with `b.safeDecompress` bomb caps + `b.backup` `tar.gz` bundle format + `sha-to-tag verify` fetches `origin/main`.** gzip lands as the composition layer over the archive family. `b.archive.gz(bytes)` produces an RFC 1952 gzip stream with the same `toBuffer()` / `toAdapter(adapter)` / `digest()` shape every archive builder ships, and `b.archive.read.gz(adapter, opts)` reads it back through `b.safeDecompress` so a malicious `tar.gz` fails the gzip-layer bomb cap (1 GiB output / 100× ratio defaults) before the tar walker ever sees a decompressed byte. The reader exposes `toBuffer()` / `asTar(opts)` / `asZip(opts)` so operators can hand the decompressed bytes directly to a downstream archive reader without a round-trip through disk. `b.archive.tar().toGzip(adapter, opts)` is the write-side convenience for the most common combination. `b.backup.bundleAdapterStorage({ format: "tar.gz" })` adds gzip compression on the wire — bundle sizes drop ~3-5× on text-heavy backups (databases, JSON exports, mail spools); the readback path detects the format from the storage key suffix and composes `b.safeDecompress` automatically. The `sha-to-tag verify` workflow now explicitly fetches `origin/main` before walking the first-parent history, fixing a stale-ref bug that silently failed v0.12.6 through v0.12.8 tag verifications (the publish workflow itself was unaffected; the gate is independent). **Added:** *`b.archive.gz(bytes)` — standalone gzip write builder* — RFC 1952 gzip envelope with the standard archive-builder shape. `toBuffer()` returns the compressed bytes; `toAdapter(adapter)` writes through any writable adapter (fs / object-store / http) that exposes `.write(bytes)` + optional `.close()`; `digest()` returns a SHA3-512 hex hash of the compressed payload for operator integrity logs. `opts.level` accepts 0-9 (zlib default 6). Composes cleanly under `b.archive.tar().toGzip(adapter)` / `b.archive.zip()` for tar.gz / zip.gz convenience. · *`b.archive.read.gz(adapter, opts)` — gunzip reader with `b.safeDecompress` bomb caps* — Every decompression routes through `b.safeDecompress({ algorithm: "gzip", maxOutputBytes, maxRatio })` so a hostile gzip stream fails the bomb gate before any downstream parsing happens. Defaults: `maxDecompressedBytes` = 1 GiB, `maxExpansionRatio` = 100×. The reader exposes three downstream entry points: `toBuffer()` returns the raw decompressed bytes; `asTar(opts)` returns a `b.archive.read.tar` reader over the decompressed payload; `asZip(opts)` returns a `b.archive.read.zip` reader. `fromGzip` is the documented alias the spec uses (operators may reach for either). Refuses non-gzip input upfront via the `0x1f 0x8b` magic check (`archive-gz/bad-magic`). · *`b.archive.tar().toGzip(adapter, opts)` — tar.gz write convenience* — Pipes the tar builder's `toBuffer()` through `b.archive.gz()` and writes the resulting gzip envelope to a writable adapter. Equivalent to `b.archive.gz(t.toBuffer()).toAdapter(adapter)` but lets the operator stay in the tar-builder fluent chain when composing under fs / object-store / http adapters. · *`b.backup.bundleAdapterStorage({ format: "tar.gz" })` — compressed-on-the-wire bundles* — Adds gzip compression to the v0.12.8 tar bundle format. Bundle sizes drop ~3-5× on text-heavy backups (databases, JSON exports, mail spools); binary-heavy backups (compressed databases, encrypted archives) see ~1.0-1.1×. Read paths auto-detect via the `<bundleId>/bundle.tar.gz` storage key suffix and route through `b.safeDecompress` on readback. The v0.12.8 `maxBundleBytes` cap continues to gate against pathological projected-uncompressed sizes; `tar.gz` does not bypass it. · *`b.safeArchive.extract({ format: "tar.gz" })` — explicit tar.gz dispatch* — Operators handed a `.tar.gz` upload pass `format: "tar.gz"` explicitly; the orchestrator composes `b.archive.read.gz` → `.asTar()` and feeds the standard tar bomb-policy + entry-type-policy + guardProfile through. Defer-with-condition: auto-sniff for tar.gz (peek inside the gzip envelope for ustar magic at offset 257 of the decompressed prefix) lands when operator demand surfaces; today operators with `auto` mode on a `.tar.gz` payload get `format-unsupported gzip` with the explicit-format hint in the error message. **Fixed:** *`sha-to-tag verify` workflow fetches `origin/main` before first-parent walk* — The release-tag integrity gate runs on every `v*` tag push and verifies the tag's commit SHA appears on `main`'s first-parent history. `actions/checkout` was being asked for full history of the tag ref alone — `origin/main` wasn't fetched as a side effect, so `git rev-list --first-parent origin/main | grep -qx "$SHA"` walked a stale (or absent) ref and falsely refused. The check now explicitly fetches `origin/main` after checkout so the walk sees the current squash-merge HEAD. Affected releases (v0.12.6 / v0.12.7 / v0.12.8) had publish workflows that completed normally — `sha-to-tag verify` is an independent gate that was silently failing alongside successful publishes; nothing about the published artifacts was wrong. **Security:** *Bomb caps ride at the gz layer, not the tar/zip layer* — The decompression gate is enforced BEFORE the downstream archive reader sees any bytes — a hostile `tar.gz` that would decompress to 10 GiB of zero-filled tar entries fails the 1 GiB `maxDecompressedBytes` default cap during gunzip, never reaching the tar walker. Operators with legitimately large compressed archives pass `maxDecompressedBytes` higher; the framework refuses without an explicit opt-in. RFC 1952 §2.3.1 magic enforcement prevents content-type confusion (gzip-pretending-to-be-something-else inputs). **Detectors:** *`archive-gz-without-safedecompress` — direct `node:zlib` gunzip in `lib/` must compose `b.safeDecompress`* — Mirrors the v0.11.5 must-compose pattern: any `lib/` call to `zlib.gunzipSync` / `zlib.createGunzip` / `gunzip` outside `lib/archive-gz.js` (which IS the canonical gunzip site, with `b.safeDecompress` wired in) must carry an `allow:archive-gz-without-safedecompress` marker explaining why the bomb gate is bypassed. The detector locks the contract so v0.13+ work that touches a gzip-handling primitive can't quietly drop the cap.

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.12.10",
-  "createdAt": "2026-05-23T18:01:15.953Z",
+  "frameworkVersion": "0.12.11",
+  "createdAt": "2026-05-23T19:12:47.343Z",
   "exports": {
     "a2a": {
       "type": "object",
@@ -1834,10 +1834,18 @@
           "type": "function",
           "arity": 2
         },
+        "unwrapWithPassphrase": {
+          "type": "function",
+          "arity": 2
+        },
         "wrap": {
           "type": "function",
           "arity": 2
         },
+        "wrapWithPassphrase": {
+          "type": "function",
+          "arity": 2
+        },
         "zip": {
           "type": "function",
           "arity": 0

package/lib/vendor/blamejs/lib/archive-wrap.js

@@ -28,15 +28,23 @@ var { defineClass } = require("./framework-error");
 var ArchiveWrapError = defineClass("ArchiveWrapError", { alwaysPermanent: true });
 
 var bCrypto = lazyRequire(function () { return require("./crypto"); });
+var backupCrypto = lazyRequire(function () { return require("./backup/crypto"); });
 
 // Envelope magic — 5-byte ASCII prefix the safe-archive sniffer
 // recognises. Distinct from b.crypto.encrypt's base64 envelope so
 // archive-wrap output can carry an unambiguous "this is an archive
-// recipient-wrap envelope" magic before the operator-controlled
-// payload.
-var ARCH_WRAP_MAGIC = "BAWRP";                                                       // allow:raw-byte-literal — 5-byte ASCII archive-wrap envelope magic
-var ARCH_WRAP_VERSION = 0x01;                                                        // allow:raw-byte-literal — version byte
+// wrap envelope" magic before the operator-controlled payload.
+var ARCH_WRAP_MAGIC = "BAWRP";                                                       // allow:raw-byte-literal — 5-byte ASCII archive-wrap recipient envelope magic
+var ARCH_WRAP_VERSION = 0x01;                                                        // allow:raw-byte-literal — recipient version byte
 var ARCH_WRAP_HEADER_BYTES = C.BYTES.bytes(6);                                        // magic(5) + version(1)
+// Passphrase variant — wire format: magic(5) + version(1) + saltLen(1)
+// + salt(saltLen bytes) + encrypted bytes (24-byte nonce + ciphertext+tag
+// from backup-crypto encryptWithPassphrase). The salt-prefix shape
+// lets the framework rotate KDF parameters in future minors without
+// per-envelope version bumps (each envelope carries its own salt).
+var ARCH_PASSPHRASE_MAGIC = "BAWPP";                                                 // allow:raw-byte-literal — 5-byte passphrase-wrap envelope magic
+var ARCH_PASSPHRASE_VERSION = 0x01;                                                  // allow:raw-byte-literal — passphrase version byte
+var ARCH_PASSPHRASE_HEADER_BYTES = C.BYTES.bytes(7);                                  // magic(5) + version(1) + saltLen(1)
 
 /**
  * @primitive b.archive.wrap
@@ -227,11 +235,213 @@ function _isWrapMagic(buf) {
     buf.slice(0, 5).toString("ascii") === ARCH_WRAP_MAGIC;
 }
 
