@blamejs/blamejs-shop 0.2.8 → 0.2.10

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.2.x
 
+- v0.2.10 (2026-05-27) — **Accessibility and mobile polish — the cookie bar stops covering the page, and forms behave on phones.** A round of default-theme refinements focused on the cookie consent bar, mobile ergonomics, and accessibility. The consent bar previously floated over page content — on a product page or checkout it could sit on top of the price, variant picker, and the add-to-cart / continue-to-payment button on a first visit. It is now a compact bottom bar that reserves its own space (so nothing important is ever hidden under it), scrolls within itself if the text is long, and receives keyboard focus when it appears. Alongside it: mobile form inputs no longer trigger iOS zoom-on-focus, the header touch targets meet the 44px minimum, inline text links are underlined, and a consistency pass tightened button shapes, table-label typography, and small-screen layout. **Changed:** *Visual consistency pass* — Action buttons share a single corner radius (primary and secondary no longer differ in shape), uppercase micro-labels use the monospace face consistently across tables and forms, the catalog grid shows two columns on small phones instead of one, the hero stat row breathes on narrow screens, and a few dark-theme borders/placeholders that read muddy were moved onto the semantic token palette. **Fixed:** *Cookie consent bar no longer covers page content* — On a first visit the consent bar could overlap the product buy box and the checkout form (the price, variant selector, and primary button). It is now a compact bottom-docked bar that reserves matching space at the foot of the page until a choice is made, caps its height and scrolls internally for long text, and moves keyboard focus to its first control when shown — so the page's primary action is never hidden and the bar is reachable without tabbing the whole page. · *Mobile form inputs no longer zoom on iOS* — Text inputs, selects, and textareas render at a 16px minimum on touch devices, so mobile Safari no longer zooms the viewport when a field is focused (which previously left the page zoomed-in and pannable mid-checkout). · *Header touch targets meet the 44px minimum on mobile* — The account and cart controls in the header — the two primary controls on a phone — are now at least 44×44px. · *Clearer link and prompt-glyph affordances* — Inline text links in body copy are underlined (no longer distinguished by color alone), and the terminal prompt glyph on the dark accent bands renders in full contrast.
+
+- v0.2.9 (2026-05-27) — **Storefront read pages stay fast for every visitor — the cart badge updates client-side.** Restores full edge-render speed for returning and signed-in shoppers. Every storefront read page (home, product listing, search, blog) now renders at the edge for all visitors again; the nav cart badge renders server-side and a tiny client island corrects the number from a new lightweight endpoint. The result: the fast cached page AND an accurate cart count, without sending a shopper-with-a-cart through the slower origin on every page. **Added:** *`GET /cart/count` + a cart-count island* — A new endpoint returns the current session's cart line count as JSON (`{"count": N}`), cached `no-store`, with no product hydration. A small deferred same-origin script (`assets/js/cart-count.js`) reads it on load and updates the nav badge text and its aria-label. A visitor with JavaScript off keeps the server-rendered badge. The script is a same-origin external file, so the existing `script-src 'self'` policy already permits it — no CSP change required. **Fixed:** *Fast read pages for shoppers who have a session* — A visitor carrying a cart or sign-in cookie is once again served the edge-rendered storefront pages instead of being routed to the origin container, so the home page and other read pages load quickly for returning visitors, not just first-time guests. The nav cart count stays correct via the island below.
+
 - v0.2.8 (2026-05-27) — **A complete shipping address at checkout, and an accurate cart count on every page.** Two storefront fixes. Checkout now collects a real, shippable address — a street line, an optional apt/suite line, and a city — alongside the region, postal code, and country it already took; a signed-in customer's default saved address pre-fills the form, the address shows on the order confirmation, and the order export carries it so fulfilment has everything it needs. Separately, the navigation cart badge now shows the correct item count on the catalog, product, search, and blog pages — not only on the cart and account pages — by rendering those pages for a shopper-with-a-cart on the path that can read their session. **Changed:** *Checkout collects a complete shipping address* — The shipping step now takes a street address (line 1, plus an optional apartment / suite / unit line) and a city in addition to the region, postal code, and country it already collected, so a placed order carries an address you can actually ship to. Street line and city are marked required for the common physical-goods path; the server treats them as optional so a digital-only order still completes. A signed-in customer's default saved address pre-fills the form. · *Shipping address on the confirmation page and in the order export* — The order confirmation now shows the ship-to address, and the order CSV / NDJSON export gains `shipping_line1`, `shipping_line2`, and `shipping_city` columns (inserted after `customer_name`) so a fulfilment handoff has the full address. Consumers that key on the header name are unaffected; a consumer that keys on absolute column position should re-map to the 27-column layout. **Fixed:** *Cart count is correct on every page* — The nav cart badge previously read zero on edge-rendered pages (home, product, search, blog) for a shopper who had items in their cart, while the cart and account pages showed the real count. A request that carries a session cookie is now rendered on the path that can unseal the session and read the cart, so the badge is consistent everywhere. Guests — who have no cart — still get the fast cached render with a count of zero, which is correct for them.
 
 - v0.2.7 (2026-05-27) — **Default-theme brand polish — broader favicon support and a larger logo.** Small refinements to the bundled default theme's branding. Every page head now advertises a PNG favicon and an Apple touch icon alongside the existing SVG favicon, so the site icon renders correctly on Safari / iOS home screens and on browsers that don't support SVG favicons, plus a theme-color so the mobile browser chrome matches the dark canvas. The header and footer logo are rendered larger for more presence. These affect the default theme only; a custom theme passed via the theme primitive is unchanged. **Changed:** *Fuller favicon + icon metadata* — The page head now includes a PNG favicon and an `apple-touch-icon` (Apple home-screen icons require PNG — SVG favicons aren't used there) in addition to the SVG favicon, plus a `theme-color` meta for the mobile browser UI. Emitted on every page across both the edge and container render paths. · *Larger header and footer logo* — The default theme renders the brand logo at a larger size in the header and footer for clearer presence.

package/lib/asset-manifest.json

@@ -1,21 +1,25 @@
 {
-  "version": "0.2.8",
+  "version": "0.2.10",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-FgqvXcZygYkJjjOtXAeu9xi6AtYqkchPnJKcS0OeHm8lynhd9r4RfdpoT7P7j7/l",
       "fingerprinted": "css/admin.afd7b964c1f6fe1b.css"
     },
     "css/main.css": {
-      "integrity": "sha384-6aJfYezHHWR7kgX0foRedjqZg90PP6xrD7oXFim5X2gzV3E3gzZaQTzqgZuCP9eU",
-      "fingerprinted": "css/main.d428a281f9f583d8.css"
+      "integrity": "sha384-989Th+84GsswrtPWc4g7DImIYKE/nUSgpZcQMeYxhPN1tg3lrgBhjQNKHNqwz7kb",
+      "fingerprinted": "css/main.4504ec0c542c3225.css"
     },
     "js/announcement.js": {
       "integrity": "sha384-z4zcEMn+tScoVnYRE4nEf8N/oyvpxdpaxTNrT4QO/jURChid4+qjAvWkzatCaAPq",
       "fingerprinted": "js/announcement.59eab4872d2f3b4c.js"
     },
+    "js/cart-count.js": {
+      "integrity": "sha384-K/rkm//Dzg8nuOfpaeenJvLKKl+6DEuvuJi1LLgd46BK+dd1HYmU8R7/gHHjtEsr",
+      "fingerprinted": "js/cart-count.bfc2eb434b19c00a.js"
+    },
     "js/consent.js": {
-      "integrity": "sha384-KKMQ0og8HPOykRRPpUyxX7dMhTvKySfVtpGX/jGWzZwNaN/c4OykvRvXpqBHcQST",
-      "fingerprinted": "js/consent.517d6ad1fbf106a1.js"
+      "integrity": "sha384-XY3GHA5QDj/Nri03ZO1t7nsr9RGepZuanY45CTpFQnnTorQnygbtAVG4vVGfkNIP",
+      "fingerprinted": "js/consent.59060d7723d050b2.js"
     },
     "js/passkey-login.js": {
       "integrity": "sha384-65i1wVHIkiS2e0YiOV6oUOF9+tNR7s6QRvpnWaEne43P+B8UvKLTpDgp4MSKNGqX",

package/lib/storefront.js

@@ -266,6 +266,7 @@ var LAYOUT =
   "  </footer>\n" +
   CONSENT_BANNER +
   "RAW_CONSENT_SCRIPT" +
+  "RAW_CART_COUNT_SCRIPT" +
   "RAW_ANNOUNCEMENT_SCRIPT" +
   "</body>\n" +
   "</html>\n";
@@ -621,6 +622,7 @@ function _wrap(opts) {
     .replace("RAW_CSS_INTEGRITY", themeCssIntegrity)
     .replace("RAW_ANNOUNCEMENT_BAR", announcementBarHtml)
     .replace("RAW_CONSENT_SCRIPT", _islandScript("consent.js", { id: "consent-island", policy: _activeConsentPolicy }))
+    .replace("RAW_CART_COUNT_SCRIPT", _islandScript("cart-count.js", { id: "cart-count-island" }))
     .replace("RAW_ANNOUNCEMENT_SCRIPT", announcementScript)
     .replace("RAW_CURRENCY_SWITCHER", switcherHtml)
     .replace("RAW_LOCALE_SWITCHER", localeCtx.switcher_html || "")
@@ -5848,15 +5850,7 @@ function mount(router, deps) {
       }
     }
 
-    var sid = _readSidCookie(req);
-    var cartCount = 0;
-    if (sid) {
-      var c = await deps.cart.bySession(sid);
-      if (c) {
-        var lines = await deps.cart.listLines(c.id);
-        cartCount = lines.length;
-      }
-    }
+    var cartCount = await _cartCountForReq(req);
     var ccy = await _currencyForReq(req);
     _send(res, 200, renderSearch(Object.assign({
       q:               q,
@@ -5886,15 +5880,7 @@ function mount(router, deps) {
     // variant-select interaction we don't ship yet.
     var media = await deps.catalog.media.listForProduct(product.id);
     // Render cart count from the current session's cart, if any.
-    var sid = _readSidCookie(req);
-    var cartCount = 0;
-    if (sid) {
-      var c = await deps.cart.bySession(sid);
-      if (c) {
-        var lines = await deps.cart.listLines(c.id);
-        cartCount = lines.length;
-      }
-    }
+    var cartCount = await _cartCountForReq(req);
     // Published reviews aggregate + list. A failed read (e.g. the
     // reviews table not yet migrated) degrades to the empty state
     // rather than 500-ing the whole PDP — reviews are supplementary
@@ -6298,6 +6284,21 @@ function mount(router, deps) {
     });
   }
 
+  // Nav cart-badge count for the cart-count island. Every storefront
+  // chrome page server-renders the badge (0 on the cookie-less edge-cached
+  // render); the island fetches this on load and corrects the number for a
+  // visitor whose sealed `shop_sid` the edge can't read. JSON only — one
+  // session lookup, no product hydration — and never cached (a per-session
+  // value must not land in a shared cache).
+  router.get("/cart/count", async function (req, res) {
+    var count = await _cartCountForReq(req);
+    res.status(200);
+    res.setHeader && res.setHeader("content-type", "application/json; charset=utf-8");
+    res.setHeader && res.setHeader("cache-control", "no-store");
+    var payload = JSON.stringify({ count: count });
+    return res.end ? res.end(payload) : res.send(payload);
+  });
+
   router.get("/cart", async function (req, res) {
     var ccy = await _currencyForReq(req);
     var sid = _readSidCookie(req);

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.13.19",
-      "tag": "v0.13.19",
+      "version": "0.13.22",
+      "tag": "v0.13.22",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",
@@ -13,7 +13,7 @@
         "server": "lib/vendor/blamejs/"
       },
       "bundler": "shallow git clone of release tag from github.com/blamejs/blamejs",
-      "bundledAt": "2026-05-27"
+      "bundledAt": "2026-05-28"
     }
   }
 }

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,12 @@ upgrading across more than a few patches at a time.
 
 ## v0.13.x
 
+- v0.13.22 (2026-05-27) — **`b.archive.read.zip.fromTrustedStream` reads a ZIP from a Readable — no longer an experimental stub.** fromTrustedStream was an experimental stub whose inspect / entries / extract methods threw, forcing callers to buffer the stream themselves and use the random-access reader. It now works, with the same shape as the tar trusted-stream reader: pass b.archive.adapters.trustedStream(readable) and the bytes are collected into a size-capped buffer (1 GiB hard ceiling) and read through the same bomb-cap, path-traversal, and entry-type decode as the random-access reader — so bombPolicy, guardProfile, entryTypePolicy, and audit all apply, and inspect / entries / extract / extractEntries all return data. This is a bounded-memory reader (the archive is held in memory under the ceiling), not zero-buffer streaming; a future forward-inflate walker shared with the tar reader would lift the ceiling. **Added:** *`b.archive.read.zip.fromTrustedStream` now reads — `inspect` / `entries` / `extract` / `extractEntries`* — The ZIP trusted-stream reader is implemented (was an experimental stub that threw). Pass `b.archive.adapters.trustedStream(readable)` to read a ZIP straight from a Node Readable without buffering it yourself. The stream is collected into a size-capped buffer (1 GiB ceiling, matching `b.archive.read.tar`'s trusted-stream reader) and decoded through the same adversarial-safe path as the random-access reader, so `bombPolicy` / `guardProfile` / `entryTypePolicy` / `audit` are honored on decode. Adversarial archives remain fully bomb-capped; "trusted" refers only to the source-size bound. A non-trusted-stream adapter is refused with `archive-read/bad-adapter`.
+
+- v0.13.21 (2026-05-27) — **`b.cose.exportKey` — serialize a public key as a COSE_Key, the inverse of `b.cose.importKey`.** b.cose could import a COSE_Key (RFC 9052 §7) into a node:crypto key for verification, but had no way to produce one — so a key used with b.cose.sign could not be shipped to a verifier in COSE form without hand-building the CBOR map. b.cose.exportKey(keyObject, opts?) closes the round-trip: it serializes an EC2 (P-256 / P-384 / P-521) or OKP (Ed25519) public key as the CBOR-encoded COSE_Key map, with optional alg and kid common parameters. A private key has its public half exported; unsupported curves / key types are refused rather than emitting a COSE_Key no verifier here would accept. The bytes round-trip through b.cose.importKey, and feed the mdoc MSO / COSE_Key header / SCITT / C2PA verification-key paths. **Added:** *`b.cose.exportKey(keyObject, { alg?, kid? })` — KeyObject → COSE_Key (RFC 9052 §7)* — Serialize a `node:crypto` public key as the CBOR-encoded COSE_Key map — the inverse of `b.cose.importKey`. Supports EC2 (P-256 / P-384 / P-521) and OKP (Ed25519), the same key types `b.cose.verify` accepts; `opts.alg` (e.g. `"ES256"`) and `opts.kid` populate the COSE_Key alg (label 3) and kid (label 2) common parameters. A private key exports its public half; unsupported curves / key types throw rather than producing a COSE_Key no verifier would accept. `b.cose.importKey(b.cbor.decode(exportKey(k)))` round-trips, so a key signed with `b.cose.sign` can be shipped to a verifier as bytes — the mdoc MSO / COSE_Key header / SCITT / C2PA verification-key paths.
+
+- v0.13.20 (2026-05-27) — **`b.archive.wrap` can seal an archive for a tenant with no key-pair to manage — `recipient: "tenant"`.** b.archive.wrap previously sealed only to an explicit hybrid-PQC key-pair or a peer certificate; the documented recipient: "tenant" strategy threw. It now works: pass { recipient: "tenant", tenantId } and the archive is sealed under a deterministic per-tenant key derived from the vault root (SHAKE256 KDF) with XChaCha20-Poly1305, the tenant id mixed into the AEAD additional-authenticated-data so one tenant's envelope cannot be opened under another tenant's key. There is no recipient key-pair for the operator to generate, store, or rotate — b.archive.unwrap re-derives the key from the same tenantId. Rotating the vault re-keys every tenant (rotation intent is re-seal). The derivation is exposed directly as b.agent.tenant.derivedKey(tenantId, purpose) for operators who need the raw per-tenant key for their own AEAD. Requires an initialized vault. **Added:** *`b.archive.wrap` / `b.archive.unwrap` `recipient: "tenant"` — per-tenant archive sealing, no key-pair* — `b.archive.wrap(bytes, { recipient: "tenant", tenantId })` seals under a deterministic per-tenant key derived from the vault root with XChaCha20-Poly1305 (draft-irtf-cfrg-xchacha-03) and a SHAKE256 KDF (FIPS 202); the tenant id is bound into the AEAD AAD so a tenant-A envelope cannot decrypt under tenant-B's key even if an attacker swaps envelope headers. `b.archive.unwrap(sealed, { recipient: "tenant", tenantId })` (or just `{ tenantId }`) re-derives the key and recovers the bytes — no recipient key-pair to manage. The tenant envelope carries a distinct version byte so it is never fed to the hybrid-KEM decrypt path. The static-key and peer-cert recipient strategies are unchanged. · *`b.agent.tenant.derivedKey(tenantId, purpose)` — direct per-tenant key derivation* — The deterministic, domain-separated per-tenant key derivation (vault root + tenantId + purpose, SHAKE256, NUL-separated) is now exported at the module level, returning a 64-char hex key. Previously reachable only as a method on a created tenant manager; operators who need the raw key for their own AEAD can now call it directly. Throws if the vault is not initialized.
+
 - v0.13.19 (2026-05-27) — **`auditTools` export / archive / forensic-snapshot can return the bundle as bytes — no output directory for serverless / read-only filesystems.** b.auditTools.exportSlice, b.auditTools.archive, and b.auditTools.forensicSnapshot required an `out` directory to write the encrypted bundle (rows.enc + optional checkpoint.enc + manifest.json), which is unusable on a read-only or ephemeral serverless filesystem. Each now accepts `returnBytes: true` instead of `out` and returns the bundle as an in-memory `{ filename: Buffer }` map — ready to stream to object storage or over the wire with no filesystem access. `out` and `returnBytes` are mutually exclusive. The on-disk path is unchanged. The bundle's encryption (XChaCha20-Poly1305 + Argon2id), chain-proof material, and manifest checksums are identical to the written bundle, so an in-memory bundle written to disk verifies exactly as one produced by the `out` path. **Added:** *`returnBytes` on `auditTools.exportSlice` / `archive` / `forensicSnapshot` — in-memory bundles* — Pass `returnBytes: true` (and omit `out`) to get the encrypted audit bundle as an in-memory `{ filename: Buffer }` map instead of a directory write — the read-only / serverless path. `exportSlice` / `archive` return `{ manifest, files, rowCount, range }`; `forensicSnapshot` returns `{ ...manifest, files }` where `files` carries the slice's `rows.enc` + `manifest.json` plus the `forensic-snapshot.json` incident wrapper. The encryption, chain proof, and manifest checksums match the on-disk bundle byte-for-byte, so the bytes verify with `verifyBundle` once written out. `out` and `returnBytes` are mutually exclusive (passing both throws). **Fixed:** *`auditTools.forensicSnapshot` now honors the `since` window instead of capturing the entire audit history* — `forensicSnapshot` passed its `since` bound to the slice exporter under the wrong option name, so the time filter was silently dropped and the snapshot bundled every audit row regardless of `since`. The window is now applied — a snapshot scoped to an incident window contains only that window's rows. The snapshot manifest's `auditSliceFile` field, previously always undefined, now records the slice location.
 
 - v0.13.18 (2026-05-27) — **`bodyParser` multipart can buffer uploads in memory — no tmp directory for serverless / read-only filesystems.** The multipart/form-data sub-parser previously streamed every file part to a tmp directory on disk (os.tmpdir() by default), which fails on a read-only or ephemeral serverless filesystem. A new multipart.storage option selects where file parts land: "disk" (default, unchanged — req.files[].path points at a tmp file cleaned up on response end) or "memory" (req.files[].buffer holds the assembled bytes, with no filesystem access at all). Both modes enforce the same per-file (fileSize), per-field, and total-request (totalSize) caps, so memory mode adds no new memory-exhaustion surface. The file object shape is stable across both modes — disk sets path with buffer null, memory sets buffer with path null — so a handler branches on whichever is non-null. An invalid storage value is rejected when the middleware is constructed. **Added:** *`bodyParser` multipart `storage: "memory"` — buffer uploads in RAM instead of a tmp directory* — `b.middleware.bodyParser({ multipart: { storage: "memory" } })` buffers each uploaded file part in memory and exposes it as `req.files[].buffer` (a Buffer), with no `os.tmpdir()` write and no tmp-file cleanup — the read-only / serverless path. The default `storage: "disk"` is unchanged: file parts stream to a tmp file, `req.files[].path` points at it, and it is removed when the response finishes. Both modes apply the existing `fileSize` / per-field `maxBytes` / `totalSize` caps and SHA3-512 hash each part during streaming, so memory mode is bounded by the same limits and adds no new DoS surface. The `req.files[]` shape is stable across modes (disk: `path` set, `buffer` null; memory: `buffer` set, `path` null). A `storage` value other than `"disk"` or `"memory"` throws a `TypeError` at construction.

package/lib/vendor/blamejs/README.md

@@ -141,7 +141,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 - **JSON / SQL / schema** — `b.safeJson` (with `maxKeys` cap defending CVE-2026-21717 V8 HashDoS), `b.safeBuffer`, `b.safeSql`, `b.safeSchema`
 - **URL + path** — `b.safeUrl` (IDN mixed-script / homograph refuse); `b.safeJsonPath` (refuses filter `?(...)`, deep-scan `$..`, script-shape `(@.x)` for safe Postgres JSONB ops)
 - **Binary codec** — `b.cbor` bounded deterministic CBOR (RFC 8949 §4.2): depth/size caps, indefinite-length + reserved-info + tag + duplicate-key refusal, `requireDeterministic` canonical-form check; the in-tree substrate under COSE / CWT / SCITT / WebAuthn attestation
-- **COSE messages** — `b.cose` the full RFC 9052 message-type set over `b.cbor`: COSE_Sign1 sign/verify (attached or detached payload), COSE_Encrypt0 single-recipient AEAD, COSE_Mac0 shared-key HMAC (mac0/macVerify0), plus `importKey` (COSE_Key → KeyObject). Signatures use classical ES256/384/512 + EdDSA (final COSE ids, interoperable today) plus ML-DSA-87 (PQC-forward, draft id); bounded + alg-allowlisted + crit-bypass-checked verification; AEAD ChaCha20/Poly1305 default (AES-GCM opt-in); the signed-statement substrate under SCITT / CWT / mdoc / C2PA
+- **COSE messages** — `b.cose` the full RFC 9052 message-type set over `b.cbor`: COSE_Sign1 sign/verify (attached or detached payload), COSE_Encrypt0 single-recipient AEAD, COSE_Mac0 shared-key HMAC (mac0/macVerify0), plus `importKey` (COSE_Key → KeyObject) and `exportKey` (KeyObject → COSE_Key, the inverse — ship a verification key as RFC 9052 §7 bytes). Signatures use classical ES256/384/512 + EdDSA (final COSE ids, interoperable today) plus ML-DSA-87 (PQC-forward, draft id); bounded + alg-allowlisted + crit-bypass-checked verification; AEAD ChaCha20/Poly1305 default (AES-GCM opt-in); the signed-statement substrate under SCITT / CWT / mdoc / C2PA
 - **CBOR Web Token** — `b.cwt` CWT sign/verify (RFC 8392) over `b.cose`: standard-claim mapping (iss/sub/aud/exp/nbf/iat/cti) + `exp`/`nbf` clock-skew enforcement + `iss`/`aud` matching; the CBOR-native JWT for constrained / IoT / FIDO / verifiable-credential contexts
 - **Entity Attestation Token** — `b.eat` EAT sign/verify (RFC 9711) over `b.cwt`: device + software attestation claims (ueid / oemid / hwmodel / measurements / submods) with verifier-nonce freshness binding, `dbgstat` debug-status policy, and `eat_profile` pinning
 - **SCITT signed statements** — `b.scitt` sign/verify a signed, attributable claim about an artifact (signed SBOM, build attestation, release approval) over `b.cose`: the issuer + subject bind in the integrity-protected CWT_Claims header (RFC 9597); verification refuses any statement missing the iss/sub binding. The issuer side, on finalized RFCs; the transparency receipt (COSE Receipts draft) opts in on publication
@@ -228,7 +228,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 - **i18n** — CLDR plural rules, Accept-Language negotiation, Intl formatters, RTL (`b.i18n`)
 - **CSV** — RFC 4180 with Excel formula-injection prevention (`b.csv`)
 - **IDs + slugs** — RFC 9562 UUID v4 + v7 (`b.uuid`); URL-safe slugs (`b.slug`)
-- **Time + archive** — TZ-aware datetime (`b.time`); ZIP creation + adversarial-safe read with bomb caps + path-traversal + LFH/CD-skew defense (`b.archive` + `b.archive.read.zip`); one-liner quarantine extraction (`b.safeArchive.extract`); in-memory extraction with no disk write for read-only / serverless filesystems (`b.archive.read.zip(...).extractEntries()` / `.tar`); fs / objectStore / http / buffer / trusted-stream adapter contract (`b.archive.adapters`)
+- **Time + archive** — TZ-aware datetime (`b.time`); ZIP creation + adversarial-safe read with bomb caps + path-traversal + LFH/CD-skew defense (`b.archive` + `b.archive.read.zip`); one-liner quarantine extraction (`b.safeArchive.extract`); in-memory extraction with no disk write for read-only / serverless filesystems (`b.archive.read.zip(...).extractEntries()` / `.tar`); fs / objectStore / http / buffer / trusted-stream adapter contract (`b.archive.adapters`); recipient-sealed envelopes — hybrid-PQC key-pair, peer certificate, or per-tenant key with no key-pair to manage (`b.archive.wrap({ recipient: "tenant", tenantId })`)
 - **Pagination + forms** — HMAC-signed cursor pagination (`b.pagination`); HTML form rendering + validation + CSRF (`b.forms`)
 
 ### Production

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.13.19",
-  "createdAt": "2026-05-27T20:32:29.864Z",
+  "frameworkVersion": "0.13.22",
+  "createdAt": "2026-05-27T23:32:55.833Z",
   "exports": {
     "a2a": {
       "type": "object",
@@ -992,6 +992,10 @@
               "type": "function",
               "arity": 1
             },
+            "derivedKey": {
+              "type": "function",
+              "arity": 2
+            },
             "guards": {
               "type": "object",
               "members": {
@@ -13663,6 +13667,10 @@
           "type": "function",
           "arity": 2
         },
+        "exportKey": {
+          "type": "function",
+          "arity": 2
+        },
         "importKey": {
           "type": "function",
           "arity": 1

package/lib/vendor/blamejs/lib/agent-tenant.js

@@ -386,6 +386,35 @@ function _deriveTenantKeyBytes(tenantId, purpose) {
   return bCrypto.kdf(input, TENANT_KEY_BYTES);
 }
 
+/**
+ * @primitive b.agent.tenant.derivedKey
+ * @signature b.agent.tenant.derivedKey(tenantId, purpose)
+ * @since     0.9.25
+ * @status    stable
+ * @compliance hipaa, pci-dss, gdpr, soc2
+ * @related   b.agent.tenant.create, b.archive.wrap, b.vault
+ *
+ * Derive a deterministic, domain-separated 32-byte key for a tenant
+ * and a named purpose, returned as a 64-char hex string. The key is a
+ * SHAKE256 KDF over the vault root (the master keypair PEM hashed),
+ * the `tenantId`, and the `purpose`, with NUL separators so distinct
+ * `(tenantId, purpose)` pairs cannot collide. The same inputs always
+ * produce the same key, so a value sealed under
+ * `derivedKey(t, "archive-wrap")` is recoverable later from the same
+ * tenant + purpose with no key escrow. Rotating the vault
+ * (`b.vaultRotate.rotate`) changes the root and therefore every
+ * derived key — by design, rotation intent is re-seal.
+ *
+ * Throws if the vault has not been initialized (keys cannot be derived
+ * before bootstrap) or if `purpose` is empty. This is the same
+ * derivation the per-tenant `sealField` / archive `recipient: "tenant"`
+ * paths use internally; call it directly when you need the raw key for
+ * your own AEAD.
+ *
+ * @example
+ *   var key = b.agent.tenant.derivedKey("acme-corp", "archive-wrap");
+ *   // → "9f3c…" (64 hex chars; deterministic per tenant + purpose)
+ */
 function _derivedKey(tenantId, purpose) {
   // Public API — returns hex so the existing wire shape (operators
   // storing the derived key string in their DB) is unchanged. Internal
@@ -624,6 +653,7 @@ function _inMemoryBackend() {
 
 module.exports = {
   create:                    create,
+  derivedKey:                _derivedKey,
   CROSS_TENANT_ADMIN_SCOPE:  CROSS_TENANT_ADMIN_SCOPE,
   AgentTenantError:          AgentTenantError,
   guards: {

package/lib/vendor/blamejs/lib/archive-read.js

@@ -51,6 +51,8 @@ var ArchiveReadError = defineClass("ArchiveReadError", { alwaysPermanent: true }
 var guardFilename = lazyRequire(function () { return require("./guard-filename"); });
 var guardArchive  = lazyRequire(function () { return require("./guard-archive"); });
 var safeDecompress = lazyRequire(function () { return require("./safe-decompress"); });
+var safeBuffer     = lazyRequire(function () { return require("./safe-buffer"); });
+var archiveAdapters = lazyRequire(function () { return require("./archive-adapters"); });
 
 // ---- Wire-format constants ------------------------------------------------
 // Aligned with the write-side `lib/archive.js`. APPNOTE.TXT § references
@@ -775,29 +777,31 @@ function zip(adapter, opts) {
  * @status    experimental
  * @related   b.archive.read.zip, b.archive.adapters.trustedStream
  *
- * Forward-scan-only ZIP reader for trusted Readable sources. No
- * central-directory comparison — operators reaching for this primitive
- * are declaring they own the producer (e.g. piping their own
- * `b.archive.zip().toStream()` output back into a reader for round-trip
- * verification).
+ * ZIP reader for a Readable source — pass `b.archive.adapters.trustedStream(readable)`
+ * instead of buffering the stream yourself. The bytes are collected
+ * into a size-capped buffer (1 GiB hard ceiling, like the tar
+ * trusted-stream reader) and then read through the same bomb-cap /
+ * path-traversal / entry-policy decode as the random-access reader, so
+ * `bombPolicy`, `guardProfile`, `entryTypePolicy`, and `audit` all
+ * apply. "Trusted" means the source size is bounded by the operator —
+ * the collection ceiling is the only guard against an unbounded
+ * producer; adversarial archives are still fully bomb-capped on decode.
  *
- * NOT YET IMPLEMENTED: the streaming LFH walker is not built —
- * `inspect()` / `entries()` / `extract()` throw
- * `archive-read/trusted-stream-*-deferred`, and `bombPolicy` / `audit`
- * are accepted but not yet honored. Re-opens when a streaming
- * consumer needs it. Until then, collect the stream into a buffer and
- * use the random-access reader, which is the supported path for both
- * trusted round-trip verification and adversarial input.
+ * The collection ceiling means this is not zero-buffer streaming (the
+ * whole archive is held in memory, capped); a future bounded-memory
+ * forward-inflate walker would lift that, shared with the tar reader.
  *
  * @opts
- *   bombPolicy:       { ... },   // reserved — not yet honored
- *   audit:            b.audit,   // reserved — not yet honored
+ *   bombPolicy:       { maxEntries, maxEntryDecompressedBytes,
+ *                       maxTotalDecompressedBytes, maxExpansionRatio },
+ *   entryTypePolicy:  { ... },
+ *   guardProfile:     "strict" | "balanced" | "permissive",
+ *   audit:            b.audit,
  *
  * @example
- *   // Supported path: buffer the stream, then read random-access.
- *   var bytes  = await someStreamToBuffer(producedZipStream);
- *   var reader = b.archive.read.zip(b.archive.adapters.buffer(bytes));
+ *   var reader  = b.archive.read.zip.fromTrustedStream(b.archive.adapters.trustedStream(readable));
  *   var entries = await reader.inspect();
+ *   void entries;
  */
 function fromTrustedStream(adapter, opts) {
   if (!adapter || adapter.kind !== "trusted-sequential") {
@@ -805,36 +809,45 @@ function fromTrustedStream(adapter, opts) {
       "fromTrustedStream: adapter must come from b.archive.adapters.trustedStream(readable)");
   }
   opts = opts || {};
-  var bombPolicy = _normalizeBombPolicy(opts.bombPolicy);
-  void bombPolicy;
-
-  // The streaming LFH walker is not built — only the API surface +
-  // adapter validation exist. Extraction via streaming inflate +
-  // data-descriptor scanning re-opens when a streaming consumer needs
-  // it; until then the supported path is to buffer the stream and use
-  // the random-access reader (which handles both trusted round-trip
-  // verification and adversarial input).
-  async function inspect() {
-    throw new ArchiveReadError("archive-read/trusted-stream-inspect-deferred",
-      "fromTrustedStream.inspect() is not implemented — collect the stream into a buffer and " +
-      "use b.archive.read.zip(b.archive.adapters.buffer(bytes))");
+
+  // Collect the Readable into a size-capped buffer once (tar-parity:
+  // boundedChunkCollector with a 1 GiB ceiling), then delegate to the
+  // random-access reader so the full bomb-cap / guard / audit decode
+  // applies. Lazy + memoized — construction stays cheap and the stream
+  // is consumed only on the first method call.
+  var readerPromise = null;
+  function _reader() {
+    if (!readerPromise) {
+      readerPromise = (async function () {
+        var collector = safeBuffer().boundedChunkCollector({
+          maxBytes:   C.BYTES.gib(1),
+          errorClass: ArchiveReadError,
+          sizeCode:   "archive-read/trusted-stream-too-large",
+        });
+        for await (var chunk of adapter.readable) { collector.push(chunk); }
+        return zip(archiveAdapters().buffer(collector.result()), opts);
+      })();
+    }
+    return readerPromise;
   }
 
+  async function inspect() { return (await _reader()).inspect(); }
   async function* entries() {
-    throw new ArchiveReadError("archive-read/trusted-stream-entries-deferred",
-      "fromTrustedStream.entries() is not implemented — collect into a buffer and use the random-access reader");
+    var r = await _reader();
+    for await (var e of r.entries()) { yield e; }
   }
-
-  async function extract() {
-    throw new ArchiveReadError("archive-read/trusted-stream-extract-deferred",
-      "fromTrustedStream.extract() is not implemented — collect into a buffer and use the random-access reader");
+  async function extract(extractOpts) { return (await _reader()).extract(extractOpts); }
+  async function* extractEntries(extractOpts) {
+    var r = await _reader();
+    for await (var e of r.extractEntries(extractOpts)) { yield e; }
   }
 
   return {
-    kind:    "zip-trusted-sequential",
-    inspect: inspect,
-    entries: entries,
-    extract: extract,
+    kind:           "zip-trusted-sequential",
+    inspect:        inspect,
+    entries:        entries,
+    extract:        extract,
+    extractEntries: extractEntries,
   };
 }
 

package/lib/vendor/blamejs/lib/archive-wrap.js

@@ -15,10 +15,11 @@
  *   var bytes  = b.archive.unwrap(sealed, { recipient: privKeys });
  *   var reader = b.archive.read.tar(b.archive.adapters.buffer(bytes));
  *
- * Builder-fluent composition (`tarBuilder.toAdapter(s3, { wrap: ... })`)
- * + per-entry ZIP wrap (Flavor 2) land in v0.12.11 alongside the
- * backup-crypto refactor; this patch ships the recipient substrate
- * + the b.backup `cryptoStrategy: "recipient"` opt that consumes it.
+ * Three recipient strategies: a static hybrid-PQC key-pair, a peer
+ * certificate, and `"tenant"` — a deterministic per-tenant symmetric
+ * seal keyed by the vault root (no key-pair to manage; unwrap
+ * re-derives from the tenant id). b.backup's `cryptoStrategy:
+ * "recipient"` consumes the same substrate.
  */
 
 var C = require("./constants");
@@ -29,13 +30,23 @@ var ArchiveWrapError = defineClass("ArchiveWrapError", { alwaysPermanent: true }
 
 var bCrypto = lazyRequire(function () { return require("./crypto"); });
 var backupCrypto = lazyRequire(function () { return require("./backup/crypto"); });
+var agentTenant = lazyRequire(function () { return require("./agent-tenant"); });
 
 // Envelope magic — 5-byte ASCII prefix the safe-archive sniffer
 // recognises. Distinct from b.crypto.encrypt's base64 envelope so
 // archive-wrap output can carry an unambiguous "this is an archive
 // wrap envelope" magic before the operator-controlled payload.
 var ARCH_WRAP_MAGIC = "BAWRP";                                                       // allow:raw-byte-literal — 5-byte ASCII archive-wrap recipient envelope magic
-var ARCH_WRAP_VERSION = 0x01;                                                        // allow:raw-byte-literal — recipient version byte
+var ARCH_WRAP_VERSION = 0x01;                                                        // allow:raw-byte-literal — recipient version byte (hybrid-KEM envelope)
+// Tenant strategy uses the same BAWRP magic with a distinct version
+// byte: the body is a symmetric XChaCha20-Poly1305 packed ciphertext
+// (b.crypto.encryptPacked) keyed by the tenant's vault-derived key,
+// not a hybrid-KEM envelope. unwrap dispatches on the version byte so
+// a tenant envelope is never fed to the KEM decrypt path.
+var ARCH_WRAP_VERSION_TENANT = 0x02;                                                 // allow:raw-byte-literal — tenant symmetric-seal version byte
+// Purpose label for the per-tenant key derivation (domain-separates
+// the archive-wrap key from a tenant's seal / audit / session keys).
+var TENANT_KEY_PURPOSE = "archive-wrap";
 var ARCH_WRAP_HEADER_BYTES = C.BYTES.bytes(6);                                        // magic(5) + version(1)
 // Passphrase variant — wire format: magic(5) + version(1) + saltLen(1)
 // + salt(saltLen bytes) + encrypted bytes (24-byte nonce + ciphertext+tag
@@ -66,10 +77,14 @@ var ARCH_PASSPHRASE_HEADER_BYTES = C.BYTES.bytes(7);
  *   - peer cert   — `{ recipient: { peerCertDer, peerKemPubkey } }` composes
  *                   `b.crypto.encryptEnvelopeAsCertPeer` (extracts the
  *                   P-384 half from the cert).
- *   - tenant      — `{ recipient: "tenant", tenantId: "alpha" }` resolves
- *                   the tenant's KEM keypair via `b.vault.derivedKey`
- *                   (deferred to v0.12.11 alongside the backup
- *                   `cryptoStrategy: "recipient"` adoption).
+ *   - tenant      — `{ recipient: "tenant", tenantId: "alpha" }` seals
+ *                   under a deterministic per-tenant key derived from the
+ *                   vault root (`b.agent.tenant.derivedKey`) with
+ *                   XChaCha20-Poly1305, the tenant id mixed into the AEAD
+ *                   AAD so one tenant's envelope cannot open under
+ *                   another's key. No recipient key-pair to manage;
+ *                   `unwrap` re-derives from the same `tenantId`. Requires
+ *                   an initialized vault.
  *
  * @opts
  *   recipient:  object | string,   // see strategies above; required
@@ -96,15 +111,16 @@ function wrap(bytes, opts) {
     throw new ArchiveWrapError("archive-wrap/no-recipient",
       "wrap: opts.recipient is required (static key object | \"tenant\" string | peer-cert object)");
   }
-  var envelope = _encryptForRecipient(bytes, opts);
-  // envelope is a base64 string from b.crypto.encrypt. Buffer it and
-  // prepend the 6-byte archive-wrap header so safeArchive's sniffer
-  // can identify it without attempting decryption.
-  var envelopeBuf = Buffer.from(envelope, "utf-8");
+  var enc = _encryptForRecipient(bytes, opts);
+  // enc.body is the envelope bytes (base64 KEM envelope for static /
+  // peer-cert recipients, symmetric packed ciphertext for tenant).
+  // Prepend the 6-byte archive-wrap header stamped with the strategy's
+  // version byte so safeArchive's sniffer + unwrap can identify the
+  // envelope (and pick the right decrypt path) without trial decryption.
   var header = Buffer.alloc(ARCH_WRAP_HEADER_BYTES);
   header.write(ARCH_WRAP_MAGIC, 0, 5, "ascii");
-  header[5] = ARCH_WRAP_VERSION;
-  return Buffer.concat([header, envelopeBuf]);
+  header[5] = enc.version;
+  return Buffer.concat([header, enc.body]);
 }
 
 /**
@@ -121,11 +137,14 @@ function wrap(bytes, opts) {
  * than a crypto-level error.
  *
  * @opts
- *   recipient:  object,   // { privateKey, ecPrivateKey } | { certPrivateKey, kemSecret }; required
+ *   recipient:  object | "tenant",  // { privateKey, ecPrivateKey } | { certPrivateKey, kemSecret } | "tenant"
+ *   tenantId:   string,             // required when the envelope was sealed with recipient: "tenant"
  *
  * @example
  *   var bytes  = b.archive.unwrap(sealed, { recipient: privPair });
  *   var reader = b.archive.read.tar(b.archive.adapters.buffer(bytes));
+ *   // tenant envelope:
+ *   var t = b.archive.unwrap(sealedForTenant, { recipient: "tenant", tenantId: "alpha" });
  */
 function unwrap(sealed, opts) {
   opts = opts || {};
@@ -145,6 +164,27 @@ function unwrap(sealed, opts) {
       JSON.stringify(ARCH_WRAP_MAGIC) + "; got " + JSON.stringify(magic));
   }
   var version = buf[5];
+  // Tenant strategy: symmetric packed ciphertext keyed by the
+  // vault-derived per-tenant key. Re-derive from opts.tenantId and
+  // decrypt under the same tenant-bound AAD that wrap sealed with.
+  if (version === ARCH_WRAP_VERSION_TENANT) {
+    if (opts.recipient !== undefined && opts.recipient !== "tenant") {
+      throw new ArchiveWrapError("archive-wrap/recipient-mismatch",
+        "unwrap: this envelope was sealed with recipient: \"tenant\" — pass opts.tenantId " +
+        "(and either omit opts.recipient or set it to \"tenant\"), not a key-pair recipient");
+    }
+    var tenantKey = _tenantKey(opts.tenantId);
+    var packedBody = buf.slice(ARCH_WRAP_HEADER_BYTES);
+    try {
+      return bCrypto().decryptPacked(packedBody, tenantKey, _tenantAad(opts.tenantId));
+    } catch (e) {
+      var terr = new ArchiveWrapError("archive-wrap/decrypt-failed",
+        "unwrap: tenant envelope decryption refused (wrong tenantId or rotated vault?): " +
+        ((e && e.message) || String(e)));
+      terr.cause = e;
+      throw terr;
+    }
+  }
   if (version !== ARCH_WRAP_VERSION) {
     throw new ArchiveWrapError("archive-wrap/bad-version",
       "unwrap: archive-wrap version " + version + " not supported by this build");
@@ -152,7 +192,8 @@ function unwrap(sealed, opts) {
   if (!opts.recipient || typeof opts.recipient !== "object") {
     throw new ArchiveWrapError("archive-wrap/no-recipient",
       "unwrap: opts.recipient is required ({ privateKey, ecPrivateKey } " +
-      "for the static-key path, { certPrivateKey, kemSecret } for the peer-cert path)");
+      "for the static-key path, { certPrivateKey, kemSecret } for the peer-cert path, " +
+      "or \"tenant\" + opts.tenantId for the tenant path)");
   }
   var envelope = buf.slice(ARCH_WRAP_HEADER_BYTES).toString("utf-8");
   var plaintext;
@@ -183,28 +224,52 @@ function unwrap(sealed, opts) {
   return Buffer.isBuffer(plaintext) ? plaintext : Buffer.from(plaintext);
 }
 
+// Resolve a tenant's deterministic 32-byte archive-wrap key from the
+// vault root. Throws a clear archive-wrap error (rather than a deep
+// agent-tenant one) when tenantId is missing; the vault-not-initialized
+// case surfaces from agentTenant.derivedKey unchanged.
+function _tenantKey(tenantId) {
+  if (typeof tenantId !== "string" || tenantId.length === 0) {
+    throw new ArchiveWrapError("archive-wrap/no-tenant-id",
+      "recipient: \"tenant\" requires opts.tenantId (a non-empty string)");
+  }
+  return Buffer.from(agentTenant().derivedKey(tenantId, TENANT_KEY_PURPOSE), "hex");
+}
+
+// AAD context-binds the symmetric envelope to the tenant: the Poly1305
+// tag covers this, so a tenant-A envelope cannot be decrypted under
+// tenant-B's key even if an attacker swaps headers between envelopes.
+function _tenantAad(tenantId) {
+  return Buffer.from("archive-wrap|tenant|" + tenantId, "utf8");
+}
+
+// Returns { version, body } so wrap() can stamp the right version byte:
+// hybrid-KEM recipients use ARCH_WRAP_VERSION with a base64 envelope
+// body; the tenant strategy uses ARCH_WRAP_VERSION_TENANT with a
+// symmetric packed-ciphertext body.
 function _encryptForRecipient(bytes, opts) {
   var r = opts.recipient;
   if (typeof r === "string") {
     if (r === "tenant") {
-      // tenant strategy lands in v0.12.11 alongside the backup
-      // cryptoStrategy adoption — refuse cleanly for v0.12.10 so
-      // operators see the deferred-shape contract.
-      throw new ArchiveWrapError("archive-wrap/tenant-strategy-deferred",
-        "wrap: recipient: \"tenant\" lands in v0.12.11 alongside b.backup cryptoStrategy: \"recipient\" + per-tenant key resolution. For v0.12.10, pass an explicit { publicKey, ecPublicKey } recipient");
+      var tenantKey = _tenantKey(opts.tenantId);
+      var packed = bCrypto().encryptPacked(Buffer.from(bytes), tenantKey, _tenantAad(opts.tenantId));
+      return { version: ARCH_WRAP_VERSION_TENANT, body: packed };
     }
     throw new ArchiveWrapError("archive-wrap/bad-recipient",
-      "wrap: recipient string " + JSON.stringify(r) + " not recognised; \"tenant\" deferred to v0.12.11");
+      "wrap: recipient string " + JSON.stringify(r) + " not recognised; the only string recipient is \"tenant\" (with opts.tenantId)");
   }
   if (r.peerCertDer || r.peerKemPubkey) {
     if (!r.peerCertDer || !r.peerKemPubkey) {
       throw new ArchiveWrapError("archive-wrap/bad-recipient",
         "wrap: peer-cert strategy requires BOTH peerCertDer + peerKemPubkey");
     }
-    return bCrypto().encryptEnvelopeAsCertPeer(bytes, {
-      peerCertDer:    r.peerCertDer,
-      peerKemPubkey:  r.peerKemPubkey,
-    });
+    return {
+      version: ARCH_WRAP_VERSION,
+      body: Buffer.from(bCrypto().encryptEnvelopeAsCertPeer(bytes, {
+        peerCertDer:    r.peerCertDer,
+        peerKemPubkey:  r.peerKemPubkey,
+      }), "utf-8"),
+    };
   }
   if (r.publicKey) {
     // Codex P2 on v0.12.10 PR #161 — b.crypto.encrypt falls back to
@@ -221,10 +286,13 @@ function _encryptForRecipient(bytes, opts) {
         "and ecPublicKey (P-384 ECDH PEM). Partial recipients trip b.crypto.encrypt's " +
         "ML-KEM-only fallback which silently degrades the hybrid contract this primitive promises.");
     }
-    return bCrypto().encrypt(bytes, {
-      publicKey:    r.publicKey,
-      ecPublicKey:  r.ecPublicKey,
-    });
+    return {
+      version: ARCH_WRAP_VERSION,
+      body: Buffer.from(bCrypto().encrypt(bytes, {
+        publicKey:    r.publicKey,
+        ecPublicKey:  r.ecPublicKey,
+      }), "utf-8"),
+    };
   }
   throw new ArchiveWrapError("archive-wrap/bad-recipient",
     "wrap: recipient must be { publicKey, ecPublicKey } | { peerCertDer, peerKemPubkey } | \"tenant\"");

package/lib/vendor/blamejs/lib/cose.js

@@ -743,9 +743,15 @@ function macVerify0(coseMac0, opts) {
 // secp256k1 key be verified under ES256, breaking the COSE alg/curve
 // binding (RFC 9053). Re-add with an explicit ES256K algorithm.
 var COSE_EC2_CRV = { 1: "P-256", 2: "P-384", 3: "P-521" };
+// Reverse of COSE_EC2_CRV — JWK crv name → COSE EC2 curve id, for exportKey.
+var COSE_EC2_CRV_ID = { "P-256": 1, "P-384": 2, "P-521": 3 };
 var COSE_KTY_OKP = 1;
 var COSE_KTY_EC2 = 2;
 var COSE_OKP_ED25519 = 6;                                                    // allow:raw-byte-literal — COSE OKP Ed25519 crv id (RFC 9053)
+// COSE_Key common-parameter labels (RFC 9052 §7.1): 1=kty, 2=kid, 3=alg.
+var COSE_KEY_LABEL_KTY = 1;
+var COSE_KEY_LABEL_KID = 2;
+var COSE_KEY_LABEL_ALG = 3;
 
 function _coseKeyBytes(v, what) {
   if (Buffer.isBuffer(v)) return v;
@@ -804,6 +810,83 @@ function importKey(coseKey) {
   catch (e) { throw new CoseError("cose/bad-cose-key", "cose.importKey: could not import COSE_Key: " + ((e && e.message) || e)); }
 }
 
+/**
+ * @primitive b.cose.exportKey
+ * @signature b.cose.exportKey(keyObject, opts?)
+ * @since     0.13.20
+ * @status    stable
+ * @related   b.cose.importKey, b.cose.verify, b.cbor.encode
+ *
+ * Serialize a <code>node:crypto</code> public key as a COSE_Key
+ * (RFC 9052 §7) — the CBOR-map, integer-labelled form embedded in an
+ * mdoc MSO, a COSE_Key header, or a SCITT / C2PA verification-key
+ * field. The inverse of <code>b.cose.importKey</code>: a key signed
+ * with <code>b.cose.sign</code> can be shipped to a verifier as bytes
+ * and re-imported. Returns the CBOR-encoded bytes (like the other COSE
+ * producers); pass the decoded map to <code>importKey</code> to round-trip.
+ *
+ * Accepts the same key types <code>importKey</code> / <code>verify</code>
+ * understand: EC2 (P-256 / P-384 / P-521) and OKP (Ed25519). A private
+ * key has its public half exported. Other curves / key types are
+ * refused rather than emitting a COSE_Key no verifier here would accept.
+ *
+ * @opts
+ *   alg:   string,          // optional COSE alg label (e.g. "ES256") → COSE_Key label 3
+ *   kid:   Buffer | string, // optional key id → COSE_Key label 2 (bstr; string encoded UTF-8)
+ *
+ * @example
+ *   var bytes = b.cose.exportKey(pubKey, { alg: "ES256", kid: "key-1" });
+ *   var key   = b.cose.importKey(b.cbor.decode(bytes));   // round-trips
+ */
+function exportKey(keyObject, opts) {
+  opts = opts || {};
+  if (!keyObject || typeof keyObject.export !== "function" || typeof keyObject.type !== "string") {
+    throw new CoseError("cose/bad-key", "cose.exportKey: expected a node:crypto KeyObject");
+  }
+  // A private key exports its public half — a COSE_Key here is a
+  // verification key, never the secret.
+  var pub = keyObject.type === "private" ? nodeCrypto.createPublicKey(keyObject) : keyObject;
+  var jwk;
+  try { jwk = pub.export({ format: "jwk" }); }
+  catch (e) { throw new CoseError("cose/bad-key", "cose.exportKey: could not export key to JWK: " + ((e && e.message) || e)); }
+
+  var coseKey = new Map();
+  if (jwk.kty === "OKP") {
+    if (jwk.crv !== "Ed25519") {
+      throw new CoseError("cose/unsupported-key", "cose.exportKey: only OKP curve Ed25519 is supported (got " + jwk.crv + ")");
+    }
+    coseKey.set(COSE_KEY_LABEL_KTY, COSE_KTY_OKP);
+    coseKey.set(-1, COSE_OKP_ED25519);
+    coseKey.set(-2, Buffer.from(jwk.x, "base64url"));
+  } else if (jwk.kty === "EC") {
+    var crvId = COSE_EC2_CRV_ID[jwk.crv];
+    if (!crvId) {
+      throw new CoseError("cose/unsupported-key", "cose.exportKey: unsupported EC curve " + jwk.crv + " (only P-256 / P-384 / P-521)");
+    }
+    coseKey.set(COSE_KEY_LABEL_KTY, COSE_KTY_EC2);
+    coseKey.set(-1, crvId);
+    coseKey.set(-2, Buffer.from(jwk.x, "base64url"));
+    coseKey.set(-3, Buffer.from(jwk.y, "base64url"));
+  } else {
+    throw new CoseError("cose/unsupported-key", "cose.exportKey: kty must be OKP or EC (got " + jwk.kty + ")");
+  }
+
+  if (opts.kid !== undefined) {
+    var kid = Buffer.isBuffer(opts.kid) ? opts.kid
+      : (typeof opts.kid === "string" ? Buffer.from(opts.kid, "utf8") : null);
+    if (!kid) throw new CoseError("cose/bad-kid", "cose.exportKey: opts.kid must be a Buffer or string");
+    coseKey.set(COSE_KEY_LABEL_KID, kid);
+  }
+  if (opts.alg !== undefined) {
+    var algId = ALG_NAME_TO_ID[opts.alg];
+    if (algId === undefined) {
+      throw new CoseError("cose/unknown-alg", "cose.exportKey: opts.alg '" + opts.alg + "' not recognized");
+    }
+    coseKey.set(COSE_KEY_LABEL_ALG, algId);
+  }
+  return cbor.encode(coseKey);
+}
+
 module.exports = {
   sign:        sign,
   verify:      verify,
@@ -812,6 +895,7 @@ module.exports = {
   mac0:        mac0,
   macVerify0:  macVerify0,
   importKey:   importKey,
+  exportKey:   exportKey,
   ALGORITHMS:  ALG_NAME_TO_ID,
   MAC_ALGORITHMS: HMAC_NAME_TO_ID,
   COSE_MAC0_TAG: COSE_MAC0_TAG,

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.13.19",
+  "version": "0.13.22",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.13.20.json

@@ -0,0 +1,22 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.20",
+  "date": "2026-05-27",
+  "headline": "`b.archive.wrap` can seal an archive for a tenant with no key-pair to manage — `recipient: \"tenant\"`",
+  "summary": "b.archive.wrap previously sealed only to an explicit hybrid-PQC key-pair or a peer certificate; the documented recipient: \"tenant\" strategy threw. It now works: pass { recipient: \"tenant\", tenantId } and the archive is sealed under a deterministic per-tenant key derived from the vault root (SHAKE256 KDF) with XChaCha20-Poly1305, the tenant id mixed into the AEAD additional-authenticated-data so one tenant's envelope cannot be opened under another tenant's key. There is no recipient key-pair for the operator to generate, store, or rotate — b.archive.unwrap re-derives the key from the same tenantId. Rotating the vault re-keys every tenant (rotation intent is re-seal). The derivation is exposed directly as b.agent.tenant.derivedKey(tenantId, purpose) for operators who need the raw per-tenant key for their own AEAD. Requires an initialized vault.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.archive.wrap` / `b.archive.unwrap` `recipient: \"tenant\"` — per-tenant archive sealing, no key-pair",
+          "body": "`b.archive.wrap(bytes, { recipient: \"tenant\", tenantId })` seals under a deterministic per-tenant key derived from the vault root with XChaCha20-Poly1305 (draft-irtf-cfrg-xchacha-03) and a SHAKE256 KDF (FIPS 202); the tenant id is bound into the AEAD AAD so a tenant-A envelope cannot decrypt under tenant-B's key even if an attacker swaps envelope headers. `b.archive.unwrap(sealed, { recipient: \"tenant\", tenantId })` (or just `{ tenantId }`) re-derives the key and recovers the bytes — no recipient key-pair to manage. The tenant envelope carries a distinct version byte so it is never fed to the hybrid-KEM decrypt path. The static-key and peer-cert recipient strategies are unchanged."
+        },
+        {
+          "title": "`b.agent.tenant.derivedKey(tenantId, purpose)` — direct per-tenant key derivation",
+          "body": "The deterministic, domain-separated per-tenant key derivation (vault root + tenantId + purpose, SHAKE256, NUL-separated) is now exported at the module level, returning a 64-char hex key. Previously reachable only as a method on a created tenant manager; operators who need the raw key for their own AEAD can now call it directly. Throws if the vault is not initialized."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.21.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.21",
+  "date": "2026-05-27",
+  "headline": "`b.cose.exportKey` — serialize a public key as a COSE_Key, the inverse of `b.cose.importKey`",
+  "summary": "b.cose could import a COSE_Key (RFC 9052 §7) into a node:crypto key for verification, but had no way to produce one — so a key used with b.cose.sign could not be shipped to a verifier in COSE form without hand-building the CBOR map. b.cose.exportKey(keyObject, opts?) closes the round-trip: it serializes an EC2 (P-256 / P-384 / P-521) or OKP (Ed25519) public key as the CBOR-encoded COSE_Key map, with optional alg and kid common parameters. A private key has its public half exported; unsupported curves / key types are refused rather than emitting a COSE_Key no verifier here would accept. The bytes round-trip through b.cose.importKey, and feed the mdoc MSO / COSE_Key header / SCITT / C2PA verification-key paths.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.cose.exportKey(keyObject, { alg?, kid? })` — KeyObject → COSE_Key (RFC 9052 §7)",
+          "body": "Serialize a `node:crypto` public key as the CBOR-encoded COSE_Key map — the inverse of `b.cose.importKey`. Supports EC2 (P-256 / P-384 / P-521) and OKP (Ed25519), the same key types `b.cose.verify` accepts; `opts.alg` (e.g. `\"ES256\"`) and `opts.kid` populate the COSE_Key alg (label 3) and kid (label 2) common parameters. A private key exports its public half; unsupported curves / key types throw rather than producing a COSE_Key no verifier would accept. `b.cose.importKey(b.cbor.decode(exportKey(k)))` round-trips, so a key signed with `b.cose.sign` can be shipped to a verifier as bytes — the mdoc MSO / COSE_Key header / SCITT / C2PA verification-key paths."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.22.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.22",
+  "date": "2026-05-27",
+  "headline": "`b.archive.read.zip.fromTrustedStream` reads a ZIP from a Readable — no longer an experimental stub",
+  "summary": "fromTrustedStream was an experimental stub whose inspect / entries / extract methods threw, forcing callers to buffer the stream themselves and use the random-access reader. It now works, with the same shape as the tar trusted-stream reader: pass b.archive.adapters.trustedStream(readable) and the bytes are collected into a size-capped buffer (1 GiB hard ceiling) and read through the same bomb-cap, path-traversal, and entry-type decode as the random-access reader — so bombPolicy, guardProfile, entryTypePolicy, and audit all apply, and inspect / entries / extract / extractEntries all return data. This is a bounded-memory reader (the archive is held in memory under the ceiling), not zero-buffer streaming; a future forward-inflate walker shared with the tar reader would lift the ceiling.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.archive.read.zip.fromTrustedStream` now reads — `inspect` / `entries` / `extract` / `extractEntries`",
+          "body": "The ZIP trusted-stream reader is implemented (was an experimental stub that threw). Pass `b.archive.adapters.trustedStream(readable)` to read a ZIP straight from a Node Readable without buffering it yourself. The stream is collected into a size-capped buffer (1 GiB ceiling, matching `b.archive.read.tar`'s trusted-stream reader) and decoded through the same adversarial-safe path as the random-access reader, so `bombPolicy` / `guardProfile` / `entryTypePolicy` / `audit` are honored on decode. Adversarial archives remain fully bomb-capped; \"trusted\" refers only to the source-size bound. A non-trusted-stream adapter is refused with `archive-read/bad-adapter`."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/archive-read.test.js

@@ -222,6 +222,51 @@ async function testSafeArchiveRefusesTrustedStreamSource() {
   }
 }
 
+async function testFromTrustedStreamRoundTrip() {
+  var nodeStream = require("node:stream");
+  var z = b.archive.zip();
+  z.addFile("readme.txt", "trusted stream readme\n");
+  z.addFile("data/n.csv", "a,b\n1,2\n");
+  var bytes = z.toBuffer();
+
+  // inspect over a Readable via the trusted-stream adapter (no manual
+  // buffering by the caller — the reader collects + decodes).
+  var reader = b.archive.read.zip.fromTrustedStream(
+    b.archive.adapters.trustedStream(nodeStream.Readable.from(bytes)));
+  check("fromTrustedStream: kind tag", reader.kind === "zip-trusted-sequential");
+  var entries = await reader.inspect();
+  check("fromTrustedStream: inspect sees both entries", entries.length === 2);
+  check("fromTrustedStream: entry name round-trips",
+    entries.some(function (e) { return e.name === "readme.txt"; }));
+
+  // extractEntries over a fresh stream recovers the bytes.
+  var reader2 = b.archive.read.zip.fromTrustedStream(
+    b.archive.adapters.trustedStream(nodeStream.Readable.from(bytes)));
+  var got = {};
+  for await (var ent of reader2.extractEntries()) {
+    got[ent.name] = Buffer.isBuffer(ent.bytes) ? ent.bytes.toString("utf8") : null;
+  }
+  check("fromTrustedStream: extractEntries recovers content",
+    got["readme.txt"] === "trusted stream readme\n" && got["data/n.csv"] === "a,b\n1,2\n");
+
+  // bombPolicy is honored through the delegated decode — a tiny
+  // per-entry cap refuses the archive.
+  var reader3 = b.archive.read.zip.fromTrustedStream(
+    b.archive.adapters.trustedStream(nodeStream.Readable.from(bytes)),
+    { bombPolicy: { maxEntryDecompressedBytes: 4 } });
+  var bombErr = null;
+  try { await reader3.inspect(); for await (var _e of reader3.extractEntries()) { void _e; } }
+  catch (e) { bombErr = e; }
+  check("fromTrustedStream: bombPolicy applies on decode", bombErr !== null);
+
+  // bad adapter (random-access) refused.
+  var badErr = null;
+  try { b.archive.read.zip.fromTrustedStream(b.archive.adapters.buffer(bytes)); }
+  catch (e) { badErr = e; }
+  check("fromTrustedStream: non-trusted-stream adapter refused",
+    badErr && /bad-adapter/.test(badErr.code || badErr.message));
+}
+
 async function testGuardArchiveInspect() {
   var z = b.archive.zip();
   z.addFile("safe.txt", "safe");
@@ -359,6 +404,7 @@ async function run() {
   testVerifyExtractionPathWindowsHazards();
   await testExtractRefusesOverwrite();
   await testSafeArchiveRefusesTrustedStreamSource();
+  await testFromTrustedStreamRoundTrip();
   await testGuardArchiveInspect();
   await testBundleAdapterStorageRoundTrip();
 }

package/lib/vendor/blamejs/test/layer-0-primitives/archive-wrap.test.js

@@ -82,13 +82,56 @@ async function testWrapRequiresRecipient() {
     refused && /no-recipient/.test(refused.code || refused.message));
 }
 
-async function testTenantStrategyDeferred() {
-  var refused = null;
+async function testTenantStrategyRoundTrip() {
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-aw-tenant-"));
   try {
-    b.archive.wrap(Buffer.from("bytes"), { recipient: "tenant", tenantId: "alpha" });
-  } catch (e) { refused = e; }
-  check("archive.wrap: tenant strategy deferred to v0.12.11 with explicit message",
-    refused && /tenant-strategy-deferred/.test(refused.code || refused.message));
+    await helpers.setupVaultOnly(tmpDir);
+    var src = Buffer.from("per-tenant sealed archive bytes ".repeat(40));
+
+    // wrap → unwrap round-trips for the same tenant, no key-pair managed.
+    var sealed = b.archive.wrap(src, { recipient: "tenant", tenantId: "alpha" });
+    check("archive.wrap tenant: BAWRP magic",
+      sealed.slice(0, 5).toString("ascii") === "BAWRP");
+    check("archive.wrap tenant: version byte is 0x02 (tenant)",
+      sealed[5] === 0x02);
+    var recovered = b.archive.unwrap(sealed, { recipient: "tenant", tenantId: "alpha" });
+    check("archive.wrap tenant: round-trips losslessly", recovered.equals(src));
+    // recipient may be omitted on unwrap (version byte selects the path).
+    var recovered2 = b.archive.unwrap(sealed, { tenantId: "alpha" });
+    check("archive.wrap tenant: unwrap works with tenantId alone", recovered2.equals(src));
+
+    // Cross-tenant isolation — a different tenant's derived key (and AAD)
+    // cannot open tenant alpha's envelope.
+    var crossErr = null;
+    try { b.archive.unwrap(sealed, { recipient: "tenant", tenantId: "beta" }); }
+    catch (e) { crossErr = e; }
+    check("archive.wrap tenant: another tenant cannot decrypt",
+      crossErr && /decrypt-failed/.test(crossErr.code || crossErr.message));
+
+    // Missing tenantId on wrap throws a clear config error.
+    var noIdErr = null;
+    try { b.archive.wrap(src, { recipient: "tenant" }); }
+    catch (e) { noIdErr = e; }
+    check("archive.wrap tenant: missing tenantId throws no-tenant-id",
+      noIdErr && /no-tenant-id/.test(noIdErr.code || noIdErr.message));
+
+    // Passing a key-pair recipient to a tenant envelope is refused.
+    var mismatchErr = null;
+    try { b.archive.unwrap(sealed, { recipient: { privateKey: "x", ecPrivateKey: "y" } }); }
+    catch (e) { mismatchErr = e; }
+    check("archive.wrap tenant: key-pair recipient on tenant envelope refused",
+      mismatchErr && /recipient-mismatch/.test(mismatchErr.code || mismatchErr.message));
+
+    // Determinism — re-wrapping the same bytes for the same tenant yields
+    // a DIFFERENT envelope (fresh nonce) that still opens to the same plaintext.
+    var sealed2 = b.archive.wrap(src, { recipient: "tenant", tenantId: "alpha" });
+    check("archive.wrap tenant: fresh nonce per wrap (envelopes differ)",
+      !sealed2.equals(sealed));
+    check("archive.wrap tenant: second envelope also round-trips",
+      b.archive.unwrap(sealed2, { tenantId: "alpha" }).equals(src));
+  } finally {
+    helpers.teardownVaultOnly(tmpDir);
+  }
 }
 
 async function testBackupRecipientRoundTrip() {
@@ -159,7 +202,7 @@ async function run() {
   await testWrapRefusesWrongKey();
   await testWrapRefusesPartialStaticRecipient();
   await testWrapRequiresRecipient();
-  await testTenantStrategyDeferred();
+  await testTenantStrategyRoundTrip();
   await testBackupRecipientRoundTrip();
   await testBackupRecipientStrategyRequiresKeys();
   await testBackupRecipientDirectoryRefused();

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -2387,6 +2387,16 @@ async function testNoDuplicateCodeBlocks() {
       ],
       reason: "v0.12.48 / v0.12.51 / v0.12.52 / v0.12.53 / v0.13.x — Buffer-coercion guard (`if (Buffer.isBuffer(x)) return x; if (x instanceof Uint8Array) return Buffer.from(x); ...`) repeats across byte-string-consuming primitives. The throw-on-unknown variants (cose / mdoc / dnssec / dane / tsa) each raise a MODULE-LOCAL typed error code naming the local argument; the JSON-fallback variants (eat._toBuf serializing a CBOR/EAT claims payload, worm._toBytes serializing a record to hash) instead JSON.stringify a non-bytes value. The duplicated prefix is the symptom; the cause is that JS can't throw a caller-namespaced ErrorClass (or choose the domain's serialization) without the local closure. Same documented exception as the v0.12.7 require-non-empty-string cluster — the per-domain error code / serialization is the divergence the dup detector can't see.",
     },
+    {
+      mode:  "family-subset",
+      files: [
+        "lib/cose.js:importKey",
+        "lib/cose.js:exportKey",
+        "lib/did.js:_jwkToKey",
+        "lib/network-dnssec.js:_jwkKey",
+      ],
+      reason: "v0.13.20 — EC/OKP JWK-coordinate handling (`kty` + `crv` switch over P-256/P-384/P-521 + Ed25519, base64url x/y, `createPublicKey({ format: 'jwk' })`) is coincidentally similar across three unrelated wire formats: cose.importKey/exportKey map a COSE_Key (RFC 9052 §7 — INTEGER crv ids -1/-2/-3 and labels) to/from a KeyObject; did._jwkToKey resolves a W3C DID verification method's JWK; network-dnssec._jwkKey reconstructs a DNSKEY's public key. The curve identifiers, the surrounding map shape, and the direction (import builds a key from a map, export emits a map from a key) all differ per spec — extracting a shared helper would couple three independent standards on a syntactic accident. The shingle is the JWK-coordinate idiom, not behaviour; same documented exception as the v0.12.40 signature-verify-preamble cluster.",
+    },
     {
       mode:  "family-subset",
       files: [

package/lib/vendor/blamejs/test/layer-0-primitives/cose.test.js

@@ -247,6 +247,47 @@ async function testImportKey() {
   check("importKey: secp256k1 refused (no ES256K binding)", secpBad && secpBad.code === "cose/unsupported-key");
 }
 
+async function testExportKey() {
+  // EC2 P-256 → COSE_Key bytes → decode → importKey round-trips, and
+  // the re-imported key verifies a COSE_Sign1 the original signed.
+  var bytes = b.cose.exportKey(EC.publicKey, { alg: "ES256", kid: "key-1" });
+  check("exportKey: returns CBOR bytes", Buffer.isBuffer(bytes));
+  var map = b.cbor.decode(bytes);
+  check("exportKey: kty=EC2 (2)", map.get(1) === 2);
+  check("exportKey: crv=P-256 (1)", map.get(-1) === 1);
+  check("exportKey: x matches the JWK", map.get(-2).toString("base64url") === EC.publicKey.export({ format: "jwk" }).x);
+  check("exportKey: alg label 3 = ES256 (-7)", map.get(3) === -7);
+  check("exportKey: kid label 2 = 'key-1'", Buffer.isBuffer(map.get(2)) && map.get(2).toString("utf8") === "key-1");
+  var reimported = b.cose.importKey(map);
+  var att = await b.cose.sign(Buffer.from("rt"), { alg: "ES256", privateKey: EC.privateKey });
+  check("exportKey → importKey: round-trips for verification",
+    (await b.cose.verify(att, { algorithms: ["ES256"], publicKey: reimported })).payload.toString() === "rt");
+
+  // OKP Ed25519 round-trip.
+  var edBytes = b.cose.exportKey(ED.publicKey);
+  var edMap = b.cbor.decode(edBytes);
+  check("exportKey: OKP kty=1 + crv Ed25519 (6)", edMap.get(1) === 1 && edMap.get(-1) === 6);
+  check("exportKey: OKP re-imports to ed25519",
+    b.cose.importKey(edMap).asymmetricKeyType === "ed25519");
+
+  // A private key exports its PUBLIC half (never the secret).
+  var fromPriv = b.cbor.decode(b.cose.exportKey(EC.privateKey));
+  check("exportKey: private key exports the public coordinates",
+    fromPriv.get(-2).toString("base64url") === EC.publicKey.export({ format: "jwk" }).x);
+
+  // Unsupported curve / key type / bad opts refused.
+  var k1 = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "secp256k1" });
+  var secpBad = null;
+  try { b.cose.exportKey(k1.publicKey); } catch (e) { secpBad = e; }
+  check("exportKey: secp256k1 refused", secpBad && secpBad.code === "cose/unsupported-key");
+  var notKey = null;
+  try { b.cose.exportKey({ not: "a key" }); } catch (e) { notKey = e; }
+  check("exportKey: non-KeyObject refused", notKey && notKey.code === "cose/bad-key");
+  var badAlg = null;
+  try { b.cose.exportKey(EC.publicKey, { alg: "NOPE" }); } catch (e) { badAlg = e; }
+  check("exportKey: unknown alg refused", badAlg && badAlg.code === "cose/unknown-alg");
+}
+
 async function run() {
   testSurface();
   testEncrypt0();
@@ -258,6 +299,7 @@ async function run() {
   await testValidation();
   await testDetachedPayload();
   await testImportKey();
+  await testExportKey();
   testMac0();
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {