@blamejs/blamejs-shop 0.3.40 → 0.3.41

package/lib/vendor/blamejs/lib/crypto-field.js

@@ -1105,6 +1105,11 @@ module.exports = {
   getSealedFields:  getSealedFields,
   sealRow:          sealRow,
   unsealRow:        unsealRow,
+  // _aadParts — the column-AAD builder the seal/unseal path uses. Exported
+  // (internal) so the vault-key rotation pipeline reconstructs the IDENTICAL
+  // AAD tuple a cell was sealed under — one source of truth, no drift
+  // between the seal side and the rotate side.
+  _aadParts:        _aadParts,
   // Doc-shaped aliases — operators / tests preparing a JS document
   // object (vs. a SQL row) reach for sealDoc / unsealDoc naming. Same
   // function, identical shape, returns a new object (input untouched).

package/lib/vendor/blamejs/lib/db.js

@@ -1318,6 +1318,15 @@ async function init(opts) {
       derivedHashes:   t.derivedHashes,
       hashNamespaces:  t.hashNamespaces,
       derivedHashMode: t.derivedHashMode,
+      // AAD-binding metadata MUST pass through — without it a schema that
+      // declares { aad: true } registers as a plain table, so its cells
+      // seal under vault: (not vault.aad:) and the vault-key rotation
+      // pipeline cannot reconstruct their AAD. registerTable defaults these
+      // (aad:false / rowIdField:"id" / schemaVersion:"1") so non-AAD tables
+      // are unaffected.
+      aad:             t.aad,
+      rowIdField:      t.rowIdField,
+      schemaVersion:   t.schemaVersion,
     });
     tableMetadata[t.name] = {
       primaryKey:             _normalizePk(t),
@@ -3161,6 +3170,12 @@ module.exports = {
   // (plain mode) or when the plaintext DB doesn't exist.
   flushToDisk:         encryptToDisk,
   snapshot:            snapshot,
+  // Internal AAD constructors, exported so the vault-key rotation
+  // pipeline (lib/vault/rotate.js) re-seals db.enc / db.key.enc under the
+  // SAME deployment-bound AAD this module writes them with — single source
+  // of truth for the wire-format literals (no duplicated constants).
+  _dbEncAad:           _dbEncAad,
+  _dbKeyAad:           _dbKeyAad,
   // integrityCheck — runs PRAGMA integrity_check against the live db
   // and returns "ok" on success, an array of corruption lines
   // otherwise. Operators wire this into a periodic monitor or a

