@blamejs/blamejs-shop 0.1.36 → 0.1.37

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.1.x
 
+- v0.1.37 (2026-05-26) — **Localized storefront — the UI chrome renders in the visitor's language, with a locale switcher and right-to-left support.** The storefront's interface chrome — the navigation, search controls, newsletter band, and footer — now renders in the visitor's language. The locale is resolved the same way at the edge and in the container: an explicit `?lang=` choice first, then a saved preference cookie, then the browser's Accept-Language header, then the operator's default. A locale switcher in the footer lets the visitor change it; the choice persists in a first-party cookie. Right-to-left languages (Arabic, Hebrew, Persian, …) flip the document direction automatically. Strings come from the operator's locale policy and translation rows, and any key without a translation falls back to the English baseline rather than showing a raw placeholder — so a partially translated catalog never renders broken text. The default locale renders at the edge for cookie-less visitors (so cached pages stay fast); a non-default choice is served by the container. Everything works with JavaScript off, and the localized markup is byte-identical across the edge and the container. **Added:** *Localized UI chrome + footer locale switcher* — Navigation, search labels, the newsletter band, and the footer render in the visitor's locale. A locale switcher in the footer lists the languages the operator has enabled (shown by their own names — "Deutsch", "Français"); selecting one persists the choice in a first-party cookie and returns the visitor to the page they were on. The locale resolves identically at the edge and in the container — `?lang=`, then the cookie, then `Accept-Language`, then the operator default — and a right-to-left language sets the document's `dir` so the layout mirrors correctly. The switcher and selection work without JavaScript. · *Operator locale policy with English-baseline fallback* — Enable languages by setting a locale policy (a default locale plus the supported list) and supplying translation rows for the chrome strings; the storefront resolves each string against the active policy, layered over the operator's translations, and falls back to the built-in English baseline for any key still missing — never a raw key or empty label. With no policy seeded the storefront renders the English baseline and shows no switcher, so the feature is opt-in and a fresh install is unaffected. `SHOP_DEFAULT_LOCALE` sets the default the edge serves to cookie-less visitors; set `SHOP_LOCALES` (the supported list) so the edge forwards a first-time visitor whose `Accept-Language` prefers a supported non-default locale to the container instead of caching the default. An explicit cookie or `?lang=` choice is always served by the container so edge caching stays simple.
+
 - v0.1.36 (2026-05-26) — **Multi-currency display — shoppers browse prices in their own currency while you still charge in your base currency.** Shoppers can now pick a display currency from a switcher in the footer; every price on the storefront — product pages, the grid, search, and the cart — re-renders in that currency using the foreign-exchange rates you set, formatted with the right symbol, grouping, and decimal places for the locale. Conversion is display-only: the cart line and the eventual charge stay in your base currency, and a "Prices shown in EUR; you'll be charged in USD" disclosure makes that explicit whenever a conversion is in effect. The choice rides in a sealed first-party cookie and survives navigation; a per-currency rounding rule can snap converted prices to a tidy increment (for example Swiss 0.05 Rappenrundung). Every failure mode falls back to the base currency rather than showing a broken price: a currency with no rate on file, a rate that has expired, a currency you've removed from the allow-list, or a tampered cookie all render in your base currency. The switcher and all conversions render identically from the edge and the container, and the whole flow works with JavaScript off. **Added:** *Currency switcher + on-page price conversion* — A currency switcher in the footer lists the currencies you've enabled; choosing one `POST`s to `/currency`, stores the choice in a sealed cookie, and redirects back to the page the shopper was on. From then on product pages, the product grid, search results, and the cart display prices converted into that currency, each formatted for its locale (symbol, thousands separator, decimal places). When a conversion is active a "Prices shown in <display>; you'll be charged in <base>" note appears so the shopper always knows the charge currency. The switcher submits without JavaScript — the small enhancement script only auto-submits on change. · *Operator-set FX rates, display rounding, and a base-currency guarantee* — Set your base currency and the enabled list with `SHOP_BASE_CURRENCY` / `SHOP_CURRENCIES` (or the `shop.base_currency` / `shop.currencies` config keys), and supply foreign-exchange rates yourself from whatever source you trust — the framework never reaches out to a rate feed. Rates are stored as integer basis points and conversion uses banker's rounding; an optional per-currency rounding rule snaps the result to a display increment (e.g. nearest 0.05). Conversion is strictly for display: the cart line's currency and amount, and therefore the amount charged at checkout, always stay in the base currency. Any currency without a usable rate — missing, expired, de-listed, or a tampered cookie — falls back to base-currency display instead of a broken or `NaN` price, so a stale or absent rate feed never breaks a priced page.
 
 - v0.1.35 (2026-05-26) — **Cookie-consent banner — GDPR/ePrivacy consent with category opt-in, an audit ledger, and a preferences page.** Every page now carries a cookie-consent banner until the visitor decides. They can accept all, reject everything non-essential, or open preferences to toggle categories; the choice is stored in a sealed first-party cookie and recorded in a consent ledger for the audit trail. Strictly-necessary cookies (session, CSRF, the consent choice itself) always work; analytics and marketing are opt-in and default-deny, and a Do-Not-Track or Global-Privacy-Control signal collapses them to denied regardless of any stored opt-in. A "Manage cookies" footer link reopens the preferences. The banner and its choice form are server-rendered and work with JavaScript off — the small enhancement script only hides the banner once a choice exists — and the banner renders identically from the edge and the container. A consent-gating hook lets future analytics/marketing scripts render only when their category is granted. **Added:** *Consent banner + preferences page* — A banner shows on every page until a choice is made: Accept all, Reject non-essential, or Manage preferences. `POST /consent` records the decision (validated; safe-redirect back to where the visitor was), and `GET /cookies` is a preferences page to review and change categories later, linked from the footer. The authoritative choice is a sealed, HttpOnly first-party cookie; a tampered or missing cookie simply reshows the banner rather than erroring. Every decision is also written to the consent ledger for the GDPR audit trail, best-effort so a ledger hiccup never blocks the choice from taking effect. · *Category opt-in with DNT / GPC honored* — Cookies are grouped into strictly-necessary (always on) plus toggleable categories (analytics, marketing, …) that are opt-in and default-deny. A `DNT: 1` or `Sec-GPC: 1` request header forces the non-essential categories to denied regardless of any stored opt-in. A server-side gating hook renders a category's script only when that category is granted, so future analytics/marketing islands are consent-gated by construction. · *Consent is anchored to a policy version* — Each stored decision records the cookie-policy version it was captured under. When an operator bumps the active version (the cookie policy materially changed), decisions taken under the old version stop being honored — the gate falls back to default-deny for the optional categories and the banner re-prompts so consent is re-collected, rather than coasting on opt-ins given under a superseded policy. The banner and preferences page keep working with JavaScript off; the enhancement script only suppresses the banner while the stored version still matches the active one.

package/README.md

@@ -82,6 +82,7 @@ Every primitive is composed on the vendored blamejs surface — no npm runtime d
 | **`lib/search-synonyms.js`** | Typo-tolerant, synonym-aware query matching. Before the catalog is searched, the query is expanded through an operator-curated vocabulary — synonym groups (so "tee" matches "t-shirt"), common typo corrections, and stopword removal — and the page shows a "Showing results for" note when the query was corrected or expanded. A query that still matches nothing falls back to the raw terms so search never silently empties on an unknown word. Shared rewrite instance; runs identically at the edge and the container. |
 | **`lib/cookie-consent.js`** | GDPR/ePrivacy cookie consent. Every page carries a banner until the visitor decides — accept all, reject non-essential, or manage categories — with the choice in a sealed first-party cookie and recorded in a consent ledger for the audit trail. Strictly-necessary cookies are always on; analytics/marketing are opt-in and default-deny, and a `DNT`/`Sec-GPC` header forces non-essential to denied regardless of stored opt-in. `POST /consent` sets the choice (safe-redirect back); `GET /cookies` is the preferences page (footer-linked). A server-side gating hook renders a category's script only when granted. Banner + form are server-rendered (work with JS off; the island only hides the banner once decided) and identical at the edge and container. |
 | **`lib/currency-display.js`** | Multi-currency display. Shoppers pick a display currency from the footer switcher (`POST /currency`, sealed cookie, 303 back); product pages, the grid, search, and the cart then show prices converted into it via operator-set FX rates (stored as integer basis points, banker's rounding), formatted per the currency's locale. Conversion is display-only — the cart line and the charged amount stay in the base currency, and a "Prices shown in <display>; you'll be charged in <base>" disclosure appears whenever converting. An optional per-currency rounding rule (composed with `lib/currency-rounding.js`) snaps converted prices to a display increment (e.g. CHF 0.05). Every failure mode — no rate on file, an expired rate, a de-listed currency, a tampered cookie — falls back to base-currency display, never a broken / `NaN` price. Base + enabled list come from `SHOP_BASE_CURRENCY` / `SHOP_CURRENCIES` (or `shop.base_currency` / `shop.currencies` config). Switcher + conversions are server-rendered (work with JS off) and identical at the edge and container. |
+| **`lib/translations.js`** | Storefront localization. The UI chrome (nav, search, newsletter band, footer) renders in the visitor's locale, resolved identically at the edge and container: `?lang=`, then a first-party cookie, then `Accept-Language`, then the operator default. A footer locale switcher (languages shown by their autonyms) persists the choice and 303s back; `GET /locale` sets the cookie. Right-to-left languages set the document `dir`. Strings layer the operator's translation rows over a built-in English baseline — a missing key falls back to English, never a raw placeholder. Enable it by seeding a locale policy (default + supported locales) via `localeRouter`; with none seeded the storefront renders the English baseline and shows no switcher. `SHOP_DEFAULT_LOCALE` sets the edge default and `SHOP_LOCALES` (the supported list) lets the edge forward an `Accept-Language`-preferred non-default locale to the container instead of caching the default; an explicit cookie/`?lang=` choice is always container-served. Server-rendered (works with JS off), byte-identical edge/container. |
 | **`lib/subscriptions.js`** | Stripe-backed recurring billing — `subscription_plans` (interval / amount / trial) + `subscriptions` (mirrors Stripe's object byte-for-byte). `subscriptions.create` POSTs to Stripe via the payment dep, then persists the returned object locally. `handleStripeEvent` replays `customer.subscription.*` events into the local row so the shop has an authoritative view without round-tripping. Customers view + cancel their own subscriptions at `/account/subscriptions` (ownership-checked; cancel mounts when the payment handle is wired). |
 | **`lib/giftcards.js`** | Prepaid bearer gift cards. `issue({ amount_minor, currency })` generates a 16-char code (32-glyph alphabet, no ambiguous letters) via `b.crypto.generateBytes`, stores only its `namespaceHash` digest + a 4-char hint, and returns the plaintext code once. `balance(code)` / `lookup(code)` resolve a code to its live balance (constant-time hash compare); `redeem({ code, order_id, amount_minor })` decrements the balance with an atomic `balance >= amount` SQL guard so concurrent spends can't overdraw. Redeemed at checkout as a credit against the order grand total: the amount due drops by the applied balance (never below zero), the order still records the full total it owed, and the debit is recorded once per order — a card that fully covers the order is marked paid with no Stripe charge. Customers check a balance at `GET /gift-cards`; the page is not a code-existence oracle (unknown / malformed / expired all return the same generic not-found). |
 | **`lib/gift-card-ledger.js`** | Append-only credit / debit / expire history per gift card, with a denormalized `balance_after_minor` snapshot for O(1) balance reads. `credit` / `debit` / `expire` write one row each; `history(id)` paginates a card's transactions; `transactionsForOrder(id)` lists a card's movements for one order. The audit trail behind the admin gift-card ledger console; overdraft is refused at the primitive layer. |

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.1.36",
+  "version": "0.1.37",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-rvjL1QySBgNJGEUDusbbMCkL3fsjmzcwUvTp9pljo/0Nn/lErxq2AbY8EYvDF9Ch",

package/lib/storefront.js

@@ -28,9 +28,22 @@
 var emailModule = require("./email");
 var pricing      = require("./pricing");
 var currencyDisplayModule = require("./currency-display");
+var translationsModule = require("./translations");
+var { AsyncLocalStorage } = require("node:async_hooks");   // allow:non-shop-require — Node-core per-request context (no npm dep); the framework itself composes it in db-role-context / log. No b.* request-context primitive exists to wrap it.
 
 var b = require("./vendor/blamejs");
 
+// Per-request locale context store. The storefront's locale middleware
+// resolves the request's locale + chrome strings once and seeds this
+// store; every `_wrap` call on the same request reads the resolved
+// context back out without the ~30 renderers having to thread it through
+// their opts. `enterWith` scopes the value to the request's async
+// execution context (each inbound request runs its own `handle()` chain),
+// so concurrent requests never see each other's locale. A renderer
+// reached outside a request (a unit test calling `renderHome` directly)
+// finds no store and falls back to the English baseline.
+var _localeAls = new AsyncLocalStorage();
+
 // Payment-webhook signatures (Stripe's HMAC, PayPal's, …) are computed over
 // the EXACT raw request bytes, but the global JSON body-parser reparses and
 // discards them. This middleware buffers the raw body for the given POST
@@ -126,7 +139,7 @@ var CONSENT_BANNER =
 
 var LAYOUT =
   "<!DOCTYPE html>\n" +
-  "<html lang=\"en\">\n" +
+  "<html lang=\"{{lang}}\" dir=\"{{dir}}\">\n" +
   "<head>\n" +
   "  <meta charset=\"utf-8\">\n" +
   "  <meta name=\"viewport\" content=\"width=device-width,initial-scale=1\">\n" +
@@ -146,13 +159,13 @@ var LAYOUT =
   "  <meta name=\"twitter:image\" content=\"{{og_image}}\">\n" +
   "</head>\n" +
   "<body>\n" +
-  "  <a class=\"skip-link\" href=\"#main\">Skip to content</a>\n" +
+  "  <a class=\"skip-link\" href=\"#main\">{{skip_to_content}}</a>\n" +
   "\n" +
   "  <div class=\"utility-bar\" role=\"complementary\">\n" +
   "    <div class=\"utility-bar__inner\">\n" +
-  "      <span class=\"utility-bar__pill\"><span class=\"dot dot--live\" aria-hidden=\"true\"></span> Open source · Apache 2.0</span>\n" +
-  "      <span class=\"utility-bar__msg\">Server-rendered HTML · post-quantum crypto on by default · zero npm runtime deps</span>\n" +
-  "      <a class=\"utility-bar__link\" href=\"https://github.com/blamejs/blamejs.shop\" rel=\"noopener\">Star on GitHub →</a>\n" +
+  "      <span class=\"utility-bar__pill\"><span class=\"dot dot--live\" aria-hidden=\"true\"></span> {{util_pill}}</span>\n" +
+  "      <span class=\"utility-bar__msg\">{{util_msg}}</span>\n" +
+  "      <a class=\"utility-bar__link\" href=\"https://github.com/blamejs/blamejs.shop\" rel=\"noopener\">{{util_star}}</a>\n" +
   "    </div>\n" +
   "  </div>\n" +
   "\n" +
@@ -161,17 +174,17 @@ var LAYOUT =
   "      <a href=\"/\" class=\"brand\" aria-label=\"{{shop_name}}\"><img src=\"/assets/brand/logo.png\" alt=\"{{shop_name}}\"></a>\n" +
   "      <form class=\"site-search\" action=\"/search\" method=\"get\" role=\"search\">\n" +
   "        <div class=\"site-search__inner\">\n" +
-  "          <label for=\"site-search-q\" class=\"skip-link\">Search products</label>\n" +
+  "          <label for=\"site-search-q\" class=\"skip-link\">{{search_label}}</label>\n" +
   "          <svg class=\"site-search__icon\" viewBox=\"0 0 24 24\" width=\"18\" height=\"18\" aria-hidden=\"true\"><path d=\"M21 21l-4.35-4.35M11 19a8 8 0 1 1 0-16 8 8 0 0 1 0 16Z\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.75\" stroke-linecap=\"round\"/></svg>\n" +
-  "          <input id=\"site-search-q\" type=\"search\" name=\"q\" value=\"{{search_q}}\" placeholder=\"Search the catalog\" autocomplete=\"off\" spellcheck=\"false\" maxlength=\"200\">\n" +
-  "          <button type=\"submit\">Search</button>\n" +
+  "          <input id=\"site-search-q\" type=\"search\" name=\"q\" value=\"{{search_q}}\" placeholder=\"{{search_placeholder}}\" autocomplete=\"off\" spellcheck=\"false\" maxlength=\"200\">\n" +
+  "          <button type=\"submit\">{{search_submit}}</button>\n" +
   "        </div>\n" +
   "      </form>\n" +
   "      <nav class=\"site-nav\" aria-label=\"Primary\">\n" +
-  "        <a class=\"site-nav__link\" href=\"/\">Shop</a>\n" +
-  "        <a class=\"site-nav__link\" href=\"#framework\">Framework</a>\n" +
-  "        <a class=\"site-nav__icon\" href=\"/account\" aria-label=\"Account\"><svg viewBox=\"0 0 24 24\" width=\"20\" height=\"20\" aria-hidden=\"true\"><path d=\"M12 12a4 4 0 1 0 0-8 4 4 0 0 0 0 8Zm-7 9a7 7 0 0 1 14 0\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.75\" stroke-linecap=\"round\"/></svg></a>\n" +
-  "        <a class=\"cart-pill\" href=\"/cart\" aria-label=\"Cart, {{cart_count}} items\"><svg viewBox=\"0 0 24 24\" width=\"18\" height=\"18\" aria-hidden=\"true\"><path d=\"M3 4h2l2.4 12.1a2 2 0 0 0 2 1.6h7.6a2 2 0 0 0 1.95-1.55L21 8H6\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.75\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/><circle cx=\"10\" cy=\"21\" r=\"1.4\" fill=\"currentColor\"/><circle cx=\"17\" cy=\"21\" r=\"1.4\" fill=\"currentColor\"/></svg><span class=\"cart-pill__count\">{{cart_count}}</span></a>\n" +
+  "        <a class=\"site-nav__link\" href=\"/\">{{nav_shop}}</a>\n" +
+  "        <a class=\"site-nav__link\" href=\"#framework\">{{nav_framework}}</a>\n" +
+  "        <a class=\"site-nav__icon\" href=\"/account\" aria-label=\"{{nav_account}}\"><svg viewBox=\"0 0 24 24\" width=\"20\" height=\"20\" aria-hidden=\"true\"><path d=\"M12 12a4 4 0 1 0 0-8 4 4 0 0 0 0 8Zm-7 9a7 7 0 0 1 14 0\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.75\" stroke-linecap=\"round\"/></svg></a>\n" +
+  "        <a class=\"cart-pill\" href=\"/cart\" aria-label=\"{{nav_cart_aria}}\"><svg viewBox=\"0 0 24 24\" width=\"18\" height=\"18\" aria-hidden=\"true\"><path d=\"M3 4h2l2.4 12.1a2 2 0 0 0 2 1.6h7.6a2 2 0 0 0 1.95-1.55L21 8H6\" fill=\"none\" stroke=\"currentColor\" stroke-width=\"1.75\" stroke-linecap=\"round\" stroke-linejoin=\"round\"/><circle cx=\"10\" cy=\"21\" r=\"1.4\" fill=\"currentColor\"/><circle cx=\"17\" cy=\"21\" r=\"1.4\" fill=\"currentColor\"/></svg><span class=\"cart-pill__count\">{{cart_count}}</span></a>\n" +
   "      </nav>\n" +
   "    </div>\n" +
   "  </header>\n" +
@@ -181,14 +194,14 @@ var LAYOUT =
   "  <section class=\"newsletter-band\" aria-labelledby=\"newsletter-title\">\n" +
   "    <div class=\"newsletter-band__inner\">\n" +
   "      <div class=\"newsletter-band__copy\">\n" +
-  "        <p class=\"eyebrow eyebrow--on-dark\">Stay in the loop</p>\n" +
-  "        <h2 id=\"newsletter-title\">Get release notes the day they ship.</h2>\n" +
-  "        <p class=\"newsletter-band__lede\">No marketing emails. A single short note when there's a new framework release, a security advisory, or a primitive worth knowing about.</p>\n" +
+  "        <p class=\"eyebrow eyebrow--on-dark\">{{newsletter_eyebrow}}</p>\n" +
+  "        <h2 id=\"newsletter-title\">{{newsletter_title}}</h2>\n" +
+  "        <p class=\"newsletter-band__lede\">{{newsletter_lede}}</p>\n" +
   "      </div>\n" +
   "      <form class=\"newsletter-band__form\" method=\"post\" action=\"/newsletter\">\n" +
-  "        <label class=\"skip-link\" for=\"newsletter-email\">Email address</label>\n" +
+  "        <label class=\"skip-link\" for=\"newsletter-email\">{{newsletter_email}}</label>\n" +
   "        <input id=\"newsletter-email\" type=\"email\" name=\"email\" required placeholder=\"you@example.com\" autocomplete=\"email\">\n" +
-  "        <button type=\"submit\">Subscribe</button>\n" +
+  "        <button type=\"submit\">{{newsletter_submit}}</button>\n" +
   "      </form>\n" +
   "    </div>\n" +
   "  </section>\n" +
@@ -197,7 +210,7 @@ var LAYOUT =
   "    <div class=\"site-footer__inner\">\n" +
   "      <div class=\"site-footer__brand-col\">\n" +
   "        <img class=\"site-footer__logo\" src=\"/assets/brand/logo.png\" alt=\"{{shop_name}}\">\n" +
-  "        <p class=\"site-footer__tagline\">An open-source shop framework — server-rendered HTML, zero npm runtime dependencies, security defaults on.</p>\n" +
+  "        <p class=\"site-footer__tagline\">{{footer_tagline}}</p>\n" +
   "        <ul class=\"site-footer__social\" aria-label=\"Project links\">\n" +
   "          <li><a href=\"https://github.com/blamejs/blamejs.shop\" rel=\"noopener\" aria-label=\"GitHub\"><svg viewBox=\"0 0 24 24\" width=\"18\" height=\"18\" aria-hidden=\"true\"><path d=\"M12 .5a11.5 11.5 0 0 0-3.6 22.4c.6.1.8-.3.8-.6v-2c-3.2.7-3.9-1.5-3.9-1.5-.5-1.4-1.3-1.8-1.3-1.8-1-.7.1-.7.1-.7 1.2.1 1.8 1.2 1.8 1.2 1 1.8 2.8 1.3 3.5 1 .1-.8.4-1.3.7-1.6-2.6-.3-5.3-1.3-5.3-5.7 0-1.3.4-2.3 1.2-3.1-.1-.3-.5-1.5.1-3.1 0 0 1-.3 3.3 1.2a11 11 0 0 1 6 0c2.3-1.5 3.3-1.2 3.3-1.2.6 1.6.2 2.8.1 3.1.8.8 1.2 1.8 1.2 3.1 0 4.4-2.7 5.4-5.3 5.7.4.4.8 1.1.8 2.3v3.4c0 .3.2.7.8.6A11.5 11.5 0 0 0 12 .5Z\" fill=\"currentColor\"/></svg></a></li>\n" +
   "          <li><a href=\"https://npmjs.com/package/blamejs\" rel=\"noopener\" aria-label=\"npm\"><svg viewBox=\"0 0 24 24\" width=\"18\" height=\"18\" aria-hidden=\"true\"><path d=\"M2 7v10h6v-7h3v7h11V7H2Zm15 8h-2v-5h-3v5h-1V9h6v6Z\" fill=\"currentColor\"/></svg></a></li>\n" +
@@ -205,44 +218,45 @@ var LAYOUT =
   "        </ul>\n" +
   "      </div>\n" +
   "      <div class=\"site-footer__col\">\n" +
-  "        <h4>Shop</h4>\n" +
+  "        <h4>{{footer_shop_heading}}</h4>\n" +
   "        <ul>\n" +
-  "          <li><a href=\"/\">All products</a></li>\n" +
-  "          <li><a href=\"/collections\">Collections</a></li>\n" +
-  "          <li><a href=\"/categories\">Categories</a></li>\n" +
-  "          <li><a href=\"/?sort=new\">New arrivals</a></li>\n" +
-  "          <li><a href=\"/?sort=sale\">On sale</a></li>\n" +
-  "          <li><a href=\"/compare\">Compare</a></li>\n" +
-  "          <li><a href=\"/cart\">Cart</a></li>\n" +
+  "          <li><a href=\"/\">{{footer_shop_all}}</a></li>\n" +
+  "          <li><a href=\"/collections\">{{footer_shop_collections}}</a></li>\n" +
+  "          <li><a href=\"/categories\">{{footer_shop_categories}}</a></li>\n" +
+  "          <li><a href=\"/?sort=new\">{{footer_shop_new}}</a></li>\n" +
+  "          <li><a href=\"/?sort=sale\">{{footer_shop_sale}}</a></li>\n" +
+  "          <li><a href=\"/compare\">{{footer_shop_compare}}</a></li>\n" +
+  "          <li><a href=\"/cart\">{{footer_shop_cart}}</a></li>\n" +
   "        </ul>\n" +
   "      </div>\n" +
   "      <div class=\"site-footer__col\">\n" +
-  "        <h4>Framework</h4>\n" +
+  "        <h4>{{footer_framework_heading}}</h4>\n" +
   "        <ul>\n" +
-  "          <li><a href=\"https://github.com/blamejs/blamejs.shop\" rel=\"noopener\">Source on GitHub</a></li>\n" +
-  "          <li><a href=\"https://github.com/blamejs/blamejs\" rel=\"noopener\">blamejs core</a></li>\n" +
-  "          <li><a href=\"/SECURITY.md\">Security policy</a></li>\n" +
-  "          <li><a href=\"/CHANGELOG.md\">Changelog</a></li>\n" +
+  "          <li><a href=\"https://github.com/blamejs/blamejs.shop\" rel=\"noopener\">{{footer_framework_source}}</a></li>\n" +
+  "          <li><a href=\"https://github.com/blamejs/blamejs\" rel=\"noopener\">{{footer_framework_core}}</a></li>\n" +
+  "          <li><a href=\"/SECURITY.md\">{{footer_framework_security}}</a></li>\n" +
+  "          <li><a href=\"/CHANGELOG.md\">{{footer_framework_changelog}}</a></li>\n" +
   "        </ul>\n" +
   "      </div>\n" +
   "      <div class=\"site-footer__col\">\n" +
-  "        <h4>Operators</h4>\n" +
+  "        <h4>{{footer_operators_heading}}</h4>\n" +
   "        <ul>\n" +
-  "          <li><a href=\"/account\">Account</a></li>\n" +
-  "          <li><a href=\"/orders\">Orders</a></li>\n" +
-  "          <li><a href=\"/admin\">Admin</a></li>\n" +
-  "          <li><a href=\"mailto:hello@blamejs.shop\">Contact</a></li>\n" +
+  "          <li><a href=\"/account\">{{footer_operators_account}}</a></li>\n" +
+  "          <li><a href=\"/orders\">{{footer_operators_orders}}</a></li>\n" +
+  "          <li><a href=\"/admin\">{{footer_operators_admin}}</a></li>\n" +
+  "          <li><a href=\"mailto:hello@blamejs.shop\">{{footer_operators_contact}}</a></li>\n" +
   "        </ul>\n" +
   "      </div>\n" +
   "    </div>\n" +
     "    RAW_CURRENCY_SWITCHER\n" +
+    "    RAW_LOCALE_SWITCHER\n" +
   "    <div class=\"site-footer__copy\">\n" +
-  "      <p>&copy; {{year}} {{shop_name}} — built on blamejs · Apache 2.0 licensed.</p>\n" +
+  "      <p>&copy; {{year}} {{shop_name}} — {{footer_copy_suffix}}</p>\n" +
   "      <ul>\n" +
-  "        <li><a href=\"/SECURITY.md\">Security</a></li>\n" +
-  "        <li><a href=\"/privacy\">Privacy</a></li>\n" +
-  "        <li><a href=\"/terms\">Terms</a></li>\n" +
-  "        <li><a href=\"/cookies\">Manage cookies</a></li>\n" +
+  "        <li><a href=\"/SECURITY.md\">{{footer_legal_security}}</a></li>\n" +
+  "        <li><a href=\"/privacy\">{{footer_legal_privacy}}</a></li>\n" +
+  "        <li><a href=\"/terms\">{{footer_legal_terms}}</a></li>\n" +
+  "        <li><a href=\"/cookies\">{{footer_legal_cookies}}</a></li>\n" +
   "      </ul>\n" +
   "    </div>\n" +
   "  </footer>\n" +
@@ -374,6 +388,20 @@ function _currencyWrapOpts(opts) {
   };
 }
 
