@blamejs/blamejs-shop 0.2.13 → 0.2.14

package/lib/vendor/blamejs/lib/storage.js

@@ -833,10 +833,10 @@ function _requireInit() {
 //
 // Resumable-chunked-upload primitive. Operators handling large file
 // uploads (multipart form / tus / S3-multipart-style flow) need to
-// persist incoming chunks during the upload window, then assemble
-// them into a final file when the upload completes. Without a
-// framework primitive every consumer ended up reinventing the
-// per-assembly directory layout + atomic finalize + GC of partial
+// persist incoming chunks during the upload window, then concatenate
+// them in order when the upload completes. Without a framework
+// primitive every consumer ended up reinventing the per-assembly
+// directory layout + ordered gap-checked assembly + GC of partial
 // assemblies that never completed.
 //
 // chunkScratch owns:
@@ -844,8 +844,8 @@ function _requireInit() {
 //     storage backend just like saveFile)
 //   - chunk persistence + retrieval with the framework envelope
 //   - assembly metadata tracking createdAt/totalChunks/chunkHashes
-//   - atomic concat into the final file (no consumer ever sees a
-//     half-assembled file)
+//   - ordered, gap-checked concat returning the assembled bytes for
+//     the caller to persist (the primitive does not write a final file)
 //   - GC of stale partial assemblies (operator opts in via gc())
 //
 // Backend is the same `b.storage` backend the operator already
@@ -919,10 +919,11 @@ function _validateChunkIndex(idx) {
  * @related   b.storage.saveFile, b.storage.getFileBuffer
  *
  * Resumable-chunked-upload primitive. Persists incoming upload chunks
- * during the upload window + atomically assembles them into the
- * final file on completion. Owns per-assembly directory layout,
- * envelope-encrypted chunk persistence, atomic finalize, and GC of
- * partial assemblies.
+ * during the upload window, then concatenates them in order on
+ * completion and returns the assembled bytes for the caller to persist
+ * (the primitive does not itself write a final file). Owns per-assembly
+ * directory layout, envelope-encrypted chunk persistence, ordered
+ * gap-checked assembly, and GC of partial assemblies.
  *
  * Composes existing primitives: each chunk routes through
  * `b.storage.saveFile` (same XChaCha20-Poly1305 envelope as the
@@ -974,13 +975,16 @@ function _validateChunkIndex(idx) {
  *   b.storage.init({ backend: "local", uploadDir: "./data/uploads" });
  *   var cs = b.storage.chunkScratch({ rootKeyPrefix: "uploads/scratch" });
  *
- *   // During upload — each PUT lands one chunk
- *   await cs.saveChunk({ assemblyId: "upload-abc", chunkIndex: 0, data: chunk0 });
- *   await cs.saveChunk({ assemblyId: "upload-abc", chunkIndex: 1, data: chunk1 });
- *   await cs.saveChunk({ assemblyId: "upload-abc", chunkIndex: 2, data: chunk2 });
+ *   // During upload — each PUT lands one chunk. saveChunk returns the
+ *   // chunk's sealed encryptionKey; collect them in order for assemble.
+ *   var keys = [];
+ *   keys[0] = (await cs.saveChunk({ assemblyId: "upload-abc", chunkIndex: 0, data: chunk0 })).encryptionKey;
+ *   keys[1] = (await cs.saveChunk({ assemblyId: "upload-abc", chunkIndex: 1, data: chunk1 })).encryptionKey;
+ *   keys[2] = (await cs.saveChunk({ assemblyId: "upload-abc", chunkIndex: 2, data: chunk2 })).encryptionKey;
  *
- *   // On completion — atomic assemble + cleanup
- *   var assembled = await cs.assemble({ assemblyId: "upload-abc", expectedTotal: 3 });
+ *   // On completion — concat the chunks (in order) into the assembled
+ *   // buffer, then clean up. chunkEncryptionKeys is one key per chunk.
+ *   var assembled = await cs.assemble({ assemblyId: "upload-abc", expectedTotal: 3, chunkEncryptionKeys: keys });
  *   await cs.removeAssembly("upload-abc");
  *
  *   // Periodic GC of partial uploads abandoned mid-stream

package/lib/vendor/blamejs/lib/vault/index.js

@@ -625,6 +625,7 @@ module.exports = {
   getKeysJson:           getKeysJson,
   getCurrentPassphrase:  getCurrentPassphrase,
   getMode:               getMode,
+  isInitialized:         function () { return initialized; },
   VaultError:            VaultError,
   sealPemFile:           sealPemFileModule.sealPemFile,
   SealPemFileError:      sealPemFileModule.SealPemFileError,

package/lib/vendor/blamejs/lib/vault-aad.js

@@ -35,8 +35,8 @@
  *   .isAadSealed(value) → boolean
  *
  * Per the framework's security-first stance:
- *   - Symmetric key derivation uses HKDF-SHAKE256 (matching the
- *     vault's KDF) over the vault root key concatenated with the
+ *   - Symmetric key derivation uses SHAKE256 (matching the vault's
+ *     KDF) over the vault root key concatenated with the
  *     canonicalized AAD.
  *   - AEAD: XChaCha20-Poly1305 with the AAD threaded into the tag.
  *   - 24-byte nonce, generated fresh per-seal via

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.13.24",
+  "version": "0.13.32",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.13.25.json

@@ -0,0 +1,39 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.25",
+  "date": "2026-05-28",
+  "headline": "Agent idempotency results and orchestrator/tenant registry rows are sealed at rest",
+  "summary": "The b.agent.idempotency, b.agent.orchestrator, and b.agent.tenant primitives documented their stored rows as sealed at rest, but the values were written as plaintext JSON — a database dump could expose cached result payloads (which can carry mail-move / search data), the tenant ids that own each agent, and operator-supplied endpoint metadata. Those values are now sealed via b.cryptoField (XChaCha20-Poly1305 through the vault) before they reach the backing store and unsealed on read, when a vault is configured — which is the default in a booted app. Each ciphertext is AAD-bound to its row identity so a database-write attacker cannot copy a sealed value between rows. Reads of rows written before this release (plain JSON) continue to work unchanged, and a vault-less deployment stores rows as before. No API or call-site changes are required.",
+  "sections": [
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "Agent idempotency / orchestrator / tenant rows sealed at rest",
+          "body": "`b.agent.idempotency` cached result blobs, `b.agent.orchestrator` registry rows (owning tenant id + endpoint metadata), and `b.agent.tenant` registry-row metadata are now sealed via `b.cryptoField` when a vault is configured (the default in a booted app via `b.start`). The fields were previously stored as plaintext despite the docs describing them as sealed, so a DB dump exposed cached payloads, agent↔tenant ownership, and endpoint detail. Each sealed value is AAD-bound to the row identity (the idempotency key hash / the agent name / the tenant id), so a sealed value cannot be copied between rows. Rows written before this release remain readable (a non-sealed value passes through unseal), and a vault-less deployment behaves as before. No call-site changes."
+        }
+      ]
+    },
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "`b.agent.saga` run() return/throw shape documented correctly",
+          "body": "The doc said `run()` resolves to `{ status: \"failed\", failedStep, lastCompensationError }` on failure and to a bare final state. In fact it resolves to `{ status: \"completed\", sagaId, state }` on success and rejects (throws) on step failure with an error carrying `failedStep`, `cause`, `compensationCause`, and `failedCompStepName`. The docs now describe the actual contract."
+        },
+        {
+          "title": "`b.agent.idempotency` put() example uses the real option name",
+          "body": "The example passed `{ argsFingerprint: ... }`, which the function does not read; the fingerprint option is `requestFingerprint` (or `args`). The example now uses `requestFingerprint`."
+        },
+        {
+          "title": "`b.agent.tenant.derivedKey` @since corrected to 0.9.26",
+          "body": "It was tagged `@since 0.9.25`, a version before the tenant module existed; it ships in 0.9.26 alongside `b.agent.tenant.create`."
+        },
+        {
+          "title": "`b.agent.trace.injectIntoEnvelope` documented as single-argument",
+          "body": "The doc listed a second `currentSpan` argument the function ignores — it always injects the currently-active span's trace context. The doc now shows `injectIntoEnvelope(envelope)` and notes it should be called while the intended span is active."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.26.json

@@ -0,0 +1,31 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.26",
+  "date": "2026-05-28",
+  "headline": "`b.cryptoField.unsealRow` nulls a sealed column on unseal failure instead of returning the forged ciphertext",
+  "summary": "When a sealed column failed to unseal — a DB-write attacker's forged `vault:<…>` payload, or a valid ciphertext copied into a different row so the AAD no longer matches — unsealRow recorded the failure on the audit chain but then kept the original attacker-crafted string in the field rather than nulling it, despite the documented contract that downstream sees 'no value'. A write-back guard discarded the intended null on the failure path. The column is now nulled on any unseal failure, so a forged or cross-row-copied value never reaches downstream code as if it were a real plaintext. Valid values round-trip unchanged and genuinely-unsealed pass-through values are still kept. This hardens every sealed-column reader, including the agent idempotency / orchestrator / tenant rows sealed in 0.13.25.",
+  "sections": [
+    {
+      "heading": "Security",
+      "items": [
+        {
+          "title": "Sealed columns are nulled on unseal failure (forged / cross-row ciphertext)",
+          "body": "`b.cryptoField.unsealRow` now nulls a sealed field when its value fails to unseal — a crafted `vault:`/`vault.aad:` payload written by a DB-write attacker, or a valid ciphertext copied to a different row (AAD mismatch). Previously the field kept the attacker-controlled string, so downstream code could read the forged ciphertext as if it were the plaintext. The audit emit (`system.crypto.unseal_failed`) is unchanged. Valid round-trips and not-actually-sealed pass-through values are unaffected. A regression test pins the forged-value, cross-row-copy, and pass-through cases."
+        }
+      ]
+    },
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "Audit checkpoint docs name the actual signature algorithm",
+          "body": "`b.audit.checkpoint` / `b.audit.verifyCheckpoints` described the anchor signature as ML-DSA-87, but the checkpoint is signed with the configured `b.auditSign` algorithm — SLH-DSA-SHAKE-256f by default (ML-DSA-87 / ML-DSA-65 are opt-in). The docs and the verify-failure reason now refer to the post-quantum signature without naming a specific algorithm the operator may not be using."
+        },
+        {
+          "title": "`b.storage.chunkScratch` example and assembly description corrected",
+          "body": "The `assemble()` example omitted the mandatory `chunkEncryptionKeys` argument (one sealed key per chunk, returned by `saveChunk`), so it would have thrown as written; it now collects and passes the keys. The prose no longer claims the primitive writes a final file with an 'atomic finalize' — `assemble()` concatenates the chunks in order and returns the assembled bytes for the caller to persist."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.27.json

@@ -0,0 +1,34 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.27",
+  "date": "2026-05-28",
+  "headline": "Documentation corrected across api-encrypt, mail-crypto, mail-store, and calendar",
+  "summary": "A set of JSDoc corrections where the documented contract had drifted from the code. The most actionable: b.middleware.apiEncrypt's @opts named the keypair fields secretKey / ecSecretKey, but the middleware requires privateKey / ecPrivateKey (the shape b.crypto.generateEncryptionKeyPair returns), so a keypair built from the docs threw INVALID_KEYPAIR at construction; the same block documented a wrong custom-nonceStore interface and an example calling a non-existent b.crypto.keypair(). Also corrected: the b.mail.crypto facade and the PGP module described S/MIME sign/verify and PGP encrypt/decrypt/WKD as deferred when they ship and are live; b.mail.crypto.smime.checkCert documented a return shape whose field names did not match what it returns; and b.mailStore.create listed a destroy method it does not expose. No code behavior changed — only the docs were wrong.",
+  "sections": [
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "`b.middleware.apiEncrypt` options documented with the correct field names",
+          "body": "The `@opts` listed the keypair as `{ publicKey, secretKey, ecPublicKey, ecSecretKey }`, but the middleware requires `{ publicKey, privateKey, ecPublicKey, ecPrivateKey }` — the shape `b.crypto.generateEncryptionKeyPair()` returns — and threw `INVALID_KEYPAIR` for the documented shape. The custom `nonceStore` interface was documented as `{ has, add, prune }` but the middleware calls `{ checkAndInsert, purgeExpired, close }`, and the example called a non-existent `b.crypto.keypair()`. All three now match the implementation (`b.crypto.generateEncryptionKeyPair()`)."
+        },
+        {
+          "title": "`b.mail.crypto` S/MIME and PGP availability described accurately",
+          "body": "The `b.mail.crypto` facade said S/MIME `sign()` / `verify()` were deferred, and the PGP module's intro said in-process encrypt / decrypt and WKD discovery would 'ship in v0.10.14'. All of these are implemented and live (PGP encrypt/decrypt/WKD were promoted to the stable surface in v0.11.32; S/MIME sign/verify/verifyAll run on the `b.cms` substrate). The docs now describe them as available; the genuinely-deferred PGP v6-signature-packet support remains noted as deferred."
+        },
+        {
+          "title": "`b.mail.crypto.smime.checkCert` return shape documented correctly",
+          "body": "The doc and example described the result as `{ subjectCN, issuerCN, validFrom, validTo, keyAlg, keyBits, sigAlg }`; the function returns `{ subject, issuer, validFrom, validTo, sigAlgName, sigAlgOid, keyType, fingerprint256 }` (full DN strings, no key-size field). The documented shape now matches."
+        },
+        {
+          "title": "`b.mailStore.create` method list matches the returned handle",
+          "body": "The doc listed a `destroy` method the handle does not expose and omitted `search` / `moveMessages` / `hardExpunge` that it does. The list now reflects the actual methods."
+        },
+        {
+          "title": "Smaller doc corrections",
+          "body": "`b.calendar` fromIcal / toIcal / validate now document that they also handle Task (VTODO), Note (VJOURNAL), and Group, not just Event. `b.middleware.requireAuth`'s `prefersJson` default is documented as Accept / X-Requested-With only (Content-Type is intentionally not a signal, as the module already noted). The default CSP nonce is 24 base64 chars (16 bytes), not 22. `b.mail.bimi`'s returned `evidenceDocument` is noted as echoed from the operator-supplied option rather than pulled from the certificate."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.28.json

@@ -0,0 +1,30 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.28",
+  "date": "2026-05-28",
+  "headline": "Queue retry backoff now applies on the Redis backend; static-serve path-containment edge closed",
+  "summary": "Two behavioral fixes plus doc corrections. The Redis queue backend silently discarded the documented retry backoff: b.queue.consume passes the delay as `{ retryDelayMs }` (the shape the local backend reads), but the Redis backend's fail() accepted only a bare-number third argument, so the object failed its numeric check and the delay was forced to 0 — a failing job re-leased immediately instead of waiting 1s/2s/4s/…, a retry storm under failure. The Redis backend now accepts the object form, so the exponential backoff applies as documented (verified by an integration test against real Redis). Separately, b.router.serveStatic's path-containment check used a bare string prefix, so a sibling directory whose name extends the root (root `/srv/public` vs `/srv/public-evil`) could pass; it now anchors on a path separator. Also: b.fileUpload now surfaces (via an observability counter) when a configured content-safety gate is skipped because an upload streamed past the reassembly cap, and documents that boundary; and b.cookies.parse's example output is corrected.",
+  "sections": [
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "Redis queue backend honors the documented retry backoff",
+          "body": "`b.queue.consume` re-pends a failed job with deterministic exponential backoff (1s base, 5min cap) by calling the backend's `fail()` with `{ retryDelayMs }`. The Redis backend's `fail()` accepted only a bare-number third argument, so the object failed its `typeof === \"number\"` check and the delay was reset to 0 — a failing job became immediately re-leasable, hot-looping instead of backing off. `fail()` now accepts both the object form (as the local backend does) and a bare number, so the backoff applies on Redis. An integration test against real Redis pins it."
+        },
+        {
+          "title": "`b.router.serveStatic` path-containment anchors on a separator",
+          "body": "The containment check was `resolvedPath.startsWith(root)`, which a sibling directory sharing the root's name as a prefix (root `/srv/public` vs `/srv/public-evil`) could satisfy. It now requires the resolved path to equal `root` or start with `root + path.sep`, closing the sibling-prefix edge (`b.staticServe.create` remains the hardened serving path, with realpath + filename gating)."
+        },
+        {
+          "title": "`b.fileUpload` surfaces content-safety gate skips on oversized streamed uploads",
+          "body": "The byte-level content-safety gate inspects the reassembled buffer, so it runs on uploads up to `maxStreamReassemblyBytes` (default 64 MiB); a larger upload is handed to `onFinalize` as a stream and the byte-content gate is skipped (MIME-sniff and filename gates still run). That skip now emits a `fileUpload.content_safety_skipped_streamed` observability counter instead of passing silently, and the limit is documented. To guarantee content-gating of a type, cap `maxFileBytes` at or below `maxStreamReassemblyBytes`."
+        },
+        {
+          "title": "`b.cookies.parse` example output corrected",
+          "body": "The example claimed `theme=%22dark%22` parses to `theme: \"dark\"`, but quote-stripping runs before percent-decoding, so the literal quotes survive. The example now uses `theme=dark%20mode` → `theme: \"dark mode\"`, which demonstrates percent-decoding without the quote-strip-ordering quirk."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.29.json

@@ -0,0 +1,30 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.29",
+  "date": "2026-05-28",
+  "headline": "Doc corrections: AI Act disclosure kind values, SQS queue model, age-gate coupling",
+  "summary": "Documentation corrections. The most actionable: b.middleware.aiActDisclosure's @opts listed two EU AI Act transparency `kind` values (`deepfake` and `synthetic-content`) that the middleware does not accept, so they threw at construction; the accepted values use the hyphenated Art. 50 spellings (e.g. `deep-fake`) and include a text-public-interest variant the enum omitted — an operator copying the documented values crashed a compliance middleware at boot. The b.queue docs implied the SQS backend is driven by the generic b.queue.consume loop like local/redis; SQS is actually an SQS-native adapter (complete/fail by message receipt handle, server-side redrive) driven directly, and the docs now say so. b.middleware.ageGate's `requireAge` 451 floor is documented as taking effect only alongside `consentRequired` (it was silently inert without it). Plus a compose-pipeline @since and a flag-context @related correction. No code behavior changed.",
+  "sections": [
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "`b.middleware.aiActDisclosure` documents the accepted `kind` values",
+          "body": "The `@opts` listed `kind` as `ai-interaction | deepfake | emotion-recognition | biometric-categorisation | synthetic-content`. Two of those — `deepfake` and `synthetic-content` — are not accepted and threw at construction; the EU AI Act Art. 50 values use hyphenated spellings (e.g. `deep-fake`, the generated-content variant) and include `ai-text-public-interest`, which the documented enum omitted. The `@opts` now lists the full set the middleware accepts."
+        },
+        {
+          "title": "`b.queue` SQS backend documented as SQS-native, not consume-driven",
+          "body": "The module docs implied the `sqs` backend is interchangeable with `local`/`redis` under the generic `b.queue.consume` loop. SQS is an SQS-native adapter: `complete` / `fail` act on the message's `receiptHandle` (returned by `lease()`, threaded back by the caller), and DLQ + visibility-expiry are handled server-side by the queue's RedrivePolicy. The docs now state that `sqs` is driven directly (lease → handle → complete/fail) rather than by `b.queue.consume`, and does not use the framework DLQ / sweep."
+        },
+        {
+          "title": "`b.middleware.ageGate` documents the `requireAge` / `consentRequired` coupling",
+          "body": "`requireAge` (the HTTP 451 legal floor) is evaluated within the consent classification, so it takes effect only when `consentRequired` is also set — `requireAge` alone, with `consentRequired: null`, never classifies a request as below-threshold and the 451 never fires. The `@opts` and prose now state this coupling instead of presenting `requireAge` as a standalone threshold."
+        },
+        {
+          "title": "Smaller doc corrections",
+          "body": "`b.middleware.composePipeline`'s `@since` is corrected to 0.9.43 (its actual ship version). `b.middleware.flagContext`'s `@related` pointed at a non-existent `b.flagClient.getBoolean`; it now references `b.flag.create`."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.30.json

@@ -0,0 +1,30 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.30",
+  "date": "2026-05-28",
+  "headline": "Doc corrections in the safe-* parsers (defaults, an error code, an example, a status list)",
+  "summary": "Four documentation corrections in the safe-* input parsers; no code behavior changed. The parsers' enforced limits and controls are unchanged — these align the docs with what the code already does. b.safeMime.parse's documented default transfer-encoding allowlist listed `binary`, which is excluded by default (opt-in per RFC 3030 BINARYMIME). b.safeDecompress documented a refusal code (`output-too-large`) it never emits — an absolute-size bomb surfaces under `decompress-failed`. b.safeSmtp.findDotTerminator's example output was off by one. b.safeIcap's intro status-code summary omitted 404 / 405 / 408 (the detailed block already listed them).",
+  "sections": [
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "`b.safeMime.parse` documents the actual default transfer-encoding allowlist",
+          "body": "The `@opts` default listed `7bit/8bit/binary/qp/base64`, but `binary` is deliberately excluded by default (RFC 3030 BINARYMIME is opt-in); the default is `7bit/8bit/quoted-printable/base64`. The doc now matches, so operators don't expect inbound `Content-Transfer-Encoding: binary` parts to pass without opting in."
+        },
+        {
+          "title": "`b.safeDecompress` names the real absolute-size-bomb refusal code",
+          "body": "The refusal-posture list documented `safe-decompress/output-too-large` for a bomb-by-absolute-size, but that code is never emitted — zlib's `maxOutputLength` throws before allocation and the failure surfaces as `safe-decompress/decompress-failed`. The doc now names the code an operator branching on the result will actually see (the ratio, output-byte, and compressed-input caps are unchanged and enforced)."
+        },
+        {
+          "title": "`b.safeSmtp.findDotTerminator` example output corrected",
+          "body": "The example claimed the `\\r\\n.\\r\\n` terminator in `\"Hello world.\\r\\n.\\r\\n\"` is at index 13; it is at index 12. The example now shows 12 (the implementation was already correct)."
+        },
+        {
+          "title": "`b.safeIcap` intro status-code summary lists 404 / 405 / 408",
+          "body": "The intro summary said only `100 / 200 / 204 / 400 / 403 / 5xx` are honored, but the parser also accepts `404 / 405 / 408` (legitimate RFC 3507 §4.3.3 codes, already listed in the detailed `parse` block). The intro summary now matches."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.31.json

@@ -0,0 +1,26 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.31",
+  "date": "2026-05-28",
+  "headline": "Circuit-breaker onStateChange callback now fires; mcp / vault-aad doc corrections",
+  "summary": "b.circuitBreaker documented an `onStateChange` callback (both an option and an `onStateChange(handler)` registration method) plus a state-change payload, but the callback was never invoked — only an observability event fired. The callback is now implemented: it fires on every transition with `{ name, from, to, at }`, the registration method works, and a non-function handler is rejected at construction. The same primitive's docs are corrected to name the real accessor (`getState()`, not `state()`) and drop a never-read `audit` option. Plus two doc-only corrections: b.mcp.toolResult.sanitize described composing b.guardHtml / b.ai.input.classify (it uses built-in detection) and documented a `classifyInput` option it never read; and b.vault.aad's prose said HKDF-SHAKE256 where the derivation is SHAKE256 (the AEAD AAD-binding itself is unchanged and sound).",
+  "sections": [
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "`b.circuitBreaker` onStateChange callback is invoked on every transition",
+          "body": "The `onStateChange` option and the `onStateChange(handler)` registration method are now wired: each registered handler is called with `{ name, from, to, at }` on every state transition (closed→open, open→half, half→closed/open), alongside the existing `breaker.state.change` observability event. A non-function `onStateChange` is rejected at construction. Previously the documented callback never fired. The docs are also corrected to name the real state accessor `getState()` (there is a `state` property, so `state()` was never a method) and to drop a never-read `audit` option."
+        },
+        {
+          "title": "`b.mcp.toolResult.sanitize` documents its actual detection and options",
+          "body": "The prose said the sanitizer composes `b.guardHtml`'s strict profile and `b.ai.input.classify`; it uses built-in dangerous-HTML and prompt-injection-marker detection. The `@opts` also listed a `classifyInput` override the function never read. The prose now describes the built-in detection and the unwired `classifyInput` option is removed. The fail-closed refusal behavior (default `posture: \"refuse\"`) is unchanged."
+        },
+        {
+          "title": "`b.vault.aad` derivation named correctly (SHAKE256)",
+          "body": "The module prose described the per-binding key derivation as HKDF-SHAKE256; it is SHAKE256 over the vault root concatenated with the binding inputs (no HKDF extract/expand). The AEAD AAD-binding to (table, row, column, schema version) — the file's actual security guarantee — is unchanged and sound; only the KDF name in the doc was wrong."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.32.json

@@ -0,0 +1,34 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.32",
+  "date": "2026-05-28",
+  "headline": "`b.auditDailyReview` enforces notify under the sox-404 posture; compliance doc corrections",
+  "summary": "b.auditDailyReview documented `sox-404` (SOX §404 ICFR — the internal-controls regime this primitive serves) as one of the postures that make a `notify` callback mandatory at construction, but the enforcement set used only `sox`, so pinning `posture: \"sox-404\"` without a notify channel was silently accepted. `sox-404` is now in the mandatory-notify set, so the advertised guarantee holds (a regression test pins it). The rest are documentation corrections with no behavior change: b.compliance.posturesByDomain / posturesByJurisdiction examples showed small fixed arrays where the functions return every matching posture (the catalog has grown); b.dataAct's surface list named two methods that do not exist (the real surface is declareProduct / recordUserAccess / shareWithThirdParty / recordSwitchRequest, with gatekeeper refusal folded into shareWithThirdParty); b.secCyber.eightKArtifact's documented return key `audit` is actually `deadlineBusinessDays`; and b.compliance.aiAct.transparency's helper summary named `cspMetaTag` / a `watermark({ kind })` argument that are really `metaTags` / `watermark({ mediaKind })`.",
+  "sections": [
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "`b.auditDailyReview` requires a notify channel under the `sox-404` posture",
+          "body": "The docs listed `sox-404` among the postures that make a `notify` callback mandatory at create-time, but the enforcement set contained only `sox` — so `posture: \"sox-404\"` without `notify` was accepted instead of refused. `sox-404` (SOX §404 ICFR) is now in the mandatory-notify set, matching the documented guarantee; constructing without a notify channel under it throws `auditDailyReview/notify-required-under-posture`."
+        },
+        {
+          "title": "`b.compliance` jurisdiction/domain lister examples no longer enumerate a stale fixed set",
+          "body": "`posturesByDomain` and `posturesByJurisdiction` return every posture matching the domain/jurisdiction, but their `@example`s showed small fixed arrays from before the posture catalog grew. The examples now show a representative prefix with `...` and note they return the full matching set."
+        },
+        {
+          "title": "`b.dataAct` surface list matches the real methods",
+          "body": "The module surface listed `userAccessible(...)` and `refuseGatekeeper(...)`, neither of which exists. The real surface is `declareProduct` / `recordUserAccess` / `shareWithThirdParty` / `recordSwitchRequest`, and DMA-gatekeeper refusal (Art 32 §1) is enforced inside `shareWithThirdParty`. The doc now reflects that."
+        },
+        {
+          "title": "`b.secCyber.eightKArtifact` documented return shape corrected",
+          "body": "The signature line showed `{ artifact, deadline, audit }`; the function returns `{ artifact, deadline, deadlineBusinessDays }` (there is no `audit` key). The doc now matches."
+        },
+        {
+          "title": "`b.compliance.aiAct.transparency` helper names corrected",
+          "body": "The helper summary named a `cspMetaTag(...)` function and a `watermark({ kind })` argument; the real names are `metaTags(...)` and `watermark({ mediaKind })`. Calling the documented names threw. Also corrected: a `b.aiAdverseDecision` illustration showed an ECOA `statutoryDeadlines` shape that didn't match the regime's actual deadlines."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/20-db.js

@@ -427,11 +427,41 @@ async function testCrossSchemaAttach() {
   }
 }
 
+async function testUnsealRowNullsForgedValue() {
+  // Security regression (CRYPTO-1): an unseal failure — a DB-write
+  // attacker's forged `vault:<…>` payload, or a valid ciphertext copied
+  // to a different row (AAD mismatch) — must NULL the column so
+  // downstream sees "no value", not the attacker-crafted string. A prior
+  // `unsealed ? unsealed : out[field]` write-back silently kept the
+  // forged value on failure, defeating the documented defense.
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-cf-forged-"));
+  try {
+    await setupTestDb(tmpDir);
+    b.cryptoField.registerTable("cf_forged_regress", {
+      sealedFields: ["secret"], aad: true, rowIdField: "id",
+    });
+    var sealed = b.cryptoField.sealRow("cf_forged_regress", { id: "r1", secret: "hello" });
+    check("cryptoField valid round-trip",
+      b.cryptoField.unsealRow("cf_forged_regress", sealed).secret === "hello");
+    var forged = b.cryptoField.unsealRow("cf_forged_regress",
+      { id: "r1", secret: "vault.aad:Zm9yZ2VkLWdhcmJhZ2U=" });
+    check("forged sealed value nulls the field (not kept)", forged.secret === null);
+    var crossRow = b.cryptoField.unsealRow("cf_forged_regress",
+      { id: "DIFFERENT-ROW", secret: sealed.secret });
+    check("cross-row-copied ciphertext nulls the field (AAD mismatch)", crossRow.secret === null);
+    var plain = b.cryptoField.unsealRow("cf_forged_regress", { id: "r2", secret: "not-sealed" });
+    check("non-sealed pass-through value is kept", plain.secret === "not-sealed");
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
 // ---- run() ----
 
 async function run() {
   // db basic
   await testDbBasic();
+  await testUnsealRowNullsForgedValue();
   await testDbWriteOps();
   await testDbSealedWithoutDerived();
   await testDbTransactions();

package/lib/vendor/blamejs/test/integration/queue-redis.test.js

@@ -152,6 +152,20 @@ async function run() {
           lease3b[0].attempts === 2);  // sweep doesn't re-increment; lease does
     await qr.complete(enq3.jobId);
 
+    // ---- fail() honors the object-form { retryDelayMs } b.queue.consume
+    //      passes (regression: the redis backend previously accepted only
+    //      a bare-number 3rd arg, so the object failed the typeof check
+    //      and the delay was forced to 0 — the documented exponential
+    //      backoff was silently discarded and the job re-leased at once) ----
+    var QB = "retry-backoff";
+    var enqB = await qr.enqueue(QB, { go: 1 }, { maxAttempts: 5 });
+    var leaseB = await qr.lease(QB, 5000, 1);
+    check("lease: backoff-regression job leased", leaseB.length === 1);
+    await qr.fail(enqB.jobId, "boom", { retryDelayMs: 60000 });  // object form, 60s delay
+    var leaseBNow = await qr.lease(QB, 5000, 1);
+    check("fail({retryDelayMs}) delays re-lease — backoff honored, not forced to 0",
+          leaseBNow.length === 0);
+
     // ---- fail + retry path ----
     var Q4 = "retry";
     var enq4 = await qr.enqueue(Q4, { go: 1 }, { maxAttempts: 2 });

package/lib/vendor/blamejs/test/layer-0-primitives/agent-idempotency.test.js

@@ -235,8 +235,45 @@ async function testReplayCountAtomic() {
     (r1.replayCount === 2 && r2.replayCount === 1));
 }
 
+async function testAtRestSealingWithVault() {
+  // The cached result is sealed at rest via b.cryptoField when a vault
+  // is configured. Init a vault, capture what actually lands in the
+  // backend, and assert the sensitive payload is not stored in the
+  // clear — then confirm it round-trips. Reset the vault afterwards so
+  // the remaining (vault-less) tests run in their expected mode.
+  var os   = require("node:os");
+  var path = require("node:path");
+  var fs   = require("node:fs");
+  var dir  = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-idem-seal-"));
+  check("vault.isInitialized() is false before init", b.vault.isInitialized() === false);
+  await b.vault.init({ mode: "plaintext", dataDir: dir });
+  try {
+    check("vault.isInitialized() is true after init", b.vault.isInitialized() === true);
+    var SECRET = "patient-PII-9007199254740993";
+    var captured = null;
+    var backend = {
+      _m: Object.create(null),
+      async get(m, a, h) { return this._m[m + a + h] || null; },
+      async put(m, a, h, row) { this._m[m + a + h] = row; captured = row; },
+      async delete(m, a, h) { delete this._m[m + a + h]; },
+    };
+    var idem = b.agent.idempotency.create({ store: backend });
+    await idem.put("move", "u-seal", "jmap-seal-1", { payload: SECRET });
+    check("at-rest: result blob is sealed (no plaintext leak)",
+      typeof captured.resultBlob === "string" && captured.resultBlob.indexOf(SECRET) === -1);
+    check("at-rest: sealed blob carries a vault prefix",
+      /^vault(\.aad)?:/.test(String(captured.resultBlob)));
+    var hit = await idem.get("move", "u-seal", "jmap-seal-1");
+    check("at-rest: sealed result round-trips to plaintext",
+      hit && hit.result && hit.result.payload === SECRET);
+  } finally {
+    b.vault._resetForTest();
+  }
+}
+
 async function run() {
   testSurface();
+  await testAtRestSealingWithVault();
   await testBasicGetPut();
   await testCrossActorIsolation();
   await testCrossMethodIsolation();

package/lib/vendor/blamejs/test/layer-0-primitives/agent-orchestrator.test.js

@@ -361,6 +361,42 @@ async function testShardForSaltedFnv() {
     Object.keys(spread).length >= 4);
 }
 
+async function testRegistryRowSealedAtRest() {
+  // Registry rows seal tenantId + endpoint metadata at rest via
+  // b.cryptoField when a vault is configured. Scope a vault around this
+  // one test (the other tests intentionally run vault-less to exercise
+  // the salted-FNV fallback), capture what lands in the backend, and
+  // assert the sensitive fields are not stored in the clear — then
+  // confirm the tenantId filter still resolves through unseal.
+  var os   = require("node:os");
+  var path = require("node:path");
+  var fs   = require("node:fs");
+  var dir  = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-orch-seal-"));
+  await helpers.setupVaultOnly(dir);
+  try {
+    var captured = null;
+    var backend = {
+      _m: Object.create(null),
+      async get(n) { return this._m[n] || null; },
+      async set(n, row) { this._m[n] = row; if (n === "svc-seal") captured = row; },
+      async delete(n) { delete this._m[n]; },
+      async list() { return Object.values(this._m); },
+    };
+    var orch = b.agent.orchestrator.create({ backend: backend });
+    await orch.register("svc-seal", { kind: "mail", handle: function () {} },
+      { agentKind: "mail", tenantId: "acme-corp", metadata: { endpoint: "https://internal-host:9000" } });
+    check("orch at-rest: tenantId sealed (no plaintext leak)",
+      typeof captured.tenantId === "string" && captured.tenantId.indexOf("acme-corp") === -1);
+    check("orch at-rest: metadata sealed (no endpoint leak)",
+      typeof captured.metadata === "string" && captured.metadata.indexOf("internal-host") === -1);
+    var listed = await orch.list({ tenantId: "acme-corp" });
+    check("orch at-rest: tenantId filter resolves through unseal",
+      listed.length === 1 && listed[0].name === "svc-seal" && listed[0].tenantId === "acme-corp");
+  } finally {
+    helpers.teardownVaultOnly(dir);
+  }
+}
+
 async function run() {
   testSurface();
   await testRegisterLookupUnregister();
@@ -381,6 +417,7 @@ async function run() {
   await testHealth();
   await testStreamRegistry();
   await testPermissions();
+  await testRegistryRowSealedAtRest();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/agent-tenant.test.js

@@ -268,12 +268,38 @@ async function testUnsealRowAuditsOnDecryptRefusal() {
   check("BUG-4: audit emitted on cross-tenant null", saw);
 }
 
+async function testRegistryMetadataSealedAtRest() {
+  // The registry row's metadata is sealed at rest via b.cryptoField when
+  // a vault is configured (it is, in this file's run()). Capture what
+  // lands in the backend and assert the sensitive metadata is not stored
+  // in the clear, then confirm lookup round-trips it back to an object.
+  var SECRET = "tenant-billing-id-XQ42";
+  var captured = null;
+  var backend = {
+    _m: Object.create(null),
+    async get(k) { return this._m[k] || null; },
+    async set(k, row) { this._m[k] = row; if (k === "acme-seal") captured = row; },
+    async delete(k) { delete this._m[k]; },
+    async list() { return Object.values(this._m); },
+  };
+  var tn = b.agent.tenant.create({ backend: backend });
+  await tn.register("acme-seal", { posture: "hipaa", metadata: { billingId: SECRET } });
+  check("tenant at-rest: metadata sealed (no plaintext leak)",
+    typeof captured.metadata === "string" && captured.metadata.indexOf(SECRET) === -1);
+  check("tenant at-rest: sealed metadata carries a vault prefix",
+    /^vault(\.aad)?:/.test(String(captured.metadata)));
+  var cfg = await tn.lookup("acme-seal");
+  check("tenant at-rest: metadata round-trips to an object",
+    cfg && cfg.metadata && cfg.metadata.billingId === SECRET);
+}
+
 async function run() {
   var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-vault-"));
   global._testVaultDir = tmpDir;
   await helpers.setupVaultOnly(tmpDir);
   try {
     testSurface();
+    await testRegistryMetadataSealedAtRest();
     await testRegisterLookupUnregister();
     await testCheckCrossTenant();
     await testCrossTenantAdminScope();

package/lib/vendor/blamejs/test/layer-0-primitives/audit-daily-review.test.js

@@ -82,6 +82,15 @@ function testPostureRequiresNotify() {
   } catch (e) { threw = e; }
   check("pci-dss posture without notify throws",
         threw && /notify-required-under-posture/.test(threw.code || ""));
+
+  // sox-404 (SOX §404 ICFR — the audit/internal-controls regime this
+  // primitive serves) is an advertised notify-required posture too.
+  var threw404 = null;
+  try {
+    b.auditDailyReview.create({ audit: _fakeAudit([]), posture: "sox-404" });
+  } catch (e) { threw404 = e; }
+  check("sox-404 posture without notify throws",
+        threw404 && /notify-required-under-posture/.test(threw404.code || ""));
 }
 
 function testBadSeverity() {