@blamejs/blamejs-shop 0.1.31 → 0.1.33

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.12.69",
-      "tag": "v0.12.69",
+      "version": "0.13.1",
+      "tag": "v0.13.1",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -6,8 +6,16 @@ Pre-1.0 the surface is intentionally evolving — every release may
 change something operators depend on. Read each entry before
 upgrading across more than a few patches at a time.
 
+## v0.13.x
+
+- v0.13.1 (2026-05-26) — **`b.worm` — write-once-read-many retention.** Store records that cannot be altered or deleted before a retention period elapses — the immutable-storage discipline regulators require (SEC 17a-4(f), CFTC 1.31, FINRA 4511). b.worm.create(opts) returns a WORM store that enforces, on every mutating call, that a record is not overwritten or deleted while it is within its retainUntil window or under a legal hold. Two modes mirror cloud Object-Lock: compliance (the default — no one, including the operator, can delete before expiry) and governance (a privileged caller may override with an audited reason). Retention can only be extended, never shortened; every record carries a SHA3-512 digest that get verifies, so tampering with the underlying bytes is detected on read; every allow/refuse decision is audited. Storage is pluggable via a synchronous store adapter, so the policy layer sits over a sealed DB table, a filesystem, or any non-S3 backend — the store-agnostic, application-level companion to b.objectStore's S3 Object Lock, with content-integrity verification that native Object Lock does not provide. **Added:** *`b.worm.create` — write-once-read-many retention* — Returns a store with `put` / `get` / `delete` / `extendRetention` / `placeLegalHold` / `releaseLegalHold` / `list`. `put` is write-once (an overwrite of a retained or held record is refused); `delete` is gated by the retention window, legal holds, and the mode (`compliance` refuses any early delete; `governance` allows a privileged override with a required, audited reason); `extendRetention` is extend-only; `get` verifies the stored SHA3-512 digest and throws `worm/tampered` on a mismatch. Storage is a pluggable synchronous adapter (`get` / `set` / `delete` / `has` / `keys`), defaulting to in-memory for tests. Use it for SEC 17a-4 / CFTC / FINRA immutable records on backends without native Object Lock; `b.objectStore` remains the path for S3 Object Lock.
+
+- v0.13.0 (2026-05-26) — **`b.crypto.oprf` — RFC 9497 Oblivious PRFs.** Compute F(serverKey, input) without the server learning the input and without the client learning the key — the Oblivious PRF primitive behind password hardening (the server peppers a password it never sees), private set intersection, and Privacy Pass. b.crypto.oprf.suite(name) returns an RFC 9497 ciphersuite — ristretto255-sha512, p256-sha256, p384-sha384, or p521-sha512 — each exposing the base oprf mode and the verifiable voprf mode (a DLEQ proof lets the client confirm the server used the key committed in its public key). The client blinds its input, the server blind-evaluates with its secret key, and the client finalizes by un-blinding and hashing; because un-blinding cancels the blind, the output depends only on key and input. Validated byte-for-byte against the RFC 9497 Appendix-A test vectors. Group and hash-to-curve operations come from the newly vendored @noble/curves (Paul Miller, MIT) — the same maintainer as the framework's existing vendored @noble/post-quantum and @noble/ciphers, with no added npm runtime dependency. **Added:** *`b.crypto.oprf` — RFC 9497 OPRF / VOPRF* — `suite(name)` returns `{ name, oprf, voprf }` for one of the four RFC 9497 ciphersuites (ristretto255-SHA512 / P-256-SHA256 / P-384-SHA384 / P-521-SHA512). The `oprf` (base) mode provides `deriveKeyPair` / `generateKeyPair` / `blind` / `blindEvaluate` / `finalize` / `evaluate`; `voprf` (verifiable) adds a DLEQ proof so the client can prove the server used the committed key. Use it for password hardening, private set intersection, and OPRF-based tokens. Verified against the RFC 9497 Appendix-A vectors. The partially-oblivious `poprf` mode is not yet exposed (the vendored `@noble/curves` does not implement it) and will follow upstream. · *Vendored `@noble/curves`* — `@noble/curves` 2.2.0 (Paul Miller, MIT) is vendored under `lib/vendor/` (no npm runtime dependency), supplying the ristretto255 / NIST-curve group and hash-to-curve operations behind `b.crypto.oprf`. It joins the existing vendored `@noble/post-quantum` and `@noble/ciphers` from the same maintainer; tracked in the SBOM and the vendor-currency gate.
+
 ## v0.12.x
 