+// Default locale context — the English chrome baseline, `lang="en"`,
+// `dir="ltr"`, no switcher. Any page rendered without a resolved
+// `locale_ctx` (an internal renderer that doesn't thread one, a deploy
+// with no locale policy) falls back to this, so the chrome is always
+// complete English — never a raw `{{key}}` and never a 500. The cart
+// aria carries a literal `{count}` here because the baseline isn't tied
+// to a request; `_wrap` interpolates the real count below.
+var _DEFAULT_LOCALE_CTX = {
+  lang:        "en",
+  dir:         "ltr",
+  chrome:      translationsModule.chromeDefaults(),
+  switcher_html: "",
+};
+
 function _wrap(opts) {
   var themeCss = (opts && typeof opts.theme_css === "string" && opts.theme_css.length)
     ? opts.theme_css
@@ -401,10 +429,30 @@ function _wrap(opts) {
     note:        opts.currency_note,
     redirect_to: opts.currency_redirect_to,
   });
-  return _render(LAYOUT, {
+
+  // Locale context — resolved per request by the storefront's locale
+  // middleware and read back from the async-local store; an explicit
+  // `opts.locale_ctx` (a renderer that threads its own) takes precedence.
+  // Absent both, the English baseline applies. The chrome strings are
+  // HTML-escaped by `_render` per substitution like every other
+  // placeholder; the switcher form is raw HTML (already escaped at its
+  // own build site) so it's spliced post-render like the body.
+  var storeCtx = _localeAls.getStore();
+  var localeCtx = (opts.locale_ctx && opts.locale_ctx.chrome)
+    ? opts.locale_ctx
+    : ((storeCtx && storeCtx.chrome) ? storeCtx : _DEFAULT_LOCALE_CTX);
+  var chrome = localeCtx.chrome;
+  var cartCount = opts.cart_count == null ? 0 : opts.cart_count;
+  // The cart aria-label carries the count: when the resolved string is
+  // the request-localised one it already has the count baked in; the
+  // English baseline default ships a literal `{count}` we fill here so
+  // the un-threaded fallback path still reads naturally.
+  var cartAria = String(chrome.nav_cart_aria).replace("{count}", String(cartCount));
+
+  var vars = {
     title:          opts.title,
     shop_name:      shopName,
-    cart_count:     opts.cart_count == null ? 0 : opts.cart_count,
+    cart_count:     cartCount,
     year:           _COPYRIGHT_YEAR,
     search_q:       opts.search_q == null ? "" : opts.search_q,
     theme_css:           themeCss,
@@ -413,10 +461,29 @@ function _wrap(opts) {
     og_description: ogDescription,
     og_image:       ogImage,
     og_url:         ogUrl,
+    lang:           localeCtx.lang || "en",
+    dir:            localeCtx.dir  || "ltr",
+    nav_cart_aria:  cartAria,
     body:           "RAW_BODY_PLACEHOLDER",
-  }).replace("RAW_CSS_INTEGRITY", themeCssIntegrity)
+  };
+  // Layer in every chrome string the LAYOUT references. `nav_cart_aria`
+  // is handled above (it needs the count interpolated); the two
+  // `locale_switcher_*` strings live only inside the switcher form
+  // (spliced via RAW_LOCALE_SWITCHER), not in the LAYOUT body — the
+  // strict `_render` refuses an unused placeholder, so they're skipped
+  // here.
+  var chromeKeys = Object.keys(chrome);
+  for (var ci = 0; ci < chromeKeys.length; ci += 1) {
+    var ck = chromeKeys[ci];
+    if (ck === "nav_cart_aria" || ck === "locale_switcher_label" || ck === "locale_switcher_submit") continue;
+    vars[ck] = chrome[ck];
+  }
+
+  return _render(LAYOUT, vars)
+    .replace("RAW_CSS_INTEGRITY", themeCssIntegrity)
     .replace("RAW_CONSENT_SCRIPT", _islandScript("consent.js", { id: "consent-island", policy: _activeConsentPolicy }))
     .replace("RAW_CURRENCY_SWITCHER", switcherHtml)
+    .replace("RAW_LOCALE_SWITCHER", localeCtx.switcher_html || "")
     .replace("RAW_BODY_PLACEHOLDER", opts.body);
   // The body is RAW HTML (already rendered + escaped at the
   // per-fragment level). The placeholder swap is post-render so the
@@ -3963,6 +4030,39 @@ function _clearCurrencyCookie(res) {
   _cookieJar().clear(res, CURRENCY_COOKIE_NAME);
 }
 
+// ---- locale cookie -----------------------------------------------------
+//
+// The visitor's locale choice rides an UNSEALED cookie. Unlike the
+// session / auth / referral cookies, the locale carries no authority —
+// it only selects which operator-configured, server-resolved locale the
+// chrome renders in (every candidate is validated against the active
+// policy's supported list; an unknown / garbage value resolves to the
+// default locale). It is deliberately not vault-sealed so the value
+// resolves IDENTICALLY on both render substrates: the edge Worker has no
+// vault and couldn't unseal a sealed cookie, which would split the
+// edge/container resolution. The framework cookie primitive still
+// applies the RFC 6265 grammar, the `Secure` / `SameSite=Lax` / `Path=/`
+// invariants, and (in production) the cookie-prefix policy. A read still
+// shape-validates the value (BCP-47) before it reaches the resolver, so
+// a tampered cookie is dropped, never trusted.
+var LOCALE_COOKIE_NAME = "shop_locale";
+// BCP-47 envelope mirror of localeRouter.LOCALE_RE — the cookie value is
+// shape-checked before it's handed to the resolver so a hostile cookie
+// can't smuggle a non-tag string through.
+var LOCALE_COOKIE_RE = /^[A-Za-z]{2,3}(?:-[A-Za-z0-9]{1,8})*$/;
+var LOCALE_COOKIE_MAX = 35;
+
+function _readLocaleCookie(req) {
+  var v = _cookieJar().read(req, LOCALE_COOKIE_NAME);
+  if (!v || typeof v !== "string" || v.length > LOCALE_COOKIE_MAX) return null;
+  return LOCALE_COOKIE_RE.test(v) ? v : null;
+}
+
+function _setLocaleCookie(res, locale) {
+  var T = b.constants.TIME;
+  _cookieJar().write(res, LOCALE_COOKIE_NAME, locale, { expires: new Date(Date.now() + T.days(365)) });
+}
+
 // ---- account-page renderers --------------------------------------------
 
 var ACCOUNT_LOGIN_PAGE =
@@ -4300,6 +4400,234 @@ function mount(router, deps) {
     return bundle;
   }
 
+  // ---- locale / i18n chrome ---------------------------------------------
+  //
+  // The storefront renders its UI chrome (nav, footer, search controls,
+  // newsletter band, locale switcher) localised per request. The locale
+  // is resolved the SAME way the edge Worker resolves it — cookie-first,
+  // then `?lang=`, then Accept-Language, then the policy default — so a
+  // visitor sees identical chrome whether the request is served at the
+  // edge or by this container. The strings come from `b.i18n` over the
+  // chrome catalog in `lib/translations.js`, layered with the operator's
+  // `ui`/`chrome` translation rows; a missing key falls back to the
+  // English baseline (never a raw key).
+  //
+  // `deps.chromeI18n` is the `b.i18n` instance (built once at boot via
+  // translations.createChromeI18n with the operator's overrides). When
+  // absent — a deploy with no locale policy seeded — the storefront
+  // renders the English baseline and shows no switcher. `deps.localeRouter`
+  // is the optional resolver; `deps.localeOptions` carries the default
+  // locale + the active-locale list the switcher renders.
+  var chromeI18n   = deps.chromeI18n   || null;
+  var localeRouter = deps.localeRouter || null;
+  var localeOptions = deps.localeOptions || {};
+  var defaultLocale = localeOptions.defaultLocale || translationsModule.BASELINE_LOCALE;
+  // Active locales the switcher offers: [{ tag, label }]. Operators
+  // declare the label (the autonym — "Deutsch", "Français") in
+  // localeOptions; absent that, the tag itself is the label.
+  var activeLocales = Array.isArray(localeOptions.locales) ? localeOptions.locales : [];
+  // Supported tags for the cookie/`?lang=` direct-match fast path.
+  var supportedTags = activeLocales.map(function (l) { return l.tag; });
+  // i18n RTL helper — `b.i18n.dir({ locale })` returns "rtl"/"ltr".
+  function _dirFor(locale) {
+    if (!chromeI18n) return "ltr";
+    try { return chromeI18n.dir({ locale: locale }); } catch (_e) { return "ltr"; }
+  }
+
+  // Per-locale resolved chrome string set, memoised — the strings don't
+  // change per request (only the cart count, interpolated at render
+  // time), so resolve each locale once.
+  var _chromeByLocale = Object.create(null);
+  function _chromeFor(locale) {
+    if (!chromeI18n) return translationsModule.chromeDefaults();
+    if (_chromeByLocale[locale]) return _chromeByLocale[locale];
+    var resolved = translationsModule.resolveChrome(chromeI18n, locale);
+    _chromeByLocale[locale] = resolved;
+    return resolved;
+  }
+
+  // Match a candidate tag against the supported set — the SAME rule the
+  // locale-router uses: a case-insensitive direct hit, then a primary-
+  // subtag match (`en-GB` candidate -> supported `en`). Returns the
+  // matched supported tag (catalog casing) or null. Kept in-process so
+  // resolution is synchronous — the middleware must seed the async-local
+  // store within one synchronous tick (an `await` inside the middleware
+  // would set the store in the awaited frame, not the request's).
+  var _supportedLowerToTag = Object.create(null);
+  for (var _si = 0; _si < supportedTags.length; _si += 1) {
+    _supportedLowerToTag[String(supportedTags[_si]).toLowerCase()] = supportedTags[_si];
+  }
+  function _matchSupported(candidate) {
+    if (!candidate) return null;
+    var lowered = String(candidate).toLowerCase();
+    if (Object.prototype.hasOwnProperty.call(_supportedLowerToTag, lowered)) {
+      return _supportedLowerToTag[lowered];
+    }
+    var primary = lowered.split("-")[0];
+    if (Object.prototype.hasOwnProperty.call(_supportedLowerToTag, primary)) {
+      return _supportedLowerToTag[primary];
+    }
+    return null;
+  }
+
+  // Parse an Accept-Language header into a q-sorted list of tags. A
+  // garbage header yields an empty list (the resolver then falls to the
+  // default). Mirrors the locale-router's parser shape.
+  function _parseAcceptLanguage(raw) {
+    if (typeof raw !== "string" || !raw.length || raw.length > 4096) return [];
+    var out = [];
+    var parts = raw.split(",");
+    for (var i = 0; i < parts.length; i += 1) {
+      var part = parts[i].trim();
+      if (!part) continue;
+      var semi = part.indexOf(";");
+      var tag = (semi === -1 ? part : part.slice(0, semi)).trim();
+      var q = 1.0;
+      if (semi !== -1) {
+        var m = /q=([0-9.]+)/.exec(part.slice(semi + 1));
+        if (m) { var n = parseFloat(m[1]); if (isFinite(n) && n >= 0 && n <= 1) q = n; }
+      }
+      if (tag === "*" || !LOCALE_COOKIE_RE.test(tag) || tag.length > LOCALE_COOKIE_MAX) continue;
+      out.push({ tag: tag, q: q, order: i });
+    }
+    out.sort(function (a, c) { return a.q !== c.q ? c.q - a.q : a.order - c.order; });
+    return out;
+  }
+
+  // Resolve the request's locale synchronously, in the SAME precedence
+  // the edge Worker / locale-router use: an explicit `?lang=` choice,
+  // then the persisted cookie, then the browser's Accept-Language list,
+  // then the policy default. Only a tag that resolves into the active
+  // supported set is honoured; anything else (unknown code, garbage
+  // cookie) falls through to the default. Never throws.
+  function _resolveRequestLocale(req) {
+    var queryLocale = null;
+    if (req.query && typeof req.query.lang === "string" &&
+        LOCALE_COOKIE_RE.test(req.query.lang) && req.query.lang.length <= LOCALE_COOKIE_MAX) {
+      queryLocale = req.query.lang;
+    }
+    var qMatch = _matchSupported(queryLocale);
+    if (qMatch) return qMatch;
+
+    var cMatch = _matchSupported(_readLocaleCookie(req));
+    if (cMatch) return cMatch;
+
+    var alHeader = req.headers && (req.headers["accept-language"] || req.headers["Accept-Language"]);
+    var alList = _parseAcceptLanguage(alHeader);
+    for (var i = 0; i < alList.length; i += 1) {
+      var alMatch = _matchSupported(alList[i].tag);
+      if (alMatch) return alMatch;
+    }
+    return defaultLocale;
+  }
+
+  // Best-effort: record the resolution in the locale-router's audit log
+  // (locale_resolutions_log). Fire-and-forget — never awaited, never
+  // blocks the request, never throws into the hot path. Wired only when
+  // the locale-router is present.
+  function _logResolution(req, locale) {
+    if (!localeRouter || typeof localeRouter.resolveLocale !== "function") return;
+    try {
+      var hostHeader = (req.headers && (req.headers.host || req.headers.Host)) || "localhost";
+      var p = localeRouter.resolveLocale({
+        request: {
+          host:            String(hostHeader),
+          path:            req.pathname || (String(req.url || "/").split("?")[0]) || "/",
+          cookie_locale:   locale,
+          accept_language: undefined,
+        },
+      });
+      if (p && typeof p.then === "function") p.then(function () {}, function () {});
+    } catch (_e) { /* drop-silent — the audit log is non-critical */ }
+  }
+
+  // Build the server-rendered locale switcher form. A GET form (works
+  // with JS off) that submits the chosen `lang` to /locale, which sets
+  // the cookie and 303-redirects back to the page the visitor was on
+  // (validated same-origin). Rendered only when there's more than one
+  // active locale to choose between.
+  function _switcherHtml(req, activeLocale, chrome) {
+    if (activeLocales.length < 2) return "";
+    var esc = b.template.escapeHtml;
+    // `to` carries the current path+query so the redirect lands the
+    // visitor back where they were. Validated server-side in /locale.
+    var here = req.pathname || (String(req.url || "/").split("?")[0]) || "/";
+    var options = activeLocales.map(function (l) {
+      var sel = l.tag === activeLocale ? " selected" : "";
+      return "<option value=\"" + esc(l.tag) + "\"" + sel + ">" + esc(l.label || l.tag) + "</option>";
+    }).join("");
+    return "" +
+      "    <form class=\"locale-switcher\" method=\"get\" action=\"/locale\">\n" +
+      "      <label class=\"locale-switcher__label\" for=\"locale-switcher-select\">" + esc(chrome.locale_switcher_label) + "</label>\n" +
+      "      <input type=\"hidden\" name=\"to\" value=\"" + esc(here) + "\">\n" +
+      "      <select id=\"locale-switcher-select\" class=\"locale-switcher__select\" name=\"lang\">" + options + "</select>\n" +
+      "      <button class=\"locale-switcher__submit\" type=\"submit\">" + esc(chrome.locale_switcher_submit) + "</button>\n" +
+      "    </form>\n";
+  }
+
+  // The per-request locale context the layout reads via the async-local
+  // store. Resolved SYNCHRONOUSLY so the middleware can seed the store
+  // within one tick. Shape: { locale, lang, dir, chrome, switcher_html }.
+  // Never throws — any failure falls back to the default locale.
+  function _localeCtx(req) {
+    var locale = defaultLocale;
+    try { locale = _resolveRequestLocale(req); } catch (_e) { locale = defaultLocale; }
+    var chrome = _chromeFor(locale);
+    return {
+      locale:        locale,
+      lang:          locale,
+      dir:           _dirFor(locale),
+      chrome:        chrome,
+      switcher_html: _switcherHtml(req, locale, chrome),
+    };
+  }
+
+  // Seed the per-request locale context into the async-local store so
+  // every `_wrap` on this request reads the resolved chrome. The
+  // middleware is SYNCHRONOUS: `AsyncLocalStorage.enterWith` only
+  // propagates to the request's downstream handlers when it runs in the
+  // same synchronous tick the router awaits — an `await` inside the
+  // middleware would scope the store to the awaited frame, not the
+  // request. Resolution is best-effort (falls back to the English
+  // baseline). The audit-log write is fired off without awaiting so it
+  // never blocks the render. Only mounted when the router exposes `.use`.
+  if (typeof router.use === "function") {
+    router.use(function localeMiddleware(req, _res, next) {
+      try {
+        var ctx = _localeCtx(req);
+        _localeAls.enterWith(ctx);
+        _logResolution(req, ctx.locale);
+      } catch (_e) { /* drop-silent — baseline applies */ }
+      next();
+    });
+  }
+
+  // Persist a locale choice. A GET form (works with JS off) from the
+  // footer switcher submits `lang` (the chosen tag) + `to` (the path to
+  // return to). We validate the tag against the active locale set, set
+  // the unsealed `shop_locale` cookie, and 303-redirect to the `to`
+  // path — refusing anything that isn't a same-origin absolute path so
+  // the redirect can't be turned into an open-redirect. Unknown / bad
+  // `lang` still redirects (to "/" or the validated `to`) without
+  // setting a cookie, so a hostile link can't 500 the route.
+  router.get("/locale", function (req, res) {
+    var q = req.query || {};
+    var to = (typeof q.to === "string") ? q.to : "/";
+    // Same-origin path only: must start with a single "/" (not "//" — a
+    // protocol-relative URL — and not a scheme). Anything else falls
+    // back to the home path.
+    if (to.charAt(0) !== "/" || to.charAt(1) === "/" || to.indexOf("\\") !== -1 || /[\x00-\x1f\x7f]/.test(to)) {
+      to = "/";
+    }
+    var lang = (typeof q.lang === "string") ? q.lang : "";
+    if (lang && LOCALE_COOKIE_RE.test(lang) && lang.length <= LOCALE_COOKIE_MAX && supportedTags.indexOf(lang) !== -1) {
+      _setLocaleCookie(res, lang);
+    }
+    res.status(303);
+    res.setHeader && res.setHeader("location", to);
+    return res.end ? res.end() : res.send("");
+  });
+
   // Absolute shareable referral link for a code. Prefers the operator's
   // configured origin (deps.shop_origin / SHOP_ORIGIN) so the link is
   // stable across the edge/container split; falls back to the request's

package/lib/translations.js

@@ -537,10 +537,213 @@ function _hydrate(row) {
   };
 }
 
+// ---- storefront UI chrome catalog --------------------------------------
+//
+// The chrome strings the storefront renders on EVERY page — nav links,
+// search controls, footer columns + links, the newsletter band, the
+// locale switcher. These are the default-locale (`en`) baseline; an
+// operator localises any key by authoring a `translations` row under
+// resource_kind `ui`, resource_id `chrome`, field = the dotted key with
+// dots rewritten to underscores (the table's `field` slug grammar
+// forbids dots), locale = the target tag. `resolveChrome` reads those
+// overrides at boot per active locale and layers them over this baseline,
+// so an untranslated key always renders the English string — never a
+// raw key. The exact English values here are the literal strings the
+// layout shipped inline before i18n landed, so an `en` storefront is
+// byte-identical to the pre-i18n markup.
+//
+// Both render paths (the container `lib/storefront.js` and the edge
+// `worker/render/*`) consume this same catalog through `b.i18n`, so a
+// given locale resolves to one identical string set on both sides.
+var CHROME_KEY_PREFIX = "ui.chrome.";
+var CHROME_RESOURCE_KIND = "ui";
+var CHROME_RESOURCE_ID   = "chrome";
+
+var CHROME_DEFAULTS = Object.freeze({
+  skip_to_content:    "Skip to content",
+
+  util_pill:          "Open source · Apache 2.0",
+  util_msg:           "Server-rendered HTML · post-quantum crypto on by default · zero npm runtime deps",
+  util_star:          "Star on GitHub →",
+
+  search_label:       "Search products",
+  search_placeholder: "Search the catalog",
+  search_submit:      "Search",
+
+  nav_shop:           "Shop",
+  nav_framework:      "Framework",
+  nav_account:        "Account",
+  // The cart aria-label carries the live item count; `{count}` is
+  // interpolated by b.i18n at render time.
+  nav_cart_aria:      "Cart, {count} items",
+
+  newsletter_eyebrow: "Stay in the loop",
+  newsletter_title:   "Get release notes the day they ship.",
+  newsletter_lede:    "No marketing emails. A single short note when there's a new framework release, a security advisory, or a primitive worth knowing about.",
+  newsletter_email:   "Email address",
+  newsletter_submit:  "Subscribe",
+
+  footer_tagline:     "An open-source shop framework — server-rendered HTML, zero npm runtime dependencies, security defaults on.",
+
+  footer_shop_heading:    "Shop",
+  footer_shop_all:        "All products",
+  footer_shop_collections: "Collections",
+  footer_shop_categories: "Categories",
+  footer_shop_new:        "New arrivals",
+  footer_shop_sale:       "On sale",
+  footer_shop_compare:    "Compare",
+  footer_shop_cart:       "Cart",
+
+  footer_framework_heading: "Framework",
+  footer_framework_source:  "Source on GitHub",
+  footer_framework_core:    "blamejs core",
+  footer_framework_security: "Security policy",
+  footer_framework_changelog: "Changelog",
+
+  footer_operators_heading: "Operators",
+  footer_operators_account: "Account",
+  footer_operators_orders:  "Orders",
+  footer_operators_admin:   "Admin",
+  footer_operators_contact: "Contact",
+
+  footer_copy_suffix:  "built on blamejs · Apache 2.0 licensed.",
+  footer_legal_security: "Security",
+  footer_legal_privacy:  "Privacy",
+  footer_legal_terms:    "Terms",
+  footer_legal_cookies:  "Manage cookies",
+
+  locale_switcher_label: "Language",
+  locale_switcher_submit: "Go",
+});
+
+// Default English chrome strings exposed verbatim for the render paths
+// to fall back on when no i18n instance is configured (the storefront
+// stays browsable on a deploy that hasn't seeded a locale policy).
+function chromeDefaults() {
+  return Object.assign({}, CHROME_DEFAULTS);
+}
+
+// Build a `b.i18n` instance carrying the chrome catalog for every active
+// locale. The baseline `en` tree is the shipped defaults; each other
+// locale's tree starts empty and is layered with the operator's `ui`
+// translation rows (read once here). b.i18n's own lookup chain then
+// falls a missing key through to `defaultLocale` (the shipped English),
+// so a partially-translated locale never surfaces a raw key.
+//
+// `opts.overrides` is the pre-read DB override map
+// ({ "<locale>": { "<field>": "<value>", ... } }) — passed in by the
+// caller (the storefront mount reads it via `readChromeOverrides`)
+// rather than read here, so this stays a synchronous, query-free build
+// that the edge Worker can run with the same inputs as the container.
+function createChromeI18n(opts) {
+  opts = opts || {};
+  var defaultLocale = opts.defaultLocale || BASELINE_LOCALE;
+  var locales = Array.isArray(opts.locales) && opts.locales.length
+    ? opts.locales.slice()
+    : [defaultLocale];
+  if (locales.indexOf(defaultLocale) === -1) locales.unshift(defaultLocale);
+  var overrides = opts.overrides || {};
+
+  // Each locale's inline tree under the single `ui.chrome.*` namespace.
+  // The default locale gets the full English baseline; other locales get
+  // only their authored overrides (the rest falls through b.i18n's chain
+  // to the default locale).
+  var translations = {};
+  for (var li = 0; li < locales.length; li += 1) {
+    var loc = locales[li];
+    var chrome = {};
+    if (loc === defaultLocale) {
+      var defKeys = Object.keys(CHROME_DEFAULTS);
+      for (var d = 0; d < defKeys.length; d += 1) chrome[defKeys[d]] = CHROME_DEFAULTS[defKeys[d]];
+    }
+    var ovr = overrides[loc];
+    if (ovr) {
+      var ovrKeys = Object.keys(ovr);
+      for (var o = 0; o < ovrKeys.length; o += 1) {
+        // Only keys we know about land in the tree — an operator typo
+        // (a field that isn't a chrome key) is ignored rather than
+        // shadowing a real string with garbage.
+        if (Object.prototype.hasOwnProperty.call(CHROME_DEFAULTS, ovrKeys[o])) {
+          chrome[ovrKeys[o]] = ovr[ovrKeys[o]];
+        }
+      }
+    }
+    translations[loc] = { ui: { chrome: chrome } };
+  }
+
+  return b.i18n.create({
+    defaultLocale:  defaultLocale,
+    locales:        locales,
+    fallbackLocale: defaultLocale,
+    translations:   translations,
+    // A missing chrome key returns the English baseline via the chain;
+    // should a key be absent from every locale (only possible if the
+    // baseline catalog itself is edited), return the dotted key rather
+    // than throwing inside a render. The render path never shows it
+    // because every shipped key has an `en` baseline.
+    missingKey:     "return-key",
+  });
+}
+
+// Resolve the full chrome string set for one locale into a flat object
+// keyed by the chrome field names (`nav_shop`, `footer_shop_all`, …),
+// each value already locale-resolved through the i18n chain. The render
+// paths feed this straight into the layout placeholders. The
+// `nav_cart_aria` string keeps its literal `{count}` placeholder — the
+// render path interpolates the live cart count uniformly across both
+// substrates, so this stays request-independent and cacheable.
+function resolveChrome(i18n, locale) {
+  var out = {};
+  var keys = Object.keys(CHROME_DEFAULTS);
+  for (var i = 0; i < keys.length; i += 1) {
+    var key = keys[i];
+    // No interpolation vars — `{count}` (and any future placeholder)
+    // survives as a literal for the render path to fill.
+    out[key] = i18n.t(CHROME_KEY_PREFIX + key, {}, { locale: locale });
+  }
+  return out;
+}
+
+// Read the operator's `ui`/`chrome` override rows for the given locales
+// into the `{ "<locale>": { "<field>": "<value>" } }` shape
+// `createChromeI18n` consumes. Missing-table-resilient: a deploy whose
+// `translations` table hasn't been migrated (or a transient read error)
+// yields an empty override map, so the storefront falls back to the
+// English baseline rather than 500-ing. The caller passes a `query`
+// function (the externalDb handle).
+async function readChromeOverrides(query, locales) {
+  if (typeof query !== "function" || !Array.isArray(locales) || !locales.length) return {};
+  var out = {};
+  try {
+    var placeholders = locales.map(function (_l, i) { return "?" + (i + 3); }).join(", ");
+    var rows = (await query(
+      "SELECT locale, field, value FROM translations " +
+      "WHERE resource_kind = ?1 AND resource_id = ?2 AND locale IN (" + placeholders + ")",
+      [CHROME_RESOURCE_KIND, CHROME_RESOURCE_ID].concat(locales)
+    )).rows;
+    for (var i = 0; i < rows.length; i += 1) {
+      var r = rows[i];
+      if (!out[r.locale]) out[r.locale] = {};
+      out[r.locale][r.field] = r.value;
+    }
+  } catch (_e) {
+    // Missing table / read failure — degrade to the English baseline.
+    return {};
+  }
+  return out;
+}
+
 module.exports = {
   create:                  create,
   MAX_VALUE_LEN:           MAX_VALUE_LEN,
   MAX_BULK_ROWS:           MAX_BULK_ROWS,
   BASELINE_LOCALE:         BASELINE_LOCALE,
   DEFAULT_SAMPLE_SIZE:     DEFAULT_SAMPLE_SIZE,
+  CHROME_DEFAULTS:         CHROME_DEFAULTS,
+  CHROME_RESOURCE_KIND:    CHROME_RESOURCE_KIND,
+  CHROME_RESOURCE_ID:      CHROME_RESOURCE_ID,
+  chromeDefaults:          chromeDefaults,
+  createChromeI18n:        createChromeI18n,
+  resolveChrome:           resolveChrome,
+  readChromeOverrides:     readChromeOverrides,
 };

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.13.5",
-      "tag": "v0.13.5",
+      "version": "0.13.6",
+      "tag": "v0.13.6",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.13.x
 
+- v0.13.6 (2026-05-26) — **`b.ai.frontierModelProtocol` — California SB 53 frontier-AI obligations.** b.ai.frontierModelProtocol assesses a developer's obligations under California's Transparency in Frontier Artificial Intelligence Act — SB 53, Cal. Bus. & Prof. Code §22757.10, effective 2026-01-01 — from a model's training compute and the developer's revenue. It reports whether the model crosses the frontier threshold (more than 10^26 training FLOPs), whether the developer is a large frontier developer (prior-year revenue, with affiliates, above $500M), and the resulting obligations: every frontier developer must report critical safety incidents and publish a transparency report, and a large frontier developer must additionally publish an annual safety framework and disclose its catastrophic-risk assessment. Passing a candidate safety framework reports which required elements (risk identification, mitigation, governance, cybersecurity, standards alignment) are missing. b.ai.frontierModelProtocol.incidentReport validates a critical-incident type against the Act's four categories and computes the notification deadline to the California Office of Emergency Services — 15 days from discovery, or 24 hours when there is an imminent risk of death or serious physical injury. The ca-tfaia compliance posture was already in the catalog. **Added:** *`b.ai.frontierModelProtocol` — SB 53 threshold classification, obligations, and incident reporting* — `b.ai.frontierModelProtocol({ trainingFlops, annualRevenueUsd, framework? })` returns `isFrontierModel`, `isLargeFrontierDeveloper`, the `obligations` list, and (when a framework is supplied) its `frameworkGaps`. `b.ai.frontierModelProtocol.incidentReport({ type, discoveredAt, imminentRiskToLife? })` builds a critical-safety-incident report with the California OES recipient and a `dueAt` / `deadlineHours` computed from the 15-day (or 24-hour imminent-risk) statutory window; `type` must be one of the four categories in `INCIDENT_TYPES`. Throws `FrontierProtocolError` on malformed input.
+
 - v0.13.5 (2026-05-26) — **`b.ai.aedtBiasAudit` — NYC Local Law 144 bias audit.** b.ai.aedtBiasAudit computes the bias-audit figures New York City Local Law 144 requires before an Automated Employment Decision Tool may screen candidates (NYC Admin. Code §20-870 et seq.; DCWP rules 6 RCNY §5-300). Given the per-category counts an independent auditor collected — selected/total for a pass-fail tool, or scored-above-the-overall-median/total for a continuous-score tool — it returns the selection (or scoring) rate, the impact ratio (each group's rate divided by the most-selected group's rate), and an adverse-impact flag (impact ratio below the EEOC four-fifths threshold of 0.8) for every group, across the sex, race/ethnicity, and intersectional dimensions, plus the most-selected group per dimension and an overall flag. Categories under 2% of the audited data are marked excluded per DCWP discretion. It is a pure calculation that produces exactly the figures the annual published summary must contain — the law mandates the calculation, not any particular remediation. The relevant compliance postures (nyc-ll144, and ca-tfaia for California SB 53) were already in the catalog. **Added:** *`b.ai.aedtBiasAudit` — Local Law 144 selection/scoring rates and four-fifths impact ratios* — `b.ai.aedtBiasAudit({ type, metadata, categories, minCategoryShare? })` where `type` is `"selection"` (group entries `{ selected, total }`) or `"scoring"` (`{ scoredAboveMedian, total }`). Returns per-group rate, impact ratio, and `adverseImpact` flag across the `sex`, `raceEthnicity`, and `intersectional` dimensions, plus the most-selected group per dimension and an `anyAdverseImpact` summary. Categories below `minCategoryShare` (2% default) are excluded from the impact-ratio basis. Throws `AedtBiasAuditError` on malformed input.
 
 - v0.13.4 (2026-05-26) — **`b.crdt` — conflict-free replicated data types.** b.crdt adds state-based Conflict-free Replicated Data Types: data structures that independent replicas update without coordination and still converge to the same value once they have exchanged state. Each type's merge is a join over a semilattice — commutative, associative, and idempotent — so replicas can merge in any order, any number of times, and agree, which makes these the substrate for active/active cluster state, offline-first clients that reconcile on reconnect, and eventually-consistent counters, sets, and maps. The release ships the full state-based family: grow-only and positive-negative counters (gCounter / pnCounter), grow-only, two-phase, and observed-remove sets (gSet / twoPSet / orSet), a last-write-wins register (lwwRegister), and an observed-remove map (orMap). Every type exposes the same contract — local mutators, merge(other) that returns a converged instance without mutating either operand, value() for the materialized value, and state() / fromState() for a JSON-serializable form to snapshot via b.archive or b.backup or ship to a peer — and carries a replicaId so per-replica contributions stay distinct. **Added:** *`b.crdt` — state-based CvRDT counters, sets, register, and map* — `b.crdt.gCounter` / `pnCounter` (grow-only and increment/decrement counters), `b.crdt.gSet` / `twoPSet` / `orSet` (grow-only, two-phase, and observed-remove sets — `orSet` supports re-add and resolves a concurrent add-vs-remove as add-wins), `b.crdt.lwwRegister` (last-write-wins with a deterministic replicaId tie-break), and `b.crdt.orMap` (observed-remove keys with last-write-wins values). Each exposes `merge` / `value` / `state` / `fromState` and converges by the CvRDT laws. `orSet` and `orMap` accept `tombstoneRetention` to bound tombstone memory against a remove flood.

package/lib/vendor/blamejs/README.md

@@ -190,6 +190,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 - **AI usage quotas** — per-tenant / per-model budgets metered by tokens / requests / cost-usd / compute-hours over calendar-aligned windows, with an atomic conditional reserve (no charge-then-refund race) + hard/soft/warn enforcement and an optional cross-node store; defends OWASP LLM10:2025 unbounded consumption / denial-of-wallet (`b.ai.quota`)
 - **AI capability routing** — model-capability registry (context window / modalities / tool use / reasoning tier / cost rates) + a router that picks the cheapest model satisfying a request's requirements, refusing capability mismatches before the inference call (NIST AI RMF MAP + Model Cards); composes with `b.ai.quota` cost budgets (`b.ai.capability`)
 - **AEDT bias audit** — NYC Local Law 144 bias-audit figures (`b.ai.aedtBiasAudit`): selection / scoring rates and EEOC four-fifths-rule impact ratios across sex, race/ethnicity, and their intersection, with the most-selected group and adverse-impact flags (impact ratio < 0.8) for the annual published summary; sub-2% categories excludable per DCWP §5-301
+- **Frontier AI protocol** — California SB 53 (Transparency in Frontier AI Act) obligations (`b.ai.frontierModelProtocol`): classify the frontier-model (>10²⁶ training FLOPs) and large-frontier-developer (>$500M revenue) thresholds, enumerate the resulting obligations, check a safety framework for required elements, and build a critical-safety-incident report with the 15-day / 24-hour California OES notification deadline (`.incidentReport`)
 ### Compliance regimes
 
 - **Posture coordinator** — `b.compliance` cascades operator-declared regime into retention / audit / db / cryptoField via POSTURE_DEFAULTS:

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.13.5",
-  "createdAt": "2026-05-27T01:38:32.776Z",
+  "frameworkVersion": "0.13.6",
+  "createdAt": "2026-05-27T02:34:13.690Z",
   "exports": {
     "a2a": {
       "type": "object",
@@ -1577,6 +1577,10 @@
             }
           }
         },
+        "frontierModelProtocol": {
+          "type": "function",
+          "arity": 1
+        },
         "input": {
           "type": "object",
           "members": {

package/lib/vendor/blamejs/index.js

@@ -478,6 +478,7 @@ module.exports = {
     capability:      require("./lib/ai-capability"),
     dp:              require("./lib/ai-dp"),
     aedtBiasAudit:   require("./lib/ai-aedt-bias-audit"),
+    frontierModelProtocol: require("./lib/ai-frontier-protocol"),
   },
   promisePool:      require("./lib/promise-pool"),
   sdNotify:         require("./lib/sd-notify"),

package/lib/vendor/blamejs/lib/ai-frontier-protocol.js

@@ -0,0 +1,196 @@
+"use strict";
+/**
+ * @module b.ai.frontierModelProtocol
+ * @nav    Compliance
+ * @title  Frontier AI Protocol
+ *
+ * @intro
+ *   Assess a developer's obligations under California's Transparency in
+ *   Frontier Artificial Intelligence Act — SB 53, Cal. Bus. & Prof. Code
+ *   §22757.10 et seq., signed 2025-09-29 and effective 2026-01-01 — and build
+ *   the critical-safety-incident report the law requires. SB 53 attaches
+ *   obligations by two thresholds: a <em>frontier model</em> is one trained
+ *   with more than 10<sup>26</sup> floating-point operations (including
+ *   cumulative fine-tuning), and a <em>large frontier developer</em> is a
+ *   frontier developer whose annual revenue, with affiliates, exceeded
+ *   $500,000,000 in the prior calendar year. Frontier developers must report
+ *   critical safety incidents; large frontier developers must additionally
+ *   publish an annual frontier-AI safety framework.
+ *
+ *   <code>frontierModelProtocol(opts)</code> takes the model's training compute
+ *   and the developer's revenue and returns which thresholds are crossed and
+ *   the resulting obligations, optionally checking that a supplied safety
+ *   framework carries the elements the Act expects (risk identification,
+ *   mitigation, governance, cybersecurity, and alignment with a recognized
+ *   standard such as the NIST AI RMF or ISO/IEC 42001).
+ *   <code>frontierModelProtocol.incidentReport(opts)</code> validates a
+ *   critical-incident type against the Act's four definitions and computes the
+ *   notification deadline: a routine report goes to the California Office of
+ *   Emergency Services within 15 days of discovery; an imminent risk of death
+ *   or serious physical injury is reported to an applicable authority within 24
+ *   hours.
+ *
+ * @card
+ *   California SB 53 frontier-AI protocol (`b.ai.frontierModelProtocol`) —
+ *   classify frontier-model / large-developer thresholds (10²⁶ FLOPs, $500M
+ *   revenue), enumerate obligations, and build the critical-safety-incident
+ *   report with the 15-day / 24-hour OES notification deadline.
+ */
+
+var C = require("./constants");
+var { defineClass } = require("./framework-error");
+
+var FrontierProtocolError = defineClass("FrontierProtocolError", { alwaysPermanent: true });
+
+// SB 53 thresholds.
+var FRONTIER_FLOP_THRESHOLD = 1e26;          // > 10^26 training FLOPs → frontier model
+var LARGE_DEVELOPER_REVENUE_USD = 5e8;       // > $500,000,000 prior-year revenue → large developer
+var INCIDENT_DEADLINE_MS = C.TIME.days(15);  // report to CA OES within 15 days of discovery
+var IMMINENT_DEADLINE_MS = C.TIME.hours(24); // within 24 hours if imminent risk to life
+
+// The four critical safety incident categories (Cal. Bus. & Prof. Code §22757.10).
+var CRITICAL_INCIDENT_TYPES = {
+  "weights-exfiltration-harm":         "Unauthorized access, modification, or exfiltration of frontier-model weights resulting in death or bodily injury",
+  "catastrophic-risk-materialization": "Harm resulting from the materialization of a catastrophic risk (including loss of life or property from a dangerous capability)",
+  "loss-of-control-harm":              "Loss of control of a frontier model causing death or bodily injury",
+  "deceptive-control-subversion":      "A frontier model using deceptive techniques to subvert developer controls, demonstrating materially increased catastrophic risk",
+};
+
+// Elements a large frontier developer's published safety framework must address.
+var REQUIRED_FRAMEWORK_ELEMENTS = ["riskIdentification", "riskMitigation", "governance", "cybersecurity", "standardsAlignment"];
+
+function _posNum(v, label) {
+  if (typeof v !== "number" || !isFinite(v) || v < 0) throw new FrontierProtocolError("frontier/bad-value", "frontierModelProtocol: " + label + " must be a non-negative finite number");
+  return v;
+}
+
+/**
+ * @primitive  b.ai.frontierModelProtocol
+ * @signature  b.ai.frontierModelProtocol(opts)
+ * @since      0.13.6
+ * @status     stable
+ * @compliance ca-tfaia, soc2
+ * @related    b.ai.aedtBiasAudit, b.ai.disclosure.applyAll
+ *
+ * Determine SB 53 obligations from a model's training compute and the
+ * developer's revenue. Returns <code>isFrontierModel</code> (training FLOPs
+ * above 10<sup>26</sup>), <code>isLargeFrontierDeveloper</code> (a frontier
+ * developer with revenue above $500M), and the resulting
+ * <code>obligations</code>. When <code>framework</code> is supplied, its
+ * required elements are checked and reported in <code>frameworkGaps</code>.
+ * Throws <code>FrontierProtocolError</code> on malformed input.
+ *
+ * @opts
+ *   trainingFlops:    number,   // total training FLOPs incl. fine-tuning (required)
+ *   annualRevenueUsd: number,   // developer prior-year revenue with affiliates (default: 0)
+ *   framework:        object,   // optional safety framework to check for required elements
+ *
+ * @example
+ *   var p = b.ai.frontierModelProtocol({ trainingFlops: 5e26, annualRevenueUsd: 1e9 });
+ *   p.isFrontierModel;           // → true
+ *   p.isLargeFrontierDeveloper;  // → true
+ *   p.obligations;               // → ["report-critical-safety-incidents", "publish-annual-safety-framework", ...]
+ */
+function frontierModelProtocol(opts) {
+  opts = opts || {};
+  if (typeof opts !== "object") throw new FrontierProtocolError("frontier/bad-opts", "frontierModelProtocol: opts must be an object");
+  var allowed = { trainingFlops: 1, annualRevenueUsd: 1, framework: 1 };
+  Object.keys(opts).forEach(function (k) { if (!allowed[k]) throw new FrontierProtocolError("frontier/bad-opts", "frontierModelProtocol: unknown option '" + k + "'"); });
+
+  var flops = _posNum(opts.trainingFlops, "trainingFlops");
+  var revenue = opts.annualRevenueUsd != null ? _posNum(opts.annualRevenueUsd, "annualRevenueUsd") : 0;
+
+  var isFrontierModel = flops > FRONTIER_FLOP_THRESHOLD;
+  var isLargeFrontierDeveloper = isFrontierModel && revenue > LARGE_DEVELOPER_REVENUE_USD;
+
+  var obligations = [];
+  if (isFrontierModel) {
+    obligations.push("report-critical-safety-incidents");
+    obligations.push("publish-transparency-report");
+  }
+  if (isLargeFrontierDeveloper) {
+    obligations.push("publish-annual-safety-framework");
+    obligations.push("disclose-catastrophic-risk-assessment");
+  }
+
+  var out = {
+    isFrontierModel: isFrontierModel,
+    isLargeFrontierDeveloper: isLargeFrontierDeveloper,
+    thresholds: { frontierFlops: FRONTIER_FLOP_THRESHOLD, largeDeveloperRevenueUsd: LARGE_DEVELOPER_REVENUE_USD },
+    obligations: obligations,
+  };
+
+  if (opts.framework != null) {
+    if (typeof opts.framework !== "object") throw new FrontierProtocolError("frontier/bad-value", "frontierModelProtocol: framework must be an object");
+    var gaps = REQUIRED_FRAMEWORK_ELEMENTS.filter(function (el) { return !opts.framework[el]; });
+    out.frameworkGaps = gaps;
+    out.frameworkComplete = gaps.length === 0;
+  }
+  return out;
+}
+
+/**
+ * @primitive  b.ai.frontierModelProtocol.incidentReport
+ * @signature  b.ai.frontierModelProtocol.incidentReport(opts)
+ * @since      0.13.6
+ * @status     stable
+ * @compliance ca-tfaia, soc2
+ * @related    b.ai.frontierModelProtocol, b.ai.aedtBiasAudit
+ *
+ * Build a critical-safety-incident report and compute its notification
+ * deadline to the California Office of Emergency Services. <code>type</code>
+ * must be one of the Act's four categories; <code>discoveredAt</code> is when
+ * the incident was discovered. The deadline is 15 days from discovery, or 24
+ * hours when <code>imminentRiskToLife</code> is set. Returns the structured
+ * report with <code>dueAt</code> and <code>deadlineHours</code>. Throws
+ * <code>FrontierProtocolError</code> on an unknown type or bad timestamp.
+ *
+ * @opts
+ *   type:               string,   // one of b.ai.frontierModelProtocol.INCIDENT_TYPES (required)
+ *   discoveredAt:       Date,     // discovery time (Date or epoch-ms; default: now)
+ *   imminentRiskToLife: boolean,  // true → 24-hour deadline (default: false → 15 days)
+ *   description:        string,   // free-text incident description (optional)
+ *
+ * @example
+ *   var r = b.ai.frontierModelProtocol.incidentReport({
+ *     type: "loss-of-control-harm", discoveredAt: new Date("2026-06-01T00:00:00Z"),
+ *   });
+ *   r.deadlineHours;   // → 360  (15 days)
+ *   r.recipient;       // → "California Office of Emergency Services"
+ */
+function incidentReport(opts) {
+  opts = opts || {};
+  if (typeof opts !== "object") throw new FrontierProtocolError("frontier/bad-opts", "incidentReport: opts must be an object");
+  if (!CRITICAL_INCIDENT_TYPES[opts.type]) throw new FrontierProtocolError("frontier/bad-incident-type", "incidentReport: type must be one of " + Object.keys(CRITICAL_INCIDENT_TYPES).join(", "));
+
+  var discoveredMs;
+  if (opts.discoveredAt == null) discoveredMs = Date.now();
+  else if (opts.discoveredAt instanceof Date) discoveredMs = opts.discoveredAt.getTime();
+  else discoveredMs = Number(opts.discoveredAt);
+  if (!isFinite(discoveredMs) || discoveredMs < 0) throw new FrontierProtocolError("frontier/bad-value", "incidentReport: discoveredAt must be a Date or non-negative epoch-ms");
+
+  var imminent = opts.imminentRiskToLife === true;
+  var windowMs = imminent ? IMMINENT_DEADLINE_MS : INCIDENT_DEADLINE_MS;
+
+  return {
+    type:               opts.type,
+    typeDescription:    CRITICAL_INCIDENT_TYPES[opts.type],
+    description:        typeof opts.description === "string" ? opts.description : null,
+    imminentRiskToLife: imminent,
+    discoveredAt:       new Date(discoveredMs).toISOString(),
+    dueAt:              new Date(discoveredMs + windowMs).toISOString(),
+    deadlineHours:      windowMs / C.TIME.hours(1),
+    // §22757.13: the routine report goes to OES within 15 days; an imminent
+    // risk of death or serious physical injury is reported to an applicable
+    // authority within 24 hours, which the operator selects for the incident.
+    recipient:          imminent ? "An applicable authority with jurisdiction (e.g. law enforcement or a public-safety agency)" : "California Office of Emergency Services",
+    citation:           "Cal. Bus. & Prof. Code §22757.13 (SB 53)",
+  };
+}
+
+frontierModelProtocol.incidentReport = incidentReport;
+frontierModelProtocol.INCIDENT_TYPES = Object.keys(CRITICAL_INCIDENT_TYPES);
+frontierModelProtocol.REQUIRED_FRAMEWORK_ELEMENTS = REQUIRED_FRAMEWORK_ELEMENTS;
+frontierModelProtocol.FrontierProtocolError = FrontierProtocolError;
+
+module.exports = frontierModelProtocol;

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.13.5",
+  "version": "0.13.6",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.13.6.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.6",
+  "date": "2026-05-26",
+  "headline": "`b.ai.frontierModelProtocol` — California SB 53 frontier-AI obligations",
+  "summary": "b.ai.frontierModelProtocol assesses a developer's obligations under California's Transparency in Frontier Artificial Intelligence Act — SB 53, Cal. Bus. & Prof. Code §22757.10, effective 2026-01-01 — from a model's training compute and the developer's revenue. It reports whether the model crosses the frontier threshold (more than 10^26 training FLOPs), whether the developer is a large frontier developer (prior-year revenue, with affiliates, above $500M), and the resulting obligations: every frontier developer must report critical safety incidents and publish a transparency report, and a large frontier developer must additionally publish an annual safety framework and disclose its catastrophic-risk assessment. Passing a candidate safety framework reports which required elements (risk identification, mitigation, governance, cybersecurity, standards alignment) are missing. b.ai.frontierModelProtocol.incidentReport validates a critical-incident type against the Act's four categories and computes the notification deadline to the California Office of Emergency Services — 15 days from discovery, or 24 hours when there is an imminent risk of death or serious physical injury. The ca-tfaia compliance posture was already in the catalog.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.ai.frontierModelProtocol` — SB 53 threshold classification, obligations, and incident reporting",
+          "body": "`b.ai.frontierModelProtocol({ trainingFlops, annualRevenueUsd, framework? })` returns `isFrontierModel`, `isLargeFrontierDeveloper`, the `obligations` list, and (when a framework is supplied) its `frameworkGaps`. `b.ai.frontierModelProtocol.incidentReport({ type, discoveredAt, imminentRiskToLife? })` builds a critical-safety-incident report with the California OES recipient and a `dueAt` / `deadlineHours` computed from the 15-day (or 24-hour imminent-risk) statutory window; `type` must be one of the four categories in `INCIDENT_TYPES`. Throws `FrontierProtocolError` on malformed input."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/ai-frontier-protocol.test.js

@@ -0,0 +1,83 @@
+"use strict";
+/**
+ * Layer 0 — b.ai.frontierModelProtocol (California SB 53, Transparency in
+ * Frontier AI Act).
+ *
+ * Oracle: the statute's thresholds and deadlines (Cal. Bus. & Prof. Code
+ * §22757.10) — a frontier model exceeds 10^26 training FLOPs, a large frontier
+ * developer exceeds $500M revenue, and a critical-incident report is due to the
+ * CA OES within 15 days of discovery (24 hours when there is imminent risk to
+ * life). The four incident categories are enumerated.
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+var fp = b.ai.frontierModelProtocol;
+
+function testSurface() {
+  check("b.ai.frontierModelProtocol is a function", typeof fp === "function");
+  check("incidentReport is a function", typeof fp.incidentReport === "function");
+  check("INCIDENT_TYPES has the four categories", fp.INCIDENT_TYPES.length === 4);
+  check("REQUIRED_FRAMEWORK_ELEMENTS present", fp.REQUIRED_FRAMEWORK_ELEMENTS.length === 5);
+  check("FrontierProtocolError is a class", typeof fp.FrontierProtocolError === "function");
+}
+
+function testThresholds() {
+  var big = fp({ trainingFlops: 5e26, annualRevenueUsd: 1e9 });
+  check("above 10^26 FLOPs is a frontier model", big.isFrontierModel === true);
+  check("frontier + >$500M is a large frontier developer", big.isLargeFrontierDeveloper === true);
+  check("large developer gets all four obligations", big.obligations.length === 4 && big.obligations.indexOf("publish-annual-safety-framework") !== -1);
+
+  check("below 10^26 FLOPs is not a frontier model", fp({ trainingFlops: 1e25, annualRevenueUsd: 1e9 }).isFrontierModel === false);
+  check("exactly 10^26 FLOPs is not a frontier model (strict >)", fp({ trainingFlops: 1e26 }).isFrontierModel === false);
+
+  var smallCo = fp({ trainingFlops: 5e26, annualRevenueUsd: 1e8 });
+  check("frontier model at a small developer: frontier yes, large no", smallCo.isFrontierModel === true && smallCo.isLargeFrontierDeveloper === false);
+  check("small developer gets only the frontier obligations", smallCo.obligations.length === 2 && smallCo.obligations.indexOf("report-critical-safety-incidents") !== -1);
+  check("revenue defaults to 0 when omitted", fp({ trainingFlops: 5e26 }).isLargeFrontierDeveloper === false);
+}
+
+function testFrameworkCheck() {
+  var gaps = fp({ trainingFlops: 5e26, annualRevenueUsd: 1e9, framework: { riskIdentification: 1, governance: 1 } });
+  check("framework gaps detected", JSON.stringify(gaps.frameworkGaps) === JSON.stringify(["riskMitigation", "cybersecurity", "standardsAlignment"]));
+  check("frameworkComplete false with gaps", gaps.frameworkComplete === false);
+  var complete = fp({ trainingFlops: 5e26, annualRevenueUsd: 1e9, framework: { riskIdentification: 1, riskMitigation: 1, governance: 1, cybersecurity: 1, standardsAlignment: 1 } });
+  check("frameworkComplete true when all elements present", complete.frameworkComplete === true && complete.frameworkGaps.length === 0);
+}
+
+function testIncidentReport() {
+  var r15 = fp.incidentReport({ type: "loss-of-control-harm", discoveredAt: new Date("2026-06-01T00:00:00Z") });
+  check("default deadline is 15 days (360h)", r15.deadlineHours === 360);
+  check("15-day dueAt computed", r15.dueAt === "2026-06-16T00:00:00.000Z");
+  check("routine report goes to CA OES", r15.recipient.indexOf("Office of Emergency Services") !== -1);
+  check("type description carried", r15.typeDescription.indexOf("Loss of control") !== -1);
+
+  var r24 = fp.incidentReport({ type: "weights-exfiltration-harm", discoveredAt: new Date("2026-06-01T00:00:00Z"), imminentRiskToLife: true });
+  check("imminent-risk deadline is 24 hours", r24.deadlineHours === 24);
+  check("24-hour dueAt computed", r24.dueAt === "2026-06-02T00:00:00.000Z");
+  // §22757.13: imminent risk routes to an applicable authority, not OES.
+  check("imminent-risk routes to an applicable authority, not OES", r24.recipient.indexOf("Office of Emergency Services") === -1 && r24.recipient.indexOf("applicable authority") !== -1);
+  // §22757.10(i): the weights category is death/bodily-injury only — no property.
+  check("weights-incident description excludes property", r24.typeDescription.toLowerCase().indexOf("property") === -1);
+}
+
+function testErrors() {
+  check("unknown incident type throws", code(function () { fp.incidentReport({ type: "made-up" }); }) === "frontier/bad-incident-type");
+  check("bad discoveredAt throws",       code(function () { fp.incidentReport({ type: "loss-of-control-harm", discoveredAt: -5 }); }) === "frontier/bad-value");
+  check("missing trainingFlops throws",  code(function () { fp({}); }) === "frontier/bad-value");
+  check("negative trainingFlops throws", code(function () { fp({ trainingFlops: -1 }); }) === "frontier/bad-value");
+  check("unknown opt throws",            code(function () { fp({ trainingFlops: 1e26, bogus: 1 }); }) === "frontier/bad-opts");
+  check("non-object framework throws",   code(function () { fp({ trainingFlops: 5e26, framework: 7 }); }) === "frontier/bad-value");
+}
+
+async function run() {
+  testSurface();
+  testThresholds();
+  testFrameworkCheck();
+  testIncidentReport();
+  testErrors();
+}
+module.exports = { run: run };
+if (require.main === module) { run().then(function () { console.log("[ai-frontier-protocol] OK — " + helpers.getChecks() + " checks passed"); }, function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }); }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.1.36",
+  "version": "0.1.37",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {