@blamejs/blamejs-shop 0.1.35 → 0.1.36

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.1.x
 
+- v0.1.36 (2026-05-26) — **Multi-currency display — shoppers browse prices in their own currency while you still charge in your base currency.** Shoppers can now pick a display currency from a switcher in the footer; every price on the storefront — product pages, the grid, search, and the cart — re-renders in that currency using the foreign-exchange rates you set, formatted with the right symbol, grouping, and decimal places for the locale. Conversion is display-only: the cart line and the eventual charge stay in your base currency, and a "Prices shown in EUR; you'll be charged in USD" disclosure makes that explicit whenever a conversion is in effect. The choice rides in a sealed first-party cookie and survives navigation; a per-currency rounding rule can snap converted prices to a tidy increment (for example Swiss 0.05 Rappenrundung). Every failure mode falls back to the base currency rather than showing a broken price: a currency with no rate on file, a rate that has expired, a currency you've removed from the allow-list, or a tampered cookie all render in your base currency. The switcher and all conversions render identically from the edge and the container, and the whole flow works with JavaScript off. **Added:** *Currency switcher + on-page price conversion* — A currency switcher in the footer lists the currencies you've enabled; choosing one `POST`s to `/currency`, stores the choice in a sealed cookie, and redirects back to the page the shopper was on. From then on product pages, the product grid, search results, and the cart display prices converted into that currency, each formatted for its locale (symbol, thousands separator, decimal places). When a conversion is active a "Prices shown in <display>; you'll be charged in <base>" note appears so the shopper always knows the charge currency. The switcher submits without JavaScript — the small enhancement script only auto-submits on change. · *Operator-set FX rates, display rounding, and a base-currency guarantee* — Set your base currency and the enabled list with `SHOP_BASE_CURRENCY` / `SHOP_CURRENCIES` (or the `shop.base_currency` / `shop.currencies` config keys), and supply foreign-exchange rates yourself from whatever source you trust — the framework never reaches out to a rate feed. Rates are stored as integer basis points and conversion uses banker's rounding; an optional per-currency rounding rule snaps the result to a display increment (e.g. nearest 0.05). Conversion is strictly for display: the cart line's currency and amount, and therefore the amount charged at checkout, always stay in the base currency. Any currency without a usable rate — missing, expired, de-listed, or a tampered cookie — falls back to base-currency display instead of a broken or `NaN` price, so a stale or absent rate feed never breaks a priced page.
+
 - v0.1.35 (2026-05-26) — **Cookie-consent banner — GDPR/ePrivacy consent with category opt-in, an audit ledger, and a preferences page.** Every page now carries a cookie-consent banner until the visitor decides. They can accept all, reject everything non-essential, or open preferences to toggle categories; the choice is stored in a sealed first-party cookie and recorded in a consent ledger for the audit trail. Strictly-necessary cookies (session, CSRF, the consent choice itself) always work; analytics and marketing are opt-in and default-deny, and a Do-Not-Track or Global-Privacy-Control signal collapses them to denied regardless of any stored opt-in. A "Manage cookies" footer link reopens the preferences. The banner and its choice form are server-rendered and work with JavaScript off — the small enhancement script only hides the banner once a choice exists — and the banner renders identically from the edge and the container. A consent-gating hook lets future analytics/marketing scripts render only when their category is granted. **Added:** *Consent banner + preferences page* — A banner shows on every page until a choice is made: Accept all, Reject non-essential, or Manage preferences. `POST /consent` records the decision (validated; safe-redirect back to where the visitor was), and `GET /cookies` is a preferences page to review and change categories later, linked from the footer. The authoritative choice is a sealed, HttpOnly first-party cookie; a tampered or missing cookie simply reshows the banner rather than erroring. Every decision is also written to the consent ledger for the GDPR audit trail, best-effort so a ledger hiccup never blocks the choice from taking effect. · *Category opt-in with DNT / GPC honored* — Cookies are grouped into strictly-necessary (always on) plus toggleable categories (analytics, marketing, …) that are opt-in and default-deny. A `DNT: 1` or `Sec-GPC: 1` request header forces the non-essential categories to denied regardless of any stored opt-in. A server-side gating hook renders a category's script only when that category is granted, so future analytics/marketing islands are consent-gated by construction. · *Consent is anchored to a policy version* — Each stored decision records the cookie-policy version it was captured under. When an operator bumps the active version (the cookie policy materially changed), decisions taken under the old version stop being honored — the gate falls back to default-deny for the optional categories and the banner re-prompts so consent is re-collected, rather than coasting on opt-ins given under a superseded policy. The banner and preferences page keep working with JavaScript off; the enhancement script only suppresses the banner while the stored version still matches the active one.
 
 - v0.1.34 (2026-05-26) — **Vendored blamejs refreshed to v0.13.0.** Refreshes the vendored blamejs stack from v0.12.11 to v0.13.0 — the single source of every security, crypto, and primitive the shop composes. No application API changes; the refresh keeps the shop current with upstream fixes and broadens the primitive surface the shop builds on. The vendored tree is verified against the release tag by the vendor-integrity gate, and the in-image smoke gate runs against the refreshed tree before any image ships. **Changed:** *Vendored blamejs v0.12.11 → v0.13.0* — The committed copy under `lib/vendor/blamejs/` is updated to the v0.13.0 release tag via the vendor-refresh entry point. Composed primitives are unchanged at the call sites the shop already uses; the refresh carries upstream maintenance and expands the available primitive surface for future shop features.

package/README.md

@@ -81,6 +81,7 @@ Every primitive is composed on the vendored blamejs surface — no npm runtime d
 | **`lib/search-facets.js`** | Filterable search. A search result page renders facet groups — collection, price range, in-stock — as server-rendered controls; selecting one narrows the results and rides the URL query string (`?q=…&collection=…&in_stock=1`), counts beside each option reflect the current result set, facets combine across groups, and active filters show as removable chips with a clear-all path that survives result pagination. All filtering is server-side from the query string (no client JS); unknown facet keys, out-of-range prices, and garbage values are ignored rather than erroring; an empty filtered result shows a clear-filters state. Runs identically at the edge worker and the container — the edge reads the catalog and facet registry straight from D1, missing-table-resilient. |
 | **`lib/search-synonyms.js`** | Typo-tolerant, synonym-aware query matching. Before the catalog is searched, the query is expanded through an operator-curated vocabulary — synonym groups (so "tee" matches "t-shirt"), common typo corrections, and stopword removal — and the page shows a "Showing results for" note when the query was corrected or expanded. A query that still matches nothing falls back to the raw terms so search never silently empties on an unknown word. Shared rewrite instance; runs identically at the edge and the container. |
 | **`lib/cookie-consent.js`** | GDPR/ePrivacy cookie consent. Every page carries a banner until the visitor decides — accept all, reject non-essential, or manage categories — with the choice in a sealed first-party cookie and recorded in a consent ledger for the audit trail. Strictly-necessary cookies are always on; analytics/marketing are opt-in and default-deny, and a `DNT`/`Sec-GPC` header forces non-essential to denied regardless of stored opt-in. `POST /consent` sets the choice (safe-redirect back); `GET /cookies` is the preferences page (footer-linked). A server-side gating hook renders a category's script only when granted. Banner + form are server-rendered (work with JS off; the island only hides the banner once decided) and identical at the edge and container. |
+| **`lib/currency-display.js`** | Multi-currency display. Shoppers pick a display currency from the footer switcher (`POST /currency`, sealed cookie, 303 back); product pages, the grid, search, and the cart then show prices converted into it via operator-set FX rates (stored as integer basis points, banker's rounding), formatted per the currency's locale. Conversion is display-only — the cart line and the charged amount stay in the base currency, and a "Prices shown in <display>; you'll be charged in <base>" disclosure appears whenever converting. An optional per-currency rounding rule (composed with `lib/currency-rounding.js`) snaps converted prices to a display increment (e.g. CHF 0.05). Every failure mode — no rate on file, an expired rate, a de-listed currency, a tampered cookie — falls back to base-currency display, never a broken / `NaN` price. Base + enabled list come from `SHOP_BASE_CURRENCY` / `SHOP_CURRENCIES` (or `shop.base_currency` / `shop.currencies` config). Switcher + conversions are server-rendered (work with JS off) and identical at the edge and container. |
 | **`lib/subscriptions.js`** | Stripe-backed recurring billing — `subscription_plans` (interval / amount / trial) + `subscriptions` (mirrors Stripe's object byte-for-byte). `subscriptions.create` POSTs to Stripe via the payment dep, then persists the returned object locally. `handleStripeEvent` replays `customer.subscription.*` events into the local row so the shop has an authoritative view without round-tripping. Customers view + cancel their own subscriptions at `/account/subscriptions` (ownership-checked; cancel mounts when the payment handle is wired). |
 | **`lib/giftcards.js`** | Prepaid bearer gift cards. `issue({ amount_minor, currency })` generates a 16-char code (32-glyph alphabet, no ambiguous letters) via `b.crypto.generateBytes`, stores only its `namespaceHash` digest + a 4-char hint, and returns the plaintext code once. `balance(code)` / `lookup(code)` resolve a code to its live balance (constant-time hash compare); `redeem({ code, order_id, amount_minor })` decrements the balance with an atomic `balance >= amount` SQL guard so concurrent spends can't overdraw. Redeemed at checkout as a credit against the order grand total: the amount due drops by the applied balance (never below zero), the order still records the full total it owed, and the debit is recorded once per order — a card that fully covers the order is marked paid with no Stripe charge. Customers check a balance at `GET /gift-cards`; the page is not a code-existence oracle (unknown / malformed / expired all return the same generic not-found). |
 | **`lib/gift-card-ledger.js`** | Append-only credit / debit / expire history per gift card, with a denormalized `balance_after_minor` snapshot for O(1) balance reads. `credit` / `debit` / `expire` write one row each; `history(id)` paginates a card's transactions; `transactionsForOrder(id)` lists a card's movements for one order. The audit trail behind the admin gift-card ledger console; overdraft is refused at the primitive layer. |

package/lib/asset-manifest.json

@@ -1,13 +1,13 @@
 {
-  "version": "0.1.35",
+  "version": "0.1.36",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-rvjL1QySBgNJGEUDusbbMCkL3fsjmzcwUvTp9pljo/0Nn/lErxq2AbY8EYvDF9Ch",
       "fingerprinted": "css/admin.4dc78dfc45d0736d.css"
     },
     "css/main.css": {
-      "integrity": "sha384-eNBBXiZ+B0S2drwiWoHzw7FzZRNGRO79o9VIwsaujSHTxQLz2zJabp0x74kFxAxq",
-      "fingerprinted": "css/main.0ef22690caec76ea.css"
+      "integrity": "sha384-oCNOJjwj7/EHXCrMnkhOTDY/5iFDeIvpWFmMyeX1g73CE4usg4i4q/dGYx4Ko258",
+      "fingerprinted": "css/main.0cbb632d5418155e.css"
     },
     "js/consent.js": {
       "integrity": "sha384-KKMQ0og8HPOykRRPpUyxX7dMhTvKySfVtpGX/jGWzZwNaN/c4OykvRvXpqBHcQST",

package/lib/currency-display.js

@@ -53,6 +53,7 @@
 
 var b = require("./vendor/blamejs");
 var C = b.constants;
+var currencyRounding = require("./currency-rounding");
 
 var CURRENCY_RE = /^[A-Z]{3}$/;
 var DEFAULT_TTL_MS = C.TIME.days(1);
@@ -409,10 +410,38 @@ function create(opts) {
     return { written: written, fetched_at: fetchedAt };
   }
 
+  // Display-side read: the rate to use when rendering `base` prices in
+  // `quote`, or null when there's nothing usable. Returns null (rather
+  // than the stale-flagged row `getRate` returns) for a missing row, an
+  // expired row, OR a quote outside the operator's allow-list — the three
+  // cases the storefront treats identically: fall back to the base
+  // currency. Missing-table-resilient: a query that throws (the
+  // `fx_rates` table not migrated on this deploy) reads as "no rate", so
+  // a storefront without the table degrades to base display rather than
+  // 500-ing every priced page. The `at` epoch-ms parameter overrides
+  // "now" for the freshness check (tests, deterministic replay).
+  async function getRateForDisplay(base, quote, at) {
+    _assertCurrency(base,  "base");
+    _assertCurrency(quote, "quote");
+    if (base === quote) return { rate_bps: BPS_SCALE, stale: false };
+    if (supported.indexOf(quote) === -1) return null;
+    var now = at == null ? _now() : at;
+    var row;
+    try {
+      row = await getRate(base, quote);
+    } catch (_e) {
+      // fx_rates table absent / query failure — degrade to base display.
+      return null;
+    }
+    if (!row || row.expires_at < now) return null;
+    return { rate_bps: row.rate_bps, stale: false, source: row.source, fetched_at: row.fetched_at };
+  }
+
   return {
     supportedCurrencies: supported.slice(),
     setRate:             setRate,
     getRate:             getRate,
+    getRateForDisplay:   getRateForDisplay,
     convert:             convert,
     format:              format,
     convertAndFormat:    convertAndFormat,
@@ -421,9 +450,177 @@ function create(opts) {
   };
 }
 
+// ---- display presenter (request-scoped) ---------------------------------
+//
+// The storefront renders a price string at dozens of call sites (PDP,
+// catalog grids, search cards, cart lines + totals). Those renderers are
+// synchronous; the FX-rate + rounding-rule lookups are async D1 reads.
+// The presenter resolves the rate + rule ONCE per request (`load`), then
+// hands the renderers a synchronous `format(amount_minor, currency)` that
+// converts the catalog's base-currency price into the visitor's chosen
+// display currency and formats it for that currency's locale.
+//
+// This is DISPLAY-ONLY. The cart / order / payment currency is unchanged
+// — `pricing.format` + the stored order totals remain authoritative for
+// what the customer is charged. The presenter only transforms the string
+// the customer reads. When the display currency is the base currency (or
+// unset / unknown / has no usable FX rate), `format` is exactly
+// `b.money.fromMinorUnits(...).format(locale)` over the base amount.
+
+// Default BCP 47 locale per currency so a EUR price renders "27,59 €"
+// and a JPY price renders "¥3,200" without the operator wiring a locale
+// table. The visitor's Accept-Language can override via `opts.locale`.
+var DEFAULT_LOCALE_BY_CURRENCY = {
+  USD: "en-US", CAD: "en-CA", AUD: "en-AU", NZD: "en-NZ", SGD: "en-SG",
+  HKD: "en-HK", INR: "en-IN", GBP: "en-GB", EUR: "de-DE", CHF: "de-CH",
+  SEK: "sv-SE", NOK: "nb-NO", DKK: "da-DK", JPY: "ja-JP", KRW: "ko-KR",
+  BRL: "pt-BR", MXN: "es-MX",
+};
+
+function _localeFor(currency, fallback) {
+  return DEFAULT_LOCALE_BY_CURRENCY[currency] || fallback || "en-US";
+}
+
+// Pure base→display minor-unit conversion. Composes b.money.convert (the
+// framework's banker's-rounding FX step, ISO 4217 exponent-aware) for the
+// currency change, then the pure currency-rounding step for the display
+// increment rule (CHF 0.05, SEK 0.10, …). No I/O, no audit-log write —
+// the audit log is for committed checkout roundings, not the read-side
+// display render. `rateBps` is the integer basis-points rate
+// (rate * 10000); `rule` is the shaped rounding rule (or null for none).
+function _convertMinorForDisplay(baseMinor, baseCurrency, displayCurrency, rateBps, rule) {
+  var convertedMinor;
+  if (baseCurrency === displayCurrency || rateBps === BPS_SCALE) {
+    convertedMinor = baseMinor;
+  } else {
+    var money    = b.money.fromMinorUnits(BigInt(baseMinor), baseCurrency);
+    var rateStr  = _bpsToDecimal(rateBps);
+    var provider = { rate: function (_from, _to) { return rateStr; } };
+    convertedMinor = Number(b.money.convert(money, displayCurrency, provider).toMinorUnits());
+  }
+  // Display-increment rounding — only when an active rule covers the
+  // display-side render. The rule's `applies_to` is honoured: a rule
+  // scoped to `cart_total` only does not touch a PDP price.
+  if (rule && rule.increment_minor > 1 &&
+      (rule.applies_to === "all" || rule.applies_to === "display_only")) {
+    convertedMinor = currencyRounding.round(convertedMinor, rule.increment_minor, rule.mode);
+  }
+  return convertedMinor;
+}
+
+// Build a presenter for ONE request. `displayCurrency` is the visitor's
+// chosen currency (from the sealed cookie); `baseCurrency` is the
+// catalog's settlement currency (USD by default). Resolves the FX rate +
+// rounding rule up front so the returned `format` is synchronous.
+//
+//   opts.fx              — a currencyDisplay.create() instance (FX reads)
+//   opts.rounding        — a currencyRounding.create() instance (optional)
+//   opts.displayCurrency — the visitor's choice (may be null / unknown)
+//   opts.baseCurrency    — catalog settlement currency (default "USD")
+//   opts.locale          — override the per-currency default locale
+//   opts.at              — epoch-ms freshness override (tests)
+//
+// When the display currency equals the base, is unset, is unsupported, or
+// has no usable FX rate, the presenter resolves to an INACTIVE presenter
+// that formats in the base currency — never a broken / NaN price.
+async function loadPresenter(opts) {
+  opts = opts || {};
+  var baseCurrency = opts.baseCurrency == null ? "USD" : opts.baseCurrency;
+  _assertCurrency(baseCurrency, "baseCurrency");
+  var requested = opts.displayCurrency;
+
+  // No / garbage choice, or the base currency itself → base presenter.
+  if (typeof requested !== "string" || !CURRENCY_RE.test(requested) || requested === baseCurrency) {
+    return _basePresenter(baseCurrency, opts.locale);
+  }
+  if (!opts.fx || typeof opts.fx.getRateForDisplay !== "function") {
+    return _basePresenter(baseCurrency, opts.locale);
+  }
+  // Outside the operator's allow-list → base presenter (and the switcher
+  // never lists it, so this is the tampered-cookie path).
+  if (opts.fx.supportedCurrencies && opts.fx.supportedCurrencies.indexOf(requested) === -1) {
+    return _basePresenter(baseCurrency, opts.locale);
+  }
+
+  var rate = await opts.fx.getRateForDisplay(baseCurrency, requested, opts.at);
+  if (!rate) {
+    // No usable FX rate (missing / stale / table absent) → base display.
+    return _basePresenter(baseCurrency, opts.locale);
+  }
+
+  var rule = null;
+  if (opts.rounding && typeof opts.rounding.getRule === "function") {
+    try {
+      rule = await opts.rounding.getRule(requested);
+      if (rule && !rule.active) rule = null;
+    } catch (_e) {
+      // currency_rounding_rules table absent / read failure — convert
+      // without the display-increment step. Banker's rounding from the
+      // FX step still applies, so the price is never broken.
+      rule = null;
+    }
+  }
+
+  var locale  = opts.locale || _localeFor(requested);
+  var rateBps = rate.rate_bps;
+
+  return {
+    active:          true,
+    baseCurrency:    baseCurrency,
+    displayCurrency: requested,
+    locale:          locale,
+    note:            _disclosure(requested, baseCurrency),
+    // Synchronous price renderer. `currency` is the price's stored
+    // currency; when it matches the base we convert to the display
+    // currency, otherwise we format it as-is (a price already quoted in
+    // a non-base currency isn't re-converted — we have no base→that rate
+    // resolved this request, and re-quoting it would be wrong).
+    format: function (amountMinor, currency) {
+      var cur = currency == null ? baseCurrency : currency;
+      if (cur !== baseCurrency) {
+        return b.money.fromMinorUnits(BigInt(amountMinor), cur).format(_localeFor(cur, "en-US"));
+      }
+      var displayMinor = _convertMinorForDisplay(amountMinor, baseCurrency, requested, rateBps, rule);
+      return b.money.fromMinorUnits(BigInt(displayMinor), requested).format(locale);
+    },
+  };
+}
+
+// The pass-through presenter — `format` is byte-for-byte `pricing.format`
+// (b.money over the stored amount + currency). Used whenever no display
+// conversion applies, so every call site can use `presenter.format`
+// unconditionally.
+function _basePresenter(baseCurrency, localeOverride) {
+  return {
+    active:          false,
+    baseCurrency:    baseCurrency,
+    displayCurrency: baseCurrency,
+    locale:          localeOverride || _localeFor(baseCurrency),
+    note:            null,
+    format: function (amountMinor, currency) {
+      var cur = currency == null ? baseCurrency : currency;
+      var loc = localeOverride || _localeFor(cur, "en-US");
+      return b.money.fromMinorUnits(BigInt(amountMinor), cur).format(loc);
+    },
+  };
+}
+
+// The customer-facing disclosure shown near converted prices: the charge
+// stays in the settlement currency even though the display is converted.
+function _disclosure(displayCurrency, baseCurrency) {
+  return "Prices shown in " + displayCurrency + "; you'll be charged in " + baseCurrency + ".";
+}
+
 module.exports = {
-  create:               create,
-  DEFAULT_TTL_MS:       DEFAULT_TTL_MS,
-  DEFAULT_SUPPORTED:    DEFAULT_SUPPORTED,
-  BPS_SCALE:            BPS_SCALE,
+  create:                  create,
+  loadPresenter:           loadPresenter,
+  DEFAULT_TTL_MS:          DEFAULT_TTL_MS,
+  DEFAULT_SUPPORTED:       DEFAULT_SUPPORTED,
+  BPS_SCALE:               BPS_SCALE,
+  DEFAULT_LOCALE_BY_CURRENCY: DEFAULT_LOCALE_BY_CURRENCY,
+  // Pure conversion exposed so the edge worker computes byte-identical
+  // display prices from the same rate + rule inputs.
+  convertMinorForDisplay:  _convertMinorForDisplay,
+  localeFor:               _localeFor,
+  disclosure:              _disclosure,
 };

package/lib/storefront.js

@@ -27,6 +27,7 @@
 
 var emailModule = require("./email");
 var pricing      = require("./pricing");
+var currencyDisplayModule = require("./currency-display");
 
 var b = require("./vendor/blamejs");
 
@@ -234,6 +235,7 @@ var LAYOUT =
   "        </ul>\n" +
   "      </div>\n" +
   "    </div>\n" +
+    "    RAW_CURRENCY_SWITCHER\n" +
   "    <div class=\"site-footer__copy\">\n" +
   "      <p>&copy; {{year}} {{shop_name}} — built on blamejs · Apache 2.0 licensed.</p>\n" +
   "      <ul>\n" +
@@ -315,6 +317,63 @@ function _islandScript(name, opts) {
     (sri ? " integrity=\"" + sri + "\"" : "") + " defer" + policyAttr + "></script>";
 }
 
+// Multi-currency display switcher — a GET form in the footer listing the
+// operator's display currencies. Selecting one POSTs to /currency, which
+// sets the sealed `shop_ccy` cookie and redirects back. The currently
+// selected currency is pre-checked. Absent a presenter (feature not
+// wired) the whole block is empty so older deploys render unchanged.
+// `currencies` is the operator's allow-list; `selected` is the active
+// display currency; `note` is the "charged in <base>" disclosure (present
+// only when a non-base currency is active).
+function _buildCurrencySwitcher(opts) {
+  if (!opts || !Array.isArray(opts.currencies) || opts.currencies.length < 2) return "";
+  var esc = function (s) { return b.template.escapeHtml(String(s)); };
+  var selected = opts.selected || opts.currencies[0];
+  var options = opts.currencies.map(function (c) {
+    var sel = c === selected ? " selected" : "";
+    return "<option value=\"" + esc(c) + "\"" + sel + ">" + esc(c) + "</option>";
+  }).join("");
+  // GET-action would expose the choice in the URL + cache key; a POST
+  // keeps it in the sealed cookie and bypasses the edge cache via the
+  // 303 redirect. `redirect_to` carries the current path so the visitor
+  // lands back where they were. The form auto-submits via the island
+  // script when present; without JS the explicit "Set" button submits.
+  var noteHtml = opts.note
+    ? "<p class=\"currency-switcher__note\">" + esc(opts.note) + "</p>"
+    : "";
+  return "<div class=\"currency-switcher\">\n" +
+    "      <form class=\"currency-switcher__form\" method=\"post\" action=\"/currency\">\n" +
+    "        <input type=\"hidden\" name=\"redirect_to\" value=\"" + esc(opts.redirect_to || "/") + "\">\n" +
+    "        <label class=\"currency-switcher__label\" for=\"currency-select\">Display currency</label>\n" +
+    "        <select id=\"currency-select\" name=\"currency\" class=\"currency-switcher__select\" data-currency-switcher>" + options + "</select>\n" +
+    "        <button type=\"submit\" class=\"currency-switcher__btn\">Set</button>\n" +
+    "      </form>\n" +
+    "      " + noteHtml + "\n" +
+    "    </div>";
+}
+
+// The per-request price formatter a renderer uses for every displayed
+// price. When the route handler resolved a display-currency presenter and
+// threaded it in as `opts.format_price`, that's used (it converts base →
+// display currency + applies the display rounding rule). Otherwise the
+// renderer falls back to `pricing.format` — identical to pre-feature
+// behaviour, so an un-wired store or any renderer the route handler
+// didn't thread keeps formatting in the catalog currency.
+function _priceFormatter(opts) {
+  return (opts && typeof opts.format_price === "function") ? opts.format_price : pricing.format;
+}
+
+// Lift the currency-switcher fields off a renderer's opts so they reach
+// `_wrap` unchanged. Keeps the per-renderer `_wrap` call sites short.
+function _currencyWrapOpts(opts) {
+  return {
+    currency_options:     opts.currency_options,
+    currency_selected:    opts.currency_selected,
+    currency_note:        opts.currency_note,
+    currency_redirect_to: opts.currency_redirect_to,
+  };
+}
+
 function _wrap(opts) {
   var themeCss = (opts && typeof opts.theme_css === "string" && opts.theme_css.length)
     ? opts.theme_css
@@ -333,6 +392,15 @@ function _wrap(opts) {
   var ogDescription = opts.og_description || "Open-source ecommerce framework built on blamejs. Server-rendered HTML, post-quantum crypto, zero npm runtime dependencies.";
   var ogImage       = opts.og_image       || "/assets/brand/logo.png";
   var ogUrl         = opts.og_url         || "";
+  // Multi-currency display switcher — populated only when the operator
+  // configured >1 display currency (opts.currency_options). The block is
+  // empty otherwise, so a single-currency store renders unchanged.
+  var switcherHtml = _buildCurrencySwitcher({
+    currencies:  opts.currency_options,
+    selected:    opts.currency_selected,
+    note:        opts.currency_note,
+    redirect_to: opts.currency_redirect_to,
+  });
   return _render(LAYOUT, {
     title:          opts.title,
     shop_name:      shopName,
@@ -348,6 +416,7 @@ function _wrap(opts) {
     body:           "RAW_BODY_PLACEHOLDER",
   }).replace("RAW_CSS_INTEGRITY", themeCssIntegrity)
     .replace("RAW_CONSENT_SCRIPT", _islandScript("consent.js", { id: "consent-island", policy: _activeConsentPolicy }))
+    .replace("RAW_CURRENCY_SWITCHER", switcherHtml)
     .replace("RAW_BODY_PLACEHOLDER", opts.body);
   // The body is RAW HTML (already rendered + escaped at the
   // per-fragment level). The placeholder swap is post-render so the
@@ -607,9 +676,10 @@ function renderHome(opts) {
   var cartCount = opts.cart_count == null ? 0 : opts.cart_count;
   var title     = opts.title || "Shop";
   var assetPrefix = opts.asset_prefix || "/assets/";
+  var fmt = _priceFormatter(opts);
   var products    = opts.products.map(function (p) {
     var priceStr = p.starting_price_minor != null
-      ? pricing.format(p.starting_price_minor, p.starting_price_currency || "USD")
+      ? fmt(p.starting_price_minor, p.starting_price_currency || "USD")
       : "—";
     // Hero image — first media row attached to the product (the
     // route handler bundles it in via `p.hero_media`). Image-less
@@ -684,13 +754,13 @@ function renderHome(opts) {
   // designed surface even when no products are loaded yet —
   // visitors land on the storefront shell, not a tech demo.
   var body = hero + catalog;
-  return _wrap({
+  return _wrap(Object.assign({
     title:      title,
     shop_name:  shopName,
     cart_count: cartCount,
     theme_css: opts.theme_css,
     body:       body,
-  });
+  }, _currencyWrapOpts(opts)));
 }
 
 // ---- search results -----------------------------------------------------
@@ -914,9 +984,10 @@ function renderSearch(opts) {
       .replace("RAW_CLEAR", clearLink);
   } else {
     var assetPrefix = opts.asset_prefix || "/assets/";
+    var fmt = _priceFormatter(opts);
     var cards = products.map(function (p) {
       var priceStr = p.starting_price_minor != null
-        ? pricing.format(p.starting_price_minor, p.starting_price_currency || "USD")
+        ? fmt(p.starting_price_minor, p.starting_price_currency || "USD")
         : "—";
       var imageUrl = p.hero_media ? assetPrefix + p.hero_media.r2_key : null;
       var imageAlt = p.hero_media ? (p.hero_media.alt_text || p.title) : null;
@@ -932,14 +1003,14 @@ function renderSearch(opts) {
   } else {
     body = header + correctionHtml + chipsHtml + resultsInner;
   }
-  return _wrap({
+  return _wrap(Object.assign({
     title:      "Search",
     shop_name:  opts.shop_name || "blamejs.shop",
     cart_count: opts.cart_count,
     search_q:   opts.q,
     theme_css: opts.theme_css,
     body:       body,
-  });
+  }, _currencyWrapOpts(opts)));
 }
 
 // ---- product detail -----------------------------------------------------
@@ -2654,9 +2725,10 @@ function renderProduct(opts) {
   var shopName = opts.shop_name || "blamejs.shop";
   var cartCount = opts.cart_count == null ? 0 : opts.cart_count;
   var description = opts.product.description || "";
+  var fmt = _priceFormatter(opts);
   var rendered = variants.map(function (v) {
     var price = prices[v.id];
-    var priceStr = price ? pricing.format(price.amount_minor, price.currency) : "—";
+    var priceStr = price ? fmt(price.amount_minor, price.currency) : "—";
     var vTitle = v.title || (Object.keys(v.options || {}).map(function (k) { return v.options[k]; }).join(" / ") || "Default");
     return { id: v.id, sku: v.sku, title: vTitle, price: priceStr };
   });
@@ -2762,7 +2834,7 @@ function renderProduct(opts) {
   });
   jsonLd = (jsonLd || "") + breadcrumbJsonLd;
 
-  return _wrap({
+  return _wrap(Object.assign({
     title:          opts.product.title,
     shop_name:      shopName,
     cart_count:     cartCount,
@@ -2772,7 +2844,7 @@ function renderProduct(opts) {
     og_description: description || ("Browse " + opts.product.title + " on " + shopName + "."),
     og_image:       ogImage,
     body:           body + jsonLd,
-  });
+  }, _currencyWrapOpts(opts)));
 }
 
 // ---- cart --------------------------------------------------------------
@@ -3299,6 +3371,7 @@ function renderCart(opts) {
   // route handler bundles it in. Lines without an entry render with
   // a dashed-placeholder tile + the SKU as the fallback title.
   var lookup  = opts.product_lookup || {};
+  var fmt = _priceFormatter(opts);
   var rendered = lines.map(function (l) {
     var match  = lookup[l.variant_id] || null;
     var prod   = match && match.product;
@@ -3309,16 +3382,16 @@ function renderCart(opts) {
       id:             l.id,
       sku:            l.sku,
       qty:            String(l.qty),
-      unit:           pricing.format(l.unit_amount_minor, l.unit_currency),
-      total:          pricing.format(l.qty * l.unit_amount_minor, l.unit_currency),
+      unit:           fmt(l.unit_amount_minor, l.unit_currency),
+      total:          fmt(l.qty * l.unit_amount_minor, l.unit_currency),
       product_title:  (prod && prod.title) || l.sku,
       product_url:    prod ? ("/products/" + prod.slug) : "#",
       image_url:      imageUrl,
       image_alt:      imageAlt,
     };
   });
-  var subtotal = pricing.format(totals.subtotal_minor,    totals.currency);
-  var total    = pricing.format(totals.grand_total_minor, totals.currency);
+  var subtotal = fmt(totals.subtotal_minor,    totals.currency);
+  var total    = fmt(totals.grand_total_minor, totals.currency);
   if (opts.theme) {
     return opts.theme.render("cart", {
       title:          "Cart",
@@ -3364,13 +3437,13 @@ function renderCart(opts) {
       total:     total,
     }).replace("RAW_LINES", rows);
   }
-  return _wrap({
+  return _wrap(Object.assign({
     title:      "Cart",
     shop_name:  shopName,
     cart_count: lines.length,
     theme_css: opts.theme_css,
     body:       body,
-  });
+  }, _currencyWrapOpts(opts)));
 }
 
 // ---- admin landing (HTML — the rest of /admin/* is JSON API) ----------
@@ -3637,6 +3710,14 @@ var OAUTH_COOKIE_NAME = "shop_oauth";
 // Sealed so it can't be forged to mis-attribute a signup.
 var REFERRAL_COOKIE_NAME = "shop_ref";
 
+// Sealed cookie holding the visitor's chosen DISPLAY currency (ISO 4217).
+// Display-only: the cart / order / payment currency is unchanged — this
+// only selects which currency the price strings are rendered in. Sealed
+// so a tampered value can't smuggle a non-allow-listed code past the
+// reader; a garbage value reads as "unset" and the storefront renders in
+// the base currency. Path "/" so the choice persists across the catalog.
+var CURRENCY_COOKIE_NAME = "shop_ccy";
+
 // Shape of a valid session id — mirrors cart.js's SESSION_ID_RE.
 var SID_SHAPE_RE = /^[A-Za-z0-9_-]{16,64}$/;
 
@@ -3864,6 +3945,24 @@ function _uaClass(req) {
   return "unknown";
 }
 
+var CCY_SHAPE_RE = /^[A-Z]{3}$/;
+
+// The visitor's chosen display currency, or null. Sealed so the value
+// can't be forged; a missing / malformed / mis-shaped value reads as null
+// (→ base-currency display), never throws.
+function _readCurrencyCookie(req) {
+  var raw = _cookieJar().readSealed(req, CURRENCY_COOKIE_NAME);
+  if (raw === null || !CCY_SHAPE_RE.test(raw)) return null;
+  return raw;
+}
+function _setCurrencyCookie(res, code) {
+  var T = b.constants.TIME;
+  _cookieJar().writeSealed(res, CURRENCY_COOKIE_NAME, code, { expires: new Date(Date.now() + T.days(180)) });
+}
+function _clearCurrencyCookie(res) {
+  _cookieJar().clear(res, CURRENCY_COOKIE_NAME);
+}
+
 // ---- account-page renderers --------------------------------------------
 
 var ACCOUNT_LOGIN_PAGE =
@@ -4131,6 +4230,76 @@ function mount(router, deps) {
     return lines.length;
   }
 
+  // ---- multi-currency display -------------------------------------------
+  //
+  // Opt-in: wired only when the operator supplies `deps.currencyDisplay`
+  // (an FX-rate cache instance) AND `deps.currency_display_options` (the
+  // allow-list of display currencies, base first). Absent either, every
+  // render call gets an empty currency bundle and prices stay in the base
+  // currency exactly as before. `deps.currencyRounding` is optional —
+  // present, it applies the per-currency display-increment rule (CHF 0.05,
+  // SEK 0.10); absent, conversion uses banker's rounding only.
+  var _ccyBase    = (deps.currency_base || "USD").toUpperCase();
+  var _ccyOptions = Array.isArray(deps.currency_display_options)
+    ? deps.currency_display_options.map(function (c) { return String(c).toUpperCase(); })
+    : null;
+  // The feature mounts (the /currency route + the per-request bundle)
+  // whenever an FX instance is wired AND the boot-time allow-list names
+  // >1 currency. The per-request `currency_config` resolver can narrow /
+  // widen the live allow-list, but mounting is decided once at boot from
+  // the seed so a single-currency store never registers the route.
+  var _ccyEnabled = !!(deps.currencyDisplay && _ccyOptions && _ccyOptions.length > 1);
+  var _ccyConfig  = typeof deps.currency_config === "function" ? deps.currency_config : null;
+
+  // Per-request currency bundle merged into every render call's opts:
+  //   format_price          — sync base→display formatter (or pricing.format)
+  //   currency_options       — the switcher's option list
+  //   currency_selected      — the visitor's active display currency
+  //   currency_note          — "charged in <base>" disclosure (when converting)
+  //   currency_redirect_to   — the path the switcher returns the visitor to
+  // A read / conversion failure degrades to the base bundle (prices in the
+  // base currency) — a broken FX backend never breaks a priced page.
+  async function _currencyForReq(req) {
+    if (!_ccyEnabled) return {};
+    var path = String((req && req.url) || "/").split("?")[0] || "/";
+    // Resolve the live base + allow-list (config override, else the boot
+    // seed). A resolver failure falls back to the seed.
+    var base = _ccyBase;
+    var options = _ccyOptions;
+    if (_ccyConfig) {
+      try {
+        var cfg = await _ccyConfig();
+        if (cfg && cfg.base) base = cfg.base;
+        if (cfg && Array.isArray(cfg.options) && cfg.options.length) options = cfg.options;
+      } catch (_e) { /* keep the boot seed */ }
+    }
+    var bundle = {
+      currency_options:     options,
+      currency_selected:    base,
+      currency_redirect_to: path,
+    };
+    var chosen = _readCurrencyCookie(req);
+    try {
+      var presenter = await currencyDisplayModule.loadPresenter({
+        fx:              deps.currencyDisplay,
+        rounding:        deps.currencyRounding || null,
+        baseCurrency:    base,
+        displayCurrency: chosen,
+      });
+      // The presenter only activates when the chosen currency is in the
+      // live allow-list AND has a usable rate. A cookie naming a currency
+      // the operator since removed from the list resolves to base.
+      if (presenter && presenter.active && options.indexOf(presenter.displayCurrency) !== -1) {
+        bundle.format_price      = presenter.format;
+        bundle.currency_selected = presenter.displayCurrency;
+        if (presenter.note) bundle.currency_note = presenter.note;
+      }
+    } catch (_e) {
+      // FX / rounding backend unavailable — fall back to base display.
+    }
+    return bundle;
+  }
+
   // Absolute shareable referral link for a code. Prefers the operator's
   // configured origin (deps.shop_origin / SHOP_ORIGIN) so the link is
   // stable across the edge/container split; falls back to the request's
@@ -4254,8 +4423,9 @@ function mount(router, deps) {
   // reachable via multiple variant SKUs. Drop-silent on a primitive
   // error so a bundles read failure can't 500 the PDP — the rail just
   // doesn't render (mirrors the reviews/Q&A degrade-to-empty stance).
-  async function _resolveBundleOffers(variantSkus, currency) {
+  async function _resolveBundleOffers(variantSkus, currency, fmtPrice) {
     if (!deps.bundles) return [];
+    var fmt = typeof fmtPrice === "function" ? fmtPrice : pricing.format;
     var seen = Object.create(null);
     var offers = [];
     try {
@@ -4300,9 +4470,9 @@ function mount(router, deps) {
             bundle_sku:         bundle.bundle_sku,
             title:              bundle.title,
             components:         componentsOut,
-            list_total_str:     pricing.format(listMinor, cur),
-            amount_str:         pricing.format(amountMinor, cur),
-            discount_str:       discountMinor > 0 ? pricing.format(discountMinor, cur) : null,
+            list_total_str:     fmt(listMinor, cur),
+            amount_str:         fmt(amountMinor, cur),
+            discount_str:       discountMinor > 0 ? fmt(discountMinor, cur) : null,
             available:          available,
             unavailable_reason: available
               ? null
@@ -4326,8 +4496,9 @@ function mount(router, deps) {
   // that quantity. Rows read as ascending ranges ("1–4", "5–9",
   // "10+"). Returns [] when no active sku-scoped tier set exists.
   // Drop-silent on a read failure so the PDP still renders.
-  async function _resolveQtyBreaks(sku, unitMinor, currency) {
+  async function _resolveQtyBreaks(sku, unitMinor, currency, fmtPrice) {
     if (!deps.quantityDiscounts || unitMinor == null) return [];
+    var fmt = typeof fmtPrice === "function" ? fmtPrice : pricing.format;
     var breakdown;
     try {
       breakdown = await deps.quantityDiscounts.tierBreakdown({
@@ -4350,7 +4521,7 @@ function mount(router, deps) {
     if (sorted[0].min_quantity > 1) {
       out.push({
         label:    "1–" + (sorted[0].min_quantity - 1),
-        unit_str: pricing.format(unitMinor, currency),
+        unit_str: fmt(unitMinor, currency),
       });
     }
     for (var i = 0; i < sorted.length; i += 1) {
@@ -4358,7 +4529,7 @@ function mount(router, deps) {
       var next = sorted[i + 1];
       var label = next ? (t.min_quantity + "–" + (next.min_quantity - 1)) : (t.min_quantity + "+");
       var unit = t.sample_discounted_unit_minor != null ? t.sample_discounted_unit_minor : unitMinor;
-      out.push({ label: label, unit_str: pricing.format(unit, currency) });
+      out.push({ label: label, unit_str: fmt(unit, currency) });
     }
     return out;
   }
@@ -4398,7 +4569,35 @@ function mount(router, deps) {
     return out;
   }
 
-  router.get("/", async function (_req, res) {
+  // POST /currency — set (or clear) the visitor's display-currency choice.
+  // Registered only when multi-currency display is wired. Display-only:
+  // this NEVER touches the cart / order / payment currency — it sets the
+  // sealed `shop_ccy` cookie that selects which currency price strings are
+  // rendered in, then 303-redirects back so the new choice takes effect on
+  // the next render. A choice outside the operator's allow-list clears the
+  // cookie (→ base-currency display) rather than persisting a code the
+  // switcher would never offer.
+  if (_ccyEnabled) {
+    router.post("/currency", function (req, res) {
+      var body = req.body || {};
+      var chosen = typeof body.currency === "string" ? body.currency.toUpperCase() : "";
+      // `redirect_to` is constrained to a same-origin path (leading single
+      // slash, no scheme / host / protocol-relative `//`) so the switcher
+      // can't be turned into an open redirect.
+      var rawTo = typeof body.redirect_to === "string" ? body.redirect_to : "/";
+      var to = (/^\/(?!\/)/.test(rawTo)) ? rawTo : "/";
+      if (chosen === _ccyBase || _ccyOptions.indexOf(chosen) === -1) {
+        _clearCurrencyCookie(res);
+      } else {
+        _setCurrencyCookie(res, chosen);
+      }
+      res.status(303);
+      res.setHeader && res.setHeader("location", to);
+      return res.end ? res.end() : res.send("");
+    });
+  }
+
+  router.get("/", async function (req, res) {
     var page = await deps.catalog.products.list({ status: "active", limit: 24 });
     // Best-effort "starting price" + "hero media" lookup. Each
     // product on the home grid carries its first variant's USD
@@ -4423,7 +4622,8 @@ function mount(router, deps) {
         hero_media:              heroMedia,
       }));
     }
-    var html = renderHome({ products: products, shop_name: shopName, theme: theme });
+    var ccy = await _currencyForReq(req);
+    var html = renderHome(Object.assign({ products: products, shop_name: shopName, theme: theme }, ccy));
     _send(res, 200, html);
   });
 
@@ -4553,7 +4753,8 @@ function mount(router, deps) {
         cartCount = lines.length;
       }
     }
-    _send(res, 200, renderSearch({
+    var ccy = await _currencyForReq(req);
+    _send(res, 200, renderSearch(Object.assign({
       q:               q,
       products:        products,
       facets:          facetGroups,
@@ -4561,7 +4762,7 @@ function mount(router, deps) {
       corrected_query: correctedQ,
       shop_name:       shopName,
       cart_count:      cartCount,
-    }));
+    }, ccy)));
   });
 
   router.get("/products/:slug", async function (req, res) {
@@ -4654,14 +4855,16 @@ function mount(router, deps) {
     // so the buy path renders regardless. The quantity-break table is
     // built against the first variant's list price — the band a shopper
     // sees on the PDP matches what the cart charges at that quantity.
+    var ccy = await _currencyForReq(req);
+    var ccyFmt = ccy.format_price || null;
     var variantSkus = variants.map(function (v) { return v.sku; });
-    var bundleOffers = await _resolveBundleOffers(variantSkus, "USD");
+    var bundleOffers = await _resolveBundleOffers(variantSkus, "USD", ccyFmt);
     var firstVariant = variants[0] || null;
     var firstPrice = firstVariant ? prices[firstVariant.id] : null;
     var qtyBreaks = firstVariant && firstPrice
-      ? await _resolveQtyBreaks(firstVariant.sku, firstPrice.amount_minor, firstPrice.currency)
+      ? await _resolveQtyBreaks(firstVariant.sku, firstPrice.amount_minor, firstPrice.currency, ccyFmt)
       : [];
-    var html = renderProduct({
+    var html = renderProduct(Object.assign({
       product:        product,
       variants:       variants,
       prices:         prices,
@@ -4677,7 +4880,7 @@ function mount(router, deps) {
       shop_name:      shopName,
       cart_count:     cartCount,
       theme:          theme,
-    });
+    }, ccy));
     _send(res, 200, html);
   });
 
@@ -4992,19 +5195,20 @@ function mount(router, deps) {
   }
 
   router.get("/cart", async function (req, res) {
+    var ccy = await _currencyForReq(req);
     var sid = _readSidCookie(req);
     if (!sid) {
-      return _send(res, 200, renderCart({
+      return _send(res, 200, renderCart(Object.assign({
         lines: [], totals: { subtotal_minor: 0, grand_total_minor: 0, currency: "USD" },
         shop_name: shopName, theme: theme,
-      }));
+      }, ccy)));
     }
     var c = await deps.cart.bySession(sid);
     if (!c) {
-      return _send(res, 200, renderCart({
+      return _send(res, 200, renderCart(Object.assign({
         lines: [], totals: { subtotal_minor: 0, grand_total_minor: 0, currency: "USD" },
         shop_name: shopName, theme: theme,
-      }));
+      }, ccy)));
     }
     var rawLines = await deps.cart.listLines(c.id);
     // Reapply the active quantity-break for each line at its current
@@ -5031,14 +5235,14 @@ function mount(router, deps) {
         hero_media: media.length ? media[0] : null,
       };
     }
-    _send(res, 200, renderCart({
+    _send(res, 200, renderCart(Object.assign({
       lines:           lines,
       totals:          totals,
       product_lookup:  productLookup,
       can_save:        !!(deps.saveForLater && deps.customers),
       shop_name:       shopName,
       theme:           theme,
-    }));
+    }, ccy)));
   });
 
   // ---- checkout flow -------------------------------------------------

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.13.4",
-      "tag": "v0.13.4",
+      "version": "0.13.5",
+      "tag": "v0.13.5",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.13.x
 
+- v0.13.5 (2026-05-26) — **`b.ai.aedtBiasAudit` — NYC Local Law 144 bias audit.** b.ai.aedtBiasAudit computes the bias-audit figures New York City Local Law 144 requires before an Automated Employment Decision Tool may screen candidates (NYC Admin. Code §20-870 et seq.; DCWP rules 6 RCNY §5-300). Given the per-category counts an independent auditor collected — selected/total for a pass-fail tool, or scored-above-the-overall-median/total for a continuous-score tool — it returns the selection (or scoring) rate, the impact ratio (each group's rate divided by the most-selected group's rate), and an adverse-impact flag (impact ratio below the EEOC four-fifths threshold of 0.8) for every group, across the sex, race/ethnicity, and intersectional dimensions, plus the most-selected group per dimension and an overall flag. Categories under 2% of the audited data are marked excluded per DCWP discretion. It is a pure calculation that produces exactly the figures the annual published summary must contain — the law mandates the calculation, not any particular remediation. The relevant compliance postures (nyc-ll144, and ca-tfaia for California SB 53) were already in the catalog. **Added:** *`b.ai.aedtBiasAudit` — Local Law 144 selection/scoring rates and four-fifths impact ratios* — `b.ai.aedtBiasAudit({ type, metadata, categories, minCategoryShare? })` where `type` is `"selection"` (group entries `{ selected, total }`) or `"scoring"` (`{ scoredAboveMedian, total }`). Returns per-group rate, impact ratio, and `adverseImpact` flag across the `sex`, `raceEthnicity`, and `intersectional` dimensions, plus the most-selected group per dimension and an `anyAdverseImpact` summary. Categories below `minCategoryShare` (2% default) are excluded from the impact-ratio basis. Throws `AedtBiasAuditError` on malformed input.
+
 - v0.13.4 (2026-05-26) — **`b.crdt` — conflict-free replicated data types.** b.crdt adds state-based Conflict-free Replicated Data Types: data structures that independent replicas update without coordination and still converge to the same value once they have exchanged state. Each type's merge is a join over a semilattice — commutative, associative, and idempotent — so replicas can merge in any order, any number of times, and agree, which makes these the substrate for active/active cluster state, offline-first clients that reconcile on reconnect, and eventually-consistent counters, sets, and maps. The release ships the full state-based family: grow-only and positive-negative counters (gCounter / pnCounter), grow-only, two-phase, and observed-remove sets (gSet / twoPSet / orSet), a last-write-wins register (lwwRegister), and an observed-remove map (orMap). Every type exposes the same contract — local mutators, merge(other) that returns a converged instance without mutating either operand, value() for the materialized value, and state() / fromState() for a JSON-serializable form to snapshot via b.archive or b.backup or ship to a peer — and carries a replicaId so per-replica contributions stay distinct. **Added:** *`b.crdt` — state-based CvRDT counters, sets, register, and map* — `b.crdt.gCounter` / `pnCounter` (grow-only and increment/decrement counters), `b.crdt.gSet` / `twoPSet` / `orSet` (grow-only, two-phase, and observed-remove sets — `orSet` supports re-add and resolves a concurrent add-vs-remove as add-wins), `b.crdt.lwwRegister` (last-write-wins with a deterministic replicaId tie-break), and `b.crdt.orMap` (observed-remove keys with last-write-wins values). Each exposes `merge` / `value` / `state` / `fromState` and converges by the CvRDT laws. `orSet` and `orMap` accept `tombstoneRetention` to bound tombstone memory against a remove flood.
 
 - v0.13.3 (2026-05-26) — **`b.crypto.xwing` — X-Wing hybrid post-quantum KEM.** b.crypto.xwing adds the X-Wing hybrid key-encapsulation mechanism (draft-connolly-cfrg-xwing-kem): it runs ML-KEM-768 and X25519 side by side and binds their shared secrets with SHA3-256, so an encapsulated key stays secure as long as either ML-KEM-768 or X25519 holds. That is the conservative shape for moving off classical ECDH today — a harvest-now-decrypt-later attacker must break the lattice KEM, and a hypothetical ML-KEM break still leaves X25519 standing. keygen() produces a 32-byte decapsulation seed and a 1216-byte public key; encapsulate(publicKey) returns a 1120-byte ciphertext and a 32-byte shared secret; decapsulate(secretKey, ciphertext) recovers it. The X-Wing combiner is frozen, but its specification is still an IETF Internet-Draft, so this primitive is marked experimental and sits beside the existing pre-RFC post-quantum HPKE drafts; it composes the framework's vendored ML-KEM-768 and X25519 with SHA3 and adds no new cryptographic core. The combiner is known-answer-tested byte-for-byte against the draft's definition. **Added:** *`b.crypto.xwing` — X-Wing hybrid PQ/T KEM (experimental)* — `keygen(seed?)` → `{ publicKey (1216 B), secretKey (32-byte seed) }`; `encapsulate(publicKey, eseed?)` → `{ ciphertext (1120 B), sharedSecret (32 B) }`; `decapsulate(secretKey, ciphertext)` → the 32-byte shared secret. Both `keygen` and `encapsulate` accept an optional seed for deterministic operation. The combiner — `SHA3-256(ssMLKEM ‖ ssX25519 ‖ ctX25519 ‖ pkX25519 ‖ label)` — is exposed as `combiner` for advanced use. Marked `experimental` while draft-connolly-cfrg-xwing-kem remains an Internet-Draft; the algorithm itself is frozen.

package/lib/vendor/blamejs/README.md

@@ -189,6 +189,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 - **Content provenance** — C2PA 2.1 + California SB-942 / AB-853 manifest builder for AI-generated media (provider, model id + version, timestamp, content ID, signed) (`b.contentCredentials`)
 - **AI usage quotas** — per-tenant / per-model budgets metered by tokens / requests / cost-usd / compute-hours over calendar-aligned windows, with an atomic conditional reserve (no charge-then-refund race) + hard/soft/warn enforcement and an optional cross-node store; defends OWASP LLM10:2025 unbounded consumption / denial-of-wallet (`b.ai.quota`)
 - **AI capability routing** — model-capability registry (context window / modalities / tool use / reasoning tier / cost rates) + a router that picks the cheapest model satisfying a request's requirements, refusing capability mismatches before the inference call (NIST AI RMF MAP + Model Cards); composes with `b.ai.quota` cost budgets (`b.ai.capability`)
+- **AEDT bias audit** — NYC Local Law 144 bias-audit figures (`b.ai.aedtBiasAudit`): selection / scoring rates and EEOC four-fifths-rule impact ratios across sex, race/ethnicity, and their intersection, with the most-selected group and adverse-impact flags (impact ratio < 0.8) for the annual published summary; sub-2% categories excludable per DCWP §5-301
 ### Compliance regimes
 
 - **Posture coordinator** — `b.compliance` cascades operator-declared regime into retention / audit / db / cryptoField via POSTURE_DEFAULTS:

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.13.4",
-  "createdAt": "2026-05-27T00:29:21.229Z",
+  "frameworkVersion": "0.13.5",
+  "createdAt": "2026-05-27T01:38:32.776Z",
   "exports": {
     "a2a": {
       "type": "object",
@@ -1388,6 +1388,10 @@
             }
           }
         },
+        "aedtBiasAudit": {
+          "type": "function",
+          "arity": 1
+        },
         "aiContentDetect": {
           "type": "object",
           "members": {

package/lib/vendor/blamejs/examples/wiki/lib/source-comment-block-validator.js

@@ -55,6 +55,7 @@ var KNOWN_POSTURES = {
   // v0.10.8 — EU AI Act Art. 50 + Art. 11 + AB-853 + CAC + AI governance
   "eu-ai-act-art-50": 1, "eu-ai-act-art-11": 1,
   "ca-ab-853": 1, "ca-sb-942": 1,
+  "nyc-ll144": 1, "ca-tfaia": 1,
   "cac-genai-label": 1,
   "nist-ai-600-1": 1, "nist-ai-rmf": 1,
   "iso-42001": 1, "iso-23894": 1,

package/lib/vendor/blamejs/index.js

@@ -477,6 +477,7 @@ module.exports = {
     quota:           require("./lib/ai-quota"),
     capability:      require("./lib/ai-capability"),
     dp:              require("./lib/ai-dp"),
+    aedtBiasAudit:   require("./lib/ai-aedt-bias-audit"),
   },
   promisePool:      require("./lib/promise-pool"),
   sdNotify:         require("./lib/sd-notify"),

package/lib/vendor/blamejs/lib/ai-aedt-bias-audit.js

@@ -0,0 +1,180 @@
+"use strict";
+/**
+ * @module b.ai.aedtBiasAudit
+ * @nav    Compliance
+ * @title  AEDT Bias Audit
+ *
+ * @intro
+ *   Compute the bias-audit statistics New York City Local Law 144 requires
+ *   before an Automated Employment Decision Tool (AEDT) may be used to screen
+ *   candidates or employees. The law (NYC Admin. Code §20-870 et seq., in force
+ *   since 2023-07-05; DCWP rules 6 RCNY §5-300 et seq.) requires an independent
+ *   annual audit that reports, for each demographic category, the rate at which
+ *   the tool selects (or scores above the median for) that group and the
+ *   <em>impact ratio</em> — that group's rate divided by the rate of the
+ *   most-selected group. An impact ratio below the four-fifths (0.8) threshold
+ *   from the EEOC Uniform Guidelines flags potential adverse impact; the law
+ *   requires the number to be calculated and published, not any particular
+ *   remediation.
+ *
+ *   The audit is computed across three dimensions: sex, race/ethnicity, and
+ *   the intersection of the two, using the EEOC categories. Categories that
+ *   make up less than 2% of the audited data may be excluded from the impact-
+ *   ratio calculation at the auditor's discretion (DCWP §5-301). This primitive
+ *   takes the per-category counts — selected/total for a pass-fail tool, or
+ *   scored-above-the-overall-median/total for a continuous-score tool — and
+ *   returns the selection (or scoring) rate, impact ratio, and adverse-impact
+ *   flag per group, plus the most-selected group and an overall flag. It is a
+ *   pure calculation: the operator supplies the data an independent auditor
+ *   collected, and gets back the figures the published summary must contain.
+ *
+ * @card
+ *   NYC Local Law 144 AEDT bias audit (`b.ai.aedtBiasAudit`) — selection /
+ *   scoring rates and four-fifths-rule impact ratios across sex, race/ethnicity,
+ *   and their intersection, with the most-selected group and adverse-impact
+ *   flags for the published audit summary.
+ */
+
+var validateOpts = require("./validate-opts");
+var { defineClass } = require("./framework-error");
+
+var AedtBiasAuditError = defineClass("AedtBiasAuditError", { alwaysPermanent: true });
+
+var FOUR_FIFTHS = 4 / 5;         // EEOC Uniform Guidelines four-fifths adverse-impact threshold
+var DEFAULT_MIN_SHARE = 0.02;    // DCWP §5-301 — categories under 2% may be excluded
+var DIMENSIONS = ["sex", "raceEthnicity", "intersectional"];
+
+function _str(v, label) {
+  if (typeof v !== "string" || v.length === 0) throw new AedtBiasAuditError("aedt/bad-metadata", "aedtBiasAudit: metadata." + label + " must be a non-empty string");
+  return v;
+}
+function _count(v, label) {
+  if (typeof v !== "number" || !isFinite(v) || v < 0 || Math.floor(v) !== v) throw new AedtBiasAuditError("aedt/bad-count", "aedtBiasAudit: " + label + " must be a non-negative integer");
+  return v;
+}
+
+// Reduce one dimension's per-group counts to the LL-144 figures.
+function _auditDimension(groups, type, minShare) {
+  var names = Object.keys(groups);
+  var rows = [];
+  var dimensionTotal = 0;
+  var numeratorKey = type === "scoring" ? "scoredAboveMedian" : "selected";
+
+  names.forEach(function (name) {
+    var g = groups[name];
+    if (!g || typeof g !== "object") throw new AedtBiasAuditError("aedt/bad-count", "aedtBiasAudit: group '" + name + "' must be an object with " + numeratorKey + " + total");
+    var total = _count(g.total, name + ".total");
+    var num = _count(g[numeratorKey], name + "." + numeratorKey);
+    if (num > total) throw new AedtBiasAuditError("aedt/bad-count", "aedtBiasAudit: " + name + "." + numeratorKey + " (" + num + ") exceeds total (" + total + ")");
+    dimensionTotal += total;
+    rows.push({ category: name, total: total, _num: num, rate: total === 0 ? 0 : num / total });
+  });
+
+  // Exclude sub-threshold categories (auditor discretion), then find the
+  // most-selected group among those that remain.
+  var maxRate = 0;
+  var mostSelected = null;
+  rows.forEach(function (r) {
+    r.share = dimensionTotal === 0 ? 0 : r.total / dimensionTotal;
+    r.excluded = dimensionTotal > 0 && r.share < minShare;
+    if (!r.excluded && r.rate > maxRate) { maxRate = r.rate; mostSelected = r.category; }
+  });
+
+  rows.forEach(function (r) {
+    r.impactRatio = (r.excluded || maxRate === 0) ? null : r.rate / maxRate;
+    r.adverseImpact = r.impactRatio !== null && r.impactRatio < FOUR_FIFTHS;
+    delete r._num;
+  });
+  // Stable order: highest rate first, then category name.
+  rows.sort(function (a, b) { return b.rate - a.rate || (a.category < b.category ? -1 : a.category > b.category ? 1 : 0); });
+  return { rows: rows, mostSelected: mostSelected };
+}
+
+/**
+ * @primitive  b.ai.aedtBiasAudit
+ * @signature  b.ai.aedtBiasAudit(opts)
+ * @since      0.13.5
+ * @status     stable
+ * @compliance nyc-ll144, soc2
+ * @related    b.ai.disclosure.applyAll, b.ai.disclosure.chatbot
+ *
+ * Compute the NYC Local Law 144 bias-audit figures from per-category counts.
+ * <code>type</code> is <code>"selection"</code> for a pass-fail tool (each
+ * group entry is <code>{ selected, total }</code>) or <code>"scoring"</code>
+ * for a continuous-score tool (<code>{ scoredAboveMedian, total }</code>, where
+ * the count is candidates scoring above the <em>overall</em> median). Returns
+ * the selection/scoring rate, impact ratio (group rate ÷ most-selected group's
+ * rate), and an <code>adverseImpact</code> flag (impact ratio &lt; 0.8) per
+ * group, across the <code>sex</code>, <code>raceEthnicity</code>, and
+ * <code>intersectional</code> dimensions, plus the most-selected group per
+ * dimension. Categories under <code>minCategoryShare</code> (2% by default) are
+ * marked <code>excluded</code> and left out of the impact-ratio basis. Throws
+ * <code>AedtBiasAuditError</code> on malformed input. The result is the data an
+ * employer must publish; the law mandates the calculation, not any remediation.
+ *
+ * @opts
+ *   type:             string,   // "selection" | "scoring" (required)
+ *   metadata:         object,   // { tool, auditor, auditDate, distributionDate? } (tool/auditor/auditDate required)
+ *   categories:       object,   // { sex?, raceEthnicity?, intersectional? } → { <group>: { selected|scoredAboveMedian, total } }
+ *   minCategoryShare: number,   // default: 0.02 (DCWP §5-301 — sub-2% categories may be excluded)
+ *
+ * @example
+ *   var report = b.ai.aedtBiasAudit({
+ *     type: "selection",
+ *     metadata: { tool: "ResumeRanker v3", auditor: "Acme Audit LLC", auditDate: "2026-05-26" },
+ *     categories: { sex: { Male: { selected: 60, total: 100 }, Female: { selected: 42, total: 100 } } },
+ *   });
+ *   report.results.sex[1].impactRatio;   // → 0.7  (Female: 42% / 60%)
+ *   report.results.sex[1].adverseImpact; // → true (below the 0.8 four-fifths threshold)
+ */
+function aedtBiasAudit(opts) {
+  opts = opts || {};
+  // Surface an unknown/typoed option as this primitive's own error type rather
+  // than the generic Error validateOpts throws, so the malformed-input contract
+  // (AedtBiasAuditError / e.code) holds for every bad-config path.
+  try { validateOpts(opts, ["type", "metadata", "categories", "minCategoryShare"], "aedtBiasAudit"); }
+  catch (e) { throw new AedtBiasAuditError("aedt/bad-opts", e && e.message || "aedtBiasAudit: invalid options"); }
+  if (opts.type !== "selection" && opts.type !== "scoring") throw new AedtBiasAuditError("aedt/bad-type", "aedtBiasAudit: type must be 'selection' or 'scoring'");
+
+  var md = opts.metadata || {};
+  var metadata = {
+    tool:             _str(md.tool, "tool"),
+    auditor:          _str(md.auditor, "auditor"),
+    auditDate:        _str(md.auditDate, "auditDate"),
+    distributionDate: md.distributionDate != null ? _str(md.distributionDate, "distributionDate") : null,
+  };
+
+  var minShare = opts.minCategoryShare != null ? opts.minCategoryShare : DEFAULT_MIN_SHARE;
+  if (typeof minShare !== "number" || !isFinite(minShare) || minShare < 0 || minShare >= 1) throw new AedtBiasAuditError("aedt/bad-share", "aedtBiasAudit: minCategoryShare must be a number in [0, 1)");
+
+  var cats = opts.categories || {};
+  var present = DIMENSIONS.filter(function (d) { return cats[d] && typeof cats[d] === "object" && Object.keys(cats[d]).length > 0; });
+  if (present.length === 0) throw new AedtBiasAuditError("aedt/no-categories", "aedtBiasAudit: at least one of sex / raceEthnicity / intersectional must carry group counts");
+
+  var results = {};
+  var mostSelected = {};
+  var adverseImpactGroups = [];
+  present.forEach(function (dim) {
+    var out = _auditDimension(cats[dim], opts.type, minShare);
+    results[dim] = out.rows;
+    mostSelected[dim] = out.mostSelected;
+    out.rows.forEach(function (r) { if (r.adverseImpact) adverseImpactGroups.push({ dimension: dim, category: r.category, impactRatio: r.impactRatio }); });
+  });
+
+  return {
+    type:     opts.type,
+    metadata: metadata,
+    results:  results,
+    summary:  {
+      mostSelected:        mostSelected,
+      adverseImpactGroups: adverseImpactGroups,
+      anyAdverseImpact:    adverseImpactGroups.length > 0,
+      fourFifthsThreshold: FOUR_FIFTHS,
+    },
+  };
+}
+
+aedtBiasAudit.FOUR_FIFTHS = FOUR_FIFTHS;
+aedtBiasAudit.AedtBiasAuditError = AedtBiasAuditError;
+
+module.exports = aedtBiasAudit;

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.13.4",
+  "version": "0.13.5",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.13.5.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.5",
+  "date": "2026-05-26",
+  "headline": "`b.ai.aedtBiasAudit` — NYC Local Law 144 bias audit",
+  "summary": "b.ai.aedtBiasAudit computes the bias-audit figures New York City Local Law 144 requires before an Automated Employment Decision Tool may screen candidates (NYC Admin. Code §20-870 et seq.; DCWP rules 6 RCNY §5-300). Given the per-category counts an independent auditor collected — selected/total for a pass-fail tool, or scored-above-the-overall-median/total for a continuous-score tool — it returns the selection (or scoring) rate, the impact ratio (each group's rate divided by the most-selected group's rate), and an adverse-impact flag (impact ratio below the EEOC four-fifths threshold of 0.8) for every group, across the sex, race/ethnicity, and intersectional dimensions, plus the most-selected group per dimension and an overall flag. Categories under 2% of the audited data are marked excluded per DCWP discretion. It is a pure calculation that produces exactly the figures the annual published summary must contain — the law mandates the calculation, not any particular remediation. The relevant compliance postures (nyc-ll144, and ca-tfaia for California SB 53) were already in the catalog.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.ai.aedtBiasAudit` — Local Law 144 selection/scoring rates and four-fifths impact ratios",
+          "body": "`b.ai.aedtBiasAudit({ type, metadata, categories, minCategoryShare? })` where `type` is `\"selection\"` (group entries `{ selected, total }`) or `\"scoring\"` (`{ scoredAboveMedian, total }`). Returns per-group rate, impact ratio, and `adverseImpact` flag across the `sex`, `raceEthnicity`, and `intersectional` dimensions, plus the most-selected group per dimension and an `anyAdverseImpact` summary. Categories below `minCategoryShare` (2% default) are excluded from the impact-ratio basis. Throws `AedtBiasAuditError` on malformed input."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/ai-aedt-bias-audit.test.js

@@ -0,0 +1,107 @@
+"use strict";
+/**
+ * Layer 0 — b.ai.aedtBiasAudit (NYC Local Law 144 AEDT bias audit).
+ *
+ * Oracle: the EEOC four-fifths rule and the DCWP §5-300 impact-ratio formula.
+ * The canonical worked example — a tool passing 60% of men and 42% of women —
+ * yields an impact ratio of 42/60 = 0.70 for women, below the 0.8 threshold.
+ * Boundary, scoring-rate, intersectional, sub-2% exclusion, and the
+ * most-selected basis are each asserted against the formula.
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+function row(report, dim, cat) { return report.results[dim].filter(function (r) { return r.category === cat; })[0]; }
+
+var MD = { tool: "ResumeRanker v3", auditor: "Acme Audit LLC", auditDate: "2026-05-26" };
+
+function testSurface() {
+  check("b.ai.aedtBiasAudit is a function", typeof b.ai.aedtBiasAudit === "function");
+  check("b.ai.aedtBiasAudit.FOUR_FIFTHS is 0.8", b.ai.aedtBiasAudit.FOUR_FIFTHS === 0.8);
+  check("b.ai.aedtBiasAudit.AedtBiasAuditError is a class", typeof b.ai.aedtBiasAudit.AedtBiasAuditError === "function");
+}
+
+function testFourFifthsWorkedExample() {
+  var r = b.ai.aedtBiasAudit({
+    type: "selection",
+    metadata: MD,
+    categories: { sex: { Male: { selected: 60, total: 100 }, Female: { selected: 42, total: 100 } } },
+  });
+  var f = row(r, "sex", "Female"), m = row(r, "sex", "Male");
+  check("Female selection rate 0.42", f.rate === 0.42);
+  check("Female impact ratio 0.70 (42/60)", Math.abs(f.impactRatio - 0.7) < 1e-9);
+  check("Female flagged adverse (< 0.8)", f.adverseImpact === true);
+  check("Male is the most-selected (ratio 1)", m.impactRatio === 1 && m.adverseImpact === false);
+  check("most-selected sex group is Male", r.summary.mostSelected.sex === "Male");
+  check("anyAdverseImpact true", r.summary.anyAdverseImpact === true);
+  check("adverseImpactGroups names Female", r.summary.adverseImpactGroups.length === 1 && r.summary.adverseImpactGroups[0].category === "Female");
+  check("metadata echoed", r.metadata.tool === MD.tool && r.metadata.auditor === MD.auditor && r.metadata.distributionDate === null);
+}
+
+function testFourFifthsBoundary() {
+  // Exactly 0.80 is NOT adverse (strictly-less-than threshold); 0.79 is.
+  var at = b.ai.aedtBiasAudit({ type: "selection", metadata: MD, categories: { sex: { X: { selected: 100, total: 100 }, Y: { selected: 80, total: 100 } } } });
+  check("impact ratio exactly 0.80 is not adverse", row(at, "sex", "Y").adverseImpact === false);
+  var below = b.ai.aedtBiasAudit({ type: "selection", metadata: MD, categories: { sex: { X: { selected: 100, total: 100 }, Y: { selected: 79, total: 100 } } } });
+  check("impact ratio 0.79 is adverse", row(below, "sex", "Y").adverseImpact === true);
+}
+
+function testScoringRate() {
+  // Scoring tools: rate = scored-above-overall-median / total.
+  var r = b.ai.aedtBiasAudit({ type: "scoring", metadata: MD, categories: { sex: { M: { scoredAboveMedian: 50, total: 100 }, F: { scoredAboveMedian: 30, total: 100 } } } });
+  check("scoring rate F 0.30", row(r, "sex", "F").rate === 0.3);
+  check("scoring impact ratio F 0.60 (30/50)", Math.abs(row(r, "sex", "F").impactRatio - 0.6) < 1e-9);
+}
+
+function testIntersectionalAndRace() {
+  var r = b.ai.aedtBiasAudit({
+    type: "selection",
+    metadata: MD,
+    categories: {
+      raceEthnicity: { "White": { selected: 80, total: 100 }, "Black or African American": { selected: 48, total: 100 } },
+      intersectional: { "Male - White": { selected: 90, total: 100 }, "Female - Black or African American": { selected: 45, total: 100 } },
+    },
+  });
+  check("race dimension computed", row(r, "raceEthnicity", "Black or African American").impactRatio === 0.6);
+  check("intersectional dimension computed", row(r, "intersectional", "Female - Black or African American").impactRatio === 0.5);
+  check("intersectional adverse flagged", row(r, "intersectional", "Female - Black or African American").adverseImpact === true);
+}
+
+function testSubTwoPercentExclusion() {
+  var r = b.ai.aedtBiasAudit({ type: "selection", metadata: MD, categories: { sex: { Big: { selected: 90, total: 1000 }, Tiny: { selected: 0, total: 10 } } } });
+  check("sub-2% category excluded", row(r, "sex", "Tiny").excluded === true);
+  check("excluded category has null impact ratio", row(r, "sex", "Tiny").impactRatio === null);
+  check("excluded category not flagged adverse", row(r, "sex", "Tiny").adverseImpact === false);
+  // A higher minCategoryShare excludes more.
+  var r2 = b.ai.aedtBiasAudit({ type: "selection", metadata: MD, minCategoryShare: 0, categories: { sex: { Big: { selected: 90, total: 1000 }, Tiny: { selected: 0, total: 10 } } } });
+  check("minCategoryShare 0 includes Tiny", row(r2, "sex", "Tiny").excluded === false);
+}
+
+function testErrors() {
+  check("bad type throws",        code(function () { b.ai.aedtBiasAudit({ type: "x", metadata: MD, categories: { sex: { M: { selected: 1, total: 1 } } } }); }) === "aedt/bad-type");
+  check("missing metadata throws", code(function () { b.ai.aedtBiasAudit({ type: "selection", metadata: {}, categories: { sex: { M: { selected: 1, total: 1 } } } }); }) === "aedt/bad-metadata");
+  check("no categories throws",    code(function () { b.ai.aedtBiasAudit({ type: "selection", metadata: MD, categories: {} }); }) === "aedt/no-categories");
+  check("selected > total throws", code(function () { b.ai.aedtBiasAudit({ type: "selection", metadata: MD, categories: { sex: { M: { selected: 5, total: 2 } } } }); }) === "aedt/bad-count");
+  check("negative count throws",   code(function () { b.ai.aedtBiasAudit({ type: "selection", metadata: MD, categories: { sex: { M: { selected: -1, total: 2 } } } }); }) === "aedt/bad-count");
+  check("bad minCategoryShare throws", code(function () { b.ai.aedtBiasAudit({ type: "selection", metadata: MD, minCategoryShare: 1, categories: { sex: { M: { selected: 1, total: 1 } } } }); }) === "aedt/bad-share");
+  // A typoed/unknown option must surface as AedtBiasAuditError (not a generic
+  // Error from validateOpts), so e.code / instanceof handling is reliable.
+  check("unknown opt throws aedt/bad-opts", code(function () { b.ai.aedtBiasAudit({ type: "selection", metadata: MD, categories: { sex: { M: { selected: 1, total: 1 } } }, minCategoryshare: 0.01 }); }) === "aedt/bad-opts");
+  var threw = null;
+  try { b.ai.aedtBiasAudit({ type: "selection", metadata: MD, categories: { sex: { M: { selected: 1, total: 1 } } }, bogus: 1 }); } catch (e) { threw = e; }
+  check("unknown opt error is an AedtBiasAuditError", threw instanceof b.ai.aedtBiasAudit.AedtBiasAuditError);
+}
+
+async function run() {
+  testSurface();
+  testFourFifthsWorkedExample();
+  testFourFifthsBoundary();
+  testScoringRate();
+  testIntersectionalAndRace();
+  testSubTwoPercentExclusion();
+  testErrors();
+}
+module.exports = { run: run };
+if (require.main === module) { run().then(function () { console.log("[ai-aedt-bias-audit] OK — " + helpers.getChecks() + " checks passed"); }, function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }); }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.1.35",
+  "version": "0.1.36",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {