@blamejs/blamejs-shop 0.3.40 → 0.3.41

package/lib/vendor/blamejs/release-notes/v0.14.12.json

@@ -0,0 +1,95 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.14.12",
+  "date": "2026-05-31",
+  "headline": "Vault key rotation re-seals AAD-bound storage under the new root instead of silently orphaning it",
+  "summary": "Every AAD-sealed cell derives its key from the live vault root, so rotating the vault keypair changes those keys. `b.vaultRotate.rotate` previously re-sealed only legacy `vault:`-prefixed cells in `db.enc` and skipped `vault.aad:` cells, AAD-bound at-rest files, and operator-supplied AAD stores — leaving them encrypted under the retired keypair while still returning a success result and a passing round-trip verify, so the loss was invisible until the old keypair was discarded and the cells became permanently undecryptable. Rotation now re-seals `db.enc` (preserving its dataDir-bound AAD), `db.key.enc` (location-bound), every `{ aad: true }` table column, and the overflow store under the new root; refuses up front with a fail-closed error when operator-supplied AAD stores (agent idempotency / orchestrator / tenant / snapshot) are reachable unless each has been re-sealed via its module hook and explicitly acknowledged; and the round-trip verify now decrypts AAD-sealed cells under the new root and treats any cell that still opens under the old root as a regression. New explicit-root `b.vault.aad` seal / unseal / reseal primitives carry a cell from the old root to the new one while preserving its AAD tuple; `b.archive.rewrapTenant` re-wraps tenant-scoped archive envelopes; and `b.cluster` can adopt a rotated vault-key fingerprint instead of partitioning the membership during a rolling rotation.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.vault.aad.sealRoot` / `unsealRoot` / `resealRoot`",
+          "body": "Explicit-root variants of the AAD seal / unseal that take a root-keypair JSON (`b.vault.getKeysJson()` output) instead of reading the live vault singleton. `resealRoot(value, aadParts, oldRootJson, newRootJson)` opens a cell under the old root and re-seals it under the new one while preserving the same AAD tuple (`table` / `rowId` / `column` / `schemaVersion`), which is what lets a rotation worker move AAD-bound state across a keypair change without altering the bound context. The default-root `b.vault.aad.seal` / `unseal` behaviour is unchanged."
+        },
+        {
+          "title": "Per-store AAD re-seal hooks on the agent primitives",
+          "body": "`b.agent.idempotency.reseal`, `b.agent.orchestrator.reseal`, `b.agent.snapshot.reseal`, and the `b.agent.tenant` registry / tenant-cell reseal paths re-seal that module's AAD-bound rows from an old root to a new root over the operator's own store. Each module also exposes an `AAD_ROTATION` descriptor naming the store the rotation pipeline cannot reach on its own, so an operator can enumerate exactly what to re-seal before a rotation."
+        },
+        {
+          "title": "`b.archive.rewrapTenant`",
+          "body": "Re-wraps a `recipient: \"tenant\"` archive envelope from an old vault root to a new one for a given `tenantId`, so a keypair rotation does not strand tenant-scoped archives. Opens the blob under the old root + tenantId, refuses a blob that is not a tenant-recipient envelope or that does not open under the supplied old root, and emits a fresh envelope bound to the new root. This is offered alongside the documented re-export path (decrypt with the old keypair, re-archive with the new one) for operators who hold the envelope but not the source."
+        },
+        {
+          "title": "Cluster vault-key rotation acceptance",
+          "body": "A vault-key rotation changes the public-key fingerprint recorded in the canonical cluster-state row, which a peer would otherwise report as `VAULT_KEY_DRIFT`. `b.cluster` configuration gains `acceptVaultKeyRotation: true` to declare the change legitimate — the node adopts the rotated fingerprint and bumps a rotation epoch instead of refusing — and an optional `expectedVaultKeyFp` that narrows acceptance to a single blessed post-rotation fingerprint. The drift guard stays in force whenever a rotation is not declared; supplying `expectedVaultKeyFp` without `acceptVaultKeyRotation` is rejected at configuration time as a misconfiguration."
+        }
+      ]
+    },
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "`b.vaultRotate.rotate` refuses when reachable AAD stores are not acknowledged",
+          "body": "Because the rotation pipeline walks only `db.enc` and cannot introspect an operator's own AAD-backed stores, it now detects which AAD-store modules are loadable and throws `vault-rotate/external-aad-unresealed` unless `opts.externalAadResealed` is either `true` (you do not use those features) or an array naming every detected store (you have re-sealed each via its hook). This converts a path that previously discarded data and reported success into a fail-closed gate. The error names each store and the hook to call."
+        }
+      ]
+    },
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "Rotation re-seals `vault.aad:` cells and AAD-bound at-rest files",
+          "body": "`db.enc` is re-written bound to its dataDir-scoped AAD (it was previously re-written un-bound, silently stripping the at-rest AAD binding on every rotation), `db.key.enc` retains its location-bound AAD, and every `{ aad: true }` table column plus the overflow store is re-sealed under the new root. Previously only `vault:`-prefixed cells were carried across, so AAD-sealed data was left encrypted under the retired keypair and lost once it was discarded."
+        },
+        {
+          "title": "Round-trip verify no longer reports a false success",
+          "body": "`b.vaultRotate.verify` now samples and decrypts AAD-sealed cells under the new root and treats any cell that still decrypts under the old root as a regression, so an incomplete rotation fails verification instead of passing it. The prior verify checked only `vault:` cells and therefore reported `ok` even when AAD-sealed cells had been orphaned."
+        }
+      ]
+    },
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "A vault key rotation can no longer silently destroy encrypted data",
+          "body": "The orphaning path lost agent idempotency / orchestrator / tenant / snapshot state, `{ aad: true }` columns, and tenant archives with no error and a passing verify; the data became unrecoverable the moment the old keypair was retired. Rotation is now fail-closed end to end: it re-seals what it can reach, refuses to proceed past what it cannot until you acknowledge it, and verifies the result under the new root. If you performed a rotation on v0.14.11 or earlier and still hold the retired keypair, re-seal the affected cells under the current root with the explicit-root primitives before discarding it."
+        }
+      ]
+    },
+    {
+      "heading": "Detectors",
+      "items": [
+        {
+          "title": "AAD-backed store modules must expose a rotation reseal path",
+          "body": "A new check flags a module that registers an external `{ aad: true }` store but does not expose an `AAD_ROTATION` descriptor and reseal hook, which would leave its state unreachable by the rotation pipeline."
+        },
+        {
+          "title": "A root-keyed seal family must ship its reseal",
+          "body": "A new check flags adding a `sealRoot` / `unsealRoot` pair without the matching `resealRoot`, since without it a rotated cell cannot be carried from the old root to the new one."
+        },
+        {
+          "title": "Live-root AAD seals need a reseal path",
+          "body": "A new check flags a primitive that AAD-seals under the live vault root without a way to re-seal that state under a new root during rotation."
+        },
+        {
+          "title": "Tenant archive re-wrapping must compose `b.archive.rewrapTenant`",
+          "body": "A new check flags tenant-scoped archive re-wrapping that opens and re-seals a tenant envelope by hand instead of routing through `b.archive.rewrapTenant`."
+        },
+        {
+          "title": "Cluster vault-key drift needs the rotation-epoch accept gate",
+          "body": "A new check flags a cluster vault-key fingerprint comparison that hard-rejects a mismatch without honouring the `acceptVaultKeyRotation` epoch window."
+        }
+      ]
+    },
+    {
+      "heading": "Migration",
+      "items": [
+        {
+          "title": "Re-seal operator AAD stores before rotating",
+          "body": "Before calling `b.vaultRotate.rotate`, re-seal each AAD-backed store you use via its hook (`b.agent.idempotency.reseal`, `b.agent.orchestrator.reseal`, `b.agent.snapshot.reseal`, the `b.agent.tenant` `AAD_ROTATION` reseal paths) with the old and new root JSON, re-wrap tenant archives with `b.archive.rewrapTenant`, then pass `opts.externalAadResealed` as an array naming each re-sealed store. If you use none of these features, pass `opts.externalAadResealed: true`. Declare the rotation to each cluster node with `acceptVaultKeyRotation: true` so the membership adopts the new fingerprint rather than reporting drift."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.14.13.json

@@ -0,0 +1,52 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.14.13",
+  "date": "2026-05-31",
+  "headline": "Close advertised-but-missing surface: SRS1 chained forwarding, DCQL array-wildcard claim paths, and in-memory safe-archive extraction",
+  "summary": "Three primitives advertised a capability in their documentation or card but refused or omitted it at runtime; this release implements each. b.mail.srs gains srs1Rewrite for the SRS1 double-forward (and multi-hop) case — previously the @intro described SRS1 and create() threw, pointing at a function that was never exported. b.safeArchive gains extractToMemory, the in-memory counterpart to extract for read-only / serverless filesystems — previously the card advertised in-memory extraction but the orchestrator required a destination directory. b.auth.oid4vp.matchDcql now honours a null claims-path segment as the array wildcard the OpenID4VP DCQL spec defines, rather than refusing it as unsupported while the card advertised DCQL. A stale version-pinned wording in a safe-archive error message is corrected. Every change is additive or message-only — no existing caller changes behaviour.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.mail.srs` SRS1 chained forwarding — `srs1Rewrite`",
+          "body": "`b.mail.srs.create(...)` now returns `srs1Rewrite` alongside `rewrite` / `reverse`. `srs1Rewrite(srsAddress)` chains an already-SRS0 (or SRS1) envelope-from for a further forwarding hop: it keeps the original SRS0 body verbatim, prepends the SRS0 originator's domain, and binds the pair with this forwarder's own HMAC-SHA-256 tag — no new timestamp, no repeated original local-part — emitting `SRS1=tag=originator==<SRS0-body>@thisForwarder`. `reverse()` now detects an SRS1 address, verifies this hop's tag and forwarder-domain binding, and unwraps exactly one hop back to the originator's SRS0 so a multi-hop bounce routes straight to the forwarder that can recover the original sender. Typed failure modes: `srs/not-srs0` (input not SRS-encoded), `srs/malformed` (missing the `==` separator), `srs/bad-tag` (tampered), `srs/too-long` (chain exceeds the RFC 5321 256-octet path limit). Implements the Sender Rewriting Scheme SRS1 wire format; the second-hop SPF rationale is RFC 7208 §2.4."
+        },
+        {
+          "title": "`b.safeArchive.extractToMemory` — in-memory safe extraction",
+          "body": "An async generator counterpart to `b.safeArchive.extract` for read-only / serverless filesystems: it resolves the source, sniffs the format, auto-unwraps recipient (`BAWRP`) / passphrase (`BAWPP`) envelopes, and dispatches to the zip / tar / tar.gz reader's in-memory `extractEntries()`, yielding `{ name, bytes, size }` per regular-file entry without ever writing to disk. It takes no `destination`. Every defense the disk path runs applies unchanged: the zip-bomb caps (entry-count / per-entry / total / expansion-ratio), the `b.guardArchive` metadata cascade (Zip-Slip / path-traversal / symlink-escape / encrypted-entry refusal, CVE-2025-3445 class), and the entry-type policy. The disk-only realpath-agreement check (CVE-2025-4517 PATH_MAX TOCTOU defense) is intentionally absent — there is no extraction root — so the archive-level name refusals carry containment. Trusted-stream sources are refused upfront (the adversarial-safe central-directory walk needs random access). gzip magic per RFC 1952 §2.3.1."
+        }
+      ]
+    },
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "OID4VP DCQL `null` claim-path segment now resolves the array wildcard",
+          "body": "`b.auth.oid4vp.matchDcql` previously threw `auth-oid4vp/null-path-segment-not-supported` for a `null` claims-path segment while the namespace card advertised DCQL — under-disclosing a legitimate presentation (CWE-863). Per OpenID4VP 1.0 §7.1.1 a `null` segment selects all elements of the array at that depth; the matcher now recurses over array elements with existence semantics (with DCQL value-matching applied to any selected leaf), composed to arbitrary depth. A `null` segment on a non-array node — like an integer index into a non-array, or a string key into an array — is a clean non-match, not a thrown error, because the matcher walks holder credential data rather than operator config. String and integer claim paths are byte-identical to before; only queries that previously threw now succeed or fail cleanly."
+        },
+        {
+          "title": "safe-archive trusted-stream refusal message no longer cites a stale version",
+          "body": "The thrown `safe-archive/trusted-stream-unsupported` message and its comment claimed trusted-stream extraction was \"deferred to v0.12.8 / when the v0.12.8 sequential extract path lands.\" That path shipped long ago — `b.archive.read.zip.fromTrustedStream` and the tar sequential mode exist — so the message now points at them as present capabilities and drops the version-pinned wording. The error code is unchanged."
+        }
+      ]
+    },
+    {
+      "heading": "Detectors",
+      "items": [
+        {
+          "title": "A primitive may not advertise a capability and then throw an unimplemented stub",
+          "body": "A new check flags a bare `not yet supported` / `operator demand TBD` / `not supported in v1` refusal in a lib throw string (comments excluded). A defer is only complete with a written re-open condition; the SRS1 and DCQL stubs that this release implements both carried this bare-defer shape, and the detector keeps it from re-entering."
+        },
+        {
+          "title": "DCQL `null` path segments must recurse, never refuse",
+          "body": "A new check flags the `null path segment not supported` refusal shape in `lib/auth/oid4vp.js`, so the spec-mandated array wildcard cannot be re-stubbed."
+        },
+        {
+          "title": "`extractToMemory` must stay disk-free",
+          "body": "A new check flags any `writeFileSync` / `renameSync` / `mkdirSync` / `createWriteStream` inside the `extractToMemory` generator body, so the read-only / serverless contract cannot regress into a disk write."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.14.14.json

@@ -0,0 +1,31 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.14.14",
+  "date": "2026-05-31",
+  "headline": "Recognized consent purposes with lawful-basis gating, and a new b.privacy namespace for annual EdTech vendor-review attestations",
+  "summary": "Closes the student-data gap where an educational-only consent purpose and an annual third-party vendor-review report were described but never implemented. b.consent gains a recognized-purpose vocabulary: a purpose value matching a recognized key carries lawful-basis constraints that grant() enforces, and the named educational-only purpose (FERPA's school-official exception and California's SOPIPA) refuses a legitimate_interests lawful basis. The new b.privacy namespace ships vendorReview(), a builder for the dated, clause-by-clause annual EdTech third-party / processor review FERPA and SOPIPA expect a school or district to keep — it computes whether every required clause (no targeted advertising, no commercial profiling, no sale of student data, deletion on request, school-official designation, and so on) is attested, names the gaps, and stamps a 365-day re-review clock. Free-form consent purposes keep working unchanged, so the vocabulary is opt-in and additive.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.consent` recognized-purpose vocabulary + lawful-basis gating",
+          "body": "`b.consent.recognizedPurpose(name)` looks up a recognized purpose and `b.consent.listPurposes()` enumerates them. When a `grant({ purpose })` value matches a recognized key, `grant()` enforces that purpose's lawful-basis constraints; the `educational-only` purpose forbids a `legitimate_interests` basis (FERPA 34 CFR 99.31(a)(1) school-official exception; California SOPIPA Cal. B&P 22584; FTC school-authorized COPPA consent 16 CFR 312.5(c)(10)) and marks the data commercial-use-prohibited. The commercial-use prohibition is an operator trust-boundary obligation — `isGranted()` does not re-derive it. Any purpose value NOT in the vocabulary stays free-form and unconstrained, so existing callers are unaffected; the hash-chain column set is unchanged, so `b.consent.verify()` over existing rows is unaffected."
+        },
+        {
+          "title": "`b.privacy.vendorReview` — annual EdTech vendor-review attestation",
+          "body": "A new `b.privacy` namespace whose `vendorReview(opts)` builds the dated third-party / processor review a FERPA school-official arrangement and California SOPIPA expect for every vendor that touches student data. The operator supplies a boolean attestation per clause (educational-purpose-only, no-targeted-advertising, no-commercial-profiling, no-sale-of-student-data, security-safeguards, deletion-on-request, sub-processor-currency, breach-notification, school-official-designation, directory-information-handling); `vendorReview` validates the shape, computes whether every required clause is attested (`attested`) and which are not (`gaps`), and stamps `reviewedAt` plus a 365-day `nextReviewDueAt` re-review clock. `b.privacy.listVendorReviewClauses()` returns the clause set with citations. Operator-feeds-metadata: the frozen report is not framework-persisted — compose it into your retention / audit / export sink. A best-effort `privacy.vendor_review.recorded` audit event fires when an audit sink is wired."
+        }
+      ]
+    },
+    {
+      "heading": "Detectors",
+      "items": [
+        {
+          "title": "A gated consent purpose must go through `b.consent`",
+          "body": "A new check flags any lib code that mints a consent row with a hardcoded `educational-only` purpose literal without composing the recognized-purpose vocabulary — which would record the value while never enforcing its FERPA / SOPIPA lawful-basis constraint."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/00-primitives.js

@@ -10279,6 +10279,9 @@ async function testVaultRotateRotateEndToEnd() {
       oldKeys: oldKeys, newKeys: newKeys,
       dataDir: dataDir, stagingDir: stagingDir,
       mode: "plaintext",
+      // This fixture seals only db.enc-backed columns; no operator-supplied
+      // AAD stores are in play, so the rotation has nothing external to re-seal.
+      externalAadResealed: true,
       progressCallback: function (e) { progressEvents.push(e.phase); },
     });
 
@@ -10307,7 +10310,12 @@ async function testVaultRotateRotateEndToEnd() {
     // Staged db.enc should decrypt with dbKey, contain the same rows, and
     // every email/name column should now be sealed under newKeys.
     var stagedPacked = fs.readFileSync(path.join(stagingDir, "db.enc"));
-    var stagedPlain = b.crypto.decryptPacked(stagedPacked, dbKey);
+    // Rotation re-writes db.enc bound to the dataDir-scoped AAD (matching the
+    // at-rest format db.js writes), even when the input snapshot was a legacy
+    // un-bound envelope — so verification must supply the same AAD. The binding
+    // tracks the final dataDir (where db.js reopens it after the staging swap),
+    // not the staging path.
+    var stagedPlain = b.crypto.decryptPacked(stagedPacked, dbKey, b.db._dbEncAad(dataDir));
     var verifyDbPath = path.join(dir, "verify.db");
     fs.writeFileSync(verifyDbPath, stagedPlain);
     var vdb = new DatabaseSync(verifyDbPath);

package/lib/vendor/blamejs/test/layer-0-primitives/agent-idempotency.test.js

@@ -290,8 +290,111 @@ async function testAtRestSealingWithVault() {
   }
 }
 
+async function testAadRotationDescriptor() {
+  // The descriptor every {aad:true} external-store module exports so an
+  // operator can rotate the backing store out-of-band (the in-tree
+  // b.vaultRotate.rotate pipeline can't reach an operator-supplied store).
+  var d = b.agent.idempotency.AAD_ROTATION;
+  check("AAD_ROTATION present",        d && typeof d === "object");
+  check("AAD_ROTATION.table",          d.table === "agent_idempotency");
+  check("AAD_ROTATION.rowIdField",     d.rowIdField === "keyHash");
+  check("AAD_ROTATION.schemaVersion",  d.schemaVersion === "1");
+  check("AAD_ROTATION.backend external", d.backend === "external");
+  check("AAD_ROTATION.reseal is fn",   typeof d.reseal === "function");
+  check("reseal exported directly",    typeof b.agent.idempotency.reseal === "function");
+
+  // reseal validates its config/entry-point inputs synchronously — THROW on
+  // a missing root or a store that can't enumerate + write back, before any
+  // async store work begins.
+  var threwRoot = null;
+  try { b.agent.idempotency.reseal({ store: { listAll: function () { return []; }, putResealed: function () {} } }); }
+  catch (e) { threwRoot = e; }
+  check("reseal refuses missing roots",
+    threwRoot && (threwRoot.code || "").indexOf("agent-idempotency/bad-root") !== -1);
+  var threwStore = null;
+  try { b.agent.idempotency.reseal({ oldRootJson: "{}", newRootJson: "{}", store: { listAll: function () { return []; } } }); }
+  catch (e) { threwStore = e; }
+  check("reseal refuses store without putResealed",
+    threwStore && (threwStore.code || "").indexOf("agent-idempotency/bad-reseal-store") !== -1);
+}
+
+async function testResealRotatesSealedCellsAcrossRoots() {
+  // End-to-end: seal a cached-result row under vault root A, capture the
+  // sealed cell, derive a second root B, reseal A->B out-of-band, and
+  // confirm the cell now opens under B (and no longer under A) — the AAD
+  // tuple is reconstructed via the SAME builder the seal side used, so the
+  // re-sealed value round-trips.
+  var os   = require("node:os");
+  var path = require("node:path");
+  var fs   = require("node:fs");
+  var dirA = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-idem-rotA-"));
+  await b.vault.init({ mode: "plaintext", dataDir: dirA });
+  var rootA = b.vault.getKeysJson();
+  var SECRET = "rotate-payload-9007199254740993";
+  var backend = {
+    _m: Object.create(null),
+    async get(m, a, h) { return this._m[m + "\0" + a + "\0" + h] || null; },
+    async put(m, a, h, row) { this._m[m + "\0" + a + "\0" + h] = row; },
+    async delete(m, a, h) { delete this._m[m + "\0" + a + "\0" + h]; },
+    // Out-of-band reseal contract: enumerate every stored row, then write
+    // each back addressed by its stored keyHash identity (the raw key is
+    // never persisted — only its namespaced keyHash is).
+    listAll() { return Object.keys(this._m).map(function (k) { return this._m[k]; }.bind(this)); },
+    putResealed(row) {
+      for (var k in this._m) {
+        if (this._m[k].keyHash === row.keyHash && this._m[k].method === row.method) {
+          this._m[k] = row;
+          return;
+        }
+      }
+    },
+  };
+  var idem = b.agent.idempotency.create({ store: backend });
+  await idem.put("move", "u-rot", "jmap-rot-1", { payload: SECRET });
+  var stored = backend.listAll();
+  check("rotate: one sealed row stored", stored.length === 1);
+  var beforeCell = stored[0].resultBlob;
+  check("rotate: cell is AAD-sealed before rotation",
+    typeof beforeCell === "string" && b.vault.aad.isAadSealed(beforeCell));
+
+  // Derive a second, distinct vault root B (fresh keypair in a new dir).
+  b.vault._resetForTest();
+  var dirB = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-idem-rotB-"));
+  await b.vault.init({ mode: "plaintext", dataDir: dirB });
+  var rootB = b.vault.getKeysJson();
+  check("rotate: roots differ", rootA !== rootB);
+
+  try {
+    var r = await b.agent.idempotency.reseal({ store: backend, oldRootJson: rootA, newRootJson: rootB });
+    check("rotate: reseal reports table",    r.table === "agent_idempotency");
+    check("rotate: reseal counted the row",  r.resealed === 1);
+
+    var afterCell = backend.listAll()[0].resultBlob;
+    check("rotate: cell changed after reseal", afterCell !== beforeCell);
+    check("rotate: cell still AAD-sealed",     b.vault.aad.isAadSealed(afterCell));
+
+    // Reconstruct the exact AAD the seal side used and verify the cell now
+    // opens under B but not under A.
+    var schema = b.cryptoField.getSchema("agent_idempotency");
+    var aad = b.cryptoField._aadParts(schema, "agent_idempotency", "resultBlob", backend.listAll()[0]);
+    var openedB = b.vault.aad.unsealRoot(afterCell, aad, rootB);
+    check("rotate: resealed cell opens under NEW root",
+      typeof openedB === "string" && openedB.indexOf(SECRET) !== -1);
+    var openedUnderOld = null;
+    try { b.vault.aad.unsealRoot(afterCell, aad, rootA); }
+    catch (e) { openedUnderOld = e; }
+    check("rotate: resealed cell no longer opens under OLD root", openedUnderOld !== null);
+  } finally {
+    b.vault._resetForTest();
+    try { fs.rmSync(dirA, { recursive: true, force: true }); } catch (_e) {}
+    try { fs.rmSync(dirB, { recursive: true, force: true }); } catch (_e) {}
+  }
+}
+
 async function run() {
   testSurface();
+  await testAadRotationDescriptor();
+  await testResealRotatesSealedCellsAcrossRoots();
   await testAtRestSealingWithVault();
   await testBasicGetPut();
   await testInMemoryBackendBounded();

package/lib/vendor/blamejs/test/layer-0-primitives/agent-orchestrator.test.js

@@ -429,8 +429,99 @@ async function testRegistryRowSealedAtRest() {
   }
 }
 
+async function testAadRotationDescriptor() {
+  var d = b.agent.orchestrator.AAD_ROTATION;
+  check("AAD_ROTATION present",          d && typeof d === "object");
+  check("AAD_ROTATION.table",            d.table === "agent_orchestrator_registry");
+  check("AAD_ROTATION.rowIdField",       d.rowIdField === "name");
+  check("AAD_ROTATION.schemaVersion",    d.schemaVersion === "1");
+  check("AAD_ROTATION.backend external", d.backend === "external");
+  check("AAD_ROTATION.reseal is fn",     typeof d.reseal === "function");
+  check("reseal exported directly",      typeof b.agent.orchestrator.reseal === "function");
+
+  await expectRejection("reseal refuses missing roots",
+    Promise.resolve().then(function () {
+      return b.agent.orchestrator.reseal({ store: { list: function () { return []; }, set: function () {} } });
+    }),
+    "agent-orchestrator/bad-root");
+  await expectRejection("reseal refuses store without list/set",
+    Promise.resolve().then(function () {
+      return b.agent.orchestrator.reseal({ oldRootJson: "{}", newRootJson: "{}", store: { list: function () { return []; } } });
+    }),
+    "agent-orchestrator/bad-reseal-store");
+}
+
+async function testResealRotatesRegistryRowsAcrossRoots() {
+  // Seal a registry row (tenantId + metadata) under vault root A, derive a
+  // distinct root B, reseal the operator backend A->B out-of-band, and
+  // confirm the sealed cells now open under B (and no longer under A). The
+  // AAD tuple is rebuilt via cryptoField._aadParts — the same builder the
+  // seal side used — so the re-sealed values round-trip.
+  var os   = helpers.os;
+  var path = helpers.path;
+  var fs   = helpers.fs;
+  var dirA = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-orch-rotA-"));
+  await helpers.setupVaultOnly(dirA);
+  var rootA = b.vault.getKeysJson();
+  var backend = {
+    _m: Object.create(null),
+    async get(n) { return this._m[n] || null; },
+    async set(n, row) { this._m[n] = row; },
+    async delete(n) { delete this._m[n]; },
+    async list() { return Object.values(this._m); },
+  };
+  var orch = b.agent.orchestrator.create({ backend: backend });
+  await orch.register("svc-rot", { kind: "mail", handle: function () {} }, {
+    agentKind: "mail", tenantId: "acme-corp", metadata: { endpoint: "https://internal-host:9000" },
+  });
+  var beforeTenant = backend._m["svc-rot"].tenantId;
+  var beforeMeta   = backend._m["svc-rot"].metadata;
+  check("orch rotate: tenantId AAD-sealed before",
+    typeof beforeTenant === "string" && b.vault.aad.isAadSealed(beforeTenant));
+  check("orch rotate: metadata AAD-sealed before",
+    typeof beforeMeta === "string" && b.vault.aad.isAadSealed(beforeMeta));
+
+  // Derive a second, distinct vault root B.
+  b.vault._resetForTest();
+  if (b.agent.orchestrator._resetForTest) b.agent.orchestrator._resetForTest();
+  var dirB = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-orch-rotB-"));
+  await helpers.setupVaultOnly(dirB);
+  var rootB = b.vault.getKeysJson();
+  check("orch rotate: roots differ", rootA !== rootB);
+
+  try {
+    var r = await b.agent.orchestrator.reseal({ store: backend, oldRootJson: rootA, newRootJson: rootB });
+    check("orch rotate: reseal reports table",   r.table === "agent_orchestrator_registry");
+    check("orch rotate: reseal counted the row", r.resealed === 1);
+
+    var afterTenant = backend._m["svc-rot"].tenantId;
+    var afterMeta   = backend._m["svc-rot"].metadata;
+    check("orch rotate: tenantId cell changed", afterTenant !== beforeTenant);
+    check("orch rotate: metadata cell changed", afterMeta !== beforeMeta);
+
+    var schema = b.cryptoField.getSchema("agent_orchestrator_registry");
+    var tenantAad = b.cryptoField._aadParts(schema, "agent_orchestrator_registry", "tenantId", backend._m["svc-rot"]);
+    var openedTenant = b.vault.aad.unsealRoot(afterTenant, tenantAad, rootB);
+    check("orch rotate: tenantId opens under NEW root", openedTenant === "acme-corp");
+    var openedUnderOld = null;
+    try { b.vault.aad.unsealRoot(afterTenant, tenantAad, rootA); }
+    catch (e) { openedUnderOld = e; }
+    check("orch rotate: tenantId no longer opens under OLD root", openedUnderOld !== null);
+
+    var metaAad = b.cryptoField._aadParts(schema, "agent_orchestrator_registry", "metadata", backend._m["svc-rot"]);
+    var openedMeta = b.vault.aad.unsealRoot(afterMeta, metaAad, rootB);
+    check("orch rotate: metadata opens under NEW root",
+      typeof openedMeta === "string" && openedMeta.indexOf("internal-host") !== -1);
+  } finally {
+    helpers.teardownVaultOnly(dirB);
+    try { fs.rmSync(dirA, { recursive: true, force: true }); } catch (_e) {}
+  }
+}
+
 async function run() {
   testSurface();
+  await testAadRotationDescriptor();
+  await testResealRotatesRegistryRowsAcrossRoots();
   await testRegisterLookupUnregister();
   await testList();
   await testTenantScopeRegistryReads();

package/lib/vendor/blamejs/test/layer-0-primitives/agent-snapshot.test.js

@@ -1,5 +1,8 @@
 "use strict";
 
+var fs      = require("fs");
+var os      = require("os");
+var path    = require("path");
 var helpers = require("../helpers");
 var b       = helpers.b;
 var check   = helpers.check;
@@ -296,6 +299,188 @@ async function testRestoreRequireHandlersRefuses() {
     "agent-snapshot/no-restore-handlers");
 }
 
+// ---- reseal (vault-key rotation) -----------------------------------------
+//
+// reseal composes b.vault.aad.resealRoot, which only re-keys a real
+// `vault.aad:` blob — so these cases use the live b.vault.aad sealer
+// (omit the `sealer` opt so _resolveSealer picks up vault().aad) under a
+// setupVaultOnly fixture. The signer stays a fake so the test doesn't
+// need the full audit-sign passphrase boot.
+
+function _vaultBackedSnapshot(backend) {
+  return b.agent.snapshot.create({
+    orchestrator: _fakeOrch(),
+    backend:      backend,
+    signer:       _fakeSigner(),
+    // sealer omitted on purpose → live b.vault.aad.
+  });
+}
+
+function testResealRotationSurface() {
+  var desc = b.agent.snapshot.AAD_ROTATION;
+  check("AAD_ROTATION exported",            desc && typeof desc === "object");
+  check("AAD_ROTATION.table",               desc.table === "agent.snapshot");
+  check("AAD_ROTATION.rowIdField",          desc.rowIdField === "snapshotId");
+  check("AAD_ROTATION.schemaVersion",       desc.schemaVersion === String(b.agent.snapshot.SCHEMA_VERSION));
+  check("AAD_ROTATION.backend external",    desc.backend === "external");
+  check("AAD_ROTATION.reseal is fn",        typeof desc.reseal === "function");
+  check("reseal exported on module",        typeof b.agent.snapshot.reseal === "function");
+}
+
+async function testResealBadInputRefused() {
+  await expectRejection("reseal refuses missing backend",
+    b.agent.snapshot.reseal({ oldRootJson: "a", newRootJson: "b" }),
+    "agent-snapshot/bad-backend");
+  await expectRejection("reseal refuses missing oldRootJson",
+    b.agent.snapshot.reseal({ backend: _fakeBackend(), newRootJson: "b" }),
+    "agent-snapshot/bad-root");
+  await expectRejection("reseal refuses missing newRootJson",
+    b.agent.snapshot.reseal({ backend: _fakeBackend(), oldRootJson: "a" }),
+    "agent-snapshot/bad-root");
+}
+
+async function testResealRekeysUnderNewRoot() {
+  var backend = _fakeBackend();
+  var snapshot = _vaultBackedSnapshot(backend);
+  var snap = await snapshot.takeSnapshot({ sagas: [{ id: "s1" }] });
+  await snapshot.persist(snap);
+
+  var oldRootJson = b.vault.getKeysJson();
+  // A distinct, keys-shaped root: resealRoot hashes the whole serialized
+  // form, so any byte-distinct JSON is a different vault root.
+  var newRootJson = JSON.stringify(
+    Object.assign(JSON.parse(oldRootJson), { _rotationTestRoot: "v2" }));
+
+  var before = await backend.get(snap.snapshotId);
+  var beforeSealed = before.sealed;
+  var prefix = b.agent.snapshot.SEALED_PREFIX;
+  check("pre-reseal: wrapper carries the prefix", beforeSealed.indexOf(prefix) === 0);
+  var innerBefore = beforeSealed.slice(prefix.length);
+  check("pre-reseal: inner blob is a vault.aad: value",
+    b.vault.aad.isAadSealed(innerBefore));
+
+  var result = await b.agent.snapshot.reseal({
+    backend:     backend,
+    oldRootJson: oldRootJson,
+    newRootJson: newRootJson,
+  });
+  check("reseal: table echoed", result.table === "agent.snapshot");
+  check("reseal: 1 row re-keyed", result.resealed === 1);
+
+  var after = await backend.get(snap.snapshotId);
+  check("post-reseal: prefix preserved", after.sealed.indexOf(prefix) === 0);
+  check("post-reseal: ciphertext changed", after.sealed !== beforeSealed);
+  check("post-reseal: decorative wrapper preserved",
+    after.snapshotId === snap.snapshotId && after.takenAt === before.takenAt);
+
+  // The AAD the cell was sealed under — rebuilt the SAME way the module
+  // does, via the column-shaped tuple.
+  var aad = {
+    table:         "agent.snapshot",
+    rowId:         snap.snapshotId,
+    column:        "envelope",
+    schemaVersion: String(b.agent.snapshot.SCHEMA_VERSION),
+  };
+  var innerAfter = after.sealed.slice(prefix.length);
+  // Re-keyed blob opens under the NEW root + the SAME AAD, yielding the
+  // original signed envelope JSON.
+  var reopened = b.vault.aad.unsealRoot(innerAfter, aad, newRootJson);
+  var env = JSON.parse(reopened);
+  check("post-reseal: envelope decrypts under new root",
+    env.snapshotId === snap.snapshotId);
+
+  // ...and is now undecryptable under the OLD root (the AEAD tag is
+  // keyed off the new root).
+  var oldRootFails = false;
+  try { b.vault.aad.unsealRoot(innerAfter, aad, oldRootJson); }
+  catch (_e) { oldRootFails = true; }
+  check("post-reseal: old root no longer opens the cell", oldRootFails);
+}
+
+async function testResealSkipsPlaintextRows() {
+  // A bare-envelope row (no `sealed` wrapper) — what the allowPlaintext
+  // path writes, and what a legacy plaintext snapshot looks like — has no
+  // AAD-sealed blob to re-key, so reseal skips it and re-keys only the
+  // sealed rows. Inject the plaintext row directly so the skip branch is
+  // exercised regardless of whether the live vault would otherwise seal.
+  var backend = _fakeBackend();
+  var sealedSnap = _vaultBackedSnapshot(backend);
+  var ss = await sealedSnap.takeSnapshot({});
+  await sealedSnap.persist(ss);
+
+  // Plaintext row: the bare envelope, snapshotId-keyed, no `sealed`.
+  var plainSnap = await sealedSnap.takeSnapshot({});
+  await backend.put(plainSnap.snapshotId, plainSnap);
+
+  var oldRootJson = b.vault.getKeysJson();
+  var newRootJson = JSON.stringify(
+    Object.assign(JSON.parse(oldRootJson), { _rotationTestRoot: "v3" }));
+  var result = await b.agent.snapshot.reseal({
+    backend:     backend,
+    oldRootJson: oldRootJson,
+    newRootJson: newRootJson,
+  });
+  check("reseal: only the sealed row counted (plaintext skipped)",
+    result.resealed === 1);
+}
+
+async function testResealRefusesNonVaultSealer() {
+  // A row sealed by a custom KMS sealer carries a non-vault.aad: inner
+  // blob; reseal can't re-key it via resealRoot, so it refuses rather
+  // than silently no-op (the operator must re-key through their KMS).
+  var backend = _fakeBackend();
+  var kms = b.agent.snapshot.create({
+    orchestrator: _fakeOrch(),
+    backend:      backend,
+    signer:       _fakeSigner(),
+    sealer:       _fakeSealer(),   // AES-GCM fake → not a vault.aad: blob
+  });
+  var snap = await kms.takeSnapshot({});
+  await kms.persist(snap);
+  var oldRootJson = b.vault.getKeysJson();
+  var newRootJson = JSON.stringify(
+    Object.assign(JSON.parse(oldRootJson), { _rotationTestRoot: "v5" }));
+  await expectRejection("reseal refuses a non-vault-sealed row",
+    b.agent.snapshot.reseal({
+      backend:     backend,
+      oldRootJson: oldRootJson,
+      newRootJson: newRootJson,
+    }),
+    "agent-snapshot/not-vault-sealed");
+}
+
+async function testResealDescriptorMapsStore() {
+  // The AAD_ROTATION.reseal adapter maps the pipeline's generic `store`
+  // term onto this module's backend.
+  var backend = _fakeBackend();
+  var snapshot = _vaultBackedSnapshot(backend);
+  await snapshot.persist(await snapshot.takeSnapshot({}));
+  var oldRootJson = b.vault.getKeysJson();
+  var newRootJson = JSON.stringify(
+    Object.assign(JSON.parse(oldRootJson), { _rotationTestRoot: "v4" }));
+  var result = await b.agent.snapshot.AAD_ROTATION.reseal({
+    store:       backend,
+    oldRootJson: oldRootJson,
+    newRootJson: newRootJson,
+  });
+  check("AAD_ROTATION.reseal: re-keyed via store alias", result.resealed === 1);
+}
+
+async function runReseal() {
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-snapshot-reseal-"));
+  await helpers.setupVaultOnly(tmpDir);
+  try {
+    testResealRotationSurface();
+    await testResealBadInputRefused();
+    await testResealRekeysUnderNewRoot();
+    await testResealSkipsPlaintextRows();
+    await testResealRefusesNonVaultSealer();
+    await testResealDescriptorMapsStore();
+  } finally {
+    helpers.teardownVaultOnly(tmpDir);
+  }
+}
+
 async function run() {
   testSurface();
   await testCreateRequiresOrchestrator();
@@ -313,6 +498,7 @@ async function run() {
   await testGc();
   await testRestoreHandlersInvoked();
   await testRestoreRequireHandlersRefuses();
+  await runReseal();
 }
 
 module.exports = { run: run };