@blamejs/blamejs-shop 0.3.11 → 0.3.13

package/lib/vendor/blamejs/lib/agent-saga.js

@@ -58,8 +58,7 @@
  *
  *   ## No saga-level retry
  *
- *   Per the substrate playbook decision (operator-confirmed
- *   2026-05-14): saga's value-add is compensation, not retry. If a
+ *   Saga's value-add is compensation, not retry. If a
  *   step needs retry-with-backoff, the operator wraps `step.run`
  *   with `b.retry` inside the step body. With v0.9.22 idempotency
  *   available, internal retry inside step.run is side-effect-safe.
@@ -109,7 +108,7 @@ var SAGA_ID_RAND_BYTES = 8;
 function create(config) {
   guardSagaConfig.validate(config);
   var auditImpl = config.audit || audit();
-  // SUBSTRATE-7 — operator wires a stateStore for crash-safe resume.
+  // Operator wires a stateStore for crash-safe resume.
   // Interface: { saveStep, loadResumePoint, markCompleted, markFailed }.
   // saveStep({sagaId, stepIndex, stepName, state, status}) commits
   // after each step.run; loadResumePoint(sagaId) returns the resume
@@ -189,7 +188,7 @@ async function _runFrom(config, auditImpl, stateStore, ctx, state, opts, sagaId,
       });
       await step.run(ctx, state);
       completedSteps.push({ step: step, index: i });
-      // SUBSTRATE-7 — checkpoint after the step.run returns. saveStep
+      // Checkpoint after the step.run returns. saveStep
       // commits the post-step state so a crash before the NEXT step
       // resumes from i+1. The audit chain records the checkpoint
       // independently of the operator's stateStore — operator can
@@ -232,7 +231,7 @@ async function _runFrom(config, auditImpl, stateStore, ctx, state, opts, sagaId,
         message: (stepErr && stepErr.message) || String(stepErr),
       });
       var compensationError = null;
-      // BUG-5 — capture the compensation step that ACTUALLY failed,
+      // Capture the compensation step that ACTUALLY failed,
       // not "completedSteps[completedSteps.length-1].name" which
       // names the last-COMPLETED step regardless of which compensation
       // threw. CWE-209-adjacent (information disclosure via wrong
@@ -278,7 +277,7 @@ async function _runFrom(config, auditImpl, stateStore, ctx, state, opts, sagaId,
           });
         } catch (_e) { /* drop-silent — audit already records */ }
       }
-      // SUBSTRATE-15 — attach cause:stepErr so the original step
+      // Attach cause:stepErr so the original step
       // error stack survives. ES2022 Error.cause is the standard
       // mechanism; the framework's defineClass-built AgentSagaError
       // accepts cause via the third arg.
@@ -290,7 +289,7 @@ async function _runFrom(config, auditImpl, stateStore, ctx, state, opts, sagaId,
                      ((compensationError.message) || String(compensationError));
       }
       var sagaErr = new AgentSagaError("agent-saga/failed", detailMsg);
-      // SUBSTRATE-15 — ES2022 Error.cause attaches the originating
+      // ES2022 Error.cause attaches the originating
       // stepErr so operator stack-trace tooling can walk the chain.
       // defineClass({alwaysPermanent:true}) doesn't accept cause in
       // its constructor signature; the property assignment after

package/lib/vendor/blamejs/lib/agent-snapshot.js

@@ -60,7 +60,7 @@ var vault                 = lazyRequire(function () { return require("./vault");
 
 var AgentSnapshotError = defineClass("AgentSnapshotError", { alwaysPermanent: true });
 
-// SUBSTRATE-2 — sealed envelopes start with this prefix on disk; the
+// Sealed envelopes start with this prefix on disk; the
 // loader sniffs it and routes through unseal before guardSnapshotEnvelope
 // validation. Compatible with operator backends that store the value
 // as a string (JSON DBs, k/v stores) or wrap it in `{ value: "..." }`.
@@ -113,19 +113,19 @@ function create(opts) {
   var snapshotIntervalMs = typeof policy.snapshotIntervalMs === "number" ? policy.snapshotIntervalMs : DEFAULT_SNAPSHOT_INTERVAL_MS;
   var maxSnapshotBytes   = typeof policy.maxSnapshotBytes === "number" ? policy.maxSnapshotBytes : DEFAULT_MAX_SNAPSHOT_BYTES;
   var auditImpl = opts.audit || audit();
-  // SUBSTRATE-1 — operator may inject `signer` (interface
+  // Operator may inject `signer` (interface
   // `{ sign(bytes) → Buffer, verify(bytes, sig, pubKey?) → boolean }`)
   // for testing / alternate key custody. Default = b.auditSign when
   // initialized at boot; refuses persist() with a clear error if
   // neither is wired so secure-by-default holds.
   var signer = opts.signer || null;
-  // SUBSTRATE-2 — operator may inject `sealer` (interface
+  // Operator may inject `sealer` (interface
   // `{ seal(plaintext, aadParts) → string, unseal(value, aadParts) → string }`)
   // for alternate KMS integration. Default = b.vault.aad. Refused if
   // neither is wired AND opts.allowPlaintext is not explicitly true
   // (operator-justified dev / single-tenant deployments only).
   var sealer = opts.sealer || null;
-  // SUBSTRATE-18 — operator-supplied restoreHandlers walk the
+  // Operator-supplied restoreHandlers walk the
   // snapshot inFlight + idempotencyCache + orchestratorState segments
   // and hydrate the corresponding consumer module. Map shape:
   //   { streams, sagas, outboxJobs, busSubscribers, pendingDeliveries,
@@ -300,7 +300,7 @@ async function _takeSnapshot(ctx, snapshotOpts) {
 
 async function _persist(ctx, snap) {
   guardSnapshotEnvelope.validate(snap);
-  // SUBSTRATE-1 — sign first so a backend that mutates on put() (very
+  // Sign first so a backend that mutates on put() (very
   // common for k/v stores adding metadata) doesn't poison the signed
   // bytes downstream readers verify.
   var signer = _resolveSigner(ctx);
@@ -314,7 +314,7 @@ async function _persist(ctx, snap) {
   // pubkey at verify time).
   snap.sigPubKey = (typeof signer.getPublicKey === "function" && signer.getPublicKey()) || null;
 
-  // SUBSTRATE-2 — seal the entire envelope under AAD that pins
+  // Seal the entire envelope under AAD that pins
   // snapshotId + schemaVersion + tenantId. AAD mismatch on unseal (a
   // copy-paste attack from one snapshotId's row into another) fails
   // the Poly1305 tag check; tampered bytes also fail. The sealed
@@ -405,7 +405,7 @@ async function _unwrapAndVerify(ctx, raw, expectedId) {
     throw new AgentSnapshotError("agent-snapshot/snapshot-id-mismatch",
       "load: wrapper snapshotId='" + expectedId + "' does not match envelope='" + snap.snapshotId + "'");
   }
-  // SUBSTRATE-1 — verify the signature before returning the envelope
+  // Verify the signature before returning the envelope
   // to the caller. Restore-side trust derives from this gate. The
   // allowPlaintext escape hatch (operator-acknowledged dev mode)
   // also waives signature verification because there's no key custody
@@ -496,7 +496,7 @@ async function _restore(ctx, snap, restoreOpts) {
       affectedStreams:       (snap.inFlight && snap.inFlight.streams || []).length,
     });
   }
-  // SUBSTRATE-18 — invoke operator-supplied restoreHandlers across
+  // Invoke operator-supplied restoreHandlers across
   // every segment the snapshot envelope carries. Handlers are
   // declared at create() time; the snapshot primitive owns ordering
   // (orchestratorState first so live agents register before consumers

package/lib/vendor/blamejs/lib/agent-stream.js

@@ -138,7 +138,7 @@ function _makeIterator(ctx) {
   var done       = false;
   var closed     = false;
   var drained    = false;
-  // SUBSTRATE-14 — track the cursor of the LAST row actually yielded
+  // Track the cursor of the LAST row actually yielded
   // to the consumer. The prior shape called cursor.lastSeenCursor()
   // at drain-marker emit, which returned the position of the last
   // FETCHED batch — clients resuming from that cursor SKIPPED every
@@ -167,7 +167,7 @@ function _makeIterator(ctx) {
       try {
         if (buffer.length > 0) {
           var row = buffer.shift();
-          // SUBSTRATE-14 — record the cursor for this yielded row so a
+          // Record the cursor for this yielded row so a
           // drain that fires BETWEEN buffered yields emits a marker
           // whose lastSeenCursor matches what the client actually
           // received. The cursor extraction shape mirrors the
@@ -248,7 +248,7 @@ function _safeAudit(auditImpl, action, actor, metadata) {
   agentAudit.safeAudit(auditImpl, action, actor, metadata);
 }
 
-// SUBSTRATE-14 — resolve the resume cursor for a row about to be
+// Resolve the resume cursor for a row about to be
 // yielded. Operators may attach the cursor per-row (`row._cursor` /
 // `row.cursor`) OR rely on the cursor's own per-row tracker
 // (`cursor.cursorForRow(row)`) — both shapes supported.

package/lib/vendor/blamejs/lib/agent-tenant.js

@@ -222,7 +222,7 @@ async function _unregister(ctx, tenantId, args) {
   }
   // Archive default — retain the key + metadata for retention-mandated
   // restoration. Operator's compliance regime drives archivePolicy.
-  // SUBSTRATE-19 — persist as a `status: "archived"` row in the same
+  // Persist as a `status: "archived"` row in the same
   // backend rather than only the process-local Map. GDPR Art. 17 +
   // HIPAA §164.530(j) require the archived state to survive process
   // restart (auditor pulls a deleted tenant's archival record years
@@ -373,7 +373,7 @@ function _check(ctx, actor, agentTenantId) {
 
 // ---- Per-tenant derived key -----------------------------------------------
 //
-// SUBSTRATE-5 — `namespaceHash(label, tenantId)` is a PUBLIC function
+// `namespaceHash(label, tenantId)` is a PUBLIC function
 // over PUBLIC inputs; an attacker who learns `tenantId` (an account id
 // surfaced in URLs / API responses) reconstructs every per-tenant key
 // without any secret material. The defense the docstring promises —
@@ -555,7 +555,7 @@ var TENANT_FIELD_PREFIX = "tnt-v1:";
 function _tenantFieldKey(tenantId, table) {
   // 32-byte symmetric key for XChaCha20-Poly1305. _deriveTenantKeyBytes
   // returns the raw key bound to the vault master + tenantId + purpose
-  // — see SUBSTRATE-5 commentary above _derivedKey for the threat
+  // — see the commentary above _derivedKey for the threat
   // model that drove this away from public-input-only derivation.
   return _deriveTenantKeyBytes(tenantId, "cryptoField:" + table);
 }
@@ -646,7 +646,7 @@ function _unsealRowForTenant(ctx, tenantId, table, row) {
     if (out[f] !== undefined && out[f] !== null) {
       try { out[f] = _unsealField(tenantId, table, f, out[f]); }
       catch (e) {
-        // BUG-4 — null-on-decrypt-failure was silent; the docstring
+        // Null-on-decrypt-failure was silent; the docstring
         // promised "audit chain surfaces the failure" but no emit ever
         // ran. Cross-tenant ciphertext replay / tampered row / wrong-
         // prefix all hit this path; operator audit pipelines need the

package/lib/vendor/blamejs/lib/agent-trace.js

@@ -70,7 +70,7 @@ var audit              = lazyRequire(function () { return require("./audit"); })
 
 var AgentTraceError = defineClass("AgentTraceError", { alwaysPermanent: true });
 
-// SUBSTRATE-24 — once-per-process audit emit on the first tracer
+// Once-per-process audit emit on the first tracer
 // failure each install fires. Operators get the signal even when
 // individual span calls are best-effort suppressed.
 var _failureAuditEmittedFor = Object.create(null);
@@ -122,7 +122,7 @@ function create(opts) {
     injectIntoEnvelope:  function (envelope, span)          { return _injectIntoEnvelope(opts.tracing, envelope, span); },
     extractFromEnvelope: function (envelope)                { return _extractFromEnvelope(envelope); },
     recordResult:        function (span, result, error)     { return _recordResult(span, result, error, auditImpl); },
-    // SUBSTRATE-17 — `shouldSample` now takes a traceId so the same
+    // `shouldSample` now takes a traceId so the same
     // trace gets the same decision across hops. Operator-supplied
     // traceId comes from the W3C `traceparent` header at request-
     // entry; absent that, falls back to Math.random (start of trace).
@@ -150,7 +150,7 @@ function _startSpan(tracing, name, sopts, auditImpl) {
       return tracing.startSpan(name, sopts);
     }
   } catch (e) {
-    // SUBSTRATE-24 — tracer failures should not crash the agent's
+    // Tracer failures should not crash the agent's
     // method call; surface the first failure to the audit chain
     // (rate-limited) so operators get the signal.
     _emitFirstFailureAudit(auditImpl, "startSpan", e && e.message);
@@ -206,7 +206,7 @@ function _extractFromEnvelope(envelope) {
 
 function _recordResult(span, result, error, auditImpl) {
   if (!span || typeof span !== "object") return;
-  // SUBSTRATE-24 — surface first occurrence of each span-op failure
+  // Surface first occurrence of each span-op failure
   // via audit so the operator gets the signal. Subsequent failures
   // stay silent (best-effort) per the operational spec.
   if (error) {
@@ -228,7 +228,7 @@ function _recordResult(span, result, error, auditImpl) {
   }
 }
 
