@blamejs/blamejs-shop 0.2.12 → 0.2.14

package/lib/vendor/blamejs/release-notes/v0.13.28.json

@@ -0,0 +1,30 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.28",
+  "date": "2026-05-28",
+  "headline": "Queue retry backoff now applies on the Redis backend; static-serve path-containment edge closed",
+  "summary": "Two behavioral fixes plus doc corrections. The Redis queue backend silently discarded the documented retry backoff: b.queue.consume passes the delay as `{ retryDelayMs }` (the shape the local backend reads), but the Redis backend's fail() accepted only a bare-number third argument, so the object failed its numeric check and the delay was forced to 0 — a failing job re-leased immediately instead of waiting 1s/2s/4s/…, a retry storm under failure. The Redis backend now accepts the object form, so the exponential backoff applies as documented (verified by an integration test against real Redis). Separately, b.router.serveStatic's path-containment check used a bare string prefix, so a sibling directory whose name extends the root (root `/srv/public` vs `/srv/public-evil`) could pass; it now anchors on a path separator. Also: b.fileUpload now surfaces (via an observability counter) when a configured content-safety gate is skipped because an upload streamed past the reassembly cap, and documents that boundary; and b.cookies.parse's example output is corrected.",
+  "sections": [
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "Redis queue backend honors the documented retry backoff",
+          "body": "`b.queue.consume` re-pends a failed job with deterministic exponential backoff (1s base, 5min cap) by calling the backend's `fail()` with `{ retryDelayMs }`. The Redis backend's `fail()` accepted only a bare-number third argument, so the object failed its `typeof === \"number\"` check and the delay was reset to 0 — a failing job became immediately re-leasable, hot-looping instead of backing off. `fail()` now accepts both the object form (as the local backend does) and a bare number, so the backoff applies on Redis. An integration test against real Redis pins it."
+        },
+        {
+          "title": "`b.router.serveStatic` path-containment anchors on a separator",
+          "body": "The containment check was `resolvedPath.startsWith(root)`, which a sibling directory sharing the root's name as a prefix (root `/srv/public` vs `/srv/public-evil`) could satisfy. It now requires the resolved path to equal `root` or start with `root + path.sep`, closing the sibling-prefix edge (`b.staticServe.create` remains the hardened serving path, with realpath + filename gating)."
+        },
+        {
+          "title": "`b.fileUpload` surfaces content-safety gate skips on oversized streamed uploads",
+          "body": "The byte-level content-safety gate inspects the reassembled buffer, so it runs on uploads up to `maxStreamReassemblyBytes` (default 64 MiB); a larger upload is handed to `onFinalize` as a stream and the byte-content gate is skipped (MIME-sniff and filename gates still run). That skip now emits a `fileUpload.content_safety_skipped_streamed` observability counter instead of passing silently, and the limit is documented. To guarantee content-gating of a type, cap `maxFileBytes` at or below `maxStreamReassemblyBytes`."
+        },
+        {
+          "title": "`b.cookies.parse` example output corrected",
+          "body": "The example claimed `theme=%22dark%22` parses to `theme: \"dark\"`, but quote-stripping runs before percent-decoding, so the literal quotes survive. The example now uses `theme=dark%20mode` → `theme: \"dark mode\"`, which demonstrates percent-decoding without the quote-strip-ordering quirk."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.29.json

@@ -0,0 +1,30 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.29",
+  "date": "2026-05-28",
+  "headline": "Doc corrections: AI Act disclosure kind values, SQS queue model, age-gate coupling",
+  "summary": "Documentation corrections. The most actionable: b.middleware.aiActDisclosure's @opts listed two EU AI Act transparency `kind` values (`deepfake` and `synthetic-content`) that the middleware does not accept, so they threw at construction; the accepted values use the hyphenated Art. 50 spellings (e.g. `deep-fake`) and include a text-public-interest variant the enum omitted — an operator copying the documented values crashed a compliance middleware at boot. The b.queue docs implied the SQS backend is driven by the generic b.queue.consume loop like local/redis; SQS is actually an SQS-native adapter (complete/fail by message receipt handle, server-side redrive) driven directly, and the docs now say so. b.middleware.ageGate's `requireAge` 451 floor is documented as taking effect only alongside `consentRequired` (it was silently inert without it). Plus a compose-pipeline @since and a flag-context @related correction. No code behavior changed.",
+  "sections": [
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "`b.middleware.aiActDisclosure` documents the accepted `kind` values",
+          "body": "The `@opts` listed `kind` as `ai-interaction | deepfake | emotion-recognition | biometric-categorisation | synthetic-content`. Two of those — `deepfake` and `synthetic-content` — are not accepted and threw at construction; the EU AI Act Art. 50 values use hyphenated spellings (e.g. `deep-fake`, the generated-content variant) and include `ai-text-public-interest`, which the documented enum omitted. The `@opts` now lists the full set the middleware accepts."
+        },
+        {
+          "title": "`b.queue` SQS backend documented as SQS-native, not consume-driven",
+          "body": "The module docs implied the `sqs` backend is interchangeable with `local`/`redis` under the generic `b.queue.consume` loop. SQS is an SQS-native adapter: `complete` / `fail` act on the message's `receiptHandle` (returned by `lease()`, threaded back by the caller), and DLQ + visibility-expiry are handled server-side by the queue's RedrivePolicy. The docs now state that `sqs` is driven directly (lease → handle → complete/fail) rather than by `b.queue.consume`, and does not use the framework DLQ / sweep."
+        },
+        {
+          "title": "`b.middleware.ageGate` documents the `requireAge` / `consentRequired` coupling",
+          "body": "`requireAge` (the HTTP 451 legal floor) is evaluated within the consent classification, so it takes effect only when `consentRequired` is also set — `requireAge` alone, with `consentRequired: null`, never classifies a request as below-threshold and the 451 never fires. The `@opts` and prose now state this coupling instead of presenting `requireAge` as a standalone threshold."
+        },
+        {
+          "title": "Smaller doc corrections",
+          "body": "`b.middleware.composePipeline`'s `@since` is corrected to 0.9.43 (its actual ship version). `b.middleware.flagContext`'s `@related` pointed at a non-existent `b.flagClient.getBoolean`; it now references `b.flag.create`."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.30.json

@@ -0,0 +1,30 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.30",
+  "date": "2026-05-28",
+  "headline": "Doc corrections in the safe-* parsers (defaults, an error code, an example, a status list)",
+  "summary": "Four documentation corrections in the safe-* input parsers; no code behavior changed. The parsers' enforced limits and controls are unchanged — these align the docs with what the code already does. b.safeMime.parse's documented default transfer-encoding allowlist listed `binary`, which is excluded by default (opt-in per RFC 3030 BINARYMIME). b.safeDecompress documented a refusal code (`output-too-large`) it never emits — an absolute-size bomb surfaces under `decompress-failed`. b.safeSmtp.findDotTerminator's example output was off by one. b.safeIcap's intro status-code summary omitted 404 / 405 / 408 (the detailed block already listed them).",
+  "sections": [
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "`b.safeMime.parse` documents the actual default transfer-encoding allowlist",
+          "body": "The `@opts` default listed `7bit/8bit/binary/qp/base64`, but `binary` is deliberately excluded by default (RFC 3030 BINARYMIME is opt-in); the default is `7bit/8bit/quoted-printable/base64`. The doc now matches, so operators don't expect inbound `Content-Transfer-Encoding: binary` parts to pass without opting in."
+        },
+        {
+          "title": "`b.safeDecompress` names the real absolute-size-bomb refusal code",
+          "body": "The refusal-posture list documented `safe-decompress/output-too-large` for a bomb-by-absolute-size, but that code is never emitted — zlib's `maxOutputLength` throws before allocation and the failure surfaces as `safe-decompress/decompress-failed`. The doc now names the code an operator branching on the result will actually see (the ratio, output-byte, and compressed-input caps are unchanged and enforced)."
+        },
+        {
+          "title": "`b.safeSmtp.findDotTerminator` example output corrected",
+          "body": "The example claimed the `\\r\\n.\\r\\n` terminator in `\"Hello world.\\r\\n.\\r\\n\"` is at index 13; it is at index 12. The example now shows 12 (the implementation was already correct)."
+        },
+        {
+          "title": "`b.safeIcap` intro status-code summary lists 404 / 405 / 408",
+          "body": "The intro summary said only `100 / 200 / 204 / 400 / 403 / 5xx` are honored, but the parser also accepts `404 / 405 / 408` (legitimate RFC 3507 §4.3.3 codes, already listed in the detailed `parse` block). The intro summary now matches."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.31.json

@@ -0,0 +1,26 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.31",
+  "date": "2026-05-28",
+  "headline": "Circuit-breaker onStateChange callback now fires; mcp / vault-aad doc corrections",
+  "summary": "b.circuitBreaker documented an `onStateChange` callback (both an option and an `onStateChange(handler)` registration method) plus a state-change payload, but the callback was never invoked — only an observability event fired. The callback is now implemented: it fires on every transition with `{ name, from, to, at }`, the registration method works, and a non-function handler is rejected at construction. The same primitive's docs are corrected to name the real accessor (`getState()`, not `state()`) and drop a never-read `audit` option. Plus two doc-only corrections: b.mcp.toolResult.sanitize described composing b.guardHtml / b.ai.input.classify (it uses built-in detection) and documented a `classifyInput` option it never read; and b.vault.aad's prose said HKDF-SHAKE256 where the derivation is SHAKE256 (the AEAD AAD-binding itself is unchanged and sound).",
+  "sections": [
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "`b.circuitBreaker` onStateChange callback is invoked on every transition",
+          "body": "The `onStateChange` option and the `onStateChange(handler)` registration method are now wired: each registered handler is called with `{ name, from, to, at }` on every state transition (closed→open, open→half, half→closed/open), alongside the existing `breaker.state.change` observability event. A non-function `onStateChange` is rejected at construction. Previously the documented callback never fired. The docs are also corrected to name the real state accessor `getState()` (there is a `state` property, so `state()` was never a method) and to drop a never-read `audit` option."
+        },
+        {
+          "title": "`b.mcp.toolResult.sanitize` documents its actual detection and options",
+          "body": "The prose said the sanitizer composes `b.guardHtml`'s strict profile and `b.ai.input.classify`; it uses built-in dangerous-HTML and prompt-injection-marker detection. The `@opts` also listed a `classifyInput` override the function never read. The prose now describes the built-in detection and the unwired `classifyInput` option is removed. The fail-closed refusal behavior (default `posture: \"refuse\"`) is unchanged."
+        },
+        {
+          "title": "`b.vault.aad` derivation named correctly (SHAKE256)",
+          "body": "The module prose described the per-binding key derivation as HKDF-SHAKE256; it is SHAKE256 over the vault root concatenated with the binding inputs (no HKDF extract/expand). The AEAD AAD-binding to (table, row, column, schema version) — the file's actual security guarantee — is unchanged and sound; only the KDF name in the doc was wrong."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.32.json

@@ -0,0 +1,34 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.32",
+  "date": "2026-05-28",
+  "headline": "`b.auditDailyReview` enforces notify under the sox-404 posture; compliance doc corrections",
+  "summary": "b.auditDailyReview documented `sox-404` (SOX §404 ICFR — the internal-controls regime this primitive serves) as one of the postures that make a `notify` callback mandatory at construction, but the enforcement set used only `sox`, so pinning `posture: \"sox-404\"` without a notify channel was silently accepted. `sox-404` is now in the mandatory-notify set, so the advertised guarantee holds (a regression test pins it). The rest are documentation corrections with no behavior change: b.compliance.posturesByDomain / posturesByJurisdiction examples showed small fixed arrays where the functions return every matching posture (the catalog has grown); b.dataAct's surface list named two methods that do not exist (the real surface is declareProduct / recordUserAccess / shareWithThirdParty / recordSwitchRequest, with gatekeeper refusal folded into shareWithThirdParty); b.secCyber.eightKArtifact's documented return key `audit` is actually `deadlineBusinessDays`; and b.compliance.aiAct.transparency's helper summary named `cspMetaTag` / a `watermark({ kind })` argument that are really `metaTags` / `watermark({ mediaKind })`.",
+  "sections": [
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "`b.auditDailyReview` requires a notify channel under the `sox-404` posture",
+          "body": "The docs listed `sox-404` among the postures that make a `notify` callback mandatory at create-time, but the enforcement set contained only `sox` — so `posture: \"sox-404\"` without `notify` was accepted instead of refused. `sox-404` (SOX §404 ICFR) is now in the mandatory-notify set, matching the documented guarantee; constructing without a notify channel under it throws `auditDailyReview/notify-required-under-posture`."
+        },
+        {
+          "title": "`b.compliance` jurisdiction/domain lister examples no longer enumerate a stale fixed set",
+          "body": "`posturesByDomain` and `posturesByJurisdiction` return every posture matching the domain/jurisdiction, but their `@example`s showed small fixed arrays from before the posture catalog grew. The examples now show a representative prefix with `...` and note they return the full matching set."
+        },
+        {
+          "title": "`b.dataAct` surface list matches the real methods",
+          "body": "The module surface listed `userAccessible(...)` and `refuseGatekeeper(...)`, neither of which exists. The real surface is `declareProduct` / `recordUserAccess` / `shareWithThirdParty` / `recordSwitchRequest`, and DMA-gatekeeper refusal (Art 32 §1) is enforced inside `shareWithThirdParty`. The doc now reflects that."
+        },
+        {
+          "title": "`b.secCyber.eightKArtifact` documented return shape corrected",
+          "body": "The signature line showed `{ artifact, deadline, audit }`; the function returns `{ artifact, deadline, deadlineBusinessDays }` (there is no `audit` key). The doc now matches."
+        },
+        {
+          "title": "`b.compliance.aiAct.transparency` helper names corrected",
+          "body": "The helper summary named a `cspMetaTag(...)` function and a `watermark({ kind })` argument; the real names are `metaTags(...)` and `watermark({ mediaKind })`. Calling the documented names threw. Also corrected: a `b.aiAdverseDecision` illustration showed an ECOA `statutoryDeadlines` shape that didn't match the regime's actual deadlines."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/20-db.js

@@ -427,11 +427,41 @@ async function testCrossSchemaAttach() {
   }
 }
 
+async function testUnsealRowNullsForgedValue() {
+  // Security regression (CRYPTO-1): an unseal failure — a DB-write
+  // attacker's forged `vault:<…>` payload, or a valid ciphertext copied
+  // to a different row (AAD mismatch) — must NULL the column so
+  // downstream sees "no value", not the attacker-crafted string. A prior
+  // `unsealed ? unsealed : out[field]` write-back silently kept the
+  // forged value on failure, defeating the documented defense.
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-cf-forged-"));
+  try {
+    await setupTestDb(tmpDir);
+    b.cryptoField.registerTable("cf_forged_regress", {
+      sealedFields: ["secret"], aad: true, rowIdField: "id",
+    });
+    var sealed = b.cryptoField.sealRow("cf_forged_regress", { id: "r1", secret: "hello" });
+    check("cryptoField valid round-trip",
+      b.cryptoField.unsealRow("cf_forged_regress", sealed).secret === "hello");
+    var forged = b.cryptoField.unsealRow("cf_forged_regress",
+      { id: "r1", secret: "vault.aad:Zm9yZ2VkLWdhcmJhZ2U=" });
+    check("forged sealed value nulls the field (not kept)", forged.secret === null);
+    var crossRow = b.cryptoField.unsealRow("cf_forged_regress",
+      { id: "DIFFERENT-ROW", secret: sealed.secret });
+    check("cross-row-copied ciphertext nulls the field (AAD mismatch)", crossRow.secret === null);
+    var plain = b.cryptoField.unsealRow("cf_forged_regress", { id: "r2", secret: "not-sealed" });
+    check("non-sealed pass-through value is kept", plain.secret === "not-sealed");
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
 // ---- run() ----
 
 async function run() {
   // db basic
   await testDbBasic();
+  await testUnsealRowNullsForgedValue();
   await testDbWriteOps();
   await testDbSealedWithoutDerived();
   await testDbTransactions();

package/lib/vendor/blamejs/test/integration/queue-redis.test.js

@@ -152,6 +152,20 @@ async function run() {
           lease3b[0].attempts === 2);  // sweep doesn't re-increment; lease does
     await qr.complete(enq3.jobId);
 
+    // ---- fail() honors the object-form { retryDelayMs } b.queue.consume
+    //      passes (regression: the redis backend previously accepted only
+    //      a bare-number 3rd arg, so the object failed the typeof check
+    //      and the delay was forced to 0 — the documented exponential
+    //      backoff was silently discarded and the job re-leased at once) ----
+    var QB = "retry-backoff";
+    var enqB = await qr.enqueue(QB, { go: 1 }, { maxAttempts: 5 });
+    var leaseB = await qr.lease(QB, 5000, 1);
+    check("lease: backoff-regression job leased", leaseB.length === 1);
+    await qr.fail(enqB.jobId, "boom", { retryDelayMs: 60000 });  // object form, 60s delay
+    var leaseBNow = await qr.lease(QB, 5000, 1);
+    check("fail({retryDelayMs}) delays re-lease — backoff honored, not forced to 0",
+          leaseBNow.length === 0);
+
     // ---- fail + retry path ----
     var Q4 = "retry";
     var enq4 = await qr.enqueue(Q4, { go: 1 }, { maxAttempts: 2 });

package/lib/vendor/blamejs/test/layer-0-primitives/agent-idempotency.test.js

@@ -235,8 +235,45 @@ async function testReplayCountAtomic() {
     (r1.replayCount === 2 && r2.replayCount === 1));
 }
 
+async function testAtRestSealingWithVault() {
+  // The cached result is sealed at rest via b.cryptoField when a vault
+  // is configured. Init a vault, capture what actually lands in the
+  // backend, and assert the sensitive payload is not stored in the
+  // clear — then confirm it round-trips. Reset the vault afterwards so
+  // the remaining (vault-less) tests run in their expected mode.
+  var os   = require("node:os");
+  var path = require("node:path");
+  var fs   = require("node:fs");
+  var dir  = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-idem-seal-"));
+  check("vault.isInitialized() is false before init", b.vault.isInitialized() === false);
+  await b.vault.init({ mode: "plaintext", dataDir: dir });
+  try {
+    check("vault.isInitialized() is true after init", b.vault.isInitialized() === true);
+    var SECRET = "patient-PII-9007199254740993";
+    var captured = null;
+    var backend = {
+      _m: Object.create(null),
+      async get(m, a, h) { return this._m[m + a + h] || null; },
+      async put(m, a, h, row) { this._m[m + a + h] = row; captured = row; },
+      async delete(m, a, h) { delete this._m[m + a + h]; },
+    };
+    var idem = b.agent.idempotency.create({ store: backend });
+    await idem.put("move", "u-seal", "jmap-seal-1", { payload: SECRET });
+    check("at-rest: result blob is sealed (no plaintext leak)",
+      typeof captured.resultBlob === "string" && captured.resultBlob.indexOf(SECRET) === -1);
+    check("at-rest: sealed blob carries a vault prefix",
+      /^vault(\.aad)?:/.test(String(captured.resultBlob)));
+    var hit = await idem.get("move", "u-seal", "jmap-seal-1");
+    check("at-rest: sealed result round-trips to plaintext",
+      hit && hit.result && hit.result.payload === SECRET);
+  } finally {
+    b.vault._resetForTest();
+  }
+}
+
 async function run() {
   testSurface();
+  await testAtRestSealingWithVault();
   await testBasicGetPut();
   await testCrossActorIsolation();
   await testCrossMethodIsolation();

package/lib/vendor/blamejs/test/layer-0-primitives/agent-orchestrator.test.js

@@ -361,6 +361,42 @@ async function testShardForSaltedFnv() {
     Object.keys(spread).length >= 4);
 }
 
+async function testRegistryRowSealedAtRest() {
+  // Registry rows seal tenantId + endpoint metadata at rest via
+  // b.cryptoField when a vault is configured. Scope a vault around this
+  // one test (the other tests intentionally run vault-less to exercise
+  // the salted-FNV fallback), capture what lands in the backend, and
+  // assert the sensitive fields are not stored in the clear — then
+  // confirm the tenantId filter still resolves through unseal.
+  var os   = require("node:os");
+  var path = require("node:path");
+  var fs   = require("node:fs");
+  var dir  = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-orch-seal-"));
+  await helpers.setupVaultOnly(dir);
+  try {
+    var captured = null;
+    var backend = {
+      _m: Object.create(null),
+      async get(n) { return this._m[n] || null; },
+      async set(n, row) { this._m[n] = row; if (n === "svc-seal") captured = row; },
+      async delete(n) { delete this._m[n]; },
+      async list() { return Object.values(this._m); },
+    };
+    var orch = b.agent.orchestrator.create({ backend: backend });
+    await orch.register("svc-seal", { kind: "mail", handle: function () {} },
+      { agentKind: "mail", tenantId: "acme-corp", metadata: { endpoint: "https://internal-host:9000" } });
+    check("orch at-rest: tenantId sealed (no plaintext leak)",
+      typeof captured.tenantId === "string" && captured.tenantId.indexOf("acme-corp") === -1);
+    check("orch at-rest: metadata sealed (no endpoint leak)",
+      typeof captured.metadata === "string" && captured.metadata.indexOf("internal-host") === -1);
+    var listed = await orch.list({ tenantId: "acme-corp" });
+    check("orch at-rest: tenantId filter resolves through unseal",
+      listed.length === 1 && listed[0].name === "svc-seal" && listed[0].tenantId === "acme-corp");
+  } finally {
+    helpers.teardownVaultOnly(dir);
+  }
+}
+
 async function run() {
   testSurface();
   await testRegisterLookupUnregister();
@@ -381,6 +417,7 @@ async function run() {
   await testHealth();
   await testStreamRegistry();
   await testPermissions();
+  await testRegistryRowSealedAtRest();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/agent-tenant.test.js

@@ -268,12 +268,38 @@ async function testUnsealRowAuditsOnDecryptRefusal() {
   check("BUG-4: audit emitted on cross-tenant null", saw);
 }
 
+async function testRegistryMetadataSealedAtRest() {
+  // The registry row's metadata is sealed at rest via b.cryptoField when
+  // a vault is configured (it is, in this file's run()). Capture what
+  // lands in the backend and assert the sensitive metadata is not stored
+  // in the clear, then confirm lookup round-trips it back to an object.
+  var SECRET = "tenant-billing-id-XQ42";
+  var captured = null;
+  var backend = {
+    _m: Object.create(null),
+    async get(k) { return this._m[k] || null; },
+    async set(k, row) { this._m[k] = row; if (k === "acme-seal") captured = row; },
+    async delete(k) { delete this._m[k]; },
+    async list() { return Object.values(this._m); },
+  };
+  var tn = b.agent.tenant.create({ backend: backend });
+  await tn.register("acme-seal", { posture: "hipaa", metadata: { billingId: SECRET } });
+  check("tenant at-rest: metadata sealed (no plaintext leak)",
+    typeof captured.metadata === "string" && captured.metadata.indexOf(SECRET) === -1);
+  check("tenant at-rest: sealed metadata carries a vault prefix",
+    /^vault(\.aad)?:/.test(String(captured.metadata)));
+  var cfg = await tn.lookup("acme-seal");
+  check("tenant at-rest: metadata round-trips to an object",
+    cfg && cfg.metadata && cfg.metadata.billingId === SECRET);
+}
+
 async function run() {
   var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-vault-"));
   global._testVaultDir = tmpDir;
   await helpers.setupVaultOnly(tmpDir);
   try {
     testSurface();
+    await testRegistryMetadataSealedAtRest();
     await testRegisterLookupUnregister();
     await testCheckCrossTenant();
     await testCrossTenantAdminScope();

package/lib/vendor/blamejs/test/layer-0-primitives/audit-daily-review.test.js

@@ -82,6 +82,15 @@ function testPostureRequiresNotify() {
   } catch (e) { threw = e; }
   check("pci-dss posture without notify throws",
         threw && /notify-required-under-posture/.test(threw.code || ""));
+
+  // sox-404 (SOX §404 ICFR — the audit/internal-controls regime this
+  // primitive serves) is an advertised notify-required posture too.
+  var threw404 = null;
+  try {
+    b.auditDailyReview.create({ audit: _fakeAudit([]), posture: "sox-404" });
+  } catch (e) { threw404 = e; }
+  check("sox-404 posture without notify throws",
+        threw404 && /notify-required-under-posture/.test(threw404.code || ""));
 }
 
 function testBadSeverity() {

package/lib/vendor/blamejs/test/layer-0-primitives/retry.test.js

@@ -307,6 +307,30 @@ async function testBreakerClosedToOpen() {
         threw && threw.code === "CIRCUIT_OPEN");
 }
 
+async function testBreakerOnStateChange() {
+  // The documented onStateChange opt + onStateChange(handler) method must
+  // both fire on every transition with the { name, from, to, at } payload.
+  var events = [];
+  var br = new b.retry.CircuitBreaker("test-osc", {
+    failureThreshold: 2, cooldownMs: 1000, successThreshold: 1,
+    onStateChange: function (e) { events.push(e); },
+  });
+  var late = [];
+  br.onStateChange(function (e) { late.push(e); });
+  for (var i = 0; i < 2; i++) {
+    try { await br.wrap(function () { throw new Error("boom"); }); } catch (_e) {}
+  }
+  check("breaker: onStateChange opt fired on closed→open", events.length === 1);
+  check("breaker: onStateChange payload carries name/from/to/at",
+        events[0] && events[0].name === "test-osc" && events[0].from === "closed" &&
+        events[0].to === "open" && typeof events[0].at === "number");
+  check("breaker: onStateChange(handler) registration also fired", late.length === 1);
+  // A non-function handler is refused at config time.
+  var threw = null;
+  try { new b.retry.CircuitBreaker("bad", { onStateChange: 42 }); } catch (e) { threw = e; }
+  check("breaker: non-function onStateChange throws", threw instanceof TypeError);
+}
+
 async function testBreakerOpenToHalfToClosed() {
   var br = new b.retry.CircuitBreaker("test-2", {
     failureThreshold: 2, cooldownMs: 30, successThreshold: 2,
@@ -517,6 +541,7 @@ async function run() {
   await testWithRetryValidatesOpts();
 
   await testBreakerClosedToOpen();
+  await testBreakerOnStateChange();
   await testBreakerOpenToHalfToClosed();
   await testBreakerHalfToOpenOnFailure();
   await testBreakerIgnoresPermanent();

package/lib/vendor/blamejs/test/smoke.js

@@ -472,6 +472,31 @@ function _checkChangelogInSync() {
   await _runLayer(5, path.join(__dirname, "50-integration.js"), "Layer 5");
 
   console.log("OK — " + helpers.getChecks() + " checks passed (" + (Date.now() - smokeStart) + "ms total)");
+
+  // Deterministic exit on success. The .catch() below exits 1 on
+  // failure; the success path historically fell through and relied on
+  // the event loop draining on its own. A lingering handle (a forked-
+  // child stdio pipe, a Layer-5 integration server whose socket did not
+  // fully close, an unref-missed timer) then keeps the process alive
+  // after the suite finished, burning the CI job's timeout budget until
+  // the runner cancels it — observed on the slow macos-latest runner
+  // (OK printed, ~3.5 min idle, job-timeout cancel). Reap it here: if
+  // anything still holds the loop open, name the handle kinds so a real
+  // resource leak surfaces in the log rather than being silently masked,
+  // then exit 0.
+  var _stdio = [process.stdout, process.stderr, process.stdin];
+  var _lingering = (typeof process._getActiveHandles === "function"
+    ? process._getActiveHandles() : []).filter(function (h) { return _stdio.indexOf(h) === -1; });
+  if (_lingering.length > 0) {
+    var _kinds = {};
+    _lingering.forEach(function (h) {
+      var name = (h && h.constructor && h.constructor.name) || typeof h;
+      _kinds[name] = (_kinds[name] || 0) + 1;
+    });
+    console.error("smoke: " + _lingering.length + " handle(s) still open after pass — forcing exit. kinds: " +
+      Object.keys(_kinds).map(function (k) { return k + "x" + _kinds[k]; }).join(", "));
+  }
+  process.exit(0);
 })().catch(function (err) {
   console.error("SMOKE TEST FAILED:", err.message);
   console.error(err.stack);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.2.12",
+  "version": "0.2.14",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {