@blamejs/blamejs-shop 0.1.35 → 0.1.37

package/lib/vendor/blamejs/lib/ai-frontier-protocol.js

@@ -0,0 +1,196 @@
+"use strict";
+/**
+ * @module b.ai.frontierModelProtocol
+ * @nav    Compliance
+ * @title  Frontier AI Protocol
+ *
+ * @intro
+ *   Assess a developer's obligations under California's Transparency in
+ *   Frontier Artificial Intelligence Act — SB 53, Cal. Bus. & Prof. Code
+ *   §22757.10 et seq., signed 2025-09-29 and effective 2026-01-01 — and build
+ *   the critical-safety-incident report the law requires. SB 53 attaches
+ *   obligations by two thresholds: a <em>frontier model</em> is one trained
+ *   with more than 10<sup>26</sup> floating-point operations (including
+ *   cumulative fine-tuning), and a <em>large frontier developer</em> is a
+ *   frontier developer whose annual revenue, with affiliates, exceeded
+ *   $500,000,000 in the prior calendar year. Frontier developers must report
+ *   critical safety incidents; large frontier developers must additionally
+ *   publish an annual frontier-AI safety framework.
+ *
+ *   <code>frontierModelProtocol(opts)</code> takes the model's training compute
+ *   and the developer's revenue and returns which thresholds are crossed and
+ *   the resulting obligations, optionally checking that a supplied safety
+ *   framework carries the elements the Act expects (risk identification,
+ *   mitigation, governance, cybersecurity, and alignment with a recognized
+ *   standard such as the NIST AI RMF or ISO/IEC 42001).
+ *   <code>frontierModelProtocol.incidentReport(opts)</code> validates a
+ *   critical-incident type against the Act's four definitions and computes the
+ *   notification deadline: a routine report goes to the California Office of
+ *   Emergency Services within 15 days of discovery; an imminent risk of death
+ *   or serious physical injury is reported to an applicable authority within 24
+ *   hours.
+ *
+ * @card
+ *   California SB 53 frontier-AI protocol (`b.ai.frontierModelProtocol`) —
+ *   classify frontier-model / large-developer thresholds (10²⁶ FLOPs, $500M
+ *   revenue), enumerate obligations, and build the critical-safety-incident
+ *   report with the 15-day / 24-hour OES notification deadline.
+ */
+
+var C = require("./constants");
+var { defineClass } = require("./framework-error");
+
+var FrontierProtocolError = defineClass("FrontierProtocolError", { alwaysPermanent: true });
+
+// SB 53 thresholds.
+var FRONTIER_FLOP_THRESHOLD = 1e26;          // > 10^26 training FLOPs → frontier model
+var LARGE_DEVELOPER_REVENUE_USD = 5e8;       // > $500,000,000 prior-year revenue → large developer
+var INCIDENT_DEADLINE_MS = C.TIME.days(15);  // report to CA OES within 15 days of discovery
+var IMMINENT_DEADLINE_MS = C.TIME.hours(24); // within 24 hours if imminent risk to life
+
+// The four critical safety incident categories (Cal. Bus. & Prof. Code §22757.10).
+var CRITICAL_INCIDENT_TYPES = {
+  "weights-exfiltration-harm":         "Unauthorized access, modification, or exfiltration of frontier-model weights resulting in death or bodily injury",
+  "catastrophic-risk-materialization": "Harm resulting from the materialization of a catastrophic risk (including loss of life or property from a dangerous capability)",
+  "loss-of-control-harm":              "Loss of control of a frontier model causing death or bodily injury",
+  "deceptive-control-subversion":      "A frontier model using deceptive techniques to subvert developer controls, demonstrating materially increased catastrophic risk",
+};
+
+// Elements a large frontier developer's published safety framework must address.
+var REQUIRED_FRAMEWORK_ELEMENTS = ["riskIdentification", "riskMitigation", "governance", "cybersecurity", "standardsAlignment"];
+
+function _posNum(v, label) {
+  if (typeof v !== "number" || !isFinite(v) || v < 0) throw new FrontierProtocolError("frontier/bad-value", "frontierModelProtocol: " + label + " must be a non-negative finite number");
+  return v;
+}
+
+/**
+ * @primitive  b.ai.frontierModelProtocol
+ * @signature  b.ai.frontierModelProtocol(opts)
+ * @since      0.13.6
+ * @status     stable
+ * @compliance ca-tfaia, soc2
+ * @related    b.ai.aedtBiasAudit, b.ai.disclosure.applyAll
+ *
+ * Determine SB 53 obligations from a model's training compute and the
+ * developer's revenue. Returns <code>isFrontierModel</code> (training FLOPs
+ * above 10<sup>26</sup>), <code>isLargeFrontierDeveloper</code> (a frontier
+ * developer with revenue above $500M), and the resulting
+ * <code>obligations</code>. When <code>framework</code> is supplied, its
+ * required elements are checked and reported in <code>frameworkGaps</code>.
+ * Throws <code>FrontierProtocolError</code> on malformed input.
+ *
+ * @opts
+ *   trainingFlops:    number,   // total training FLOPs incl. fine-tuning (required)
+ *   annualRevenueUsd: number,   // developer prior-year revenue with affiliates (default: 0)
+ *   framework:        object,   // optional safety framework to check for required elements
+ *
+ * @example
+ *   var p = b.ai.frontierModelProtocol({ trainingFlops: 5e26, annualRevenueUsd: 1e9 });
+ *   p.isFrontierModel;           // → true
+ *   p.isLargeFrontierDeveloper;  // → true
+ *   p.obligations;               // → ["report-critical-safety-incidents", "publish-annual-safety-framework", ...]
+ */
+function frontierModelProtocol(opts) {
+  opts = opts || {};
+  if (typeof opts !== "object") throw new FrontierProtocolError("frontier/bad-opts", "frontierModelProtocol: opts must be an object");
+  var allowed = { trainingFlops: 1, annualRevenueUsd: 1, framework: 1 };
+  Object.keys(opts).forEach(function (k) { if (!allowed[k]) throw new FrontierProtocolError("frontier/bad-opts", "frontierModelProtocol: unknown option '" + k + "'"); });
+
+  var flops = _posNum(opts.trainingFlops, "trainingFlops");
+  var revenue = opts.annualRevenueUsd != null ? _posNum(opts.annualRevenueUsd, "annualRevenueUsd") : 0;
+
+  var isFrontierModel = flops > FRONTIER_FLOP_THRESHOLD;
+  var isLargeFrontierDeveloper = isFrontierModel && revenue > LARGE_DEVELOPER_REVENUE_USD;
+
+  var obligations = [];
+  if (isFrontierModel) {
+    obligations.push("report-critical-safety-incidents");
+    obligations.push("publish-transparency-report");
+  }
+  if (isLargeFrontierDeveloper) {
+    obligations.push("publish-annual-safety-framework");
+    obligations.push("disclose-catastrophic-risk-assessment");
+  }
+
+  var out = {
+    isFrontierModel: isFrontierModel,
+    isLargeFrontierDeveloper: isLargeFrontierDeveloper,
+    thresholds: { frontierFlops: FRONTIER_FLOP_THRESHOLD, largeDeveloperRevenueUsd: LARGE_DEVELOPER_REVENUE_USD },
+    obligations: obligations,
+  };
+
+  if (opts.framework != null) {
+    if (typeof opts.framework !== "object") throw new FrontierProtocolError("frontier/bad-value", "frontierModelProtocol: framework must be an object");
+    var gaps = REQUIRED_FRAMEWORK_ELEMENTS.filter(function (el) { return !opts.framework[el]; });
+    out.frameworkGaps = gaps;
+    out.frameworkComplete = gaps.length === 0;
+  }
+  return out;
+}
+
+/**
+ * @primitive  b.ai.frontierModelProtocol.incidentReport
+ * @signature  b.ai.frontierModelProtocol.incidentReport(opts)
+ * @since      0.13.6
+ * @status     stable
+ * @compliance ca-tfaia, soc2
+ * @related    b.ai.frontierModelProtocol, b.ai.aedtBiasAudit
+ *
+ * Build a critical-safety-incident report and compute its notification
+ * deadline to the California Office of Emergency Services. <code>type</code>
+ * must be one of the Act's four categories; <code>discoveredAt</code> is when
+ * the incident was discovered. The deadline is 15 days from discovery, or 24
+ * hours when <code>imminentRiskToLife</code> is set. Returns the structured
+ * report with <code>dueAt</code> and <code>deadlineHours</code>. Throws
+ * <code>FrontierProtocolError</code> on an unknown type or bad timestamp.
+ *
+ * @opts
+ *   type:               string,   // one of b.ai.frontierModelProtocol.INCIDENT_TYPES (required)
+ *   discoveredAt:       Date,     // discovery time (Date or epoch-ms; default: now)
+ *   imminentRiskToLife: boolean,  // true → 24-hour deadline (default: false → 15 days)
+ *   description:        string,   // free-text incident description (optional)
+ *
+ * @example
+ *   var r = b.ai.frontierModelProtocol.incidentReport({
+ *     type: "loss-of-control-harm", discoveredAt: new Date("2026-06-01T00:00:00Z"),
+ *   });
+ *   r.deadlineHours;   // → 360  (15 days)
+ *   r.recipient;       // → "California Office of Emergency Services"
+ */
+function incidentReport(opts) {
+  opts = opts || {};
+  if (typeof opts !== "object") throw new FrontierProtocolError("frontier/bad-opts", "incidentReport: opts must be an object");
+  if (!CRITICAL_INCIDENT_TYPES[opts.type]) throw new FrontierProtocolError("frontier/bad-incident-type", "incidentReport: type must be one of " + Object.keys(CRITICAL_INCIDENT_TYPES).join(", "));
+
+  var discoveredMs;
+  if (opts.discoveredAt == null) discoveredMs = Date.now();
+  else if (opts.discoveredAt instanceof Date) discoveredMs = opts.discoveredAt.getTime();
+  else discoveredMs = Number(opts.discoveredAt);
+  if (!isFinite(discoveredMs) || discoveredMs < 0) throw new FrontierProtocolError("frontier/bad-value", "incidentReport: discoveredAt must be a Date or non-negative epoch-ms");
+
+  var imminent = opts.imminentRiskToLife === true;
+  var windowMs = imminent ? IMMINENT_DEADLINE_MS : INCIDENT_DEADLINE_MS;
+
+  return {
+    type:               opts.type,
+    typeDescription:    CRITICAL_INCIDENT_TYPES[opts.type],
+    description:        typeof opts.description === "string" ? opts.description : null,
+    imminentRiskToLife: imminent,
+    discoveredAt:       new Date(discoveredMs).toISOString(),
+    dueAt:              new Date(discoveredMs + windowMs).toISOString(),
+    deadlineHours:      windowMs / C.TIME.hours(1),
+    // §22757.13: the routine report goes to OES within 15 days; an imminent
+    // risk of death or serious physical injury is reported to an applicable
+    // authority within 24 hours, which the operator selects for the incident.
+    recipient:          imminent ? "An applicable authority with jurisdiction (e.g. law enforcement or a public-safety agency)" : "California Office of Emergency Services",
+    citation:           "Cal. Bus. & Prof. Code §22757.13 (SB 53)",
+  };
+}
+
+frontierModelProtocol.incidentReport = incidentReport;
+frontierModelProtocol.INCIDENT_TYPES = Object.keys(CRITICAL_INCIDENT_TYPES);
+frontierModelProtocol.REQUIRED_FRAMEWORK_ELEMENTS = REQUIRED_FRAMEWORK_ELEMENTS;
+frontierModelProtocol.FrontierProtocolError = FrontierProtocolError;
+
+module.exports = frontierModelProtocol;

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.13.4",
+  "version": "0.13.6",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.13.5.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.5",
+  "date": "2026-05-26",
+  "headline": "`b.ai.aedtBiasAudit` — NYC Local Law 144 bias audit",
+  "summary": "b.ai.aedtBiasAudit computes the bias-audit figures New York City Local Law 144 requires before an Automated Employment Decision Tool may screen candidates (NYC Admin. Code §20-870 et seq.; DCWP rules 6 RCNY §5-300). Given the per-category counts an independent auditor collected — selected/total for a pass-fail tool, or scored-above-the-overall-median/total for a continuous-score tool — it returns the selection (or scoring) rate, the impact ratio (each group's rate divided by the most-selected group's rate), and an adverse-impact flag (impact ratio below the EEOC four-fifths threshold of 0.8) for every group, across the sex, race/ethnicity, and intersectional dimensions, plus the most-selected group per dimension and an overall flag. Categories under 2% of the audited data are marked excluded per DCWP discretion. It is a pure calculation that produces exactly the figures the annual published summary must contain — the law mandates the calculation, not any particular remediation. The relevant compliance postures (nyc-ll144, and ca-tfaia for California SB 53) were already in the catalog.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.ai.aedtBiasAudit` — Local Law 144 selection/scoring rates and four-fifths impact ratios",
+          "body": "`b.ai.aedtBiasAudit({ type, metadata, categories, minCategoryShare? })` where `type` is `\"selection\"` (group entries `{ selected, total }`) or `\"scoring\"` (`{ scoredAboveMedian, total }`). Returns per-group rate, impact ratio, and `adverseImpact` flag across the `sex`, `raceEthnicity`, and `intersectional` dimensions, plus the most-selected group per dimension and an `anyAdverseImpact` summary. Categories below `minCategoryShare` (2% default) are excluded from the impact-ratio basis. Throws `AedtBiasAuditError` on malformed input."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.6.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.6",
+  "date": "2026-05-26",
+  "headline": "`b.ai.frontierModelProtocol` — California SB 53 frontier-AI obligations",
+  "summary": "b.ai.frontierModelProtocol assesses a developer's obligations under California's Transparency in Frontier Artificial Intelligence Act — SB 53, Cal. Bus. & Prof. Code §22757.10, effective 2026-01-01 — from a model's training compute and the developer's revenue. It reports whether the model crosses the frontier threshold (more than 10^26 training FLOPs), whether the developer is a large frontier developer (prior-year revenue, with affiliates, above $500M), and the resulting obligations: every frontier developer must report critical safety incidents and publish a transparency report, and a large frontier developer must additionally publish an annual safety framework and disclose its catastrophic-risk assessment. Passing a candidate safety framework reports which required elements (risk identification, mitigation, governance, cybersecurity, standards alignment) are missing. b.ai.frontierModelProtocol.incidentReport validates a critical-incident type against the Act's four categories and computes the notification deadline to the California Office of Emergency Services — 15 days from discovery, or 24 hours when there is an imminent risk of death or serious physical injury. The ca-tfaia compliance posture was already in the catalog.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.ai.frontierModelProtocol` — SB 53 threshold classification, obligations, and incident reporting",
+          "body": "`b.ai.frontierModelProtocol({ trainingFlops, annualRevenueUsd, framework? })` returns `isFrontierModel`, `isLargeFrontierDeveloper`, the `obligations` list, and (when a framework is supplied) its `frameworkGaps`. `b.ai.frontierModelProtocol.incidentReport({ type, discoveredAt, imminentRiskToLife? })` builds a critical-safety-incident report with the California OES recipient and a `dueAt` / `deadlineHours` computed from the 15-day (or 24-hour imminent-risk) statutory window; `type` must be one of the four categories in `INCIDENT_TYPES`. Throws `FrontierProtocolError` on malformed input."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/ai-aedt-bias-audit.test.js

@@ -0,0 +1,107 @@
+"use strict";
+/**
+ * Layer 0 — b.ai.aedtBiasAudit (NYC Local Law 144 AEDT bias audit).
+ *
+ * Oracle: the EEOC four-fifths rule and the DCWP §5-300 impact-ratio formula.
+ * The canonical worked example — a tool passing 60% of men and 42% of women —
+ * yields an impact ratio of 42/60 = 0.70 for women, below the 0.8 threshold.
+ * Boundary, scoring-rate, intersectional, sub-2% exclusion, and the
+ * most-selected basis are each asserted against the formula.
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+function row(report, dim, cat) { return report.results[dim].filter(function (r) { return r.category === cat; })[0]; }
+
+var MD = { tool: "ResumeRanker v3", auditor: "Acme Audit LLC", auditDate: "2026-05-26" };
+
+function testSurface() {
+  check("b.ai.aedtBiasAudit is a function", typeof b.ai.aedtBiasAudit === "function");
+  check("b.ai.aedtBiasAudit.FOUR_FIFTHS is 0.8", b.ai.aedtBiasAudit.FOUR_FIFTHS === 0.8);
+  check("b.ai.aedtBiasAudit.AedtBiasAuditError is a class", typeof b.ai.aedtBiasAudit.AedtBiasAuditError === "function");
+}
+
+function testFourFifthsWorkedExample() {
+  var r = b.ai.aedtBiasAudit({
+    type: "selection",
+    metadata: MD,
+    categories: { sex: { Male: { selected: 60, total: 100 }, Female: { selected: 42, total: 100 } } },
+  });
+  var f = row(r, "sex", "Female"), m = row(r, "sex", "Male");
+  check("Female selection rate 0.42", f.rate === 0.42);
+  check("Female impact ratio 0.70 (42/60)", Math.abs(f.impactRatio - 0.7) < 1e-9);
+  check("Female flagged adverse (< 0.8)", f.adverseImpact === true);
+  check("Male is the most-selected (ratio 1)", m.impactRatio === 1 && m.adverseImpact === false);
+  check("most-selected sex group is Male", r.summary.mostSelected.sex === "Male");
+  check("anyAdverseImpact true", r.summary.anyAdverseImpact === true);
+  check("adverseImpactGroups names Female", r.summary.adverseImpactGroups.length === 1 && r.summary.adverseImpactGroups[0].category === "Female");
+  check("metadata echoed", r.metadata.tool === MD.tool && r.metadata.auditor === MD.auditor && r.metadata.distributionDate === null);
+}
+
+function testFourFifthsBoundary() {
+  // Exactly 0.80 is NOT adverse (strictly-less-than threshold); 0.79 is.
+  var at = b.ai.aedtBiasAudit({ type: "selection", metadata: MD, categories: { sex: { X: { selected: 100, total: 100 }, Y: { selected: 80, total: 100 } } } });
+  check("impact ratio exactly 0.80 is not adverse", row(at, "sex", "Y").adverseImpact === false);
+  var below = b.ai.aedtBiasAudit({ type: "selection", metadata: MD, categories: { sex: { X: { selected: 100, total: 100 }, Y: { selected: 79, total: 100 } } } });
+  check("impact ratio 0.79 is adverse", row(below, "sex", "Y").adverseImpact === true);
+}
+
+function testScoringRate() {
+  // Scoring tools: rate = scored-above-overall-median / total.
+  var r = b.ai.aedtBiasAudit({ type: "scoring", metadata: MD, categories: { sex: { M: { scoredAboveMedian: 50, total: 100 }, F: { scoredAboveMedian: 30, total: 100 } } } });
+  check("scoring rate F 0.30", row(r, "sex", "F").rate === 0.3);
+  check("scoring impact ratio F 0.60 (30/50)", Math.abs(row(r, "sex", "F").impactRatio - 0.6) < 1e-9);
+}
+
+function testIntersectionalAndRace() {
+  var r = b.ai.aedtBiasAudit({
+    type: "selection",
+    metadata: MD,
+    categories: {
+      raceEthnicity: { "White": { selected: 80, total: 100 }, "Black or African American": { selected: 48, total: 100 } },
+      intersectional: { "Male - White": { selected: 90, total: 100 }, "Female - Black or African American": { selected: 45, total: 100 } },
+    },
+  });
+  check("race dimension computed", row(r, "raceEthnicity", "Black or African American").impactRatio === 0.6);
+  check("intersectional dimension computed", row(r, "intersectional", "Female - Black or African American").impactRatio === 0.5);
+  check("intersectional adverse flagged", row(r, "intersectional", "Female - Black or African American").adverseImpact === true);
+}
+
+function testSubTwoPercentExclusion() {
+  var r = b.ai.aedtBiasAudit({ type: "selection", metadata: MD, categories: { sex: { Big: { selected: 90, total: 1000 }, Tiny: { selected: 0, total: 10 } } } });
+  check("sub-2% category excluded", row(r, "sex", "Tiny").excluded === true);
+  check("excluded category has null impact ratio", row(r, "sex", "Tiny").impactRatio === null);
+  check("excluded category not flagged adverse", row(r, "sex", "Tiny").adverseImpact === false);
+  // A higher minCategoryShare excludes more.
+  var r2 = b.ai.aedtBiasAudit({ type: "selection", metadata: MD, minCategoryShare: 0, categories: { sex: { Big: { selected: 90, total: 1000 }, Tiny: { selected: 0, total: 10 } } } });
+  check("minCategoryShare 0 includes Tiny", row(r2, "sex", "Tiny").excluded === false);
+}
+
+function testErrors() {
+  check("bad type throws",        code(function () { b.ai.aedtBiasAudit({ type: "x", metadata: MD, categories: { sex: { M: { selected: 1, total: 1 } } } }); }) === "aedt/bad-type");
+  check("missing metadata throws", code(function () { b.ai.aedtBiasAudit({ type: "selection", metadata: {}, categories: { sex: { M: { selected: 1, total: 1 } } } }); }) === "aedt/bad-metadata");
+  check("no categories throws",    code(function () { b.ai.aedtBiasAudit({ type: "selection", metadata: MD, categories: {} }); }) === "aedt/no-categories");
+  check("selected > total throws", code(function () { b.ai.aedtBiasAudit({ type: "selection", metadata: MD, categories: { sex: { M: { selected: 5, total: 2 } } } }); }) === "aedt/bad-count");
+  check("negative count throws",   code(function () { b.ai.aedtBiasAudit({ type: "selection", metadata: MD, categories: { sex: { M: { selected: -1, total: 2 } } } }); }) === "aedt/bad-count");
+  check("bad minCategoryShare throws", code(function () { b.ai.aedtBiasAudit({ type: "selection", metadata: MD, minCategoryShare: 1, categories: { sex: { M: { selected: 1, total: 1 } } } }); }) === "aedt/bad-share");
+  // A typoed/unknown option must surface as AedtBiasAuditError (not a generic
+  // Error from validateOpts), so e.code / instanceof handling is reliable.
+  check("unknown opt throws aedt/bad-opts", code(function () { b.ai.aedtBiasAudit({ type: "selection", metadata: MD, categories: { sex: { M: { selected: 1, total: 1 } } }, minCategoryshare: 0.01 }); }) === "aedt/bad-opts");
+  var threw = null;
+  try { b.ai.aedtBiasAudit({ type: "selection", metadata: MD, categories: { sex: { M: { selected: 1, total: 1 } } }, bogus: 1 }); } catch (e) { threw = e; }
+  check("unknown opt error is an AedtBiasAuditError", threw instanceof b.ai.aedtBiasAudit.AedtBiasAuditError);
+}
+
+async function run() {
+  testSurface();
+  testFourFifthsWorkedExample();
+  testFourFifthsBoundary();
+  testScoringRate();
+  testIntersectionalAndRace();
+  testSubTwoPercentExclusion();
+  testErrors();
+}
+module.exports = { run: run };
+if (require.main === module) { run().then(function () { console.log("[ai-aedt-bias-audit] OK — " + helpers.getChecks() + " checks passed"); }, function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }); }

package/lib/vendor/blamejs/test/layer-0-primitives/ai-frontier-protocol.test.js

@@ -0,0 +1,83 @@
+"use strict";
+/**
+ * Layer 0 — b.ai.frontierModelProtocol (California SB 53, Transparency in
+ * Frontier AI Act).
+ *
+ * Oracle: the statute's thresholds and deadlines (Cal. Bus. & Prof. Code
+ * §22757.10) — a frontier model exceeds 10^26 training FLOPs, a large frontier
+ * developer exceeds $500M revenue, and a critical-incident report is due to the
+ * CA OES within 15 days of discovery (24 hours when there is imminent risk to
+ * life). The four incident categories are enumerated.
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+var fp = b.ai.frontierModelProtocol;
+
+function testSurface() {
+  check("b.ai.frontierModelProtocol is a function", typeof fp === "function");
+  check("incidentReport is a function", typeof fp.incidentReport === "function");
+  check("INCIDENT_TYPES has the four categories", fp.INCIDENT_TYPES.length === 4);
+  check("REQUIRED_FRAMEWORK_ELEMENTS present", fp.REQUIRED_FRAMEWORK_ELEMENTS.length === 5);
+  check("FrontierProtocolError is a class", typeof fp.FrontierProtocolError === "function");
+}
+
+function testThresholds() {
+  var big = fp({ trainingFlops: 5e26, annualRevenueUsd: 1e9 });
+  check("above 10^26 FLOPs is a frontier model", big.isFrontierModel === true);
+  check("frontier + >$500M is a large frontier developer", big.isLargeFrontierDeveloper === true);
+  check("large developer gets all four obligations", big.obligations.length === 4 && big.obligations.indexOf("publish-annual-safety-framework") !== -1);
+
+  check("below 10^26 FLOPs is not a frontier model", fp({ trainingFlops: 1e25, annualRevenueUsd: 1e9 }).isFrontierModel === false);
+  check("exactly 10^26 FLOPs is not a frontier model (strict >)", fp({ trainingFlops: 1e26 }).isFrontierModel === false);
+
+  var smallCo = fp({ trainingFlops: 5e26, annualRevenueUsd: 1e8 });
+  check("frontier model at a small developer: frontier yes, large no", smallCo.isFrontierModel === true && smallCo.isLargeFrontierDeveloper === false);
+  check("small developer gets only the frontier obligations", smallCo.obligations.length === 2 && smallCo.obligations.indexOf("report-critical-safety-incidents") !== -1);
+  check("revenue defaults to 0 when omitted", fp({ trainingFlops: 5e26 }).isLargeFrontierDeveloper === false);
+}
+
+function testFrameworkCheck() {
+  var gaps = fp({ trainingFlops: 5e26, annualRevenueUsd: 1e9, framework: { riskIdentification: 1, governance: 1 } });
+  check("framework gaps detected", JSON.stringify(gaps.frameworkGaps) === JSON.stringify(["riskMitigation", "cybersecurity", "standardsAlignment"]));
+  check("frameworkComplete false with gaps", gaps.frameworkComplete === false);
+  var complete = fp({ trainingFlops: 5e26, annualRevenueUsd: 1e9, framework: { riskIdentification: 1, riskMitigation: 1, governance: 1, cybersecurity: 1, standardsAlignment: 1 } });
+  check("frameworkComplete true when all elements present", complete.frameworkComplete === true && complete.frameworkGaps.length === 0);
+}
+
+function testIncidentReport() {
+  var r15 = fp.incidentReport({ type: "loss-of-control-harm", discoveredAt: new Date("2026-06-01T00:00:00Z") });
+  check("default deadline is 15 days (360h)", r15.deadlineHours === 360);
+  check("15-day dueAt computed", r15.dueAt === "2026-06-16T00:00:00.000Z");
+  check("routine report goes to CA OES", r15.recipient.indexOf("Office of Emergency Services") !== -1);
+  check("type description carried", r15.typeDescription.indexOf("Loss of control") !== -1);
+
+  var r24 = fp.incidentReport({ type: "weights-exfiltration-harm", discoveredAt: new Date("2026-06-01T00:00:00Z"), imminentRiskToLife: true });
+  check("imminent-risk deadline is 24 hours", r24.deadlineHours === 24);
+  check("24-hour dueAt computed", r24.dueAt === "2026-06-02T00:00:00.000Z");
+  // §22757.13: imminent risk routes to an applicable authority, not OES.
+  check("imminent-risk routes to an applicable authority, not OES", r24.recipient.indexOf("Office of Emergency Services") === -1 && r24.recipient.indexOf("applicable authority") !== -1);
+  // §22757.10(i): the weights category is death/bodily-injury only — no property.
+  check("weights-incident description excludes property", r24.typeDescription.toLowerCase().indexOf("property") === -1);
+}
+
+function testErrors() {
+  check("unknown incident type throws", code(function () { fp.incidentReport({ type: "made-up" }); }) === "frontier/bad-incident-type");
+  check("bad discoveredAt throws",       code(function () { fp.incidentReport({ type: "loss-of-control-harm", discoveredAt: -5 }); }) === "frontier/bad-value");
+  check("missing trainingFlops throws",  code(function () { fp({}); }) === "frontier/bad-value");
+  check("negative trainingFlops throws", code(function () { fp({ trainingFlops: -1 }); }) === "frontier/bad-value");
+  check("unknown opt throws",            code(function () { fp({ trainingFlops: 1e26, bogus: 1 }); }) === "frontier/bad-opts");
+  check("non-object framework throws",   code(function () { fp({ trainingFlops: 5e26, framework: 7 }); }) === "frontier/bad-value");
+}
+
+async function run() {
+  testSurface();
+  testThresholds();
+  testFrameworkCheck();
+  testIncidentReport();
+  testErrors();
+}
+module.exports = { run: run };
+if (require.main === module) { run().then(function () { console.log("[ai-frontier-protocol] OK — " + helpers.getChecks() + " checks passed"); }, function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }); }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.1.35",
+  "version": "0.1.37",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {