@blamejs/blamejs-shop 0.3.12 → 0.3.13

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.14.6",
-  "createdAt": "2026-05-30T16:00:48.364Z",
+  "frameworkVersion": "0.14.7",
+  "createdAt": "2026-05-30T20:25:42.630Z",
   "exports": {
     "a2a": {
       "type": "object",
@@ -14518,6 +14518,10 @@
           "type": "function",
           "arity": 0
         },
+        "getDeclaredColumns": {
+          "type": "function",
+          "arity": 1
+        },
         "getMode": {
           "type": "function",
           "arity": 0
@@ -37103,6 +37107,10 @@
             "create": {
               "type": "function",
               "arity": 1
+            },
+            "createDeadlineClock": {
+              "type": "function",
+              "arity": 1
             }
           }
         }
@@ -49732,6 +49740,10 @@
           "type": "function",
           "arity": 0
         },
+        "getDerivedHashMacKey": {
+          "type": "function",
+          "arity": 0
+        },
         "getDerivedHashSalt": {
           "type": "function",
           "arity": 0

package/lib/vendor/blamejs/lib/agent-event-bus.js

@@ -136,7 +136,7 @@ function _registerTopic(topics, name, topicOpts, auditImpl) {
     throw new AgentEventBusError("agent-event-bus/bad-schema",
       "registerTopic: schema required (flat key→type map)");
   }
-  // BUG-12 — `kind` is now captured on register so listTopics's kind
+  // `kind` is now captured on register so listTopics's kind
   // filter actually matches. Prior shape never set entry.kind, so the
   // filter at args.kind was dead. Default value derives from the
   // dotted topic name's first segment ("mail.scan.x" → "mail"), giving
@@ -164,7 +164,7 @@ function _registerTopic(topics, name, topicOpts, auditImpl) {
   });
 }
 
-// SUBSTRATE-22 — operators reloading a module (test runners between
+// Operators reloading a module (test runners between
 // runs, hot-reload tools, multi-tenant onboarding flows that
 // register-deregister topics) need a clean unregister path; without
 // it the second register throws topic-duplicate and the operator is
@@ -183,7 +183,7 @@ function _unregisterTopic(topics, name, auditImpl) {
 function _listTopics(topics, args, permissions) {
   // Permission gate: list-topics requires no special scope by default;
   // operator can wrap with their own permissions instance for stricter.
-  // BUG-12 — kind filter now matches because register captures kind.
+  // Kind filter now matches because register captures kind.
   var out = [];
   topics.forEach(function (entry) {
     if (args.kind && entry.kind !== args.kind) return;
@@ -229,7 +229,7 @@ async function _publish(topics, pubsub, name, payload, pOpts, permissions, audit
   }
   // Schema validation.
   guardEventBusPayload.validate(payload, entry.schema);
-  // SUBSTRATE-6 — when a topic is tenant-scoped, require the publisher
+  // When a topic is tenant-scoped, require the publisher
   // to declare a tenantId BEFORE the event reaches the durable bus
   // backend. Prior shape allowed `wrapped._tenantId: null` to land on
   // the bus, and the receive-side drop only fired AFTER persistence —

package/lib/vendor/blamejs/lib/agent-idempotency.js

@@ -158,7 +158,7 @@ function create(opts) {
   return {
     get:        function (method, actorId, key)                       { return _get(store, method, actorId, key, auditImpl, ttlMs, maxResultBytes); },
     put:        function (method, actorId, key, result, putOpts)      { return _put(store, method, actorId, key, result, putOpts || {}, ttlMs, maxResultBytes, fingerprintArgs, auditImpl); },
-    // SUBSTRATE-4 — putIfAbsent gates concurrent retries at the cache
+    // putIfAbsent gates concurrent retries at the cache
     // boundary so only one consumer runs the handler. Operator wraps:
     //   var claim = await idem.putIfAbsent(method, actor, key, args);
     //   if (claim.alreadyClaimed) return claim.result; // another retry won
@@ -173,7 +173,7 @@ function create(opts) {
   };
 }
 
-// SUBSTRATE-4 — atomic claim/check/run pattern. Returns one of:
+// Atomic claim/check/run pattern. Returns one of:
 //   { alreadyClaimed: false, fingerprint }          — caller runs the handler
 //   { alreadyClaimed: true,  pending: true }        — another in-flight claim holds the slot
 //   { alreadyClaimed: true,  result: <cached> }     — prior handler completed; cached result
@@ -299,7 +299,7 @@ async function _get(store, method, actorId, key, auditImpl, ttlMs, maxResultByte
     throw new AgentIdempotencyError("agent-idempotency/corrupt-result",
       "get: cached result failed to parse — " + (e && e.message ? e.message : String(e)));
   }
-  // SUBSTRATE-12 — atomic replayCount increment. The prior shape
+  // Atomic replayCount increment. The prior shape
   // (read row → mutate → put row) raced two concurrent retries: each
   // saw replayCount=N, both wrote replayCount=N+1, so the counter
   // missed bumps and the put-with-fresh-result race-clobbered prior
@@ -439,7 +439,7 @@ function _fingerprintArgs(args) {
   // unique fingerprint and defeat the args-mismatch defense. Strip
   // _traceContext (varies per-hop, doesn't change result).
   //
-  // SUBSTRATE-11 — DO NOT strip _postureChain. The prior shape ignored
+  // DO NOT strip _postureChain. The prior shape ignored
   // _postureChain.postureSet, so a request made under
   // postureSet:["hipaa","pci-dss"] cached the same result that a
   // downgrade attempt under postureSet:["pci-dss"] would replay
@@ -493,7 +493,7 @@ function _inMemoryBackend(maxEntries) {
       map.set(_k(method, actorId, hash), row);
       return Promise.resolve();
     },
-    // SUBSTRATE-4 — atomic insert. Map.set is synchronous so the
+    // Atomic insert. Map.set is synchronous so the
     // get+set pair below is naturally race-free within the in-memory
     // backend (V8 single-threaded). Returns true when inserted, false
     // when the row already exists.
@@ -503,7 +503,7 @@ function _inMemoryBackend(maxEntries) {
       map.set(k, row);
       return Promise.resolve(true);
     },
-    // SUBSTRATE-12 — atomic replayCount increment. Operators wiring
+    // Atomic replayCount increment. Operators wiring
     // a SQL backend implement this with `UPDATE ... SET
     // replay_count = replay_count + 1 WHERE keyHash = $1 RETURNING *`
     // — read-modify-write race-free. In-memory backend is naturally

package/lib/vendor/blamejs/lib/agent-orchestrator.js

@@ -119,7 +119,7 @@ function _unsealRegistryRow(row) {
 var DEFAULT_DRAIN_TIMEOUT_MS = C.TIME.minutes(2);
 var STREAM_ID_RAND_BYTES     = 8;                                                                     // stream-id random-suffix byte length, not a size cap
 var DEFAULT_PER_CONSUMER_STOP_MS = C.TIME.seconds(5);
-// SUBSTRATE-20 — FNV-1a offset basis salted with the first 32 bits of
+// FNV-1a offset basis salted with the first 32 bits of
 // SHA3-512(vault master). Attackers who don't have read access to the
 // vault keypair can't compute the salt, so they can't engineer
 // tenantIds that all map to one shard. Cached per-process; rotation
@@ -183,7 +183,7 @@ function create(opts) {
     // operator-supplied metadata (kind / tenantId / posture / ...);
     // every consuming process holds its own runtime map of name → agent.
     liveAgents:  new Map(),
-    // SUBSTRATE-8 — drain quiesce wiring. Operator passes
+    // Drain quiesce wiring. Operator passes
     // { outbox, sagaInFlightCount, pubsubFlush } via create() so the
     // drain phase can quiesce real in-flight work, not just stop
     // consumers. Optional — operators with no outbox / saga / pubsub
@@ -192,7 +192,7 @@ function create(opts) {
     sagaInFlightCount: typeof opts.sagaInFlightCount === "function" ? opts.sagaInFlightCount : null,
     pubsubFlush:      typeof opts.pubsubFlush === "function" ? opts.pubsubFlush : null,
     perConsumerStopMs: typeof opts.perConsumerStopMs === "number" ? opts.perConsumerStopMs : DEFAULT_PER_CONSUMER_STOP_MS,
-    // SUBSTRATE-9 — onTransition handler invalidates election cache
+    // onTransition handler invalidates election cache
     // on lease-lost / acquired / released. Operator opts out via
     // { cacheElections: false } to always re-query b.cluster.
     cacheElections:   opts.cacheElections !== false,
@@ -205,7 +205,7 @@ function create(opts) {
     });
   }
 
-  // SUBSTRATE-9 — subscribe to cluster lease transitions so cached
+  // Subscribe to cluster lease transitions so cached
   // election state can't go stale after a partition. b.cluster
   // .onTransition fires for every lease-acquired / lease-lost / lease-
   // released event; we invalidate the affected resource's cached
@@ -254,7 +254,7 @@ function create(opts) {
  * @status    stable
  * @related   b.agent.orchestrator.create
  *
- * SUBSTRATE-3 — attach an in-process live agent reference to a row
+ * Attach an in-process live agent reference to a row
  * that already exists in the persistent registry backend. The
  * canonical boot-phase contract: the *first* process to start a new
  * agent calls `register()` (writes the backend row + holds the live
@@ -499,7 +499,7 @@ function _spawnSingleConsumer(ctx, agent, queue, topic, maxConcurrency) {
  *   // → integer in [0, 8)
  */
 function _saltedFnvBasis() {
-  // SUBSTRATE-20 — salt FNV-1a offset basis with the vault master so
+  // Salt FNV-1a offset basis with the vault master so
   // an attacker can't engineer tenantIds that all hash to one shard.
   // Vault-less path (single-process tests / dev) falls back to the
   // standard FNV offset basis; production deployments with vault
@@ -561,7 +561,7 @@ async function _elect(ctx, args) {
     });
     return elec;
   }
-  // SUBSTRATE-9 — cluster mode: ALWAYS query truth from b.cluster.
+  // Cluster mode: ALWAYS query truth from b.cluster.
   // The onTransition handler installed in create() invalidates the
   // cache on every lease event, so a cache hit here is safe (it
   // means no lease event has fired since the last query). But the
@@ -600,10 +600,10 @@ async function _drain(ctx, args) {
   var drained = 0;
   var startedAt = Date.now();
   var perConsumerMs = ctx.perConsumerStopMs;
-  // SUBSTRATE-8 — drain phases:
+  // Drain phases:
   //   1. set ctx.draining so streams emit drain-markers + new task
   //      dispatches refuse (consumers re-check on every envelope).
-  //   2. stop each consumer with BUG-6 per-consumer timeout race —
+  //   2. stop each consumer with a per-consumer timeout race —
   //      one hung consumer can't block the full drain budget.
   //   3. quiesce in-flight: poll outbox.pendingCount + sagaInFlightCount
   //      until 0 OR remaining-budget-ms elapses.

package/lib/vendor/blamejs/lib/agent-posture-chain.js

@@ -65,7 +65,7 @@ var AgentPostureChainError = defineClass("AgentPostureChainError", { alwaysPerma
 
 var BUILTIN_REGIMES = Object.freeze(["hipaa", "pci-dss", "gdpr", "soc2"]);
 
-// SUBSTRATE-10 — envelope MAC vocabulary. Cross-process envelope
+// Envelope MAC vocabulary. Cross-process envelope
 // integrity: an attacker with queue / event-bus write access who
 // strips postureSet to [] and re-sends a saga / sub-agent envelope
 // can bypass the downgrade refusal in _validate (which only checks
@@ -73,7 +73,7 @@ var BUILTIN_REGIMES = Object.freeze(["hipaa", "pci-dss", "gdpr", "soc2"]);
 // envelope bytes, computed at appendHop and verified at validate.
 var ENVELOPE_MAC_LABEL = "blamejs.agent.postureChain/v1";
 var ENVELOPE_MAC_KEY_BYTES = 32;                                                                        // HMAC-SHA3-512 keyed bytes
-// SUBSTRATE-21 — hop count cap defends infinite recursion across
+// Hop count cap defends infinite recursion across
 // agent delegation. 16 is the spec default; operators can lower via
 // opts.maxHopCount but never raise (audit fan-out without a cap is a
 // DoS class).
@@ -111,7 +111,7 @@ function _resolveMacKey() {
 
 function _envelopeMacBytes(envelope) {
   // Sign every field that downstream consumers verify off the wire,
-  // except the `_mac` field itself. SUBSTRATE-21 — also includes
+  // except the `_mac` field itself. Also includes
   // hopCount + chainTrail so a hostile rewriter can't roll back the
   // trail to evade the cap.
   var payload = {
@@ -163,8 +163,8 @@ function create(opts) {
                     opts.maxHopCount <= DEFAULT_MAX_HOP_COUNT
                       ? Math.floor(opts.maxHopCount)
                       : DEFAULT_MAX_HOP_COUNT;
-  // SUBSTRATE-10 escape hatch — only operator-confirmed single-process
-  // unit tests should opt out of envelope MAC. Production / multi-
+  // Escape hatch — only single-process unit tests should opt out of
+  // envelope MAC. Production / multi-
   // process / queue-spanning deployments leave the default on; the
   // gate audit-emits when bypassed so the posture is visible.
   var requireMac = opts.requireMac !== false;
@@ -257,7 +257,7 @@ function _appendHop(ctx, envelope, hopName) {
       "appendHop: hopName must be a non-empty string");
   }
   var trail = Array.isArray(envelope.chainTrail) ? envelope.chainTrail.slice() : [];
-  // SUBSTRATE-21 — cap enforced BEFORE the push so the hop-cap throw
+  // Cap enforced BEFORE the push so the hop-cap throw
   // fires consistently regardless of whether the operator inspects
   // trail.length first. Cap is a hard refusal (no truncation) because
   // a silently-dropped hop loses audit provenance for the call.
@@ -279,8 +279,8 @@ function _appendHop(ctx, envelope, hopName) {
     hopCount:   trail.length,
   });
   guardPostureChain.validate(newEnvelope);
-  // SUBSTRATE-10 — sign at every hop. Verify-side enforces requireMac.
-  // ctx.requireMac=false (operator-confirmed test escape hatch) skips
+  // Sign at every hop. Verify-side enforces requireMac.
+  // ctx.requireMac=false (test escape hatch) skips
   // the sign so a vault-less test path still works.
   if (ctx.requireMac) {
     try {
@@ -301,7 +301,7 @@ function _appendHop(ctx, envelope, hopName) {
 
 function _validate(ctx, envelope, agentPostureSet) {
   guardPostureChain.validate(envelope);
-  // SUBSTRATE-10 — MAC verification BEFORE any field-based decision so
+  // MAC verification BEFORE any field-based decision so
   // the wire-rewrite attack (postureSet:[] downgrade with valid SHAPE
   // but no integrity binding) is refused. ctx.requireMac=false skips
   // verification and emits an audit so the bypass is visible.
@@ -326,7 +326,7 @@ function _validate(ctx, envelope, agentPostureSet) {
       chainTrail: envelope.chainTrail,
     });
   }
-  // SUBSTRATE-21 — hop cap also enforced at validate-time. A hostile
+  // Hop cap also enforced at validate-time. A hostile
   // envelope might arrive with hopCount > cap if a prior hop's
   // requireMac was off; refuse here regardless.
   if (Array.isArray(envelope.chainTrail) && envelope.chainTrail.length > ctx.maxHopCount) {

package/lib/vendor/blamejs/lib/agent-saga.js

@@ -58,8 +58,7 @@
  *
  *   ## No saga-level retry
  *
- *   Per the substrate playbook decision (operator-confirmed
- *   2026-05-14): saga's value-add is compensation, not retry. If a
+ *   Saga's value-add is compensation, not retry. If a
  *   step needs retry-with-backoff, the operator wraps `step.run`
  *   with `b.retry` inside the step body. With v0.9.22 idempotency
  *   available, internal retry inside step.run is side-effect-safe.
@@ -109,7 +108,7 @@ var SAGA_ID_RAND_BYTES = 8;
 function create(config) {
   guardSagaConfig.validate(config);
   var auditImpl = config.audit || audit();
-  // SUBSTRATE-7 — operator wires a stateStore for crash-safe resume.
+  // Operator wires a stateStore for crash-safe resume.
   // Interface: { saveStep, loadResumePoint, markCompleted, markFailed }.
   // saveStep({sagaId, stepIndex, stepName, state, status}) commits
   // after each step.run; loadResumePoint(sagaId) returns the resume
@@ -189,7 +188,7 @@ async function _runFrom(config, auditImpl, stateStore, ctx, state, opts, sagaId,
       });
       await step.run(ctx, state);
       completedSteps.push({ step: step, index: i });
-      // SUBSTRATE-7 — checkpoint after the step.run returns. saveStep
+      // Checkpoint after the step.run returns. saveStep
       // commits the post-step state so a crash before the NEXT step
       // resumes from i+1. The audit chain records the checkpoint
       // independently of the operator's stateStore — operator can
@@ -232,7 +231,7 @@ async function _runFrom(config, auditImpl, stateStore, ctx, state, opts, sagaId,
         message: (stepErr && stepErr.message) || String(stepErr),
       });
       var compensationError = null;
-      // BUG-5 — capture the compensation step that ACTUALLY failed,
+      // Capture the compensation step that ACTUALLY failed,
       // not "completedSteps[completedSteps.length-1].name" which
       // names the last-COMPLETED step regardless of which compensation
       // threw. CWE-209-adjacent (information disclosure via wrong
@@ -278,7 +277,7 @@ async function _runFrom(config, auditImpl, stateStore, ctx, state, opts, sagaId,
           });
         } catch (_e) { /* drop-silent — audit already records */ }
       }
-      // SUBSTRATE-15 — attach cause:stepErr so the original step
+      // Attach cause:stepErr so the original step
       // error stack survives. ES2022 Error.cause is the standard
       // mechanism; the framework's defineClass-built AgentSagaError
       // accepts cause via the third arg.
@@ -290,7 +289,7 @@ async function _runFrom(config, auditImpl, stateStore, ctx, state, opts, sagaId,
                      ((compensationError.message) || String(compensationError));
       }
       var sagaErr = new AgentSagaError("agent-saga/failed", detailMsg);
-      // SUBSTRATE-15 — ES2022 Error.cause attaches the originating
+      // ES2022 Error.cause attaches the originating
       // stepErr so operator stack-trace tooling can walk the chain.
       // defineClass({alwaysPermanent:true}) doesn't accept cause in
       // its constructor signature; the property assignment after

package/lib/vendor/blamejs/lib/agent-snapshot.js

@@ -60,7 +60,7 @@ var vault                 = lazyRequire(function () { return require("./vault");
 
 var AgentSnapshotError = defineClass("AgentSnapshotError", { alwaysPermanent: true });
 
-// SUBSTRATE-2 — sealed envelopes start with this prefix on disk; the
+// Sealed envelopes start with this prefix on disk; the
 // loader sniffs it and routes through unseal before guardSnapshotEnvelope
 // validation. Compatible with operator backends that store the value
 // as a string (JSON DBs, k/v stores) or wrap it in `{ value: "..." }`.
@@ -113,19 +113,19 @@ function create(opts) {
   var snapshotIntervalMs = typeof policy.snapshotIntervalMs === "number" ? policy.snapshotIntervalMs : DEFAULT_SNAPSHOT_INTERVAL_MS;
   var maxSnapshotBytes   = typeof policy.maxSnapshotBytes === "number" ? policy.maxSnapshotBytes : DEFAULT_MAX_SNAPSHOT_BYTES;
   var auditImpl = opts.audit || audit();
-  // SUBSTRATE-1 — operator may inject `signer` (interface
+  // Operator may inject `signer` (interface
   // `{ sign(bytes) → Buffer, verify(bytes, sig, pubKey?) → boolean }`)
   // for testing / alternate key custody. Default = b.auditSign when
   // initialized at boot; refuses persist() with a clear error if
   // neither is wired so secure-by-default holds.
   var signer = opts.signer || null;
-  // SUBSTRATE-2 — operator may inject `sealer` (interface
+  // Operator may inject `sealer` (interface
   // `{ seal(plaintext, aadParts) → string, unseal(value, aadParts) → string }`)
   // for alternate KMS integration. Default = b.vault.aad. Refused if
   // neither is wired AND opts.allowPlaintext is not explicitly true
   // (operator-justified dev / single-tenant deployments only).
   var sealer = opts.sealer || null;
-  // SUBSTRATE-18 — operator-supplied restoreHandlers walk the
+  // Operator-supplied restoreHandlers walk the
   // snapshot inFlight + idempotencyCache + orchestratorState segments
   // and hydrate the corresponding consumer module. Map shape:
   //   { streams, sagas, outboxJobs, busSubscribers, pendingDeliveries,
@@ -300,7 +300,7 @@ async function _takeSnapshot(ctx, snapshotOpts) {
 
 async function _persist(ctx, snap) {
   guardSnapshotEnvelope.validate(snap);
-  // SUBSTRATE-1 — sign first so a backend that mutates on put() (very
+  // Sign first so a backend that mutates on put() (very
   // common for k/v stores adding metadata) doesn't poison the signed
   // bytes downstream readers verify.
   var signer = _resolveSigner(ctx);
@@ -314,7 +314,7 @@ async function _persist(ctx, snap) {
   // pubkey at verify time).
   snap.sigPubKey = (typeof signer.getPublicKey === "function" && signer.getPublicKey()) || null;
 
-  // SUBSTRATE-2 — seal the entire envelope under AAD that pins
+  // Seal the entire envelope under AAD that pins
   // snapshotId + schemaVersion + tenantId. AAD mismatch on unseal (a
   // copy-paste attack from one snapshotId's row into another) fails
   // the Poly1305 tag check; tampered bytes also fail. The sealed
@@ -405,7 +405,7 @@ async function _unwrapAndVerify(ctx, raw, expectedId) {
     throw new AgentSnapshotError("agent-snapshot/snapshot-id-mismatch",
       "load: wrapper snapshotId='" + expectedId + "' does not match envelope='" + snap.snapshotId + "'");
   }
-  // SUBSTRATE-1 — verify the signature before returning the envelope
+  // Verify the signature before returning the envelope
   // to the caller. Restore-side trust derives from this gate. The
   // allowPlaintext escape hatch (operator-acknowledged dev mode)
   // also waives signature verification because there's no key custody
@@ -496,7 +496,7 @@ async function _restore(ctx, snap, restoreOpts) {
       affectedStreams:       (snap.inFlight && snap.inFlight.streams || []).length,
     });
   }
-  // SUBSTRATE-18 — invoke operator-supplied restoreHandlers across
+  // Invoke operator-supplied restoreHandlers across
   // every segment the snapshot envelope carries. Handlers are
   // declared at create() time; the snapshot primitive owns ordering
   // (orchestratorState first so live agents register before consumers

package/lib/vendor/blamejs/lib/agent-stream.js

@@ -138,7 +138,7 @@ function _makeIterator(ctx) {
   var done       = false;
   var closed     = false;
   var drained    = false;
-  // SUBSTRATE-14 — track the cursor of the LAST row actually yielded
+  // Track the cursor of the LAST row actually yielded
   // to the consumer. The prior shape called cursor.lastSeenCursor()
   // at drain-marker emit, which returned the position of the last
   // FETCHED batch — clients resuming from that cursor SKIPPED every
@@ -167,7 +167,7 @@ function _makeIterator(ctx) {
       try {
         if (buffer.length > 0) {
           var row = buffer.shift();
-          // SUBSTRATE-14 — record the cursor for this yielded row so a
+          // Record the cursor for this yielded row so a
           // drain that fires BETWEEN buffered yields emits a marker
           // whose lastSeenCursor matches what the client actually
           // received. The cursor extraction shape mirrors the
@@ -248,7 +248,7 @@ function _safeAudit(auditImpl, action, actor, metadata) {
   agentAudit.safeAudit(auditImpl, action, actor, metadata);
 }
 
-// SUBSTRATE-14 — resolve the resume cursor for a row about to be
+// Resolve the resume cursor for a row about to be
 // yielded. Operators may attach the cursor per-row (`row._cursor` /
 // `row.cursor`) OR rely on the cursor's own per-row tracker
 // (`cursor.cursorForRow(row)`) — both shapes supported.

package/lib/vendor/blamejs/lib/agent-tenant.js

@@ -222,7 +222,7 @@ async function _unregister(ctx, tenantId, args) {
   }
   // Archive default — retain the key + metadata for retention-mandated
   // restoration. Operator's compliance regime drives archivePolicy.
-  // SUBSTRATE-19 — persist as a `status: "archived"` row in the same
+  // Persist as a `status: "archived"` row in the same
   // backend rather than only the process-local Map. GDPR Art. 17 +
   // HIPAA §164.530(j) require the archived state to survive process
   // restart (auditor pulls a deleted tenant's archival record years
@@ -373,7 +373,7 @@ function _check(ctx, actor, agentTenantId) {
 
 // ---- Per-tenant derived key -----------------------------------------------
 //
-// SUBSTRATE-5 — `namespaceHash(label, tenantId)` is a PUBLIC function
+// `namespaceHash(label, tenantId)` is a PUBLIC function
 // over PUBLIC inputs; an attacker who learns `tenantId` (an account id
 // surfaced in URLs / API responses) reconstructs every per-tenant key
 // without any secret material. The defense the docstring promises —
@@ -555,7 +555,7 @@ var TENANT_FIELD_PREFIX = "tnt-v1:";
 function _tenantFieldKey(tenantId, table) {
   // 32-byte symmetric key for XChaCha20-Poly1305. _deriveTenantKeyBytes
   // returns the raw key bound to the vault master + tenantId + purpose
-  // — see SUBSTRATE-5 commentary above _derivedKey for the threat
+  // — see the commentary above _derivedKey for the threat
   // model that drove this away from public-input-only derivation.
   return _deriveTenantKeyBytes(tenantId, "cryptoField:" + table);
 }
@@ -646,7 +646,7 @@ function _unsealRowForTenant(ctx, tenantId, table, row) {
     if (out[f] !== undefined && out[f] !== null) {
       try { out[f] = _unsealField(tenantId, table, f, out[f]); }
       catch (e) {
-        // BUG-4 — null-on-decrypt-failure was silent; the docstring
+        // Null-on-decrypt-failure was silent; the docstring
         // promised "audit chain surfaces the failure" but no emit ever
         // ran. Cross-tenant ciphertext replay / tampered row / wrong-
         // prefix all hit this path; operator audit pipelines need the

package/lib/vendor/blamejs/lib/agent-trace.js

@@ -70,7 +70,7 @@ var audit              = lazyRequire(function () { return require("./audit"); })
 
 var AgentTraceError = defineClass("AgentTraceError", { alwaysPermanent: true });
 
-// SUBSTRATE-24 — once-per-process audit emit on the first tracer
+// Once-per-process audit emit on the first tracer
 // failure each install fires. Operators get the signal even when
 // individual span calls are best-effort suppressed.
 var _failureAuditEmittedFor = Object.create(null);
@@ -122,7 +122,7 @@ function create(opts) {
     injectIntoEnvelope:  function (envelope, span)          { return _injectIntoEnvelope(opts.tracing, envelope, span); },
     extractFromEnvelope: function (envelope)                { return _extractFromEnvelope(envelope); },
     recordResult:        function (span, result, error)     { return _recordResult(span, result, error, auditImpl); },
-    // SUBSTRATE-17 — `shouldSample` now takes a traceId so the same
+    // `shouldSample` now takes a traceId so the same
     // trace gets the same decision across hops. Operator-supplied
     // traceId comes from the W3C `traceparent` header at request-
     // entry; absent that, falls back to Math.random (start of trace).
@@ -150,7 +150,7 @@ function _startSpan(tracing, name, sopts, auditImpl) {
       return tracing.startSpan(name, sopts);
     }
   } catch (e) {
-    // SUBSTRATE-24 — tracer failures should not crash the agent's
+    // Tracer failures should not crash the agent's
     // method call; surface the first failure to the audit chain
     // (rate-limited) so operators get the signal.
     _emitFirstFailureAudit(auditImpl, "startSpan", e && e.message);
@@ -206,7 +206,7 @@ function _extractFromEnvelope(envelope) {
 
 function _recordResult(span, result, error, auditImpl) {
   if (!span || typeof span !== "object") return;
-  // SUBSTRATE-24 — surface first occurrence of each span-op failure
+  // Surface first occurrence of each span-op failure
   // via audit so the operator gets the signal. Subsequent failures
   // stay silent (best-effort) per the operational spec.
   if (error) {
@@ -228,7 +228,7 @@ function _recordResult(span, result, error, auditImpl) {
   }
 }
 
-// SUBSTRATE-17 — deterministic sampling per W3C Trace Context §3.2.3.1.
+// Deterministic sampling per W3C Trace Context §3.2.3.1.
 // `Math.random` makes child-vs-parent sampling decisions non-coherent:
 // a parent span sampled OUT can still have child spans sampled IN,
 // producing orphaned spans operators can't correlate. Hashing the

package/lib/vendor/blamejs/lib/ai-disclosure.js

@@ -133,7 +133,7 @@ function chatbot(session, opts) {
   var text = typeof opts.text === "string" && opts.text.length > 0
     ? opts.text
     : DEFAULT_CHATBOT_TEXT;
-  // Codex P1A on v0.12.12 PR #163 — "on-request" placement gates on
+  // "on-request" placement gates on
   // the operator's explicit `opts.requested: true` signal. Without
   // it, "on-request" collapsed into "always" semantics and emitted
   // every call. The operator wires this from an explicit user
@@ -155,7 +155,7 @@ function chatbot(session, opts) {
     regulation:     "Regulation (EU) 2024/1689",
   };
   if (shouldEmit) {
-    // Codex P1B on v0.12.12 PR #163 — mark the session so subsequent
+    // Mark the session so subsequent
     // calls with the same session under "first-message" placement
     // see `aiDisclosureEmitted: true` and return shouldEmit=false.
     // Without this mutation operators had to remember to flip the
@@ -385,7 +385,7 @@ function applyAll(scenario) {
       "applyAll: scenario.kinds must be a non-empty array of " +
       "\"chatbot\" / \"deepfake\" / \"emotion\"");
   }
-  // Codex P1 on v0.12.25 PR #176 — validate every kind +
+  // Validate every kind +
   // per-kind required field UP FRONT, before any emission.
   // Previously a later-kind failure (e.g. deepfake missing
   // contentType, unknown trailing kind) ran AFTER earlier kinds

package/lib/vendor/blamejs/lib/app.js

@@ -113,7 +113,7 @@ function _resolveMiddlewareOpt(value, allowDefault, name) {
   if (value === false) {
     // Operator explicitly disabled this middleware. When it's one of the
     // security-on-by-default layers (allowDefault), leave an audit trace
-    // so the weakened posture is visible — Core Rule §3 security defaults
+    // so the weakened posture is visible — security defaults
     // shouldn't be silently opt-out-able. Drop-silent observability sink.
     if (allowDefault && name) {
       try {
@@ -227,7 +227,7 @@ async function createApp(opts) {
   var rateLimitOpts = _resolveMiddlewareOpt(mwConfig.rateLimit, false, "rateLimit");
   if (rateLimitOpts) router.use(middleware.rateLimit(rateLimitOpts));
 
-  // Security middleware wired ON by default (Core Rule §3). Each reads its
+  // Security middleware wired ON by default. Each reads its
   // config from opts.middleware.<name>: pass `false` to opt out (audited
   // via _resolveMiddlewareOpt), or an object to customize — operator cookie
   // / field names flow straight through, nothing static is baked in.

package/lib/vendor/blamejs/lib/archive-read.js

@@ -260,7 +260,7 @@ async function _readCentralDirectory(adapter, eocd) {
         "central directory entry " + n + " carries ZIP64 sentinel sizes (unsupported — use tar for >4 GiB / >65535 entries)");
     }
     // ZIP names are CP437 or UTF-8 (per FLAG_UTF8_NAME bit). Decode
-    // as UTF-8 unconditionally — Codex P2 territory if operators in
+    // as UTF-8 unconditionally — a concern if operators in
     // the wild rely on CP437; v0.12.7 ships UTF-8 only and operators
     // with legacy CP437-only producers reach for an external decoder.
     var name = cdBytes.slice(nameStart, nameStart + nameLen).toString("utf8");

package/lib/vendor/blamejs/lib/archive-tar-read.js

@@ -237,7 +237,7 @@ function tar(adapter, opts) {
       }
       var bodyStart = pos;
       var paddedSize = Math.ceil(hdr.size / BLOCK_SIZE) * BLOCK_SIZE;
-      // Codex P1 on v0.12.8 PR #159 — refuse truncated archives upfront.
+      // Refuse truncated archives upfront.
       // The walker advances `pos` by the declared padded block size; if
       // the buffer ends mid-body, extract() would silently slice a
       // partial payload (header says 11 bytes, buffer holds 8 — without

package/lib/vendor/blamejs/lib/archive-wrap.js

@@ -272,7 +272,7 @@ function _encryptForRecipient(bytes, opts) {
     };
   }
   if (r.publicKey) {
-    // Codex P2 on v0.12.10 PR #161 — b.crypto.encrypt falls back to
+    // B.crypto.encrypt falls back to
     // ML-KEM-only when ecPublicKey is undefined (with a one-shot
     // audit). For archive-wrap's recipient contract the hybrid leg
     // (P-384 ECDH defence-in-depth backstop on top of ML-KEM-1024)
@@ -343,7 +343,7 @@ function sniffEnvelope(bytes) {
   if (!Buffer.isBuffer(bytes) && !(bytes instanceof Uint8Array)) {
     return "none";
   }
-  // Codex P2A on v0.12.14 PR #165 — `Buffer.from(uint8Array)` copies
+  // `Buffer.from(uint8Array)` copies
   // the entire input, turning a constant-time 5-byte probe into an
   // O(n) allocation. Use the zero-copy view form so the sniff is
   // truly cheap regardless of input size.
@@ -351,7 +351,7 @@ function sniffEnvelope(bytes) {
     ? bytes
     : Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength);
   if (buf.length < 5) return "none";
-  // Codex P2B on v0.12.14 PR #165 — match on the 5-byte ASCII magic
+  // Match on the 5-byte ASCII magic
   // alone, NOT on the full header (which requires version + saltLen
   // bytes). A truncated envelope (`BAWRP` + nothing else) is still a
   // recipient envelope; the unwrap call surfaces the truncation with
@@ -413,7 +413,7 @@ async function wrapWithPassphrase(bytes, opts) {
   // alphabet. Operators sourcing passphrases from a random-bytes
   // generator (high entropy density) pass without issue; operators
   // typing dictionary phrases trip the gate.
-  // Codex P1 on v0.12.11 PR #162 — typeof NaN === "number" passes
+  // Typeof NaN === "number" passes
   // typeof gate but bypasses downstream comparisons. Use isFinite
   // so NaN / Infinity can't slip past the entropy gate.
   var minEntropy;
@@ -516,7 +516,7 @@ async function unwrapWithPassphrase(sealed, opts) {
 }
 
 function _estimatePassphraseEntropyBits(passphrase) {
-  // Codex P2 on v0.12.11 PR #162 — Buffer passphrases (CSPRNG-
+  // Buffer passphrases (CSPRNG-
   // generated random bytes) shouldn't be UTF-8 decoded for entropy
   // estimation; the decoding artifacts (invalid sequences, BOM,
   // surrogate pairs) make the alphabet-class measure unstable and