+- v0.12.70 (2026-05-26) — **`b.network.dns.tsig` — RFC 8945 DNS transaction signatures.** Sign and verify DNS messages with RFC 8945 TSIG — the shared-key HMAC that authenticates a DNS transaction (zone transfers, dynamic updates, query/response pairs) and proves it was not altered in flight. b.network.dns.tsig.sign(message, opts) appends a TSIG resource record and returns the signed wire; b.network.dns.tsig.verify(message, opts) locates the TSIG record, recomputes the HMAC over the RFC 8945 §4.3.3 digest, compares it in constant time, and checks the time window (valid only within `fudge` seconds of `timeSigned`). HMAC-SHA-256 is the default; SHA-384 / SHA-512 are available and the broken HMAC-MD5 / HMAC-SHA-1 algorithms are refused unless allowLegacy is set. Signing a response chains the request MAC into the digest. Verified byte-for-byte against dnspython 2.8.0 reference signatures. TSIG completes the DNS-trust set alongside the existing DNSSEC (zone-data authentication) and DANE primitives — DNSSEC authenticates the data end-to-end, TSIG authenticates a single hop's transaction with a pre-shared key. **Added:** *`b.network.dns.tsig.sign` / `b.network.dns.tsig.verify`* — RFC 8945 TSIG transaction authentication. `sign(message, { keyName, secret, algorithm, fudge, time, requestMac })` appends a TSIG RR to a DNS wire message and returns `{ wire, mac }`; `verify(message, { keys, now, requestMac })` returns `{ valid, keyName, algorithm, timeSigned, error, macValid, timeValid, reason }`, with a constant-time MAC compare (via `b.crypto.timingSafeEqual`), a `fudge`-second time-window check, truncated-MAC handling per §5.2.2.1, and request-MAC chaining for responses (§5.4.1). HMAC-SHA-256 default; HMAC-SHA-384 / SHA-512 supported; HMAC-MD5 / HMAC-SHA-1 refused unless `allowLegacy: true`. The transaction-level companion to `b.network.dns.dnssec` and `b.network.dns.dane`.
+
 - v0.12.69 (2026-05-26) — **`b.middleware.botGuard` no longer blocks browsers that omit Sec-Fetch-Mode.** b.middleware.botGuard treated a missing Sec-Fetch-Mode header as a bot signal and returned 403 Forbidden, which refused legitimate browsers on any origin where the browser does not emit Fetch Metadata: every plain-HTTP non-localhost origin (Umbrel apps, LAN and *.local reverse-proxy deployments) and Safari before 16.4 even over HTTPS. Browsers only send Sec-Fetch-* in a secure context, so its absence is normal there — not a bot. Sec-Fetch-Mode is now advisory only: it never blocks, and it sets req.suspectedBot in mode:"tag" only on a secure-context HTML GET where a modern browser would have sent it. Drive-by bots are still blocked by the missing-Accept-Language and User-Agent heuristics. No configuration change is needed; if you had widened skipPaths or disabled bot-guard to work around this, you can revert that. **Fixed:** *`b.middleware.botGuard` no longer 403s browsers over plain HTTP or older Safari* — A missing `Sec-Fetch-Mode` was a blocking heuristic, but browsers omit Fetch Metadata outside a secure context (every plain-HTTP non-localhost origin — Umbrel, LAN, `*.local` proxies) and Safari < 16.4 omits it even over HTTPS. Those legitimate browsers were refused with `403 Forbidden`. `Sec-Fetch-Mode` is now advisory: it never blocks, and only sets `req.suspectedBot` in `mode: "tag"` on a secure-context HTML GET. The `Accept-Language` and User-Agent heuristics (which catch the same bots) are unchanged. **Detectors:** *reserved-hostname trailing-dot detector recognizes regex strips* — The codebase-patterns gate that requires stripping the RFC 1034 trailing root-zone dot before a reserved-hostname comparison now also recognizes end-anchored regex strips (`.replace(/\.$/, …)`), not only the `charAt` / `while`-loop forms.
 
 - v0.12.68 (2026-05-26) — **`b.jwk` — RFC 7638 JWK thumbprint.** Compute the RFC 7638 thumbprint of a JSON Web Key — the canonical base64url(SHA-256(canonical-JSON)) identifier used to name a key (DPoP jkt bindings, ACME account-key thumbprints, DBSC session pins, kid derivation). b.jwk.thumbprint(jwk) returns the digest; b.jwk.canonicalize(jwk) returns the exact JSON that is hashed — only the key-type's required members, member names in lexicographic order, no whitespace, so the same key always yields the same thumbprint regardless of how its JWK was serialized. The standard key types are supported (EC, RSA, oct, OKP per RFC 8037) plus AKP, the IANA key type Node uses for ML-DSA / SLH-DSA post-quantum public keys; SHA-256 is the default, with hash: "sha384" | "sha512" for RFC 9278 thumbprint-with-hash. Verified against the RFC 7638 §3.1 worked example. b.auth.dpop, b.acme, and b.dbsc now compute their thumbprints through this primitive. **Added:** *`b.jwk.thumbprint` / `b.jwk.canonicalize`* — RFC 7638 JWK thumbprint. `thumbprint(jwk, opts)` returns `base64url(hash(canonical-JSON))` — only the key-type's required members feed the hash, so optional fields (`kid`, `use`, `alg`, …) never change the result. `canonicalize(jwk)` returns the canonical JSON string itself. Supports EC / RSA / oct / OKP and the AKP post-quantum key type; SHA-256 default, `hash` selects SHA-384 / SHA-512. Throws `JwkError` on an invalid key or unknown hash. **Changed:** *DPoP, ACME, and DBSC compose `b.jwk`* — `b.auth.dpop` (the `jkt` proof-key thumbprint), `b.acme` (the RFC 8555 account-key authorization), and `b.dbsc` (the session-pin thumbprint) now compute RFC 7638 thumbprints through `b.jwk` instead of carrying their own implementations. Behavior is unchanged — DPoP still refuses symmetric key types, and each surface keeps its own error codes.

package/lib/vendor/blamejs/README.md

@@ -89,8 +89,10 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 - **Workflow gates** — break-glass column gates with second-factor + audit (`b.breakGlass`); two-person-rule m-of-n approval with cooling-off lock + cancellation (`b.dualControl`)
 - **Financial / Open Banking** — FAPI 2.0 Final composite posture (PAR + PKCE-S256 + DPoP-or-mTLS + RFC 9207); runtime enforcement helpers `b.fapi2.assertCallback` (refuses missing iss + bare-param under message-signing) and `b.fapi2.assertAuthzRequest` (refuses non-JAR); CFPB §1033 / FDX 6.0 consumer-financial-data-sharing wrapper (`b.fdx`)
 - **Data-subject coordination** — cross-table export / rectify / erase / restrict / objection (`b.subject`, `b.subject.eraseHard`); subject-level legal-hold registry consulted by erase + retention paths (FRCP Rule 26/37(e), GDPR Art 17(3)(e), SEC Rule 17a-4, HIPAA §164.530(j)(2)) (`b.legalHold`)
+- **WORM retention** — write-once-read-many records over any backing store (`b.worm.create`): `compliance` / `governance` Object-Lock modes, extend-only `retainUntil`, legal holds, and a tamper-evident SHA3-512 digest verified on read — the store-agnostic application-level companion to `b.objectStore`'s S3 Object Lock, for sealed-DB / filesystem / non-S3 backends (SEC 17a-4(f), CFTC 1.31, FINRA 4511)
 - **Account safety** — adaptive bot-challenge staircase (`b.authBotChallenge`); session-to-device-posture binding with fail-closed verify (`b.sessionDeviceBinding`)
 - **Anonymous authorization** — Privacy Pass origin side (RFC 9577/9578 — `b.privacyPass`): issue a `WWW-Authenticate: PrivateToken` challenge and verify a presented Blind-RSA (type 0x0002) token against the issuer public key, with no issuer callback and no client identity
+- **Oblivious PRF** — RFC 9497 OPRF / VOPRF (`b.crypto.oprf.suite`): learn `F(serverKey, input)` without the server seeing the input — the primitive behind password hardening (pepper a password the server never sees), private set intersection, and Privacy Pass; `oprf` (base) + `voprf` (verifiable, DLEQ-proof) modes over ristretto255-SHA512 / P-256 / P-384 / P-521; validated against the RFC 9497 Appendix-A vectors
 ### Crypto
 
