@blamejs/blamejs-shop 0.1.33 → 0.1.35

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.1.x
 
+- v0.1.35 (2026-05-26) — **Cookie-consent banner — GDPR/ePrivacy consent with category opt-in, an audit ledger, and a preferences page.** Every page now carries a cookie-consent banner until the visitor decides. They can accept all, reject everything non-essential, or open preferences to toggle categories; the choice is stored in a sealed first-party cookie and recorded in a consent ledger for the audit trail. Strictly-necessary cookies (session, CSRF, the consent choice itself) always work; analytics and marketing are opt-in and default-deny, and a Do-Not-Track or Global-Privacy-Control signal collapses them to denied regardless of any stored opt-in. A "Manage cookies" footer link reopens the preferences. The banner and its choice form are server-rendered and work with JavaScript off — the small enhancement script only hides the banner once a choice exists — and the banner renders identically from the edge and the container. A consent-gating hook lets future analytics/marketing scripts render only when their category is granted. **Added:** *Consent banner + preferences page* — A banner shows on every page until a choice is made: Accept all, Reject non-essential, or Manage preferences. `POST /consent` records the decision (validated; safe-redirect back to where the visitor was), and `GET /cookies` is a preferences page to review and change categories later, linked from the footer. The authoritative choice is a sealed, HttpOnly first-party cookie; a tampered or missing cookie simply reshows the banner rather than erroring. Every decision is also written to the consent ledger for the GDPR audit trail, best-effort so a ledger hiccup never blocks the choice from taking effect. · *Category opt-in with DNT / GPC honored* — Cookies are grouped into strictly-necessary (always on) plus toggleable categories (analytics, marketing, …) that are opt-in and default-deny. A `DNT: 1` or `Sec-GPC: 1` request header forces the non-essential categories to denied regardless of any stored opt-in. A server-side gating hook renders a category's script only when that category is granted, so future analytics/marketing islands are consent-gated by construction. · *Consent is anchored to a policy version* — Each stored decision records the cookie-policy version it was captured under. When an operator bumps the active version (the cookie policy materially changed), decisions taken under the old version stop being honored — the gate falls back to default-deny for the optional categories and the banner re-prompts so consent is re-collected, rather than coasting on opt-ins given under a superseded policy. The banner and preferences page keep working with JavaScript off; the enhancement script only suppresses the banner while the stored version still matches the active one.
+
+- v0.1.34 (2026-05-26) — **Vendored blamejs refreshed to v0.13.0.** Refreshes the vendored blamejs stack from v0.12.11 to v0.13.0 — the single source of every security, crypto, and primitive the shop composes. No application API changes; the refresh keeps the shop current with upstream fixes and broadens the primitive surface the shop builds on. The vendored tree is verified against the release tag by the vendor-integrity gate, and the in-image smoke gate runs against the refreshed tree before any image ships. **Changed:** *Vendored blamejs v0.12.11 → v0.13.0* — The committed copy under `lib/vendor/blamejs/` is updated to the v0.13.0 release tag via the vendor-refresh entry point. Composed primitives are unchanged at the call sites the shop already uses; the refresh carries upstream maintenance and expands the available primitive surface for future shop features.
+
 - v0.1.33 (2026-05-26) — **Search filters and synonyms — narrow results by facet, and match what shoppers mean, not just what they typed.** Search gains filters and smarter matching. A search result page now shows facet groups — collection, price range, and in-stock — as filter controls; choosing one narrows the results, the counts beside each option reflect the current result set, and choices combine across groups. Active filters show with a one-click clear and carry through pagination rather than dropping on page two. All filtering is server-side from query parameters, so it works with no client JavaScript. Separately, the query is expanded through an operator-curated synonym and typo vocabulary before the catalog is searched, so a search for "tee" matches "t-shirt" and a near-miss spelling still finds the product, with a "Showing results for" note when the query was corrected. Filters and synonym matching work identically whether the page is served from the edge or the container. This release also moves the shipped theme's stylesheets and island scripts to content-fingerprinted filenames so an asset and the page that references it can never fall out of sync. **Added:** *Faceted search filters* — A search result page shows facet groups — collection, price range, and in-stock availability — as server-rendered filter controls. Selecting a facet narrows the results and is reflected in the URL (for example `/search?q=shirt&collection=summer&in_stock=1`), the count beside each option reflects how many results it would yield against the current query, and facets combine across groups. Active filters render as removable chips with a clear-all path, and the active filters carry through result pagination so page two keeps the filter set. All filtering is server-side from the query string — no client JavaScript — and unknown facet keys, out-of-range price values, and garbage filter values are ignored rather than erroring. With filters applied and no matches, the page shows an empty state with a clear-filters link. · *Synonym and typo-tolerant query matching* — Before the catalog is searched, the query is expanded through an operator-curated vocabulary: synonym groups (so "tee" matches "t-shirt"), common typo corrections, and stopword removal. When the query is corrected or expanded, the page shows a "Showing results for" note. A query that still matches nothing falls back to the raw terms so search never silently empties on an unknown word. **Changed:** *Search filters and synonyms render identically at the edge and the container* — The faceting and synonym logic runs in both the edge worker and the container search path, producing the same results and the same filter chrome whichever serves the page. The edge path reads the catalog and the facet/synonym vocabulary directly from the database, missing-table-resilient, so a shop without the optional facet configuration still searches normally. · *Theme stylesheets and scripts use content-fingerprinted filenames* — The shipped default theme's stylesheets and island scripts are now referenced by a content-hashed filename (`main.<hash>.css`) rather than a `?v=` query, emitted identically by the edge and container renderers and served from object storage under the fingerprinted key. Each URL maps to exactly one byte-content, so an asset and the page that references it can never disagree on a Subresource Integrity digest, and previously-served pages keep working across an asset change. The edge stylesheet link now also carries an integrity attribute, matching the container.
 
 - v0.1.32 (2026-05-26) — **Bundles and quantity discounts — sell products together at a set price, and reward buying more.** Two merchandising surfaces go live on the product page and in the cart, both priced authoritatively on the server. A product that belongs to a bundle shows a "Bundle & save" offer with its member products and the bundle price against the sum of the parts; one action adds the whole bundle to the cart at that price, all-or-nothing, and the discount is split across the member lines so the cart subtotal equals the quoted bundle price. Separately, a product with quantity breaks shows its price tiers ("1–2 / 3–5 / 6+") on the page, and the cart applies the right unit price for each line's quantity — recomputed on every cart render and again at checkout, so the line, cart, and order totals all reflect the break. The client never sends a price: it sends a bundle code or a quantity, and the server prices both from the live catalog. A bundle whose member is archived or out of stock is shown unavailable rather than adding a broken line, and a missing offer simply renders nothing. **Added:** *Bundles on the product page* — A product that is part of one or more bundles shows a "Bundle & save" offer listing the bundle's member products, the bundle price, and the saving against buying the parts separately. `POST /cart/bundle` adds the whole bundle to the cart in one action: the bundle price is recomputed from the live catalog and allocated across the member lines (proportional to each member's list price, with the rounding remainder on the last line) so the cart subtotal equals the quoted price. The add is atomic — if any member is archived or out of stock the bundle is shown unavailable and the action adds nothing rather than a partial set. A product in no bundle shows no offer; an unpriceable bundle (a missing member price or a currency mismatch) is shown unavailable, never a server error. The offer renders identically from the edge worker and the container. · *Quantity discounts on the product page and in the cart* — A product with quantity breaks shows its price tiers on the page (for example 1–2, 3–5, 6+ at descending unit prices). In the cart, each line is priced at the unit price for its quantity — applied server-side on every cart render so changing the quantity re-prices the line, and applied again at checkout so the per-line price and the order total written onto the order reflect the break, not the list price. A quantity below the first tier falls back to the base price; a quantity above the top tier takes the top tier. Stacks with the rest of the cart math. The tier table renders identically from the edge worker and the container. **Fixed:** *Themed product template carries the compare control* — The file-backed default product template now includes the Add-to-compare slot, matching the built-in render path so the comparison control appears on the product page whichever template is in use.

package/README.md

@@ -80,6 +80,7 @@ Every primitive is composed on the vendored blamejs surface — no npm runtime d
 | **`lib/category-navigation.js`** | Hierarchical category tree surfaced as public browse pages. `GET /categories` lists the active top-level categories as a card grid; `GET /categories/:slug` renders one category — its title and optional description, a breadcrumb chain from the catalog root down to the current category, an optional hero image, and a grid of the category's direct child sub-categories. Each page reads fresh against the active tree, so archived / unpublished categories drop out of every surface. Public, no sign-in; an unknown, archived, or malformed slug is a 404 (never a 500), and a category with no children renders a graceful empty state. Linked from the footer on every page. The tree itself (define / move / reorder / archive, with cycle defense bounded by `MAX_TREE_DEPTH`) is operator-managed through the primitive's write API. |
 | **`lib/search-facets.js`** | Filterable search. A search result page renders facet groups — collection, price range, in-stock — as server-rendered controls; selecting one narrows the results and rides the URL query string (`?q=…&collection=…&in_stock=1`), counts beside each option reflect the current result set, facets combine across groups, and active filters show as removable chips with a clear-all path that survives result pagination. All filtering is server-side from the query string (no client JS); unknown facet keys, out-of-range prices, and garbage values are ignored rather than erroring; an empty filtered result shows a clear-filters state. Runs identically at the edge worker and the container — the edge reads the catalog and facet registry straight from D1, missing-table-resilient. |
 | **`lib/search-synonyms.js`** | Typo-tolerant, synonym-aware query matching. Before the catalog is searched, the query is expanded through an operator-curated vocabulary — synonym groups (so "tee" matches "t-shirt"), common typo corrections, and stopword removal — and the page shows a "Showing results for" note when the query was corrected or expanded. A query that still matches nothing falls back to the raw terms so search never silently empties on an unknown word. Shared rewrite instance; runs identically at the edge and the container. |
+| **`lib/cookie-consent.js`** | GDPR/ePrivacy cookie consent. Every page carries a banner until the visitor decides — accept all, reject non-essential, or manage categories — with the choice in a sealed first-party cookie and recorded in a consent ledger for the audit trail. Strictly-necessary cookies are always on; analytics/marketing are opt-in and default-deny, and a `DNT`/`Sec-GPC` header forces non-essential to denied regardless of stored opt-in. `POST /consent` sets the choice (safe-redirect back); `GET /cookies` is the preferences page (footer-linked). A server-side gating hook renders a category's script only when granted. Banner + form are server-rendered (work with JS off; the island only hides the banner once decided) and identical at the edge and container. |
 | **`lib/subscriptions.js`** | Stripe-backed recurring billing — `subscription_plans` (interval / amount / trial) + `subscriptions` (mirrors Stripe's object byte-for-byte). `subscriptions.create` POSTs to Stripe via the payment dep, then persists the returned object locally. `handleStripeEvent` replays `customer.subscription.*` events into the local row so the shop has an authoritative view without round-tripping. Customers view + cancel their own subscriptions at `/account/subscriptions` (ownership-checked; cancel mounts when the payment handle is wired). |
 | **`lib/giftcards.js`** | Prepaid bearer gift cards. `issue({ amount_minor, currency })` generates a 16-char code (32-glyph alphabet, no ambiguous letters) via `b.crypto.generateBytes`, stores only its `namespaceHash` digest + a 4-char hint, and returns the plaintext code once. `balance(code)` / `lookup(code)` resolve a code to its live balance (constant-time hash compare); `redeem({ code, order_id, amount_minor })` decrements the balance with an atomic `balance >= amount` SQL guard so concurrent spends can't overdraw. Redeemed at checkout as a credit against the order grand total: the amount due drops by the applied balance (never below zero), the order still records the full total it owed, and the debit is recorded once per order — a card that fully covers the order is marked paid with no Stripe charge. Customers check a balance at `GET /gift-cards`; the page is not a code-existence oracle (unknown / malformed / expired all return the same generic not-found). |
 | **`lib/gift-card-ledger.js`** | Append-only credit / debit / expire history per gift card, with a denormalized `balance_after_minor` snapshot for O(1) balance reads. `credit` / `debit` / `expire` write one row each; `history(id)` paginates a card's transactions; `transactionsForOrder(id)` lists a card's movements for one order. The audit trail behind the admin gift-card ledger console; overdraft is refused at the primitive layer. |

package/lib/asset-manifest.json

@@ -1,13 +1,17 @@
 {
-  "version": "0.1.33",
+  "version": "0.1.35",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-rvjL1QySBgNJGEUDusbbMCkL3fsjmzcwUvTp9pljo/0Nn/lErxq2AbY8EYvDF9Ch",
       "fingerprinted": "css/admin.4dc78dfc45d0736d.css"
     },
     "css/main.css": {
-      "integrity": "sha384-A2m9cYLHIlIrFvTluTOaZz9r8F90yWIKd3SHOlyNwQwtaOBrzlsn/NDR1vso6dSF",
-      "fingerprinted": "css/main.91c0dfab0198569c.css"
+      "integrity": "sha384-eNBBXiZ+B0S2drwiWoHzw7FzZRNGRO79o9VIwsaujSHTxQLz2zJabp0x74kFxAxq",
+      "fingerprinted": "css/main.0ef22690caec76ea.css"
+    },
+    "js/consent.js": {
+      "integrity": "sha384-KKMQ0og8HPOykRRPpUyxX7dMhTvKySfVtpGX/jGWzZwNaN/c4OykvRvXpqBHcQST",
+      "fingerprinted": "js/consent.517d6ad1fbf106a1.js"
     },
     "js/passkey-login.js": {
       "integrity": "sha384-65i1wVHIkiS2e0YiOV6oUOF9+tNR7s6QRvpnWaEne43P+B8UvKLTpDgp4MSKNGqX",

package/lib/storefront.js

@@ -77,6 +77,52 @@ var _render = emailModule._render;
 // the bound R2 bucket. The 1536×1024 source PNG is committed
 // only to .template/ (local-only) and uploaded once via
 // `wrangler r2 object put`.
+
+// Cookie-consent banner — present in the chrome of every page (both
+// the container render below and each worker/render/*.js LAYOUT, kept
+// byte-identical). GDPR (EU 2016/679 art. 6 + 7) + ePrivacy (2002/58/EC
+// art. 5(3)) demand informed, specific, opt-in consent BEFORE any non-
+// strictly-necessary cookie / tracker is set, with default-deny on the
+// toggleable categories and a withdraw path. The banner is a plain
+// server-rendered form that POSTs to /consent — it works with no client
+// JS at all (essential-only browsing, accept, reject, and the granular
+// preference center are all reachable JS-off).
+//
+// Because the storefront's read pages are edge-cached for cookie-less
+// visitors (worker/index.js `_edgeRenderCached`), the banner can't be
+// server-conditionally omitted on a cached page — the cached HTML is one
+// document shared across visitors. So the banner ships in every document
+// and the dismissal is cookie-driven on the client: the consent island
+// (themes/default/assets/js/consent.js) reads the non-sealed
+// `shop_consent_set` flag cookie and hides the banner when a choice
+// already exists. The authoritative decision lives in the sealed
+// `shop_consent` cookie + the cookie-consent ledger (server-side); the
+// flag cookie is a non-authoritative "has decided" hint that only drives
+// banner visibility. Nothing in this block reflects a visitor-supplied
+// value, so there is no interpolation and no escape surface.
+//
+// `hidden` is the default visible state inversion: the dialog renders
+// visible for a visitor with no decision (JS-off included). The island
+// adds `data-consent-decided` to <html> and the CSS hides the dialog,
+// so a returning visitor never sees it. A visitor with JS disabled who
+// has already decided sees the banner again — but every control still
+// works server-side, so they re-confirm rather than hit a dead end.
+var CONSENT_BANNER =
+  "  <div class=\"consent-banner\" id=\"consent-banner\" role=\"dialog\" aria-modal=\"false\" aria-labelledby=\"consent-title\" aria-describedby=\"consent-desc\">\n" +
+  "    <div class=\"consent-banner__inner\">\n" +
+  "      <div class=\"consent-banner__copy\">\n" +
+  "        <h2 class=\"consent-banner__title\" id=\"consent-title\">Your privacy choices</h2>\n" +
+  "        <p class=\"consent-banner__desc\" id=\"consent-desc\">We use strictly-necessary cookies to run the shop (your session, security tokens, and this choice itself). Optional cookies — functional, analytics, marketing, and preferences — are off until you turn them on. You can change this any time from <a href=\"/cookies\">Manage cookies</a>.</p>\n" +
+  "      </div>\n" +
+  "      <form class=\"consent-banner__actions\" method=\"post\" action=\"/consent\">\n" +
+  "        <input type=\"hidden\" name=\"return_to\" value=\"/\" data-consent-return>\n" +
+  "        <button type=\"submit\" name=\"choice\" value=\"accept_all\" class=\"btn-primary consent-banner__btn\">Accept all</button>\n" +
+  "        <button type=\"submit\" name=\"choice\" value=\"reject\" class=\"btn-ghost consent-banner__btn\">Reject non-essential</button>\n" +
+  "        <a class=\"consent-banner__manage\" href=\"/cookies\">Manage preferences</a>\n" +
+  "      </form>\n" +
+  "    </div>\n" +
+  "  </div>\n";
+
 var LAYOUT =
   "<!DOCTYPE html>\n" +
   "<html lang=\"en\">\n" +
@@ -194,9 +240,12 @@ var LAYOUT =
   "        <li><a href=\"/SECURITY.md\">Security</a></li>\n" +
   "        <li><a href=\"/privacy\">Privacy</a></li>\n" +
   "        <li><a href=\"/terms\">Terms</a></li>\n" +
+  "        <li><a href=\"/cookies\">Manage cookies</a></li>\n" +
   "      </ul>\n" +
   "    </div>\n" +
   "  </footer>\n" +
+  CONSENT_BANNER +
+  "RAW_CONSENT_SCRIPT" +
   "</body>\n" +
   "</html>\n";
 
@@ -254,10 +303,16 @@ function _assetSri(relUnderThemeAssets) {
   var entry = _assetManifest.assets[relUnderThemeAssets];
   return (entry && entry.integrity) || null;
 }
-function _islandScript(name) {
+function _islandScript(name, opts) {
   var sri = _assetSri("js/" + name);
-  return "<script src=\"" + _assetUrl("js/" + name) + "\"" +
-    (sri ? " integrity=\"" + sri + "\"" : "") + " defer></script>";
+  // Optional `id` (so an island can find its own <script> at runtime) and
+  // `policy` (the active consent policy version, stamped for the consent
+  // island to compare against the flag cookie). Both are charset-safe by
+  // construction at the call site, so they go in without escaping.
+  var idAttr     = (opts && opts.id)     ? " id=\"" + opts.id + "\"" : "";
+  var policyAttr = (opts && opts.policy) ? " data-consent-policy=\"" + opts.policy + "\"" : "";
+  return "<script" + idAttr + " src=\"" + _assetUrl("js/" + name) + "\"" +
+    (sri ? " integrity=\"" + sri + "\"" : "") + " defer" + policyAttr + "></script>";
 }
 
 function _wrap(opts) {
@@ -291,7 +346,9 @@ function _wrap(opts) {
     og_image:       ogImage,
     og_url:         ogUrl,
     body:           "RAW_BODY_PLACEHOLDER",
-  }).replace("RAW_CSS_INTEGRITY", themeCssIntegrity).replace("RAW_BODY_PLACEHOLDER", opts.body);
+  }).replace("RAW_CSS_INTEGRITY", themeCssIntegrity)
+    .replace("RAW_CONSENT_SCRIPT", _islandScript("consent.js", { id: "consent-island", policy: _activeConsentPolicy }))
+    .replace("RAW_BODY_PLACEHOLDER", opts.body);
   // The body is RAW HTML (already rendered + escaped at the
   // per-fragment level). The placeholder swap is post-render so the
   // outer renderer's HTML-escape doesn't double-escape the inner
@@ -3422,6 +3479,82 @@ function renderNewsletterError(opts) {
   });
 }
 
+// ---- cookie preference center ------------------------------------------
+
+// The four toggleable categories + their operator-facing copy, mirroring
+// lib/cookie-consent.js's category taxonomy. Order is fixed so the page
+// reads the same every render.
+var CONSENT_CATEGORY_COPY = [
+  { key: "functional",  name: "Functional",  desc: "Remember-me, locale, and currency-selector cookies that make the shop more convenient." },
+  { key: "analytics",   name: "Analytics",   desc: "Aggregate, privacy-respecting usage measurement so we can see which pages help and which don't." },
+  { key: "marketing",   name: "Marketing",   desc: "Advertising and retargeting pixels. Off unless you turn them on; a Do-Not-Track or Global Privacy Control signal keeps them off regardless." },
+  { key: "preferences", name: "Preferences", desc: "Your saved UI tweaks — dark mode, list density, and similar non-essential settings." },
+];
+
+// The /cookies manage page. Pre-checks each toggle from the visitor's
+// stored decision (all off when there's no decision yet — default-deny).
+// `decision` is the shape `_readConsentDecision` returns, or null.
+// `notice` is an optional operator-fixed confirmation string (e.g. after
+// a save) — never a reflected visitor value.
+function renderCookiePreferences(opts) {
+  opts = opts || {};
+  var decision = opts.decision || null;
+  var noticeHtml = "";
+  if (opts.notice === "saved") {
+    noticeHtml = "<p class=\"consent-page__notice\" role=\"status\">Your cookie preferences were saved. They take effect immediately and you can change them again any time on this page.</p>";
+  } else if (opts.notice === "invalid") {
+    noticeHtml = "<p class=\"consent-page__notice\" role=\"alert\">That submission wasn't understood, so nothing changed. Choose your categories below and save again.</p>";
+  }
+
+  var cats = "";
+  for (var i = 0; i < CONSENT_CATEGORY_COPY.length; i += 1) {
+    var c = CONSENT_CATEGORY_COPY[i];
+    var on = decision && decision.categories && decision.categories[c.key] === true;
+    cats +=
+      "<div class=\"consent-cat\">" +
+        "<div class=\"consent-cat__head\">" +
+          "<h2 class=\"consent-cat__name\">" + c.name + "</h2>" +
+          "<label class=\"consent-toggle\">" +
+            "<span class=\"skip-link\">Allow " + c.name + " cookies</span>" +
+            "<input type=\"checkbox\" name=\"cat_" + c.key + "\" value=\"1\"" + (on ? " checked" : "") + ">" +
+          "</label>" +
+        "</div>" +
+        "<p class=\"consent-cat__desc\">" + c.desc + "</p>" +
+      "</div>";
+  }
+
+  var body =
+    "<section class=\"consent-page\">" +
+      "<p class=\"eyebrow\">Privacy</p>" +
+      "<h1>Cookie preferences</h1>" +
+      "<p class=\"consent-page__lede\">Strictly-necessary cookies — your session, security tokens, and this choice itself — are always on because the shop can't run without them. Everything below is optional and off by default.</p>" +
+      noticeHtml +
+      "<form method=\"post\" action=\"/consent\">" +
+        "<input type=\"hidden\" name=\"return_to\" value=\"/cookies\">" +
+        "<div class=\"consent-cat\">" +
+          "<div class=\"consent-cat__head\">" +
+            "<h2 class=\"consent-cat__name\">Strictly necessary</h2>" +
+            "<span class=\"consent-cat__always\">Always on</span>" +
+          "</div>" +
+          "<p class=\"consent-cat__desc\">Session, CSRF protection, and your cookie choice. These can't be switched off.</p>" +
+        "</div>" +
+        cats +
+        "<div class=\"consent-page__actions\">" +
+          "<button type=\"submit\" name=\"choice\" value=\"granular\" class=\"btn-primary\">Save preferences</button>" +
+          "<button type=\"submit\" name=\"choice\" value=\"accept_all\" class=\"btn-ghost\">Accept all</button>" +
+          "<button type=\"submit\" name=\"choice\" value=\"reject\" class=\"btn-ghost\">Reject non-essential</button>" +
+        "</div>" +
+      "</form>" +
+    "</section>";
+  return _wrap({
+    title:      "Cookie preferences",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
+
 // ---- 404 ---------------------------------------------------------------
 
 function renderNotFound(opts) {
@@ -3589,6 +3722,148 @@ function _readReferralEnv(req) {
   try { return JSON.parse(raw); } catch (_e) { return null; }
 }
 
+// ---- cookie-consent cookies --------------------------------------------
+//
+// Two cookies carry a visitor's cookie-consent decision:
+//
+//   * `shop_consent`     — the authoritative decision, vault-sealed +
+//                          HttpOnly. Holds { categories, policy_version,
+//                          ts }. Read server-side to gate non-essential
+//                          cookies/trackers and to pre-check the manage
+//                          page's toggles. A tampered / truncated / stale
+//                          value fails the seal and reads as "no decision"
+//                          (the banner reshows) rather than throwing.
+//   * `shop_consent_set` — a non-sealed, NON-HttpOnly "1" flag the consent
+//                          island reads to hide the banner on edge-cached
+//                          pages. Non-authoritative: it only drives banner
+//                          visibility, never the actual cookie/tracker gate.
+//
+// The four toggleable categories mirror lib/cookie-consent.js's
+// TOGGLEABLE_CATEGORIES; strictly-necessary is implicit-on and never
+// stored here.
+var CONSENT_COOKIE_NAME      = "shop_consent";
+var CONSENT_FLAG_COOKIE_NAME = "shop_consent_set";
+var CONSENT_TOGGLEABLE       = ["functional", "analytics", "marketing", "preferences"];
+
+// The consent policy version visitors are being asked to consent to. A
+// stored decision (sealed cookie) captured under an older version is no
+// longer authoritative: the gate stops honoring it and the banner re-
+// prompts, so an operator who materially changes their cookie policy and
+// bumps the version re-collects consent rather than coasting on stale
+// opt-ins. Mirrors lib/cookie-consent.js's `policy_version` charset so the
+// value is safe to stamp into a cookie value and an HTML attribute; an
+// out-of-charset / over-length / missing value falls back to "v1" (the
+// initial version, matching the edge worker's stamped default). The active
+// value is read live from `deps.cookieConsent.policyVersion` per request in
+// the server gate (so a runtime bump takes effect immediately); the module
+// snapshot drives the page-stamped value set once at mount.
+var _activeConsentPolicy = "v1";
+function _sanitizeConsentPolicy(v) {
+  return (typeof v === "string" && /^[A-Za-z0-9._-]{1,64}$/.test(v)) ? v : "v1";
+}
+
+// Persist a decision: the sealed authoritative cookie + the non-sealed
+// flag. Both expire in 180 days — ICO / CNIL guidance treats ~6 months as
+// the upper bound before a consent re-prompt; the cookie-consent ledger
+// keeps the durable audit record regardless of cookie lifetime.
+function _setConsentCookies(res, decision) {
+  var T = b.constants.TIME;
+  var exp = new Date(Date.now() + T.days(180));
+  _cookieJar().writeSealed(res, CONSENT_COOKIE_NAME, JSON.stringify(decision), { expires: exp });
+  // Not HttpOnly — the consent island must read it from document.cookie to
+  // decide whether to hide the banner. Its value is the policy version the
+  // decision was captured under (charset-constrained, no decision detail),
+  // so the island can compare it to the active version stamped on its
+  // <script> tag and re-prompt when the operator has bumped the policy. A
+  // script-readable version string leaks nothing the server would act on.
+  var flagVal = _sanitizeConsentPolicy(decision && decision.policy_version);
+  _cookieJar().write(res, CONSENT_FLAG_COOKIE_NAME, flagVal, { expires: exp, httpOnly: false });
+}
+
+// The visitor's stored decision, or null when none / malformed / stale.
+// Shape-validates the unsealed payload so a forged-but-unsealable or schema-
+// drifted value reads as "no decision". `activePolicy` is the policy version
+// currently in force (defaults to the module snapshot; the server routes
+// pass the live `deps.cookieConsent.policyVersion`): a decision whose
+// `policy_version` doesn't match it — including an unversioned legacy value
+// — reads as "no decision" so the operator's policy bump re-collects consent
+// rather than the gate honoring opt-ins captured under a superseded policy.
+function _readConsentDecision(req, activePolicy) {
+  var raw = _cookieJar().readSealed(req, CONSENT_COOKIE_NAME);
+  if (raw === null) return null;
+  var parsed;
+  try { parsed = JSON.parse(raw); } catch (_e) { return null; }
+  if (!parsed || typeof parsed !== "object" || !parsed.categories || typeof parsed.categories !== "object") {
+    return null;
+  }
+  var active = (arguments.length > 1) ? _sanitizeConsentPolicy(activePolicy) : _activeConsentPolicy;
+  if (parsed.policy_version !== active) return null;
+  var cats = {};
+  for (var i = 0; i < CONSENT_TOGGLEABLE.length; i += 1) {
+    cats[CONSENT_TOGGLEABLE[i]] = parsed.categories[CONSENT_TOGGLEABLE[i]] === true;
+  }
+  return {
+    categories:     cats,
+    policy_version: parsed.policy_version,
+    ts:             Number.isFinite(parsed.ts) ? parsed.ts : null,
+  };
+}
+
+// Server-side gating hook. Returns true when `category` may emit a
+// cookie / tag / pixel byte for this request. Strictly-necessary is
+// always allowed; the four toggleable categories consult the stored
+// decision (default-deny when absent). DNT / Sec-GPC collapse analytics
+// + marketing to false regardless of the stored opt-in (browser-level
+// opt-out wins — same rule the cookie-consent ledger records and
+// honors). This is the single function a future analytics / marketing
+// island gates its render on:
+//
+//   if (_consentAllows(req, "analytics", _liveConsentPolicy())) body += _islandScript("analytics.js");
+//
+// so a tracker is never injected into the document unless the visitor
+// opted that category in.
+function _consentAllows(req, category, activePolicy) {
+  if (category === "strictly_necessary") return true;
+  if (CONSENT_TOGGLEABLE.indexOf(category) === -1) return false;
+  var decision = (arguments.length > 2)
+    ? _readConsentDecision(req, activePolicy)
+    : _readConsentDecision(req);
+  if (!decision) return false;
+  if ((category === "analytics" || category === "marketing") && _browserOptOut(req)) return false;
+  return decision.categories[category] === true;
+}
+
+// DNT (Do-Not-Track) header set to "1". Defensive read — missing /
+// garbage reads as "no signal".
+function _dntSignal(req) {
+  var h = (req && req.headers) || {};
+  return String(h["dnt"] || h["DNT"] || "") === "1";
+}
+
+// Sec-GPC (Global Privacy Control) header set to "1".
+function _gpcSignal(req) {
+  var h = (req && req.headers) || {};
+  return String(h["sec-gpc"] || h["Sec-GPC"] || "") === "1";
+}
+
+// Either DNT or GPC is an implicit deny for analytics + marketing.
+function _browserOptOut(req) {
+  return _dntSignal(req) || _gpcSignal(req);
+}
+
+// Coarse UA classifier for the consent ledger row — matches
+// lib/cookie-consent.js's UA_CLASS_VALUES. Defensive: unknown / missing
+// UA reads as "unknown".
+function _uaClass(req) {
+  var ua = String((req && req.headers && (req.headers["user-agent"] || req.headers["User-Agent"])) || "").toLowerCase();
+  if (!ua) return "unknown";
+  if (/bot|crawl|spider|slurp|bingpreview|headless/.test(ua)) return "bot";
+  if (/ipad|tablet|kindle|playbook|silk/.test(ua)) return "tablet";
+  if (/mobi|iphone|android.*mobile|phone/.test(ua)) return "mobile";
+  if (/windows|macintosh|linux|cros|x11/.test(ua)) return "desktop";
+  return "unknown";
+}
+
 // ---- account-page renderers --------------------------------------------
 
 var ACCOUNT_LOGIN_PAGE =
@@ -3808,6 +4083,20 @@ function mount(router, deps) {
   // Stripe via the primitive); without it the list stays read-only.
   var subscriptions = deps.subscriptions || null;
 
+  // Active cookie-consent policy version. `_liveConsentPolicy()` reads it
+  // from the consent primitive per request so a runtime `policyVersion`
+  // bump takes effect on the gate immediately, and refreshes the module
+  // snapshot the page-stamp reads — the snapshot exists because the
+  // module-level renderers (`_wrap`) don't close over `deps`, so consulting
+  // the live version (every consent route does) keeps the stamped value in
+  // step without threading it through every render call. Set once here so
+  // the value is correct from the first render after boot.
+  function _liveConsentPolicy() {
+    _activeConsentPolicy = _sanitizeConsentPolicy(deps.cookieConsent && deps.cookieConsent.policyVersion);
+    return _activeConsentPolicy;
+  }
+  _liveConsentPolicy();
+
   function _send(res, status, html) {
     res.status(status);
     res.setHeader && res.setHeader("content-type", "text/html; charset=utf-8");
@@ -6966,6 +7255,144 @@ function mount(router, deps) {
     });
   }
 
+  // ---- cookie consent -----------------------------------------------------
+  //
+  // GDPR (EU 2016/679 art. 6 + 7) + ePrivacy (2002/58/EC art. 5(3)) opt-in
+  // for non-strictly-necessary cookies. The banner ships in the chrome of
+  // every page (see CONSENT_BANNER in the layout); these two routes back
+  // it. No auth, no client JS required — the banner form and the manage
+  // page both work server-rendered for a guest with scripting disabled.
+  //
+  // The decision is written to a sealed first-party cookie (the gate) AND
+  // recorded in the cookie-consent ledger (the audit trail) when the
+  // primitive is wired. CSRF / origin / fetch-metadata defenses are the
+  // framework middleware already on every POST — no per-route re-check.
+
+  // Same-origin path guard for `return_to`. Accepts a single leading slash
+  // followed by a non-slash (so `//evil.example` and absolute URLs are
+  // refused), capping length defensively. Anything else collapses to the
+  // safe default the caller passes.
+  function _consentReturnTo(raw, fallback) {
+    if (typeof raw === "string" && raw.length <= 512 && /^\/[^/]/.test(raw)) return raw;
+    return fallback;
+  }
+
+  // Translate a posted choice + per-category checkboxes into the four
+  // toggleable booleans. `accept_all` turns every category on; `reject`
+  // turns every category off; `granular` reads each `cat_<key>` checkbox
+  // (present + "1" == on, absent == off — the unchecked-by-default
+  // ePrivacy shape). Returns null for an unknown choice so the caller can
+  // 400 a malformed submit.
+  function _consentCategoriesFromBody(body) {
+    var choice = body && body.choice;
+    var cats = { functional: false, analytics: false, marketing: false, preferences: false };
+    if (choice === "accept_all") {
+      cats.functional = cats.analytics = cats.marketing = cats.preferences = true;
+      return cats;
+    }
+    if (choice === "reject") {
+      return cats;
+    }
+    if (choice === "granular") {
+      for (var i = 0; i < CONSENT_TOGGLEABLE.length; i += 1) {
+        var k = CONSENT_TOGGLEABLE[i];
+        cats[k] = body["cat_" + k] === "1";
+      }
+      return cats;
+    }
+    return null;
+  }
+
+  // Ensure a session id exists so the consent decision is keyed to a
+  // stable (hashed-at-the-ledger) session. Reuses the existing shop_sid
+  // cookie when present; mints one otherwise — consent is a guest-
+  // reachable flow, so it can't assume a cart already created the sid.
+  function _ensureSid(req, res) {
+    var sid = _readSidCookie(req);
+    if (!sid) {
+      sid = b.uuid.v7();
+      _setSidCookie(res, sid);
+    }
+    return sid;
+  }
+
+  // POST /consent — set the decision. Drives both the banner (Accept all /
+  // Reject) and the manage page's granular save. Writes the sealed gate
+  // cookie + the non-sealed flag cookie, records the decision in the
+  // cookie-consent ledger (best-effort — a ledger hiccup never blocks the
+  // decision from taking effect), then 303s back to a safe same-origin
+  // return_to.
+  router.post("/consent", async function (req, res) {
+    var body = req.body || {};
+    var cats = _consentCategoriesFromBody(body);
+    var fromManage = (typeof body.return_to === "string" && body.return_to.indexOf("/cookies") === 0);
+
+    // Malformed (unknown / missing choice) → 400. Re-render the manage
+    // page so the visitor lands somewhere actionable rather than on a
+    // bare error string.
+    if (!cats) {
+      var cartCount400 = 0;
+      try { cartCount400 = await _cartCountForReq(req); } catch (_e) { /* drop-silent — empty cart fallback */ }
+      return _send(res, 400, renderCookiePreferences({
+        shop_name:  shopName,
+        cart_count: cartCount400,
+        theme:      theme,
+        decision:   _readConsentDecision(req, _liveConsentPolicy()),
+        notice:     "invalid",
+      }));
+    }
+
+    var sid = _ensureSid(req, res);
+    var decision = {
+      categories:     cats,
+      policy_version: _liveConsentPolicy(),
+      ts:             Date.now(),
+    };
+    _setConsentCookies(res, decision);
+
+    // Durable audit trail. The cookie-consent ledger hashes the session id
+    // itself; we pass the raw sid + the browser DNT / GPC signals + a
+    // coarse UA class so the operator can prove to a supervisory authority
+    // both what was chosen and that a browser-level opt-out was honored.
+    if (deps.cookieConsent) {
+      try {
+        await deps.cookieConsent.recordConsent({
+          session_id: sid,
+          categories: cats,
+          ua_class:   _uaClass(req),
+          dnt:        _dntSignal(req),
+          gpc:        _gpcSignal(req),
+        });
+      } catch (_e) { /* drop-silent — the gate cookie is authoritative; the ledger write is the audit trail and must not block the decision */ }
+    }
+
+    var dest = _consentReturnTo(body.return_to, "/");
+    res.status(303);
+    res.setHeader && res.setHeader("location", fromManage ? "/cookies?saved=1" : dest);
+    return res.end ? res.end() : res.send("");
+  });
+
+  // GET /cookies — the preference center. Linked from the footer's
+  // "Manage cookies" and the banner's "Manage preferences". Pre-checks
+  // each toggle from the stored decision (all off when none exists). The
+  // `?saved=1` query renders a confirmation notice after a save 303.
+  router.get("/cookies", async function (req, res) {
+    var cartCount = 0;
+    try { cartCount = await _cartCountForReq(req); } catch (_e) { /* drop-silent — empty cart fallback */ }
+    var saved = false;
+    try {
+      var u = new URL(req.url, "http://localhost");
+      saved = u.searchParams.get("saved") === "1";
+    } catch (_e) { saved = false; }
+    return _send(res, 200, renderCookiePreferences({
+      shop_name:  shopName,
+      cart_count: cartCount,
+      theme:      theme,
+      decision:   _readConsentDecision(req, _liveConsentPolicy()),
+      notice:     saved ? "saved" : null,
+    }));
+  });
+
   // robots.txt — minimal crawl policy. Allow everything except
   // the admin API + cart + account + checkout / pay / orders (these
   // are session-scoped or operator-only, no crawl value), and
@@ -7083,6 +7510,7 @@ module.exports = {
   renderAccountRegister: renderAccountRegister,
   renderAccount:         renderAccount,
   renderAccountSubscriptions: renderAccountSubscriptions,
+  renderCookiePreferences: renderCookiePreferences,
   renderNotFound:        renderNotFound,
   // Layout exposed so operators forking the framework can override.
   _wrap:                 _wrap,

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.13.1",
-      "tag": "v0.13.1",
+      "version": "0.13.4",
+      "tag": "v0.13.4",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",
@@ -13,7 +13,7 @@
         "server": "lib/vendor/blamejs/"
       },
       "bundler": "shallow git clone of release tag from github.com/blamejs/blamejs",
-      "bundledAt": "2026-05-26"
+      "bundledAt": "2026-05-27"
     }
   }
 }

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,12 @@ upgrading across more than a few patches at a time.
 
 ## v0.13.x
 
+- v0.13.4 (2026-05-26) — **`b.crdt` — conflict-free replicated data types.** b.crdt adds state-based Conflict-free Replicated Data Types: data structures that independent replicas update without coordination and still converge to the same value once they have exchanged state. Each type's merge is a join over a semilattice — commutative, associative, and idempotent — so replicas can merge in any order, any number of times, and agree, which makes these the substrate for active/active cluster state, offline-first clients that reconcile on reconnect, and eventually-consistent counters, sets, and maps. The release ships the full state-based family: grow-only and positive-negative counters (gCounter / pnCounter), grow-only, two-phase, and observed-remove sets (gSet / twoPSet / orSet), a last-write-wins register (lwwRegister), and an observed-remove map (orMap). Every type exposes the same contract — local mutators, merge(other) that returns a converged instance without mutating either operand, value() for the materialized value, and state() / fromState() for a JSON-serializable form to snapshot via b.archive or b.backup or ship to a peer — and carries a replicaId so per-replica contributions stay distinct. **Added:** *`b.crdt` — state-based CvRDT counters, sets, register, and map* — `b.crdt.gCounter` / `pnCounter` (grow-only and increment/decrement counters), `b.crdt.gSet` / `twoPSet` / `orSet` (grow-only, two-phase, and observed-remove sets — `orSet` supports re-add and resolves a concurrent add-vs-remove as add-wins), `b.crdt.lwwRegister` (last-write-wins with a deterministic replicaId tie-break), and `b.crdt.orMap` (observed-remove keys with last-write-wins values). Each exposes `merge` / `value` / `state` / `fromState` and converges by the CvRDT laws. `orSet` and `orMap` accept `tombstoneRetention` to bound tombstone memory against a remove flood.
+
+- v0.13.3 (2026-05-26) — **`b.crypto.xwing` — X-Wing hybrid post-quantum KEM.** b.crypto.xwing adds the X-Wing hybrid key-encapsulation mechanism (draft-connolly-cfrg-xwing-kem): it runs ML-KEM-768 and X25519 side by side and binds their shared secrets with SHA3-256, so an encapsulated key stays secure as long as either ML-KEM-768 or X25519 holds. That is the conservative shape for moving off classical ECDH today — a harvest-now-decrypt-later attacker must break the lattice KEM, and a hypothetical ML-KEM break still leaves X25519 standing. keygen() produces a 32-byte decapsulation seed and a 1216-byte public key; encapsulate(publicKey) returns a 1120-byte ciphertext and a 32-byte shared secret; decapsulate(secretKey, ciphertext) recovers it. The X-Wing combiner is frozen, but its specification is still an IETF Internet-Draft, so this primitive is marked experimental and sits beside the existing pre-RFC post-quantum HPKE drafts; it composes the framework's vendored ML-KEM-768 and X25519 with SHA3 and adds no new cryptographic core. The combiner is known-answer-tested byte-for-byte against the draft's definition. **Added:** *`b.crypto.xwing` — X-Wing hybrid PQ/T KEM (experimental)* — `keygen(seed?)` → `{ publicKey (1216 B), secretKey (32-byte seed) }`; `encapsulate(publicKey, eseed?)` → `{ ciphertext (1120 B), sharedSecret (32 B) }`; `decapsulate(secretKey, ciphertext)` → the 32-byte shared secret. Both `keygen` and `encapsulate` accept an optional seed for deterministic operation. The combiner — `SHA3-256(ssMLKEM ‖ ssX25519 ‖ ctX25519 ‖ pkX25519 ‖ label)` — is exposed as `combiner` for advanced use. Marked `experimental` while draft-connolly-cfrg-xwing-kem remains an Internet-Draft; the algorithm itself is frozen.
+
+- v0.13.2 (2026-05-26) — **`b.iabTcf.encode` — write TCF consent strings, and a TC-string timestamp fix.** b.iabTcf gains the encode half of its consent-string codec: b.iabTcf.encode(obj) serialises a parsed object back into an IAB TCF v2 TC string, and b.iabTcf.isValid(tcString) is a total never-throwing validity check. Vendor and purpose collections may be Sets, id arrays, or the parsed sections parseString returns; vendor sections are written with whichever of the bit-field and range forms is smaller, matching the reference CMP encoders, so a parsed string round-trips to an equivalent signal. parseString now fully decodes the Core publisher-restrictions list and the PublisherTC segment's publisher and custom purposes, where it previously reported only the segment's presence. The encoder is verified against the worked-example string in the IAB Tech Lab consent-string specification: it re-encodes that string's Core segment byte-for-byte. This release also fixes a TC-string parsing bug — the bit reader accumulated values with a 32-bit shift, so the 36-bit Created and LastUpdated timestamp fields were silently truncated for any real date; they now decode and round-trip exactly. **Added:** *`b.iabTcf.encode` / `b.iabTcf.isValid`* — `encode(obj)` serialises a TCF object (the shape `parseString` returns) into a TC string — Core plus optional DisclosedVendors, AllowedVendors, and PublisherTC segments — choosing the smaller of the bit-field and range vendor encodings. `isValid(tcString)` returns whether a string parses as a well-formed Core segment without throwing. `parseString` now fully decodes Core publisher restrictions and the PublisherTC purposes that were previously reported only as present. **Fixed:** *TC-string 36-bit timestamps were truncated on parse* — `b.iabTcf.parseString` read multi-bit fields with a 32-bit left-shift accumulation. The 36-bit Created and LastUpdated fields hold deciseconds-since-epoch, which exceeds 2^31 for any date after 1976, so those timestamps were silently corrupted. The reader now accumulates without the 32-bit truncation; timestamps decode correctly and round-trip through `encode`.
+
 - v0.13.1 (2026-05-26) — **`b.worm` — write-once-read-many retention.** Store records that cannot be altered or deleted before a retention period elapses — the immutable-storage discipline regulators require (SEC 17a-4(f), CFTC 1.31, FINRA 4511). b.worm.create(opts) returns a WORM store that enforces, on every mutating call, that a record is not overwritten or deleted while it is within its retainUntil window or under a legal hold. Two modes mirror cloud Object-Lock: compliance (the default — no one, including the operator, can delete before expiry) and governance (a privileged caller may override with an audited reason). Retention can only be extended, never shortened; every record carries a SHA3-512 digest that get verifies, so tampering with the underlying bytes is detected on read; every allow/refuse decision is audited. Storage is pluggable via a synchronous store adapter, so the policy layer sits over a sealed DB table, a filesystem, or any non-S3 backend — the store-agnostic, application-level companion to b.objectStore's S3 Object Lock, with content-integrity verification that native Object Lock does not provide. **Added:** *`b.worm.create` — write-once-read-many retention* — Returns a store with `put` / `get` / `delete` / `extendRetention` / `placeLegalHold` / `releaseLegalHold` / `list`. `put` is write-once (an overwrite of a retained or held record is refused); `delete` is gated by the retention window, legal holds, and the mode (`compliance` refuses any early delete; `governance` allows a privileged override with a required, audited reason); `extendRetention` is extend-only; `get` verifies the stored SHA3-512 digest and throws `worm/tampered` on a mismatch. Storage is a pluggable synchronous adapter (`get` / `set` / `delete` / `has` / `keys`), defaulting to in-memory for tests. Use it for SEC 17a-4 / CFTC / FINRA immutable records on backends without native Object Lock; `b.objectStore` remains the path for S3 Object Lock.
 
 - v0.13.0 (2026-05-26) — **`b.crypto.oprf` — RFC 9497 Oblivious PRFs.** Compute F(serverKey, input) without the server learning the input and without the client learning the key — the Oblivious PRF primitive behind password hardening (the server peppers a password it never sees), private set intersection, and Privacy Pass. b.crypto.oprf.suite(name) returns an RFC 9497 ciphersuite — ristretto255-sha512, p256-sha256, p384-sha384, or p521-sha512 — each exposing the base oprf mode and the verifiable voprf mode (a DLEQ proof lets the client confirm the server used the key committed in its public key). The client blinds its input, the server blind-evaluates with its secret key, and the client finalizes by un-blinding and hashing; because un-blinding cancels the blind, the output depends only on key and input. Validated byte-for-byte against the RFC 9497 Appendix-A test vectors. Group and hash-to-curve operations come from the newly vendored @noble/curves (Paul Miller, MIT) — the same maintainer as the framework's existing vendored @noble/post-quantum and @noble/ciphers, with no added npm runtime dependency. **Added:** *`b.crypto.oprf` — RFC 9497 OPRF / VOPRF* — `suite(name)` returns `{ name, oprf, voprf }` for one of the four RFC 9497 ciphersuites (ristretto255-SHA512 / P-256-SHA256 / P-384-SHA384 / P-521-SHA512). The `oprf` (base) mode provides `deriveKeyPair` / `generateKeyPair` / `blind` / `blindEvaluate` / `finalize` / `evaluate`; `voprf` (verifiable) adds a DLEQ proof so the client can prove the server used the committed key. Use it for password hardening, private set intersection, and OPRF-based tokens. Verified against the RFC 9497 Appendix-A vectors. The partially-oblivious `poprf` mode is not yet exposed (the vendored `@noble/curves` does not implement it) and will follow upstream. · *Vendored `@noble/curves`* — `@noble/curves` 2.2.0 (Paul Miller, MIT) is vendored under `lib/vendor/` (no npm runtime dependency), supplying the ristretto255 / NIST-curve group and hash-to-curve operations behind `b.crypto.oprf`. It joins the existing vendored `@noble/post-quantum` and `@noble/ciphers` from the same maintainer; tracked in the SBOM and the vendor-currency gate.