fix: PCH-02-004 exact-pin crypto-adjacent deps (otpauth, pako, @zxing, bwip-js, pdf-lib, papaparse) + WASM-PROVENANCE.md (v4.0.0)

@@ -0,0 +1,54 @@1+# WASM & Crypto-Adjacent Dependency Provenance2+3+Peach's vault security rests on a small set of third-party packages that4+either ship WebAssembly blobs or sit directly on a security path. This file5+records what each one is for and the supply-chain rules that apply to them.6+7+## Exact-pin discipline (LV-9, extended by PCH-02-004)8+9+Every dependency listed below is exact-pinned in `package.json` (no caret or10+tilde ranges) and locked in `bun.lock` with `packageManager` pinned to a11+specific bun release. CI installs with a frozen lockfile (LV-6). Upgrading any12+of them is a deliberate act: bump the pin, regenerate the lockfile, and re-run13+the full suite. It should never happen as a side effect of a fresh resolve.14+15+### WASM-shipping packages16+17+| Package | Pinned | Role |18+|---|---|---|19+| `hash-wasm` | 4.12.0 | Argon2id (master-password KDF) and BLAKE3 (payload checksums, vault id) |20+| `@bokuweb/zstd-wasm` | 0.0.27 | zstd compression inside the encrypted export envelope |21+| `@subspace/reed-solomon-erasure.wasm` | 0.2.5 | Codex paper-backup erasure coding |22+23+### Pure-JS crypto core24+25+| Package | Pinned | Role |26+|---|---|---|27+| `@stablelib/*` (blake2s, chacha20poly1305, hkdf, hmac, sha256, x25519) | 2.0.1 | Noise XX/NK handshakes and transport encryption for LAN sync |28+| `@zxcvbn-ts/*` | 3.0.4 / 3.0.2 | Password strength estimation |29+| `tldts` | 7.0.28 | eTLD+1 derivation for the autofill origin boundary |30+| `pdfjs-dist` | 5.7.284 | Codex PDF import (hardened per MV-9) |31+32+### Crypto-adjacent (exact-pinned by PCH-02-004)33+34+These do not hold key material but feed or transform security-relevant data,35+so the same pin discipline applies:36+37+| Package | Pinned | Role |38+|---|---|---|39+| `otpauth` | 9.5.0 | TOTP code generation (RFC 6238) from stored seeds |40+| `pako` | 2.1.0 | Codex restore-side decompression (bomb-capped per MV-4) |41+| `@zxing/library` | 0.23.0 | Aztec matrix decode on Codex restore |42+| `bwip-js` | 4.11.1 | Aztec matrix encode on Codex generation |43+| `pdf-lib` | 1.17.1 | Codex PDF assembly (note: bundles its own internal `[email protected]`, distinct from the import-side `[email protected]`) |44+| `papaparse` | 5.5.3 | CSV import parsing (formula-injection surface) |45+46+## Verifying a WASM blob47+48+The WASM packages ship compiled binaries; their provenance chain is49+npm-registry integrity hash → `bun.lock` → frozen-lockfile CI. When bumping one,50+diff the package's published source repository tag against the shipped artifact51+where the upstream provides reproducible builds, and re-run the unlock-time52+Known-Answer self-test (`src/background/self-test.ts`) plus the Argon2id KAT53+(`src/crypto/argon2id.kat.test.ts`). A silently-swapped KDF or hash54+implementation fails those vectors.