@blamejs/blamejs-shop 0.3.18 → 0.3.20

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.3.x
 
+- v0.3.20 (2026-05-30) — **Served media carries hardened headers, primary-image changes are product-scoped, and image-by-URL imports are size-capped.** Three defense-in-depth fixes on product media. Media assets served from storage now carry X-Content-Type-Options: nosniff and Cross-Origin-Resource-Policy: same-origin, and SVG files additionally carry a content policy that prevents script from running when the file is opened directly while still rendering normally inside a product image. Setting a product's primary image now verifies the image actually belongs to the product named in the request rather than acting on the image alone. And importing a product image by URL now refuses a response larger than the same 10 MiB limit the file-upload path enforces, instead of buffering an unbounded download. **Changed:** *Setting the primary image is product-scoped* — The endpoint that makes an image a product's primary (hero) now verifies the image belongs to the product in the request path and returns not-found otherwise, instead of acting on the image regardless of the product named. A request whose product and image don't match is now rejected. · *Vendored runtime updated to v0.14.9* — The vendored blamejs runtime is updated to v0.14.9, a documentation-path and source-comment fix with no API, wire-format, or behavior changes. No operator action is required. **Security:** *Hardened response headers on served media* — Media served from storage now sets X-Content-Type-Options: nosniff and Cross-Origin-Resource-Policy: same-origin, so a mistyped or hostile upload can't be content-sniffed into something executable or embedded cross-origin. An SVG additionally carries a default-src 'none' sandbox content-security policy, so opening an SVG URL directly cannot run script (it still renders inside an img tag). This sits behind the existing SVG-upload sanitizer as a second layer. · *Importing an image by URL is size-capped* — Importing a product image from a URL now refuses a response larger than 10 MiB — the same limit a direct file upload uses — returning a clear error instead of buffering an unbounded download.
+
+- v0.3.19 (2026-05-30) — **Edit announcement bars, automatic-discount terms, and subscription plans from the console.** Three admin entities could be created but only partly edited from the console — the rest of their fields were reachable only through the API, so changing them meant archive-and-recreate or a manual API call. Each now has a detail screen with the full edit form. An announcement bar can have its message, links, schedule, audience, and dismissibility changed in place. An automatic discount can have its actual terms changed — the amount, percentage, threshold, or buy-x-get-y values — not just its title, priority, and on/off state. A subscription plan can have its price, billing interval, trial length, active state, and variant edited. Create and archive behavior is unchanged. **Fixed:** *Announcement bars are editable in place* — A detail screen now lets you change an announcement's message, link, theme, audience, start/end schedule, and whether it can be dismissed — instead of archiving it and creating a new one (which lost the slug and any recorded dismissal state). · *Automatic-discount terms are editable from the console* — The discount detail screen now edits the rule's trigger and value — the amount off, percent off, cart threshold, or buy-x-get-y terms — which previously could only be changed through the API. The inline priority and on/off controls are unchanged. · *Subscription plans have an edit screen* — A subscription plan's price, billing interval count, trial length, active state, and variant can now be edited from a detail screen. The Stripe-bound fields (the price id, interval unit, and currency) remain read-only, as they were always immutable.
+
 - v0.3.18 (2026-05-30) — **Write and publish blog posts from the admin console.** The storefront already served a blog — the index at /blog, individual posts at /blog/:slug, an RSS feed, and sitemap entries — but there was no way to write a post, so it rendered empty. The admin console now has a Blog screen with the full lifecycle: create a draft, edit its title, body (Markdown), tags, hero image, and meta fields, publish it, unpublish it, and archive or restore it. A post is created as a draft and stays off the storefront until it is explicitly published, so work in progress is never visible to shoppers. **Added:** *Blog authoring in the admin console* — A new Blog screen lists posts by status and lets an operator create, edit, publish, unpublish, archive, and restore them. New posts start as drafts and do not appear on the storefront /blog, its RSS feed, or the sitemap until published; archiving removes a published post from the storefront and is reversible. This wires the admin over the blog backend that was already serving the customer-facing pages.
 
 - v0.3.17 (2026-05-30) — **Search results paginate with an accurate count, and collection pages get canonical URLs.** Two customer-facing storefront fixes. Search no longer stops at the first 24 products: the result count now reports the true number of matches instead of the page size, and numbered page links (with prev/next) make every matching product reachable while preserving the active query and filters. Separately, collection pages now emit a correct canonical and og:url so search engines and shared links resolve to one address, while the cart and account pages — which should not be indexed — are explicitly marked noindex. **Fixed:** *Search shows the real match count and paginates* — The search results page previously capped at 24 products, discarded the real total, and reported the page size as the match count — so anything past the first 24 was unreachable and the count was wrong. It now computes the true total, shows it in the "Showing N matches" summary, and adds no-JavaScript numbered page links (with prev/next) that carry the active query and facet filters, so every matching product can be reached. · *Collection pages have canonical URLs; cart and account are noindex* — Collection pages now emit an absolute canonical and og:url derived from the request host, so indexers and shared links resolve to a single address instead of an empty tag. The cart and account pages, which are not meant to be indexed, now carry a noindex robots tag in their markup, consistent on both the edge and container render paths.