+function _isPassphraseMagic(buf) {
+  return buf.length >= ARCH_PASSPHRASE_HEADER_BYTES &&
+    buf.slice(0, 5).toString("ascii") === ARCH_PASSPHRASE_MAGIC;
+}
+
+/**
+ * @primitive b.archive.wrapWithPassphrase
+ * @signature b.archive.wrapWithPassphrase(bytes, opts)
+ * @since     0.12.11
+ * @status    stable
+ * @related   b.archive.unwrapWithPassphrase, b.archive.wrap, b.backupCrypto
+ *
+ * Wrap archive bytes in a passphrase-derived envelope. The envelope
+ * wire format is the framework's standard Argon2id (RFC 9106) +
+ * XChaCha20-Poly1305 AEAD with a fresh per-envelope salt prefixed in
+ * a 7-byte `BAWPP` header (5-byte magic + 1-byte version + 1-byte
+ * salt length). Operators choosing the passphrase strategy (vs the
+ * recipient strategy from `b.archive.wrap`) reach for this primitive
+ * when they don't want to manage KEM keypairs but do want
+ * encryption-at-rest under operator-controlled material.
+ *
+ * @opts
+ *   passphrase:           Buffer | string,   // required; >= minEntropyBits
+ *   minEntropyBits:       number,            // default 80; HIPAA recipe sets 128
+ *
+ * @example
+ *   var sealed = await b.archive.wrapWithPassphrase(tarBytes, {
+ *     passphrase:     "operator-supplied-long-passphrase",
+ *     minEntropyBits: 128,
+ *   });
+ */
+async function wrapWithPassphrase(bytes, opts) {
+  opts = opts || {};
+  if (!Buffer.isBuffer(bytes) && !(bytes instanceof Uint8Array)) {
+    throw new ArchiveWrapError("archive-wrap/bad-input",
+      "wrapWithPassphrase: bytes must be a Buffer or Uint8Array");
+  }
+  if (bytes.length === 0) {
+    throw new ArchiveWrapError("archive-wrap/empty-input",
+      "wrapWithPassphrase: bytes is empty");
+  }
+  if (typeof opts.passphrase !== "string" && !Buffer.isBuffer(opts.passphrase)) {
+    throw new ArchiveWrapError("archive-wrap/no-passphrase",
+      "wrapWithPassphrase: opts.passphrase is required (string or Buffer)");
+  }
+  var passLen = typeof opts.passphrase === "string"
+    ? Buffer.byteLength(opts.passphrase, "utf-8")
+    : opts.passphrase.length;
+  // Entropy estimate — character-set-aware bit count via Shannon's
+  // bound assuming uniform random selection over the observed
+  // alphabet. Operators sourcing passphrases from a random-bytes
+  // generator (high entropy density) pass without issue; operators
+  // typing dictionary phrases trip the gate.
+  // Codex P1 on v0.12.11 PR #162 — typeof NaN === "number" passes
+  // typeof gate but bypasses downstream comparisons. Use isFinite
+  // so NaN / Infinity can't slip past the entropy gate.
+  var minEntropy;
+  if (opts.minEntropyBits === undefined || opts.minEntropyBits === null) {
+    minEntropy = 80;                                                                  // allow:raw-byte-literal — entropy-bits default, not byte count
+  } else if (Number.isFinite(opts.minEntropyBits) && opts.minEntropyBits >= 0) {
+    minEntropy = Math.floor(opts.minEntropyBits);
+  } else {
+    throw new ArchiveWrapError("archive-wrap/bad-arg",
+      "wrapWithPassphrase: opts.minEntropyBits must be a finite non-negative number; got " +
+      JSON.stringify(opts.minEntropyBits) + " (NaN / Infinity refused so the entropy gate can't be bypassed)");
+  }
+  var estimated = _estimatePassphraseEntropyBits(opts.passphrase);
+  if (estimated < minEntropy) {
+    throw new ArchiveWrapError("archive-wrap/weak-passphrase",
+      "wrapWithPassphrase: passphrase estimated entropy " + estimated +
+      " bits is below opts.minEntropyBits=" + minEntropy +
+      " (length=" + passLen + " bytes). Strengthen the passphrase or lower the gate; " +
+      "HIPAA recipe is 128+ bits.");
+  }
+  var fresh = await backupCrypto().encryptWithFreshSalt(bytes, opts.passphrase);
+  var saltBytes = Buffer.from(fresh.salt, "hex");
+  if (saltBytes.length > 0xff) {
+    throw new ArchiveWrapError("archive-wrap/salt-too-long",
+      "wrapWithPassphrase: salt length " + saltBytes.length +
+      " exceeds 255-byte wire limit");
+  }
+  var header = Buffer.alloc(ARCH_PASSPHRASE_HEADER_BYTES);
+  header.write(ARCH_PASSPHRASE_MAGIC, 0, 5, "ascii");
+  header[5] = ARCH_PASSPHRASE_VERSION;
+  header[6] = saltBytes.length;
+  return Buffer.concat([header, saltBytes, fresh.encrypted]);
+}
+
+/**
+ * @primitive b.archive.unwrapWithPassphrase
+ * @signature b.archive.unwrapWithPassphrase(sealed, opts)
+ * @since     0.12.11
+ * @status    stable
+ * @related   b.archive.wrapWithPassphrase
+ *
+ * Recover archive bytes from a passphrase-derived envelope produced
+ * by `b.archive.wrapWithPassphrase`. Verifies the 7-byte `BAWPP`
+ * header before attempting key derivation so non-envelope inputs
+ * fail with `archive-wrap/bad-magic` rather than burning Argon2id
+ * compute on bad bytes.
+ *
+ * @opts
+ *   passphrase:  Buffer | string,   // required; same passphrase used at wrap-time
+ *
+ * @example
+ *   var recovered = await b.archive.unwrapWithPassphrase(sealed, {
+ *     passphrase: "operator-supplied-long-passphrase",
+ *   });
+ */
+async function unwrapWithPassphrase(sealed, opts) {
+  opts = opts || {};
+  if (!Buffer.isBuffer(sealed) && !(sealed instanceof Uint8Array)) {
+    throw new ArchiveWrapError("archive-wrap/bad-input",
+      "unwrapWithPassphrase: sealed must be a Buffer or Uint8Array");
+  }
+  if (sealed.length < ARCH_PASSPHRASE_HEADER_BYTES) {
+    throw new ArchiveWrapError("archive-wrap/bad-magic",
+      "unwrapWithPassphrase: input shorter than 7-byte BAWPP header");
+  }
+  var buf = Buffer.isBuffer(sealed) ? sealed : Buffer.from(sealed);
+  var magic = buf.slice(0, 5).toString("ascii");
+  if (magic !== ARCH_PASSPHRASE_MAGIC) {
+    throw new ArchiveWrapError("archive-wrap/bad-magic",
+      "unwrapWithPassphrase: input does not start with passphrase-wrap magic " +
+      JSON.stringify(ARCH_PASSPHRASE_MAGIC) + "; got " + JSON.stringify(magic));
+  }
+  var version = buf[5];
+  if (version !== ARCH_PASSPHRASE_VERSION) {
+    throw new ArchiveWrapError("archive-wrap/bad-version",
+      "unwrapWithPassphrase: passphrase-wrap version " + version + " not supported");
+  }
+  if (typeof opts.passphrase !== "string" && !Buffer.isBuffer(opts.passphrase)) {
+    throw new ArchiveWrapError("archive-wrap/no-passphrase",
+      "unwrapWithPassphrase: opts.passphrase is required");
+  }
+  var saltLen = buf[6];
+  if (sealed.length < ARCH_PASSPHRASE_HEADER_BYTES + saltLen) {
+    throw new ArchiveWrapError("archive-wrap/truncated-envelope",
+      "unwrapWithPassphrase: header claims " + saltLen + "-byte salt but only " +
+      (sealed.length - ARCH_PASSPHRASE_HEADER_BYTES) + " bytes remain");
+  }
+  var saltHex = buf.slice(ARCH_PASSPHRASE_HEADER_BYTES,
+    ARCH_PASSPHRASE_HEADER_BYTES + saltLen).toString("hex");
+  var encrypted = buf.slice(ARCH_PASSPHRASE_HEADER_BYTES + saltLen);
+  try {
+    return await backupCrypto().decryptWithPassphrase(encrypted, opts.passphrase, saltHex);
+  } catch (e) {
+    var err = new ArchiveWrapError("archive-wrap/decrypt-failed",
+      "unwrapWithPassphrase: decryption refused (wrong passphrase or tampered envelope): " +
+      ((e && e.message) || String(e)));
+    err.cause = e;
+    throw err;
+  }
+}
+
+function _estimatePassphraseEntropyBits(passphrase) {
+  // Codex P2 on v0.12.11 PR #162 — Buffer passphrases (CSPRNG-
+  // generated random bytes) shouldn't be UTF-8 decoded for entropy
+  // estimation; the decoding artifacts (invalid sequences, BOM,
+  // surrogate pairs) make the alphabet-class measure unstable and
+  // falsely reject strong random buffers. Treat Buffer input as
+  // raw bytes: observed-alphabet bit count over the byte values
+  // gives a stable approximation that credits CSPRNG output
+  // correctly (a 16-byte buffer with full byte variation scores
+  // 16 * log2(16+) ≈ 64-128 bits) and refuses all-zero buffers
+  // (alphabet=1, score 0).
+  if (Buffer.isBuffer(passphrase)) {
+    if (passphrase.length === 0) return 0;
+    var seen = new Set();
+    for (var bi = 0; bi < passphrase.length; bi += 1) {
+      seen.add(passphrase[bi]);
+    }
+    var byteAlphabet = seen.size;
+    if (byteAlphabet === 0) return 0;
+    return Math.floor(passphrase.length * Math.log2(byteAlphabet));
+  }
+  var s = typeof passphrase === "string" ? passphrase : String(passphrase);
+  if (s.length === 0) return 0;
+  // String passphrases — operator-typed phrases. Observed character-
+  // class alphabet count. log2(alphabetSize) bits per character is
+  // the standard NIST/OWASP "estimate by character classes" measure.
+  var hasLower = false, hasUpper = false, hasDigit = false, hasSpecial = false;
+  for (var i = 0; i < s.length; i += 1) {
+    var c = s.charCodeAt(i);
+    if (c >= 0x61 && c <= 0x7a) hasLower = true;
+    else if (c >= 0x41 && c <= 0x5a) hasUpper = true;
+    else if (c >= 0x30 && c <= 0x39) hasDigit = true;
+    else hasSpecial = true;
+  }
+  var alphabet = 0;
+  if (hasLower) alphabet += 26;                                                       // allow:raw-byte-literal — alphabet-size term, not byte count
+  if (hasUpper) alphabet += 26;                                                       // allow:raw-byte-literal — alphabet-size term, not byte count
+  if (hasDigit) alphabet += 10;                                                       // allow:raw-byte-literal — alphabet-size term, not byte count
+  if (hasSpecial) alphabet += 32;                                                     // allow:raw-byte-literal — alphabet-size term, not byte count
+  if (alphabet === 0) return 0;
+  return Math.floor(s.length * Math.log2(alphabet));
+}
+
 module.exports = {
-  wrap:             wrap,
-  unwrap:           unwrap,
-  ArchiveWrapError: ArchiveWrapError,
+  wrap:                  wrap,
+  unwrap:                unwrap,
+  wrapWithPassphrase:    wrapWithPassphrase,
+  unwrapWithPassphrase:  unwrapWithPassphrase,
+  ArchiveWrapError:      ArchiveWrapError,
   // Exposed for sibling modules + sniffer
-  _isWrapMagic:     _isWrapMagic,
-  ARCH_WRAP_MAGIC:  ARCH_WRAP_MAGIC,
+  _isWrapMagic:          _isWrapMagic,
+  _isPassphraseMagic:    _isPassphraseMagic,
+  ARCH_WRAP_MAGIC:       ARCH_WRAP_MAGIC,
+  ARCH_PASSPHRASE_MAGIC: ARCH_PASSPHRASE_MAGIC,
 };

package/lib/vendor/blamejs/lib/archive.js

@@ -549,11 +549,13 @@ var archiveGz = require("./archive-gz");
 var archiveWrap = require("./archive-wrap");
 
 module.exports = {
-  zip:               zip,
-  tar:               archiveTar.tar,
-  gz:                archiveGz.gz,
-  wrap:              archiveWrap.wrap,
-  unwrap:            archiveWrap.unwrap,
+  zip:                  zip,
+  tar:                  archiveTar.tar,
+  gz:                   archiveGz.gz,
+  wrap:                 archiveWrap.wrap,
+  unwrap:               archiveWrap.unwrap,
+  wrapWithPassphrase:   archiveWrap.wrapWithPassphrase,
+  unwrapWithPassphrase: archiveWrap.unwrapWithPassphrase,
   ArchiveError:      ArchiveError,
   TarError:          archiveTar.TarError,
   ArchiveGzError:    archiveGz.ArchiveGzError,

package/lib/vendor/blamejs/lib/backup/index.js

@@ -1083,11 +1083,11 @@ function bundleAdapterStorage(opts) {
   //                 BACKUP_ENCRYPTION_REQUIRED_POSTURES) REFUSE
   //                 "none" + require "recipient".
   var cryptoStrategy = opts.cryptoStrategy || "none";
-  if (cryptoStrategy !== "none" && cryptoStrategy !== "recipient") {
+  if (cryptoStrategy !== "none" && cryptoStrategy !== "recipient" &&
+      cryptoStrategy !== "passphrase") {
     throw new BackupError("backup/bad-crypto-strategy",
-      "bundleAdapterStorage: cryptoStrategy must be \"none\" (default — adapter-encrypted storage) " +
-      "or \"recipient\" (v0.12.10 — wraps bundle bytes in a hybrid PQC envelope before writeFile). " +
-      "Passphrase strategy is deferred to v0.12.11.");
+      "bundleAdapterStorage: cryptoStrategy must be \"none\" (default — adapter-encrypted storage), " +
+      "\"recipient\" (v0.12.10 — hybrid PQC envelope wrap), or \"passphrase\" (v0.12.11 — Argon2id + XChaCha20-Poly1305 wrap)");
   }
   var recipient = opts.recipient;
   if (cryptoStrategy === "recipient" && (!recipient || typeof recipient !== "object")) {
@@ -1096,29 +1096,67 @@ function bundleAdapterStorage(opts) {
       "({ publicKey, ecPublicKey } for the hybrid PQC envelope OR { peerCertDer, peerKemPubkey } " +
       "for the peer-cert envelope)");
   }
-  // Codex P1 on v0.12.10 PR #161 — the wrap layer composes only
-  // with the tar / tar.gz writeBundle branches. Pairing recipient
-  // strategy with format: "directory" would silently write plaintext
-  // per-file payloads because the directory branch doesn't apply
-  // the envelope. Refuse the combination upfront so operators see
-  // the contract gap rather than discover it via disk inspection.
-  // Per-file recipient encryption for directory format is a v0.12.11
-  // follow-up alongside the _crypto-base.js refactor.
-  if (cryptoStrategy === "recipient" && format === "directory") {
-    throw new BackupError("backup/recipient-strategy-needs-bundled-format",
-      "bundleAdapterStorage: cryptoStrategy: \"recipient\" requires format: \"tar\" or \"tar.gz\". " +
-      "Directory format writes per-file plaintext to the adapter — the wrap layer composes only " +
-      "with tar / tar.gz bundles in v0.12.10. Per-file recipient encryption is a v0.12.11 follow-up.");
+  var passphrase = opts.passphrase;
+  // HIPAA + PCI-DSS recipe raises the floor to 128 bits (per
+  // BACKUP_ENCRYPTION_REQUIRED_POSTURES below); default 80 matches
+  // OWASP "strong password" guidance for generic deployments.
+  // Codex P1 on v0.12.11 PR #162 — typeof NaN === "number" and
+  // typeof Infinity === "number" both pass the typeof gate but
+  // bypass downstream comparisons (NaN < 128 is false; estimated
+  // < NaN is false). Use Number.isFinite + a finite integer check
+  // so the entropy floor can't be NaN'd out under HIPAA.
+  var passphraseMinEntropyBits;
+  if (opts.passphraseMinEntropyBits === undefined ||
+      opts.passphraseMinEntropyBits === null) {
+    passphraseMinEntropyBits = 80;                                                    // allow:raw-byte-literal — entropy-bits default floor, not byte count
+  } else if (Number.isFinite(opts.passphraseMinEntropyBits) &&
+             opts.passphraseMinEntropyBits >= 0) {
+    passphraseMinEntropyBits = Math.floor(opts.passphraseMinEntropyBits);
+  } else {
+    throw new BackupError("backup/bad-arg",
+      "bundleAdapterStorage: passphraseMinEntropyBits must be a finite non-negative number; " +
+      "got " + JSON.stringify(opts.passphraseMinEntropyBits) +
+      " (NaN / Infinity are refused upfront so the HIPAA / PCI-DSS 128-bit floor can't be bypassed)");
+  }
+  if (cryptoStrategy === "passphrase") {
+    if (typeof passphrase !== "string" && !Buffer.isBuffer(passphrase)) {
+      throw new BackupError("backup/no-passphrase",
+        "bundleAdapterStorage: cryptoStrategy: \"passphrase\" requires opts.passphrase " +
+        "(string or Buffer; Argon2id key derivation + XChaCha20-Poly1305 AEAD). " +
+        "passphraseMinEntropyBits defaults to 80; HIPAA / PCI-DSS postures raise the floor to 128.");
+    }
+  }
+  // Codex P1 on v0.12.10 PR #161 — the wrap layers (recipient AND
+  // passphrase) compose only with the tar / tar.gz writeBundle
+  // branches. Pairing encryption strategy with format: "directory"
+  // would silently write plaintext per-file payloads. Refuse upfront
+  // so operators see the contract gap rather than discover it via
+  // disk inspection. Per-file encryption for directory format is a
+  // future patch alongside the _crypto-base.js refactor.
+  if ((cryptoStrategy === "recipient" || cryptoStrategy === "passphrase") &&
+      format === "directory") {
+    throw new BackupError("backup/" + cryptoStrategy + "-strategy-needs-bundled-format",
+      "bundleAdapterStorage: cryptoStrategy: " + JSON.stringify(cryptoStrategy) +
+      " requires format: \"tar\" or \"tar.gz\". Directory format writes per-file plaintext to " +
+      "the adapter — the wrap layer composes only with tar / tar.gz bundles. Per-file " +
+      "encryption for directory format is a future patch alongside the _crypto-base.js refactor.");
   }
   var posture = opts.posture;
-  if (posture && BACKUP_ENCRYPTION_REQUIRED_POSTURES.indexOf(posture) !== -1 &&
-      cryptoStrategy === "none") {
-    throw new BackupError("backup/posture-requires-encryption",
-      "bundleAdapterStorage: posture=" + JSON.stringify(posture) +
-      " requires cryptoStrategy: \"recipient\" (the adapter-storage layer cannot itself " +
-      "satisfy HIPAA / PCI-DSS encryption-at-rest with cryptoStrategy: \"none\"). " +
-      "The recipient+directory combination is refused separately so operators don't slip " +
-      "plaintext per-file payloads past the posture gate.");
+  if (posture && BACKUP_ENCRYPTION_REQUIRED_POSTURES.indexOf(posture) !== -1) {
+    if (cryptoStrategy === "none") {
+      throw new BackupError("backup/posture-requires-encryption",
+        "bundleAdapterStorage: posture=" + JSON.stringify(posture) +
+        " requires cryptoStrategy: \"recipient\" or \"passphrase\" (the adapter-storage layer " +
+        "cannot itself satisfy HIPAA / PCI-DSS encryption-at-rest with cryptoStrategy: \"none\"). " +
+        "The recipient+directory and passphrase+directory combinations are refused separately so " +
+        "operators don't slip plaintext per-file payloads past the posture gate.");
+    }
+    // v0.12.11 — passphrase strategy under HIPAA / PCI-DSS raises
+    // the entropy floor to 128 bits (matches the framework's
+    // existing crypto-grade-password discipline for sealed-storage).
+    if (cryptoStrategy === "passphrase" && passphraseMinEntropyBits < 128) {          // allow:raw-byte-literal — entropy-bits floor, not byte count
+      passphraseMinEntropyBits = 128;                                                  // allow:raw-byte-literal — entropy-bits floor, not byte count
+    }
   }
   // Codex P2 on v0.12.8 PR #159 — tar mode builds the whole archive
   // in memory before adapter.writeFile because the v0.12.8 adapter
@@ -1229,6 +1267,11 @@ function bundleAdapterStorage(opts) {
           : t.toBuffer();
         if (cryptoStrategy === "recipient") {
           payloadBytes = archiveLazy().wrap(payloadBytes, { recipient: recipient });
+        } else if (cryptoStrategy === "passphrase") {
+          payloadBytes = await archiveLazy().wrapWithPassphrase(payloadBytes, {
+            passphrase:     passphrase,
+            minEntropyBits: passphraseMinEntropyBits,
+          });
         }
         await adapter.writeFile(bundleId + keySuffix, payloadBytes);
         return;
@@ -1272,6 +1315,8 @@ function bundleAdapterStorage(opts) {
         var gzBytes = await adapter.readFile(bundleId + TAR_GZ_KEY_SUFFIX);
         if (cryptoStrategy === "recipient") {
           gzBytes = archiveLazy().unwrap(gzBytes, { recipient: recipient });
+        } else if (cryptoStrategy === "passphrase") {
+          gzBytes = await archiveLazy().unwrapWithPassphrase(gzBytes, { passphrase: passphrase });
         }
         var gzReader = archiveLazy().read.gz(archiveAdaptersLazy().buffer(gzBytes), {
           maxDecompressedBytes: maxBundleBytes,
@@ -1285,6 +1330,8 @@ function bundleAdapterStorage(opts) {
         var tarBytes = await adapter.readFile(bundleId + TAR_KEY_SUFFIX);
         if (cryptoStrategy === "recipient") {
           tarBytes = archiveLazy().unwrap(tarBytes, { recipient: recipient });
+        } else if (cryptoStrategy === "passphrase") {
+          tarBytes = await archiveLazy().unwrapWithPassphrase(tarBytes, { passphrase: passphrase });
         }
         var reader = archiveLazy().read.tar(archiveAdaptersLazy().buffer(tarBytes));
         await reader.extract({ destination: destDir });

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.12.10",
+  "version": "0.12.11",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.12.11.json

@@ -0,0 +1,39 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.12.11",
+  "date": "2026-05-23",
+  "headline": "`b.archive.wrapWithPassphrase` + `b.archive.unwrapWithPassphrase` — Argon2id + XChaCha20-Poly1305 archive envelope + `b.backup` `cryptoStrategy: \"passphrase\"` with HIPAA / PCI-DSS 128-bit entropy floor",
+  "summary": "Passphrase wrap lands as the second `b.archive` envelope strategy alongside v0.12.10's recipient wrap. `b.archive.wrapWithPassphrase(bytes, { passphrase, minEntropyBits })` produces a `BAWPP`-prefixed envelope under Argon2id (RFC 9106; framework-default 64 MiB / 3 iterations / 4 parallelism) key derivation with XChaCha20-Poly1305 AEAD; each envelope carries its own fresh salt in the wire format (5-byte magic + 1-byte version + 1-byte saltLen + salt + 24-byte nonce + ciphertext+tag) so KDF parameters can rotate in future minors without per-envelope version bumps. `b.archive.unwrapWithPassphrase(sealed, { passphrase })` verifies the `BAWPP` header before any Argon2id compute so non-envelope inputs fail with `archive-wrap/bad-magic` rather than burning the KDF on bad bytes. `b.backup.bundleAdapterStorage({ cryptoStrategy: \"passphrase\", passphrase })` composes the wrap layer transparently — bundle bytes hitting the adapter's `writeFile` are an opaque passphrase-derived envelope. Default `passphraseMinEntropyBits: 80` matches OWASP strong-password guidance; HIPAA + PCI-DSS postures raise the floor to 128 bits automatically (matching the framework's existing crypto-grade-password discipline for sealed-storage). The recipient strategy from v0.12.10 + passphrase strategy from v0.12.11 + plaintext strategy from v0.12.7 cover the operator's posture matrix: HIPAA / PCI-DSS pick recipient or passphrase; non-regulated deployments may stay on `\"none\"` when the storage layer is itself the protective boundary.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.archive.wrapWithPassphrase(bytes, { passphrase, minEntropyBits })` — Argon2id-derived archive envelope",
+          "body": "Composes `b.backupCrypto.encryptWithFreshSalt(bytes, passphrase)` (Argon2id KDF + XChaCha20-Poly1305 AEAD, fresh per-envelope salt) and prepends a 7-byte `BAWPP` envelope header (5-byte magic + 1-byte version + 1-byte saltLen) so format sniffers can identify passphrase wrap output without trial KDF work. Entropy estimate uses observed-alphabet bit-count (the standard NIST/OWASP character-class approximation). `minEntropyBits` defaults to 80; the gate refuses upfront with `archive-wrap/weak-passphrase` when the estimate falls short."
+        },
+        {
+          "title": "`b.archive.unwrapWithPassphrase(sealed, { passphrase })` — inverse with magic-check upfront",
+          "body": "Verifies the 7-byte `BAWPP` header (magic + version + saltLen) before any cryptographic work so non-envelope inputs (raw archives, recipient-wrap envelopes, truncated buffers) fail with `archive-wrap/bad-magic` / `archive-wrap/bad-version` / `archive-wrap/truncated-envelope` rather than wasting Argon2id compute. Routes through `b.backupCrypto.decryptWithPassphrase(encrypted, passphrase, saltHex)` so the framework's locked Argon2id parameters apply."
+        },
+        {
+          "title": "`b.backup.bundleAdapterStorage({ cryptoStrategy: \"passphrase\", passphrase })` — Argon2id-keyed bundle storage",
+          "body": "Composes `b.archive.wrapWithPassphrase` transparently — every `writeBundle` payload is wrapped before `adapter.writeFile`; every `readBundle` payload is unwrapped after `adapter.readFile`. The `passphraseMinEntropyBits` opt defaults to 80 (OWASP strong-password floor); HIPAA + PCI-DSS postures raise the floor to 128 bits automatically. Passphrase + directory format combination refused upfront (same contract as recipient + directory). Wire-format envelope on disk is opaque ciphertext — no information leakage about archive contents through the storage adapter."
+        },
+        {
+          "title": "HIPAA + PCI-DSS postures raise entropy floor to 128 bits under passphrase strategy",
+          "body": "`bundleAdapterStorage({ posture: \"hipaa\", cryptoStrategy: \"passphrase\", passphrase })` enforces `passphraseMinEntropyBits >= 128` regardless of the operator-supplied opt. The 128-bit floor matches the framework's existing crypto-grade-password discipline for sealed-storage cells. Operators sourcing passphrases from a CSPRNG (`b.crypto.generateBytes(16).toString(\"base64url\")` → ~128 bits) pass without issue; operators typing dictionary phrases trip the gate."
+        }
+      ]
+    },
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "Magic-check before KDF work — non-envelope inputs can't burn Argon2id compute",
+          "body": "Adversarial inputs that look like passphrase envelopes but aren't (random bytes, recipient envelopes, raw archives) fail at byte 0-4 (magic check) rather than after a 64 MiB Argon2id round. Operators handing user-supplied bundles to readBundle on a server with concurrent load get bounded refusal latency rather than worst-case KDF compute under a chosen-bytes attack."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/archive-wrap-passphrase.test.js

@@ -0,0 +1,207 @@
+"use strict";
+/**
+ * Layer 0 — b.archive.wrapWithPassphrase + b.archive.unwrapWithPassphrase
+ * + bundleAdapterStorage cryptoStrategy: "passphrase" + HIPAA / PCI-DSS
+ * entropy floor.
+ */
+
+var fs = require("node:fs");
+var path = require("node:path");
+var os = require("node:os");
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+
+var STRONG_PASSPHRASE = "aLongCorrectHorseBatteryStaple9876!Phrase";   // ~227 bits estimated
+
+async function testPassphraseRoundTrip() {
+  var src = Buffer.from("opaque archive bytes ".repeat(50));
+  var sealed = await b.archive.wrapWithPassphrase(src, {
+    passphrase: STRONG_PASSPHRASE,
+  });
+  check("wrapWithPassphrase: output carries BAWPP magic",
+    sealed.slice(0, 5).toString("ascii") === "BAWPP");
+  check("wrapWithPassphrase: output version byte present",
+    sealed[5] === 0x01);
+  var saltLen = sealed[6];
+  check("wrapWithPassphrase: saltLen byte sane (16-64 bytes typical)",
+    saltLen >= 16 && saltLen <= 64);
+  var recovered = await b.archive.unwrapWithPassphrase(sealed, {
+    passphrase: STRONG_PASSPHRASE,
+  });
+  check("wrapWithPassphrase → unwrap: bytes round-trip losslessly",
+    recovered.equals(src));
+}
+
+async function testPassphraseRefusesBadMagic() {
+  var notSealed = Buffer.from("this is not a passphrase envelope");
+  var refused = null;
+  try {
+    await b.archive.unwrapWithPassphrase(notSealed, { passphrase: STRONG_PASSPHRASE });
+  } catch (e) { refused = e; }
+  check("unwrapWithPassphrase: non-BAWPP input refused with bad-magic",
+    refused && /bad-magic/.test(refused.code || refused.message));
+}
+
+async function testPassphraseRefusesWrongPassword() {
+  var sealed = await b.archive.wrapWithPassphrase(Buffer.from("PHI"), {
+    passphrase: STRONG_PASSPHRASE,
+  });
+  var refused = null;
+  try {
+    await b.archive.unwrapWithPassphrase(sealed, {
+      passphrase: STRONG_PASSPHRASE + "-WRONG",
+    });
+  } catch (e) { refused = e; }
+  check("unwrapWithPassphrase: wrong passphrase refused",
+    refused && /decrypt-failed/.test(refused.code || refused.message));
+}
+
+async function testPassphraseRefusesWeakEntropy() {
+  var refused = null;
+  try {
+    await b.archive.wrapWithPassphrase(Buffer.from("bytes"), {
+      passphrase: "weak",
+      minEntropyBits: 80,
+    });
+  } catch (e) { refused = e; }
+  check("wrapWithPassphrase: weak passphrase refused under default floor",
+    refused && /weak-passphrase/.test(refused.code || refused.message));
+}
+
+async function testBackupPassphraseRoundTrip() {
+  var src = fs.mkdtempSync(path.join(os.tmpdir(), "bjs-pp-src-"));
+  var dest = fs.mkdtempSync(path.join(os.tmpdir(), "bjs-pp-dest-"));
+  var verify = path.join(os.tmpdir(), "bjs-pp-verify-" + Date.now());
+  try {
+    fs.writeFileSync(path.join(src, "phi.json"), "{\"patient\":42}");
+    var storage = b.backup.bundleAdapterStorage({
+      adapter:        b.backup.bundleAdapterStorage.fsAdapter({ root: dest }),
+      format:         "tar.gz",
+      cryptoStrategy: "passphrase",
+      passphrase:     STRONG_PASSPHRASE,
+    });
+    var bundleId = "2026-05-23T20-15-00-000Z-dddddddd";
+    await storage.writeBundle(bundleId, src);
+    var sealed = fs.readFileSync(path.join(dest, bundleId, "bundle.tar.gz"));
+    check("backup passphrase: bundle on disk carries BAWPP magic",
+      sealed.slice(0, 5).toString("ascii") === "BAWPP");
+    await storage.readBundle(bundleId, verify);
+    check("backup passphrase: phi.json round-trips after unwrap+gunzip+untar",
+      fs.readFileSync(path.join(verify, "phi.json"), "utf-8") === "{\"patient\":42}");
+  } finally {
+    try { fs.rmSync(src,    { recursive: true, force: true }); } catch (_e) { /* ignore */ }
+    try { fs.rmSync(dest,   { recursive: true, force: true }); } catch (_e) { /* ignore */ }
+    try { fs.rmSync(verify, { recursive: true, force: true }); } catch (_e) { /* ignore */ }
+  }
+}
+
+async function testBackupPassphraseHipaaRequires128() {
+  // HIPAA posture should raise the entropy floor to 128. A 100-bit-
+  // estimated passphrase that would pass the 80-bit default must
+  // refuse under HIPAA.
+  var src = fs.mkdtempSync(path.join(os.tmpdir(), "bjs-pp-hipaa-"));
+  try {
+    fs.writeFileSync(path.join(src, "phi.json"), "{}");
+    var storage = b.backup.bundleAdapterStorage({
+      adapter:        b.backup.bundleAdapterStorage.fsAdapter({ root: os.tmpdir() }),
+      format:         "tar.gz",
+      posture:        "hipaa",
+      cryptoStrategy: "passphrase",
+      passphrase:     "weakish-passphrase17",   // ~100-110 bits estimated
+    });
+    var refused = null;
+    try { await storage.writeBundle("2026-05-23T20-30-00-000Z-eeeeeeee", src); } catch (e) { refused = e; }
+    check("backup passphrase: HIPAA raises entropy floor to 128 bits",
+      refused && /weak-passphrase/.test(refused.code || refused.message));
+  } finally {
+    try { fs.rmSync(src, { recursive: true, force: true }); } catch (_e) { /* ignore */ }
+  }
+}
+
+async function testPassphraseNanInfinityRefused() {
+  // Codex P1 on v0.12.11 PR #162 — typeof NaN === "number" passed
+  // the old typeof gate but NaN < 128 is false, bypassing entropy
+  // floor under HIPAA. Same for Infinity.
+  var refused = null;
+  try {
+    await b.archive.wrapWithPassphrase(Buffer.from("bytes"), {
+      passphrase:     "weak",
+      minEntropyBits: NaN,
+    });
+  } catch (e) { refused = e; }
+  check("wrapWithPassphrase: NaN minEntropyBits refused upfront",
+    refused && /bad-arg/.test(refused.code || refused.message));
+  var refused2 = null;
+  try {
+    b.backup.bundleAdapterStorage({
+      adapter:        b.backup.bundleAdapterStorage.fsAdapter({ root: os.tmpdir() }),
+      format:         "tar.gz",
+      cryptoStrategy: "passphrase",
+      passphrase:     "weak",
+      posture:        "hipaa",
+      passphraseMinEntropyBits: NaN,
+    });
+  } catch (e) { refused2 = e; }
+  check("backup: NaN passphraseMinEntropyBits refused so HIPAA floor can't bypass",
+    refused2 && /bad-arg/.test(refused2.code || refused2.message));
+}
+
+async function testBufferPassphraseEntropyFromBytes() {
+  // Codex P2 on v0.12.11 PR #162 — Buffer passphrases shouldn't
+  // be UTF-8 decoded for entropy estimation. A 32-byte CSPRNG
+  // buffer should pass an 80-bit floor; the prior code path
+  // UTF-8 decoded the random bytes and false-rejected.
+  var randomBuf = b.crypto.generateBytes(32);  // 32 unique random bytes typically → ~32 * 5 = 160 bits
+  var sealed = await b.archive.wrapWithPassphrase(Buffer.from("PHI"), {
+    passphrase:     randomBuf,
+    minEntropyBits: 80,
+  });
+  check("wrapWithPassphrase: Buffer passphrase scored from byte alphabet, not UTF-8 decoding",
+    sealed.slice(0, 5).toString("ascii") === "BAWPP");
+  // All-zero buffer must still fail — zero alphabet = zero entropy.
+  var refused = null;
+  try {
+    await b.archive.wrapWithPassphrase(Buffer.from("bytes"), {
+      passphrase:     Buffer.alloc(64),  // all zeros — one unique byte → 0 bits entropy
+      minEntropyBits: 80,
+    });
+  } catch (e) { refused = e; }
+  check("wrapWithPassphrase: all-zero Buffer passphrase refused (zero byte-alphabet)",
+    refused && /weak-passphrase/.test(refused.code || refused.message));
+}
+
+async function testBackupPassphraseDirectoryRefused() {
+  var refused = null;
+  try {
+    b.backup.bundleAdapterStorage({
+      adapter:        b.backup.bundleAdapterStorage.fsAdapter({ root: os.tmpdir() }),
+      format:         "directory",
+      cryptoStrategy: "passphrase",
+      passphrase:     STRONG_PASSPHRASE,
+    });
+  } catch (e) { refused = e; }
+  check("backup passphrase: passphrase + directory format refused upfront",
+    refused && /passphrase-strategy-needs-bundled-format/.test(refused.code || refused.message));
+}
+
+async function run() {
+  await testPassphraseRoundTrip();
+  await testPassphraseRefusesBadMagic();
+  await testPassphraseRefusesWrongPassword();
+  await testPassphraseRefusesWeakEntropy();
+  await testPassphraseNanInfinityRefused();
+  await testBufferPassphraseEntropyFromBytes();
+  await testBackupPassphraseRoundTrip();
+  await testBackupPassphraseHipaaRequires128();
+  await testBackupPassphraseDirectoryRefused();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("[archive-wrap-passphrase] OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -2239,6 +2239,15 @@ async function testNoDuplicateCodeBlocks() {
       ],
       reason: "v0.12.8 — `_normalizeEntryTypePolicy` shape is genuinely duplicated between archive-read.js + archive-tar-read.js — both copy DEFAULT_ENTRY_TYPE_POLICY and merge with operator opts. Could extract to a shared lib/_archive-policy.js helper in a future patch; for v0.12.8 keeping the duplication so the format-specific entry-type vocabulary (zip's external-attrs vs tar's typeflag) stays close to the reader that uses it. archive.js:writeTo is the unrelated third file in the dup cluster — its toBuffer + writeFileSync shape happens to share the 50-token shingle by coincidence (writeTo is the legacy ZIP write-to-path helper, not policy-related).",
     },
+    {
+      mode:  "family-subset",
+      files: [
+        "lib/backup/index.js:bundleAdapterStorage",
+        "lib/importmap-integrity.js:build",
+        "lib/metrics.js:shadowRegistry",
+      ],
+      reason: "v0.12.11 — bundleAdapterStorage's opts-validation cascade (cryptoStrategy / recipient / passphrase / posture branches each with their own throw-on-bad-shape gates) reaches 50-token duplication with importmap-integrity.build's manifest-shape cascade + metrics.shadowRegistry's registry-config cascade by coincidence of the chained-if-throw-Error pattern. Each cascade carries primitive-specific semantics (crypto strategy vs SRI hash list vs shadow-collector config); extracting would require a generic options-cascade helper that loses the per-primitive error codes operators grep for in audit logs.",
+    },
     {
       mode:  "family-subset",
       files: [
@@ -5615,6 +5624,19 @@ var KNOWN_ANTIPATTERNS = [
     reason: "Codex P1 on v0.12.7 PR #158 — archive-read.extract used renameSync to atomically place each decompressed entry at its canonical destination + tracked written[].path for catch-block cleanup. When the destination directory was non-empty, the rename silently overwrote operator files; on extract abort, the cleanup deleted them. Fix: refuse upfront if destination path exists, force operators to use a fresh / empty subtree. Detector locks the shape: any extract code that tracks resolvedPath for catch-block cleanup MUST carry a `destination-exists` refusal in the same file.",
   },
 
+  // Codex P1 on v0.12.11 PR #162 — surfaced the NaN/Infinity bypass
+  // through `typeof X === "number" ? X : default` gating. The
+  // pattern exists widely in the codebase (~29 call sites at the
+  // time the finding was filed) — most are framework-controlled
+  // (numeric byte-slot reads from Buffers, enum-tag checks) where
+  // NaN-vs-number is moot. Adding a static detector here would
+  // cause widespread false positives without surfacing the actual
+  // operator-opt-controlled bug pattern. The runtime gate in
+  // lib/backup/index.js + lib/archive-wrap.js IS the fix; a
+  // future patch can sweep the 29 sites if any are found to be
+  // operator-opt controlled. See feedback_typeof_number_nan_bypass
+  // (write this as a memory if it recurs).
+
   {
     // Codex P2 on v0.12.10 PR #161 — partial recipient objects
     // ({ publicKey } alone) silently triggered b.crypto.encrypt's

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.0.108",
+  "version": "0.0.110",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {