@blamejs/blamejs-shop 0.1.33 → 0.1.35

package/lib/vendor/blamejs/test/layer-0-primitives/crdt.test.js

@@ -0,0 +1,158 @@
+"use strict";
+/**
+ * Layer 0 — b.crdt (state-based CvRDTs).
+ *
+ * Oracle: the CRDT correctness laws themselves. A state-based CvRDT's merge is
+ * a join over a semilattice, so for every type merge must be commutative,
+ * associative, and idempotent, and two replicas that apply concurrent ops then
+ * merge must converge to the same value. Those laws ARE the specification
+ * (Shapiro et al.); each is asserted below alongside worked examples.
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+var crdt = b.crdt;
+function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+function val(c) { return JSON.stringify(c.value()); }
+
+// Assert the three merge laws for a type, given three instances carrying
+// concurrent (disjoint-replica) ops.
+function laws(label, a, c, d) {
+  check(label + ": commutative", val(a.merge(c)) === val(c.merge(a)));
+  check(label + ": associative", val(a.merge(c).merge(d)) === val(a.merge(c.merge(d))));
+  check(label + ": idempotent",  val(a.merge(a)) === val(a));
+  // Convergence: cross-merge of two replicas lands on one value both ways.
+  check(label + ": converges",   val(a.merge(c)) === val(c.merge(a)));
+}
+
+function testSurface() {
+  // Reference each primitive by its full b.crdt.* path (coverage gate).
+  check("b.crdt.gCounter is a factory",    typeof b.crdt.gCounter === "function" && typeof b.crdt.gCounter.fromState === "function");
+  check("b.crdt.pnCounter is a factory",   typeof b.crdt.pnCounter === "function" && typeof b.crdt.pnCounter.fromState === "function");
+  check("b.crdt.gSet is a factory",        typeof b.crdt.gSet === "function" && typeof b.crdt.gSet.fromState === "function");
+  check("b.crdt.twoPSet is a factory",     typeof b.crdt.twoPSet === "function" && typeof b.crdt.twoPSet.fromState === "function");
+  check("b.crdt.orSet is a factory",       typeof b.crdt.orSet === "function" && typeof b.crdt.orSet.fromState === "function");
+  check("b.crdt.lwwRegister is a factory", typeof b.crdt.lwwRegister === "function" && typeof b.crdt.lwwRegister.fromState === "function");
+  check("b.crdt.orMap is a factory",       typeof b.crdt.orMap === "function" && typeof b.crdt.orMap.fromState === "function");
+  check("b.crdt.CrdtError is a class",     typeof b.crdt.CrdtError === "function");
+}
+
+function testGCounter() {
+  var a = crdt.gCounter({ replicaId: "a" }).inc(3);
+  var c = crdt.gCounter({ replicaId: "c" }).inc(5);
+  var d = crdt.gCounter({ replicaId: "d" }).inc(1);
+  check("gCounter sum across replicas", a.merge(c).value() === 8);
+  laws("gCounter", a, c, d);
+  check("gCounter inc default is 1", crdt.gCounter({ replicaId: "a" }).inc().value() === 1);
+  check("gCounter rejects negative inc", code(function () { crdt.gCounter().inc(-1); }) === "crdt/bad-value");
+}
+
+function testPNCounter() {
+  var a = crdt.pnCounter({ replicaId: "a" }).inc(5).dec(2);
+  var c = crdt.pnCounter({ replicaId: "c" }).inc(1);
+  var d = crdt.pnCounter({ replicaId: "d" }).dec(3);
+  check("pnCounter value", a.value() === 3);
+  check("pnCounter merged value", a.merge(c).merge(d).value() === 1);
+  laws("pnCounter", a, c, d);
+}
+
+function testGSet() {
+  var a = crdt.gSet({ replicaId: "a" }).add("x").add("y");
+  var c = crdt.gSet({ replicaId: "c" }).add("z");
+  var d = crdt.gSet({ replicaId: "d" }).add("x");
+  check("gSet union", val(a.merge(c)) === JSON.stringify(["x", "y", "z"]));
+  check("gSet has", a.has("x") && !a.has("q"));
+  check("gSet supports structured elements", crdt.gSet().add({ k: 1 }).has({ k: 1 }));
+  laws("gSet", a, c, d);
+  // value() order must converge for structured elements regardless of merge
+  // order (sorted by the encoded key, not the decoded value).
+  var s1 = crdt.gSet().add({ id: 2 }).add({ id: 1 });
+  var s2 = crdt.gSet().add({ id: 3 });
+  check("gSet structured-element value order converges", JSON.stringify(s1.merge(s2).value()) === JSON.stringify(s2.merge(s1).value()));
+}
+
+function testTwoPSet() {
+  var s = crdt.twoPSet().add("a").add("b").remove("a");
+  check("twoPSet remove", val(s) === JSON.stringify(["b"]));
+  check("twoPSet remove-wins (no re-add)", !s.add("a").has("a"));
+  var a = crdt.twoPSet({ replicaId: "a" }).add("x").remove("x");
+  var c = crdt.twoPSet({ replicaId: "c" }).add("y");
+  var d = crdt.twoPSet({ replicaId: "d" }).add("z");
+  laws("twoPSet", a, c, d);
+}
+
+function testORSet() {
+  // Concurrent re-add survives a remove that did not observe it.
+  var a = crdt.orSet({ replicaId: "a" }).add("x").add("y");
+  var c = crdt.orSet.fromState(a.state(), { replicaId: "c" });
+  a.remove("x");
+  c.add("x");
+  check("orSet concurrent re-add survives remove", a.merge(c).value().indexOf("x") !== -1);
+  // A remove that observed the add wins.
+  var s = crdt.orSet().add("z");
+  check("orSet observed remove drops element", s.remove("z").value().indexOf("z") === -1);
+  laws("orSet", crdt.orSet({ replicaId: "a" }).add("p"), crdt.orSet({ replicaId: "c" }).add("q"), crdt.orSet({ replicaId: "d" }).add("r"));
+  // tombstoneRetention cap is accepted and bounds the tombstone set.
+  var capped = crdt.orSet({ replicaId: "a", tombstoneRetention: 2 });
+  capped.add("1").add("2").add("3").remove("1").remove("2").remove("3");
+  check("orSet tombstoneRetention bounds the set", capped.state().tombstones.length <= 2);
+  check("orSet rejects bad tombstoneRetention", code(function () { crdt.orSet({ tombstoneRetention: -1 }); }) === "crdt/bad-value");
+}
+
+function testLWWRegister() {
+  var a = crdt.lwwRegister({ replicaId: "a" }).set("first", 1);
+  var c = crdt.lwwRegister({ replicaId: "c" }).set("second", 2);
+  check("lwwRegister higher ts wins", a.merge(c).value() === "second");
+  // Tie-break by replicaId (deterministic).
+  var r1 = crdt.lwwRegister({ replicaId: "a" }).set("a", 100);
+  var r2 = crdt.lwwRegister({ replicaId: "c" }).set("c", 100);
+  check("lwwRegister tie-break by replicaId", r1.merge(r2).value() === "c" && r2.merge(r1).value() === "c");
+  laws("lwwRegister",
+    crdt.lwwRegister({ replicaId: "a" }).set("x", 5),
+    crdt.lwwRegister({ replicaId: "c" }).set("y", 9),
+    crdt.lwwRegister({ replicaId: "d" }).set("z", 3));
+}
+
+function testORMap() {
+  var a = crdt.orMap({ replicaId: "a" }).set("k1", "v1", 10);
+  var c = crdt.orMap({ replicaId: "c" }).set("k1", "v2", 20).set("k2", "x", 5);
+  var merged = a.merge(c);
+  check("orMap concurrent key write resolves LWW", merged.get("k1") === "v2");
+  check("orMap disjoint keys both present", merged.has("k2") && val(merged) === JSON.stringify({ k1: "v2", k2: "x" }));
+  check("orMap commutative", val(a.merge(c)) === val(c.merge(a)));
+  // Remove a key, then converge.
+  var p = crdt.orMap.fromState(merged.state(), { replicaId: "a" }).remove("k2");
+  check("orMap remove converges", val(p.merge(merged)) === JSON.stringify({ k1: "v2" }));
+  check("orMap rejects non-string key", code(function () { crdt.orMap().set(5, "v"); }) === "crdt/bad-key");
+  // Removing a key clears its register, so a re-add starts clean — a later set
+  // with a lower timestamp than the pre-remove value still wins on this replica.
+  var rr = crdt.orMap({ replicaId: "a" }).set("k", "old", 100);
+  rr.remove("k");
+  rr.set("k", "new", 50);   // lower ts than the removed "old"@100
+  check("orMap remove clears register so re-add wins", rr.get("k") === "new");
+  check("orMap re-add appears in value", JSON.stringify(rr.value()) === JSON.stringify({ k: "new" }));
+}
+
+function testStateRoundTrip() {
+  ["gCounter", "pnCounter", "gSet", "twoPSet", "orSet", "lwwRegister", "orMap"].forEach(function (t) {
+    var inst = crdt[t]({ replicaId: "a" });
+    var s = inst.state();
+    check(t + ": fromState round-trips", JSON.stringify(crdt[t].fromState(s, { replicaId: "a" }).state()) === JSON.stringify(s));
+    check(t + ": fromState rejects a mismatched type", code(function () { crdt[t].fromState({ type: "WRONG" }); }) === "crdt/type-mismatch");
+  });
+}
+
+async function run() {
+  testSurface();
+  testGCounter();
+  testPNCounter();
+  testGSet();
+  testTwoPSet();
+  testORSet();
+  testLWWRegister();
+  testORMap();
+  testStateRoundTrip();
+}
+module.exports = { run: run };
+if (require.main === module) { run().then(function () { console.log("[crdt] OK — " + helpers.getChecks() + " checks passed"); }, function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }); }

package/lib/vendor/blamejs/test/layer-0-primitives/crypto-xwing.test.js

@@ -0,0 +1,120 @@
+"use strict";
+/**
+ * Layer 0 — b.crypto.xwing (X-Wing hybrid PQ/T KEM, draft-connolly-cfrg-xwing-kem).
+ *
+ * Oracle. The X-Wing-specific contribution is the combiner — SHA3-256 over a
+ * fixed concatenation plus a fixed label — so that is known-answer-tested
+ * byte-for-byte against an independent SHA3-256. The ML-KEM-768 and X25519
+ * halves are pre-validated vendored primitives; the composition is checked by
+ * full encaps → decaps agreement, by deterministic reproducibility from fixed
+ * seeds (regression-anchored to pinned digests), and by implicit-rejection
+ * behaviour on a tampered ciphertext.
+ */
+
+var nodeCrypto = require("crypto");
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+
+var x = b.crypto.xwing;
+
+function testSurface() {
+  check("xwing.keygen is fn",       typeof x.keygen === "function");
+  check("xwing.encapsulate is fn",  typeof x.encapsulate === "function");
+  check("xwing.decapsulate is fn",  typeof x.decapsulate === "function");
+  check("xwing.combiner is fn",     typeof x.combiner === "function");
+  check("xwing.NAME is X-Wing",     x.NAME === "X-Wing");
+  check("xwing.XWingError is class", typeof x.XWingError === "function");
+  check("SIZES pk 1216",  x.SIZES.publicKey === 1216);
+  check("SIZES ct 1120",  x.SIZES.ciphertext === 1120);
+  check("SIZES sk 32",    x.SIZES.secretKey === 32);
+  check("SIZES ss 32",    x.SIZES.sharedSecret === 32);
+}
+
+function testCombinerKAT() {
+  // Byte-exact against the draft: SHA3-256(ssM ‖ ssX ‖ ctX ‖ pkX ‖ label),
+  // label = the six bytes 5c2e2f2f5e5c ("\./" "/^\").
+  var ssM = Buffer.alloc(32, 0x11), ssX = Buffer.alloc(32, 0x22),
+      ctX = Buffer.alloc(32, 0x33), pkX = Buffer.alloc(32, 0x44);
+  var ref = nodeCrypto.createHash("sha3-256")
+    .update(Buffer.concat([ssM, ssX, ctX, pkX, Buffer.from("5c2e2f2f5e5c", "hex")])).digest();
+  check("combiner matches independent SHA3-256 + label byte-for-byte", x.combiner(ssM, ssX, ctX, pkX).equals(ref));
+  // Order matters: swapping two inputs changes the output.
+  check("combiner is order-sensitive", !x.combiner(ssX, ssM, ctX, pkX).equals(ref));
+  check("combiner rejects a short input", code(function () { x.combiner(Buffer.alloc(31), ssX, ctX, pkX); }) === "xwing/bad-input");
+}
+
+function testSizes() {
+  var kp = x.keygen();
+  check("public key is 1216 bytes", kp.publicKey.length === 1216);
+  check("secret key (seed) is 32 bytes", kp.secretKey.length === 32);
+  var enc = x.encapsulate(kp.publicKey);
+  check("ciphertext is 1120 bytes", enc.ciphertext.length === 1120);
+  check("shared secret is 32 bytes", enc.sharedSecret.length === 32);
+}
+
+function testRoundTrip() {
+  for (var i = 0; i < 5; i++) {
+    var kp = x.keygen();
+    var enc = x.encapsulate(kp.publicKey);
+    var ss = x.decapsulate(kp.secretKey, enc.ciphertext);
+    check("round-trip " + i + ": decaps recovers the encaps shared secret", ss.equals(enc.sharedSecret));
+  }
+}
+
+function testDeterminism() {
+  var seed = Buffer.alloc(32, 1);
+  check("keygen(seed) is deterministic", x.keygen(seed).publicKey.equals(x.keygen(seed).publicKey));
+  var pk = x.keygen(seed).publicKey;
+  // Distinct eseed halves so the value depends on the draft's split order
+  // (eseed[0:32] = ML-KEM coins, eseed[32:64] = X25519 ephemeral).
+  var eseed = Buffer.concat([Buffer.alloc(32, 2), Buffer.alloc(32, 3)]);
+  var a = x.encapsulate(pk, eseed), c2 = x.encapsulate(pk, eseed);
+  check("encapsulate(pk, eseed) is deterministic", a.ciphertext.equals(c2.ciphertext) && a.sharedSecret.equals(c2.sharedSecret));
+  check("deterministic encaps round-trips", x.decapsulate(seed, a.ciphertext).equals(a.sharedSecret));
+
+  // Regression anchors: pinned digests of the full deterministic flow. A change
+  // to the combiner, the seed expansion, the eseed split order, or the wire
+  // framing breaks these.
+  check("keygen(0x01) public key digest is stable",
+    nodeCrypto.createHash("sha3-256").update(pk).digest("hex") === "60068c4c0bfc7421bb1cb4a4202bf0ef75ee27e61bf2f6b08780869485cc736a");
+  check("deterministic ciphertext digest is stable",
+    nodeCrypto.createHash("sha3-256").update(a.ciphertext).digest("hex") === "1422e82c4307fcb8117b28ceaf686241cbe48d1a5546e05cd1aa7401d5fc2624");
+  check("deterministic shared secret is stable",
+    a.sharedSecret.toString("hex") === "356f5611bb146e8baf7fa61410552a9c724a170b8a0d4e742fac19161d8fdf4a");
+}
+
+function testImplicitRejection() {
+  var kp = x.keygen();
+  var enc = x.encapsulate(kp.publicKey);
+  // Wrong key: ML-KEM implicit rejection yields a different 32-byte secret, no throw.
+  var wrong = x.decapsulate(x.keygen().secretKey, enc.ciphertext);
+  check("wrong key yields a 32-byte secret (no throw)", Buffer.isBuffer(wrong) && wrong.length === 32);
+  check("wrong key yields a different secret", !wrong.equals(enc.sharedSecret));
+  // Tampered ciphertext: still no throw, different secret.
+  var bad = Buffer.from(enc.ciphertext); bad[0] ^= 0xff; bad[bad.length - 1] ^= 0xff;
+  var ssBad = x.decapsulate(kp.secretKey, bad);
+  check("tampered ciphertext yields a different secret without throwing", !ssBad.equals(enc.sharedSecret));
+}
+
+function testErrors() {
+  var kp = x.keygen();
+  check("keygen rejects a short seed",       code(function () { x.keygen(Buffer.alloc(16)); }) === "xwing/bad-seed");
+  check("encapsulate rejects a short pubkey", code(function () { x.encapsulate(Buffer.alloc(100)); }) === "xwing/bad-public-key");
+  check("encapsulate rejects a short eseed",  code(function () { x.encapsulate(kp.publicKey, Buffer.alloc(32)); }) === "xwing/bad-eseed");
+  check("decapsulate rejects a short seed",   code(function () { x.decapsulate(Buffer.alloc(16), Buffer.alloc(1120)); }) === "xwing/bad-seed");
+  check("decapsulate rejects a short ct",     code(function () { x.decapsulate(kp.secretKey, Buffer.alloc(100)); }) === "xwing/bad-ciphertext");
+}
+
+async function run() {
+  testSurface();
+  testCombinerKAT();
+  testSizes();
+  testRoundTrip();
+  testDeterminism();
+  testImplicitRejection();
+  testErrors();
+}
+module.exports = { run: run };
+if (require.main === module) { run().then(function () { console.log("[crypto-xwing] OK — " + helpers.getChecks() + " checks passed"); }, function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }); }

package/lib/vendor/blamejs/test/layer-0-primitives/iab-tcf.test.js

@@ -41,7 +41,8 @@ async function run() {
     // bytes with a zero pad.
     var totalBits = 6 + 36 + 36 + 12 + 12 + 6 + 6 + 6 + 12 + 6 + 1 + 1 +
                     12 + 24 + 24 + 1 + 6 + 6 +
-                    16 + 1 + 16 + 1; // two empty vendor sections
+                    16 + 1 + 16 + 1 + // two empty vendor sections
+                    12;               // NumPubRestrictions (mandatory, =0)
     var byteLen = Math.ceil(totalBits / 8);                                                   // allow:raw-byte-literal — bits-per-byte
     var buf = Buffer.alloc(byteLen);
     // Set version field (top 6 bits of byte 0).
@@ -68,6 +69,65 @@ async function run() {
   check("core version=4",             parsed.core.version === 4);
   check("checkVendor handles bare core",
         b.iabTcf.checkVendor(parsed, 755).consented === false);
+
+  // ---- encode + isValid + completed parse --------------------------------
+  check("iabTcf.encode is fn",  typeof b.iabTcf.encode === "function");
+  check("iabTcf.isValid is fn", typeof b.iabTcf.isValid === "function");
+
+  // Independent oracle: the worked-example string from the IAB Tech Lab
+  // "Consent string and vendor list formats v2" specification.
+  var SPEC = "CQSbk4AQSbk4ANwAAAENAwCgAAAAAAAAAAYgACPAAAAA.IDKQA4AAgAKAGQAygAAA.YAAAAAAAAAAA";
+  var SPEC_CORE = "CQSbk4AQSbk4ANwAAAENAwCgAAAAAAAAAAYgACPAAAAA";
+  var sp = b.iabTcf.parseString(SPEC);
+  check("spec core version 2",            sp.core.version === 2);
+  check("spec cmpId 880",                 sp.core.cmpId === 880);
+  check("spec vendorListVersion 48",      sp.core.vendorListVersion === 48);
+  check("spec created 2025-06-03",        new Date(sp.core.createdAt).toISOString() === "2025-06-03T00:00:00.000Z");
+  check("spec vendorConsents [1,2,3,4]",  JSON.stringify(Array.from(sp.core.vendorConsents.ids)) === "[1,2,3,4]");
+  check("spec disclosedVendors decoded",  JSON.stringify(Array.from(sp.disclosedVendors.vendorIds)) === "[1,2,3,4,5,100,404]");
+  check("spec publisherTC fully parsed",  sp.publisherTC && sp.publisherTC.present === true && typeof sp.publisherTC.numCustomPurposes === "number");
+  check("core.publisherRestrictions array", Array.isArray(sp.core.publisherRestrictions));
+  // Strong oracle: re-encoding the parsed core reproduces the spec Core
+  // segment byte-for-byte.
+  check("re-encoded core is byte-identical to the spec", b.iabTcf.encode({ core: sp.core }) === SPEC_CORE);
+  // Disclosed content round-trips (the encoder writes the minimal valid form).
+  var rt = b.iabTcf.parseString(b.iabTcf.encode({ core: sp.core, disclosedVendors: sp.disclosedVendors }));
+  check("disclosed content round-trips", JSON.stringify(Array.from(rt.disclosedVendors.vendorIds)) === "[1,2,3,4,5,100,404]");
+
+  // 36-bit timestamp regression: a real date (deciseconds > 2^31) must survive
+  // parse → encode unchanged. Guards the reader's `* 2` (not `<< 1`)
+  // accumulation, without which Created / LastUpdated truncate at 32 bits.
+  var bigCreated = Date.UTC(2026, 4, 26);
+  var encTs = b.iabTcf.encode({ core: { version: 2, createdAt: bigCreated, lastUpdatedAt: bigCreated, cmpId: 300, vendorListVersion: 100, consentLanguage: "EN", publisherCC: "DE", vendorConsents: [], vendorLIs: [] } });
+  var decTs = b.iabTcf.parseString(encTs);
+  check("36-bit timestamp survives round-trip", decTs.core.createdAt === bigCreated);
+  check("cmpId survives round-trip",            decTs.core.cmpId === 300);
+  check("consentLanguage survives round-trip",  decTs.core.consentLanguage === "EN");
+
+  // Vendor-section round-trip across range-favouring and sparse sets.
+  [[1, 2, 3, 4, 5, 6, 7, 8, 9, 10], [12, 37, 199, 755], [1]].forEach(function (vc, idx) {
+    var s = b.iabTcf.encode({ core: { version: 2, createdAt: bigCreated, lastUpdatedAt: bigCreated, cmpId: 5, vendorListVersion: 10, consentLanguage: "EN", publisherCC: "FR", purposesConsent: [1, 2, 3], vendorConsents: vc, vendorLIs: [] } });
+    var d = b.iabTcf.parseString(s);
+    check("vendorConsents round-trip " + idx,  JSON.stringify(Array.from(d.core.vendorConsents.ids)) === JSON.stringify(vc));
+    check("purposesConsent round-trip " + idx, JSON.stringify(Array.from(d.core.purposesConsent)) === "[1,2,3]");
+  });
+
+  // Publisher restrictions round-trip.
+  var prDec = b.iabTcf.parseString(b.iabTcf.encode({ core: { version: 2, createdAt: bigCreated, lastUpdatedAt: bigCreated, cmpId: 9, vendorListVersion: 1, consentLanguage: "IT", publisherCC: "IT", vendorConsents: [], vendorLIs: [], publisherRestrictions: [{ purposeId: 2, restrictionType: 1, vendorIds: [5, 6, 7, 50] }] } }));
+  check("publisher restriction round-trips",
+        prDec.core.publisherRestrictions.length === 1 &&
+        prDec.core.publisherRestrictions[0].purposeId === 2 &&
+        JSON.stringify(prDec.core.publisherRestrictions[0].vendorIds) === "[5,6,7,50]");
+
+  check("isValid true for the spec vector", b.iabTcf.isValid(SPEC) === true);
+  check("isValid false for garbage",        b.iabTcf.isValid("nonsense!!") === false);
+  // A truncated core (a dropped trailing character cuts into the mandatory
+  // NumPubRestrictions field) must NOT validate — the reader's bounds check
+  // rejects it rather than treating the gap as "no restrictions".
+  check("isValid false for a truncated core", b.iabTcf.isValid(SPEC_CORE.slice(0, -1)) === false);
+  rejects("encode without core throws", function () { b.iabTcf.encode({}); }, "BAD_INPUT");
+  rejects("encode rejects a non-positive id",
+    function () { b.iabTcf.encode({ core: { consentLanguage: "EN", publisherCC: "DE", vendorConsents: [0], vendorLIs: [] } }); }, "BAD_VALUE");
 }
 
 module.exports = { run: run };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.1.33",
+  "version": "0.1.35",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {
@@ -8,7 +8,7 @@
     "test": "node test/smoke.js",
     "vendor": "bash scripts/vendor-update.sh",
     "sync-assets": "node scripts/sync-r2-assets.js",
-    "deploy": "wrangler deploy && node scripts/sync-r2-assets.js"
+    "release": "node scripts/release.js"
   },
   "engines": {
     "node": ">=24.14.1"