package/lib/admin.js

@@ -1086,6 +1086,18 @@ function mount(router, deps) {
 
   // ---- media ----------------------------------------------------------
 
+  // True when media `mid` exists AND its product_id equals `productId` — the
+  // self-consistency check the per-product media routes assert before acting,
+  // so a `/admin/products/:id/media/:mid/...` request can't name product A in
+  // the path while operating on product B's media. A malformed `mid` makes
+  // catalog.media.get throw TypeError (the caller maps it to a clean 400);
+  // an unknown id, a foreign-product id, or a variant-only row (no
+  // product_id) returns false so the caller renders the same not-found.
+  async function _mediaBelongsToProduct(mid, productId) {
+    var row = await catalog.media.get(mid);
+    return !!(row && row.product_id && row.product_id === productId);
+  }
+
   router.post("/admin/media", W("media.attach", async function (req, res) {
     var m = await catalog.media.attach(req.body || {});
     _json(res, 201, m);
@@ -1156,16 +1168,28 @@ function mount(router, deps) {
       // Fetch the source bytes. The framework's httpClient runs every
       // outbound through the SSRF gate, so a `source_url` pointing at
       // a cloud-metadata IP (169.254.169.254) / RFC 1918 host can't
-      // smuggle internal data into the bucket.
+      // smuggle internal data into the bucket. `maxResponseBytes` caps the
+      // buffered body at the same media budget the direct-file path enforces
+      // (`_UPLOAD_MAX_BYTES`): without it the client buffers up to its
+      // ~1 GiB GET default, so a `source_url` pointing at a multi-gigabyte
+      // resource would balloon memory before the magic-byte sniff ever runs.
+      // The client rejects with `RESPONSE_TOO_LARGE` the moment the body
+      // crosses the cap; that surfaces below as a clean 413, never an OOM or
+      // a 500.
       var fetched;
       try {
         fetched = await b.httpClient.request({
-          method:    "GET",
-          url:       body.source_url,
-          timeoutMs: 20000,
-          headers:   { "accept": body.content_type + ",*/*;q=0.5" },
+          method:           "GET",
+          url:              body.source_url,
+          timeoutMs:        20000,
+          maxResponseBytes: _UPLOAD_MAX_BYTES,
+          headers:          { "accept": body.content_type + ",*/*;q=0.5" },
         });
       } catch (e) {
+        if (e && e.code === "RESPONSE_TOO_LARGE") {
+          return { status: 413, code: "source-too-large",
+            detail: "source_url body exceeds the " + _UPLOAD_MAX_BYTES + "-byte media upload cap" };
+        }
         return { status: 502, code: "source-fetch-failed", detail: (e && e.message) || String(e) };
       }
       if (fetched.statusCode < 200 || fetched.statusCode >= 300) {
@@ -1515,10 +1539,23 @@ function mount(router, deps) {
   // id is in the path, the product id only used to PRG back to the detail.
   // A malformed id throws TypeError (→ 400 / ?err=1); an unknown or
   // variant-only row returns false (→ 404 / ?err=1). DB-only.
+  //
+  // The :id (product) path segment is asserted against the media row's own
+  // product_id before the promote: the primitive scopes its reorder by the
+  // row's product, so naming product A in the path while pointing :mid at
+  // product B's media would silently act on B. Refuse that mismatch (and a
+  // variant-only row, which has no product to lead) with the same clean
+  // not-found status, so the path is self-consistent and the contract
+  // doesn't lie about which product it touched.
   router.post("/admin/products/:id/media/:mid/primary", _pageOrApi(false,
     W("media.set_primary", async function (req, res) {
       var ok;
-      try { ok = await catalog.media.setPrimary(req.params.mid); }
+      try {
+        if (!(await _mediaBelongsToProduct(req.params.mid, req.params.id))) {
+          return _problem(res, 404, "media-not-found");
+        }
+        ok = await catalog.media.setPrimary(req.params.mid);
+      }
       catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
       if (!ok) return _problem(res, 404, "media-not-found");
       _json(res, 200, { ok: true });
@@ -1528,7 +1565,12 @@ function mount(router, deps) {
       var id  = req.params.id;
       var enc = encodeURIComponent(id);
       var ok = false;
-      try { ok = await catalog.media.setPrimary(req.params.mid); }
+      try {
+        if (!(await _mediaBelongsToProduct(req.params.mid, id))) {
+          return _redirect(res, "/admin/products/" + enc + "?err=1");
+        }
+        ok = await catalog.media.setPrimary(req.params.mid);
+      }
       catch (e) {
         _safeNotice(e, "media.set_primary");
         return _redirect(res, "/admin/products/" + enc + "?err=1");
@@ -4005,6 +4047,55 @@ function mount(router, deps) {
       },
     ));
 
+    // Detail screen: the single announcement + its edit form. Content-
+    // negotiates like the list — bearer → the JSON row; browser cookie →
+    // the rendered edit page. A bad / unknown slug is a 404 page (browser)
+    // or 404 problem (bearer), never a 500.
+    router.get("/admin/announcements/:slug", _pageOrApi(true,
+      R(async function (req, res) {
+        var row = await announcements.getAnnouncement(req.params.slug);
+        if (!row) return _problem(res, 404, "announcement-not-found");
+        _json(res, 200, row);
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var row = await announcements.getAnnouncement(req.params.slug);
+        if (!row) return _sendHtml(res, 404, renderAdminAnnouncements({
+          shop_name: deps.shop_name, nav_available: navAvailable, announcements: [], notice: "Announcement not found.",
+        }));
+        _sendHtml(res, 200, renderAdminAnnouncement({
+          shop_name: deps.shop_name, nav_available: navAvailable, announcement: row,
+          updated: url && url.searchParams.get("updated"),
+          notice:  (url && url.searchParams.get("err")) ? "That action couldn't be completed for the announcement." : null,
+        }));
+      },
+    ));
+
+    // Edit content-negotiates: bearer POST /edit (JSON) + browser POST
+    // /edit (HTML forms can't PATCH). Both forward the full editable
+    // column set — message, link, audience, schedule, dismissible — into
+    // updateAnnouncement, preserving the slug + accumulated dismissal
+    // state (archive-and-recreate would discard both). PRG to ?updated=1;
+    // a bad shape is a clean 400 (bearer) / err notice (browser).
+    router.post("/admin/announcements/:slug/edit", _pageOrApi(false,
+      W("announcement.update", async function (req, res) {
+        var row;
+        try { row = await announcements.updateAnnouncement(req.params.slug, _announcementPatchFromForm(req.body || {})); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        if (!row) return _problem(res, 404, "announcement-not-found");
+        _json(res, 200, row);
+        return { id: row.slug };
+      }),
+      async function (req, res) {
+        var slug = req.params.slug;
+        var enc = encodeURIComponent(slug);
+        try { await announcements.updateAnnouncement(slug, _announcementPatchFromForm(req.body || {})); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; return _redirect(res, "/admin/announcements/" + enc + "?err=1"); }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".announcement.update", outcome: "success", metadata: { slug: slug } });
+        _redirect(res, "/admin/announcements/" + enc + "?updated=1");
+      },
+    ));
+
     router.post("/admin/announcements/:slug/archive", _pageOrApi(false,
       W("announcement.archive", async function (req, res) {
         var row;
@@ -4810,6 +4901,29 @@ function mount(router, deps) {
 
   var subscriptions = deps.subscriptions || null;
   if (subscriptions) {
+    // Coerce the edit form into a plans.update patch. Only the mutable
+    // columns are forwarded; an absent / blank field is omitted so a
+    // partial edit leaves the rest untouched. amount_minor /
+    // interval_count / trial_days go through the strict integer reader so
+    // "", a float, or "12abc" is refused as a clean 400 rather than
+    // coerced. active rides a hidden presence marker so a value-only edit
+    // doesn't flip it. variant_id="" links the plan to no variant
+    // (standalone); the immutable Stripe-bound columns are never on the
+    // form.
+    function _subscriptionPlanPatchFromForm(body) {
+      body = body || {};
+      var patch = {};
+      if (body.amount_minor   != null && body.amount_minor   !== "") patch.amount_minor   = _strictMinorInt(body.amount_minor, "subscriptions", "amount_minor (minor units)");
+      if (body.interval_count != null && body.interval_count !== "") patch.interval_count = _strictMinorInt(body.interval_count, "subscriptions", "interval_count");
+      if (body.trial_days     != null && body.trial_days     !== "") patch.trial_days     = _strictMinorInt(body.trial_days, "subscriptions", "trial_days");
+      if (body.active_present === "1") patch.active = (body.active === "on" || body.active === "1");
+      if (Object.prototype.hasOwnProperty.call(body, "variant_id")) {
+        var vid = typeof body.variant_id === "string" ? body.variant_id.trim() : body.variant_id;
+        patch.variant_id = vid ? vid : null;
+      }
+      return patch;
+    }
+
     // Create content-negotiates: bearer → JSON (unchanged for tooling);
     // signed-in browser form → create, then PRG back to the catalog (a
     // bad-shape submit re-renders the form with the validator's message
@@ -4874,19 +4988,74 @@ function mount(router, deps) {
       },
     ));
 
-    router.get("/admin/subscription-plans/:id", R(async function (req, res) {
-      var p = await subscriptions.plans.get(req.params.id);
-      if (!p) return _problem(res, 404, "subscription-plan-not-found");
-      _json(res, 200, p);
-    }));
+    // Detail screen content-negotiates: bearer → the JSON plan (the
+    // tooling contract, unchanged); browser cookie → the rendered detail
+    // + edit page. A malformed / unknown id is a 404 either way, never a
+    // 500. (Previously this route was bearer-JSON-only, so the console
+    // had no way to change a plan's price / interval-count / trial after
+    // create — only archive-and-recreate against a fresh Stripe price.)
+    router.get("/admin/subscription-plans/:id", _pageOrApi(true,
+      R(async function (req, res) {
+        var p;
+        try { p = await subscriptions.plans.get(req.params.id); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 404, "subscription-plan-not-found", e.message); throw e; }
+        if (!p) return _problem(res, 404, "subscription-plan-not-found");
+        _json(res, 200, p);
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var p = null;
+        try { p = await subscriptions.plans.get(req.params.id); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; p = null; }
+        if (!p) return _sendHtml(res, 404, renderAdminSubscriptionPlans({
+          shop_name: deps.shop_name, nav_available: navAvailable, plans: [], notice: "Subscription plan not found.",
+        }));
+        _sendHtml(res, 200, renderAdminSubscriptionPlan({
+          shop_name: deps.shop_name, nav_available: navAvailable, plan: p,
+          updated: url && url.searchParams.get("updated"),
+          notice:  (url && url.searchParams.get("err")) ? "That action couldn't be completed for the plan." : null,
+        }));
+      },
+    ));
 
     router.patch("/admin/subscription-plans/:id", W("subscription_plan.update", async function (req, res) {
-      var p = await subscriptions.plans.update(req.params.id, req.body || {});
+      var p;
+      try { p = await subscriptions.plans.update(req.params.id, req.body || {}); }
+      catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
       if (!p) return _problem(res, 404, "subscription-plan-not-found");
       _json(res, 200, p);
       return p;
     }));
 
+    // Browser edit alias for the PATCH (HTML forms can't PATCH). Forwards
+    // the mutable columns — amount / interval_count / trial_days / active
+    // / variant_id — through plans.update; the immutable Stripe-bound
+    // columns (stripe_price_id / interval / currency) are not on the form
+    // (changing those is archive-and-recreate). A bad value is a clean
+    // 400 (bearer) / err notice (browser), never a 500 or partial write.
+    router.post("/admin/subscription-plans/:id/edit", _pageOrApi(false,
+      W("subscription_plan.update", async function (req, res) {
+        var p;
+        try { p = await subscriptions.plans.update(req.params.id, _subscriptionPlanPatchFromForm(req.body || {})); }
+        catch (e) { if (e instanceof TypeError) return _problem(res, 400, "bad-request", e.message); throw e; }
+        if (!p) return _problem(res, 404, "subscription-plan-not-found");
+        _json(res, 200, p);
+        return p;
+      }),
+      async function (req, res) {
+        var id = req.params.id;
+        var enc = encodeURIComponent(id);
+        var updated = null;
+        try { updated = await subscriptions.plans.update(id, _subscriptionPlanPatchFromForm(req.body || {})); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; return _redirect(res, "/admin/subscription-plans/" + enc + "?err=1"); }
+        // A well-formed-but-unknown id (stale / tampered form) updates no
+        // row — plans.update returns null. Flag err, never a false success.
+        if (!updated) return _redirect(res, "/admin/subscription-plans/" + enc + "?err=1");
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".subscription_plan.update", outcome: "success", metadata: { id: id } });
+        _redirect(res, "/admin/subscription-plans/" + enc + "?updated=1");
+      },
+    ));
+
     // Browser confirmation interstitial for archive — terminal from the
     // console (a retired plan is replaced by creating a new one against a
     // fresh Stripe price id, never reactivated in place), so confirm it.
@@ -5858,6 +6027,30 @@ function mount(router, deps) {
       return { id: rule.slug };
     }));
 
+    // Detail screen: the single rule + a full edit form covering the
+    // trigger + value terms (not just priority/active). Content-
+    // negotiates like the list — bearer → the JSON rule; browser cookie
+    // → the rendered edit page.
+    router.get("/admin/discounts/:slug", _pageOrApi(true,
+      R(async function (req, res) {
+        var rule = await autoDiscount.getRule(req.params.slug);
+        if (!rule) return _problem(res, 404, "auto-discount-not-found");
+        _json(res, 200, rule);
+      }),
+      async function (req, res) {
+        var url = req.url ? new URL(req.url, "http://localhost") : null;
+        var rule = await autoDiscount.getRule(req.params.slug);
+        if (!rule) return _sendHtml(res, 404, await _renderDiscounts({
+          notice: "Discount rule not found.",
+        }));
+        _sendHtml(res, 200, renderAdminDiscount({
+          shop_name: deps.shop_name, nav_available: navAvailable, rule: rule,
+          updated: url && url.searchParams.get("updated"),
+          notice:  (url && url.searchParams.get("err")) ? "That action couldn't be completed for the rule." : null,
+        }));
+      },
+    ));
+
     router.post("/admin/discounts/:slug/edit", _pageOrApi(false,
       W("auto_discount.update", async function (req, res) {
         var rule;
@@ -5867,9 +6060,18 @@ function mount(router, deps) {
         return { id: rule.slug };
       }),
       async function (req, res) {
-        try { await autoDiscount.updateRule(req.params.slug, _discountPatch(req.body || {})); }
-        catch (e) { if (!(e instanceof TypeError)) throw e; return _redirect(res, "/admin/discounts?err=1"); }
-        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".auto_discount.update", outcome: "success", metadata: { slug: req.params.slug } });
+        var slug = req.params.slug;
+        // A terms edit (trigger/value) comes from the detail screen and
+        // returns there on error so the operator sees their input in
+        // context; the inline row edit (priority/active only) stays on
+        // the list. Success PRGs to the list's ?updated banner either way.
+        var fromDetail = (req.body && (req.body.trigger_kind || req.body.value_kind));
+        var errHref = fromDetail
+          ? "/admin/discounts/" + encodeURIComponent(slug) + "?err=1"
+          : "/admin/discounts?err=1";
+        try { await autoDiscount.updateRule(slug, _discountPatch(req.body || {})); }
+        catch (e) { if (!(e instanceof TypeError)) throw e; return _redirect(res, errHref); }
+        b.audit.safeEmit({ action: AUDIT_NAMESPACE + ".auto_discount.update", outcome: "success", metadata: { slug: slug } });
         _redirect(res, "/admin/discounts?updated=1");
       },
     ));
@@ -6263,15 +6465,24 @@ function mount(router, deps) {
     return { kind: "free_shipping" };
   }
 
-  // Translate the rule edit form into an updateRule patch — title /
-  // priority / active. The trigger + value re-set go through the bearer
-  // JSON PATCH for the full vocabulary; the console edit is the common
-  // "rename / re-prioritise / pause" gesture.
+  // Translate the rule edit form into an updateRule patch. The inline
+  // row form covers the common "rename / re-prioritise / pause" gesture
+  // (title / priority / active); the detail screen additionally posts a
+  // trigger_kind + value_kind so an operator can change the actual
+  // discount terms (amount / percentage / threshold / BOGO) from the
+  // console, not just reprioritise. The trigger / value kind fields are
+  // reused from the create form's vocabulary via _discountTrigger /
+  // _discountValue, which throw a TypeError on a bad / missing required
+  // field — so a bad terms edit degrades to a clean 400, never a 500,
+  // and never a silent partial write. The richer applies_to / segment /
+  // exclusion vocabulary stays on the bearer JSON PATCH.
   function _discountPatch(body) {
     var patch = {};
     if (Object.prototype.hasOwnProperty.call(body, "title") && body.title !== "") patch.title = body.title;
     if (body.priority != null && body.priority !== "") patch.priority = _strictMinorInt(body.priority, "autoDiscount", "priority");
     if (body.active_present === "1") patch.active = (body.active === "on" || body.active === "1");
+    if (body.trigger_kind != null && body.trigger_kind !== "") patch.trigger = _discountTrigger(body);
+    if (body.value_kind   != null && body.value_kind   !== "") patch.value   = _discountValue(body);
     return patch;
   }
 
@@ -8163,6 +8374,56 @@ function renderAdminInventory(opts) {
   return _renderAdminShell(opts.shop_name, "Inventory", bodyHtml, "inventory", opts.nav_available);
 }
 
+// Single subscription-plan detail + edit form. The Stripe-bound columns
+// (price id / interval / currency) are immutable post-create — shown
+// read-only — because they mirror a recurring Stripe Price; to change
+// those an operator archives the plan and creates a new one against a
+// fresh price id. The mutable columns (amount / interval count / trial /
+// active / variant link) are editable here.
+function renderAdminSubscriptionPlan(opts) {
+  opts = opts || {};
+  var p = opts.plan;
+  if (!p) {
+    var nf = "<section><h2>Subscription plan</h2><p class=\"empty\">Subscription plan not found.</p>" +
+      "<div class=\"actions-row\"><a class=\"btn btn--ghost\" href=\"/admin/subscription-plans\">Back to plans</a></div></section>";
+    return _renderAdminShell(opts.shop_name, "Subscription plan", nf, "subscriptions", opts.nav_available);
+  }
+  var updated = opts.updated ? "<div class=\"banner banner--ok\">Plan updated.</div>" : "";
+  var notice  = opts.notice  ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+  var isActive = p.active === 1 || p.active === true;
+  var cur = String(p.currency || "").toUpperCase();
+  var every = p.interval_count > 1 ? p.interval_count + " " + p.interval + "s" : p.interval;
+
+  var summary =
+    "<div class=\"panel\"><dl class=\"detail-grid\">" +
+      "<div><dt>Price</dt><dd><strong>" + _htmlEscape(pricing.format(p.amount_minor, cur) + " / " + every) + "</strong></dd></div>" +
+      "<div><dt>Stripe price</dt><dd><code class=\"order-id\">" + _htmlEscape(p.stripe_price_id) + "</code></dd></div>" +
+      "<div><dt>Variant</dt><dd>" + (p.variant_id ? "<code class=\"order-id\">" + _htmlEscape(String(p.variant_id)) + "</code>" : "<span class=\"meta\">standalone</span>") + "</dd></div>" +
+      "<div><dt>Trial</dt><dd>" + (p.trial_days ? _htmlEscape(String(p.trial_days)) + " days" : "<span class=\"meta\">none</span>") + "</dd></div>" +
+      "<div><dt>Status</dt><dd><span class=\"status-pill " + (isActive ? "paid" : "cancelled") + "\">" + (isActive ? "active" : "archived") + "</span></dd></div>" +
+    "</dl></div>";
+
+  var editForm = !isActive
+    ? "<p class=\"empty\">This plan is archived and can no longer be edited. Create a new plan against a fresh Stripe price id to offer it again.</p>"
+    : "<div class=\"panel mw-34\">" +
+        "<h3 class=\"subhead\">Edit plan</h3>" +
+        "<p class=\"meta\">The Stripe price id, billing interval, and currency are fixed — they mirror the Stripe Price. To change those, archive this plan and create a new one.</p>" +
+        "<form method=\"post\" action=\"/admin/subscription-plans/" + _htmlEscape(p.id) + "/edit\">" +
+          "<input type=\"hidden\" name=\"active_present\" value=\"1\">" +
+          _setupField("Amount (minor units)", "amount_minor", String(p.amount_minor), "number", "In the currency's smallest unit — e.g. 1999 = $19.99.", " min=\"1\"") +
+          _setupField("Interval count", "interval_count", String(p.interval_count), "number", "Bill every N " + _htmlEscape(p.interval) + "s (1–12).", " min=\"1\" max=\"12\"") +
+          _setupField("Trial days", "trial_days", String(p.trial_days), "number", "Free trial length before the first charge (0–730).", " min=\"0\" max=\"730\"") +
+          _setupField("Variant id (optional)", "variant_id", p.variant_id ? String(p.variant_id) : "", "text", "Link to a storefront variant, or clear for a standalone tier.", " maxlength=\"64\"") +
+          "<label class=\"kv\"><input type=\"checkbox\" name=\"active\" checked> Active</label>" +
+          "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Save changes</button></div>" +
+        "</form>" +
+      "</div>";
+
+  var bodyHtml = "<section><h2>Subscription plan</h2>" + updated + notice + summary + editForm +
+    "<div class=\"actions-row\"><a class=\"btn btn--ghost\" href=\"/admin/subscription-plans\">Back to plans</a></div></section>";
+  return _renderAdminShell(opts.shop_name, "Subscription plan", bodyHtml, "subscriptions", opts.nav_available);
+}
+
 function renderAdminSubscriptionPlans(opts) {
   opts = opts || {};
   var rows = opts.plans || [];
@@ -8188,9 +8449,10 @@ function renderAdminSubscriptionPlans(opts) {
     var price = pricing.format(p.amount_minor, String(p.currency || "").toUpperCase()) + " / " + every;
     var isActive = p.active === 1 || p.active === true;
     var archiveCell = isActive
-      ? "<form method=\"post\" action=\"/admin/subscription-plans/" + _htmlEscape(p.id) + "/archive/confirm\" class=\"form-inline\">" +
+      ? "<a class=\"btn btn--ghost\" href=\"/admin/subscription-plans/" + _htmlEscape(p.id) + "\">Edit</a> " +
+        "<form method=\"post\" action=\"/admin/subscription-plans/" + _htmlEscape(p.id) + "/archive/confirm\" class=\"form-inline\">" +
           "<button class=\"btn btn--ghost\" type=\"submit\">Archive</button></form>"
-      : "<span class=\"meta\">—</span>";
+      : "<a class=\"btn btn--ghost\" href=\"/admin/subscription-plans/" + _htmlEscape(p.id) + "\">View</a>";
     return "<tr>" +
       "<td><strong>" + _htmlEscape(price) + "</strong>" +
         (p.trial_days ? " <span class=\"status-pill pending\">" + _htmlEscape(String(p.trial_days)) + "d trial</span>" : "") + "</td>" +
@@ -8733,6 +8995,83 @@ function _fmtValue(v) {
   return v.kind;
 }
 
+// Single auto-discount rule detail + a full edit form. Unlike the
+// inline row form (priority/active only), this form re-collects the
+// trigger + value terms so an operator can change the amount / percent
+// / threshold / BOGO quantities from the console. The trigger / value
+// field set mirrors the create form exactly; each kind's fields are
+// prefilled from the rule's current terms, and the operator fills the
+// ones the chosen kind needs (the backend validates the required
+// fields for the kind). The hidden active_present marker keeps a
+// terms-only edit from flipping active.
+function renderAdminDiscount(opts) {
+  opts = opts || {};
+  var r = opts.rule;
+  if (!r) {
+    var nf = "<section><h2>Discount rule</h2><p class=\"empty\">Discount rule not found.</p>" +
+      "<div class=\"actions-row\"><a class=\"btn btn--ghost\" href=\"/admin/discounts\">Back to discounts</a></div></section>";
+    return _renderAdminShell(opts.shop_name, "Discount rule", nf, "discounts", opts.nav_available);
+  }
+  var updated = opts.updated ? "<div class=\"banner banner--ok\">Rule updated.</div>" : "";
+  var notice  = opts.notice  ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+  var isArchived = r.archived_at != null;
+  var t = r.trigger || {};
+  var v = r.value || {};
+
+  var TRIGGERS = [
+    { value: "cart_total_min", label: "Cart total ≥ (minor)" },
+    { value: "item_count_min", label: "Item count ≥" },
+    { value: "sku_purchase",   label: "SKU purchased" },
+  ];
+  var VALUES = [
+    { value: "percent_off",      label: "Percent off" },
+    { value: "amount_off_total", label: "Amount off total" },
+    { value: "amount_off_each",  label: "Amount off each" },
+    { value: "free_shipping",    label: "Free shipping" },
+    { value: "bogo",             label: "Buy X get Y" },
+  ];
+  // For amount_off_total / amount_off_each the lib stores one `minor`
+  // field; prefill it for whichever amount kind is active.
+  var amountMinor = (v.kind === "amount_off_total" || v.kind === "amount_off_each") && v.minor != null ? String(v.minor) : "";
+
+  var editForm = isArchived
+    ? "<p class=\"empty\">This rule is archived and can no longer be edited.</p>"
+    : "<div class=\"panel mw-42\">" +
+        "<h3 class=\"subhead\">Edit rule</h3>" +
+        "<p class=\"meta\">Change the trigger, the value, or the priority. Fill the fields for the trigger / value kind you pick — the others are ignored.</p>" +
+        "<form method=\"post\" action=\"/admin/discounts/" + _htmlEscape(encodeURIComponent(r.slug)) + "/edit\">" +
+          "<input type=\"hidden\" name=\"active_present\" value=\"1\">" +
+          _setupField("Title", "title", r.title, "text", "Operator-facing name.", " maxlength=\"200\"") +
+          _selectField("Trigger kind", "trigger_kind", TRIGGERS, t.kind || "cart_total_min", "What fires the rule.", "") +
+          _setupField("· Cart total min (minor)", "trigger_min_minor", t.kind === "cart_total_min" && t.min_minor != null ? String(t.min_minor) : "", "number", "For \"Cart total ≥\".", " min=\"0\"") +
+          _setupField("· Item count min", "trigger_min_count", t.kind === "item_count_min" && t.min_count != null ? String(t.min_count) : "", "number", "For \"Item count ≥\".", " min=\"1\"") +
+          _setupField("· SKUs (comma-separated)", "trigger_skus", t.kind === "sku_purchase" && Array.isArray(t.skus) ? t.skus.join(",") : "", "text", "For \"SKU purchased\".", " maxlength=\"2000\"") +
+          _setupField("· SKU min quantity", "trigger_min_quantity", t.kind === "sku_purchase" && t.min_quantity != null ? String(t.min_quantity) : "", "number", "For \"SKU purchased\" (default 1).", " min=\"1\"") +
+          _selectField("Value kind", "value_kind", VALUES, v.kind || "percent_off", "What the rule gives.", "") +
+          _setupField("· Percent (basis points)", "value_basis_points", v.kind === "percent_off" && v.basis_points != null ? String(v.basis_points) : "", "number", "For \"Percent off\". 1000 = 10.00%.", " min=\"1\" max=\"10000\"") +
+          _setupField("· Amount (minor)", "value_minor", amountMinor, "number", "For \"Amount off total / each\".", " min=\"1\"") +
+          _setupField("· BOGO buy qty", "value_buy_qty", v.kind === "bogo" && v.buy_qty != null ? String(v.buy_qty) : "", "number", "For \"Buy X get Y\".", " min=\"1\"") +
+          _setupField("· BOGO get qty", "value_get_qty", v.kind === "bogo" && v.get_qty != null ? String(v.get_qty) : "", "number", "For \"Buy X get Y\".", " min=\"1\"") +
+          _setupField("Priority", "priority", String(r.priority), "number", "Higher wins ties.", " min=\"0\"") +
+          "<label class=\"kv\"><input type=\"checkbox\" name=\"active\"" + (r.active ? " checked" : "") + "> Active</label>" +
+          "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Save changes</button></div>" +
+        "</form>" +
+      "</div>";
+
+  var bodyHtml = "<section><h2>Discount rule</h2>" + updated + notice +
+    "<div class=\"panel\"><dl class=\"detail-grid\">" +
+      "<div><dt>Rule</dt><dd><strong>" + _htmlEscape(r.title) + "</strong><br><code class=\"order-id\">" + _htmlEscape(r.slug) + "</code></dd></div>" +
+      "<div><dt>Trigger</dt><dd>" + _htmlEscape(_fmtTrigger(r.trigger)) + "</dd></div>" +
+      "<div><dt>Value</dt><dd>" + _htmlEscape(_fmtValue(r.value)) + "</dd></div>" +
+      "<div><dt>Priority</dt><dd>" + _htmlEscape(String(r.priority)) + "</dd></div>" +
+      "<div><dt>Status</dt><dd><span class=\"status-pill " + (isArchived ? "cancelled" : (r.active ? "paid" : "pending")) + "\">" + (isArchived ? "archived" : (r.active ? "active" : "paused")) + "</span></dd></div>" +
+    "</dl></div>" +
+    editForm +
+    "<div class=\"actions-row\"><a class=\"btn btn--ghost\" href=\"/admin/discounts\">Back to discounts</a></div>" +
+  "</section>";
+  return _renderAdminShell(opts.shop_name, "Discount rule", bodyHtml, "discounts", opts.nav_available);
+}
+
 function renderAdminDiscounts(opts) {
   opts = opts || {};
   var rules = opts.rules || [];
@@ -8755,6 +9094,7 @@ function renderAdminDiscounts(opts) {
         "<label class=\"kv\"><input type=\"checkbox\" name=\"active\"" + (r.active ? " checked" : "") + "> on</label>" +
         "<button class=\"btn btn--ghost\" type=\"submit\">Save</button>" +
       "</form> " +
+      "<a class=\"btn btn--ghost\" href=\"/admin/discounts/" + _htmlEscape(encodeURIComponent(r.slug)) + "\">Edit terms</a> " +
       "<form method=\"post\" action=\"/admin/discounts/" + _htmlEscape(encodeURIComponent(r.slug)) + "/archive\" class=\"form-inline\">" +
         "<button class=\"btn btn--danger\" type=\"submit\">Archive</button></form>";
     return "<tr>" +
@@ -9249,6 +9589,112 @@ function _announcementFromForm(body) {
   return out;
 }
 
+// Coerce the edit form into an updateAnnouncement patch. Every editable
+// column the primitive's whitelist accepts is forwarded so a console
+// edit reaches the same surface as the bearer PATCH: message, theme,
+// audience, dismissible, the link pair, and the two schedule bounds.
+// The schedule + link fields use the form's hidden presence markers so
+// a partial edit doesn't unintentionally clear an unrelated column: a
+// link_present marker maps a blank pair to null (clear the link); a
+// starts_present / expires_present marker maps a blank bound to null
+// (open the schedule). Absent markers leave the column untouched. The
+// primitive validates the result (audience<->segment, link both-or-
+// neither, expires>starts) and throws a TypeError on a bad shape, which
+// both surfaces degrade to a clean 400 / err notice.
+function _announcementPatchFromForm(body) {
+  body = body || {};
+  var patch = {};
+  if (Object.prototype.hasOwnProperty.call(body, "message") && body.message !== "") patch.message = body.message;
+  if (body.theme    != null && body.theme    !== "") patch.theme = body.theme;
+  if (body.audience != null && body.audience !== "") patch.audience = body.audience;
+  // The dismissible checkbox is present (on/1) when checked, absent when
+  // unchecked — only treat it as a field when the form declared the
+  // hidden marker so a partial JSON edit doesn't flip it.
+  if (body.dismissible_present === "1") patch.dismissible = (body.dismissible === "on" || body.dismissible === "1");
+  if (body.link_present === "1") {
+    var lu = typeof body.link_url === "string" ? body.link_url.trim() : "";
+    var ll = typeof body.link_label === "string" ? body.link_label.trim() : "";
+    if (lu || ll) { patch.link_url = lu; patch.link_label = ll; }
+    else { patch.link_url = null; patch.link_label = null; }
+  }
+  if (body.starts_present === "1")  patch.starts_at  = _epochFromForm(body.starts_at);
+  if (body.expires_present === "1") patch.expires_at = _epochFromForm(body.expires_at);
+  return patch;
+}
+
+// epoch ms → the <datetime-local> value an <input> renders back. Returns
+// "" for a null/absent bound so the field stays empty (open-ended).
+function _datetimeLocalValue(epochMs) {
+  if (epochMs == null) return "";
+  var d = new Date(Number(epochMs));
+  if (isNaN(d.getTime())) return "";
+  function _pad(n) { return n < 10 ? "0" + n : String(n); }
+  return d.getUTCFullYear() + "-" + _pad(d.getUTCMonth() + 1) + "-" + _pad(d.getUTCDate()) +
+    "T" + _pad(d.getUTCHours()) + ":" + _pad(d.getUTCMinutes());
+}
+
+// Single-announcement detail + edit screen. The form prefills every
+// editable column and posts to /edit; the hidden presence markers tell
+// the patch coercion which columns the form is authoritative for, so a
+// blank schedule / link clears rather than being ignored.
+function renderAdminAnnouncement(opts) {
+  opts = opts || {};
+  var a = opts.announcement;
+  if (!a) {
+    var nf = "<section><h2>Announcement</h2><p class=\"empty\">Announcement not found.</p>" +
+      "<div class=\"actions-row\"><a class=\"btn btn--ghost\" href=\"/admin/announcements\">Back to announcements</a></div></section>";
+    return _renderAdminShell(opts.shop_name, "Announcement", nf, "announcements", opts.nav_available);
+  }
+  var updated = opts.updated ? "<div class=\"banner banner--ok\">Announcement updated.</div>" : "";
+  var notice  = opts.notice  ? "<div class=\"banner banner--err\">" + _htmlEscape(opts.notice) + "</div>" : "";
+  var isArchived = a.archived_at != null;
+
+  var themeOpts = ["urgency", "promo", "info", "success"].map(function (t) {
+    return "<option value=\"" + t + "\"" + (t === a.theme ? " selected" : "") + ">" + t + "</option>";
+  }).join("");
+  // segment audience needs an isMember handle that isn't wired in the
+  // console (see the create screen's note), so the picker offers the
+  // three reachable audiences; an existing segment row keeps its value
+  // as a disabled-looking selected option so an edit doesn't silently
+  // re-target it.
+  var audValues = ["all", "guest", "logged_in"];
+  if (a.audience === "segment") audValues = ["segment"].concat(audValues);
+  var audienceOpts = audValues.map(function (au) {
+    return "<option value=\"" + au + "\"" + (au === a.audience ? " selected" : "") + ">" + au + "</option>";
+  }).join("");
+
+  var editForm = isArchived
+    ? "<p class=\"empty\">This announcement is archived and can no longer be edited.</p>"
+    : "<div class=\"panel mw-40\">" +
+        "<h3 class=\"subhead\">Edit announcement</h3>" +
+        "<form method=\"post\" action=\"/admin/announcements/" + _htmlEscape(encodeURIComponent(a.slug)) + "/edit\">" +
+          "<input type=\"hidden\" name=\"dismissible_present\" value=\"1\">" +
+          "<input type=\"hidden\" name=\"link_present\" value=\"1\">" +
+          "<input type=\"hidden\" name=\"starts_present\" value=\"1\">" +
+          "<input type=\"hidden\" name=\"expires_present\" value=\"1\">" +
+          "<label class=\"form-field\"><span>Message</span><textarea name=\"message\" maxlength=\"500\" required>" + _htmlEscape(a.message) + "</textarea></label>" +
+          _setupField("Link URL (optional)", "link_url", a.link_url || "", "text", "https:// or a /-rooted path. Clear both to remove the link.", " maxlength=\"2048\"") +
+          _setupField("Link label (optional)", "link_label", a.link_label || "", "text", "", " maxlength=\"120\"") +
+          "<label class=\"form-field\"><span>Theme</span><select name=\"theme\">" + themeOpts + "</select></label>" +
+          "<label class=\"form-field\"><span>Audience</span><select name=\"audience\">" + audienceOpts + "</select></label>" +
+          "<label class=\"form-field\"><span>Starts at (optional)</span><input type=\"datetime-local\" name=\"starts_at\" value=\"" + _htmlEscape(_datetimeLocalValue(a.starts_at)) + "\"></label>" +
+          "<label class=\"form-field\"><span>Expires at (optional)</span><input type=\"datetime-local\" name=\"expires_at\" value=\"" + _htmlEscape(_datetimeLocalValue(a.expires_at)) + "\"></label>" +
+          "<label class=\"kv\"><input type=\"checkbox\" name=\"dismissible\" value=\"on\"" + (a.dismissible ? " checked" : "") + "> Visitors can dismiss this</label>" +
+          "<div class=\"actions-row\"><button class=\"btn\" type=\"submit\">Save changes</button></div>" +
+        "</form>" +
+      "</div>";
+
+  var bodyHtml = "<section><h2>Announcement</h2>" + updated + notice +
+    "<div class=\"panel\"><dl class=\"detail-grid\">" +
+      "<div><dt>Slug</dt><dd><code class=\"order-id\">" + _htmlEscape(a.slug) + "</code></dd></div>" +
+      "<div><dt>Status</dt><dd><span class=\"status-pill " + (isArchived ? "cancelled" : "paid") + "\">" + (isArchived ? "archived" : "active") + "</span></dd></div>" +
+    "</dl></div>" +
+    editForm +
+    "<div class=\"actions-row\"><a class=\"btn btn--ghost\" href=\"/admin/announcements\">Back to announcements</a></div>" +
+  "</section>";
+  return _renderAdminShell(opts.shop_name, "Announcement", bodyHtml, "announcements", opts.nav_available);
+}
+
 function renderAdminAnnouncements(opts) {
   opts = opts || {};
   var rows = opts.announcements || [];
@@ -9272,6 +9718,7 @@ function renderAdminAnnouncements(opts) {
       "<td><span class=\"status-pill " + (isArchived ? "cancelled" : "paid") + "\">" + (isArchived ? "archived" : "active") + "</span></td>" +
       "<td><div class=\"actions-row\">" +
         (isArchived ? "" :
+          "<a class=\"btn btn--ghost\" href=\"/admin/announcements/" + _htmlEscape(encodeURIComponent(a.slug)) + "\">Edit</a> " +
           "<form method=\"post\" action=\"/admin/announcements/" + _htmlEscape(encodeURIComponent(a.slug)) + "/archive\" class=\"form-inline\">" +
             "<button class=\"btn btn--danger\" type=\"submit\">Archive</button></form>") +
       "</div></td>" +

