@blamejs/blamejs-shop 0.1.32 → 0.1.33

package/lib/vendor/blamejs/README.md

@@ -89,8 +89,10 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 - **Workflow gates** — break-glass column gates with second-factor + audit (`b.breakGlass`); two-person-rule m-of-n approval with cooling-off lock + cancellation (`b.dualControl`)
 - **Financial / Open Banking** — FAPI 2.0 Final composite posture (PAR + PKCE-S256 + DPoP-or-mTLS + RFC 9207); runtime enforcement helpers `b.fapi2.assertCallback` (refuses missing iss + bare-param under message-signing) and `b.fapi2.assertAuthzRequest` (refuses non-JAR); CFPB §1033 / FDX 6.0 consumer-financial-data-sharing wrapper (`b.fdx`)
 - **Data-subject coordination** — cross-table export / rectify / erase / restrict / objection (`b.subject`, `b.subject.eraseHard`); subject-level legal-hold registry consulted by erase + retention paths (FRCP Rule 26/37(e), GDPR Art 17(3)(e), SEC Rule 17a-4, HIPAA §164.530(j)(2)) (`b.legalHold`)
+- **WORM retention** — write-once-read-many records over any backing store (`b.worm.create`): `compliance` / `governance` Object-Lock modes, extend-only `retainUntil`, legal holds, and a tamper-evident SHA3-512 digest verified on read — the store-agnostic application-level companion to `b.objectStore`'s S3 Object Lock, for sealed-DB / filesystem / non-S3 backends (SEC 17a-4(f), CFTC 1.31, FINRA 4511)
 - **Account safety** — adaptive bot-challenge staircase (`b.authBotChallenge`); session-to-device-posture binding with fail-closed verify (`b.sessionDeviceBinding`)
 - **Anonymous authorization** — Privacy Pass origin side (RFC 9577/9578 — `b.privacyPass`): issue a `WWW-Authenticate: PrivateToken` challenge and verify a presented Blind-RSA (type 0x0002) token against the issuer public key, with no issuer callback and no client identity
+- **Oblivious PRF** — RFC 9497 OPRF / VOPRF (`b.crypto.oprf.suite`): learn `F(serverKey, input)` without the server seeing the input — the primitive behind password hardening (pepper a password the server never sees), private set intersection, and Privacy Pass; `oprf` (base) + `voprf` (verifiable, DLEQ-proof) modes over ristretto255-SHA512 / P-256 / P-384 / P-521; validated against the RFC 9497 Appendix-A vectors
 ### Crypto
 
 - **At-rest envelope** — envelope-versioned PQC (ML-KEM-1024 + P-384 hybrid, XChaCha20-Poly1305, SHAKE256); vault sealing (`b.crypto`, `b.vault`)
@@ -131,7 +133,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
   - In-process CIDR fence (`b.middleware.networkAllowlist`)
   - `Cache-Control: no-store` on every 401 from `requireAuth` / `requireAal` / `requireStepUp` per RFC 9111 §5.2.2.5
 - **Outbound HTTP client** — HTTP/1.1 + HTTP/2 with SSRF gate (cloud-metadata IPs hard-denied; private / loopback / link-local overridable per call); scheme + userinfo + per-host destination allowlist; redirects, multipart, interceptors, progress, encrypted cookie jar (`b.httpClient`, `b.ssrfGuard`, `b.safeUrl`)
-- **Network configurability (`b.network`)** — env-driven NTP / NTS (RFC 8915), IPv4/IPv6 NTP, DNS with IPv6 / DoH / DoT (private-CA pinning) / cache / lookup timeout; local DNSSEC signature verification (RFC 4035 — `b.network.dns.dnssec.verifyRrset` over a canonicalised RRset against RSA / ECDSA P-256·P-384 / Ed25519 DNSKEYs, plus DS-digest + key-tag, plus `verifyDenial` for NSEC / NSEC3 (RFC 5155) NXDOMAIN / NODATA proofs with iteration caps + Opt-Out handling, plus `verifyChain` to validate a full root→TLD→zone delegation chain against the pinned IANA root anchors) so a resolver client can verify both positive and negative answers instead of trusting the upstream AD bit; DANE / TLSA certificate matching (RFC 6698/7671 — `b.network.dns.dane.matchCertificate`) to pin a service's key through DNSSEC instead of a public CA; outbound HTTP proxy (`HTTP_PROXY` / `HTTPS_PROXY` / `NO_PROXY`); runtime DPI trust-store CA additions; application-level heartbeats; TCP socket defaults
+- **Network configurability (`b.network`)** — env-driven NTP / NTS (RFC 8915), IPv4/IPv6 NTP, DNS with IPv6 / DoH / DoT (private-CA pinning) / cache / lookup timeout; local DNSSEC signature verification (RFC 4035 — `b.network.dns.dnssec.verifyRrset` over a canonicalised RRset against RSA / ECDSA P-256·P-384 / Ed25519 DNSKEYs, plus DS-digest + key-tag, plus `verifyDenial` for NSEC / NSEC3 (RFC 5155) NXDOMAIN / NODATA proofs with iteration caps + Opt-Out handling, plus `verifyChain` to validate a full root→TLD→zone delegation chain against the pinned IANA root anchors) so a resolver client can verify both positive and negative answers instead of trusting the upstream AD bit; DANE / TLSA certificate matching (RFC 6698/7671 — `b.network.dns.dane.matchCertificate`) to pin a service's key through DNSSEC instead of a public CA; TSIG transaction signatures (RFC 8945 — `b.network.dns.tsig.sign` / `verify`) for shared-key HMAC authentication of zone transfers, dynamic updates, and query/response pairs, with constant-time MAC compare + fudge-window check (verified against dnspython); outbound HTTP proxy (`HTTP_PROXY` / `HTTPS_PROXY` / `NO_PROXY`); runtime DPI trust-store CA additions; application-level heartbeats; TCP socket defaults
 - **Error pages** — operator-rendered, no app-frame leakage (`b.errorPage`)
 ### Defensive parsers
 

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.12.69",
-  "createdAt": "2026-05-26T14:58:13.295Z",
+  "frameworkVersion": "0.13.1",
+  "createdAt": "2026-05-26T20:56:45.702Z",
   "exports": {
     "a2a": {
       "type": "object",
@@ -13951,6 +13951,23 @@
           "type": "function",
           "arity": 3
         },
+        "oprf": {
+          "type": "object",
+          "members": {
+            "OprfError": {
+              "type": "function",
+              "arity": 4
+            },
+            "SUITES": {
+              "type": "instance",
+              "ctorName": "Array"
+            },
+            "suite": {
+              "type": "function",
+              "arity": 1
+            }
+          }
+        },
         "randomInt": {
           "type": "function",
           "arity": 2
@@ -42208,6 +42225,69 @@
               "type": "function",
               "arity": 1
             },
+            "tsig": {
+              "type": "object",
+              "members": {
+                "ALGORITHMS": {
+                  "type": "object",
+                  "members": {
+                    "hmac-sha224": {
+                      "type": "primitive",
+                      "valueType": "string"
+                    },
+                    "hmac-sha256": {
+                      "type": "primitive",
+                      "valueType": "string"
+                    },
+                    "hmac-sha384": {
+                      "type": "primitive",
+                      "valueType": "string"
+                    },
+                    "hmac-sha512": {
+                      "type": "primitive",
+                      "valueType": "string"
+                    }
+                  }
+                },
+                "ERROR": {
+                  "type": "object",
+                  "members": {
+                    "BADKEY": {
+                      "type": "primitive",
+                      "valueType": "number"
+                    },
+                    "BADSIG": {
+                      "type": "primitive",
+                      "valueType": "number"
+                    },
+                    "BADTIME": {
+                      "type": "primitive",
+                      "valueType": "number"
+                    },
+                    "BADTRUNC": {
+                      "type": "primitive",
+                      "valueType": "number"
+                    },
+                    "NOERROR": {
+                      "type": "primitive",
+                      "valueType": "number"
+                    }
+                  }
+                },
+                "TsigError": {
+                  "type": "function",
+                  "arity": 4
+                },
+                "sign": {
+                  "type": "function",
+                  "arity": 2
+                },
+                "verify": {
+                  "type": "function",
+                  "arity": 2
+                }
+              }
+            },
             "useDesignatedResolvers": {
               "type": "function",
               "arity": 1
@@ -50270,6 +50350,23 @@
         }
       }
     },
+    "worm": {
+      "type": "object",
+      "members": {
+        "MODES": {
+          "type": "instance",
+          "ctorName": "Array"
+        },
+        "WormError": {
+          "type": "function",
+          "arity": 4
+        },
+        "create": {
+          "type": "function",
+          "arity": 1
+        }
+      }
+    },
     "wsClient": {
       "type": "object",
       "members": {

