@blamejs/blamejs-shop 0.1.34 → 0.1.35

package/lib/vendor/blamejs/lib/crypto-xwing.js

@@ -0,0 +1,213 @@
+"use strict";
+/**
+ * @module b.crypto.xwing
+ * @nav    Crypto
+ * @title  X-Wing KEM
+ *
+ * @intro
+ *   X-Wing is a general-purpose hybrid post-quantum / traditional key
+ *   encapsulation mechanism: it runs ML-KEM-768 and X25519 side by side and
+ *   binds their shared secrets with SHA3-256, so the resulting key stays
+ *   secure as long as <em>either</em> ML-KEM-768 or X25519 holds. That is the
+ *   conservative shape for migrating off classical ECDH today — a harvest-now-
+ *   decrypt-later attacker must break the lattice KEM, and a hypothetical
+ *   ML-KEM break still leaves X25519 standing.
+ *
+ *   The construction follows
+ *   <code>draft-connolly-cfrg-xwing-kem</code>. The combiner is frozen — it
+ *   hashes the ML-KEM shared secret, the X25519 shared secret, the X25519
+ *   ephemeral public key, the recipient's X25519 public key, and a fixed
+ *   six-byte label — but the document is still an IETF Internet-Draft, so this
+ *   primitive is marked <code>experimental</code> and sits beside the other
+ *   pre-RFC post-quantum drafts (<code>b.crypto.hpke.pq</code>). The wire
+ *   sizes are fixed: a 1216-byte public key (ML-KEM-768 1184 ‖ X25519 32), a
+ *   1120-byte ciphertext (ML-KEM-768 1088 ‖ X25519 32), a 32-byte decapsulation
+ *   seed, and a 32-byte shared secret.
+ *
+ *   X-Wing composes the framework's vendored ML-KEM-768 and X25519 plus
+ *   SHA3 — it adds no new cryptographic core, only the standard combiner and
+ *   wire framing.
+ *
+ * @card
+ *   X-Wing hybrid PQ/T KEM (`b.crypto.xwing`) — ML-KEM-768 + X25519 bound by
+ *   SHA3-256 per draft-connolly-cfrg-xwing-kem, secure if either component
+ *   holds. 1216-byte key, 1120-byte ciphertext, 32-byte shared secret.
+ */
+
+var nodeCrypto = require("node:crypto");
+var pqc = require("./vendor/noble-post-quantum.cjs");
+var { defineClass } = require("./framework-error");
+
+var XWingError = defineClass("XWingError", { alwaysPermanent: true });
+
+var mlkem = pqc.ml_kem768;
+
+// draft-connolly-cfrg-xwing-kem: the combiner label, ASCII "\./" + "/^\".
+var XWING_LABEL = Buffer.from("5c2e2f2f5e5c", "hex");
+
+// Component + composite sizes (bytes), fixed by the draft — protocol wire
+// widths, not buffer-capacity tunables.
+var ML_KEM_PK = 1184;                  // allow:raw-byte-literal — ML-KEM-768 public key
+var ML_KEM_CT = 1088;                  // allow:raw-byte-literal — ML-KEM-768 ciphertext
+var X25519_LEN = 32;                   // allow:raw-byte-literal — X25519 key/share length
+var SEED_LEN = 32;                     // allow:raw-byte-literal — X-Wing seed length
+var SS_LEN = 32;                       // allow:raw-byte-literal — shared-secret length
+var PK_LEN = ML_KEM_PK + X25519_LEN;   // 1216
+var CT_LEN = ML_KEM_CT + X25519_LEN;   // 1120
+var MLKEM_SEED = 64;                   // allow:raw-byte-literal — d ‖ z for ML-KEM KeyGen_internal
+var EXPAND_LEN = 96;                   // allow:raw-byte-literal — SHAKE256(seed) → d ‖ z ‖ sk_X
+
+// X25519 raw-scalar helpers via fixed PKCS8 / SPKI DER prefixes (OID
+// 1.3.101.110). Node clamps the scalar per RFC 7748 on use, matching X-Wing.
+var X25519_PKCS8_PREFIX = Buffer.from("302e020100300506032b656e04220420", "hex");
+var X25519_SPKI_PREFIX  = Buffer.from("302a300506032b656e032100", "hex");
+
+function _x25519Public(sk) {
+  var key = nodeCrypto.createPrivateKey({ key: Buffer.concat([X25519_PKCS8_PREFIX, sk]), format: "der", type: "pkcs8" });
+  var spki = nodeCrypto.createPublicKey(key).export({ format: "der", type: "spki" });
+  return spki.subarray(spki.length - X25519_LEN);
+}
+function _x25519Shared(sk, pk) {
+  return nodeCrypto.diffieHellman({
+    privateKey: nodeCrypto.createPrivateKey({ key: Buffer.concat([X25519_PKCS8_PREFIX, sk]), format: "der", type: "pkcs8" }),
+    publicKey:  nodeCrypto.createPublicKey({ key: Buffer.concat([X25519_SPKI_PREFIX, pk]), format: "der", type: "spki" }),
+  });
+}
+
+function _shake256(buf, outLen) { return nodeCrypto.createHash("shake256", { outputLength: outLen }).update(buf).digest(); }
+
+/**
+ * @primitive  b.crypto.xwing.combiner
+ * @signature  b.crypto.xwing.combiner(ssM, ssX, ctX, pkX)
+ * @since      0.13.3
+ * @status     experimental
+ * @compliance soc2
+ * @related    b.crypto.xwing.encapsulate, b.crypto.xwing.decapsulate
+ *
+ * The X-Wing combiner: <code>SHA3-256(ssM ‖ ssX ‖ ctX ‖ pkX ‖ label)</code>,
+ * where the label is the fixed six bytes the draft defines. Exposed for
+ * advanced use and known-answer testing; <code>encapsulate</code> and
+ * <code>decapsulate</code> call it internally. Each input must be 32 bytes.
+ *
+ * @example
+ *   var ss = b.crypto.xwing.combiner(ssMlkem, ssX25519, ephPub, recipientPub);
+ *   // → 32-byte shared secret
+ */
+function combiner(ssM, ssX, ctX, pkX) {
+  [["ssM", ssM, SS_LEN], ["ssX", ssX, X25519_LEN], ["ctX", ctX, X25519_LEN], ["pkX", pkX, X25519_LEN]].forEach(function (t) {
+    // ML-KEM outputs are Uint8Array; X25519 outputs are Buffer — accept both.
+    if (!(Buffer.isBuffer(t[1]) || t[1] instanceof Uint8Array) || t[1].length !== t[2]) throw new XWingError("xwing/bad-input", "xwing.combiner: " + t[0] + " must be a " + t[2] + "-byte byte array");
+  });
+  return nodeCrypto.createHash("sha3-256").update(Buffer.concat([ssM, ssX, ctX, pkX, XWING_LABEL])).digest();
+}
+
+// Expand a 32-byte seed into ML-KEM key material + the X25519 scalar.
+function _expand(seed) {
+  var e = _shake256(seed, EXPAND_LEN);
+  var kp = mlkem.keygen(e.subarray(0, MLKEM_SEED));     // KeyGen_internal(d, z)
+  var skX = e.subarray(MLKEM_SEED, EXPAND_LEN);
+  return { skM: kp.secretKey, pkM: kp.publicKey, skX: skX, pkX: _x25519Public(skX) };
+}
+
+/**
+ * @primitive  b.crypto.xwing.keygen
+ * @signature  b.crypto.xwing.keygen(seed?)
+ * @since      0.13.3
+ * @status     experimental
+ * @compliance soc2
+ * @related    b.crypto.xwing.encapsulate, b.crypto.xwing.decapsulate
+ *
+ * Generate an X-Wing keypair. The decapsulation key is a 32-byte seed (store
+ * this); the encapsulation key is the 1216-byte public key to publish. Pass a
+ * 32-byte <code>seed</code> for deterministic generation, or omit it for a
+ * random key.
+ *
+ * @example
+ *   var kp = b.crypto.xwing.keygen();
+ *   kp.publicKey.length;   // → 1216
+ *   kp.secretKey.length;   // → 32  (the seed — keep it secret)
+ */
+function keygen(seed) {
+  if (seed == null) seed = nodeCrypto.randomBytes(SEED_LEN);
+  if (!Buffer.isBuffer(seed) || seed.length !== SEED_LEN) throw new XWingError("xwing/bad-seed", "xwing.keygen: seed must be a " + SEED_LEN + "-byte Buffer");
+  var k = _expand(seed);
+  return { publicKey: Buffer.concat([k.pkM, k.pkX]), secretKey: Buffer.from(seed) };
+}
+
+/**
+ * @primitive  b.crypto.xwing.encapsulate
+ * @signature  b.crypto.xwing.encapsulate(publicKey, eseed?)
+ * @since      0.13.3
+ * @status     experimental
+ * @compliance soc2
+ * @related    b.crypto.xwing.decapsulate, b.crypto.xwing.keygen
+ *
+ * Encapsulate to a 1216-byte X-Wing public key. Returns the 1120-byte
+ * <code>ciphertext</code> to send and the 32-byte <code>sharedSecret</code> to
+ * key a symmetric cipher with. Pass a 64-byte <code>eseed</code>
+ * (X25519 ephemeral scalar ‖ ML-KEM coins) for deterministic encapsulation, or
+ * omit it for fresh randomness.
+ *
+ * @example
+ *   var enc = b.crypto.xwing.encapsulate(recipientPublicKey);
+ *   enc.ciphertext.length;   // → 1120
+ *   enc.sharedSecret.length; // → 32
+ */
+function encapsulate(publicKey, eseed) {
+  if (!Buffer.isBuffer(publicKey) || publicKey.length !== PK_LEN) throw new XWingError("xwing/bad-public-key", "xwing.encapsulate: publicKey must be a " + PK_LEN + "-byte Buffer");
+  var pkM = publicKey.subarray(0, ML_KEM_PK);
+  var pkX = publicKey.subarray(ML_KEM_PK, PK_LEN);
+  var ekX, mlkemCoins = null;
+  if (eseed == null) {
+    ekX = nodeCrypto.randomBytes(X25519_LEN);
+  } else {
+    if (!Buffer.isBuffer(eseed) || eseed.length !== 2 * X25519_LEN) throw new XWingError("xwing/bad-eseed", "xwing.encapsulate: eseed must be a " + (2 * X25519_LEN) + "-byte Buffer");
+    // draft EncapsulateDerand: eseed[0:32] = ML-KEM coins, eseed[32:64] = X25519
+    // ephemeral scalar. This order matches the draft's test vectors.
+    mlkemCoins = eseed.subarray(0, X25519_LEN);
+    ekX = eseed.subarray(X25519_LEN, 2 * X25519_LEN);
+  }
+  var ctX = _x25519Public(ekX);
+  var ssX = _x25519Shared(ekX, pkX);
+  var kem = mlkemCoins ? mlkem.encapsulate(pkM, mlkemCoins) : mlkem.encapsulate(pkM);
+  var ss = combiner(kem.sharedSecret, ssX, ctX, pkX);
+  return { ciphertext: Buffer.concat([kem.cipherText, ctX]), sharedSecret: ss };
+}
+
+/**
+ * @primitive  b.crypto.xwing.decapsulate
+ * @signature  b.crypto.xwing.decapsulate(secretKey, ciphertext)
+ * @since      0.13.3
+ * @status     experimental
+ * @compliance soc2
+ * @related    b.crypto.xwing.encapsulate, b.crypto.xwing.keygen
+ *
+ * Recover the 32-byte shared secret from a 1120-byte X-Wing ciphertext using
+ * the 32-byte decapsulation seed. ML-KEM-768's implicit-rejection means a
+ * tampered ciphertext yields a different (still 32-byte) secret rather than an
+ * error, so never branch on success — derive keys and let the AEAD tag fail.
+ *
+ * @example
+ *   var ss = b.crypto.xwing.decapsulate(kp.secretKey, enc.ciphertext);
+ *   ss.equals(enc.sharedSecret);   // → true
+ */
+function decapsulate(secretKey, ciphertext) {
+  if (!Buffer.isBuffer(secretKey) || secretKey.length !== SEED_LEN) throw new XWingError("xwing/bad-seed", "xwing.decapsulate: secretKey must be a " + SEED_LEN + "-byte Buffer");
+  if (!Buffer.isBuffer(ciphertext) || ciphertext.length !== CT_LEN) throw new XWingError("xwing/bad-ciphertext", "xwing.decapsulate: ciphertext must be a " + CT_LEN + "-byte Buffer");
+  var k = _expand(secretKey);
+  var ctM = ciphertext.subarray(0, ML_KEM_CT);
+  var ctX = ciphertext.subarray(ML_KEM_CT, CT_LEN);
+  var ssM = mlkem.decapsulate(ctM, k.skM);
+  var ssX = _x25519Shared(k.skX, ctX);
+  return combiner(ssM, ssX, ctX, k.pkX);
+}
+
+module.exports = {
+  NAME:        "X-Wing",
+  keygen:      keygen,
+  encapsulate: encapsulate,
+  decapsulate: decapsulate,
+  combiner:    combiner,
+  SIZES:       { publicKey: PK_LEN, ciphertext: CT_LEN, secretKey: SEED_LEN, sharedSecret: SS_LEN },
+  XWingError:  XWingError,
+};

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.13.2",
+  "version": "0.13.4",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.13.3.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.3",
+  "date": "2026-05-26",
+  "headline": "`b.crypto.xwing` — X-Wing hybrid post-quantum KEM",
+  "summary": "b.crypto.xwing adds the X-Wing hybrid key-encapsulation mechanism (draft-connolly-cfrg-xwing-kem): it runs ML-KEM-768 and X25519 side by side and binds their shared secrets with SHA3-256, so an encapsulated key stays secure as long as either ML-KEM-768 or X25519 holds. That is the conservative shape for moving off classical ECDH today — a harvest-now-decrypt-later attacker must break the lattice KEM, and a hypothetical ML-KEM break still leaves X25519 standing. keygen() produces a 32-byte decapsulation seed and a 1216-byte public key; encapsulate(publicKey) returns a 1120-byte ciphertext and a 32-byte shared secret; decapsulate(secretKey, ciphertext) recovers it. The X-Wing combiner is frozen, but its specification is still an IETF Internet-Draft, so this primitive is marked experimental and sits beside the existing pre-RFC post-quantum HPKE drafts; it composes the framework's vendored ML-KEM-768 and X25519 with SHA3 and adds no new cryptographic core. The combiner is known-answer-tested byte-for-byte against the draft's definition.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.crypto.xwing` — X-Wing hybrid PQ/T KEM (experimental)",
+          "body": "`keygen(seed?)` → `{ publicKey (1216 B), secretKey (32-byte seed) }`; `encapsulate(publicKey, eseed?)` → `{ ciphertext (1120 B), sharedSecret (32 B) }`; `decapsulate(secretKey, ciphertext)` → the 32-byte shared secret. Both `keygen` and `encapsulate` accept an optional seed for deterministic operation. The combiner — `SHA3-256(ssMLKEM ‖ ssX25519 ‖ ctX25519 ‖ pkX25519 ‖ label)` — is exposed as `combiner` for advanced use. Marked `experimental` while draft-connolly-cfrg-xwing-kem remains an Internet-Draft; the algorithm itself is frozen."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.4.json

@@ -0,0 +1,23 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.4",
+  "date": "2026-05-26",
+  "headline": "`b.crdt` — conflict-free replicated data types",
+  "summary": "b.crdt adds state-based Conflict-free Replicated Data Types: data structures that independent replicas update without coordination and still converge to the same value once they have exchanged state. Each type's merge is a join over a semilattice — commutative, associative, and idempotent — so replicas can merge in any order, any number of times, and agree, which makes these the substrate for active/active cluster state, offline-first clients that reconcile on reconnect, and eventually-consistent counters, sets, and maps. The release ships the full state-based family: grow-only and positive-negative counters (gCounter / pnCounter), grow-only, two-phase, and observed-remove sets (gSet / twoPSet / orSet), a last-write-wins register (lwwRegister), and an observed-remove map (orMap). Every type exposes the same contract — local mutators, merge(other) that returns a converged instance without mutating either operand, value() for the materialized value, and state() / fromState() for a JSON-serializable form to snapshot via b.archive or b.backup or ship to a peer — and carries a replicaId so per-replica contributions stay distinct.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.crdt` — state-based CvRDT counters, sets, register, and map",
+          "body": "`b.crdt.gCounter` / `pnCounter` (grow-only and increment/decrement counters), `b.crdt.gSet` / `twoPSet` / `orSet` (grow-only, two-phase, and observed-remove sets — `orSet` supports re-add and resolves a concurrent add-vs-remove as add-wins), `b.crdt.lwwRegister` (last-write-wins with a deterministic replicaId tie-break), and `b.crdt.orMap` (observed-remove keys with last-write-wins values). Each exposes `merge` / `value` / `state` / `fromState` and converges by the CvRDT laws. `orSet` and `orMap` accept `tombstoneRetention` to bound tombstone memory against a remove flood."
+        }
+      ]
+    }
+  ],
+  "outOfScope": [
+    "Operation-based sequence CRDTs (RGA) — a different formal class (CmRDT) requiring a causal-delivery channel; ships when collaborative-text / ordered-list editing is needed.",
+    "Delta-state mutators — a bandwidth optimization over full-state merge; ships under large-state replication pressure.",
+    "The event-bus replicator for live multi-node auto-sync — the state-based types merge manually standalone; ships when live multi-node synchronization is wired, together with the causal-delivery option and its detector."
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/crdt.test.js

@@ -0,0 +1,158 @@
+"use strict";
+/**
+ * Layer 0 — b.crdt (state-based CvRDTs).
+ *
+ * Oracle: the CRDT correctness laws themselves. A state-based CvRDT's merge is
+ * a join over a semilattice, so for every type merge must be commutative,
+ * associative, and idempotent, and two replicas that apply concurrent ops then
+ * merge must converge to the same value. Those laws ARE the specification
+ * (Shapiro et al.); each is asserted below alongside worked examples.
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+var crdt = b.crdt;
+function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+function val(c) { return JSON.stringify(c.value()); }
+
+// Assert the three merge laws for a type, given three instances carrying
+// concurrent (disjoint-replica) ops.
+function laws(label, a, c, d) {
+  check(label + ": commutative", val(a.merge(c)) === val(c.merge(a)));
+  check(label + ": associative", val(a.merge(c).merge(d)) === val(a.merge(c.merge(d))));
+  check(label + ": idempotent",  val(a.merge(a)) === val(a));
+  // Convergence: cross-merge of two replicas lands on one value both ways.
+  check(label + ": converges",   val(a.merge(c)) === val(c.merge(a)));
+}
+
+function testSurface() {
+  // Reference each primitive by its full b.crdt.* path (coverage gate).
+  check("b.crdt.gCounter is a factory",    typeof b.crdt.gCounter === "function" && typeof b.crdt.gCounter.fromState === "function");
+  check("b.crdt.pnCounter is a factory",   typeof b.crdt.pnCounter === "function" && typeof b.crdt.pnCounter.fromState === "function");
+  check("b.crdt.gSet is a factory",        typeof b.crdt.gSet === "function" && typeof b.crdt.gSet.fromState === "function");
+  check("b.crdt.twoPSet is a factory",     typeof b.crdt.twoPSet === "function" && typeof b.crdt.twoPSet.fromState === "function");
+  check("b.crdt.orSet is a factory",       typeof b.crdt.orSet === "function" && typeof b.crdt.orSet.fromState === "function");
+  check("b.crdt.lwwRegister is a factory", typeof b.crdt.lwwRegister === "function" && typeof b.crdt.lwwRegister.fromState === "function");
+  check("b.crdt.orMap is a factory",       typeof b.crdt.orMap === "function" && typeof b.crdt.orMap.fromState === "function");
+  check("b.crdt.CrdtError is a class",     typeof b.crdt.CrdtError === "function");
+}
+
+function testGCounter() {
+  var a = crdt.gCounter({ replicaId: "a" }).inc(3);
+  var c = crdt.gCounter({ replicaId: "c" }).inc(5);
+  var d = crdt.gCounter({ replicaId: "d" }).inc(1);
+  check("gCounter sum across replicas", a.merge(c).value() === 8);
+  laws("gCounter", a, c, d);
+  check("gCounter inc default is 1", crdt.gCounter({ replicaId: "a" }).inc().value() === 1);
+  check("gCounter rejects negative inc", code(function () { crdt.gCounter().inc(-1); }) === "crdt/bad-value");
+}
+
+function testPNCounter() {
+  var a = crdt.pnCounter({ replicaId: "a" }).inc(5).dec(2);
+  var c = crdt.pnCounter({ replicaId: "c" }).inc(1);
+  var d = crdt.pnCounter({ replicaId: "d" }).dec(3);
+  check("pnCounter value", a.value() === 3);
+  check("pnCounter merged value", a.merge(c).merge(d).value() === 1);
+  laws("pnCounter", a, c, d);
+}
+
+function testGSet() {
+  var a = crdt.gSet({ replicaId: "a" }).add("x").add("y");
+  var c = crdt.gSet({ replicaId: "c" }).add("z");
+  var d = crdt.gSet({ replicaId: "d" }).add("x");
+  check("gSet union", val(a.merge(c)) === JSON.stringify(["x", "y", "z"]));
+  check("gSet has", a.has("x") && !a.has("q"));
+  check("gSet supports structured elements", crdt.gSet().add({ k: 1 }).has({ k: 1 }));
+  laws("gSet", a, c, d);
+  // value() order must converge for structured elements regardless of merge
+  // order (sorted by the encoded key, not the decoded value).
+  var s1 = crdt.gSet().add({ id: 2 }).add({ id: 1 });
+  var s2 = crdt.gSet().add({ id: 3 });
+  check("gSet structured-element value order converges", JSON.stringify(s1.merge(s2).value()) === JSON.stringify(s2.merge(s1).value()));
+}
+
+function testTwoPSet() {
+  var s = crdt.twoPSet().add("a").add("b").remove("a");
+  check("twoPSet remove", val(s) === JSON.stringify(["b"]));
+  check("twoPSet remove-wins (no re-add)", !s.add("a").has("a"));
+  var a = crdt.twoPSet({ replicaId: "a" }).add("x").remove("x");
+  var c = crdt.twoPSet({ replicaId: "c" }).add("y");
+  var d = crdt.twoPSet({ replicaId: "d" }).add("z");
+  laws("twoPSet", a, c, d);
+}
+
+function testORSet() {
+  // Concurrent re-add survives a remove that did not observe it.
+  var a = crdt.orSet({ replicaId: "a" }).add("x").add("y");
+  var c = crdt.orSet.fromState(a.state(), { replicaId: "c" });
+  a.remove("x");
+  c.add("x");
+  check("orSet concurrent re-add survives remove", a.merge(c).value().indexOf("x") !== -1);
+  // A remove that observed the add wins.
+  var s = crdt.orSet().add("z");
+  check("orSet observed remove drops element", s.remove("z").value().indexOf("z") === -1);
+  laws("orSet", crdt.orSet({ replicaId: "a" }).add("p"), crdt.orSet({ replicaId: "c" }).add("q"), crdt.orSet({ replicaId: "d" }).add("r"));
+  // tombstoneRetention cap is accepted and bounds the tombstone set.
+  var capped = crdt.orSet({ replicaId: "a", tombstoneRetention: 2 });
+  capped.add("1").add("2").add("3").remove("1").remove("2").remove("3");
+  check("orSet tombstoneRetention bounds the set", capped.state().tombstones.length <= 2);
+  check("orSet rejects bad tombstoneRetention", code(function () { crdt.orSet({ tombstoneRetention: -1 }); }) === "crdt/bad-value");
+}
+
+function testLWWRegister() {
+  var a = crdt.lwwRegister({ replicaId: "a" }).set("first", 1);
+  var c = crdt.lwwRegister({ replicaId: "c" }).set("second", 2);
+  check("lwwRegister higher ts wins", a.merge(c).value() === "second");
+  // Tie-break by replicaId (deterministic).
+  var r1 = crdt.lwwRegister({ replicaId: "a" }).set("a", 100);
+  var r2 = crdt.lwwRegister({ replicaId: "c" }).set("c", 100);
+  check("lwwRegister tie-break by replicaId", r1.merge(r2).value() === "c" && r2.merge(r1).value() === "c");
+  laws("lwwRegister",
+    crdt.lwwRegister({ replicaId: "a" }).set("x", 5),
+    crdt.lwwRegister({ replicaId: "c" }).set("y", 9),
+    crdt.lwwRegister({ replicaId: "d" }).set("z", 3));
+}
+
+function testORMap() {
+  var a = crdt.orMap({ replicaId: "a" }).set("k1", "v1", 10);
+  var c = crdt.orMap({ replicaId: "c" }).set("k1", "v2", 20).set("k2", "x", 5);
+  var merged = a.merge(c);
+  check("orMap concurrent key write resolves LWW", merged.get("k1") === "v2");
+  check("orMap disjoint keys both present", merged.has("k2") && val(merged) === JSON.stringify({ k1: "v2", k2: "x" }));
+  check("orMap commutative", val(a.merge(c)) === val(c.merge(a)));
+  // Remove a key, then converge.
+  var p = crdt.orMap.fromState(merged.state(), { replicaId: "a" }).remove("k2");
+  check("orMap remove converges", val(p.merge(merged)) === JSON.stringify({ k1: "v2" }));
+  check("orMap rejects non-string key", code(function () { crdt.orMap().set(5, "v"); }) === "crdt/bad-key");
+  // Removing a key clears its register, so a re-add starts clean — a later set
+  // with a lower timestamp than the pre-remove value still wins on this replica.
+  var rr = crdt.orMap({ replicaId: "a" }).set("k", "old", 100);
+  rr.remove("k");
+  rr.set("k", "new", 50);   // lower ts than the removed "old"@100
+  check("orMap remove clears register so re-add wins", rr.get("k") === "new");
+  check("orMap re-add appears in value", JSON.stringify(rr.value()) === JSON.stringify({ k: "new" }));
+}
+
+function testStateRoundTrip() {
+  ["gCounter", "pnCounter", "gSet", "twoPSet", "orSet", "lwwRegister", "orMap"].forEach(function (t) {
+    var inst = crdt[t]({ replicaId: "a" });
+    var s = inst.state();
+    check(t + ": fromState round-trips", JSON.stringify(crdt[t].fromState(s, { replicaId: "a" }).state()) === JSON.stringify(s));
+    check(t + ": fromState rejects a mismatched type", code(function () { crdt[t].fromState({ type: "WRONG" }); }) === "crdt/type-mismatch");
+  });
+}
+
+async function run() {
+  testSurface();
+  testGCounter();
+  testPNCounter();
+  testGSet();
+  testTwoPSet();
+  testORSet();
+  testLWWRegister();
+  testORMap();
+  testStateRoundTrip();
+}
+module.exports = { run: run };
+if (require.main === module) { run().then(function () { console.log("[crdt] OK — " + helpers.getChecks() + " checks passed"); }, function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }); }

package/lib/vendor/blamejs/test/layer-0-primitives/crypto-xwing.test.js

@@ -0,0 +1,120 @@
+"use strict";
+/**
+ * Layer 0 — b.crypto.xwing (X-Wing hybrid PQ/T KEM, draft-connolly-cfrg-xwing-kem).
+ *
+ * Oracle. The X-Wing-specific contribution is the combiner — SHA3-256 over a
+ * fixed concatenation plus a fixed label — so that is known-answer-tested
+ * byte-for-byte against an independent SHA3-256. The ML-KEM-768 and X25519
+ * halves are pre-validated vendored primitives; the composition is checked by
+ * full encaps → decaps agreement, by deterministic reproducibility from fixed
+ * seeds (regression-anchored to pinned digests), and by implicit-rejection
+ * behaviour on a tampered ciphertext.
+ */
+
+var nodeCrypto = require("crypto");
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+
+var x = b.crypto.xwing;
+
+function testSurface() {
+  check("xwing.keygen is fn",       typeof x.keygen === "function");
+  check("xwing.encapsulate is fn",  typeof x.encapsulate === "function");
+  check("xwing.decapsulate is fn",  typeof x.decapsulate === "function");
+  check("xwing.combiner is fn",     typeof x.combiner === "function");
+  check("xwing.NAME is X-Wing",     x.NAME === "X-Wing");
+  check("xwing.XWingError is class", typeof x.XWingError === "function");
+  check("SIZES pk 1216",  x.SIZES.publicKey === 1216);
+  check("SIZES ct 1120",  x.SIZES.ciphertext === 1120);
+  check("SIZES sk 32",    x.SIZES.secretKey === 32);
+  check("SIZES ss 32",    x.SIZES.sharedSecret === 32);
+}
+
+function testCombinerKAT() {
+  // Byte-exact against the draft: SHA3-256(ssM ‖ ssX ‖ ctX ‖ pkX ‖ label),
+  // label = the six bytes 5c2e2f2f5e5c ("\./" "/^\").
+  var ssM = Buffer.alloc(32, 0x11), ssX = Buffer.alloc(32, 0x22),
+      ctX = Buffer.alloc(32, 0x33), pkX = Buffer.alloc(32, 0x44);
+  var ref = nodeCrypto.createHash("sha3-256")
+    .update(Buffer.concat([ssM, ssX, ctX, pkX, Buffer.from("5c2e2f2f5e5c", "hex")])).digest();
+  check("combiner matches independent SHA3-256 + label byte-for-byte", x.combiner(ssM, ssX, ctX, pkX).equals(ref));
+  // Order matters: swapping two inputs changes the output.
+  check("combiner is order-sensitive", !x.combiner(ssX, ssM, ctX, pkX).equals(ref));
+  check("combiner rejects a short input", code(function () { x.combiner(Buffer.alloc(31), ssX, ctX, pkX); }) === "xwing/bad-input");
+}
+
+function testSizes() {
+  var kp = x.keygen();
+  check("public key is 1216 bytes", kp.publicKey.length === 1216);
+  check("secret key (seed) is 32 bytes", kp.secretKey.length === 32);
+  var enc = x.encapsulate(kp.publicKey);
+  check("ciphertext is 1120 bytes", enc.ciphertext.length === 1120);
+  check("shared secret is 32 bytes", enc.sharedSecret.length === 32);
+}
+
+function testRoundTrip() {
+  for (var i = 0; i < 5; i++) {
+    var kp = x.keygen();
+    var enc = x.encapsulate(kp.publicKey);
+    var ss = x.decapsulate(kp.secretKey, enc.ciphertext);
+    check("round-trip " + i + ": decaps recovers the encaps shared secret", ss.equals(enc.sharedSecret));
+  }
+}
+
+function testDeterminism() {
+  var seed = Buffer.alloc(32, 1);
+  check("keygen(seed) is deterministic", x.keygen(seed).publicKey.equals(x.keygen(seed).publicKey));
+  var pk = x.keygen(seed).publicKey;
+  // Distinct eseed halves so the value depends on the draft's split order
+  // (eseed[0:32] = ML-KEM coins, eseed[32:64] = X25519 ephemeral).
+  var eseed = Buffer.concat([Buffer.alloc(32, 2), Buffer.alloc(32, 3)]);
+  var a = x.encapsulate(pk, eseed), c2 = x.encapsulate(pk, eseed);
+  check("encapsulate(pk, eseed) is deterministic", a.ciphertext.equals(c2.ciphertext) && a.sharedSecret.equals(c2.sharedSecret));
+  check("deterministic encaps round-trips", x.decapsulate(seed, a.ciphertext).equals(a.sharedSecret));
+
+  // Regression anchors: pinned digests of the full deterministic flow. A change
+  // to the combiner, the seed expansion, the eseed split order, or the wire
+  // framing breaks these.
+  check("keygen(0x01) public key digest is stable",
+    nodeCrypto.createHash("sha3-256").update(pk).digest("hex") === "60068c4c0bfc7421bb1cb4a4202bf0ef75ee27e61bf2f6b08780869485cc736a");
+  check("deterministic ciphertext digest is stable",
+    nodeCrypto.createHash("sha3-256").update(a.ciphertext).digest("hex") === "1422e82c4307fcb8117b28ceaf686241cbe48d1a5546e05cd1aa7401d5fc2624");
+  check("deterministic shared secret is stable",
+    a.sharedSecret.toString("hex") === "356f5611bb146e8baf7fa61410552a9c724a170b8a0d4e742fac19161d8fdf4a");
+}
+
+function testImplicitRejection() {
+  var kp = x.keygen();
+  var enc = x.encapsulate(kp.publicKey);
+  // Wrong key: ML-KEM implicit rejection yields a different 32-byte secret, no throw.
+  var wrong = x.decapsulate(x.keygen().secretKey, enc.ciphertext);
+  check("wrong key yields a 32-byte secret (no throw)", Buffer.isBuffer(wrong) && wrong.length === 32);
+  check("wrong key yields a different secret", !wrong.equals(enc.sharedSecret));
+  // Tampered ciphertext: still no throw, different secret.
+  var bad = Buffer.from(enc.ciphertext); bad[0] ^= 0xff; bad[bad.length - 1] ^= 0xff;
+  var ssBad = x.decapsulate(kp.secretKey, bad);
+  check("tampered ciphertext yields a different secret without throwing", !ssBad.equals(enc.sharedSecret));
+}
+
+function testErrors() {
+  var kp = x.keygen();
+  check("keygen rejects a short seed",       code(function () { x.keygen(Buffer.alloc(16)); }) === "xwing/bad-seed");
+  check("encapsulate rejects a short pubkey", code(function () { x.encapsulate(Buffer.alloc(100)); }) === "xwing/bad-public-key");
+  check("encapsulate rejects a short eseed",  code(function () { x.encapsulate(kp.publicKey, Buffer.alloc(32)); }) === "xwing/bad-eseed");
+  check("decapsulate rejects a short seed",   code(function () { x.decapsulate(Buffer.alloc(16), Buffer.alloc(1120)); }) === "xwing/bad-seed");
+  check("decapsulate rejects a short ct",     code(function () { x.decapsulate(kp.secretKey, Buffer.alloc(100)); }) === "xwing/bad-ciphertext");
+}
+
+async function run() {
+  testSurface();
+  testCombinerKAT();
+  testSizes();
+  testRoundTrip();
+  testDeterminism();
+  testImplicitRejection();
+  testErrors();
+}
+module.exports = { run: run };
+if (require.main === module) { run().then(function () { console.log("[crypto-xwing] OK — " + helpers.getChecks() + " checks passed"); }, function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }); }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.1.34",
+  "version": "0.1.35",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {
@@ -8,7 +8,7 @@
     "test": "node test/smoke.js",
     "vendor": "bash scripts/vendor-update.sh",
     "sync-assets": "node scripts/sync-r2-assets.js",
-    "deploy": "wrangler deploy && node scripts/sync-r2-assets.js"
+    "release": "node scripts/release.js"
   },
   "engines": {
     "node": ">=24.14.1"