@blamejs/blamejs-shop 0.0.122 → 0.0.123

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.0.x
 
+- v0.0.123 (2026-05-24) — **Wishlist — save products to your account, with social-proof counts on the product page.** Signed-in customers can now save products to a wishlist from the product page. A "N shoppers saved this" count surfaces social proof, and saved items live on a new account page where they can be removed or reopened. The save control and count render identically on the edge and container paths; the toggle is idempotent (saving twice is a no-op, toggling again removes) and login-gated, since a wishlist is scoped to one customer. **Added:** *Save to wishlist on the product page* — The PDP renders a "Save to wishlist" control and, once any customer has saved it, a "N shoppers saved this" social-proof count. Both render server-side on the edge and container paths. The count is public; the save action requires sign-in. · *`/account/wishlist` — saved items* — A new account page lists the customer's saved products with a thumbnail, a link back to the product, and a Remove control. Entries whose product was archived render as "no longer available" rather than breaking the list (wishlist rows are orphan-tolerant by design). The account dashboard links to it. · *`POST /wishlist/toggle`* — Login-required endpoint that saves the product if it isn't saved and removes it if it is. Idempotent (`INSERT OR IGNORE`). Redirects back to the product by resolving its canonical slug from the product id, or to a safe same-origin `return_to` (the account page's Remove uses it) — a forged or off-site redirect target is rejected.
+
 - v0.0.122 (2026-05-24) — **Product reviews on the storefront — verified-buyer submission, operator moderation, and rich-snippet ratings.** The product page now shows customer reviews: an average rating, a per-star distribution, and the published review list, with `AggregateRating` structured data so star ratings can surface in search results. Submission is gated to signed-in customers who have actually purchased the product — the route confirms a completed order for that product before accepting a review, and re-checks on submit. Reviews land in a pending state; operators publish or reject them through new bearer-token admin endpoints. Display and structured data are identical whether the page is served at the edge or from the container. **Added:** *Reviews on the product page* — The PDP renders an average rating, a per-star distribution bar chart, and the published reviews (newest first, verified-buyer badge, date). Products with no reviews show an invite to be the first. Rendered server-side on both the edge and container paths. · *Verified-buyer review submission* — `GET /products/:slug/review` shows the review form to a signed-in customer who has purchased the product; everyone else is redirected to sign in or told only verified buyers can review. `POST /products/:slug/review` re-checks the purchase before accepting the review, so a direct POST can't bypass the gate. Submitted reviews start pending. · *Operator review moderation* — `GET /admin/reviews?status=pending` lists the moderation queue across all products; `GET /admin/reviews/:id` reads one; `POST /admin/reviews/:id/publish` and `POST /admin/reviews/:id/reject` move it. Bearer-token-gated like the rest of the admin API. Pending and rejected reviews never appear on the storefront. · *`AggregateRating` structured data* — The product page emits Schema.org `AggregateRating` (rating value + review count) nested in the existing `Product` JSON-LD when published reviews exist, so eligible products can show star ratings in search results. Omitted entirely at zero reviews to stay valid. The container render path now emits the full `Product` + `AggregateOffer` + `BreadcrumbList` JSON-LD that the edge already did. · *`order.hasPurchasedProduct(customerId, productId)`* — Existence check — true when the customer has an order line for any variant of the product in an order that reached `paid` or later (excludes `pending` and `cancelled`). Backs the review purchase gate. · *`reviews.listByStatus(status, opts)`* — Lists reviews across all products by status, newest first, with the same opaque tuple cursor as `listForProduct`. Backs the admin moderation queue.
 
 - v0.0.121 (2026-05-24) — **Codebase-patterns detector blocks SHA3 primitives in `worker/` — prevents the regression that broke newsletter signup.** v0.0.120 fixed the newsletter signup by routing the POST to the container instead of computing `b.crypto.namespaceHash` (SHA3-512) at the edge — Workers' `nodejs_compat` doesn't expose SHA3-family digests. New `worker-uses-sha3-primitive` codebase-patterns detector flags any `b.crypto.{sha3Hash, hmacSha3, namespaceHash, shake256, shake512, hkdfSha3}(...)` call under `worker/` so the next operator can't re-introduce the substrate-mismatch bug. Catalog grows 121 → 122. Detector targets the exact SHA3-family primitive names rather than a general regex match — Worker code that legitimately uses `b.crypto.toBase64Url`, `b.crypto.timingSafeEqual`, `b.crypto.generateBytes`, `b.crypto.hmacSha256` (the Stripe webhook augment), etc. is unaffected. **Added:** *`worker-uses-sha3-primitive` detector* — Flags `b.crypto.sha3Hash(...)`, `hmacSha3(...)`, `namespaceHash(...)`, `shake256(...)`, `shake512(...)`, and `hkdfSha3(...)` in any file under `worker/`. Catches the substrate-mismatch class that broke v0.0.92's edge newsletter handler (live for 28 versions before being routed back to the container in v0.0.120). When edge code needs a stable hash: route to the container OR use `b.crypto.hmacSha256` IFF both sides read with the same SHA-256 path. Never have one substrate write SHA3 and another read SHA-256 — silent divergence breaks cross-substrate lookups (e.g. unsubscribe-by-email_hash).

package/README.md

@@ -64,6 +64,7 @@ Every primitive is composed on the vendored blamejs surface — no npm runtime d
 | **`lib/storefront.js`** | Server-rendered HTML — utility bar + sticky header + dark hero with code-preview card + primitives marquee + featured-product callout + collections grid + framework feature band + designed catalog grid + newsletter band + four-column footer. Designed surfaces also for PDP, cart, checkout, pay, order, account login / register / dashboard, search results, `/admin` API landing, 404. Image-bearing cards on the home + search grids pull from `catalog.media`. The default theme stylesheet is external (R2-served `themes/default/assets/css/main.css`) and CSP-compliant — operators override by uploading a replacement at the same key, by passing `opts.theme_css` to renderers, or by registering a named theme through the `theme` primitive. |
 | **`lib/customers.js`** | Customer accounts — passkey-only (WebAuthn). Email is stored hash-only (`b.crypto.namespaceHash` namespace `customer-email`); the raw address never lands in D1. Passkey credentials carry CBOR-encoded public keys, transport hints, and SHA3-512-fingerprinted attestation. Account routes (`/account/login`, `/account/register`, `/account`) ship as designed cards on the storefront. |
 | **`lib/reviews.js`** | Operator-moderated product ratings. Submission requires a signed-in customer **and** a verified purchase — `/products/:slug/review` confirms a completed order for the product (via `order.hasPurchasedProduct`) before accepting, re-checked on POST; reviews land `pending`. Author identity is hash-only (`b.crypto.namespaceHash`); the raw email is never stored. The PDP renders the average, per-star distribution, and published reviews with `AggregateRating` JSON-LD. `/admin/reviews` is the moderation queue (`listByStatus` → publish / reject). |
+| **`lib/wishlist.js`** | Per-customer saved products. The PDP renders a login-gated "Save to wishlist" toggle and a "N shoppers saved this" social-proof count; `/account/wishlist` lists saved items (remove + reopen, orphan-tolerant when a product is archived). `POST /wishlist/toggle` is idempotent (`INSERT OR IGNORE`) and redirects to the canonical product slug or a safe same-origin `return_to`. UUID-shape-validated ids, `b.pagination` HMAC cursors. |
 | **`lib/subscriptions.js`** | Stripe-backed recurring billing — `subscription_plans` (interval / amount / trial) + `subscriptions` (mirrors Stripe's object byte-for-byte). `subscriptions.create` POSTs to Stripe via the payment dep, then persists the returned object locally. `handleStripeEvent` replays `customer.subscription.*` events into the local row so the shop has an authoritative view without round-tripping. |
 | **`lib/newsletter.js`** | Operator-collected email broadcast list — `signup({ email, source })` composes `b.guardEmail` for shape validation, `b.crypto.namespaceHash` for the dedup key, and `INSERT OR IGNORE` for idempotency. Storefront POST `/newsletter` route renders a designed thank-you card with separate copy for the `new` vs `dedup` branches. |
 | **`lib/admin.js`** | Bearer-token-gated CRUD over catalog + orders + refunds + bulk CSV import + subscription plans + review moderation. Token compared via `b.crypto.timingSafeEqual`. Errors as RFC 9457 problem documents via `b.problemDetails`. Audit emission on every mutation. |
@@ -82,6 +83,7 @@ Every primitive is composed on the vendored blamejs surface — no npm runtime d
 - `migrations-d1/0009_subscriptions.sql` — subscription_plans + subscriptions (Stripe-mirrored)
 - `migrations-d1/0010_newsletter_signups.sql` — email signups with hash-based dedup
 - `migrations-d1/0011_reviews.sql` — operator-moderated product reviews (hash-only author identity)
+- `migrations-d1/0012_wishlist.sql` — per-customer saved products (unique customer + product + variant)
 
 ### Demo seed
 

package/SECURITY.md

@@ -92,8 +92,8 @@ node -e "
 
 | Purpose                           | Algorithm  | Fingerprint               |
 |-----------------------------------|------------|---------------------------|
-| Maintainer commit/tag signing key | SSH-ED25519 | *(populate on first signed tag — see below)* |
-| Release-signing public key        | ML-DSA-65 (FIPS 204) | `0d9d241e23c333201911afd6d6d0b0ba9a2feb4f60bf5fdd976bb33e0678f7ff0ec3db816c3cb2d9caf50c681caf8b04939ffe8cf4652eae9e6c90c988bfb87e` (SHA3-512 of `keys/release-pqc-pub.json#publicKey`) |
+| Maintainer commit/tag signing key | SSH-ED25519 | `SHA256:5oF/XWhFpMde9TRfEX2GAHiApAq/MXOS4vti5zQbD7g` (cross-check against `https://github.com/<maintainer>.keys` — see below) |
+| Release-signing public key        | ML-DSA-65 (FIPS 204) | `d40e1e2b06a2509271cc3cf76bd34c63d2fbb093f42e1e1f6b349288900ec044509ca183b3d735cda003d80eb6cf5d80fd9181ad897889e1c1f701d61b7902c9` (SHA3-512 of `keys/release-pqc-pub.json#publicKey`) |
 
 To populate the maintainer SSH fingerprint:
 ```

package/lib/storefront.js

@@ -676,6 +676,7 @@ var PRODUCT_PAGE =
   "          </table>\n" +
   "        </div>\n" +
   "      </div>\n" +
+  "      RAW_WISHLIST_PLACEHOLDER\n" +
   "    </div>\n" +
   "  </div>\n" +
   "  RAW_REVIEWS_PLACEHOLDER\n" +
@@ -900,6 +901,93 @@ function _reviewMessagePage(opts, heading, message, cta) {
   });
 }
 
+// Remove control for a wishlist entry — a form POST back through the
+// toggle route with `return_to` so the customer lands back on the
+// account page (not the product PDP the default toggle returns to).
+function _wishlistRemoveForm(productId, esc) {
+  return "<form class=\"wishlist-item__remove\" method=\"post\" action=\"/wishlist/toggle\">" +
+           "<input type=\"hidden\" name=\"product_id\" value=\"" + esc(productId) + "\">" +
+           "<input type=\"hidden\" name=\"return_to\" value=\"/account/wishlist\">" +
+           "<button type=\"submit\" class=\"btn-ghost btn-ghost--sm\">Remove</button>" +
+         "</form>";
+}
+
+// Account "Saved items" page. `opts.items` is a resolved list:
+// { product, hero_media } for live products, or { product: null,
+// product_id } for entries whose product was archived/deleted (the
+// wishlist row is orphan-tolerant by design — render "unavailable",
+// never crash the listing).
+function renderWishlist(opts) {
+  var esc = _b().template.escapeHtml;
+  var items = opts.items || [];
+  var prefix = opts.asset_prefix || "/assets/";
+  var rowsHtml = "";
+  for (var i = 0; i < items.length; i += 1) {
+    var it = items[i];
+    if (!it.product) {
+      rowsHtml +=
+        "<li class=\"wishlist-item wishlist-item--gone\">" +
+          "<span class=\"wishlist-item__title\">This item is no longer available.</span>" +
+          _wishlistRemoveForm(it.product_id, esc) +
+        "</li>";
+      continue;
+    }
+    var slug = esc(it.product.slug);
+    var thumb = it.hero_media
+      ? "<img src=\"" + esc(prefix + it.hero_media.r2_key) + "\" alt=\"" + esc(it.hero_media.alt_text || it.product.title) + "\" loading=\"lazy\">"
+      : "<span class=\"wishlist-item__mark\" aria-hidden=\"true\">" + esc((it.product.title || "?").trim().charAt(0).toUpperCase() || "?") + "</span>";
+    rowsHtml +=
+      "<li class=\"wishlist-item\">" +
+        "<a class=\"wishlist-item__media\" href=\"/products/" + slug + "\">" + thumb + "</a>" +
+        "<div class=\"wishlist-item__body\">" +
+          "<a class=\"wishlist-item__title\" href=\"/products/" + slug + "\">" + esc(it.product.title) + "</a>" +
+          "<a class=\"wishlist-item__view card-link\" href=\"/products/" + slug + "\">View product →</a>" +
+        "</div>" +
+        _wishlistRemoveForm(it.product.id, esc) +
+      "</li>";
+  }
+  var inner = rowsHtml
+    ? "<ul class=\"wishlist-list\">" + rowsHtml + "</ul>"
+    : "<p class=\"wishlist-empty\">You haven't saved anything yet. Browse the shop and tap <strong>Save to wishlist</strong> on products you want to keep an eye on.</p>";
+  var body =
+    "<section class=\"account-wishlist\">" +
+      "<nav class=\"breadcrumb\" aria-label=\"Breadcrumb\"><ol>" +
+        "<li><a href=\"/account\">Account</a></li>" +
+        "<li aria-current=\"page\">Saved items</li>" +
+      "</ol></nav>" +
+      "<h1 class=\"account-wishlist__title\">Saved items</h1>" +
+      inner +
+    "</section>";
+  return _wrap({
+    title:      "Saved items",
+    shop_name:  opts.shop_name || "blamejs.shop",
+    cart_count: opts.cart_count == null ? 0 : opts.cart_count,
+    theme_css:  opts.theme_css,
+    body:       body,
+  });
+}
+
+// Product-level "Save to wishlist" control + social-proof count.
+// Byte-compatible with the edge renderer (`worker/render/product.js`)
+// so both paths emit identical markup. Action-only label — the toggle
+// route resolves add/remove server-side against the sealed session.
+function _buildWishlist(productId, count) {
+  var esc = _b().template.escapeHtml;
+  var n = Number(count) || 0;
+  var countHtml = n > 0
+    ? "<span class=\"wishlist__count\">" + n + (n === 1 ? " shopper saved this" : " shoppers saved this") + "</span>"
+    : "";
+  return "<div class=\"wishlist\">" +
+           "<form class=\"wishlist__form\" method=\"post\" action=\"/wishlist/toggle\">" +
+             "<input type=\"hidden\" name=\"product_id\" value=\"" + esc(productId) + "\">" +
+             "<button type=\"submit\" class=\"btn-secondary wishlist__btn\">" +
+               "<span class=\"wishlist__heart\" aria-hidden=\"true\">♡</span> Save to wishlist" +
+             "</button>" +
+           "</form>" +
+           countHtml +
+         "</div>";
+}
+
 // Schema.org JSON-LD block. JSON.stringify covers the standard escapes;
 // the `</` → `<\/` rewrite neutralises any literal `</script>` in a
 // value. Mirrors the edge renderer's `jsonLdScript`.
@@ -933,6 +1021,7 @@ function renderProduct(opts) {
       // theme's `{{{ reviews_html }}}` raw slot. The bundled themes
       // include the slot; a custom theme opts in by adding it.
       reviews_html:   _buildReviews(opts.review_summary, opts.reviews, opts.review_cta),
+      wishlist_html:  _buildWishlist(opts.product.id, opts.wishlist_count),
       asset_css_main: opts.theme.assetUrl("css/main.css"),
     });
   }
@@ -942,6 +1031,7 @@ function renderProduct(opts) {
   if (!rows) rows = "<tr><td colspan=\"4\" class=\"empty\">No variants available.</td></tr>";
   var galleryHtml = _buildPdpGallery(opts.product, opts.media || [], opts.asset_prefix || "/assets/");
   var reviewsHtml = _buildReviews(opts.review_summary, opts.reviews, opts.review_cta);
+  var wishlistHtml = _buildWishlist(opts.product.id, opts.wishlist_count);
   var body = _render(PRODUCT_PAGE, {
     title:        opts.product.title,
     description:  description,
@@ -949,6 +1039,7 @@ function renderProduct(opts) {
   })
     .replace("RAW_GALLERY_PLACEHOLDER", galleryHtml)
     .replace("RAW_ROWS_PLACEHOLDER", rows)
+    .replace("RAW_WISHLIST_PLACEHOLDER", wishlistHtml)
     .replace("RAW_REVIEWS_PLACEHOLDER", reviewsHtml);
   // Product-specific OpenGraph + Twitter Card values so shares
   // unfurl as "Operator Tee — blamejs.shop" with the SVG hero, not
@@ -1795,7 +1886,10 @@ var ACCOUNT_DASH_PAGE =
   "      <h1 class=\"section-head__title\">Hi, {{display_name}}</h1>\n" +
   "      <p class=\"section-head__lede\">Your orders + account controls. Every order ships from origin with a Stripe-secured receipt.</p>\n" +
   "    </div>\n" +
-  "    <form method=\"post\" action=\"/account/logout\"><button type=\"submit\" class=\"btn-ghost\">Sign out</button></form>\n" +
+  "    <div class=\"account-dash__actions\">\n" +
+  "      <a class=\"btn-secondary\" href=\"/account/wishlist\">Saved items</a>\n" +
+  "      <form method=\"post\" action=\"/account/logout\"><button type=\"submit\" class=\"btn-ghost\">Sign out</button></form>\n" +
+  "    </div>\n" +
   "  </header>\n" +
   "  <dl class=\"account-dash__stats\">\n" +
   "    <div><dt>Orders</dt><dd>{{order_count}}</dd></div>\n" +
@@ -2061,6 +2155,13 @@ function mount(router, deps) {
       reviewCta = "<a class=\"btn-secondary reviews__cta\" href=\"/products/" +
         _b().template.escapeHtml(product.slug) + "/review\">Write a review</a>";
     }
+    // Wishlist social-proof count — degrades to 0 on a read failure
+    // (e.g. table not yet migrated) rather than 500-ing the PDP.
+    var wishlistCount = 0;
+    if (deps.wishlist) {
+      try { wishlistCount = await deps.wishlist.countForProduct(product.id); }
+      catch (_e) { wishlistCount = 0; }
+    }
     var html = renderProduct({
       product:        product,
       variants:       variants,
@@ -2069,6 +2170,7 @@ function mount(router, deps) {
       review_summary: reviewSummary,
       reviews:        reviewRows,
       review_cta:     reviewCta,
+      wishlist_count: wishlistCount,
       shop_name:      shopName,
       cart_count:     cartCount,
       theme:          theme,
@@ -2607,6 +2709,82 @@ function mount(router, deps) {
       return res.end ? res.end() : res.send("");
     });
 
+    // Wishlist — saved products scoped to the logged-in customer.
+    // Mounts when the wishlist primitive is wired.
+    if (deps.wishlist) {
+      // POST /wishlist/toggle — add the product if not saved, remove it
+      // if already saved. Login required (the wishlist is per-customer).
+      // Redirects to `return_to` when it's a safe same-origin path
+      // (the account page's Remove uses it), otherwise back to the
+      // product PDP (the canonical slug is resolved from product_id, so
+      // a forged slug can't drive an open redirect).
+      router.post("/wishlist/toggle", async function (req, res) {
+        var auth;
+        try { auth = _currentCustomer(req); }
+        catch (e) {
+          if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
+          throw e;
+        }
+        if (!auth) {
+          res.status(303); res.setHeader && res.setHeader("location", "/account/login");
+          return res.end ? res.end() : res.send("");
+        }
+        var productId = (req.body || {}).product_id;
+        try {
+          var already = await deps.wishlist.isWishlisted({ customer_id: auth.customer_id, product_id: productId });
+          if (already) await deps.wishlist.remove({ customer_id: auth.customer_id, product_id: productId });
+          else         await deps.wishlist.add({ customer_id: auth.customer_id, product_id: productId });
+        } catch (e) {
+          res.status(e instanceof TypeError ? 400 : 500);
+          return res.end ? res.end((e && e.message) || "Error") : res.send((e && e.message) || "Error");
+        }
+        var rt = (req.body || {}).return_to;
+        var dest;
+        if (typeof rt === "string" && /^\/[^/]/.test(rt)) {
+          dest = rt;
+        } else {
+          var product = null;
+          try { product = await deps.catalog.products.get(productId); } catch (_e) { product = null; }
+          dest = product ? ("/products/" + encodeURIComponent(product.slug)) : "/account/wishlist";
+        }
+        res.status(303); res.setHeader && res.setHeader("location", dest);
+        return res.end ? res.end() : res.send("");
+      });
+
+      // GET /account/wishlist — the customer's saved items. Each entry
+      // resolves its product + hero image; an entry whose product was
+      // archived renders as "unavailable" (the row is orphan-tolerant).
+      router.get("/account/wishlist", async function (req, res) {
+        var auth;
+        try { auth = _currentCustomer(req); }
+        catch (e) {
+          if (e && e.code === "vault/not-initialized") return _serviceUnavailable(res, "auth not configured");
+          throw e;
+        }
+        if (!auth) {
+          res.status(303); res.setHeader && res.setHeader("location", "/account/login");
+          return res.end ? res.end() : res.send("");
+        }
+        var page = await deps.wishlist.listForCustomer(auth.customer_id, { limit: 50 });
+        var items = [];
+        for (var i = 0; i < page.rows.length; i += 1) {
+          var entry = page.rows[i];
+          var product = null;
+          try { product = await deps.catalog.products.get(entry.product_id); } catch (_e) { product = null; }
+          if (!product) { items.push({ product: null, product_id: entry.product_id }); continue; }
+          var media = await deps.catalog.media.listForProduct(product.id);
+          items.push({ product: product, hero_media: media.length ? media[0] : null });
+        }
+        var cartCount = await _cartCountForReq(req);
+        _send(res, 200, renderWishlist({
+          items:        items,
+          shop_name:    shopName,
+          cart_count:   cartCount,
+          asset_prefix: deps.asset_prefix || "/assets/",
+        }));
+      });
+    }
+
     // Product reviews — submission requires a logged-in customer AND a
     // verified purchase of the product (the gate, not just a badge).
     // Only mounts when both the reviews primitive and an order handle

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.12.28",
-      "tag": "v0.12.28",
+      "version": "0.12.29",
+      "tag": "v0.12.29",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.12.x
 
+- v0.12.29 (2026-05-24) — **`b.ai.dp` — float-safe differential privacy: snapping-mechanism Laplace + discrete Gaussian + Rényi-DP budgets.** Differential privacy adds calibrated noise so an aggregate is provably insensitive to any single record — but the guarantee is fragile: Mironov (2012) showed that a Laplace mechanism sampled with naive double-precision floats lets an attacker distinguish neighbouring datasets with > 35% probability from a single output, silently destroying the promise. `b.ai.dp` ships only mechanisms whose sampling is hardened against that attack class: Laplace via the snapping mechanism (clamp + CSPRNG sign + full-mantissa uniform + power-of-two-grid rounding) and the discrete Gaussian (Canonne–Kamath–Steinke 2020) via integer-exact rejection sampling built from Bernoulli(exp(−γ)) over exact rationals — no floating-point noise at all. All randomness comes from `b.crypto.generateBytes` (SHAKE256 over the OS CSPRNG), never `Math.random`. `b.ai.dp.budget({ scope, epsilon, delta })` tracks a privacy budget per scope and refuses a `consume` that would exceed it, accounting composition either by basic summation (default) or a Rényi-DP accountant (Mironov 2017) for a much tighter bound under repeated Gaussian releases. NIST SP 800-226 (2025) is the evaluation standard; Dwork & Roth is the canonical reference. The exponential and sparse-vector mechanisms are deferred-with-condition — their float-safe constructions (base-2 / permute-and-flip; snapped SVT) re-open on operator demand, since shipping them float-unsafe would defeat the module's purpose. **Added:** *`b.ai.dp.mechanism({ type, sensitivity, epsilon, ... })` — float-safe noise mechanisms* — `type: "laplace"` is the snapping mechanism (pure ε-DP, real-valued, requires a clamp `bound` the guarantee depends on); `type: "gaussian"` is the discrete Gaussian (integer-valued, (ε, δ)-DP, requires `delta`). The Gaussian uses the classic calibration σ = √(2 ln(1.25/δ))·Δ/ε, proven for ε ≤ 1 — larger ε is refused with a pointer to splitting the release under an rdp budget. Descriptors are validated + frozen at construction so a malformed parameter fails fast. · *`b.ai.dp.budget({ scope, epsilon, delta, accounting })` — per-scope privacy budget* — Returns `{ consume, remaining, spent, reset }`. `consume(mechanism, value)` adds the mechanism's noise, charges the accountant, and throws `aiDp/budget-exhausted` if the release would push the scope past its (ε, δ). `accounting: "basic"` (default) sums per-release ε and δ; `accounting: "rdp"` runs a Rényi-DP accountant across a grid of orders and converts to (ε, δ) at the scope's δ for a tight composition bound under repeated Gaussian releases (requires `delta > 0`). The scope budget is enforced on both ε and δ independently. **Security:** *`b.crypto.generateBytes` uniformity fix at 1-byte length* — Node's SHAKE256 XOF is non-uniform at `outputLength: 1` — the byte values 0x00 and 0xff never occur and the low bit skews to ~0.54. `b.crypto.generateBytes(1)` (and the underlying `random(1)`) now draws at least 2 bytes and slices, so a single-byte CSPRNG request is uniform. Surfaced by `b.ai.dp` per-byte noise sampling; any per-byte consumer of `generateBytes` inherits the fix. A regression test asserts 0x00 / 0xff occur and the low bit is balanced.
+
 - v0.12.28 (2026-05-24) — **`b.ai.capability` — model-capability registry + cheapest-satisfying-model router.** `b.ai.capability.create({ models })` turns a fleet of AI model descriptors into a routing decision: given a set of requirements (context window, input/output modalities, tool use, structured output, reasoning tier, citation support, prompt-caching size), it picks the cheapest model that satisfies all of them. NIST AI RMF (AI 100-1) MAP 2.x requires documenting each model's capabilities and limitations; the Model Cards convention (Mitchell et al., 2019) formalizes that descriptor — this primitive makes the descriptor actionable. Routing to the cheapest sufficient model is a front-line defense against over-provisioning spend and composes directly with `b.ai.quota`'s `cost-usd` dimension (the chosen descriptor's rate feeds the budget charge); refusing to route a request to a model that cannot satisfy it (missing modality, too-small context window, no tool use) catches a capability mismatch before the inference call burns tokens on a guaranteed-bad result. Cost ranking uses a supplied `costBasis` (`{ inputTokens, outputTokens }`) for real per-call spend, else the sum of the per-1k rates; ties break by model id so the choice is deterministic across calls and nodes. **Added:** *`b.ai.capability.create({ models })` — capability registry + router* — Returns `{ describe, list, register, satisfies, route }`. A descriptor carries `maxContextTokens`, `maxOutputTokens`, `modalitiesIn` / `modalitiesOut` (arrays), `toolUse`, `structuredOutput`, `fineTunable`, `reasoningTier` (`none` / `basic` / `standard` / `advanced`, ordered), `citationSupport`, `promptCachingMaxTokens`, and the cost rates `costPer1kInputTokens` / `costPer1kOutputTokens`. Descriptors are validated + frozen at registration so a typo (negative cost, unknown reasoning tier, non-array modality list) surfaces at config time rather than as a silent mis-route. `describe(modelId)` returns the frozen descriptor; `register(modelId, descriptor)` adds or replaces one at runtime. · *`route({ requirements, fallback?, costBasis? })` — cheapest-satisfying selection* — Collects every model whose descriptor satisfies all requirements, then returns the cheapest (`{ modelId, descriptor, estimatedCost, reason }`). Requirements: `minContextTokens`, `minOutputTokens`, `modalitiesIn` / `modalitiesOut` (model must support every listed modality), `toolUse`, `structuredOutput`, `fineTunable`, `minReasoningTier` (tier ordering — `standard` is met by `standard` or `advanced`), `citationSupport`, `minPromptCachingTokens`. When no model matches, `fallback` (a registered model id) is returned with `reason: "fallback"`, or the call refuses with `aiCapability/no-candidate` if no fallback was supplied. Routing decisions emit `ai/capability-routed` / `ai/capability-fallback` / `ai/capability-no-candidate` through the drop-silent audit chain. · *`satisfies(modelId, requirements)` — precise capability-mismatch reasons* — Returns `{ ok, failures }` where each failure names the `requirement`, the `need`, and what the model `have`s — so a caller surfaces a precise reason (e.g. `minReasoningTier need advanced have basic`) instead of a bare boolean. Use it to explain a routing miss or to gate a request against a specific model before calling it.
 
 - v0.12.27 (2026-05-24) — **`b.ai.quota` — per-tenant, per-model AI usage budgets with atomic consume-and-check.** `b.ai.quota.create(opts)` builds an enforcer that caps AI inference usage per `(tenant, model, dimension, period)` and defends OWASP LLM Top 10 2025 LLM10 (Unbounded Consumption) — the class that includes denial-of-wallet, where an attacker drives a high volume of pay-per-use inferences until the bill itself is the attack. Meter by `tokens`, `requests`, `cost-usd`, or `compute-hours` over a calendar-aligned UTC window (`second` through `month`). `consume(tenant, model, amount)` is a single atomic check-and-charge: under the default `hard` enforcement it reserves the amount only if it fits under the ceiling, otherwise it refuses without charging — the limit test and the charge are one indivisible operation, so there is no charge-then-refund window for a concurrent call to observe. The in-memory counter is per-process; multi-node deployments supply an `opts.store` adapter whose `reserve` (an atomic conditional test-and-charge — a Redis Lua script, a SQL `UPDATE ... WHERE used + :amt <= :limit RETURNING used`) and `add` are atomic on the shared backend to enforce one aggregate ceiling across the cluster without false denials under contention. Limit resolution is most-specific-first: `perTenantModel` over `perTenant` over `perModel` over the default `limit`; tenant and model identifiers are percent-encoded into the counter key so a hostile tenant name cannot collide with another tenant's budget. **Added:** *`b.ai.quota.create(opts)` — per-tenant AI usage-budget enforcer* — Returns `{ consume, check, snapshot, reset }` scoped to one `dimension` (`tokens` / `requests` / `cost-usd` / `compute-hours`) and one `period` (`second` / `minute` / `hour` / `day` / `week` (Monday-aligned) / `month` (1st-of-month), all UTC-aligned). `consume(tenant, model, amount, opts?)` returns `{ used, limit, remaining, allowed, exceeded, windowStart, resetsAt, ... }`. `check(tenant, model)` is the read-only snapshot. Spin up one enforcer per dimension you meter — a monthly `cost-usd` budget and a per-minute `tokens` burst cap coexist as two `create()` calls sharing one store. Defends OWASP LLM10:2025 Unbounded Consumption / denial-of-wallet; maps to NIST AI RMF (AI 100-1) MANAGE 2.x and EU AI Act Art. 15 (robustness / resource-exhaustion resilience). · *`hard` / `soft` / `warn` enforcement* — `hard` (default) refuses the over-budget call and throws `aiQuota/exceeded` without charging — the rejected reservation is refunded so the counter is untouched. `soft` admits the charge but reports `allowed: false` so the caller decides whether to honor it. `warn` admits and allows (advisory), flagging `exceeded: true`. A per-call `consume(..., { enforcement })` override lets one endpoint soften the mode for a trusted internal caller without a second enforcer. Every over-budget event emits `ai/quota-exceeded` through the drop-silent audit chain (`ai/quota-applied` on success), tagged with the active cluster node id for attribution. · *Cross-node aggregate budgets via `opts.store`* — The default counter is in-memory (per-process). Supply `opts.store` exposing atomic `reserve` / `add` / `get` / `reset` (a Redis Lua script, a shared SQL row) and the ceiling is enforced on the cluster-wide aggregate. `hard` mode goes through `reserve`, an atomic conditional test-and-charge that adds the amount only if it fits — so a concurrent over-budget call cannot transiently inflate the counter and falsely deny a smaller call that should fit. Per-tenant and per-model limit overrides (`perTenant` / `perModel` / `perTenantModel`) are validated at config time so a malformed cap surfaces at boot, not as a silent fall-through to the default.

package/lib/vendor/blamejs/README.md

@@ -182,6 +182,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 - **Audit + segregation** — 21 CFR Part 11 §11.10(e) audit-content gate + §11.50(b) electronicSignature (`b.fda21cfr11`); PCI DSS 4.0 Req 10.4.1.1 daily-review automation (`b.auditDailyReview`); SOX §404 + SOC 2 CC1.3 segregation-of-duties via Postgres trigger DDL (`b.audit.bindActor`, `b.audit.assertSegregation`)
 - **Change control + WORM** — m-of-n approver DDL change-control with maintenance-window + ML-DSA-87 signed proposals (`b.ddlChangeControl`); row-level WORM triggers boot-asserted under `sec-17a-4` / `finra-4511` / `fda-21cfr11` (`b.db.declareWorm`); dual-control physical delete + crypto-erase + REINDEX in one transaction (`b.db.declareRequireDualControl`, `b.db.eraseHard`)
 - **Consumer-protection** — FTC click-to-cancel UX-parity attestation (`ftc-2024` / `ca-sb942` / `strict`) (`b.darkPatterns`)
+- **Differential privacy** — float-safe DP for aggregate releases: snapping-mechanism Laplace (Mironov 2012) + discrete Gaussian (Canonne–Kamath–Steinke 2020), CSPRNG noise, per-scope ε/δ budgets with basic + Rényi-DP accounting; defends the floating-point distinguishing attack that breaks naive Laplace samplers (NIST SP 800-226) (`b.ai.dp`)
 - **Privacy / DSR** — GDPR Articles 15–22 / CCPA / CPRA / LGPD / PIPEDA data-subject-rights workflow (`b.dsr`); IAB TCF v2.3 consent-string parser + `disclosedVendors` validator (`b.iabTcf`); IAB MSPA / GPP universal-opt-out (USNAT / USCA / USVA / USCO / USCT / USUT) + GPC mirror (`b.iabMspa`); generic consent capture + withdrawal (`b.consent`)
 - **Incident reporters** — EU DORA Article 17 ICT-incident workflow per Commission Delegated Regulation 2024/1772 (`b.dora`); EU NIS2 (`b.nis2`); EU Cyber Resilience Act SBOM + secure-software-attestation (`b.cra`); SEC Form 8-K Item 1.05 cybersecurity-incident materiality-disclosure (`b.secCyber`); incident lifecycle coordinator (`b.incident`)
 - **Outbound DLP** — interceptor-installed on httpClient + mail + webhook with built-in detectors for PAN (Luhn), SSN, EIN, IBAN (mod-97), api-key shapes, PEM, SSH private keys, JWTs, AWS access keys, PHI composite; refuse / redact / audit-only verdicts under pci-dss / hipaa / fapi2 / soc2 / gdpr presets (`b.redact.installOutboundDlp`)

package/lib/vendor/blamejs/SECURITY.md

@@ -342,6 +342,7 @@ This is the minimum-viable security posture for a production deployment. The fra
 - [ ] For OAuth / OIDC RP callbacks: call `b.auth.oauth.parseCallback(query, opts?)` BEFORE consuming `code` — validates RFC 9207 AS Issuer Identifier (refuses iss-mismatch + OP `error=` redirects + state-mismatch CSRF). For FAPI 2.0 deployments add `b.fapi2.assertCallback(query)` (refuses missing iss; refuses bare-param under `fapi-2.0-message-signing` posture, requiring JARM `response`) and `b.fapi2.assertAuthzRequest(authzParams)` BEFORE issuing the redirect (refuses non-JAR authorization requests). For refresh-token flows, pass `seen({ jti, iss })` to `b.auth.oauth.refreshAccessToken` so reuse of an already-rotated token refuses BEFORE the HTTP exchange (RFC 9700 §4.13 / OAuth 2.1 §6.1)
 - [ ] For Model Context Protocol servers exposing tools to LLM agents: wire `b.mcp.toolResult.sanitize(result, { posture: "refuse" })` over EVERY tool output before returning it to the model — defends OWASP LLM07 (sensitive tool output / prompt-injection echo back into the agent loop), refuses dangerous-HTML + off-allowlist URLs. Wrap each tool's input handler with `b.mcp.validateToolInput(toolName, input, schema)` (JSON Schema 2020-12 subset — `type` / `properties` / `required` / `enum` / `const` / length + range caps) so an LLM-supplied argument shape that doesn't match refuses BEFORE the tool runs. Define each tool's required scopes via `b.mcp.capability.create(scopes)` and gate execution on `cap.satisfiedBy(grantedScopes)` (LLM08 least-privilege)
 - [ ] For AI inference endpoints (especially pay-per-use provider models): wire `b.ai.quota.create({ dimension, period, limit, enforcement: "hard" })` and call `quota.consume(tenant, model, amount)` BEFORE every inference — caps tokens / requests / cost-usd / compute-hours per tenant per window so one tenant cannot run up an unbounded bill (OWASP LLM10:2025 unbounded consumption / denial-of-wallet). For multi-node deployments supply an `opts.store` whose `reserve` (atomic conditional test-and-charge) + `add` are atomic on the shared backend (Redis Lua / a SQL `UPDATE ... WHERE used + :amt <= :limit`) so the ceiling is enforced on the cluster-wide aggregate, not per-process
+- [ ] For endpoints returning aggregate statistics over personal data (counts / sums / means / histograms): add calibrated noise with `b.ai.dp` and gate spend with `b.ai.dp.budget({ scope, epsilon, delta })` — use `type: "laplace"` (snapping mechanism) or `type: "gaussian"` (discrete Gaussian), NEVER a hand-rolled `Math.random`-based noise generator: a naive double-precision Laplace sampler lets an attacker distinguish neighbouring datasets from a single output (Mironov 2012), silently breaking the guarantee. Track the per-scope ε/δ budget so repeated queries can't be averaged to cancel the noise
 - [ ] For data with a TTL (GDPR Art. 17, PCI 3.1, retention windows): declare retention rules via `b.retention.create({ db, audit }).declare({ name, table, ageField, ttlMs, action: "erase" })` and run on a `b.scheduler` cadence; honour legal-hold via `legalHoldField`
 - [ ] For write-once-read-many object archives (SEC 17a-4, FINRA, HIPAA-shaped retention): create the bucket with `b.objectStore.bucketOps.create(name, { objectLockEnabled: true })` (Object Lock can ONLY be flipped at create time), apply a default retention via `setObjectLockConfiguration(name, { mode: "COMPLIANCE", years })`, and pin individual objects with `setObjectRetention(name, key, { mode, retainUntil })` or `setObjectLegalHold(name, key, "ON")` — `COMPLIANCE` cannot be shortened or bypassed by anyone (including root); pick deliberately
 - [ ] At boot, before any outbound socket opens: call `b.network.bootFromEnv({ env: process.env, audit: b.audit })` so operator-supplied NTP / DNS / proxy / DPI-trust / TCP socket settings (`BLAMEJS_NTP_*`, `BLAMEJS_DNS_*`, `HTTP_PROXY` / `HTTPS_PROXY` / `NO_PROXY`, `BLAMEJS_EXTRA_CA_CERTS`, `BLAMEJS_SOCKET_*`) apply uniformly

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.12.28",
-  "createdAt": "2026-05-24T15:47:42.211Z",
+  "frameworkVersion": "0.12.29",
+  "createdAt": "2026-05-24T17:07:11.597Z",
   "exports": {
     "a2a": {
       "type": "object",
@@ -1548,6 +1548,31 @@
             }
           }
         },
+        "dp": {
+          "type": "object",
+          "members": {
+            "ACCOUNTINGS": {
+              "type": "instance",
+              "ctorName": "Array"
+            },
+            "AiDpError": {
+              "type": "function",
+              "arity": 4
+            },
+            "MECHANISMS": {
+              "type": "instance",
+              "ctorName": "Array"
+            },
+            "budget": {
+              "type": "function",
+              "arity": 1
+            },
+            "mechanism": {
+              "type": "function",
+              "arity": 1
+            }
+          }
+        },
         "input": {
           "type": "object",
           "members": {

package/lib/vendor/blamejs/index.js

@@ -445,6 +445,7 @@ module.exports = {
     disclosure:      require("./lib/ai-disclosure"),
     quota:           require("./lib/ai-quota"),
     capability:      require("./lib/ai-capability"),
+    dp:              require("./lib/ai-dp"),
   },
   promisePool:      require("./lib/promise-pool"),
   sdNotify:         require("./lib/sd-notify"),

package/lib/vendor/blamejs/lib/ai-dp.js

@@ -0,0 +1,539 @@
+"use strict";
+/**
+ * @module b.ai.dp
+ * @nav    Compliance
+ * @title  Differential privacy
+ *
+ * @intro
+ *   Float-safe differential-privacy mechanisms with per-scope privacy
+ *   budgeting. Differential privacy adds calibrated noise to an
+ *   aggregate so the output is provably insensitive to any single
+ *   record — but the guarantee is fragile: Mironov (2012) showed that
+ *   a Laplace mechanism implemented with naive double-precision
+ *   sampling lets an attacker distinguish neighbouring datasets with
+ *   &gt; 35% probability from a <em>single</em> output, silently
+ *   destroying the promise. This module ships only mechanisms whose
+ *   sampling is hardened against that class of attack:
+ *
+ *   - <strong>Laplace via the snapping mechanism</strong> (Mironov
+ *     2012): clamp to a bound, draw a CSPRNG sign + full-mantissa
+ *     uniform, then round to a power-of-two grid — the rounding
+ *     removes the exploitable low-order mantissa bits. Pure
+ *     ε-differential privacy.
+ *   - <strong>Discrete Gaussian</strong> (Canonne–Kamath–Steinke
+ *     2020): integer-exact rejection sampling built from
+ *     Bernoulli(exp(−γ)) over exact rationals — no floating-point
+ *     noise at all. (ε, δ)-differential privacy, integer-valued.
+ *
+ *   All randomness comes from <code>b.crypto.generateBytes</code>
+ *   (SHAKE256 over the OS CSPRNG), never <code>Math.random</code>.
+ *
+ *   <code>b.ai.dp.budget({ scope, epsilon, delta })</code> tracks a
+ *   privacy budget per scope (per-user / per-tenant / per-query-class)
+ *   and refuses a <code>consume</code> that would exceed it.
+ *   Composition is accounted two ways:
+ *
+ *   - <code>"basic"</code> (default) — sum the per-release ε and δ.
+ *     Always valid; conservative.
+ *   - <code>"rdp"</code> — a Rényi DP accountant (Mironov 2017) tracks
+ *     RDP across a grid of orders and converts to (ε, δ) at the
+ *     scope's δ, giving a much tighter bound under repeated Gaussian
+ *     releases. Requires <code>delta &gt; 0</code>.
+ *
+ *   NIST SP 800-226 (2025) is the evaluation standard for these
+ *   guarantees; Dwork &amp; Roth, "The Algorithmic Foundations of
+ *   Differential Privacy", is the canonical reference.
+ *
+ *   The exponential and sparse-vector mechanisms are
+ *   deferred-with-condition: their float-safe constructions (the
+ *   base-2 / permute-and-flip exponential mechanism, Ilvento 2019; a
+ *   snapped sparse-vector) are a distinct effort, and shipping them
+ *   float-<em>unsafe</em> would defeat the module's purpose. They
+ *   re-open on operator demand with the named construction.
+ *
+ * @card
+ *   Float-safe differential privacy — snapping-mechanism Laplace
+ *   (Mironov 2012) + discrete Gaussian (CKS20), CSPRNG noise, per-
+ *   scope ε/δ budgets with basic + Rényi-DP accounting.
+ */
+
+var bCrypto = require("./crypto");
+var validateOpts = require("./validate-opts");
+var lazyRequire = require("./lazy-require");
+var { defineClass } = require("./framework-error");
+
+var AiDpError = defineClass("AiDpError", { alwaysPermanent: true });
+
+var audit = lazyRequire(function () { return require("./audit"); });
+
+var MECHANISMS = ["laplace", "gaussian"];
+var ACCOUNTINGS = ["basic", "rdp"];
+
+// Rational approximation precision for a real-valued σ² fed to the
+// integer-exact discrete-Gaussian sampler. 2^32 keeps the deviation
+// from the target σ² below 2^-32 — far under the noise scale — while
+// keeping the BigInt denominators bounded.
+var SIGMA2_RATIONAL_DEN = 4294967296;          // allow:raw-byte-literal — 2^32 rational-approx denominator, not a byte size
+
+// ---- Minimal exact rational (BigInt num / den, den > 0) ----
+
+function _gcd(a, b) {
+  a = a < 0n ? -a : a;
+  b = b < 0n ? -b : b;
+  while (b) { var t = a % b; a = b; b = t; }
+  return a;
+}
+function _fr(num, den) {
+  if (den < 0n) { num = -num; den = -den; }
+  var g = _gcd(num, den) || 1n;
+  return { num: num / g, den: den / g };
+}
+function _frFromFloat(x, den) {
+  // den is a Number power-of-two-ish denominator; round(x*den)/den.
+  return _fr(BigInt(Math.round(x * den)), BigInt(den));
+}
+function _frMul(a, b) { return _fr(a.num * b.num, a.den * b.den); }
+function _frSub(a, b) { return _fr(a.num * b.den - b.num * a.den, a.den * b.den); }
+function _frLte(a, b) { return a.num * b.den <= b.num * a.den; }       // a <= b
+function _frGt(a, b)  { return a.num * b.den >  b.num * a.den; }       // a >  b
+
+// ---- CSPRNG primitives (all noise routes through b.crypto) ----
+
+// Uniform BigInt in [0, m) via rejection sampling on CSPRNG bytes —
+// no modulo bias.
+function _uniformBelow(m) {
+  if (m <= 0n) throw new AiDpError("aiDp/internal", "ai.dp: _uniformBelow needs m > 0");
+  if (m === 1n) return 0n;
+  var bits = m.toString(2).length;
+  var bytes = Math.ceil(bits / 8);                        // allow:raw-byte-literal — bits-per-byte divisor, not a size
+  var mask = (1n << BigInt(bits)) - 1n;
+  for (;;) {
+    var buf = bCrypto.generateBytes(bytes);
+    var x = 0n;
+    for (var i = 0; i < bytes; i++) x = (x << 8n) | BigInt(buf[i]);
+    x = x & mask;
+    if (x < m) return x;
+  }
+}
+
+// Uniform double in (0, 1] with full 53-bit mantissa entropy — the
+// snapping mechanism's noise source. A 53-bit integer is drawn via
+// the BigInt rejection sampler (accumulating 53 bits in a JS Number
+// would overflow the 2^53 safe-integer range and skew the draw), then
+// mapped (val + 1) / 2^53 → (0, 1].
+var TWO_POW_53 = 9007199254740992;                         // allow:raw-byte-literal — 2^53 mantissa range, not a byte size
+function _uniformOpen() {
+  var v = Number(_uniformBelow(9007199254740992n));        // [0, 2^53) exact
+  return (v + 1) / TWO_POW_53;                             // (0, 1]
+}
+
+function _randomSign() {
+  return (bCrypto.generateBytes(1)[0] & 1) === 1 ? 1 : -1;
+}
+
+// ---- Canonne–Kamath–Steinke 2020 integer-exact samplers ----
+// Ported verbatim from the reference implementation
+// (github.com/IBM/discrete-gaussian-differential-privacy). All
+// arithmetic is exact (BigInt rationals); no floating-point noise.
+
+function _bernoulli(p) {                                   // p rational in [0,1]
+  return _uniformBelow(p.den) < p.num ? 1 : 0;
+}
+function _bernoulliExp1(x) {                               // x rational in [0,1]
+  var k = 1n;
+  for (;;) {
+    if (_bernoulli(_fr(x.num, x.den * k)) === 1) k = k + 1n;
+    else break;
+  }
+  return Number(k % 2n);
+}
+function _bernoulliExp(x) {                                // x rational >= 0
+  while (_frGt(x, _fr(1n, 1n))) {
+    if (_bernoulliExp1(_fr(1n, 1n)) === 1) x = _frSub(x, _fr(1n, 1n));
+    else return 0;
+  }
+  return _bernoulliExp1(x);
+}
+function _geometricExpSlow(x) {                            // x rational >= 0
+  var k = 0n;
+  for (;;) {
+    if (_bernoulliExp(x) === 1) k = k + 1n;
+    else return k;
+  }
+}
+function _geometricExpFast(x) {                            // x rational > 0; returns BigInt
+  if (x.num === 0n) return 0n;
+  var t = x.den;
+  var u;
+  for (;;) {
+    u = _uniformBelow(t);
+    if (_bernoulliExp(_fr(u, t)) === 1) break;
+  }
+  var v = _geometricExpSlow(_fr(1n, 1n));
+  var value = v * t + u;
+  return value / x.num;                                   // integer division
+}
+function _sampleDLaplace(scaleNum, scaleDen) {            // Lap_Z(scale); returns BigInt
+  var invScale = _fr(scaleDen, scaleNum);                 // 1 / scale
+  for (;;) {
+    var sign = _bernoulli(_fr(1n, 2n));
+    var magnitude = _geometricExpFast(invScale);
+    if (sign === 1 && magnitude === 0n) continue;
+    return magnitude * BigInt(1 - 2 * sign);
+  }
+}
+function _floorSqrtFrac(fr) {                              // floor(sqrt(rational)); returns BigInt
+  var num = fr.num, den = fr.den;
+  var a = 0n, b = 1n;
+  while (b * b * den <= num) b = 2n * b;
+  while (a + 1n < b) {
+    var c = (a + b) / 2n;
+    if (c * c * den <= num) a = c; else b = c;
+  }
+  return a;
+}
+function _sampleDGauss(sigma2) {                          // sigma2 rational > 0; returns BigInt
+  var t = _floorSqrtFrac(sigma2) + 1n;
+  var two_sigma2 = _fr(2n * sigma2.num, sigma2.den);      // 2 * sigma2
+  var sigma2_over_t = _fr(sigma2.num, sigma2.den * t);    // sigma2 / t
+  for (;;) {
+    var candidate = _sampleDLaplace(t, 1n);
+    var absC = candidate < 0n ? -candidate : candidate;
+    var diff = _frSub(_fr(absC, 1n), sigma2_over_t);       // |candidate| - sigma2/t
+    // bias = diff^2 / (2 sigma2)  — multiply diff^2 by the reciprocal of 2σ².
+    var diff2 = _fr(diff.num * diff.num, diff.den * diff.den);
+    var bias = _frMul(diff2, _fr(two_sigma2.den, two_sigma2.num));
+    if (_bernoulliExp(bias) === 1) return candidate;
+  }
+}
+
+// ---- Snapping-mechanism Laplace (Mironov 2012), float-safe ----
+
+function _clamp(x, bound) {
+  if (x < -bound) return -bound;
+  if (x > bound) return bound;
+  return x;
+}
+function _snappingLaplace(value, scale, bound) {
+  // scale = sensitivity / epsilon (Laplace b). bound B clamps the
+  // input + output; the privacy guarantee depends on it. Lambda is
+  // the smallest power of two >= scale, so inner / Lambda and
+  // Lambda * round(...) are exact float ops — that is what removes
+  // the attackable low-order bits the naive sampler leaks.
+  var xc = _clamp(value, bound);
+  var S = _randomSign();
+  var U = _uniformOpen();                                 // (0, 1]
+  var lambdaPow = Math.pow(2, Math.ceil(Math.log2(scale)));
+  var inner = xc + S * scale * Math.log(U);
+  var rounded = lambdaPow * Math.round(inner / lambdaPow);
+  return _clamp(rounded, bound);
+}
+
+// ---- Rényi-DP costs (Mironov 2017) ----
+
+var RDP_ORDERS = [1.25, 1.5, 1.75, 2, 2.5, 3, 4, 5, 6, 8, 12, 16, 24, 32, 48, 64, 128, 256];   // allow:raw-byte-literal — Rényi DP orders (α), not byte sizes
+
+// Gaussian mechanism with noise-to-sensitivity z = sigma / sensitivity:
+// RDP(alpha) = alpha / (2 z^2).
+function _rdpGaussian(alpha, sigma, sensitivity) {
+  var z = sigma / sensitivity;
+  return alpha / (2 * z * z);
+}
+// Laplace mechanism with pure-DP parameter eps0 (= sensitivity / scale):
+// RDP(alpha) = (1/(alpha-1)) * ln( (alpha/(2alpha-1)) e^{(alpha-1)eps0}
+//              + ((alpha-1)/(2alpha-1)) e^{-alpha eps0} ).
+function _rdpLaplace(alpha, eps0) {
+  var a = alpha;
+  var num1 = a / (2 * a - 1);
+  var num2 = (a - 1) / (2 * a - 1);
+  var term = num1 * Math.exp((a - 1) * eps0) + num2 * Math.exp(-a * eps0);
+  return Math.log(term) / (a - 1);
+}
+// Convert an RDP curve (rdp[order]) to (eps, delta): the standard
+// RDP -> DP bound eps(delta) = min_alpha ( rdp(alpha) + ln(1/delta)/(alpha-1) ).
+function _rdpToEpsilon(rdpByOrder, delta) {
+  var best = Infinity;
+  for (var i = 0; i < RDP_ORDERS.length; i++) {
+    var a = RDP_ORDERS[i];
+    var e = rdpByOrder[i] + Math.log(1 / delta) / (a - 1);
+    if (e < best) best = e;
+  }
+  return best;
+}
+
+// ---- mechanism descriptor ----
+
+/**
+ * @primitive b.ai.dp.mechanism
+ * @signature b.ai.dp.mechanism(opts)
+ * @since     0.12.29
+ * @status    stable
+ * @compliance gdpr, soc2
+ * @related   b.ai.dp.budget, b.ai.quota.create
+ *
+ * Build a float-safe DP noise mechanism. <code>type: "laplace"</code>
+ * is the snapping mechanism (pure ε-DP, real-valued, needs a
+ * <code>bound</code>); <code>type: "gaussian"</code> is the discrete
+ * Gaussian (integer-valued, (ε, δ)-DP, needs <code>delta</code>).
+ * Pass the result to <code>budget.consume(mechanism, value)</code>.
+ *
+ * @opts
+ *   {
+ *     type:        string,   // "laplace" | "gaussian"
+ *     sensitivity: number,   // required, > 0 (L1 for laplace, L1/integer for gaussian)
+ *     epsilon:     number,   // required, > 0 (per-release ε; ε ≤ 1 for the
+ *                            //   classic Gaussian calibration)
+ *     delta?:      number,   // gaussian only, required, 0 < δ < 1
+ *     bound?:      number,   // laplace only, required, > 0 — clamp bound B
+ *   }
+ *
+ * @example
+ *   var lap = b.ai.dp.mechanism({ type: "laplace", sensitivity: 1, epsilon: 0.5, bound: 1000 });
+ *   var gss = b.ai.dp.mechanism({ type: "gaussian", sensitivity: 1, epsilon: 0.5, delta: 1e-6 });
+ */
+function mechanism(opts) {
+  validateOpts.requireObject(opts, "ai.dp.mechanism", AiDpError);
+  validateOpts(opts, ["type", "sensitivity", "epsilon", "delta", "bound"], "ai.dp.mechanism");
+
+  if (MECHANISMS.indexOf(opts.type) === -1) {
+    throw new AiDpError("aiDp/bad-mechanism",
+      "ai.dp.mechanism: type must be one of " + MECHANISMS.join(" / ") +
+      " (exponential / sparse-vector are deferred — their float-safe constructions " +
+      "re-open on demand)");
+  }
+  if (typeof opts.sensitivity !== "number" || !isFinite(opts.sensitivity) || opts.sensitivity <= 0) {
+    throw new AiDpError("aiDp/bad-sensitivity",
+      "ai.dp.mechanism: sensitivity must be a positive finite number");
+  }
+  if (typeof opts.epsilon !== "number" || !isFinite(opts.epsilon) || opts.epsilon <= 0) {
+    throw new AiDpError("aiDp/bad-epsilon",
+      "ai.dp.mechanism: epsilon must be a positive finite number");
+  }
+
+  if (opts.type === "laplace") {
+    if (typeof opts.bound !== "number" || !isFinite(opts.bound) || opts.bound <= 0) {
+      throw new AiDpError("aiDp/bad-bound",
+        "ai.dp.mechanism: laplace requires bound > 0 (the snapping clamp; the " +
+        "privacy guarantee depends on it)");
+    }
+    var scale = opts.sensitivity / opts.epsilon;
+    return Object.freeze({
+      type: "laplace", sensitivity: opts.sensitivity, epsilon: opts.epsilon,
+      delta: 0, scale: scale, bound: opts.bound,
+    });
+  }
+
+  // gaussian
+  if (typeof opts.delta !== "number" || !isFinite(opts.delta) || opts.delta <= 0 || opts.delta >= 1) {
+    throw new AiDpError("aiDp/bad-delta",
+      "ai.dp.mechanism: gaussian requires 0 < delta < 1");
+  }
+  if (opts.epsilon > 1) {
+    throw new AiDpError("aiDp/epsilon-too-large",
+      "ai.dp.mechanism: the classic Gaussian calibration is proven for epsilon <= 1; " +
+      "split into multiple releases under an rdp budget, or the analytic Gaussian " +
+      "mechanism (Balle-Wang 2018) re-opens this path on demand");
+  }
+  // Classic Gaussian calibration (Dwork & Roth Thm 3.22), valid for ε ≤ 1.
+  var sigma = Math.sqrt(2 * Math.log(1.25 / opts.delta)) * opts.sensitivity / opts.epsilon;
+  return Object.freeze({
+    type: "gaussian", sensitivity: opts.sensitivity, epsilon: opts.epsilon,
+    delta: opts.delta, sigma: sigma, sigma2: sigma * sigma,
+  });
+}
+
+// Apply a mechanism's noise to a numeric value (no accounting — the
+// budget wraps this).
+function _applyMechanism(m, value) {
+  if (typeof value !== "number" || !isFinite(value)) {
+    throw new AiDpError("aiDp/bad-value", "ai.dp: value must be a finite number");
+  }
+  if (m.type === "laplace") {
+    return _snappingLaplace(value, m.scale, m.bound);
+  }
+  // gaussian — discrete, integer noise added to the (rounded) value.
+  var sigma2Frac = _frFromFloat(m.sigma2, SIGMA2_RATIONAL_DEN);
+  var noise = _sampleDGauss(sigma2Frac);
+  return Math.round(value) + Number(noise);
+}
+
+function _mechRdp(m, orderIndex) {
+  var alpha = RDP_ORDERS[orderIndex];
+  if (m.type === "gaussian") return _rdpGaussian(alpha, m.sigma, m.sensitivity);
+  return _rdpLaplace(alpha, m.epsilon);
+}
+
+// ---- per-scope budget ----
+
+/**
+ * @primitive b.ai.dp.budget
+ * @signature b.ai.dp.budget(opts)
+ * @since     0.12.29
+ * @status    stable
+ * @compliance gdpr, soc2
+ * @related   b.ai.dp.mechanism, b.ai.quota.create
+ *
+ * Track a differential-privacy budget for one scope (per-user /
+ * per-tenant / per-query-class) and refuse a release that would
+ * exceed it. Returns <code>{ consume, remaining, spent, reset }</code>.
+ * <code>consume(mechanism, value)</code> adds the mechanism's noise,
+ * charges the accountant, and throws <code>aiDp/budget-exhausted</code>
+ * if the release would push the scope past its (ε, δ). With
+ * <code>accounting: "rdp"</code> the charge is accounted via Rényi DP
+ * for a tight composition bound (requires <code>delta &gt; 0</code>);
+ * <code>"basic"</code> (default) sums per-release ε and δ.
+ *
+ * @opts
+ *   {
+ *     scope:       string,   // required, the budget scope id
+ *     epsilon:     number,   // required, total ε budget (> 0)
+ *     delta?:      number,   // total δ budget (>= 0; required > 0 for rdp / gaussian)
+ *     accounting?: string,   // "basic" (default) | "rdp"
+ *     audit?:      boolean,  // default: true
+ *   }
+ *
+ * @example
+ *   var b1 = b.ai.dp.budget({ scope: "tenant-acme:daily", epsilon: 3, delta: 1e-6, accounting: "rdp" });
+ *   var m  = b.ai.dp.mechanism({ type: "gaussian", sensitivity: 1, epsilon: 0.5, delta: 1e-6 });
+ *   var out = b1.consume(m, trueCount);
+ *   // → { value: <noised>, cost: { epsilon: 0.5, delta: 1e-6 }, remaining: { epsilon, delta } }
+ */
+function budget(opts) {
+  validateOpts.requireObject(opts, "ai.dp.budget", AiDpError);
+  validateOpts(opts, ["scope", "epsilon", "delta", "accounting", "audit"], "ai.dp.budget");
+
+  validateOpts.requireNonEmptyString(opts.scope,
+    "ai.dp.budget: scope", AiDpError, "aiDp/bad-scope");
+  if (typeof opts.epsilon !== "number" || !isFinite(opts.epsilon) || opts.epsilon <= 0) {
+    throw new AiDpError("aiDp/bad-epsilon", "ai.dp.budget: epsilon must be a positive finite number");
+  }
+  var totalEpsilon = opts.epsilon;
+  var totalDelta = (opts.delta == null) ? 0 : opts.delta;
+  if (typeof totalDelta !== "number" || !isFinite(totalDelta) || totalDelta < 0 || totalDelta >= 1) {
+    throw new AiDpError("aiDp/bad-delta", "ai.dp.budget: delta must be in [0, 1)");
+  }
+  var accounting = (opts.accounting == null) ? "basic" : opts.accounting;
+  if (ACCOUNTINGS.indexOf(accounting) === -1) {
+    throw new AiDpError("aiDp/bad-accounting",
+      "ai.dp.budget: accounting must be one of " + ACCOUNTINGS.join(" / "));
+  }
+  if (accounting === "rdp" && totalDelta <= 0) {
+    throw new AiDpError("aiDp/bad-accounting",
+      "ai.dp.budget: rdp accounting requires delta > 0 (the RDP→(ε,δ) conversion is " +
+      "undefined at delta = 0; use basic accounting for pure-ε budgets)");
+  }
+  var auditOn = opts.audit !== false;
+
+  var scope = opts.scope;
+  var spentEpsilon = 0;          // basic accounting
+  var spentDelta = 0;
+  var rdp = RDP_ORDERS.map(function () { return 0; });   // rdp accounting
+
+  function _emitAudit(action, outcome, metadata) {
+    if (!auditOn) return;
+    try { audit().safeEmit({ action: action, outcome: outcome, metadata: metadata || {} }); }
+    catch (_e) { /* drop-silent */ }
+  }
+
+  function _currentEpsilon(rdpCurve) {
+    if (accounting === "basic") return spentEpsilon;
+    return _rdpToEpsilon(rdpCurve, totalDelta);
+  }
+
+  function remaining() {
+    if (accounting === "basic") {
+      return {
+        epsilon: Math.max(0, totalEpsilon - spentEpsilon),
+        delta:   Math.max(0, totalDelta - spentDelta),
+      };
+    }
+    return { epsilon: Math.max(0, totalEpsilon - _rdpToEpsilon(rdp, totalDelta)), delta: totalDelta };
+  }
+
+  function spent() {
+    if (accounting === "basic") return { epsilon: spentEpsilon, delta: spentDelta };
+    return { epsilon: _rdpToEpsilon(rdp, totalDelta), delta: totalDelta };
+  }
+
+  function consume(m, value) {
+    if (!m || typeof m !== "object" || MECHANISMS.indexOf(m.type) === -1) {
+      throw new AiDpError("aiDp/bad-mechanism",
+        "ai.dp.budget.consume: first argument must be a b.ai.dp.mechanism");
+    }
+    if (m.type === "gaussian" && totalDelta <= 0) {
+      throw new AiDpError("aiDp/bad-delta",
+        "ai.dp.budget.consume: a gaussian mechanism needs a scope delta > 0");
+    }
+
+    // Prospective accounting: would this release fit under the budget?
+    var cost;
+    if (accounting === "basic") {
+      if (spentEpsilon + m.epsilon > totalEpsilon + 1e-12 ||
+          spentDelta + m.delta > totalDelta + 1e-12) {
+        _emitAudit("dp/budget-exhausted", "denied", {
+          scope: scope, accounting: accounting, mechanism: m.type,
+          requestEpsilon: m.epsilon, requestDelta: m.delta,
+          spentEpsilon: spentEpsilon, totalEpsilon: totalEpsilon,
+        });
+        throw new AiDpError("aiDp/budget-exhausted",
+          "ai.dp.budget.consume: scope '" + scope + "' would spend ε=" +
+          (spentEpsilon + m.epsilon) + "/" + totalEpsilon + ", δ=" +
+          (spentDelta + m.delta) + "/" + totalDelta + "; refused");
+      }
+      cost = { epsilon: m.epsilon, delta: m.delta };
+    } else {
+      var trial = rdp.map(function (r, i) { return r + _mechRdp(m, i); });
+      var trialEps = _rdpToEpsilon(trial, totalDelta);
+      if (trialEps > totalEpsilon + 1e-12) {
+        _emitAudit("dp/budget-exhausted", "denied", {
+          scope: scope, accounting: accounting, mechanism: m.type,
+          projectedEpsilon: trialEps, totalEpsilon: totalEpsilon,
+        });
+        throw new AiDpError("aiDp/budget-exhausted",
+          "ai.dp.budget.consume: scope '" + scope + "' would reach ε=" +
+          trialEps.toFixed(4) + " of " + totalEpsilon + " at δ=" + totalDelta + "; refused");
+      }
+      var before = _rdpToEpsilon(rdp, totalDelta);
+      cost = { epsilon: trialEps - before, delta: 0 };
+    }
+
+    // Charge, then sample. (Sampling never fails; charging first keeps
+    // the budget monotone even if a caller ignores the throw path.)
+    var noised = _applyMechanism(m, value);
+    if (accounting === "basic") {
+      spentEpsilon += m.epsilon;
+      spentDelta += m.delta;
+    } else {
+      rdp = rdp.map(function (r, i) { return r + _mechRdp(m, i); });
+    }
+
+    _emitAudit("dp/budget-consumed", "allowed", {
+      scope: scope, accounting: accounting, mechanism: m.type,
+      epsilon: m.epsilon, delta: m.delta,
+    });
+    return { value: noised, cost: cost, remaining: remaining() };
+  }
+
+  function reset() {
+    spentEpsilon = 0;
+    spentDelta = 0;
+    rdp = RDP_ORDERS.map(function () { return 0; });
+  }
+
+  return {
+    consume:    consume,
+    remaining:  remaining,
+    spent:      spent,
+    reset:      reset,
+    scope:      scope,
+    accounting: accounting,
+  };
+}
+
+module.exports = {
+  mechanism:   mechanism,
+  budget:      budget,
+  MECHANISMS:  MECHANISMS,
+  ACCOUNTINGS: ACCOUNTINGS,
+  AiDpError:   AiDpError,
+};

package/lib/vendor/blamejs/lib/crypto.js

@@ -387,9 +387,16 @@ function random(byteLength) {
   // when callers requested more. SHAKE256 is also already the
   // framework's KDF / browser-side derivation primitive, so the same
   // hash family does double duty.
-  return nodeCrypto.createHash("shake256", { outputLength: n })
-    .update(nodeCrypto.randomBytes(n))
+  //
+  // Node's SHAKE256 XOF is non-uniform at outputLength 1 (the byte
+  // values 0x00 and 0xff never occur and the low bit skews to ~0.54);
+  // outputLength >= 2 is uniform. Draw at least 2 bytes and slice so a
+  // 1-byte request still returns a uniform byte.
+  var drawN = n < 2 ? 2 : n;
+  var out = nodeCrypto.createHash("shake256", { outputLength: drawN })
+    .update(nodeCrypto.randomBytes(drawN))
     .digest();
+  return drawN === n ? out : out.subarray(0, n);
 }
 
 /**

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.12.28",
+  "version": "0.12.29",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.12.29.json

@@ -0,0 +1,31 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.12.29",
+  "date": "2026-05-24",
+  "headline": "`b.ai.dp` — float-safe differential privacy: snapping-mechanism Laplace + discrete Gaussian + Rényi-DP budgets",
+  "summary": "Differential privacy adds calibrated noise so an aggregate is provably insensitive to any single record — but the guarantee is fragile: Mironov (2012) showed that a Laplace mechanism sampled with naive double-precision floats lets an attacker distinguish neighbouring datasets with > 35% probability from a single output, silently destroying the promise. `b.ai.dp` ships only mechanisms whose sampling is hardened against that attack class: Laplace via the snapping mechanism (clamp + CSPRNG sign + full-mantissa uniform + power-of-two-grid rounding) and the discrete Gaussian (Canonne–Kamath–Steinke 2020) via integer-exact rejection sampling built from Bernoulli(exp(−γ)) over exact rationals — no floating-point noise at all. All randomness comes from `b.crypto.generateBytes` (SHAKE256 over the OS CSPRNG), never `Math.random`. `b.ai.dp.budget({ scope, epsilon, delta })` tracks a privacy budget per scope and refuses a `consume` that would exceed it, accounting composition either by basic summation (default) or a Rényi-DP accountant (Mironov 2017) for a much tighter bound under repeated Gaussian releases. NIST SP 800-226 (2025) is the evaluation standard; Dwork & Roth is the canonical reference. The exponential and sparse-vector mechanisms are deferred-with-condition — their float-safe constructions (base-2 / permute-and-flip; snapped SVT) re-open on operator demand, since shipping them float-unsafe would defeat the module's purpose.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.ai.dp.mechanism({ type, sensitivity, epsilon, ... })` — float-safe noise mechanisms",
+          "body": "`type: \"laplace\"` is the snapping mechanism (pure ε-DP, real-valued, requires a clamp `bound` the guarantee depends on); `type: \"gaussian\"` is the discrete Gaussian (integer-valued, (ε, δ)-DP, requires `delta`). The Gaussian uses the classic calibration σ = √(2 ln(1.25/δ))·Δ/ε, proven for ε ≤ 1 — larger ε is refused with a pointer to splitting the release under an rdp budget. Descriptors are validated + frozen at construction so a malformed parameter fails fast."
+        },
+        {
+          "title": "`b.ai.dp.budget({ scope, epsilon, delta, accounting })` — per-scope privacy budget",
+          "body": "Returns `{ consume, remaining, spent, reset }`. `consume(mechanism, value)` adds the mechanism's noise, charges the accountant, and throws `aiDp/budget-exhausted` if the release would push the scope past its (ε, δ). `accounting: \"basic\"` (default) sums per-release ε and δ; `accounting: \"rdp\"` runs a Rényi-DP accountant across a grid of orders and converts to (ε, δ) at the scope's δ for a tight composition bound under repeated Gaussian releases (requires `delta > 0`). The scope budget is enforced on both ε and δ independently."
+        }
+      ]
+    },
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "`b.crypto.generateBytes` uniformity fix at 1-byte length",
+          "body": "Node's SHAKE256 XOF is non-uniform at `outputLength: 1` — the byte values 0x00 and 0xff never occur and the low bit skews to ~0.54. `b.crypto.generateBytes(1)` (and the underlying `random(1)`) now draws at least 2 bytes and slices, so a single-byte CSPRNG request is uniform. Surfaced by `b.ai.dp` per-byte noise sampling; any per-byte consumer of `generateBytes` inherits the fix. A regression test asserts 0x00 / 0xff occur and the low bit is balanced."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/ai-dp.test.js

@@ -0,0 +1,167 @@
+"use strict";
+/**
+ * Layer 0 — b.ai.dp float-safe differential privacy. Snapping-
+ * mechanism Laplace (Mironov 2012) + discrete Gaussian (CKS20) with
+ * CSPRNG noise; per-scope ε/δ budgets with basic + Rényi-DP
+ * accounting. Statistical checks validate the noise distributions;
+ * the budget tests validate composition + exhaustion.
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+
+// A budget large enough that the statistical loops never exhaust it.
+function _bigBudget() {
+  return b.ai.dp.budget({ scope: "stat", epsilon: 1e12, delta: 0.9, accounting: "basic", audit: false });
+}
+function _mean(xs) { var s = 0; for (var i = 0; i < xs.length; i++) s += xs[i]; return s / xs.length; }
+function _variance(xs, mean) { var s = 0; for (var i = 0; i < xs.length; i++) s += (xs[i] - mean) * (xs[i] - mean); return s / xs.length; }
+
+async function testMechanismValidation() {
+  var cases = [
+    [{ type: "exponential", sensitivity: 1, epsilon: 1 }, "aiDp/bad-mechanism"],
+    [{ type: "laplace", sensitivity: 0, epsilon: 1, bound: 10 }, "aiDp/bad-sensitivity"],
+    [{ type: "laplace", sensitivity: 1, epsilon: 0, bound: 10 }, "aiDp/bad-epsilon"],
+    [{ type: "laplace", sensitivity: 1, epsilon: 1 }, "aiDp/bad-bound"],
+    [{ type: "gaussian", sensitivity: 1, epsilon: 0.5 }, "aiDp/bad-delta"],
+    [{ type: "gaussian", sensitivity: 1, epsilon: 0.5, delta: 1 }, "aiDp/bad-delta"],
+    [{ type: "gaussian", sensitivity: 1, epsilon: 2, delta: 1e-6 }, "aiDp/epsilon-too-large"],
+  ];
+  var ok = true;
+  for (var i = 0; i < cases.length; i++) {
+    var caught = null;
+    try { b.ai.dp.mechanism(cases[i][0]); } catch (e) { caught = e; }
+    if (!caught || caught.code !== cases[i][1]) { ok = false; check("mechanism case " + i + " expected " + cases[i][1] + " got " + (caught && caught.code), false); }
+  }
+  check("mechanism: malformed configs throw the right codes", ok);
+  var lap = b.ai.dp.mechanism({ type: "laplace", sensitivity: 1, epsilon: 0.5, bound: 1000 });
+  check("mechanism: laplace scale = sensitivity/epsilon", lap.scale === 2 && lap.delta === 0);
+  var gss = b.ai.dp.mechanism({ type: "gaussian", sensitivity: 1, epsilon: 0.5, delta: 1e-6 });
+  check("mechanism: gaussian computes sigma", gss.sigma > 0 && gss.sigma2 > 0);
+}
+
+async function testSnappingLaplaceDistribution() {
+  var bud = _bigBudget();
+  var m = b.ai.dp.mechanism({ type: "laplace", sensitivity: 1, epsilon: 0.5, bound: 1e6 });   // scale 2 → Λ 2
+  var N = 40000, xs = [], onGrid = true;
+  for (var i = 0; i < N; i++) {
+    var v = bud.consume(m, 100).value;
+    xs.push(v);
+    if (v % 2 !== 0) onGrid = false;                       // snapping grid Λ = 2
+  }
+  check("laplace: every output lands on the power-of-two snapping grid", onGrid);
+  var mean = _mean(xs);
+  check("laplace: mean ≈ true value (100)", Math.abs(mean - 100) < 0.3);
+  var variance = _variance(xs, mean);
+  check("laplace: variance ≈ 2·scale² (8)", variance > 6.5 && variance < 9.5);
+}
+
+async function testLaplaceClamping() {
+  var bud = _bigBudget();
+  var m = b.ai.dp.mechanism({ type: "laplace", sensitivity: 1, epsilon: 1, bound: 10 });
+  var withinBound = true;
+  for (var i = 0; i < 5000; i++) {
+    var v = bud.consume(m, 1000000).value;                 // true value far outside the bound
+    if (v < -10 || v > 10) withinBound = false;
+  }
+  check("laplace: output is clamped to ±bound", withinBound);
+}
+
+async function testDiscreteGaussianDistribution() {
+  var bud = _bigBudget();
+  var m = b.ai.dp.mechanism({ type: "gaussian", sensitivity: 1, epsilon: 0.5, delta: 1e-6 });
+  var N = 40000, xs = [], allInt = true;
+  for (var i = 0; i < N; i++) {
+    var v = bud.consume(m, 0).value;
+    xs.push(v);
+    if (!Number.isInteger(v)) allInt = false;
+  }
+  check("gaussian: discrete — every output is an integer", allInt);
+  var mean = _mean(xs);
+  check("gaussian: mean ≈ 0", Math.abs(mean) < 0.5);
+  var variance = _variance(xs, mean);
+  // Discrete Gaussian variance ≈ σ² for σ not tiny.
+  check("gaussian: variance ≈ σ²", variance > m.sigma2 * 0.85 && variance < m.sigma2 * 1.15);
+}
+
+async function testBudgetBasicComposition() {
+  var bud = b.ai.dp.budget({ scope: "t", epsilon: 1.0, delta: 1e-5, accounting: "basic", audit: false });
+  var m = b.ai.dp.mechanism({ type: "laplace", sensitivity: 1, epsilon: 0.3, bound: 100 });
+  var r1 = bud.consume(m, 5);
+  check("budget: consume returns { value, cost, remaining }",
+    typeof r1.value === "number" && r1.cost.epsilon === 0.3 && Math.abs(r1.remaining.epsilon - 0.7) < 1e-9);
+  bud.consume(m, 5);
+  bud.consume(m, 5);                                        // spent 0.9
+  var refused = null;
+  try { bud.consume(m, 5); } catch (e) { refused = e; }    // 0.9 + 0.3 > 1.0
+  check("budget: basic composition refuses over-ε release", refused && refused.code === "aiDp/budget-exhausted");
+  check("budget: spent reflects three releases", Math.abs(bud.spent().epsilon - 0.9) < 1e-9);
+  bud.reset();
+  check("budget: reset clears spend", bud.spent().epsilon === 0);
+}
+
+async function testBudgetDeltaExhaustion() {
+  var bud = b.ai.dp.budget({ scope: "t", epsilon: 1e6, delta: 2.5e-6, accounting: "basic", audit: false });
+  var m = b.ai.dp.mechanism({ type: "gaussian", sensitivity: 1, epsilon: 0.1, delta: 1e-6 });
+  bud.consume(m, 0); bud.consume(m, 0);                    // δ spent 2e-6
+  var refused = null;
+  try { bud.consume(m, 0); } catch (e) { refused = e; }    // 2e-6 + 1e-6 > 2.5e-6
+  check("budget: δ budget exhaustion refuses (not just ε)", refused && refused.code === "aiDp/budget-exhausted");
+}
+
+async function testRdpTighterThanBasic() {
+  function spend(acc) {
+    var bud = b.ai.dp.budget({ scope: "s", epsilon: 1e9, delta: 1e-3, accounting: acc, audit: false });
+    var m = b.ai.dp.mechanism({ type: "gaussian", sensitivity: 1, epsilon: 0.3, delta: 1e-6 });
+    for (var k = 0; k < 12; k++) bud.consume(m, 0);
+    return bud.spent().epsilon;
+  }
+  var basicEps = spend("basic");
+  var rdpEps = spend("rdp");
+  check("rdp: 12× Gaussian basic sums to 3.6", Math.abs(basicEps - 3.6) < 1e-9);
+  check("rdp: Rényi accounting is strictly tighter than basic", rdpEps < basicEps);
+}
+
+async function testBudgetValidation() {
+  var cases = [
+    [{ scope: "", epsilon: 1 }, "aiDp/bad-scope"],
+    [{ scope: "s", epsilon: 0 }, "aiDp/bad-epsilon"],
+    [{ scope: "s", epsilon: 1, delta: 1 }, "aiDp/bad-delta"],
+    [{ scope: "s", epsilon: 1, delta: -1 }, "aiDp/bad-delta"],
+    [{ scope: "s", epsilon: 1, accounting: "zcdp" }, "aiDp/bad-accounting"],
+    [{ scope: "s", epsilon: 1, delta: 0, accounting: "rdp" }, "aiDp/bad-accounting"],
+  ];
+  var ok = true;
+  for (var i = 0; i < cases.length; i++) {
+    var caught = null;
+    try { b.ai.dp.budget(cases[i][0]); } catch (e) { caught = e; }
+    if (!caught || caught.code !== cases[i][1]) { ok = false; check("budget case " + i + " expected " + cases[i][1] + " got " + (caught && caught.code), false); }
+  }
+  check("budget: malformed configs throw the right codes", ok);
+  // A gaussian mechanism needs a scope delta > 0.
+  var bud = b.ai.dp.budget({ scope: "s", epsilon: 1, accounting: "basic", audit: false });
+  var refused = null;
+  try { bud.consume(b.ai.dp.mechanism({ type: "gaussian", sensitivity: 1, epsilon: 0.5, delta: 1e-6 }), 0); } catch (e) { refused = e; }
+  check("budget: gaussian into a δ=0 scope refused", refused && refused.code === "aiDp/bad-delta");
+}
+
+async function run() {
+  await testMechanismValidation();
+  await testSnappingLaplaceDistribution();
+  await testLaplaceClamping();
+  await testDiscreteGaussianDistribution();
+  await testBudgetBasicComposition();
+  await testBudgetDeltaExhaustion();
+  await testRdpTighterThanBasic();
+  await testBudgetValidation();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("[ai-dp] OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -2200,10 +2200,11 @@ async function testNoDuplicateCodeBlocks() {
       files: [
         "lib/ai-quota.js:_emitAudit",
         "lib/ai-capability.js:_emitAudit",
+        "lib/ai-dp.js:_emitAudit",
         "lib/cert.js:_emitAudit",
         "lib/mail-send-deliver.js:_auditEmit",
       ],
-      reason: "v0.12.27 + v0.12.28 — per-module drop-silent audit-emit helper (`try { audit().safeEmit({ action, outcome, metadata }); } catch (_e) {}`). Same family as the archive / http-client _emitAudit cluster (feedback_audit_safeEmit_per_module_emitAudit_shape): ai-quota.js emits ai/quota-applied + ai/quota-exceeded, ai-capability.js emits ai/capability-routed + ai/capability-no-candidate, cert.js emits certificate-lifecycle events, mail-send-deliver.js emits delivery events. Each carries a primitive-specific `action:` namespace + metadata fields; consolidating would force a shared audit import and lose the per-primitive namespace operators grep for in audit logs.",
+      reason: "v0.12.27 + v0.12.28 + v0.12.29 — per-module drop-silent audit-emit helper (`try { audit().safeEmit({ action, outcome, metadata }); } catch (_e) {}`). Same family as the archive / http-client _emitAudit cluster (feedback_audit_safeEmit_per_module_emitAudit_shape): ai-quota.js emits ai/quota-applied + ai/quota-exceeded, ai-capability.js emits ai/capability-routed + ai/capability-no-candidate, ai-dp.js emits dp/budget-consumed + dp/budget-exhausted, cert.js emits certificate-lifecycle events, mail-send-deliver.js emits delivery events. Each carries a primitive-specific `action:` namespace + metadata fields; consolidating would force a shared audit import and lose the per-primitive namespace operators grep for in audit logs.",
     },
     {
       mode:  "family-subset",
@@ -2219,11 +2220,22 @@ async function testNoDuplicateCodeBlocks() {
       mode:  "family-subset",
       files: [
         "lib/ai-capability.js:create",
+        "lib/ai-dp.js:budget",
         "lib/cert.js:create",
         "lib/mail-send-deliver.js:create",
         "lib/auth/sd-jwt-vc-holder.js:create",
       ],
-      reason: "v0.12.28 — factory-primitive opts-validation prelude (`validateOpts.requireObject + validateOpts(allowedKeys) + per-field typed-error throws + closure-captured return`). ai-capability.create validates a model-descriptor registry + builds a router closure; cert.create / mail-send-deliver.create / sd-jwt-vc-holder.create each validate a distinct spec's opts (X.509 cert issuance / RFC 5321 SMTP send / SD-JWT-VC holder store). Each throws a primitive-specific typed error (AiCapabilityError / CertError / MailSendError / SdJwtVcError); the shingle is the create()-factory validation idiom, not behaviour. Same family as the v0.10.16 factory-primitive validateOpts cluster.",
+      reason: "v0.12.28 + v0.12.29 — factory-primitive opts-validation prelude (`validateOpts.requireObject + validateOpts(allowedKeys) + per-field typed-error throws + closure-captured return`). ai-capability.create validates a model-descriptor registry + builds a router closure; ai-dp.budget validates a per-scope ε/δ budget + builds an accountant closure; cert.create / mail-send-deliver.create / sd-jwt-vc-holder.create each validate a distinct spec's opts (X.509 cert issuance / RFC 5321 SMTP send / SD-JWT-VC holder store). Each throws a primitive-specific typed error (AiCapabilityError / AiDpError / CertError / MailSendError / SdJwtVcError); the shingle is the create()-factory validation idiom, not behaviour. Same family as the v0.10.16 factory-primitive validateOpts cluster.",
+    },
+    {
+      mode:  "family-subset",
+      files: [
+        "lib/ai-dp.js:mechanism",
+        "lib/dora.js:_validateReportInput",
+        "lib/config.js:loadDbBacked",
+        "lib/guard-snapshot-envelope.js:validate",
+      ],
+      reason: "v0.12.29 — input-shape validation prelude (`validateOpts(allowedKeys) + chained typeof / range guards + typed-error throw`). ai-dp.mechanism validates a DP mechanism descriptor (type / sensitivity / epsilon / delta / bound); dora._validateReportInput validates a DORA Art. 17 incident report; config.loadDbBacked validates DB-backed config opts; guard-snapshot-envelope.validate validates a sealed snapshot envelope. Each enforces a distinct spec's field set with a primitive-specific typed error; the shingle is the validateOpts-then-guard idiom, not behaviour.",
     },
     {
       mode:  "family-subset",

package/lib/vendor/blamejs/test/layer-0-primitives/crypto-random-int.test.js

@@ -62,10 +62,31 @@ function testInputValidation() {
   check("max < min throws RangeError", threw);
 }
 
+function testGenerateBytesUniformity() {
+  // Regression: Node's SHAKE256 XOF is non-uniform at outputLength 1
+  // (byte values 0x00 / 0xff never occur, low bit skews to ~0.54).
+  // b.crypto.random draws >= 2 bytes and slices so a 1-byte request
+  // is still uniform — without this, every per-byte CSPRNG consumer
+  // (e.g. b.ai.dp noise sampling) would inherit the bias.
+  var N = 60000;
+  var sawZero = false, sawMax = false, lowBitOnes = 0;
+  for (var i = 0; i < N; i += 1) {
+    var byte = b.crypto.generateBytes(1)[0];
+    if (byte === 0) sawZero = true;
+    if (byte === 255) sawMax = true;                       // allow:raw-byte-literal — 0xff byte value, not a size
+    lowBitOnes += (byte & 1);
+  }
+  check("generateBytes(1) can emit 0x00", sawZero);
+  check("generateBytes(1) can emit 0xff", sawMax);
+  var lowBitFrac = lowBitOnes / N;
+  check("generateBytes(1) low bit is balanced (~0.5)", lowBitFrac > 0.47 && lowBitFrac < 0.53);
+}
+
 function run() {
   testRangeContract();
   testDispersion();
   testInputValidation();
+  testGenerateBytesUniformity();
 }
 
 if (require.main === module) run();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.0.122",
+  "version": "0.0.123",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {