@blamejs/blamejs-shop 0.1.32 → 0.1.34

package/lib/vendor/blamejs/release-notes/v0.13.0.json

@@ -0,0 +1,22 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.0",
+  "date": "2026-05-26",
+  "headline": "`b.crypto.oprf` — RFC 9497 Oblivious PRFs",
+  "summary": "Compute F(serverKey, input) without the server learning the input and without the client learning the key — the Oblivious PRF primitive behind password hardening (the server peppers a password it never sees), private set intersection, and Privacy Pass. b.crypto.oprf.suite(name) returns an RFC 9497 ciphersuite — ristretto255-sha512, p256-sha256, p384-sha384, or p521-sha512 — each exposing the base oprf mode and the verifiable voprf mode (a DLEQ proof lets the client confirm the server used the key committed in its public key). The client blinds its input, the server blind-evaluates with its secret key, and the client finalizes by un-blinding and hashing; because un-blinding cancels the blind, the output depends only on key and input. Validated byte-for-byte against the RFC 9497 Appendix-A test vectors. Group and hash-to-curve operations come from the newly vendored @noble/curves (Paul Miller, MIT) — the same maintainer as the framework's existing vendored @noble/post-quantum and @noble/ciphers, with no added npm runtime dependency.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.crypto.oprf` — RFC 9497 OPRF / VOPRF",
+          "body": "`suite(name)` returns `{ name, oprf, voprf }` for one of the four RFC 9497 ciphersuites (ristretto255-SHA512 / P-256-SHA256 / P-384-SHA384 / P-521-SHA512). The `oprf` (base) mode provides `deriveKeyPair` / `generateKeyPair` / `blind` / `blindEvaluate` / `finalize` / `evaluate`; `voprf` (verifiable) adds a DLEQ proof so the client can prove the server used the committed key. Use it for password hardening, private set intersection, and OPRF-based tokens. Verified against the RFC 9497 Appendix-A vectors. The partially-oblivious `poprf` mode is not yet exposed (the vendored `@noble/curves` does not implement it) and will follow upstream."
+        },
+        {
+          "title": "Vendored `@noble/curves`",
+          "body": "`@noble/curves` 2.2.0 (Paul Miller, MIT) is vendored under `lib/vendor/` (no npm runtime dependency), supplying the ristretto255 / NIST-curve group and hash-to-curve operations behind `b.crypto.oprf`. It joins the existing vendored `@noble/post-quantum` and `@noble/ciphers` from the same maintainer; tracked in the SBOM and the vendor-currency gate."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.1.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.1",
+  "date": "2026-05-26",
+  "headline": "`b.worm` — write-once-read-many retention",
+  "summary": "Store records that cannot be altered or deleted before a retention period elapses — the immutable-storage discipline regulators require (SEC 17a-4(f), CFTC 1.31, FINRA 4511). b.worm.create(opts) returns a WORM store that enforces, on every mutating call, that a record is not overwritten or deleted while it is within its retainUntil window or under a legal hold. Two modes mirror cloud Object-Lock: compliance (the default — no one, including the operator, can delete before expiry) and governance (a privileged caller may override with an audited reason). Retention can only be extended, never shortened; every record carries a SHA3-512 digest that get verifies, so tampering with the underlying bytes is detected on read; every allow/refuse decision is audited. Storage is pluggable via a synchronous store adapter, so the policy layer sits over a sealed DB table, a filesystem, or any non-S3 backend — the store-agnostic, application-level companion to b.objectStore's S3 Object Lock, with content-integrity verification that native Object Lock does not provide.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.worm.create` — write-once-read-many retention",
+          "body": "Returns a store with `put` / `get` / `delete` / `extendRetention` / `placeLegalHold` / `releaseLegalHold` / `list`. `put` is write-once (an overwrite of a retained or held record is refused); `delete` is gated by the retention window, legal holds, and the mode (`compliance` refuses any early delete; `governance` allows a privileged override with a required, audited reason); `extendRetention` is extend-only; `get` verifies the stored SHA3-512 digest and throws `worm/tampered` on a mismatch. Storage is a pluggable synchronous adapter (`get` / `set` / `delete` / `has` / `keys`), defaulting to in-memory for tests. Use it for SEC 17a-4 / CFTC / FINRA immutable records on backends without native Object Lock; `b.objectStore` remains the path for S3 Object Lock."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.2.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.2",
+  "date": "2026-05-26",
+  "headline": "`b.iabTcf.encode` — write TCF consent strings, and a TC-string timestamp fix",
+  "summary": "b.iabTcf gains the encode half of its consent-string codec: b.iabTcf.encode(obj) serialises a parsed object back into an IAB TCF v2 TC string, and b.iabTcf.isValid(tcString) is a total never-throwing validity check. Vendor and purpose collections may be Sets, id arrays, or the parsed sections parseString returns; vendor sections are written with whichever of the bit-field and range forms is smaller, matching the reference CMP encoders, so a parsed string round-trips to an equivalent signal. parseString now fully decodes the Core publisher-restrictions list and the PublisherTC segment's publisher and custom purposes, where it previously reported only the segment's presence. The encoder is verified against the worked-example string in the IAB Tech Lab consent-string specification: it re-encodes that string's Core segment byte-for-byte. This release also fixes a TC-string parsing bug — the bit reader accumulated values with a 32-bit shift, so the 36-bit Created and LastUpdated timestamp fields were silently truncated for any real date; they now decode and round-trip exactly.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.iabTcf.encode` / `b.iabTcf.isValid`",
+          "body": "`encode(obj)` serialises a TCF object (the shape `parseString` returns) into a TC string — Core plus optional DisclosedVendors, AllowedVendors, and PublisherTC segments — choosing the smaller of the bit-field and range vendor encodings. `isValid(tcString)` returns whether a string parses as a well-formed Core segment without throwing. `parseString` now fully decodes Core publisher restrictions and the PublisherTC purposes that were previously reported only as present."
+        }
+      ]
+    },
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "TC-string 36-bit timestamps were truncated on parse",
+          "body": "`b.iabTcf.parseString` read multi-bit fields with a 32-bit left-shift accumulation. The 36-bit Created and LastUpdated fields hold deciseconds-since-epoch, which exceeds 2^31 for any date after 1976, so those timestamps were silently corrupted. The reader now accumulates without the 32-bit truncation; timestamps decode correctly and round-trip through `encode`."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/scripts/vendor-update.sh