package/lib/vendor/blamejs/index.js

@@ -57,6 +57,7 @@ var crypto = require("./lib/crypto");
 // remembering separate top-level namespaces. Implementations live in
 // the dedicated lib files; these are thin aliases.
 crypto.hpke = require("./lib/crypto-hpke");
+crypto.oprf = require("./lib/crypto-oprf");
 // Both PQ-HPKE drafts behind one opt-in sub-namespace — see
 // lib/crypto-hpke-pq.js. Operators that need a draft-codepoint
 // shape reach for b.crypto.hpke.pq.connolly / .wg explicitly; the
@@ -371,6 +372,7 @@ var fileUpload = require("./lib/file-upload");
 var dualControl = require("./lib/dual-control");
 var retention = require("./lib/retention");
 var legalHold = require("./lib/legal-hold");
+var worm = require("./lib/worm");
 var network = require("./lib/network");
 var cloudEvents = require("./lib/cloud-events");
 var dsr = require("./lib/dsr");
@@ -709,6 +711,7 @@ module.exports = {
   dualControl:      dualControl,
   retention:        retention,
   legalHold:        legalHold,
+  worm:             worm,
   network:          network,
   cloudEvents:      cloudEvents,
   dsr:              dsr,

package/lib/vendor/blamejs/lib/crypto-oprf.js

@@ -0,0 +1,110 @@
+"use strict";
+/**
+ * @module b.crypto.oprf
+ * @nav    Crypto
+ * @title  OPRF
+ *
+ * @intro
+ *   Oblivious Pseudorandom Functions per <a
+ *   href="https://www.rfc-editor.org/rfc/rfc9497">RFC 9497</a>. An OPRF lets
+ *   a client learn <code>F(serverKey, input)</code> — a keyed pseudorandom
+ *   value — <em>without</em> the server learning the input and without the
+ *   client learning the key. It is the primitive behind Privacy Pass
+ *   tokens, password-breach checks and password hardening (the server can
+ *   pepper a password without ever seeing it), and private set
+ *   intersection.
+ *
+ *   Two modes are provided per RFC 9497: <code>oprf</code> (base) and
+ *   <code>voprf</code> (verifiable — the client can prove the server used
+ *   the committed key, via a DLEQ proof carried in the evaluation). The
+ *   partially-oblivious <code>poprf</code> mode is not yet exposed: the
+ *   vendored <code>@noble/curves</code> does not implement it, so it will
+ *   be added when upstream ships it rather than stubbed here.
+ *   The base protocol is: the client <code>blind</code>s its input to a
+ *   group element, the server <code>blindEvaluate</code>s it with its
+ *   secret key, and the client <code>finalize</code>s by un-blinding and
+ *   hashing. Because un-blinding cancels the blind, the output depends only
+ *   on the key and the input — a server-side <code>evaluate</code> produces
+ *   the same value directly.
+ *
+ *   <code>suite(name)</code> returns the suite for one of the RFC 9497
+ *   ciphersuites — <code>ristretto255-sha512</code> (the Privacy Pass
+ *   default), <code>p256-sha256</code>, <code>p384-sha384</code>, or
+ *   <code>p521-sha512</code> — each exposing the three modes. Group and
+ *   hash-to-curve operations come from the vendored <code>@noble/curves</code>.
+ *   Byte arguments are <code>Uint8Array</code> / <code>Buffer</code>;
+ *   returned elements and outputs are <code>Uint8Array</code>.
+ *
+ * @card
+ *   RFC 9497 Oblivious PRFs — learn <code>F(key, input)</code> without the
+ *   server seeing the input (oprf / voprf / poprf modes; ristretto255 / P-256
+ *   / P-384 / P-521 suites). The primitive behind Privacy Pass, password
+ *   hardening, and private set intersection.
+ */
+
+var nobleCurves = require("./vendor/noble-curves.cjs");
+var { defineClass } = require("./framework-error");
+
+var OprfError = defineClass("OprfError", { alwaysPermanent: true });
+
+// RFC 9497 ciphersuite name → vendored @noble/curves OPRF implementation.
+var SUITE_IMPL = {
+  "ristretto255-sha512": nobleCurves.ristretto255_oprf,
+  "p256-sha256":         nobleCurves.p256_oprf,
+  "p384-sha384":         nobleCurves.p384_oprf,
+  "p521-sha512":         nobleCurves.p521_oprf,
+};
+var SUITES = Object.keys(SUITE_IMPL);
+
+/**
+ * @primitive  b.crypto.oprf.suite
+ * @signature  b.crypto.oprf.suite(name)
+ * @since      0.13.0
+ * @status     stable
+ *
+ * Return the RFC 9497 OPRF suite for <code>name</code> — one of
+ * <code>"ristretto255-sha512"</code>, <code>"p256-sha256"</code>,
+ * <code>"p384-sha384"</code>, or <code>"p521-sha512"</code> (case
+ * insensitive). The result is <code>{ name, oprf, voprf }</code>; each mode
+ * object has the protocol functions:
+ *
+ * <ul>
+ *   <li><code>deriveKeyPair(seed, info)</code> / <code>generateKeyPair()</code>
+ *       → <code>{ secretKey, publicKey }</code></li>
+ *   <li><code>blind(input)</code> → <code>{ blind, blinded }</code> (client)</li>
+ *   <li><code>oprf.blindEvaluate(secretKey, blinded)</code> → evaluation
+ *       element; <code>voprf.blindEvaluate(secretKey, publicKey, blinded)</code>
+ *       → <code>{ evaluated, proof }</code> (server)</li>
+ *   <li><code>oprf.finalize(input, blind, evaluation)</code> /
+ *       <code>voprf.finalize(input, blind, evaluated, blinded, publicKey, proof)</code>
+ *       → output bytes (client; <code>voprf</code> verifies the proof and
+ *       throws if it does not match <code>publicKey</code>)</li>
+ *   <li><code>evaluate(secretKey, input)</code> → output bytes (server-side,
+ *       non-oblivious — equals the client's <code>finalize</code> output)</li>
+ * </ul>
+ *
+ * The partially-oblivious <code>poprf</code> mode is intentionally absent
+ * (not implemented by the vendored <code>@noble/curves</code>). Throws
+ * <code>OprfError</code> for an unknown suite name.
+ *
+ * @example
+ *   var s = b.crypto.oprf.suite("ristretto255-sha512");
+ *   var kp = s.oprf.deriveKeyPair(seed, Buffer.from("my-app"));
+ *   var c  = s.oprf.blind(Buffer.from("user@example.com"));   // client
+ *   var ev = s.oprf.blindEvaluate(kp.secretKey, c.blinded);   // server
+ *   var out = s.oprf.finalize(Buffer.from("user@example.com"), c.blind, ev);
+ *   // out === s.oprf.evaluate(kp.secretKey, Buffer.from("user@example.com"))
+ */
+function suite(name) {
+  var impl = SUITE_IMPL[String(name).toLowerCase()];
+  if (!impl) throw new OprfError("oprf/bad-suite", "crypto.oprf.suite: unknown suite '" + name + "'; expected one of " + SUITES.join(", "));
+  // Expose only the modes the vendored @noble/curves implements (base +
+  // verifiable). poprf is omitted rather than surfaced as an empty stub.
+  return { name: impl.name, oprf: impl.oprf, voprf: impl.voprf };
+}
+
+module.exports = {
+  suite:    suite,
+  SUITES:   SUITES,
+  OprfError: OprfError,
+};