-// SUBSTRATE-17 — deterministic sampling per W3C Trace Context §3.2.3.1.
+// Deterministic sampling per W3C Trace Context §3.2.3.1.
 // `Math.random` makes child-vs-parent sampling decisions non-coherent:
 // a parent span sampled OUT can still have child spans sampled IN,
 // producing orphaned spans operators can't correlate. Hashing the

package/lib/vendor/blamejs/lib/ai-disclosure.js

@@ -133,7 +133,7 @@ function chatbot(session, opts) {
   var text = typeof opts.text === "string" && opts.text.length > 0
     ? opts.text
     : DEFAULT_CHATBOT_TEXT;
-  // Codex P1A on v0.12.12 PR #163 — "on-request" placement gates on
+  // "on-request" placement gates on
   // the operator's explicit `opts.requested: true` signal. Without
   // it, "on-request" collapsed into "always" semantics and emitted
   // every call. The operator wires this from an explicit user
@@ -155,7 +155,7 @@ function chatbot(session, opts) {
     regulation:     "Regulation (EU) 2024/1689",
   };
   if (shouldEmit) {
-    // Codex P1B on v0.12.12 PR #163 — mark the session so subsequent
+    // Mark the session so subsequent
     // calls with the same session under "first-message" placement
     // see `aiDisclosureEmitted: true` and return shouldEmit=false.
     // Without this mutation operators had to remember to flip the
@@ -385,7 +385,7 @@ function applyAll(scenario) {
       "applyAll: scenario.kinds must be a non-empty array of " +
       "\"chatbot\" / \"deepfake\" / \"emotion\"");
   }
-  // Codex P1 on v0.12.25 PR #176 — validate every kind +
+  // Validate every kind +
   // per-kind required field UP FRONT, before any emission.
   // Previously a later-kind failure (e.g. deepfake missing
   // contentType, unknown trailing kind) ran AFTER earlier kinds

package/lib/vendor/blamejs/lib/app.js

@@ -113,7 +113,7 @@ function _resolveMiddlewareOpt(value, allowDefault, name) {
   if (value === false) {
     // Operator explicitly disabled this middleware. When it's one of the
     // security-on-by-default layers (allowDefault), leave an audit trace
-    // so the weakened posture is visible — Core Rule §3 security defaults
+    // so the weakened posture is visible — security defaults
     // shouldn't be silently opt-out-able. Drop-silent observability sink.
     if (allowDefault && name) {
       try {
@@ -227,7 +227,7 @@ async function createApp(opts) {
   var rateLimitOpts = _resolveMiddlewareOpt(mwConfig.rateLimit, false, "rateLimit");
   if (rateLimitOpts) router.use(middleware.rateLimit(rateLimitOpts));
 
-  // Security middleware wired ON by default (Core Rule §3). Each reads its
+  // Security middleware wired ON by default. Each reads its
   // config from opts.middleware.<name>: pass `false` to opt out (audited
   // via _resolveMiddlewareOpt), or an object to customize — operator cookie
   // / field names flow straight through, nothing static is baked in.

package/lib/vendor/blamejs/lib/archive-read.js

@@ -260,7 +260,7 @@ async function _readCentralDirectory(adapter, eocd) {
         "central directory entry " + n + " carries ZIP64 sentinel sizes (unsupported — use tar for >4 GiB / >65535 entries)");
     }
     // ZIP names are CP437 or UTF-8 (per FLAG_UTF8_NAME bit). Decode
-    // as UTF-8 unconditionally — Codex P2 territory if operators in
+    // as UTF-8 unconditionally — a concern if operators in
     // the wild rely on CP437; v0.12.7 ships UTF-8 only and operators
     // with legacy CP437-only producers reach for an external decoder.
     var name = cdBytes.slice(nameStart, nameStart + nameLen).toString("utf8");

package/lib/vendor/blamejs/lib/archive-tar-read.js

@@ -237,7 +237,7 @@ function tar(adapter, opts) {
       }
       var bodyStart = pos;
       var paddedSize = Math.ceil(hdr.size / BLOCK_SIZE) * BLOCK_SIZE;
-      // Codex P1 on v0.12.8 PR #159 — refuse truncated archives upfront.
+      // Refuse truncated archives upfront.
       // The walker advances `pos` by the declared padded block size; if
       // the buffer ends mid-body, extract() would silently slice a
       // partial payload (header says 11 bytes, buffer holds 8 — without

package/lib/vendor/blamejs/lib/archive-wrap.js

@@ -272,7 +272,7 @@ function _encryptForRecipient(bytes, opts) {
     };
   }
   if (r.publicKey) {
-    // Codex P2 on v0.12.10 PR #161 — b.crypto.encrypt falls back to
+    // B.crypto.encrypt falls back to
     // ML-KEM-only when ecPublicKey is undefined (with a one-shot
     // audit). For archive-wrap's recipient contract the hybrid leg
     // (P-384 ECDH defence-in-depth backstop on top of ML-KEM-1024)
@@ -343,7 +343,7 @@ function sniffEnvelope(bytes) {
   if (!Buffer.isBuffer(bytes) && !(bytes instanceof Uint8Array)) {
     return "none";
   }
-  // Codex P2A on v0.12.14 PR #165 — `Buffer.from(uint8Array)` copies
+  // `Buffer.from(uint8Array)` copies
   // the entire input, turning a constant-time 5-byte probe into an
   // O(n) allocation. Use the zero-copy view form so the sniff is
   // truly cheap regardless of input size.
@@ -351,7 +351,7 @@ function sniffEnvelope(bytes) {
     ? bytes
     : Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength);
   if (buf.length < 5) return "none";
-  // Codex P2B on v0.12.14 PR #165 — match on the 5-byte ASCII magic
+  // Match on the 5-byte ASCII magic
   // alone, NOT on the full header (which requires version + saltLen
   // bytes). A truncated envelope (`BAWRP` + nothing else) is still a
   // recipient envelope; the unwrap call surfaces the truncation with
@@ -413,7 +413,7 @@ async function wrapWithPassphrase(bytes, opts) {
   // alphabet. Operators sourcing passphrases from a random-bytes
   // generator (high entropy density) pass without issue; operators
   // typing dictionary phrases trip the gate.
-  // Codex P1 on v0.12.11 PR #162 — typeof NaN === "number" passes
+  // Typeof NaN === "number" passes
   // typeof gate but bypasses downstream comparisons. Use isFinite
   // so NaN / Infinity can't slip past the entropy gate.
   var minEntropy;
@@ -516,7 +516,7 @@ async function unwrapWithPassphrase(sealed, opts) {
 }
 
 function _estimatePassphraseEntropyBits(passphrase) {
-  // Codex P2 on v0.12.11 PR #162 — Buffer passphrases (CSPRNG-
+  // Buffer passphrases (CSPRNG-
   // generated random bytes) shouldn't be UTF-8 decoded for entropy
   // estimation; the decoding artifacts (invalid sequences, BOM,
   // surrogate pairs) make the alphabet-class measure unstable and

package/lib/vendor/blamejs/lib/audit-tools.js

@@ -75,9 +75,39 @@ var FRAMEWORK_VERSION = (pkg && pkg.version) || "unknown";
 // so importing db at audit-tools' top would close the cycle. Lazy
 // keeps the load order one-way.
 var db = lazyRequire(function () { return require("./db"); });
+var audit = lazyRequire(function () { return require("./audit"); });
 
 var AuditToolsError = defineClass("AuditToolsError", { alwaysPermanent: true });
 
+// Dual-control gate constants for the audit_log physical purge. The
+// purge erases signed audit history, so when an operator has declared
+// audit_log under b.db.declareRequireDualControl the deletion requires
+// a consumed m-of-n grant whose action matches AUDIT_LOG_PURGE_ACTION —
+// the same separation-of-duties control b.db.eraseHard enforces (NIST
+// SP 800-53 AU-9 + AC-5, HIPAA 45 CFR 164.312(b), PCI-DSS v4.0 10.5.1 /
+// 10.7, SEC 17a-4(f), CWE-778).
+var AUDIT_LOG_GATE_TABLE   = "audit_log";
+var AUDIT_LOG_PURGE_ACTION = "auditTools.purge";
+
+function _resolveDualControlGate(opts) {
+  var checker = typeof opts.checkDualControlGate === "function"
+    ? opts.checkDualControlGate
+    : function (t) { return db()._checkDualControlGate(t); };
+  try { return checker(AUDIT_LOG_GATE_TABLE); }
+  catch (_e) { return null; }
+}
+
+function _emitPurgeDenied(gate, reason) {
+  try {
+    audit().safeEmit({
+      action:   "auditTools.purge.denied",
+      outcome:  "denied",
+      reason:   reason,
+      metadata: { table: AUDIT_LOG_GATE_TABLE, m: gate.m, n: gate.n, posture: gate.posture || null },
+    });
+  } catch (_e) { /* drop-silent — denial audit is best-effort */ }
+}
+
 var BUNDLE_FORMAT  = "blamejs-audit-bundle-v1";
 var KIND_ARCHIVE   = "archive";
 var KIND_EXPORT    = "export";
@@ -149,7 +179,7 @@ function _rowToWireForm(row) {
   return out;
 }
 
-// F-AUD-4 — operator-facing wire helper that surfaces recordedAt as
+// Operator-facing wire helper that surfaces recordedAt as
 // ISO-8601 / RFC 3339 alongside the existing Unix-ms integer.
 // Auditors comparing rows against external SIEM events expect ISO
 // with explicit Z; the framework's primary ms storage stays
@@ -806,10 +836,11 @@ function _defaultVerifyCheckpointSignature(checkpoint) {
  * `lastPurgedRowHash` becomes the new chain origin.
  *
  * @opts
- *   confirm:         true,                // exact `true` required
- *   archive:         string,              // path to a verified archive bundle
- *   passphrase:      Buffer|string,       // bundle decryption passphrase
- *   verifySignature: function(checkpoint),// auditor pubkey override
+ *   confirm:          true,               // exact `true` required
+ *   archive:          string,             // path to a verified archive bundle
+ *   passphrase:       Buffer|string,      // bundle decryption passphrase
+ *   verifySignature:  function(checkpoint),// auditor pubkey override
+ *   dualControlGrant: object,             // required when audit_log is declared under b.db.declareRequireDualControl — from b.dualControl.consume({ action: "auditTools.purge" })
  *
  * @example
  *   var result = await b.auditTools.purge({
@@ -846,6 +877,34 @@ async function purge(opts) {
       "purge: bundle kind is '" + v.kind + "', must be 'archive'");
   }
 
+  // Dual-control gate. When audit_log is declared under
+  // b.db.declareRequireDualControl, the physical purge requires a
+  // consumed m-of-n grant — confirm:true alone is not enough. Mirrors
+  // b.db.eraseHard, and additionally binds the grant's action so a
+  // grant minted for a different operation can't be replayed here.
+  var dcGate = _resolveDualControlGate(opts);
+  if (dcGate) {
+    var grant = opts.dualControlGrant;
+    if (!grant) {
+      _emitPurgeDenied(dcGate, "no-grant");
+      throw new AuditToolsError("audit-tools/dual-control-required",
+        "purge: audit_log is under dual control (m=" + dcGate.m + ", n=" + dcGate.n +
+        "); pass opts.dualControlGrant from b.dualControl.consume({ action: \"" +
+        AUDIT_LOG_PURGE_ACTION + "\" }).");
+    }
+    if (grant.ready !== true) {
+      _emitPurgeDenied(dcGate, "grant-not-ready");
+      throw new AuditToolsError("audit-tools/dual-control-grant-not-ready",
+        "purge: opts.dualControlGrant.ready must be true (a consumed m-of-n grant)");
+    }
+    if (grant.action !== AUDIT_LOG_PURGE_ACTION) {
+      _emitPurgeDenied(dcGate, "grant-action-mismatch");
+      throw new AuditToolsError("audit-tools/dual-control-grant-mismatch",
+        "purge: dualControlGrant.action is '" + grant.action + "', must be '" +
+        AUDIT_LOG_PURGE_ACTION + "'");
+    }
+  }
+
   // 2. Refuse if the archive doesn't start at the next purge point. Keeps
   // the chain anchor monotonic — operators can't jump-purge a middle range.
   var readAnchor = opts.readAnchor || _defaultReadPurgeAnchor;
@@ -881,6 +940,7 @@ async function purge(opts) {
     lastPurgedCounter:    Number(v.range.lastCounter),
     lastPurgedRowHash:    v.range.lastRowHash,
     archiveBundleId:      result.archiveBundleId,
+    dualControlConsumed:  !!dcGate,
   };
 }
 

package/lib/vendor/blamejs/lib/audit.js

@@ -305,7 +305,7 @@ var FRAMEWORK_NAMESPACES = [
   "sandbox",    // b.sandbox (sandbox.run / sandbox.run.refused — operator-supplied transform isolation)
   "safeurl",    // b.safeUrl.parse (safeurl.idn_homograph.refused — UTS #39 mixed-script host-label refusal)
   "http",       // b.middleware.bodyParser (http.chunked.malformed.refused — RFC 9112 §7.1 chunked-decode failure with Connection: close) // RFC number in prose
-  "cryptofield", // b.cryptoField.eraseRow (cryptofield.vacuum.skipped — F-RTBF-2 vacuum-after-erase signal when DB not initialized at erase time)
+  "cryptofield", // b.cryptoField.eraseRow (cryptofield.vacuum.skipped — vacuum-after-erase signal when DB not initialized at erase time)
   "acme",       // b.acme (acme.account.registered / order.* / cert.issued / cert.renewed / cert.renew.skipped — RFC 8555 + RFC 9773 ARI workflow)
   "cert",       // b.cert (cert.account.generated / cert.issued / cert.renewed / cert.renew-failed / cert.challenge-cleanup — turnkey cert-manager lifecycle)
   "tls",        // b.router 0-RTT posture (tls.0rtt.refused / tls.0rtt.replayed) — RFC 8446 §8 anti-replay surface // RFC number in prose
@@ -1620,7 +1620,7 @@ async function assertSegregation(opts) {
   return { ok: ok, missing: missing };
 }
 
-// applyPosture — F-POSTURE-1 cascade hook. b.compliance.set(posture)
+// applyPosture — cascade hook. b.compliance.set(posture)
 // calls this to record the active posture so audit emissions can
 // surface the regulatory regime in metadata where downstream tooling
 // (forensic export, SIEM correlation) needs it. The chain itself is

package/lib/vendor/blamejs/lib/auth/ciba.js

@@ -577,7 +577,7 @@ function create(opts) {
         "ciba.parseNotification: empty bearer or no expected token configured");
     }
     // Constant-time compare on the SHA3 hash of both tokens —
-    // matches the project-wide discipline (audit 2026-05-11). Both
+    // matches the project-wide discipline. Both
     // sides are fixed-width sha3-512 hex strings; timingSafeEqual
     // adds explicit defense-in-depth over `!==` even though equal-
     // length JS string compare is already broadly understood as

package/lib/vendor/blamejs/lib/auth/dpop.js

@@ -437,7 +437,7 @@ async function verify(proof, opts) {
   }
 
   // nonce — when caller supplies expected nonce, payload MUST match.
-  // Constant-time compare (audit 2026-05-15): the nonce is a server-
+  // Constant-time compare: the nonce is a server-
   // issued secret-shaped value matched against attacker-controlled
   // payload bytes. RFC 9449 §8 mandates the value be unpredictable;
   // a leaking compare reveals prefix bytes over many attempts. ath

package/lib/vendor/blamejs/lib/auth/fal.js

@@ -179,7 +179,7 @@ function fromAssertion(opts) {
     return FAL3;
   }
 
-  // AUTH-19 — FAL2 per NIST SP 800-63C-4 §5.2 requires "injection
+  // FAL2 per NIST SP 800-63C-4 §5.2 requires "injection
   // protection" on the back-channel: either the back-channel itself is
   // encrypted-and-authenticated (mTLS / signed transport) OR the
   // assertion is encrypted to the RP. A plain HTTP back-channel with

package/lib/vendor/blamejs/lib/auth/fido-mds3.js

@@ -73,7 +73,7 @@ var REFUSE_STATUS = {
   // FIDO MDS3 §3.1.4 — attestation-key compromise means the
   // manufacturer's batch-signing key is suspect; every credential
   // attested under that key MUST be refused. Pre-v0.9.2 this token
-  // was missing from the refuse-list (audit 2026-05-11).
+  // was missing from the refuse-list.
   ATTESTATION_KEY_COMPROMISE:    1,
 };
 
@@ -362,7 +362,6 @@ function _verifyAndParseBlob(token) {
   // cache; an attacker serving an ancient signed-but-expired BLOB
   // could keep operators on a revoked-authenticator-list-frozen-at-X.
   // Refuse at parse time so neither fetch nor cache lookup honors it.
-  // (Audit 2026-05-11.)
   if (nextUpdate.getTime() < Date.now()) {
     throw new FidoMds3Error("fido-mds3/blob-stale",
       "BLOB payload nextUpdate \"" + payload.nextUpdate +
@@ -619,7 +618,7 @@ function verifyAuthenticator(blob, registrationInfo, vopts) {
   }
   var entry = lookupAaguid(blob, registrationInfo.aaguid);
   if (!entry) {
-    // Fail-CLOSED default for unknown AAGUIDs (audit 2026-05-11).
+    // Fail-CLOSED default for unknown AAGUIDs.
     // Pre-v0.9.2 default was `ok: true, reason: "aaguid-not-in-blob"`
     // — an attacker registering a credential with an AAGUID not in
     // the BLOB (rogue authenticator, fake hardware) silently passed.

package/lib/vendor/blamejs/lib/auth/jwt-external.js

@@ -271,7 +271,7 @@ function _selectKey(keys, header, vopts) {
     throw new AuthError("auth-jwt-external/no-matching-kid",
       "no JWKS key matches header.kid='" + header.kid + "'");
   }
-  // Refuse kid-less tokens by default (audit 2026-05-11). JWKS
+  // Refuse kid-less tokens by default. JWKS
   // rotation creates a window where the rotated-out key is still
   // cached but the rotated-in key is already published; an
   // attacker shipping a kid-less token gets the lone-key path
@@ -301,7 +301,7 @@ async function verifyExternal(token, opts) {
     "audience", "issuer", "subject", "clockSkewMs",
     // v0.9.4 — opt-out for the kid-less-token JWKS-of-one refusal
     // (default refuses; non-conforming IdPs that emit kid-less tokens
-    // set this true). Audit 2026-05-11.
+    // set this true).
     "allowKidlessJwks",
   ], "auth.jwt.verifyExternal");
 

package/lib/vendor/blamejs/lib/auth/oauth.js

@@ -621,7 +621,7 @@ function create(opts) {
     // constrained tokens (DPoP / mTLS) can opt out by NOT supplying
     // a seen callback.
     //
-    // Atomic check-and-insert (audit 2026-05-11) — pre-v0.9.3 the
+    // Atomic check-and-insert — pre-v0.9.3 the
     // check ran via `ropts.seen(token)` which was a check-then-act
     // race: two concurrent refresh requests landed on the same
     // event-loop tick could both see `seen === false` and both POST
@@ -648,7 +648,7 @@ function create(opts) {
       // Spec contract: inserted===true → first sighting (OK);
       // inserted===false → replay. v0.9.3 had this inverted, which
       // broke every first refresh attempt for operators reusing an
-      // existing b.nonceStore-style backend. (Reported 2026-05-12.)
+      // existing b.nonceStore-style backend.
       alreadySeen = inserted === false;
     } else if (typeof ropts.seen === "function") {
       // Legacy non-atomic path. Documented as a check-then-act race;
@@ -773,7 +773,7 @@ function create(opts) {
       // Constant-time compare on the CSRF state token. Project
       // discipline (auth/dpop.js, mail-srs.js, webhook.js) is
       // timingSafeEqual for any secret-shaped value compared
-      // against attacker-controlled input. (Audit 2026-05-11.)
+      // against attacker-controlled input.
       if (typeof query.state !== "string" ||
           !cryptoTimingSafeEqual(query.state, popts.expectedState)) {
         throw new OAuthError("auth-oauth/state-mismatch",
@@ -971,7 +971,7 @@ function create(opts) {
       // surface as `["admin", "read"]` and the operator's scope
       // allowlist saw two distinct scopes. Spec-strict split on
       // single-space + reject scope tokens that contain non-token
-      // chars. (Audit 2026-05-11.)
+      // chars.
       scope:        raw.scope ? raw.scope.split(" ").filter(function (s) { return s.length > 0; }) : scope.slice(),
       raw:          raw,
     };
@@ -1052,7 +1052,7 @@ function create(opts) {
     // verifier in the framework (jwt.js, jwt-external.js, dpop.js)
     // refuses; verifyIdToken previously silently ignored, letting an
     // attacker-controlled OP ship critical extensions the verifier
-    // doesn't understand. (Audit 2026-05-11.)
+    // doesn't understand.
     if (header.crit !== undefined && header.crit !== null) {
       throw new OAuthError("auth-oauth/crit-not-supported",
         "ID token JWS header carries 'crit' extension list; this verifier does not " +
@@ -1072,7 +1072,7 @@ function create(opts) {
     // key was still cached at the IdP but the rotated-in key is
     // already published. Refuse kid-less tokens unconditionally —
     // every modern IdP includes kid; absent kid is a spec smell.
-    // (Audit 2026-05-11.) Operators with non-conforming IdPs that
+    // Operators with non-conforming IdPs that
     // genuinely emit kid-less tokens can opt out via
     // vopts.allowKidlessJwks = true with a logged warning.
     if (!match) {
@@ -1117,7 +1117,7 @@ function create(opts) {
     // ES256 signature attempted against an RS256 key returned by a
     // hostile or buggy IdP with duplicate kids). Wrap so the panic
     // becomes a typed AuthError, matching the discipline in
-    // jwt-external.js + dpop.js. (Audit 2026-05-11.)
+    // jwt-external.js + dpop.js.
     var verified;
     try {
       verified = nodeCrypto.verify(params.hash, Buffer.from(signingInput, "ascii"), verifyOpts, sig);
@@ -1179,7 +1179,7 @@ function create(opts) {
     }
     if (vopts.nonce && !vopts.skipNonceCheck) {
       // Constant-time nonce compare — secret-shaped value matched
-      // against attacker-controlled payload. (Audit 2026-05-11.)
+      // against attacker-controlled payload.
       if (typeof payload.nonce !== "string" ||
           !cryptoTimingSafeEqual(payload.nonce, vopts.nonce)) {
         throw new OAuthError("auth-oauth/nonce-mismatch",
@@ -1212,7 +1212,7 @@ function create(opts) {
       // supplied; an operator typo could ship `http://` or
       // `javascript:`. Route through the framework's URL gate before
       // emitting so the URL is validated the same way as every other
-      // operator-supplied OAuth URL (audit 2026-05-15).
+      // operator-supplied OAuth URL.
       _validateUrl(uopts.postLogoutRedirectUri, allowHttp, "postLogoutRedirectUri");
       params.set("post_logout_redirect_uri", uopts.postLogoutRedirectUri);
     }