package/lib/vendor/blamejs/lib/framework-error.js

@@ -370,6 +370,10 @@ var DoraError             = defineClass("DoraError",             { alwaysPermane
 // posture name, runtime-switch refusal, assertion failures.
 // Permanent — these are configuration errors, not transient.
 var ComplianceError       = defineClass("ComplianceError",       { alwaysPermanent: true });
+// PrivacyError covers b.privacy config-time misuse: a malformed
+// vendorReview opts object, a non-boolean clause attestation, or an
+// unknown clause key. Permanent — operator configuration, not transient.
+var PrivacyError          = defineClass("PrivacyError",          { alwaysPermanent: true });
 // SmtpPolicyError covers MTA-STS / DANE / TLS-RPT misuse: bad-policy
 // shape, fetch failures, TLSA-record format errors, missing records.
 // Permanent — these are policy / DNS configuration errors, not
@@ -412,6 +416,20 @@ var McpError              = defineClass("McpError",              { alwaysPermane
 // input shape, classifier-result-shape errors, oversized input bypass.
 // Permanent — caller-shape errors.
 var AiInputError          = defineClass("AiInputError",          { alwaysPermanent: true });
+// AiOutputError covers LLM output-handling violations raised by
+// b.ai.output.sanitize / b.ai.output.redact: malformed input shape
+// (non-string), oversized output bypass (exceeds maxBytes cap), bad
+// maxBytes opt, unknown redaction entity. Permanent — caller-shape
+// errors that retry will not recover. OWASP LLM05:2025 (Improper
+// Output Handling) + LLM02:2025 (Sensitive Information Disclosure).
+var AiOutputError         = defineClass("AiOutputError",         { alwaysPermanent: true });
+// AiPromptError covers LLM prompt-assembly violations raised by
+// b.ai.prompt.template: malformed segment shape (non-string system /
+// context / user), bad maxBytes / nonceBytes opt, oversized assembled
+// prompt. Permanent — caller-shape errors that retry will not recover.
+// OWASP LLM01:2025 (Prompt Injection — indirect / data-plane injection
+// from untrusted context).
+var AiPromptError         = defineClass("AiPromptError",         { alwaysPermanent: true });
 // A2aError covers A2A (Agent-to-Agent) protocol violations: signed-
 // agent-card signature mismatch, expired card, unknown card id,
 // malformed card shape, signature-algorithm allowlist drift.
@@ -684,6 +702,7 @@ module.exports = {
   GuardAuthError:         GuardAuthError,
   DoraError:              DoraError,
   ComplianceError:        ComplianceError,
+  PrivacyError:           PrivacyError,
   SmtpPolicyError:        SmtpPolicyError,
   MailAuthError:          MailAuthError,
   MailArfError:           MailArfError,
@@ -691,6 +710,8 @@ module.exports = {
   SseError:               SseError,
   McpError:               McpError,
   AiInputError:           AiInputError,
+  AiOutputError:          AiOutputError,
+  AiPromptError:          AiPromptError,
   A2aError:               A2aError,
   GraphqlFederationError: GraphqlFederationError,
   Fda21Cfr11Error:        Fda21Cfr11Error,

package/lib/vendor/blamejs/lib/mail-srs.js

@@ -28,15 +28,24 @@
  *     - `local` is the original sender's local-part
  *     - `forwarder.example` is the rewriting forwarder's domain
  *
- *   SRS1 (double-forward case): when an already-SRS0-encoded address
- *   gets forwarded a second time, SRS1 wraps the SRS0 envelope
- *   instead of re-encoding from scratch, preserving the original
- *   sender chain.
+ *   Wire format (SRS1 — the multi-hop chain case):
+ *
+ *     SRS1=HHH=priorForwarder==<SRS0-body>@thisForwarder
+ *
+ *   When an already-SRS0 (or SRS1) address is forwarded again,
+ *   `srs1Rewrite(srsAddress)` wraps it: it keeps the original SRS0
+ *   body verbatim, prepends the preceding forwarder's domain, and
+ *   binds the pair with this forwarder's own HMAC tag — no new
+ *   timestamp, no repeated original local-part. `reverse()` detects
+ *   SRS1, verifies this hop's tag, and unwraps exactly one hop back to
+ *   the prior forwarder's SRS0 address so the bounce re-routes to it.
  *
  *   `b.mail.srs.create({ secret, forwarderDomain })` returns
- *   `{ rewrite, reverse }`. `rewrite(originalSender)` produces the
- *   SRS-encoded address; `reverse(srsAddress)` decodes back to the
- *   original sender + verifies the HMAC.
+ *   `{ rewrite, srs1Rewrite, reverse }`. `rewrite(originalSender)`
+ *   produces the SRS0 address; `srs1Rewrite(srsAddress)` chains a
+ *   further hop as SRS1; `reverse(srsAddress)` decodes an SRS0 back to
+ *   the original sender (verifying HMAC + expiry) or unwraps an SRS1
+ *   one hop back to the prior forwarder.
  *
  * @card
  *   SRS Sender Rewriting Scheme — forwarder envelope-from rewriting with HMAC-bound day-rotated tags so the next-hop SPF check passes and bounces route correctly back to the original sender.
@@ -94,6 +103,34 @@ function _dayDiff(stamp, nowMs) {
   return diff;
 }
 
+// Parse an SRS1 local-part "SRS1=<tag>=<priorForwarder>==<srs0Body>"
+// into its three fields. The 4-char base32 tag and the prior-forwarder
+// domain both carry no "=", so the FIRST "=" ends the tag and the FIRST
+// "==" (which can only fall immediately after the "="-free prior-forwarder
+// domain) ends the prior forwarder — even when the inner SRS0 body carries
+// its own single "=" separators.
+function _parseSrs1(localPart) {
+  var rest = localPart.slice(5);                                                                   // strip "SRS1="
+  var firstEq = rest.indexOf("=");
+  if (firstEq <= 0) {
+    throw new SrsError("srs/malformed",
+      "srs.reverse: SRS1 must be SRS1=tag=priorForwarder==<srs0body>");
+  }
+  var tag = rest.slice(0, firstEq);
+  var afterTag = rest.slice(firstEq + 1);
+  var sep = afterTag.indexOf("==");
+  if (sep <= 0) {
+    throw new SrsError("srs/malformed",
+      "srs.reverse: SRS1 missing the '==' prior-forwarder separator");
+  }
+  var srs0Body = afterTag.slice(sep + 2);
+  if (!srs0Body) {
+    throw new SrsError("srs/malformed",
+      "srs.reverse: SRS1 carries an empty inner SRS0 body");
+  }
+  return { tag: tag, priorForwarder: afterTag.slice(0, sep), srs0Body: srs0Body };
+}
+
 /**
  * @primitive b.mail.srs.create
  * @signature b.mail.srs.create(opts)
@@ -101,7 +138,11 @@ function _dayDiff(stamp, nowMs) {
  * @status    stable
  *
  * Build an SRS rewriter bound to the operator's forwarder domain +
- * HMAC signing secret. Returns `{ rewrite, reverse }`.
+ * HMAC signing secret. Returns `{ rewrite, srs1Rewrite, reverse }` —
+ * `rewrite` produces an SRS0 origin address, `srs1Rewrite` chains an
+ * already-SRS0/SRS1 address as SRS1 for a further forwarding hop, and
+ * `reverse` decodes either form (SRS0 → original sender with HMAC +
+ * expiry checks; SRS1 → the prior forwarder's address, one hop back).
  *
  * @opts
  *   secret:           string,   // operator's HMAC-SHA-256 signing secret (>=32 bytes recommended)
@@ -121,6 +162,11 @@ function _dayDiff(stamp, nowMs) {
  *   // Bounce arrives back at SRS0=...; decode to deliver
  *   var original = srs.reverse(rewritten);
  *   // → "alice@bob.com"
+ *
+ *   // A further forwarding hop chains the already-SRS0 address as SRS1
+ *   var hop2 = srs.srs1Rewrite(rewritten);
+ *   // → "SRS1=HHHH=forwarder.example==HHHH=TT=bob.com=alice@forwarder.example"
+ *   srs.reverse(hop2);   // → the prior-hop SRS0 address, re-routed one hop back
  */
 function create(opts) {
   if (!opts || typeof opts !== "object") {
@@ -158,13 +204,12 @@ function create(opts) {
       throw new SrsError("srs/bad-address",
         "srs.rewrite: localPart / domain exceeds RFC 5321 length cap");
     }
-    // Refuse SRS double-encoding from this primitive — operator must
-    // use srs1Rewrite() for already-SRS0 inputs (deferred per the
-    // v1-defensible decision: SRS1 wrapping is rare in operator
-    // deployments and adds substantial spec surface).
+    // Refuse SRS double-encoding from this primitive — already-SRS0 (or
+    // SRS1) inputs chain through srs1Rewrite(), which keeps the original
+    // SRS0 body verbatim rather than re-stamping it as a fresh origin.
     if (/^SRS[01]=/i.test(localPart)) {
       throw new SrsError("srs/already-rewritten",
-        "srs.rewrite: address already SRS-encoded; chain forwarding through SRS1 is not yet supported (operator demand TBD)");
+        "srs.rewrite: address already SRS-encoded; use srs1Rewrite() to chain a further forwarding hop");
     }
     var now = typeof nowMs === "number" ? nowMs : Date.now();
     var ts  = _dayStamp(now);
@@ -173,6 +218,49 @@ function create(opts) {
     return "SRS0=" + tag + "=" + ts + "=" + domain + "=" + localPart + "@" + forwarderDomain;
   }
 
+  function srs1Rewrite(srsAddress) {
+    validateOpts.requireNonEmptyString(
+      srsAddress, "srs.srs1Rewrite.address", SrsError, "srs/bad-address");
+    var at = srsAddress.lastIndexOf("@");
+    if (at <= 0 || at === srsAddress.length - 1) {
+      throw new SrsError("srs/bad-address",
+        "srs.srs1Rewrite: address must be in localPart@domain form");
+    }
+    var localPart = srsAddress.slice(0, at);
+    // The SRS0 body is kept verbatim across the whole chain (the SRS1
+    // optimization: no new timestamp, no repeated original local-part).
+    // `priorForwarder` is the domain the bounce must ultimately reach to
+    // recover the original sender — i.e. the forwarder that MINTED the
+    // inner SRS0. From an SRS0 input that is its own @domain; from an
+    // SRS1 input (a third or later hop) it is the originator already
+    // recorded in the SRS1, NOT the immediately-preceding forwarder, so
+    // every hop's bounce routes straight back to the SRS0 originator.
+    var priorForwarder, srs0Body;
+    if (/^SRS0=/i.test(localPart)) {
+      priorForwarder = srsAddress.slice(at + 1);
+      srs0Body = localPart.slice(5);
+    } else if (/^SRS1=/i.test(localPart)) {
+      var inner = _parseSrs1(localPart);
+      priorForwarder = inner.priorForwarder;
+      srs0Body = inner.srs0Body;
+    } else {
+      throw new SrsError("srs/not-srs0",
+        "srs.srs1Rewrite: input must be an SRS0 or SRS1 address (use rewrite() for a plain address)");
+    }
+    if (!priorForwarder || priorForwarder.indexOf("=") !== -1) {
+      throw new SrsError("srs/bad-address",
+        "srs.srs1Rewrite: prior forwarder domain must be a non-empty domain without '=' (would corrupt SRS1 field parsing)");
+    }
+    var opaque = priorForwarder + "==" + srs0Body;
+    var tag = _hashTag(secret, opaque);
+    var result = "SRS1=" + tag + "=" + priorForwarder + "==" + srs0Body + "@" + forwarderDomain;
+    if (result.length > 256) {                                                                     // RFC 5321 §4.5.3.1.3 path-length cap
+      throw new SrsError("srs/too-long",
+        "srs.srs1Rewrite: rewritten address exceeds the RFC 5321 256-octet path limit (forwarding chain too deep)");
+    }
+    return result;
+  }
+
   function reverse(srsAddress, nowMs) {
     validateOpts.requireNonEmptyString(
       srsAddress, "srs.reverse.address", SrsError, "srs/bad-address");
@@ -183,13 +271,15 @@ function create(opts) {
     }
     var localPart  = srsAddress.slice(0, at);
     var rcptDomain = srsAddress.slice(at + 1);
-    // Allow case-insensitive SRS0 prefix per the spec. Check this
-    // FIRST so an obviously-non-SRS0 input (`plain@example.com`)
+    // Allow case-insensitive SRS0 / SRS1 prefixes per the spec. Check
+    // this FIRST so an obviously-non-SRS input (`plain@example.com`)
     // gets the specific not-srs0 verdict instead of the more general
     // wrong-forwarder verdict.
-    if (!/^SRS0=/i.test(localPart)) {
+    var isSrs0 = /^SRS0=/i.test(localPart);
+    var isSrs1 = /^SRS1=/i.test(localPart);
+    if (!isSrs0 && !isSrs1) {
       throw new SrsError("srs/not-srs0",
-        "srs.reverse: address local-part does not start with SRS0=");
+        "srs.reverse: address local-part does not start with SRS0= or SRS1=");
     }
     // Domain binding — the rewriter is scoped to a specific forwarder
     // domain, and reverse() must verify the bounce arrived at THAT
@@ -203,6 +293,18 @@ function create(opts) {
         "srs.reverse: bounce addressed to '" + rcptDomain + "' but rewriter " +
         "is bound to forwarderDomain '" + forwarderDomain + "'");
     }
+    if (isSrs1) {
+      var s1 = _parseSrs1(localPart);
+      if (!_timingSafeStringEqual(s1.tag, _hashTag(secret, s1.priorForwarder + "==" + s1.srs0Body))) {
+        throw new SrsError("srs/bad-tag",
+          "srs.reverse: SRS1 HMAC tag does not verify (wrong secret or tampered envelope-from)");
+      }
+      // Unwrap exactly one hop: re-address the bounce to the prior
+      // forwarder's SRS0. That forwarder owns the inner SRS0's tag +
+      // expiry, so we do NOT re-check them here — per the SRS spec each
+      // hop verifies only its OWN hash.
+      return "SRS0=" + s1.srs0Body + "@" + s1.priorForwarder;
+    }
     var rest = localPart.slice(5);
     var parts = rest.split("=");
     if (parts.length < 4) {
@@ -231,8 +333,9 @@ function create(opts) {
   }
 
   return Object.freeze({
-    rewrite:  rewrite,
-    reverse:  reverse,
+    rewrite:      rewrite,
+    srs1Rewrite:  srs1Rewrite,
+    reverse:      reverse,
     forwarderDomain: forwarderDomain,
   });
 }

package/lib/vendor/blamejs/lib/privacy.js

@@ -0,0 +1,168 @@
+"use strict";
+/**
+ * @module b.privacy
+ * @nav    Compliance
+ * @title  Privacy
+ *
+ * @intro
+ *   Privacy-program operational helpers. The first primitive,
+ *   `vendorReview`, builds the annual third-party / EdTech vendor-review
+ *   attestation that FERPA's school-official exception and California's
+ *   SOPIPA expect a school or district to keep on file for every
+ *   processor that touches student data: a dated, clause-by-clause
+ *   record that the vendor uses the data only for the authorized
+ *   educational purpose, runs no targeted advertising or commercial
+ *   profiling, sells nothing, keeps reasonable security safeguards,
+ *   deletes on request, and so on.
+ *
+ *   The builder follows the operator-feeds-metadata pattern: the
+ *   operator supplies the vendor's attested answers and `vendorReview`
+ *   returns a frozen report — `{ attested, gaps, reviewedAt,
+ *   nextReviewDueAt, ... }` — that composes into the operator's own
+ *   retention / audit / export sink. It is not framework-persisted.
+ *
+ * @card
+ *   Privacy-program helpers — annual FERPA / SOPIPA EdTech vendor-review attestation reports (`vendorReview`).
+ */
+
+var lazyRequire = require("./lazy-require");
+var validateOpts = require("./validate-opts");
+var C = require("./constants");
+var { PrivacyError } = require("./framework-error");
+
+var audit = lazyRequire(function () { return require("./audit"); });
+
+// The clause set a FERPA school-official / SOPIPA vendor review attests.
+// Each entry: { id, required, citation, description }. Every `required`
+// clause must be attested true for the review to pass (attested:true).
+var VENDOR_REVIEW_CLAUSES = Object.freeze([
+  Object.freeze({ id: "educationalPurposeOnly",       required: true,  citation: "FERPA 34 CFR 99.31(a)(1)(i)(B)", description: "Vendor uses student data only for the authorized educational purpose under direct school control; no redisclosure." }),
+  Object.freeze({ id: "noTargetedAdvertising",        required: true,  citation: "SOPIPA Cal. B&P 22584(b)(1)",    description: "No targeted advertising to students based on covered information." }),
+  Object.freeze({ id: "noCommercialProfiling",        required: true,  citation: "SOPIPA Cal. B&P 22584(b)(2)",    description: "No amassing of a student profile except in furtherance of K-12 purposes." }),
+  Object.freeze({ id: "noSaleOfStudentData",          required: true,  citation: "SOPIPA Cal. B&P 22584(b)(3)",    description: "No sale or rental of student information." }),
+  Object.freeze({ id: "securitySafeguards",           required: true,  citation: "SOPIPA Cal. B&P 22584(d)(1)",    description: "Reasonable security procedures and practices appropriate to the data's sensitivity." }),
+  Object.freeze({ id: "deletionOnRequest",            required: true,  citation: "SOPIPA Cal. B&P 22584(d)(2)",    description: "Deletes student PII within a reasonable time at the school's or district's request." }),
+  Object.freeze({ id: "subProcessorsCurrent",         required: true,  citation: "FERPA 34 CFR 99.33 (redisclosure)", description: "Sub-processor list is current and each is bound to the same restrictions." }),
+  Object.freeze({ id: "breachNotification",           required: true,  citation: "FERPA 34 CFR 99.31(a)(1) control + state breach law", description: "Notifies the school / district of any security breach without undue delay." }),
+  Object.freeze({ id: "schoolOfficialDesignation",    required: true,  citation: "FERPA 34 CFR 99.31(a)(1)(i)(B)", description: "Vendor is designated a school official with a legitimate educational interest." }),
+  Object.freeze({ id: "directoryInformationHandling", required: false, citation: "FERPA 34 CFR 99.37",             description: "Handles directory information per the school's opt-out notice (only when applicable)." }),
+]);
+
+var CLAUSE_IDS = VENDOR_REVIEW_CLAUSES.map(function (c) { return c.id; });
+
+/**
+ * @primitive  b.privacy.vendorReview
+ * @signature  b.privacy.vendorReview(opts)
+ * @since      0.14.14
+ * @status     stable
+ * @compliance ferpa, ca-sopipa, coppa
+ * @related    b.consent.recognizedPurpose, b.compliance.describe, b.retention
+ *
+ * Build a dated annual third-party / EdTech vendor-review attestation —
+ * the record a FERPA school-official arrangement and California SOPIPA
+ * expect a school or district to keep for every processor of student
+ * data. The operator supplies the vendor's attested answer (a boolean)
+ * per clause; `vendorReview` validates the shape, computes whether every
+ * REQUIRED clause is attested (`attested`) and which are not (`gaps`),
+ * and stamps the review date plus a 365-day `nextReviewDueAt` re-review
+ * clock. Operator-feeds-metadata: the returned report is frozen and is
+ * NOT framework-persisted — compose it into your retention / audit /
+ * export sink. A best-effort `privacy.vendor_review.recorded` audit event
+ * fires when an audit sink is wired.
+ *
+ * @opts
+ *   vendorName:   string,                    // required — the processor under review
+ *   reviewedAt:   number,                    // required — epoch ms of this review
+ *   clauses:      { <clauseId>: boolean },   // attested answer per clause (see listVendorReviewClauses)
+ *   reviewer:     string,                    // optional — who performed the review
+ *   notes:        string,                    // optional — free-text reviewer notes
+ *
+ * @example
+ *   var report = b.privacy.vendorReview({
+ *     vendorName: "Acme LMS",
+ *     reviewedAt: Date.now(),
+ *     clauses: {
+ *       educationalPurposeOnly: true, noTargetedAdvertising: true,
+ *       noCommercialProfiling: true, noSaleOfStudentData: true,
+ *       securitySafeguards: true, deletionOnRequest: true,
+ *       subProcessorsCurrent: true, breachNotification: true,
+ *       schoolOfficialDesignation: true,
+ *     },
+ *   });
+ *   // → { vendorName, reviewedAt, nextReviewDueAt, attested: true, gaps: [], clauses: {...} }
+ */
+function vendorReview(opts) {
+  validateOpts.requireObject(opts, "b.privacy.vendorReview: opts", PrivacyError, "privacy/bad-opts");
+  validateOpts.requireNonEmptyString(opts.vendorName, "b.privacy.vendorReview: opts.vendorName", PrivacyError, "privacy/bad-vendor");
+  if (typeof opts.reviewedAt !== "number" || !isFinite(opts.reviewedAt) || opts.reviewedAt <= 0) {
+    throw new PrivacyError("privacy/bad-reviewed-at",
+      "b.privacy.vendorReview: opts.reviewedAt must be a positive epoch-ms number");
+  }
+  var clauses = opts.clauses || {};
+  validateOpts.requireObject(clauses, "b.privacy.vendorReview: opts.clauses", PrivacyError, "privacy/bad-clauses");
+  // Reject unknown clause keys — a misspelled clause would otherwise
+  // silently never gate.
+  Object.keys(clauses).forEach(function (k) {
+    if (CLAUSE_IDS.indexOf(k) === -1) {
+      throw new PrivacyError("privacy/unknown-clause",
+        "b.privacy.vendorReview: unknown clause '" + k + "' (see b.privacy.listVendorReviewClauses())");
+    }
+  });
+  var resolved = {};
+  var gaps = [];
+  VENDOR_REVIEW_CLAUSES.forEach(function (clause) {
+    var v = clauses[clause.id];
+    // A supplied clause answer must be a boolean (config-time THROW); an
+    // omitted one defaults to not-attested.
+    validateOpts.optionalBoolean(v, "b.privacy.vendorReview: clauses." + clause.id, PrivacyError, "privacy/bad-clause-value");
+    var attestedTrue = v === true;
+    resolved[clause.id] = attestedTrue;
+    if (clause.required && !attestedTrue) gaps.push(clause.id);
+  });
+  var attested = gaps.length === 0;
+  var report = Object.freeze({
+    vendorName:      opts.vendorName,
+    reviewedAt:      opts.reviewedAt,
+    nextReviewDueAt: opts.reviewedAt + C.TIME.days(365),
+    coversPeriod:    Object.freeze({ from: opts.reviewedAt - C.TIME.days(365), to: opts.reviewedAt }),
+    reviewer:        opts.reviewer || null,
+    notes:           opts.notes || null,
+    attested:        attested,
+    gaps:            Object.freeze(gaps),
+    clauses:         Object.freeze(resolved),
+  });
+  try {
+    audit().safeEmit({
+      action:   "privacy.vendor_review.recorded",
+      outcome:  attested ? "success" : "denied",
+      metadata: { vendorName: opts.vendorName, attested: attested, gaps: gaps, reviewedAt: opts.reviewedAt },
+    });
+  } catch (_e) { /* drop-silent — audit is best-effort, never block the builder */ }
+  return report;
+}
+
+/**
+ * @primitive  b.privacy.listVendorReviewClauses
+ * @signature  b.privacy.listVendorReviewClauses()
+ * @since      0.14.14
+ * @status     stable
+ * @related    b.privacy.vendorReview
+ *
+ * Return the frozen FERPA / SOPIPA vendor-review clause set — each entry
+ * is `{ id, required, citation, description }`. Use it to render a review
+ * form or to enumerate the clauses `vendorReview` evaluates.
+ *
+ * @example
+ *   b.privacy.listVendorReviewClauses().map(function (c) { return c.id; });
+ *   // → ["educationalPurposeOnly", "noTargetedAdvertising", ...]
+ */
+function listVendorReviewClauses() {
+  return VENDOR_REVIEW_CLAUSES;
+}
+
+module.exports = {
+  vendorReview:            vendorReview,
+  listVendorReviewClauses: listVendorReviewClauses,
+  VENDOR_REVIEW_CLAUSES:   VENDOR_REVIEW_CLAUSES,
+  PrivacyError:            PrivacyError,
+};