@blamejs/blamejs-shop 0.2.9 → 0.2.11

package/lib/vendor/blamejs/lib/agent-tenant.js

@@ -386,6 +386,35 @@ function _deriveTenantKeyBytes(tenantId, purpose) {
   return bCrypto.kdf(input, TENANT_KEY_BYTES);
 }
 
+/**
+ * @primitive b.agent.tenant.derivedKey
+ * @signature b.agent.tenant.derivedKey(tenantId, purpose)
+ * @since     0.9.25
+ * @status    stable
+ * @compliance hipaa, pci-dss, gdpr, soc2
+ * @related   b.agent.tenant.create, b.archive.wrap, b.vault
+ *
+ * Derive a deterministic, domain-separated 32-byte key for a tenant
+ * and a named purpose, returned as a 64-char hex string. The key is a
+ * SHAKE256 KDF over the vault root (the master keypair PEM hashed),
+ * the `tenantId`, and the `purpose`, with NUL separators so distinct
+ * `(tenantId, purpose)` pairs cannot collide. The same inputs always
+ * produce the same key, so a value sealed under
+ * `derivedKey(t, "archive-wrap")` is recoverable later from the same
+ * tenant + purpose with no key escrow. Rotating the vault
+ * (`b.vaultRotate.rotate`) changes the root and therefore every
+ * derived key — by design, rotation intent is re-seal.
+ *
+ * Throws if the vault has not been initialized (keys cannot be derived
+ * before bootstrap) or if `purpose` is empty. This is the same
+ * derivation the per-tenant `sealField` / archive `recipient: "tenant"`
+ * paths use internally; call it directly when you need the raw key for
+ * your own AEAD.
+ *
+ * @example
+ *   var key = b.agent.tenant.derivedKey("acme-corp", "archive-wrap");
+ *   // → "9f3c…" (64 hex chars; deterministic per tenant + purpose)
+ */
 function _derivedKey(tenantId, purpose) {
   // Public API — returns hex so the existing wire shape (operators
   // storing the derived key string in their DB) is unchanged. Internal
@@ -624,6 +653,7 @@ function _inMemoryBackend() {
 
 module.exports = {
   create:                    create,
+  derivedKey:                _derivedKey,
   CROSS_TENANT_ADMIN_SCOPE:  CROSS_TENANT_ADMIN_SCOPE,
   AgentTenantError:          AgentTenantError,
   guards: {

package/lib/vendor/blamejs/lib/archive-read.js

@@ -51,6 +51,8 @@ var ArchiveReadError = defineClass("ArchiveReadError", { alwaysPermanent: true }
 var guardFilename = lazyRequire(function () { return require("./guard-filename"); });
 var guardArchive  = lazyRequire(function () { return require("./guard-archive"); });
 var safeDecompress = lazyRequire(function () { return require("./safe-decompress"); });
+var safeBuffer     = lazyRequire(function () { return require("./safe-buffer"); });
+var archiveAdapters = lazyRequire(function () { return require("./archive-adapters"); });
 
 // ---- Wire-format constants ------------------------------------------------
 // Aligned with the write-side `lib/archive.js`. APPNOTE.TXT § references
@@ -775,29 +777,31 @@ function zip(adapter, opts) {
  * @status    experimental
  * @related   b.archive.read.zip, b.archive.adapters.trustedStream
  *
- * Forward-scan-only ZIP reader for trusted Readable sources. No
- * central-directory comparison — operators reaching for this primitive
- * are declaring they own the producer (e.g. piping their own
- * `b.archive.zip().toStream()` output back into a reader for round-trip
- * verification).
+ * ZIP reader for a Readable source — pass `b.archive.adapters.trustedStream(readable)`
+ * instead of buffering the stream yourself. The bytes are collected
+ * into a size-capped buffer (1 GiB hard ceiling, like the tar
+ * trusted-stream reader) and then read through the same bomb-cap /
+ * path-traversal / entry-policy decode as the random-access reader, so
+ * `bombPolicy`, `guardProfile`, `entryTypePolicy`, and `audit` all
+ * apply. "Trusted" means the source size is bounded by the operator —
+ * the collection ceiling is the only guard against an unbounded
+ * producer; adversarial archives are still fully bomb-capped on decode.
  *
- * NOT YET IMPLEMENTED: the streaming LFH walker is not built —
- * `inspect()` / `entries()` / `extract()` throw
- * `archive-read/trusted-stream-*-deferred`, and `bombPolicy` / `audit`
- * are accepted but not yet honored. Re-opens when a streaming
- * consumer needs it. Until then, collect the stream into a buffer and
- * use the random-access reader, which is the supported path for both
- * trusted round-trip verification and adversarial input.
+ * The collection ceiling means this is not zero-buffer streaming (the
+ * whole archive is held in memory, capped); a future bounded-memory
+ * forward-inflate walker would lift that, shared with the tar reader.
  *
  * @opts
- *   bombPolicy:       { ... },   // reserved — not yet honored
- *   audit:            b.audit,   // reserved — not yet honored
+ *   bombPolicy:       { maxEntries, maxEntryDecompressedBytes,
+ *                       maxTotalDecompressedBytes, maxExpansionRatio },
+ *   entryTypePolicy:  { ... },
+ *   guardProfile:     "strict" | "balanced" | "permissive",
+ *   audit:            b.audit,
  *
  * @example
- *   // Supported path: buffer the stream, then read random-access.
- *   var bytes  = await someStreamToBuffer(producedZipStream);
- *   var reader = b.archive.read.zip(b.archive.adapters.buffer(bytes));
+ *   var reader  = b.archive.read.zip.fromTrustedStream(b.archive.adapters.trustedStream(readable));
  *   var entries = await reader.inspect();
+ *   void entries;
  */
 function fromTrustedStream(adapter, opts) {
   if (!adapter || adapter.kind !== "trusted-sequential") {
@@ -805,36 +809,45 @@ function fromTrustedStream(adapter, opts) {
       "fromTrustedStream: adapter must come from b.archive.adapters.trustedStream(readable)");
   }
   opts = opts || {};
-  var bombPolicy = _normalizeBombPolicy(opts.bombPolicy);
-  void bombPolicy;
-
-  // The streaming LFH walker is not built — only the API surface +
-  // adapter validation exist. Extraction via streaming inflate +
-  // data-descriptor scanning re-opens when a streaming consumer needs
-  // it; until then the supported path is to buffer the stream and use
-  // the random-access reader (which handles both trusted round-trip
-  // verification and adversarial input).
-  async function inspect() {
-    throw new ArchiveReadError("archive-read/trusted-stream-inspect-deferred",
-      "fromTrustedStream.inspect() is not implemented — collect the stream into a buffer and " +
-      "use b.archive.read.zip(b.archive.adapters.buffer(bytes))");
+
+  // Collect the Readable into a size-capped buffer once (tar-parity:
+  // boundedChunkCollector with a 1 GiB ceiling), then delegate to the
+  // random-access reader so the full bomb-cap / guard / audit decode
+  // applies. Lazy + memoized — construction stays cheap and the stream
+  // is consumed only on the first method call.
+  var readerPromise = null;
+  function _reader() {
+    if (!readerPromise) {
+      readerPromise = (async function () {
+        var collector = safeBuffer().boundedChunkCollector({
+          maxBytes:   C.BYTES.gib(1),
+          errorClass: ArchiveReadError,
+          sizeCode:   "archive-read/trusted-stream-too-large",
+        });
+        for await (var chunk of adapter.readable) { collector.push(chunk); }
+        return zip(archiveAdapters().buffer(collector.result()), opts);
+      })();
+    }
+    return readerPromise;
   }
 
+  async function inspect() { return (await _reader()).inspect(); }
   async function* entries() {
-    throw new ArchiveReadError("archive-read/trusted-stream-entries-deferred",
-      "fromTrustedStream.entries() is not implemented — collect into a buffer and use the random-access reader");
+    var r = await _reader();
+    for await (var e of r.entries()) { yield e; }
   }
-
-  async function extract() {
-    throw new ArchiveReadError("archive-read/trusted-stream-extract-deferred",
-      "fromTrustedStream.extract() is not implemented — collect into a buffer and use the random-access reader");
+  async function extract(extractOpts) { return (await _reader()).extract(extractOpts); }
+  async function* extractEntries(extractOpts) {
+    var r = await _reader();
+    for await (var e of r.extractEntries(extractOpts)) { yield e; }
   }
 
   return {
-    kind:    "zip-trusted-sequential",
-    inspect: inspect,
-    entries: entries,
-    extract: extract,
+    kind:           "zip-trusted-sequential",
+    inspect:        inspect,
+    entries:        entries,
+    extract:        extract,
+    extractEntries: extractEntries,
   };
 }
 

package/lib/vendor/blamejs/lib/archive-wrap.js

@@ -15,10 +15,11 @@
  *   var bytes  = b.archive.unwrap(sealed, { recipient: privKeys });
  *   var reader = b.archive.read.tar(b.archive.adapters.buffer(bytes));
  *
- * Builder-fluent composition (`tarBuilder.toAdapter(s3, { wrap: ... })`)
- * + per-entry ZIP wrap (Flavor 2) land in v0.12.11 alongside the
- * backup-crypto refactor; this patch ships the recipient substrate
- * + the b.backup `cryptoStrategy: "recipient"` opt that consumes it.
+ * Three recipient strategies: a static hybrid-PQC key-pair, a peer
+ * certificate, and `"tenant"` — a deterministic per-tenant symmetric
+ * seal keyed by the vault root (no key-pair to manage; unwrap
+ * re-derives from the tenant id). b.backup's `cryptoStrategy:
+ * "recipient"` consumes the same substrate.
  */
 
 var C = require("./constants");
@@ -29,13 +30,23 @@ var ArchiveWrapError = defineClass("ArchiveWrapError", { alwaysPermanent: true }
 
 var bCrypto = lazyRequire(function () { return require("./crypto"); });
 var backupCrypto = lazyRequire(function () { return require("./backup/crypto"); });
+var agentTenant = lazyRequire(function () { return require("./agent-tenant"); });
 
 // Envelope magic — 5-byte ASCII prefix the safe-archive sniffer
 // recognises. Distinct from b.crypto.encrypt's base64 envelope so
 // archive-wrap output can carry an unambiguous "this is an archive
 // wrap envelope" magic before the operator-controlled payload.
 var ARCH_WRAP_MAGIC = "BAWRP";                                                       // allow:raw-byte-literal — 5-byte ASCII archive-wrap recipient envelope magic
-var ARCH_WRAP_VERSION = 0x01;                                                        // allow:raw-byte-literal — recipient version byte
+var ARCH_WRAP_VERSION = 0x01;                                                        // allow:raw-byte-literal — recipient version byte (hybrid-KEM envelope)
+// Tenant strategy uses the same BAWRP magic with a distinct version
+// byte: the body is a symmetric XChaCha20-Poly1305 packed ciphertext
+// (b.crypto.encryptPacked) keyed by the tenant's vault-derived key,
+// not a hybrid-KEM envelope. unwrap dispatches on the version byte so
+// a tenant envelope is never fed to the KEM decrypt path.
+var ARCH_WRAP_VERSION_TENANT = 0x02;                                                 // allow:raw-byte-literal — tenant symmetric-seal version byte
+// Purpose label for the per-tenant key derivation (domain-separates
+// the archive-wrap key from a tenant's seal / audit / session keys).
+var TENANT_KEY_PURPOSE = "archive-wrap";
 var ARCH_WRAP_HEADER_BYTES = C.BYTES.bytes(6);                                        // magic(5) + version(1)
 // Passphrase variant — wire format: magic(5) + version(1) + saltLen(1)
 // + salt(saltLen bytes) + encrypted bytes (24-byte nonce + ciphertext+tag
@@ -66,10 +77,14 @@ var ARCH_PASSPHRASE_HEADER_BYTES = C.BYTES.bytes(7);
  *   - peer cert   — `{ recipient: { peerCertDer, peerKemPubkey } }` composes
  *                   `b.crypto.encryptEnvelopeAsCertPeer` (extracts the
  *                   P-384 half from the cert).
- *   - tenant      — `{ recipient: "tenant", tenantId: "alpha" }` resolves
- *                   the tenant's KEM keypair via `b.vault.derivedKey`
- *                   (deferred to v0.12.11 alongside the backup
- *                   `cryptoStrategy: "recipient"` adoption).
+ *   - tenant      — `{ recipient: "tenant", tenantId: "alpha" }` seals
+ *                   under a deterministic per-tenant key derived from the
+ *                   vault root (`b.agent.tenant.derivedKey`) with
+ *                   XChaCha20-Poly1305, the tenant id mixed into the AEAD
+ *                   AAD so one tenant's envelope cannot open under
+ *                   another's key. No recipient key-pair to manage;
+ *                   `unwrap` re-derives from the same `tenantId`. Requires
+ *                   an initialized vault.
  *
  * @opts
  *   recipient:  object | string,   // see strategies above; required
@@ -96,15 +111,16 @@ function wrap(bytes, opts) {
     throw new ArchiveWrapError("archive-wrap/no-recipient",
       "wrap: opts.recipient is required (static key object | \"tenant\" string | peer-cert object)");
   }
-  var envelope = _encryptForRecipient(bytes, opts);
-  // envelope is a base64 string from b.crypto.encrypt. Buffer it and
-  // prepend the 6-byte archive-wrap header so safeArchive's sniffer
-  // can identify it without attempting decryption.
-  var envelopeBuf = Buffer.from(envelope, "utf-8");
+  var enc = _encryptForRecipient(bytes, opts);
+  // enc.body is the envelope bytes (base64 KEM envelope for static /
+  // peer-cert recipients, symmetric packed ciphertext for tenant).
+  // Prepend the 6-byte archive-wrap header stamped with the strategy's
+  // version byte so safeArchive's sniffer + unwrap can identify the
+  // envelope (and pick the right decrypt path) without trial decryption.
   var header = Buffer.alloc(ARCH_WRAP_HEADER_BYTES);
   header.write(ARCH_WRAP_MAGIC, 0, 5, "ascii");
-  header[5] = ARCH_WRAP_VERSION;
-  return Buffer.concat([header, envelopeBuf]);
+  header[5] = enc.version;
+  return Buffer.concat([header, enc.body]);
 }
 
 /**
@@ -121,11 +137,14 @@ function wrap(bytes, opts) {
  * than a crypto-level error.
  *
  * @opts
- *   recipient:  object,   // { privateKey, ecPrivateKey } | { certPrivateKey, kemSecret }; required
+ *   recipient:  object | "tenant",  // { privateKey, ecPrivateKey } | { certPrivateKey, kemSecret } | "tenant"
+ *   tenantId:   string,             // required when the envelope was sealed with recipient: "tenant"
  *
  * @example
  *   var bytes  = b.archive.unwrap(sealed, { recipient: privPair });
  *   var reader = b.archive.read.tar(b.archive.adapters.buffer(bytes));
+ *   // tenant envelope:
+ *   var t = b.archive.unwrap(sealedForTenant, { recipient: "tenant", tenantId: "alpha" });
  */
 function unwrap(sealed, opts) {
   opts = opts || {};
@@ -145,6 +164,27 @@ function unwrap(sealed, opts) {
       JSON.stringify(ARCH_WRAP_MAGIC) + "; got " + JSON.stringify(magic));
   }
   var version = buf[5];
+  // Tenant strategy: symmetric packed ciphertext keyed by the
+  // vault-derived per-tenant key. Re-derive from opts.tenantId and
+  // decrypt under the same tenant-bound AAD that wrap sealed with.
+  if (version === ARCH_WRAP_VERSION_TENANT) {
+    if (opts.recipient !== undefined && opts.recipient !== "tenant") {
+      throw new ArchiveWrapError("archive-wrap/recipient-mismatch",
+        "unwrap: this envelope was sealed with recipient: \"tenant\" — pass opts.tenantId " +
+        "(and either omit opts.recipient or set it to \"tenant\"), not a key-pair recipient");
+    }
+    var tenantKey = _tenantKey(opts.tenantId);
+    var packedBody = buf.slice(ARCH_WRAP_HEADER_BYTES);
+    try {
+      return bCrypto().decryptPacked(packedBody, tenantKey, _tenantAad(opts.tenantId));
+    } catch (e) {
+      var terr = new ArchiveWrapError("archive-wrap/decrypt-failed",
+        "unwrap: tenant envelope decryption refused (wrong tenantId or rotated vault?): " +
+        ((e && e.message) || String(e)));
+      terr.cause = e;
+      throw terr;
+    }
+  }
   if (version !== ARCH_WRAP_VERSION) {
     throw new ArchiveWrapError("archive-wrap/bad-version",
       "unwrap: archive-wrap version " + version + " not supported by this build");
@@ -152,7 +192,8 @@ function unwrap(sealed, opts) {
   if (!opts.recipient || typeof opts.recipient !== "object") {
     throw new ArchiveWrapError("archive-wrap/no-recipient",
       "unwrap: opts.recipient is required ({ privateKey, ecPrivateKey } " +
-      "for the static-key path, { certPrivateKey, kemSecret } for the peer-cert path)");
+      "for the static-key path, { certPrivateKey, kemSecret } for the peer-cert path, " +
+      "or \"tenant\" + opts.tenantId for the tenant path)");
   }
   var envelope = buf.slice(ARCH_WRAP_HEADER_BYTES).toString("utf-8");
   var plaintext;
@@ -183,28 +224,52 @@ function unwrap(sealed, opts) {
   return Buffer.isBuffer(plaintext) ? plaintext : Buffer.from(plaintext);
 }
 
+// Resolve a tenant's deterministic 32-byte archive-wrap key from the
+// vault root. Throws a clear archive-wrap error (rather than a deep
+// agent-tenant one) when tenantId is missing; the vault-not-initialized
+// case surfaces from agentTenant.derivedKey unchanged.
+function _tenantKey(tenantId) {
+  if (typeof tenantId !== "string" || tenantId.length === 0) {
+    throw new ArchiveWrapError("archive-wrap/no-tenant-id",
+      "recipient: \"tenant\" requires opts.tenantId (a non-empty string)");
+  }
+  return Buffer.from(agentTenant().derivedKey(tenantId, TENANT_KEY_PURPOSE), "hex");
+}
+
+// AAD context-binds the symmetric envelope to the tenant: the Poly1305
+// tag covers this, so a tenant-A envelope cannot be decrypted under
+// tenant-B's key even if an attacker swaps headers between envelopes.
+function _tenantAad(tenantId) {
+  return Buffer.from("archive-wrap|tenant|" + tenantId, "utf8");
+}
+
+// Returns { version, body } so wrap() can stamp the right version byte:
+// hybrid-KEM recipients use ARCH_WRAP_VERSION with a base64 envelope
+// body; the tenant strategy uses ARCH_WRAP_VERSION_TENANT with a
+// symmetric packed-ciphertext body.
 function _encryptForRecipient(bytes, opts) {
   var r = opts.recipient;
   if (typeof r === "string") {
     if (r === "tenant") {
-      // tenant strategy lands in v0.12.11 alongside the backup
-      // cryptoStrategy adoption — refuse cleanly for v0.12.10 so
-      // operators see the deferred-shape contract.
-      throw new ArchiveWrapError("archive-wrap/tenant-strategy-deferred",
-        "wrap: recipient: \"tenant\" lands in v0.12.11 alongside b.backup cryptoStrategy: \"recipient\" + per-tenant key resolution. For v0.12.10, pass an explicit { publicKey, ecPublicKey } recipient");
+      var tenantKey = _tenantKey(opts.tenantId);
+      var packed = bCrypto().encryptPacked(Buffer.from(bytes), tenantKey, _tenantAad(opts.tenantId));
+      return { version: ARCH_WRAP_VERSION_TENANT, body: packed };
     }
     throw new ArchiveWrapError("archive-wrap/bad-recipient",
-      "wrap: recipient string " + JSON.stringify(r) + " not recognised; \"tenant\" deferred to v0.12.11");
+      "wrap: recipient string " + JSON.stringify(r) + " not recognised; the only string recipient is \"tenant\" (with opts.tenantId)");
   }
   if (r.peerCertDer || r.peerKemPubkey) {
     if (!r.peerCertDer || !r.peerKemPubkey) {
       throw new ArchiveWrapError("archive-wrap/bad-recipient",
         "wrap: peer-cert strategy requires BOTH peerCertDer + peerKemPubkey");
     }
-    return bCrypto().encryptEnvelopeAsCertPeer(bytes, {
-      peerCertDer:    r.peerCertDer,
-      peerKemPubkey:  r.peerKemPubkey,
-    });
+    return {
+      version: ARCH_WRAP_VERSION,
+      body: Buffer.from(bCrypto().encryptEnvelopeAsCertPeer(bytes, {
+        peerCertDer:    r.peerCertDer,
+        peerKemPubkey:  r.peerKemPubkey,
+      }), "utf-8"),
+    };
   }
   if (r.publicKey) {
     // Codex P2 on v0.12.10 PR #161 — b.crypto.encrypt falls back to
@@ -221,10 +286,13 @@ function _encryptForRecipient(bytes, opts) {
         "and ecPublicKey (P-384 ECDH PEM). Partial recipients trip b.crypto.encrypt's " +
         "ML-KEM-only fallback which silently degrades the hybrid contract this primitive promises.");
     }
-    return bCrypto().encrypt(bytes, {
-      publicKey:    r.publicKey,
-      ecPublicKey:  r.ecPublicKey,
-    });
+    return {
+      version: ARCH_WRAP_VERSION,
+      body: Buffer.from(bCrypto().encrypt(bytes, {
+        publicKey:    r.publicKey,
+        ecPublicKey:  r.ecPublicKey,
+      }), "utf-8"),
+    };
   }
   throw new ArchiveWrapError("archive-wrap/bad-recipient",
     "wrap: recipient must be { publicKey, ecPublicKey } | { peerCertDer, peerKemPubkey } | \"tenant\"");

package/lib/vendor/blamejs/lib/cose.js

@@ -743,9 +743,15 @@ function macVerify0(coseMac0, opts) {
 // secp256k1 key be verified under ES256, breaking the COSE alg/curve
 // binding (RFC 9053). Re-add with an explicit ES256K algorithm.
 var COSE_EC2_CRV = { 1: "P-256", 2: "P-384", 3: "P-521" };
+// Reverse of COSE_EC2_CRV — JWK crv name → COSE EC2 curve id, for exportKey.
+var COSE_EC2_CRV_ID = { "P-256": 1, "P-384": 2, "P-521": 3 };
 var COSE_KTY_OKP = 1;
 var COSE_KTY_EC2 = 2;
 var COSE_OKP_ED25519 = 6;                                                    // allow:raw-byte-literal — COSE OKP Ed25519 crv id (RFC 9053)
+// COSE_Key common-parameter labels (RFC 9052 §7.1): 1=kty, 2=kid, 3=alg.
+var COSE_KEY_LABEL_KTY = 1;
+var COSE_KEY_LABEL_KID = 2;
+var COSE_KEY_LABEL_ALG = 3;
 
 function _coseKeyBytes(v, what) {
   if (Buffer.isBuffer(v)) return v;
@@ -804,6 +810,83 @@ function importKey(coseKey) {
   catch (e) { throw new CoseError("cose/bad-cose-key", "cose.importKey: could not import COSE_Key: " + ((e && e.message) || e)); }
 }
 
+/**
+ * @primitive b.cose.exportKey
+ * @signature b.cose.exportKey(keyObject, opts?)
+ * @since     0.13.20
+ * @status    stable
+ * @related   b.cose.importKey, b.cose.verify, b.cbor.encode
+ *
+ * Serialize a <code>node:crypto</code> public key as a COSE_Key
+ * (RFC 9052 §7) — the CBOR-map, integer-labelled form embedded in an
+ * mdoc MSO, a COSE_Key header, or a SCITT / C2PA verification-key
+ * field. The inverse of <code>b.cose.importKey</code>: a key signed
+ * with <code>b.cose.sign</code> can be shipped to a verifier as bytes
+ * and re-imported. Returns the CBOR-encoded bytes (like the other COSE
+ * producers); pass the decoded map to <code>importKey</code> to round-trip.
+ *
+ * Accepts the same key types <code>importKey</code> / <code>verify</code>
+ * understand: EC2 (P-256 / P-384 / P-521) and OKP (Ed25519). A private
+ * key has its public half exported. Other curves / key types are
+ * refused rather than emitting a COSE_Key no verifier here would accept.
+ *
+ * @opts
+ *   alg:   string,          // optional COSE alg label (e.g. "ES256") → COSE_Key label 3
+ *   kid:   Buffer | string, // optional key id → COSE_Key label 2 (bstr; string encoded UTF-8)
+ *
+ * @example
+ *   var bytes = b.cose.exportKey(pubKey, { alg: "ES256", kid: "key-1" });
+ *   var key   = b.cose.importKey(b.cbor.decode(bytes));   // round-trips
+ */
+function exportKey(keyObject, opts) {
+  opts = opts || {};
+  if (!keyObject || typeof keyObject.export !== "function" || typeof keyObject.type !== "string") {
+    throw new CoseError("cose/bad-key", "cose.exportKey: expected a node:crypto KeyObject");
+  }
+  // A private key exports its public half — a COSE_Key here is a
+  // verification key, never the secret.
+  var pub = keyObject.type === "private" ? nodeCrypto.createPublicKey(keyObject) : keyObject;
+  var jwk;
+  try { jwk = pub.export({ format: "jwk" }); }
+  catch (e) { throw new CoseError("cose/bad-key", "cose.exportKey: could not export key to JWK: " + ((e && e.message) || e)); }
+
+  var coseKey = new Map();
+  if (jwk.kty === "OKP") {
+    if (jwk.crv !== "Ed25519") {
+      throw new CoseError("cose/unsupported-key", "cose.exportKey: only OKP curve Ed25519 is supported (got " + jwk.crv + ")");
+    }
+    coseKey.set(COSE_KEY_LABEL_KTY, COSE_KTY_OKP);
+    coseKey.set(-1, COSE_OKP_ED25519);
+    coseKey.set(-2, Buffer.from(jwk.x, "base64url"));
+  } else if (jwk.kty === "EC") {
+    var crvId = COSE_EC2_CRV_ID[jwk.crv];
+    if (!crvId) {
+      throw new CoseError("cose/unsupported-key", "cose.exportKey: unsupported EC curve " + jwk.crv + " (only P-256 / P-384 / P-521)");
+    }
+    coseKey.set(COSE_KEY_LABEL_KTY, COSE_KTY_EC2);
+    coseKey.set(-1, crvId);
+    coseKey.set(-2, Buffer.from(jwk.x, "base64url"));
+    coseKey.set(-3, Buffer.from(jwk.y, "base64url"));
+  } else {
+    throw new CoseError("cose/unsupported-key", "cose.exportKey: kty must be OKP or EC (got " + jwk.kty + ")");
+  }
+
+  if (opts.kid !== undefined) {
+    var kid = Buffer.isBuffer(opts.kid) ? opts.kid
+      : (typeof opts.kid === "string" ? Buffer.from(opts.kid, "utf8") : null);
+    if (!kid) throw new CoseError("cose/bad-kid", "cose.exportKey: opts.kid must be a Buffer or string");
+    coseKey.set(COSE_KEY_LABEL_KID, kid);
+  }
+  if (opts.alg !== undefined) {
+    var algId = ALG_NAME_TO_ID[opts.alg];
+    if (algId === undefined) {
+      throw new CoseError("cose/unknown-alg", "cose.exportKey: opts.alg '" + opts.alg + "' not recognized");
+    }
+    coseKey.set(COSE_KEY_LABEL_ALG, algId);
+  }
+  return cbor.encode(coseKey);
+}
+
 module.exports = {
   sign:        sign,
   verify:      verify,
@@ -812,6 +895,7 @@ module.exports = {
   mac0:        mac0,
   macVerify0:  macVerify0,
   importKey:   importKey,
+  exportKey:   exportKey,
   ALGORITHMS:  ALG_NAME_TO_ID,
   MAC_ALGORITHMS: HMAC_NAME_TO_ID,
   COSE_MAC0_TAG: COSE_MAC0_TAG,

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.13.19",
+  "version": "0.13.22",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.13.20.json

@@ -0,0 +1,22 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.20",
+  "date": "2026-05-27",
+  "headline": "`b.archive.wrap` can seal an archive for a tenant with no key-pair to manage — `recipient: \"tenant\"`",
+  "summary": "b.archive.wrap previously sealed only to an explicit hybrid-PQC key-pair or a peer certificate; the documented recipient: \"tenant\" strategy threw. It now works: pass { recipient: \"tenant\", tenantId } and the archive is sealed under a deterministic per-tenant key derived from the vault root (SHAKE256 KDF) with XChaCha20-Poly1305, the tenant id mixed into the AEAD additional-authenticated-data so one tenant's envelope cannot be opened under another tenant's key. There is no recipient key-pair for the operator to generate, store, or rotate — b.archive.unwrap re-derives the key from the same tenantId. Rotating the vault re-keys every tenant (rotation intent is re-seal). The derivation is exposed directly as b.agent.tenant.derivedKey(tenantId, purpose) for operators who need the raw per-tenant key for their own AEAD. Requires an initialized vault.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.archive.wrap` / `b.archive.unwrap` `recipient: \"tenant\"` — per-tenant archive sealing, no key-pair",
+          "body": "`b.archive.wrap(bytes, { recipient: \"tenant\", tenantId })` seals under a deterministic per-tenant key derived from the vault root with XChaCha20-Poly1305 (draft-irtf-cfrg-xchacha-03) and a SHAKE256 KDF (FIPS 202); the tenant id is bound into the AEAD AAD so a tenant-A envelope cannot decrypt under tenant-B's key even if an attacker swaps envelope headers. `b.archive.unwrap(sealed, { recipient: \"tenant\", tenantId })` (or just `{ tenantId }`) re-derives the key and recovers the bytes — no recipient key-pair to manage. The tenant envelope carries a distinct version byte so it is never fed to the hybrid-KEM decrypt path. The static-key and peer-cert recipient strategies are unchanged."
+        },
+        {
+          "title": "`b.agent.tenant.derivedKey(tenantId, purpose)` — direct per-tenant key derivation",
+          "body": "The deterministic, domain-separated per-tenant key derivation (vault root + tenantId + purpose, SHAKE256, NUL-separated) is now exported at the module level, returning a 64-char hex key. Previously reachable only as a method on a created tenant manager; operators who need the raw key for their own AEAD can now call it directly. Throws if the vault is not initialized."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.21.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.21",
+  "date": "2026-05-27",
+  "headline": "`b.cose.exportKey` — serialize a public key as a COSE_Key, the inverse of `b.cose.importKey`",
+  "summary": "b.cose could import a COSE_Key (RFC 9052 §7) into a node:crypto key for verification, but had no way to produce one — so a key used with b.cose.sign could not be shipped to a verifier in COSE form without hand-building the CBOR map. b.cose.exportKey(keyObject, opts?) closes the round-trip: it serializes an EC2 (P-256 / P-384 / P-521) or OKP (Ed25519) public key as the CBOR-encoded COSE_Key map, with optional alg and kid common parameters. A private key has its public half exported; unsupported curves / key types are refused rather than emitting a COSE_Key no verifier here would accept. The bytes round-trip through b.cose.importKey, and feed the mdoc MSO / COSE_Key header / SCITT / C2PA verification-key paths.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.cose.exportKey(keyObject, { alg?, kid? })` — KeyObject → COSE_Key (RFC 9052 §7)",
+          "body": "Serialize a `node:crypto` public key as the CBOR-encoded COSE_Key map — the inverse of `b.cose.importKey`. Supports EC2 (P-256 / P-384 / P-521) and OKP (Ed25519), the same key types `b.cose.verify` accepts; `opts.alg` (e.g. `\"ES256\"`) and `opts.kid` populate the COSE_Key alg (label 3) and kid (label 2) common parameters. A private key exports its public half; unsupported curves / key types throw rather than producing a COSE_Key no verifier would accept. `b.cose.importKey(b.cbor.decode(exportKey(k)))` round-trips, so a key signed with `b.cose.sign` can be shipped to a verifier as bytes — the mdoc MSO / COSE_Key header / SCITT / C2PA verification-key paths."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.22.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.22",
+  "date": "2026-05-27",
+  "headline": "`b.archive.read.zip.fromTrustedStream` reads a ZIP from a Readable — no longer an experimental stub",
+  "summary": "fromTrustedStream was an experimental stub whose inspect / entries / extract methods threw, forcing callers to buffer the stream themselves and use the random-access reader. It now works, with the same shape as the tar trusted-stream reader: pass b.archive.adapters.trustedStream(readable) and the bytes are collected into a size-capped buffer (1 GiB hard ceiling) and read through the same bomb-cap, path-traversal, and entry-type decode as the random-access reader — so bombPolicy, guardProfile, entryTypePolicy, and audit all apply, and inspect / entries / extract / extractEntries all return data. This is a bounded-memory reader (the archive is held in memory under the ceiling), not zero-buffer streaming; a future forward-inflate walker shared with the tar reader would lift the ceiling.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.archive.read.zip.fromTrustedStream` now reads — `inspect` / `entries` / `extract` / `extractEntries`",
+          "body": "The ZIP trusted-stream reader is implemented (was an experimental stub that threw). Pass `b.archive.adapters.trustedStream(readable)` to read a ZIP straight from a Node Readable without buffering it yourself. The stream is collected into a size-capped buffer (1 GiB ceiling, matching `b.archive.read.tar`'s trusted-stream reader) and decoded through the same adversarial-safe path as the random-access reader, so `bombPolicy` / `guardProfile` / `entryTypePolicy` / `audit` are honored on decode. Adversarial archives remain fully bomb-capped; \"trusted\" refers only to the source-size bound. A non-trusted-stream adapter is refused with `archive-read/bad-adapter`."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/archive-read.test.js

@@ -222,6 +222,51 @@ async function testSafeArchiveRefusesTrustedStreamSource() {
   }
 }
 
+async function testFromTrustedStreamRoundTrip() {
+  var nodeStream = require("node:stream");
+  var z = b.archive.zip();
+  z.addFile("readme.txt", "trusted stream readme\n");
+  z.addFile("data/n.csv", "a,b\n1,2\n");
+  var bytes = z.toBuffer();
+
+  // inspect over a Readable via the trusted-stream adapter (no manual
+  // buffering by the caller — the reader collects + decodes).
+  var reader = b.archive.read.zip.fromTrustedStream(
+    b.archive.adapters.trustedStream(nodeStream.Readable.from(bytes)));
+  check("fromTrustedStream: kind tag", reader.kind === "zip-trusted-sequential");
+  var entries = await reader.inspect();
+  check("fromTrustedStream: inspect sees both entries", entries.length === 2);
+  check("fromTrustedStream: entry name round-trips",
+    entries.some(function (e) { return e.name === "readme.txt"; }));
+
+  // extractEntries over a fresh stream recovers the bytes.
+  var reader2 = b.archive.read.zip.fromTrustedStream(
+    b.archive.adapters.trustedStream(nodeStream.Readable.from(bytes)));
+  var got = {};
+  for await (var ent of reader2.extractEntries()) {
+    got[ent.name] = Buffer.isBuffer(ent.bytes) ? ent.bytes.toString("utf8") : null;
+  }
+  check("fromTrustedStream: extractEntries recovers content",
+    got["readme.txt"] === "trusted stream readme\n" && got["data/n.csv"] === "a,b\n1,2\n");
+
+  // bombPolicy is honored through the delegated decode — a tiny
+  // per-entry cap refuses the archive.
+  var reader3 = b.archive.read.zip.fromTrustedStream(
+    b.archive.adapters.trustedStream(nodeStream.Readable.from(bytes)),
+    { bombPolicy: { maxEntryDecompressedBytes: 4 } });
+  var bombErr = null;
+  try { await reader3.inspect(); for await (var _e of reader3.extractEntries()) { void _e; } }
+  catch (e) { bombErr = e; }
+  check("fromTrustedStream: bombPolicy applies on decode", bombErr !== null);
+
+  // bad adapter (random-access) refused.
+  var badErr = null;
+  try { b.archive.read.zip.fromTrustedStream(b.archive.adapters.buffer(bytes)); }
+  catch (e) { badErr = e; }
+  check("fromTrustedStream: non-trusted-stream adapter refused",
+    badErr && /bad-adapter/.test(badErr.code || badErr.message));
+}
+
 async function testGuardArchiveInspect() {
   var z = b.archive.zip();
   z.addFile("safe.txt", "safe");
@@ -359,6 +404,7 @@ async function run() {
   testVerifyExtractionPathWindowsHazards();
   await testExtractRefusesOverwrite();
   await testSafeArchiveRefusesTrustedStreamSource();
+  await testFromTrustedStreamRoundTrip();
   await testGuardArchiveInspect();
   await testBundleAdapterStorageRoundTrip();
 }