@blamejs/blamejs-shop 0.1.35 → 0.1.37

package/lib/translations.js

@@ -537,10 +537,213 @@ function _hydrate(row) {
   };
 }
 
+// ---- storefront UI chrome catalog --------------------------------------
+//
+// The chrome strings the storefront renders on EVERY page — nav links,
+// search controls, footer columns + links, the newsletter band, the
+// locale switcher. These are the default-locale (`en`) baseline; an
+// operator localises any key by authoring a `translations` row under
+// resource_kind `ui`, resource_id `chrome`, field = the dotted key with
+// dots rewritten to underscores (the table's `field` slug grammar
+// forbids dots), locale = the target tag. `resolveChrome` reads those
+// overrides at boot per active locale and layers them over this baseline,
+// so an untranslated key always renders the English string — never a
+// raw key. The exact English values here are the literal strings the
+// layout shipped inline before i18n landed, so an `en` storefront is
+// byte-identical to the pre-i18n markup.
+//
+// Both render paths (the container `lib/storefront.js` and the edge
+// `worker/render/*`) consume this same catalog through `b.i18n`, so a
+// given locale resolves to one identical string set on both sides.
+var CHROME_KEY_PREFIX = "ui.chrome.";
+var CHROME_RESOURCE_KIND = "ui";
+var CHROME_RESOURCE_ID   = "chrome";
+
+var CHROME_DEFAULTS = Object.freeze({
+  skip_to_content:    "Skip to content",
+
+  util_pill:          "Open source · Apache 2.0",
+  util_msg:           "Server-rendered HTML · post-quantum crypto on by default · zero npm runtime deps",
+  util_star:          "Star on GitHub →",
+
+  search_label:       "Search products",
+  search_placeholder: "Search the catalog",
+  search_submit:      "Search",
+
+  nav_shop:           "Shop",
+  nav_framework:      "Framework",
+  nav_account:        "Account",
+  // The cart aria-label carries the live item count; `{count}` is
+  // interpolated by b.i18n at render time.
+  nav_cart_aria:      "Cart, {count} items",
+
+  newsletter_eyebrow: "Stay in the loop",
+  newsletter_title:   "Get release notes the day they ship.",
+  newsletter_lede:    "No marketing emails. A single short note when there's a new framework release, a security advisory, or a primitive worth knowing about.",
+  newsletter_email:   "Email address",
+  newsletter_submit:  "Subscribe",
+
+  footer_tagline:     "An open-source shop framework — server-rendered HTML, zero npm runtime dependencies, security defaults on.",
+
+  footer_shop_heading:    "Shop",
+  footer_shop_all:        "All products",
+  footer_shop_collections: "Collections",
+  footer_shop_categories: "Categories",
+  footer_shop_new:        "New arrivals",
+  footer_shop_sale:       "On sale",
+  footer_shop_compare:    "Compare",
+  footer_shop_cart:       "Cart",
+
+  footer_framework_heading: "Framework",
+  footer_framework_source:  "Source on GitHub",
+  footer_framework_core:    "blamejs core",
+  footer_framework_security: "Security policy",
+  footer_framework_changelog: "Changelog",
+
+  footer_operators_heading: "Operators",
+  footer_operators_account: "Account",
+  footer_operators_orders:  "Orders",
+  footer_operators_admin:   "Admin",
+  footer_operators_contact: "Contact",
+
+  footer_copy_suffix:  "built on blamejs · Apache 2.0 licensed.",
+  footer_legal_security: "Security",
+  footer_legal_privacy:  "Privacy",
+  footer_legal_terms:    "Terms",
+  footer_legal_cookies:  "Manage cookies",
+
+  locale_switcher_label: "Language",
+  locale_switcher_submit: "Go",
+});
+
+// Default English chrome strings exposed verbatim for the render paths
+// to fall back on when no i18n instance is configured (the storefront
+// stays browsable on a deploy that hasn't seeded a locale policy).
+function chromeDefaults() {
+  return Object.assign({}, CHROME_DEFAULTS);
+}
+
+// Build a `b.i18n` instance carrying the chrome catalog for every active
+// locale. The baseline `en` tree is the shipped defaults; each other
+// locale's tree starts empty and is layered with the operator's `ui`
+// translation rows (read once here). b.i18n's own lookup chain then
+// falls a missing key through to `defaultLocale` (the shipped English),
+// so a partially-translated locale never surfaces a raw key.
+//
+// `opts.overrides` is the pre-read DB override map
+// ({ "<locale>": { "<field>": "<value>", ... } }) — passed in by the
+// caller (the storefront mount reads it via `readChromeOverrides`)
+// rather than read here, so this stays a synchronous, query-free build
+// that the edge Worker can run with the same inputs as the container.
+function createChromeI18n(opts) {
+  opts = opts || {};
+  var defaultLocale = opts.defaultLocale || BASELINE_LOCALE;
+  var locales = Array.isArray(opts.locales) && opts.locales.length
+    ? opts.locales.slice()
+    : [defaultLocale];
+  if (locales.indexOf(defaultLocale) === -1) locales.unshift(defaultLocale);
+  var overrides = opts.overrides || {};
+
+  // Each locale's inline tree under the single `ui.chrome.*` namespace.
+  // The default locale gets the full English baseline; other locales get
+  // only their authored overrides (the rest falls through b.i18n's chain
+  // to the default locale).
+  var translations = {};
+  for (var li = 0; li < locales.length; li += 1) {
+    var loc = locales[li];
+    var chrome = {};
+    if (loc === defaultLocale) {
+      var defKeys = Object.keys(CHROME_DEFAULTS);
+      for (var d = 0; d < defKeys.length; d += 1) chrome[defKeys[d]] = CHROME_DEFAULTS[defKeys[d]];
+    }
+    var ovr = overrides[loc];
+    if (ovr) {
+      var ovrKeys = Object.keys(ovr);
+      for (var o = 0; o < ovrKeys.length; o += 1) {
+        // Only keys we know about land in the tree — an operator typo
+        // (a field that isn't a chrome key) is ignored rather than
+        // shadowing a real string with garbage.
+        if (Object.prototype.hasOwnProperty.call(CHROME_DEFAULTS, ovrKeys[o])) {
+          chrome[ovrKeys[o]] = ovr[ovrKeys[o]];
+        }
+      }
+    }
+    translations[loc] = { ui: { chrome: chrome } };
+  }
+
+  return b.i18n.create({
+    defaultLocale:  defaultLocale,
+    locales:        locales,
+    fallbackLocale: defaultLocale,
+    translations:   translations,
+    // A missing chrome key returns the English baseline via the chain;
+    // should a key be absent from every locale (only possible if the
+    // baseline catalog itself is edited), return the dotted key rather
+    // than throwing inside a render. The render path never shows it
+    // because every shipped key has an `en` baseline.
+    missingKey:     "return-key",
+  });
+}
+
+// Resolve the full chrome string set for one locale into a flat object
+// keyed by the chrome field names (`nav_shop`, `footer_shop_all`, …),
+// each value already locale-resolved through the i18n chain. The render
+// paths feed this straight into the layout placeholders. The
+// `nav_cart_aria` string keeps its literal `{count}` placeholder — the
+// render path interpolates the live cart count uniformly across both
+// substrates, so this stays request-independent and cacheable.
+function resolveChrome(i18n, locale) {
+  var out = {};
+  var keys = Object.keys(CHROME_DEFAULTS);
+  for (var i = 0; i < keys.length; i += 1) {
+    var key = keys[i];
+    // No interpolation vars — `{count}` (and any future placeholder)
+    // survives as a literal for the render path to fill.
+    out[key] = i18n.t(CHROME_KEY_PREFIX + key, {}, { locale: locale });
+  }
+  return out;
+}
+
+// Read the operator's `ui`/`chrome` override rows for the given locales
+// into the `{ "<locale>": { "<field>": "<value>" } }` shape
+// `createChromeI18n` consumes. Missing-table-resilient: a deploy whose
+// `translations` table hasn't been migrated (or a transient read error)
+// yields an empty override map, so the storefront falls back to the
+// English baseline rather than 500-ing. The caller passes a `query`
+// function (the externalDb handle).
+async function readChromeOverrides(query, locales) {
+  if (typeof query !== "function" || !Array.isArray(locales) || !locales.length) return {};
+  var out = {};
+  try {
+    var placeholders = locales.map(function (_l, i) { return "?" + (i + 3); }).join(", ");
+    var rows = (await query(
+      "SELECT locale, field, value FROM translations " +
+      "WHERE resource_kind = ?1 AND resource_id = ?2 AND locale IN (" + placeholders + ")",
+      [CHROME_RESOURCE_KIND, CHROME_RESOURCE_ID].concat(locales)
+    )).rows;
+    for (var i = 0; i < rows.length; i += 1) {
+      var r = rows[i];
+      if (!out[r.locale]) out[r.locale] = {};
+      out[r.locale][r.field] = r.value;
+    }
+  } catch (_e) {
+    // Missing table / read failure — degrade to the English baseline.
+    return {};
+  }
+  return out;
+}
+
 module.exports = {
   create:                  create,
   MAX_VALUE_LEN:           MAX_VALUE_LEN,
   MAX_BULK_ROWS:           MAX_BULK_ROWS,
   BASELINE_LOCALE:         BASELINE_LOCALE,
   DEFAULT_SAMPLE_SIZE:     DEFAULT_SAMPLE_SIZE,
+  CHROME_DEFAULTS:         CHROME_DEFAULTS,
+  CHROME_RESOURCE_KIND:    CHROME_RESOURCE_KIND,
+  CHROME_RESOURCE_ID:      CHROME_RESOURCE_ID,
+  chromeDefaults:          chromeDefaults,
+  createChromeI18n:        createChromeI18n,
+  resolveChrome:           resolveChrome,
+  readChromeOverrides:     readChromeOverrides,
 };

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.13.4",
-      "tag": "v0.13.4",
+      "version": "0.13.6",
+      "tag": "v0.13.6",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.13.x
 
+- v0.13.6 (2026-05-26) — **`b.ai.frontierModelProtocol` — California SB 53 frontier-AI obligations.** b.ai.frontierModelProtocol assesses a developer's obligations under California's Transparency in Frontier Artificial Intelligence Act — SB 53, Cal. Bus. & Prof. Code §22757.10, effective 2026-01-01 — from a model's training compute and the developer's revenue. It reports whether the model crosses the frontier threshold (more than 10^26 training FLOPs), whether the developer is a large frontier developer (prior-year revenue, with affiliates, above $500M), and the resulting obligations: every frontier developer must report critical safety incidents and publish a transparency report, and a large frontier developer must additionally publish an annual safety framework and disclose its catastrophic-risk assessment. Passing a candidate safety framework reports which required elements (risk identification, mitigation, governance, cybersecurity, standards alignment) are missing. b.ai.frontierModelProtocol.incidentReport validates a critical-incident type against the Act's four categories and computes the notification deadline to the California Office of Emergency Services — 15 days from discovery, or 24 hours when there is an imminent risk of death or serious physical injury. The ca-tfaia compliance posture was already in the catalog. **Added:** *`b.ai.frontierModelProtocol` — SB 53 threshold classification, obligations, and incident reporting* — `b.ai.frontierModelProtocol({ trainingFlops, annualRevenueUsd, framework? })` returns `isFrontierModel`, `isLargeFrontierDeveloper`, the `obligations` list, and (when a framework is supplied) its `frameworkGaps`. `b.ai.frontierModelProtocol.incidentReport({ type, discoveredAt, imminentRiskToLife? })` builds a critical-safety-incident report with the California OES recipient and a `dueAt` / `deadlineHours` computed from the 15-day (or 24-hour imminent-risk) statutory window; `type` must be one of the four categories in `INCIDENT_TYPES`. Throws `FrontierProtocolError` on malformed input.
+
+- v0.13.5 (2026-05-26) — **`b.ai.aedtBiasAudit` — NYC Local Law 144 bias audit.** b.ai.aedtBiasAudit computes the bias-audit figures New York City Local Law 144 requires before an Automated Employment Decision Tool may screen candidates (NYC Admin. Code §20-870 et seq.; DCWP rules 6 RCNY §5-300). Given the per-category counts an independent auditor collected — selected/total for a pass-fail tool, or scored-above-the-overall-median/total for a continuous-score tool — it returns the selection (or scoring) rate, the impact ratio (each group's rate divided by the most-selected group's rate), and an adverse-impact flag (impact ratio below the EEOC four-fifths threshold of 0.8) for every group, across the sex, race/ethnicity, and intersectional dimensions, plus the most-selected group per dimension and an overall flag. Categories under 2% of the audited data are marked excluded per DCWP discretion. It is a pure calculation that produces exactly the figures the annual published summary must contain — the law mandates the calculation, not any particular remediation. The relevant compliance postures (nyc-ll144, and ca-tfaia for California SB 53) were already in the catalog. **Added:** *`b.ai.aedtBiasAudit` — Local Law 144 selection/scoring rates and four-fifths impact ratios* — `b.ai.aedtBiasAudit({ type, metadata, categories, minCategoryShare? })` where `type` is `"selection"` (group entries `{ selected, total }`) or `"scoring"` (`{ scoredAboveMedian, total }`). Returns per-group rate, impact ratio, and `adverseImpact` flag across the `sex`, `raceEthnicity`, and `intersectional` dimensions, plus the most-selected group per dimension and an `anyAdverseImpact` summary. Categories below `minCategoryShare` (2% default) are excluded from the impact-ratio basis. Throws `AedtBiasAuditError` on malformed input.
+
 - v0.13.4 (2026-05-26) — **`b.crdt` — conflict-free replicated data types.** b.crdt adds state-based Conflict-free Replicated Data Types: data structures that independent replicas update without coordination and still converge to the same value once they have exchanged state. Each type's merge is a join over a semilattice — commutative, associative, and idempotent — so replicas can merge in any order, any number of times, and agree, which makes these the substrate for active/active cluster state, offline-first clients that reconcile on reconnect, and eventually-consistent counters, sets, and maps. The release ships the full state-based family: grow-only and positive-negative counters (gCounter / pnCounter), grow-only, two-phase, and observed-remove sets (gSet / twoPSet / orSet), a last-write-wins register (lwwRegister), and an observed-remove map (orMap). Every type exposes the same contract — local mutators, merge(other) that returns a converged instance without mutating either operand, value() for the materialized value, and state() / fromState() for a JSON-serializable form to snapshot via b.archive or b.backup or ship to a peer — and carries a replicaId so per-replica contributions stay distinct. **Added:** *`b.crdt` — state-based CvRDT counters, sets, register, and map* — `b.crdt.gCounter` / `pnCounter` (grow-only and increment/decrement counters), `b.crdt.gSet` / `twoPSet` / `orSet` (grow-only, two-phase, and observed-remove sets — `orSet` supports re-add and resolves a concurrent add-vs-remove as add-wins), `b.crdt.lwwRegister` (last-write-wins with a deterministic replicaId tie-break), and `b.crdt.orMap` (observed-remove keys with last-write-wins values). Each exposes `merge` / `value` / `state` / `fromState` and converges by the CvRDT laws. `orSet` and `orMap` accept `tombstoneRetention` to bound tombstone memory against a remove flood.
 
 - v0.13.3 (2026-05-26) — **`b.crypto.xwing` — X-Wing hybrid post-quantum KEM.** b.crypto.xwing adds the X-Wing hybrid key-encapsulation mechanism (draft-connolly-cfrg-xwing-kem): it runs ML-KEM-768 and X25519 side by side and binds their shared secrets with SHA3-256, so an encapsulated key stays secure as long as either ML-KEM-768 or X25519 holds. That is the conservative shape for moving off classical ECDH today — a harvest-now-decrypt-later attacker must break the lattice KEM, and a hypothetical ML-KEM break still leaves X25519 standing. keygen() produces a 32-byte decapsulation seed and a 1216-byte public key; encapsulate(publicKey) returns a 1120-byte ciphertext and a 32-byte shared secret; decapsulate(secretKey, ciphertext) recovers it. The X-Wing combiner is frozen, but its specification is still an IETF Internet-Draft, so this primitive is marked experimental and sits beside the existing pre-RFC post-quantum HPKE drafts; it composes the framework's vendored ML-KEM-768 and X25519 with SHA3 and adds no new cryptographic core. The combiner is known-answer-tested byte-for-byte against the draft's definition. **Added:** *`b.crypto.xwing` — X-Wing hybrid PQ/T KEM (experimental)* — `keygen(seed?)` → `{ publicKey (1216 B), secretKey (32-byte seed) }`; `encapsulate(publicKey, eseed?)` → `{ ciphertext (1120 B), sharedSecret (32 B) }`; `decapsulate(secretKey, ciphertext)` → the 32-byte shared secret. Both `keygen` and `encapsulate` accept an optional seed for deterministic operation. The combiner — `SHA3-256(ssMLKEM ‖ ssX25519 ‖ ctX25519 ‖ pkX25519 ‖ label)` — is exposed as `combiner` for advanced use. Marked `experimental` while draft-connolly-cfrg-xwing-kem remains an Internet-Draft; the algorithm itself is frozen.

package/lib/vendor/blamejs/README.md

@@ -189,6 +189,8 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 - **Content provenance** — C2PA 2.1 + California SB-942 / AB-853 manifest builder for AI-generated media (provider, model id + version, timestamp, content ID, signed) (`b.contentCredentials`)
 - **AI usage quotas** — per-tenant / per-model budgets metered by tokens / requests / cost-usd / compute-hours over calendar-aligned windows, with an atomic conditional reserve (no charge-then-refund race) + hard/soft/warn enforcement and an optional cross-node store; defends OWASP LLM10:2025 unbounded consumption / denial-of-wallet (`b.ai.quota`)
 - **AI capability routing** — model-capability registry (context window / modalities / tool use / reasoning tier / cost rates) + a router that picks the cheapest model satisfying a request's requirements, refusing capability mismatches before the inference call (NIST AI RMF MAP + Model Cards); composes with `b.ai.quota` cost budgets (`b.ai.capability`)
+- **AEDT bias audit** — NYC Local Law 144 bias-audit figures (`b.ai.aedtBiasAudit`): selection / scoring rates and EEOC four-fifths-rule impact ratios across sex, race/ethnicity, and their intersection, with the most-selected group and adverse-impact flags (impact ratio < 0.8) for the annual published summary; sub-2% categories excludable per DCWP §5-301
+- **Frontier AI protocol** — California SB 53 (Transparency in Frontier AI Act) obligations (`b.ai.frontierModelProtocol`): classify the frontier-model (>10²⁶ training FLOPs) and large-frontier-developer (>$500M revenue) thresholds, enumerate the resulting obligations, check a safety framework for required elements, and build a critical-safety-incident report with the 15-day / 24-hour California OES notification deadline (`.incidentReport`)
 ### Compliance regimes
 
 - **Posture coordinator** — `b.compliance` cascades operator-declared regime into retention / audit / db / cryptoField via POSTURE_DEFAULTS:

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.13.4",
-  "createdAt": "2026-05-27T00:29:21.229Z",
+  "frameworkVersion": "0.13.6",
+  "createdAt": "2026-05-27T02:34:13.690Z",
   "exports": {
     "a2a": {
       "type": "object",
@@ -1388,6 +1388,10 @@
             }
           }
         },
+        "aedtBiasAudit": {
+          "type": "function",
+          "arity": 1
+        },
         "aiContentDetect": {
           "type": "object",
           "members": {
@@ -1573,6 +1577,10 @@
             }
           }
         },
+        "frontierModelProtocol": {
+          "type": "function",
+          "arity": 1
+        },
         "input": {
           "type": "object",
           "members": {

package/lib/vendor/blamejs/examples/wiki/lib/source-comment-block-validator.js

@@ -55,6 +55,7 @@ var KNOWN_POSTURES = {
   // v0.10.8 — EU AI Act Art. 50 + Art. 11 + AB-853 + CAC + AI governance
   "eu-ai-act-art-50": 1, "eu-ai-act-art-11": 1,
   "ca-ab-853": 1, "ca-sb-942": 1,
+  "nyc-ll144": 1, "ca-tfaia": 1,
   "cac-genai-label": 1,
   "nist-ai-600-1": 1, "nist-ai-rmf": 1,
   "iso-42001": 1, "iso-23894": 1,

package/lib/vendor/blamejs/index.js

@@ -477,6 +477,8 @@ module.exports = {
     quota:           require("./lib/ai-quota"),
     capability:      require("./lib/ai-capability"),
     dp:              require("./lib/ai-dp"),
+    aedtBiasAudit:   require("./lib/ai-aedt-bias-audit"),
+    frontierModelProtocol: require("./lib/ai-frontier-protocol"),
   },
   promisePool:      require("./lib/promise-pool"),
   sdNotify:         require("./lib/sd-notify"),

package/lib/vendor/blamejs/lib/ai-aedt-bias-audit.js

@@ -0,0 +1,180 @@
+"use strict";
+/**
+ * @module b.ai.aedtBiasAudit
+ * @nav    Compliance
+ * @title  AEDT Bias Audit
+ *
+ * @intro
+ *   Compute the bias-audit statistics New York City Local Law 144 requires
+ *   before an Automated Employment Decision Tool (AEDT) may be used to screen
+ *   candidates or employees. The law (NYC Admin. Code §20-870 et seq., in force
+ *   since 2023-07-05; DCWP rules 6 RCNY §5-300 et seq.) requires an independent
+ *   annual audit that reports, for each demographic category, the rate at which
+ *   the tool selects (or scores above the median for) that group and the
+ *   <em>impact ratio</em> — that group's rate divided by the rate of the
+ *   most-selected group. An impact ratio below the four-fifths (0.8) threshold
+ *   from the EEOC Uniform Guidelines flags potential adverse impact; the law
+ *   requires the number to be calculated and published, not any particular
+ *   remediation.
+ *
+ *   The audit is computed across three dimensions: sex, race/ethnicity, and
+ *   the intersection of the two, using the EEOC categories. Categories that
+ *   make up less than 2% of the audited data may be excluded from the impact-
+ *   ratio calculation at the auditor's discretion (DCWP §5-301). This primitive
+ *   takes the per-category counts — selected/total for a pass-fail tool, or
+ *   scored-above-the-overall-median/total for a continuous-score tool — and
+ *   returns the selection (or scoring) rate, impact ratio, and adverse-impact
+ *   flag per group, plus the most-selected group and an overall flag. It is a
+ *   pure calculation: the operator supplies the data an independent auditor
+ *   collected, and gets back the figures the published summary must contain.
+ *
+ * @card
+ *   NYC Local Law 144 AEDT bias audit (`b.ai.aedtBiasAudit`) — selection /
+ *   scoring rates and four-fifths-rule impact ratios across sex, race/ethnicity,
+ *   and their intersection, with the most-selected group and adverse-impact
+ *   flags for the published audit summary.
+ */
+
+var validateOpts = require("./validate-opts");
+var { defineClass } = require("./framework-error");
+
+var AedtBiasAuditError = defineClass("AedtBiasAuditError", { alwaysPermanent: true });
+
+var FOUR_FIFTHS = 4 / 5;         // EEOC Uniform Guidelines four-fifths adverse-impact threshold
+var DEFAULT_MIN_SHARE = 0.02;    // DCWP §5-301 — categories under 2% may be excluded
+var DIMENSIONS = ["sex", "raceEthnicity", "intersectional"];
+
+function _str(v, label) {
+  if (typeof v !== "string" || v.length === 0) throw new AedtBiasAuditError("aedt/bad-metadata", "aedtBiasAudit: metadata." + label + " must be a non-empty string");
+  return v;
+}
+function _count(v, label) {
+  if (typeof v !== "number" || !isFinite(v) || v < 0 || Math.floor(v) !== v) throw new AedtBiasAuditError("aedt/bad-count", "aedtBiasAudit: " + label + " must be a non-negative integer");
+  return v;
+}
+
+// Reduce one dimension's per-group counts to the LL-144 figures.
+function _auditDimension(groups, type, minShare) {
+  var names = Object.keys(groups);
+  var rows = [];
+  var dimensionTotal = 0;
+  var numeratorKey = type === "scoring" ? "scoredAboveMedian" : "selected";
+
+  names.forEach(function (name) {
+    var g = groups[name];
+    if (!g || typeof g !== "object") throw new AedtBiasAuditError("aedt/bad-count", "aedtBiasAudit: group '" + name + "' must be an object with " + numeratorKey + " + total");
+    var total = _count(g.total, name + ".total");
+    var num = _count(g[numeratorKey], name + "." + numeratorKey);
+    if (num > total) throw new AedtBiasAuditError("aedt/bad-count", "aedtBiasAudit: " + name + "." + numeratorKey + " (" + num + ") exceeds total (" + total + ")");
+    dimensionTotal += total;
+    rows.push({ category: name, total: total, _num: num, rate: total === 0 ? 0 : num / total });
+  });
+
+  // Exclude sub-threshold categories (auditor discretion), then find the
+  // most-selected group among those that remain.
+  var maxRate = 0;
+  var mostSelected = null;
+  rows.forEach(function (r) {
+    r.share = dimensionTotal === 0 ? 0 : r.total / dimensionTotal;
+    r.excluded = dimensionTotal > 0 && r.share < minShare;
+    if (!r.excluded && r.rate > maxRate) { maxRate = r.rate; mostSelected = r.category; }
+  });
+
+  rows.forEach(function (r) {
+    r.impactRatio = (r.excluded || maxRate === 0) ? null : r.rate / maxRate;
+    r.adverseImpact = r.impactRatio !== null && r.impactRatio < FOUR_FIFTHS;
+    delete r._num;
+  });
+  // Stable order: highest rate first, then category name.
+  rows.sort(function (a, b) { return b.rate - a.rate || (a.category < b.category ? -1 : a.category > b.category ? 1 : 0); });
+  return { rows: rows, mostSelected: mostSelected };
+}
+
+/**
+ * @primitive  b.ai.aedtBiasAudit
+ * @signature  b.ai.aedtBiasAudit(opts)
+ * @since      0.13.5
+ * @status     stable
+ * @compliance nyc-ll144, soc2
+ * @related    b.ai.disclosure.applyAll, b.ai.disclosure.chatbot
+ *
+ * Compute the NYC Local Law 144 bias-audit figures from per-category counts.
+ * <code>type</code> is <code>"selection"</code> for a pass-fail tool (each
+ * group entry is <code>{ selected, total }</code>) or <code>"scoring"</code>
+ * for a continuous-score tool (<code>{ scoredAboveMedian, total }</code>, where
+ * the count is candidates scoring above the <em>overall</em> median). Returns
+ * the selection/scoring rate, impact ratio (group rate ÷ most-selected group's
+ * rate), and an <code>adverseImpact</code> flag (impact ratio &lt; 0.8) per
+ * group, across the <code>sex</code>, <code>raceEthnicity</code>, and
+ * <code>intersectional</code> dimensions, plus the most-selected group per
+ * dimension. Categories under <code>minCategoryShare</code> (2% by default) are
+ * marked <code>excluded</code> and left out of the impact-ratio basis. Throws
+ * <code>AedtBiasAuditError</code> on malformed input. The result is the data an
+ * employer must publish; the law mandates the calculation, not any remediation.
+ *
+ * @opts
+ *   type:             string,   // "selection" | "scoring" (required)
+ *   metadata:         object,   // { tool, auditor, auditDate, distributionDate? } (tool/auditor/auditDate required)
+ *   categories:       object,   // { sex?, raceEthnicity?, intersectional? } → { <group>: { selected|scoredAboveMedian, total } }
+ *   minCategoryShare: number,   // default: 0.02 (DCWP §5-301 — sub-2% categories may be excluded)
+ *
+ * @example
+ *   var report = b.ai.aedtBiasAudit({
+ *     type: "selection",
+ *     metadata: { tool: "ResumeRanker v3", auditor: "Acme Audit LLC", auditDate: "2026-05-26" },
+ *     categories: { sex: { Male: { selected: 60, total: 100 }, Female: { selected: 42, total: 100 } } },
+ *   });
+ *   report.results.sex[1].impactRatio;   // → 0.7  (Female: 42% / 60%)
+ *   report.results.sex[1].adverseImpact; // → true (below the 0.8 four-fifths threshold)
+ */
+function aedtBiasAudit(opts) {
+  opts = opts || {};
+  // Surface an unknown/typoed option as this primitive's own error type rather
+  // than the generic Error validateOpts throws, so the malformed-input contract
+  // (AedtBiasAuditError / e.code) holds for every bad-config path.
+  try { validateOpts(opts, ["type", "metadata", "categories", "minCategoryShare"], "aedtBiasAudit"); }
+  catch (e) { throw new AedtBiasAuditError("aedt/bad-opts", e && e.message || "aedtBiasAudit: invalid options"); }
+  if (opts.type !== "selection" && opts.type !== "scoring") throw new AedtBiasAuditError("aedt/bad-type", "aedtBiasAudit: type must be 'selection' or 'scoring'");
+
+  var md = opts.metadata || {};
+  var metadata = {
+    tool:             _str(md.tool, "tool"),
+    auditor:          _str(md.auditor, "auditor"),
+    auditDate:        _str(md.auditDate, "auditDate"),
+    distributionDate: md.distributionDate != null ? _str(md.distributionDate, "distributionDate") : null,
+  };
+
+  var minShare = opts.minCategoryShare != null ? opts.minCategoryShare : DEFAULT_MIN_SHARE;
+  if (typeof minShare !== "number" || !isFinite(minShare) || minShare < 0 || minShare >= 1) throw new AedtBiasAuditError("aedt/bad-share", "aedtBiasAudit: minCategoryShare must be a number in [0, 1)");
+
+  var cats = opts.categories || {};
+  var present = DIMENSIONS.filter(function (d) { return cats[d] && typeof cats[d] === "object" && Object.keys(cats[d]).length > 0; });
+  if (present.length === 0) throw new AedtBiasAuditError("aedt/no-categories", "aedtBiasAudit: at least one of sex / raceEthnicity / intersectional must carry group counts");
+
+  var results = {};
+  var mostSelected = {};
+  var adverseImpactGroups = [];
+  present.forEach(function (dim) {
+    var out = _auditDimension(cats[dim], opts.type, minShare);
+    results[dim] = out.rows;
+    mostSelected[dim] = out.mostSelected;
+    out.rows.forEach(function (r) { if (r.adverseImpact) adverseImpactGroups.push({ dimension: dim, category: r.category, impactRatio: r.impactRatio }); });
+  });
+
+  return {
+    type:     opts.type,
+    metadata: metadata,
+    results:  results,
+    summary:  {
+      mostSelected:        mostSelected,
+      adverseImpactGroups: adverseImpactGroups,
+      anyAdverseImpact:    adverseImpactGroups.length > 0,
+      fourFifthsThreshold: FOUR_FIFTHS,
+    },
+  };
+}
+
+aedtBiasAudit.FOUR_FIFTHS = FOUR_FIFTHS;
+aedtBiasAudit.AedtBiasAuditError = AedtBiasAuditError;
+
+module.exports = aedtBiasAudit;