@@ -33,7 +33,7 @@ DATE=$(date +%Y-%m-%d)
 # (see lib/argon2-builtin.js). The case-block below preserves the
 # `argon2` operator-friendly error message for anyone who still tries
 # `vendor-update.sh argon2`.
-VENDORED_PACKAGES=("@noble/ciphers" "@noble/post-quantum" "@simplewebauthn/server" "peculiar-pki")
+VENDORED_PACKAGES=("@noble/ciphers" "@noble/curves" "@noble/post-quantum" "@simplewebauthn/server" "peculiar-pki")
 
 get_vendored_ver() {
   node -e "var m=require('./$MANIFEST'); var p=m.packages['$1']; console.log(p?p.version:'?')"
@@ -133,6 +133,16 @@ case "$PKG" in
     sed -i "1s|^|// XChaCha20-Poly1305 — vendored from @noble/ciphers v${INSTALLED_VER} by Paul Miller\n// License: MIT — https://github.com/paulmillr/noble-ciphers\n// Bundled with esbuild. Exports: xchacha20poly1305\n|" lib/vendor/noble-ciphers.cjs
     ;;
 
+  "@noble/curves")
+    cat > _entry.mjs <<'ENTRY'
+export { ristretto255_oprf } from "@noble/curves/ed25519.js";
+export { p256_oprf, p384_oprf, p521_oprf } from "@noble/curves/nist.js";
+ENTRY
+    npx esbuild _entry.mjs --bundle --format=cjs --minify --platform=node --outfile=lib/vendor/noble-curves.cjs
+    rm _entry.mjs
+    sed -i "1s|^|// @noble/curves v${INSTALLED_VER} — vendored from Paul Miller\n// License: MIT — https://github.com/paulmillr/noble-curves\n// Bundled with esbuild. Exports the RFC 9497 OPRF suites:\n//   ristretto255_oprf (ristretto255-SHA512), p256_oprf (P-256-SHA256),\n//   p384_oprf (P-384-SHA384), p521_oprf (P-521-SHA512) — each with\n//   oprf / voprf / poprf modes. Backs b.crypto.oprf.\n|" lib/vendor/noble-curves.cjs
+    ;;
+
   "@noble/post-quantum")
     cat > _entry.mjs <<'ENTRY'
 export { ml_kem512, ml_kem768, ml_kem1024 } from "@noble/post-quantum/ml-kem.js";

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -2292,8 +2292,10 @@ async function testNoDuplicateCodeBlocks() {
         "lib/privacy-pass.js:_bytes",
         "lib/content-digest.js:_bodyBytes",
         "lib/tsa.js:_bytes",
+        "lib/eat.js:_toBuf",
+        "lib/worm.js:_toBytes",
       ],
-      reason: "v0.12.48 / v0.12.51 / v0.12.52 / v0.12.53 — Buffer-coercion guard (`if (Buffer.isBuffer(x)) return x; if (x instanceof Uint8Array) return Buffer.from(x); throw <Error>`) repeats across byte-string-consuming primitives. Each throws a MODULE-LOCAL typed error code (cose/bad-cose-key, mdoc/bad-input, dnssec/bad-bytes, dane/bad-bytes, tsa/bad-input) naming the local argument; network-dane additionally coerces a hex string. The duplicated three-line shape is the symptom, the cause is that JS can't throw a caller-namespaced ErrorClass without the local closure. Same documented exception as the v0.12.7 require-non-empty-string cluster — the typed-error CODE is the divergence the dup detector can't see.",
+      reason: "v0.12.48 / v0.12.51 / v0.12.52 / v0.12.53 / v0.13.x — Buffer-coercion guard (`if (Buffer.isBuffer(x)) return x; if (x instanceof Uint8Array) return Buffer.from(x); ...`) repeats across byte-string-consuming primitives. The throw-on-unknown variants (cose / mdoc / dnssec / dane / tsa) each raise a MODULE-LOCAL typed error code naming the local argument; the JSON-fallback variants (eat._toBuf serializing a CBOR/EAT claims payload, worm._toBytes serializing a record to hash) instead JSON.stringify a non-bytes value. The duplicated prefix is the symptom; the cause is that JS can't throw a caller-namespaced ErrorClass (or choose the domain's serialization) without the local closure. Same documented exception as the v0.12.7 require-non-empty-string cluster — the per-domain error code / serialization is the divergence the dup detector can't see.",
     },
     {
       mode:  "family-subset",

package/lib/vendor/blamejs/test/layer-0-primitives/crypto-oprf.test.js

@@ -0,0 +1,101 @@
+"use strict";
+/**
+ * Layer 0 — b.crypto.oprf (RFC 9497).
+ * Oracle: the official RFC 9497 Appendix A test vectors (A.1.1
+ * ristretto255-SHA512 OPRF, A.3.1 P-256-SHA256 OPRF) — deriveKeyPair must
+ * reproduce skSm and the server-side evaluate must reproduce Output (both
+ * deterministic). Round-trips cover oprf + voprf; poprf is not exposed
+ * (the vendored @noble/curves does not implement it).
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+function hb(s) { return Buffer.from(s, "hex"); }
+function toHex(u) { return Buffer.from(u).toString("hex"); }
+
+var SEED = Buffer.alloc(32, 0xa3);                 // RFC 9497 vectors use Seed = 0xA3 × 32
+var KEYINFO = hb("74657374206b6579");              // "test key"
+var INPUT0 = hb("00");
+
+// RFC 9497 Appendix A — OPRF (mode 0x00) vectors.
+var VEC = {
+  "ristretto255-sha512": {
+    skSm: "5ebcea5ee37023ccb9fc2d2019f9d7737be85591ae8652ffa9ef0f4d37063b0e",
+    out:  "527759c3d9366f277d8c6020418d96bb393ba2afb20ff90df23fb7708264e2f3ab9135e3bd69955851de4b1f9fe8a0973396719b7912ba9ee8aa7d0b5e24bcf6",
+  },
+  "p256-sha256": {
+    skSm: "159749d750713afe245d2d39ccfaae8381c53ce92d098a9375ee70739c7ac0bf",
+    out:  "a0b34de5fa4c5b6da07e72af73cc507cceeb48981b97b7285fc375345fe495dd",
+  },
+};
+
+function testSurface() {
+  check("b.crypto.oprf.suite is a function", typeof b.crypto.oprf.suite === "function");
+  check("SUITES lists the four RFC 9497 ciphersuites", b.crypto.oprf.SUITES.join(",") === "ristretto255-sha512,p256-sha256,p384-sha384,p521-sha512");
+  check("OprfError is a class", typeof b.crypto.oprf.OprfError === "function");
+  var s = b.crypto.oprf.suite("ristretto255-sha512");
+  check("suite exposes oprf + voprf, not poprf", typeof s.oprf === "object" && typeof s.voprf === "object" && s.poprf === undefined);
+  check("suite name is case-insensitive", b.crypto.oprf.suite("P256-SHA256").name !== undefined);
+  check("unknown suite throws", code(function () { b.crypto.oprf.suite("x25519-sha256"); }) === "oprf/bad-suite");
+}
+
+function testRfc9497Vectors() {
+  Object.keys(VEC).forEach(function (name) {
+    var s = b.crypto.oprf.suite(name);
+    var kp = s.oprf.deriveKeyPair(SEED, KEYINFO);
+    check(name + ": deriveKeyPair reproduces skSm", toHex(kp.secretKey) === VEC[name].skSm);
+    check(name + ": evaluate reproduces Output", toHex(s.oprf.evaluate(kp.secretKey, INPUT0)) === VEC[name].out);
+  });
+}
+
+function testOprfRoundTrip() {
+  var s = b.crypto.oprf.suite("ristretto255-sha512");
+  var kp = s.oprf.deriveKeyPair(SEED, KEYINFO);
+  var input = Buffer.from("user@example.com", "utf8");
+  var c = s.oprf.blind(input);
+  var ev = s.oprf.blindEvaluate(kp.secretKey, c.blinded);
+  var out = toHex(s.oprf.finalize(input, c.blind, ev));
+  // The output is blind-independent: the oblivious client result equals the
+  // server's direct evaluation of the same key + input.
+  check("oprf finalize == server evaluate (blind-independent)", out === toHex(s.oprf.evaluate(kp.secretKey, input)));
+  // A fresh blind of the same input still finalizes to the same output.
+  var c2 = s.oprf.blind(input);
+  var ev2 = s.oprf.blindEvaluate(kp.secretKey, c2.blinded);
+  check("oprf output stable across blinds", toHex(s.oprf.finalize(input, c2.blind, ev2)) === out);
+  // Different input → different output.
+  check("oprf output differs for different input", toHex(s.oprf.evaluate(kp.secretKey, Buffer.from("other"))) !== out);
+}
+
+function testVoprfRoundTripAndProof() {
+  var s = b.crypto.oprf.suite("p256-sha256");
+  var v = s.voprf;
+  var kp = v.deriveKeyPair(SEED, KEYINFO);
+  var input = Buffer.from("verifiable-input", "utf8");
+  var c = v.blind(input);
+  var ev = v.blindEvaluate(kp.secretKey, kp.publicKey, c.blinded);
+  check("voprf blindEvaluate yields evaluated + proof", ev.evaluated && ev.proof);
+  var out = toHex(v.finalize(input, c.blind, ev.evaluated, c.blinded, kp.publicKey, ev.proof));
+  check("voprf finalize produces output", out.length > 0);
+  // The verifiable client output matches the server-side VOPRF evaluate
+  // (same mode). It is NOT the base-OPRF output — each mode mixes a
+  // distinct context string, so the two modes produce different values.
+  check("voprf finalize == server voprf.evaluate", out === toHex(v.evaluate(kp.secretKey, input)));
+  check("voprf output differs from oprf output (distinct mode DST)", out !== toHex(s.oprf.evaluate(kp.secretKey, input)));
+  // A tampered proof must make finalize reject (proof verification fails).
+  var badProof = Buffer.from(ev.proof); badProof[0] ^= 0xff;
+  check("voprf rejects a tampered proof", code(function () { v.finalize(input, c.blind, ev.evaluated, c.blinded, kp.publicKey, badProof); }) !== "NO-THROW");
+  // Wrong public key must also reject.
+  var otherKp = v.deriveKeyPair(Buffer.alloc(32, 0x11), KEYINFO);
+  check("voprf rejects a mismatched public key", code(function () { v.finalize(input, c.blind, ev.evaluated, c.blinded, otherKp.publicKey, ev.proof); }) !== "NO-THROW");
+}
+
+async function run() {
+  testSurface();
+  testRfc9497Vectors();
+  testOprfRoundTrip();
+  testVoprfRoundTripAndProof();
+}
+module.exports = { run: run };
+if (require.main === module) { run().then(function () { console.log("[crypto-oprf] OK — " + helpers.getChecks() + " checks passed"); }, function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }); }

package/lib/vendor/blamejs/test/layer-0-primitives/iab-tcf.test.js

@@ -41,7 +41,8 @@ async function run() {
     // bytes with a zero pad.
     var totalBits = 6 + 36 + 36 + 12 + 12 + 6 + 6 + 6 + 12 + 6 + 1 + 1 +
                     12 + 24 + 24 + 1 + 6 + 6 +
-                    16 + 1 + 16 + 1; // two empty vendor sections
+                    16 + 1 + 16 + 1 + // two empty vendor sections
+                    12;               // NumPubRestrictions (mandatory, =0)
     var byteLen = Math.ceil(totalBits / 8);                                                   // allow:raw-byte-literal — bits-per-byte
     var buf = Buffer.alloc(byteLen);
     // Set version field (top 6 bits of byte 0).
@@ -68,6 +69,65 @@ async function run() {
   check("core version=4",             parsed.core.version === 4);
   check("checkVendor handles bare core",
         b.iabTcf.checkVendor(parsed, 755).consented === false);
+
+  // ---- encode + isValid + completed parse --------------------------------
+  check("iabTcf.encode is fn",  typeof b.iabTcf.encode === "function");
+  check("iabTcf.isValid is fn", typeof b.iabTcf.isValid === "function");
+
+  // Independent oracle: the worked-example string from the IAB Tech Lab
+  // "Consent string and vendor list formats v2" specification.
+  var SPEC = "CQSbk4AQSbk4ANwAAAENAwCgAAAAAAAAAAYgACPAAAAA.IDKQA4AAgAKAGQAygAAA.YAAAAAAAAAAA";
+  var SPEC_CORE = "CQSbk4AQSbk4ANwAAAENAwCgAAAAAAAAAAYgACPAAAAA";
+  var sp = b.iabTcf.parseString(SPEC);
+  check("spec core version 2",            sp.core.version === 2);
+  check("spec cmpId 880",                 sp.core.cmpId === 880);
+  check("spec vendorListVersion 48",      sp.core.vendorListVersion === 48);
+  check("spec created 2025-06-03",        new Date(sp.core.createdAt).toISOString() === "2025-06-03T00:00:00.000Z");
+  check("spec vendorConsents [1,2,3,4]",  JSON.stringify(Array.from(sp.core.vendorConsents.ids)) === "[1,2,3,4]");
+  check("spec disclosedVendors decoded",  JSON.stringify(Array.from(sp.disclosedVendors.vendorIds)) === "[1,2,3,4,5,100,404]");
+  check("spec publisherTC fully parsed",  sp.publisherTC && sp.publisherTC.present === true && typeof sp.publisherTC.numCustomPurposes === "number");
+  check("core.publisherRestrictions array", Array.isArray(sp.core.publisherRestrictions));
+  // Strong oracle: re-encoding the parsed core reproduces the spec Core
+  // segment byte-for-byte.
+  check("re-encoded core is byte-identical to the spec", b.iabTcf.encode({ core: sp.core }) === SPEC_CORE);
+  // Disclosed content round-trips (the encoder writes the minimal valid form).
+  var rt = b.iabTcf.parseString(b.iabTcf.encode({ core: sp.core, disclosedVendors: sp.disclosedVendors }));
+  check("disclosed content round-trips", JSON.stringify(Array.from(rt.disclosedVendors.vendorIds)) === "[1,2,3,4,5,100,404]");
+
+  // 36-bit timestamp regression: a real date (deciseconds > 2^31) must survive
+  // parse → encode unchanged. Guards the reader's `* 2` (not `<< 1`)
+  // accumulation, without which Created / LastUpdated truncate at 32 bits.
+  var bigCreated = Date.UTC(2026, 4, 26);
+  var encTs = b.iabTcf.encode({ core: { version: 2, createdAt: bigCreated, lastUpdatedAt: bigCreated, cmpId: 300, vendorListVersion: 100, consentLanguage: "EN", publisherCC: "DE", vendorConsents: [], vendorLIs: [] } });
+  var decTs = b.iabTcf.parseString(encTs);
+  check("36-bit timestamp survives round-trip", decTs.core.createdAt === bigCreated);
+  check("cmpId survives round-trip",            decTs.core.cmpId === 300);
+  check("consentLanguage survives round-trip",  decTs.core.consentLanguage === "EN");
+
+  // Vendor-section round-trip across range-favouring and sparse sets.
+  [[1, 2, 3, 4, 5, 6, 7, 8, 9, 10], [12, 37, 199, 755], [1]].forEach(function (vc, idx) {
+    var s = b.iabTcf.encode({ core: { version: 2, createdAt: bigCreated, lastUpdatedAt: bigCreated, cmpId: 5, vendorListVersion: 10, consentLanguage: "EN", publisherCC: "FR", purposesConsent: [1, 2, 3], vendorConsents: vc, vendorLIs: [] } });
+    var d = b.iabTcf.parseString(s);
+    check("vendorConsents round-trip " + idx,  JSON.stringify(Array.from(d.core.vendorConsents.ids)) === JSON.stringify(vc));
+    check("purposesConsent round-trip " + idx, JSON.stringify(Array.from(d.core.purposesConsent)) === "[1,2,3]");
+  });
+
+  // Publisher restrictions round-trip.
+  var prDec = b.iabTcf.parseString(b.iabTcf.encode({ core: { version: 2, createdAt: bigCreated, lastUpdatedAt: bigCreated, cmpId: 9, vendorListVersion: 1, consentLanguage: "IT", publisherCC: "IT", vendorConsents: [], vendorLIs: [], publisherRestrictions: [{ purposeId: 2, restrictionType: 1, vendorIds: [5, 6, 7, 50] }] } }));
+  check("publisher restriction round-trips",
+        prDec.core.publisherRestrictions.length === 1 &&
+        prDec.core.publisherRestrictions[0].purposeId === 2 &&
+        JSON.stringify(prDec.core.publisherRestrictions[0].vendorIds) === "[5,6,7,50]");
+
+  check("isValid true for the spec vector", b.iabTcf.isValid(SPEC) === true);
+  check("isValid false for garbage",        b.iabTcf.isValid("nonsense!!") === false);
+  // A truncated core (a dropped trailing character cuts into the mandatory
+  // NumPubRestrictions field) must NOT validate — the reader's bounds check
+  // rejects it rather than treating the gap as "no restrictions".
+  check("isValid false for a truncated core", b.iabTcf.isValid(SPEC_CORE.slice(0, -1)) === false);
+  rejects("encode without core throws", function () { b.iabTcf.encode({}); }, "BAD_INPUT");
+  rejects("encode rejects a non-positive id",
+    function () { b.iabTcf.encode({ core: { consentLanguage: "EN", publisherCC: "DE", vendorConsents: [0], vendorLIs: [] } }); }, "BAD_VALUE");
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/network-tsig.test.js

@@ -0,0 +1,149 @@
+"use strict";
+/**
+ * Layer 0 — b.network.dns.tsig (RFC 8945).
+ * Oracle: dnspython 2.8.0 — reference TSIG-signed DNS messages. The signed
+ * wire + MAC for a fixed key / message / time are frozen below; `sign`
+ * must reproduce them byte-for-byte and `verify` must accept them.
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+var tsig = b.network.dns.tsig;
+function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+function hex(s) { return Buffer.from(s, "hex"); }
+
+// dnspython keyring secret = base64("0123456789abcdef0123456789abcdef").
+var SECRET = "MDEyMzQ1Njc4OWFiY2RlZjAxMjM0NTY3ODlhYmNkZWY=";
+var KEY = "test.key.";
+
+// Vector 1 — HMAC-SHA256, fudge 300, time_signed 1779813293.
+var V1 = {
+  unsigned: hex("123401000001000000000000076578616d706c6503636f6d0000010001"),
+  signed:   hex("123401000001000000000001076578616d706c6503636f6d00000100010474657374036b65790000fa00ff00000000003d0b686d61632d7368613235360000006a15cbad012c0020f8edb5dfdb6717c4bf6a3e50d9883be981ec862458101432ff7fe9348b127dcd123400000000"),
+  mac:      "f8edb5dfdb6717c4bf6a3e50d9883be981ec862458101432ff7fe9348b127dcd",
+  time: 1779813293, fudge: 300, alg: "hmac-sha256",
+};
+// Vector 2 — HMAC-SHA512, fudge 600, time_signed 1779813320.
+var V2 = {
+  unsigned: hex("abcd01000001000000000000046d61696c076578616d706c65036f726700000f0001"),
+  signed:   hex("abcd01000001000000000001046d61696c076578616d706c65036f726700000f00010474657374036b65790000fa00ff00000000005d0b686d61632d7368613531320000006a15cbc8025800402c9b1ce5273ed4cf11067dcb8994606e8a5ea09fa5337eda6e6907e3bba08956375853771bf52567875dc3771acd67cf31ad2c6985914fd92b5b1440a1ee3c68abcd00000000"),
+  mac:      "2c9b1ce5273ed4cf11067dcb8994606e8a5ea09fa5337eda6e6907e3bba08956375853771bf52567875dc3771acd67cf31ad2c6985914fd92b5b1440a1ee3c68",
+  time: 1779813320, fudge: 600, alg: "hmac-sha512",
+};
+
+function testSurface() {
+  check("tsig.sign is a function", typeof tsig.sign === "function");
+  check("tsig.verify is a function", typeof tsig.verify === "function");
+  check("tsig.ERROR has BADSIG/BADKEY/BADTIME", tsig.ERROR.BADSIG === 16 && tsig.ERROR.BADKEY === 17 && tsig.ERROR.BADTIME === 18);
+  check("tsig.TsigError is a class", typeof tsig.TsigError === "function");
+}
+
+function testSignMatchesDnspython() {
+  var s1 = tsig.sign(V1.unsigned, { keyName: KEY, secret: SECRET, algorithm: "hmac-sha256", fudge: V1.fudge, time: V1.time });
+  check("sign SHA-256 MAC matches dnspython", s1.mac.toString("hex") === V1.mac);
+  check("sign SHA-256 wire matches dnspython byte-for-byte", s1.wire.equals(V1.signed));
+
+  var s2 = tsig.sign(V2.unsigned, { keyName: KEY, secret: SECRET, algorithm: "hmac-sha512", fudge: V2.fudge, time: V2.time });
+  check("sign SHA-512 MAC matches dnspython", s2.mac.toString("hex") === V2.mac);
+  check("sign SHA-512 wire matches dnspython byte-for-byte", s2.wire.equals(V2.signed));
+}
+
+function testVerifyAcceptsDnspython() {
+  var r1 = tsig.verify(V1.signed, { keys: { "test.key.": { secret: SECRET } }, now: V1.time });
+  check("verify SHA-256 dnspython message is valid", r1.valid && r1.macValid && r1.timeValid);
+  check("verify reports keyName + algorithm + timeSigned", r1.keyName === "test.key." && r1.algorithm === "hmac-sha256" && r1.timeSigned === V1.time);
+
+  var r2 = tsig.verify(V2.signed, { keys: { "test.key.": { secret: SECRET } }, now: V2.time });
+  check("verify SHA-512 dnspython message is valid", r2.valid && r2.macValid);
+
+  // Single-key form.
+  var r1b = tsig.verify(V1.signed, { keyName: "test.key.", secret: SECRET, now: V1.time });
+  check("verify single-key form works", r1b.valid);
+}
+
+function testVerifyRejects() {
+  // Wrong secret → MAC mismatch (BADSIG), never throws.
+  var bad = tsig.verify(V1.signed, { keys: { "test.key.": { secret: Buffer.alloc(32, 9) } }, now: V1.time });
+  check("wrong secret → !valid + BADSIG", !bad.valid && !bad.macValid && bad.error === tsig.ERROR.BADSIG);
+
+  // Outside the fudge window → BADTIME.
+  var late = tsig.verify(V1.signed, { keys: { "test.key.": { secret: SECRET } }, now: V1.time + 100000 });
+  check("time outside fudge → !valid + BADTIME", !late.valid && late.macValid && !late.timeValid && late.error === tsig.ERROR.BADTIME);
+
+  // Unknown key → BADKEY.
+  var nokey = tsig.verify(V1.signed, { keys: { "other.key.": { secret: SECRET } }, now: V1.time });
+  check("unknown key → !valid + BADKEY", !nokey.valid && nokey.error === tsig.ERROR.BADKEY);
+
+  // Tampered message body → MAC mismatch.
+  var tampered = Buffer.from(V1.signed); tampered[2] ^= 0x20;   // flip a bit in the question/flags region
+  var tr = tsig.verify(tampered, { keys: { "test.key.": { secret: SECRET } }, now: V1.time });
+  check("tampered message → !valid", !tr.valid);
+}
+
+function testRoundTripAndPolicy() {
+  // sign → verify round-trip with a fresh time.
+  var signed = tsig.sign(V1.unsigned, { keyName: KEY, secret: SECRET, time: 1700000000, fudge: 300 });
+  var rt = tsig.verify(signed.wire, { keys: { "test.key.": { secret: SECRET } }, now: 1700000000 });
+  check("sign→verify round-trip is valid", rt.valid);
+
+  // Default algorithm is HMAC-SHA256.
+  check("default algorithm is hmac-sha256", tsig.verify(signed.wire, { keys: { "test.key.": { secret: SECRET } }, now: 1700000000 }).algorithm === "hmac-sha256");
+
+  // Broken algorithms refused unless allowLegacy.
+  check("hmac-md5 refused by default", code(function () { tsig.sign(V1.unsigned, { keyName: KEY, secret: SECRET, algorithm: "hmac-md5" }); }) === "tsig/legacy-algorithm");
+  check("hmac-sha1 permitted under allowLegacy", typeof tsig.sign(V1.unsigned, { keyName: KEY, secret: SECRET, algorithm: "hmac-sha1", allowLegacy: true }).mac === "object");
+  check("unknown algorithm refused", code(function () { tsig.sign(V1.unsigned, { keyName: KEY, secret: SECRET, algorithm: "hmac-foo" }); }) === "tsig/bad-algorithm");
+
+  // Missing keyName / non-Buffer message refused.
+  check("missing keyName refused", code(function () { tsig.sign(V1.unsigned, { secret: SECRET }); }) === "tsig/bad-opt");
+  check("non-Buffer message refused", code(function () { tsig.sign("not a buffer", { keyName: KEY, secret: SECRET }); }) === "tsig/bad-message");
+}
+
+// dnspython vector with an UPPERCASE key name "Test.Key." — proves the MAC
+// digest downcases names (DNS names are case-insensitive) and the wire
+// preserves the sender's case.
+var UC = {
+  signed: hex("123401000001000000000001076578616d706c6503636f6d00000100010454657374034b65790000fa00ff00000000003d0b686d61632d7368613235360000006a15d3d9012c00202d9c8c40b15f04407fc096200b1403a6535ee57a37580b636690b7e8146a0642123400000000"),
+  mac: "2d9c8c40b15f04407fc096200b1403a6535ee57a37580b636690b7e8146a0642",
+  time: 1779815385,
+};
+
+function testCaseInsensitive() {
+  // Verify a message whose TSIG key name is "Test.Key." against a key map
+  // keyed lower-case — must match (case-insensitive) and the downcased
+  // digest must validate against dnspython's MAC.
+  var r = tsig.verify(UC.signed, { keys: { "test.key.": { secret: SECRET } }, now: UC.time });
+  check("case-insensitive key match + downcased digest verifies", r.valid && r.macValid);
+
+  // Signing with a mixed-case key name reproduces dnspython's MAC byte-exact
+  // (proves the digest downcases, not the wire).
+  var s = tsig.sign(V1.unsigned, { keyName: "Test.Key.", secret: SECRET, time: UC.time, fudge: 300 });
+  check("sign mixed-case key matches dnspython MAC", s.mac.toString("hex") === UC.mac);
+  check("sign preserves the key-name case on the wire", s.wire.includes(Buffer.from("Test", "ascii")));
+}
+
+function testRrHeaderTamper() {
+  // RFC 8945 §4.2 — TSIG RR CLASS must be ANY and TTL must be 0. These
+  // bytes are outside the MAC, so they must be validated explicitly.
+  var tc = Buffer.from(V1.signed);
+  var idx = tc.indexOf(Buffer.from("00fa00ff", "hex"));   // TSIG type (250) + CLASS ANY (255)
+  tc[idx + 3] = 0x01;                                      // CLASS ANY -> IN
+  check("tampered TSIG CLASS is rejected", code(function () { tsig.verify(tc, { keys: { "test.key.": { secret: SECRET } }, now: V1.time }); }) === "tsig/bad-rr");
+
+  var tt = Buffer.from(V1.signed);
+  tt[idx + 7] = 0x01;                                      // a TTL byte -> non-zero
+  check("tampered TSIG TTL is rejected", code(function () { tsig.verify(tt, { keys: { "test.key.": { secret: SECRET } }, now: V1.time }); }) === "tsig/bad-rr");
+}
+
+async function run() {
+  testSurface();
+  testSignMatchesDnspython();
+  testVerifyAcceptsDnspython();
+  testVerifyRejects();
+  testCaseInsensitive();
+  testRrHeaderTamper();
+  testRoundTripAndPolicy();
+}
+module.exports = { run: run };
+if (require.main === module) { run().then(function () { console.log("[network-tsig] OK — " + helpers.getChecks() + " checks passed"); }, function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }); }

package/lib/vendor/blamejs/test/layer-0-primitives/sandbox.test.js

@@ -26,7 +26,7 @@ async function testHappyPath() {
   var r = await b.sandbox.run({
     source: "return { upper: input.name.toUpperCase(), len: input.name.length };",
     input:  { name: "alice" },
-    timeoutMs: 2000,
+    timeoutMs: 5000,
   });
   check("happy path returns wrapped result",       typeof r === "object");
   check("happy path produces result.result.upper", r.result && r.result.upper === "ALICE");
@@ -40,7 +40,7 @@ async function testAllowedBuiltins() {
     source:    "return { ts: Date.now() > 0, sqrt: Math.sqrt(16) };",
     input:     {},
     allowed:   ["Date", "Math"],
-    timeoutMs: 2000,
+    timeoutMs: 5000,
   });
   check("allowed Date works",   r.result.ts === true);
   check("allowed Math works",   r.result.sqrt === 4);

package/lib/vendor/blamejs/test/layer-0-primitives/testing.test.js

@@ -382,10 +382,10 @@ async function testWaitForResolves() {
   var v = await t.waitFor(function () {
     counter++;
     return counter >= 3 ? "done" : false;
-  }, { timeoutMs: 200, intervalMs: 5 });
+  }, { timeoutMs: 5000, intervalMs: 5 });
   check("waitFor resolves with predicate value", v === "done");
   check("waitFor invoked predicate at least 3 times",  counter >= 3);
-  check("waitFor finished within timeout",      Date.now() - startedAt < 2000);
+  check("waitFor finished within timeout",      Date.now() - startedAt < 5000);
 }
 
 async function testWaitForTimeoutFromSafeAsync() {
@@ -404,7 +404,7 @@ async function testWaitForAsyncPredicate() {
   var v = await t.waitFor(async function () {
     counter++;
     return counter >= 2 ? 42 : null;
-  }, { timeoutMs: 200, intervalMs: 5 });
+  }, { timeoutMs: 5000, intervalMs: 5 });
   check("waitFor awaits async predicate",     v === 42);
 }
 

package/lib/vendor/blamejs/test/layer-0-primitives/worm.test.js

@@ -0,0 +1,126 @@
+"use strict";
+/**
+ * Layer 0 — b.worm (write-once-read-many retention).
+ * Behavioral oracle: a WORM store must enforce write-once, retain-until
+ * immutability, legal holds, extend-only retention, compliance vs
+ * governance delete semantics, and tamper-evidence. A controllable clock
+ * drives the time-window cases deterministically.
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+
+// Controllable clock.
+function clockAt(ref) { return function () { return ref.t; }; }
+
+function testSurface() {
+  check("b.worm.create is a function", typeof b.worm.create === "function");
+  check("b.worm.MODES lists compliance + governance", b.worm.MODES.indexOf("compliance") !== -1 && b.worm.MODES.indexOf("governance") !== -1);
+  check("b.worm.WormError is a class", typeof b.worm.WormError === "function");
+  check("bad mode rejected", code(function () { b.worm.create({ mode: "loose" }); }) === "worm/bad-mode");
+  check("bad store adapter rejected", code(function () { b.worm.create({ store: { get: function () {} } }); }) === "worm/bad-store");
+  check("put without any retention rejected", code(function () { b.worm.create().put("x", "data"); }) === "worm/no-retention");
+}
+
+function testWriteOnceAndRetain() {
+  var ref = { t: 1000 };
+  var w = b.worm.create({ clock: clockAt(ref), defaultRetentionMs: 5000 });
+  var r = w.put("rec1", "hello");
+  check("put returns a receipt with digest + retainUntil", r.id === "rec1" && r.digest.length === 128 && r.retainUntil === 6000);
+  check("get returns the data", w.get("rec1").data.toString() === "hello");
+
+  // Write-once: cannot overwrite while retained.
+  check("overwrite of retained record refused", code(function () { w.put("rec1", "changed"); }) === "worm/already-exists");
+  // Cannot delete while retained (compliance default — no override).
+  check("delete while retained refused (compliance)", code(function () { w.delete("rec1"); }) === "worm/retained");
+  // Governance override is rejected in compliance mode regardless.
+  check("override ignored in compliance mode", code(function () { w.delete("rec1", { override: true, reason: "x" }); }) === "worm/retained");
+
+  // After expiry, delete is allowed.
+  ref.t = 7000;
+  check("delete allowed after retention expires", w.delete("rec1") === true);
+  check("record gone after delete", code(function () { w.get("rec1"); }) === "worm/not-found");
+}
+
+function testExtendOnly() {
+  var ref = { t: 1000 };
+  var w = b.worm.create({ clock: clockAt(ref) });
+  w.put("e", "x", { retainUntil: 5000 });
+  check("extendRetention forward allowed", w.extendRetention("e", 9000) === 9000);
+  check("shortening retention refused", code(function () { w.extendRetention("e", 6000); }) === "worm/retention-shorten");
+}
+
+function testLegalHold() {
+  var ref = { t: 10000 };
+  var w = b.worm.create({ clock: clockAt(ref) });
+  w.put("h", "x", { retainUntil: 1 });   // already past retention
+  check("expired record deletable before a hold", true);
+  w.placeLegalHold("h", "case-123");
+  check("delete refused under legal hold even after expiry", code(function () { w.delete("h"); }) === "worm/legal-hold");
+  check("overwrite refused under legal hold", code(function () { w.put("h", "y", { retainUntil: 1 }); }) === "worm/already-exists");
+  w.releaseLegalHold("h", "case-123");
+  check("delete allowed after hold released + expired", w.delete("h") === true);
+}
+
+function testGovernanceOverride() {
+  var ref = { t: 1000 };
+  var w = b.worm.create({ mode: "governance", clock: clockAt(ref) });
+  w.put("g", "x", { retainUntil: 9999 });
+  check("governance override without reason refused", code(function () { w.delete("g", { override: true }); }) === "worm/override-reason");
+  check("governance override with reason allowed", w.delete("g", { override: true, reason: "court order #5" }) === true);
+  // But a legal hold beats even a governance override.
+  w.put("g2", "x", { retainUntil: 9999, legalHold: "hold-1" });
+  check("legal hold beats governance override", code(function () { w.delete("g2", { override: true, reason: "x" }); }) === "worm/legal-hold");
+}
+
+function testTamperEvidence() {
+  var ref = { t: 1000 };
+  var store = (function () {
+    var m = new Map();
+    return { get: function (k) { return m.get(k); }, set: function (k, v) { m.set(k, v); }, delete: function (k) { m.delete(k); }, has: function (k) { return m.has(k); }, keys: function () { return Array.from(m.keys()); }, _raw: m };
+  })();
+  var w = b.worm.create({ store: store, clock: clockAt(ref), defaultRetentionMs: 1000 });
+  w.put("t", "trustworthy");
+  // Tamper with the stored bytes behind the WORM layer's back.
+  store._raw.get("t").bytes = Buffer.from("tampered!!!!");
+  check("get detects byte tampering vs the digest", code(function () { w.get("t"); }) === "worm/tampered");
+  check("list reflects stored ids", w.list().indexOf("t") !== -1);
+}
+
+function testCallerCannotMutateThroughInput() {
+  // A caller that keeps a reference to the Buffer it put must not be able to
+  // change the stored record after the fact — the store owns a private copy.
+  var w = b.worm.create({ defaultRetentionMs: 1000 });
+  var input = Buffer.from("original");
+  w.put("k", input);
+  input.write("XXXXXXXX");                       // mutate the caller's buffer
+  var got = w.get("k");
+  check("post-put input mutation does not change stored bytes", got.data.toString() === "original");
+}
+
+function testCallerCannotMutateThroughOutput() {
+  // The buffer get() returns is a copy; mutating it must not corrupt the
+  // record or trip a false tamper on the next read.
+  var w = b.worm.create({ defaultRetentionMs: 1000 });
+  w.put("k", "original");
+  var first = w.get("k");
+  first.data.write("XXXXXXXX");                  // mutate the returned buffer
+  var second = w.get("k");
+  check("mutating get() output does not corrupt the record", second.data.toString() === "original");
+  check("record still verifies after output mutation",        code(function () { w.get("k"); }) === "NO-THROW");
+}
+
+async function run() {
+  testSurface();
+  testWriteOnceAndRetain();
+  testExtendOnly();
+  testLegalHold();
+  testGovernanceOverride();
+  testTamperEvidence();
+  testCallerCannotMutateThroughInput();
+  testCallerCannotMutateThroughOutput();
+}
+module.exports = { run: run };
+if (require.main === module) { run().then(function () { console.log("[worm] OK — " + helpers.getChecks() + " checks passed"); }, function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }); }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.1.32",
+  "version": "0.1.34",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {
@@ -40,6 +40,6 @@
   "homepage": "https://blamejs.shop",
   "devDependencies": {
     "@cloudflare/containers": "^0.3.4",
-    "wrangler": "^4.93.0"
+    "wrangler": "^4.95.0"
   }
 }