 - **At-rest envelope** — envelope-versioned PQC (ML-KEM-1024 + P-384 hybrid, XChaCha20-Poly1305, SHAKE256); vault sealing (`b.crypto`, `b.vault`)
@@ -131,7 +133,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
   - In-process CIDR fence (`b.middleware.networkAllowlist`)
   - `Cache-Control: no-store` on every 401 from `requireAuth` / `requireAal` / `requireStepUp` per RFC 9111 §5.2.2.5
 - **Outbound HTTP client** — HTTP/1.1 + HTTP/2 with SSRF gate (cloud-metadata IPs hard-denied; private / loopback / link-local overridable per call); scheme + userinfo + per-host destination allowlist; redirects, multipart, interceptors, progress, encrypted cookie jar (`b.httpClient`, `b.ssrfGuard`, `b.safeUrl`)
-- **Network configurability (`b.network`)** — env-driven NTP / NTS (RFC 8915), IPv4/IPv6 NTP, DNS with IPv6 / DoH / DoT (private-CA pinning) / cache / lookup timeout; local DNSSEC signature verification (RFC 4035 — `b.network.dns.dnssec.verifyRrset` over a canonicalised RRset against RSA / ECDSA P-256·P-384 / Ed25519 DNSKEYs, plus DS-digest + key-tag, plus `verifyDenial` for NSEC / NSEC3 (RFC 5155) NXDOMAIN / NODATA proofs with iteration caps + Opt-Out handling, plus `verifyChain` to validate a full root→TLD→zone delegation chain against the pinned IANA root anchors) so a resolver client can verify both positive and negative answers instead of trusting the upstream AD bit; DANE / TLSA certificate matching (RFC 6698/7671 — `b.network.dns.dane.matchCertificate`) to pin a service's key through DNSSEC instead of a public CA; outbound HTTP proxy (`HTTP_PROXY` / `HTTPS_PROXY` / `NO_PROXY`); runtime DPI trust-store CA additions; application-level heartbeats; TCP socket defaults
+- **Network configurability (`b.network`)** — env-driven NTP / NTS (RFC 8915), IPv4/IPv6 NTP, DNS with IPv6 / DoH / DoT (private-CA pinning) / cache / lookup timeout; local DNSSEC signature verification (RFC 4035 — `b.network.dns.dnssec.verifyRrset` over a canonicalised RRset against RSA / ECDSA P-256·P-384 / Ed25519 DNSKEYs, plus DS-digest + key-tag, plus `verifyDenial` for NSEC / NSEC3 (RFC 5155) NXDOMAIN / NODATA proofs with iteration caps + Opt-Out handling, plus `verifyChain` to validate a full root→TLD→zone delegation chain against the pinned IANA root anchors) so a resolver client can verify both positive and negative answers instead of trusting the upstream AD bit; DANE / TLSA certificate matching (RFC 6698/7671 — `b.network.dns.dane.matchCertificate`) to pin a service's key through DNSSEC instead of a public CA; TSIG transaction signatures (RFC 8945 — `b.network.dns.tsig.sign` / `verify`) for shared-key HMAC authentication of zone transfers, dynamic updates, and query/response pairs, with constant-time MAC compare + fudge-window check (verified against dnspython); outbound HTTP proxy (`HTTP_PROXY` / `HTTPS_PROXY` / `NO_PROXY`); runtime DPI trust-store CA additions; application-level heartbeats; TCP socket defaults
 - **Error pages** — operator-rendered, no app-frame leakage (`b.errorPage`)
 ### Defensive parsers
 

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.12.69",
-  "createdAt": "2026-05-26T14:58:13.295Z",
+  "frameworkVersion": "0.13.1",
+  "createdAt": "2026-05-26T20:56:45.702Z",
   "exports": {
     "a2a": {
       "type": "object",
@@ -13951,6 +13951,23 @@
           "type": "function",
           "arity": 3
         },
+        "oprf": {
+          "type": "object",
+          "members": {
+            "OprfError": {
+              "type": "function",
+              "arity": 4
+            },
+            "SUITES": {
+              "type": "instance",
+              "ctorName": "Array"
+            },
+            "suite": {
+              "type": "function",
+              "arity": 1
+            }
+          }
+        },
         "randomInt": {
           "type": "function",
           "arity": 2
@@ -42208,6 +42225,69 @@
               "type": "function",
               "arity": 1
             },
+            "tsig": {
+              "type": "object",
+              "members": {
+                "ALGORITHMS": {
+                  "type": "object",
+                  "members": {
+                    "hmac-sha224": {
+                      "type": "primitive",
+                      "valueType": "string"
+                    },
+                    "hmac-sha256": {
+                      "type": "primitive",
+                      "valueType": "string"
+                    },
+                    "hmac-sha384": {
+                      "type": "primitive",
+                      "valueType": "string"
+                    },
+                    "hmac-sha512": {
+                      "type": "primitive",
+                      "valueType": "string"
+                    }
+                  }
+                },
+                "ERROR": {
+                  "type": "object",
+                  "members": {
+                    "BADKEY": {
+                      "type": "primitive",
+                      "valueType": "number"
+                    },
+                    "BADSIG": {
+                      "type": "primitive",
+                      "valueType": "number"
+                    },
+                    "BADTIME": {
+                      "type": "primitive",
+                      "valueType": "number"
+                    },
+                    "BADTRUNC": {
+                      "type": "primitive",
+                      "valueType": "number"
+                    },
+                    "NOERROR": {
+                      "type": "primitive",
+                      "valueType": "number"
+                    }
+                  }
+                },
+                "TsigError": {
+                  "type": "function",
+                  "arity": 4
+                },
+                "sign": {
+                  "type": "function",
+                  "arity": 2
+                },
+                "verify": {
+                  "type": "function",
+                  "arity": 2
+                }
+              }
+            },
             "useDesignatedResolvers": {
               "type": "function",
               "arity": 1
@@ -50270,6 +50350,23 @@
         }
       }
     },
+    "worm": {
+      "type": "object",
+      "members": {
+        "MODES": {
+          "type": "instance",
+          "ctorName": "Array"
+        },
+        "WormError": {
+          "type": "function",
+          "arity": 4
+        },
+        "create": {
+          "type": "function",
+          "arity": 1
+        }
+      }
+    },
     "wsClient": {
       "type": "object",
       "members": {

package/lib/vendor/blamejs/index.js

@@ -57,6 +57,7 @@ var crypto = require("./lib/crypto");
 // remembering separate top-level namespaces. Implementations live in
 // the dedicated lib files; these are thin aliases.
 crypto.hpke = require("./lib/crypto-hpke");
+crypto.oprf = require("./lib/crypto-oprf");
 // Both PQ-HPKE drafts behind one opt-in sub-namespace — see
 // lib/crypto-hpke-pq.js. Operators that need a draft-codepoint
 // shape reach for b.crypto.hpke.pq.connolly / .wg explicitly; the
@@ -371,6 +372,7 @@ var fileUpload = require("./lib/file-upload");
 var dualControl = require("./lib/dual-control");
 var retention = require("./lib/retention");
 var legalHold = require("./lib/legal-hold");
+var worm = require("./lib/worm");
 var network = require("./lib/network");
 var cloudEvents = require("./lib/cloud-events");
 var dsr = require("./lib/dsr");
@@ -709,6 +711,7 @@ module.exports = {
   dualControl:      dualControl,
   retention:        retention,
   legalHold:        legalHold,
+  worm:             worm,
   network:          network,
   cloudEvents:      cloudEvents,
   dsr:              dsr,

package/lib/vendor/blamejs/lib/crypto-oprf.js

@@ -0,0 +1,110 @@
+"use strict";
+/**
+ * @module b.crypto.oprf
+ * @nav    Crypto
+ * @title  OPRF
+ *
+ * @intro
+ *   Oblivious Pseudorandom Functions per <a
+ *   href="https://www.rfc-editor.org/rfc/rfc9497">RFC 9497</a>. An OPRF lets
+ *   a client learn <code>F(serverKey, input)</code> — a keyed pseudorandom
+ *   value — <em>without</em> the server learning the input and without the
+ *   client learning the key. It is the primitive behind Privacy Pass
+ *   tokens, password-breach checks and password hardening (the server can
+ *   pepper a password without ever seeing it), and private set
+ *   intersection.
+ *
+ *   Two modes are provided per RFC 9497: <code>oprf</code> (base) and
+ *   <code>voprf</code> (verifiable — the client can prove the server used
+ *   the committed key, via a DLEQ proof carried in the evaluation). The
+ *   partially-oblivious <code>poprf</code> mode is not yet exposed: the
+ *   vendored <code>@noble/curves</code> does not implement it, so it will
+ *   be added when upstream ships it rather than stubbed here.
+ *   The base protocol is: the client <code>blind</code>s its input to a
+ *   group element, the server <code>blindEvaluate</code>s it with its
+ *   secret key, and the client <code>finalize</code>s by un-blinding and
+ *   hashing. Because un-blinding cancels the blind, the output depends only
+ *   on the key and the input — a server-side <code>evaluate</code> produces
+ *   the same value directly.
+ *
+ *   <code>suite(name)</code> returns the suite for one of the RFC 9497
+ *   ciphersuites — <code>ristretto255-sha512</code> (the Privacy Pass
+ *   default), <code>p256-sha256</code>, <code>p384-sha384</code>, or
+ *   <code>p521-sha512</code> — each exposing the three modes. Group and
+ *   hash-to-curve operations come from the vendored <code>@noble/curves</code>.
+ *   Byte arguments are <code>Uint8Array</code> / <code>Buffer</code>;
+ *   returned elements and outputs are <code>Uint8Array</code>.
+ *
+ * @card
+ *   RFC 9497 Oblivious PRFs — learn <code>F(key, input)</code> without the
+ *   server seeing the input (oprf / voprf / poprf modes; ristretto255 / P-256
+ *   / P-384 / P-521 suites). The primitive behind Privacy Pass, password
+ *   hardening, and private set intersection.
+ */
+
+var nobleCurves = require("./vendor/noble-curves.cjs");
+var { defineClass } = require("./framework-error");
+
+var OprfError = defineClass("OprfError", { alwaysPermanent: true });
+
+// RFC 9497 ciphersuite name → vendored @noble/curves OPRF implementation.
+var SUITE_IMPL = {
+  "ristretto255-sha512": nobleCurves.ristretto255_oprf,
+  "p256-sha256":         nobleCurves.p256_oprf,
+  "p384-sha384":         nobleCurves.p384_oprf,
+  "p521-sha512":         nobleCurves.p521_oprf,
+};
+var SUITES = Object.keys(SUITE_IMPL);
+
+/**
+ * @primitive  b.crypto.oprf.suite
+ * @signature  b.crypto.oprf.suite(name)
+ * @since      0.13.0
+ * @status     stable
+ *
+ * Return the RFC 9497 OPRF suite for <code>name</code> — one of
+ * <code>"ristretto255-sha512"</code>, <code>"p256-sha256"</code>,
+ * <code>"p384-sha384"</code>, or <code>"p521-sha512"</code> (case
+ * insensitive). The result is <code>{ name, oprf, voprf }</code>; each mode
+ * object has the protocol functions:
+ *
+ * <ul>
+ *   <li><code>deriveKeyPair(seed, info)</code> / <code>generateKeyPair()</code>
+ *       → <code>{ secretKey, publicKey }</code></li>
+ *   <li><code>blind(input)</code> → <code>{ blind, blinded }</code> (client)</li>
+ *   <li><code>oprf.blindEvaluate(secretKey, blinded)</code> → evaluation
+ *       element; <code>voprf.blindEvaluate(secretKey, publicKey, blinded)</code>
+ *       → <code>{ evaluated, proof }</code> (server)</li>
+ *   <li><code>oprf.finalize(input, blind, evaluation)</code> /
+ *       <code>voprf.finalize(input, blind, evaluated, blinded, publicKey, proof)</code>
+ *       → output bytes (client; <code>voprf</code> verifies the proof and
+ *       throws if it does not match <code>publicKey</code>)</li>
+ *   <li><code>evaluate(secretKey, input)</code> → output bytes (server-side,
+ *       non-oblivious — equals the client's <code>finalize</code> output)</li>
+ * </ul>
+ *
+ * The partially-oblivious <code>poprf</code> mode is intentionally absent
+ * (not implemented by the vendored <code>@noble/curves</code>). Throws
+ * <code>OprfError</code> for an unknown suite name.
+ *
+ * @example
+ *   var s = b.crypto.oprf.suite("ristretto255-sha512");
+ *   var kp = s.oprf.deriveKeyPair(seed, Buffer.from("my-app"));
+ *   var c  = s.oprf.blind(Buffer.from("user@example.com"));   // client
+ *   var ev = s.oprf.blindEvaluate(kp.secretKey, c.blinded);   // server
+ *   var out = s.oprf.finalize(Buffer.from("user@example.com"), c.blind, ev);
+ *   // out === s.oprf.evaluate(kp.secretKey, Buffer.from("user@example.com"))
+ */
+function suite(name) {
+  var impl = SUITE_IMPL[String(name).toLowerCase()];
+  if (!impl) throw new OprfError("oprf/bad-suite", "crypto.oprf.suite: unknown suite '" + name + "'; expected one of " + SUITES.join(", "));
+  // Expose only the modes the vendored @noble/curves implements (base +
+  // verifiable). poprf is omitted rather than surfaced as an empty stub.
+  return { name: impl.name, oprf: impl.oprf, voprf: impl.voprf };
+}
+
+module.exports = {
+  suite:    suite,
+  SUITES:   SUITES,
+  OprfError: OprfError,
+};