package/lib/asset-manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.3.18",
+  "version": "0.3.20",
   "assets": {
     "css/admin.css": {
       "integrity": "sha384-1SIn6oAf1DjECbRfKENZasdKHJiywGdXR58wn0hsFGcdVHzUmvfgMkEz5ANIAZJ3",

package/lib/vendor/MANIFEST.json

@@ -3,8 +3,8 @@
   "_about": "blamejs.shop vendors a single framework — blamejs — which itself bundles every server-side crypto/identity dependency. The transitive packages blamejs ships are surfaced in its own MANIFEST.json at lib/vendor/blamejs/lib/vendor/MANIFEST.json — Trivy / Grype rely on that nested data for CVE attribution.",
   "packages": {
     "blamejs": {
-      "version": "0.14.8",
-      "tag": "v0.14.8",
+      "version": "0.14.9",
+      "tag": "v0.14.9",
       "license": "Apache-2.0",
       "author": "blamejs contributors",
       "source": "https://github.com/blamejs/blamejs",

package/lib/vendor/blamejs/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.14.x
 
+- v0.14.9 (2026-05-30) — **Corrects EU AI Act doc paths that named an uncallable namespace, plus source-comment hygiene and two new codebase checks.** A documentation fix and internal hygiene. The `@primitive` / `@signature` / `@example` blocks for the EU AI Act fundamental-rights-impact-assessment and GPAI training-data-summary helpers advertised `b.complianceAiAct.*`, which is undefined — the callable path is `b.compliance.aiAct.*` — so an operator copying the documented call got `undefined is not a function`. The documented paths now match the real surface. Alongside that: a duplicate parser entry in a doc block is removed, version stamps embedded in section-divider comments are stripped, and two codebase checks are added — one that fails the build when a `@primitive` block documents a wholly-unresolvable namespace (the gap that hid the AI Act paths), and one that flags a version stamp left inside a section divider. No exported API, error code, wire format, or runtime behaviour changes. **Changed:** *Source-comment hygiene* — Removed a duplicate `env` entry from the parsers `@module` doc block, and stripped internal version stamps (`vX.Y.Z`) from `// ---- ... ----` section-divider comments across several files, keeping the descriptive label. Comment-only; no behaviour change. **Fixed:** *EU AI Act helper documentation named an uncallable path* — `b.compliance.aiAct.fundamentalRightsImpactAssessment` and `b.compliance.aiAct.gpai.trainingDataSummary` were documented as `b.complianceAiAct.*` in their `@primitive` / `@signature` / `@example` blocks (and one returned reference string). `b.complianceAiAct` is undefined, so the documented call failed; the documented paths now match the callable surface. **Detectors:** *`@primitive` reachability covers wrong-namespace paths* — The reachability check previously only flagged a missing leaf on a resolved namespace; a `@primitive` whose entire dotted prefix is unresolvable (the shape that hid the AI Act doc paths) was silently skipped. It now walks each prefix segment and fails the build on any unresolvable one, while preserving the factory-instance-shorthand exemption. · *Version-stamp-in-divider check* — A new check flags a version stamp (`vX.Y.Z`) left immediately after a section divider's dashes (`// ---- vX.Y.Z ...`) — internal release vocabulary that does not belong in shipped source comments — without matching legitimate `@since` tags or prose version references.
+
 - v0.14.8 (2026-05-30) — **Source-comment and codebase-check hygiene, plus a new require-block alignment check; no API or behaviour changes.** Internal lint and comment cleanup with no operator-facing surface change. Several codebase-check comments and one stub helper name that described behaviour the check no longer has are corrected; an unused lint-suppression class and a set of stale duplicate-cluster qualifiers (functions that were since renamed or extracted) are pruned or re-pointed. Fifty-nine `// allow:` markers that named the byte-size or time-literal check on values those checks no longer flag are removed, and twenty self-negating rationales on markers the time check genuinely fires on are rewritten to say why the value coincidentally matches. A new codebase check holds top-of-file require blocks to consistent `=` column alignment, with the files that currently carry drift listed as a migration allowlist. No exported API, error code, wire format, or runtime behaviour changes. **Changed:** *Lint-suppression and codebase-check comment cleanup* — Corrected codebase-check comments that overstated their check's scope (a duplicate-code threshold described as three files when the advisory threshold is two, a narrowed byte-literal check carrying its pre-narrowing description, and a deferred-scan helper named as though it enforced a guarantee it does not yet provide). Removed an unused lint-suppression class and its one dead in-code marker, and pruned or re-pointed stale duplicate-cluster qualifiers that named functions since renamed or extracted into shared helpers. Removed fifty-nine `// allow:` markers that suppressed nothing, and rewrote twenty self-negating marker rationales (which read "not seconds" while sitting on a value the time check fires on) to explain the coincidental match. Source-comment and test hygiene only. **Detectors:** *Require-block `=` alignment check* — A new codebase check flags a top-of-file require block that mixes its `=` column alignment — a fittable line whose `=` drifts off the column the rest of the block shares. Compact single-space blocks are exempt (only blocks that declare alignment intent are checked), as are destructures and long names physically too wide to reach the column, and blank- or comment-separated tiers align independently. The files that currently carry such drift are an explicit migration allowlist, reflowed over time; new code is held to the rule.
 
 - v0.14.7 (2026-05-30) — **Storage and audit-trail hardening: queries are gated to declared columns, raw SQL refuses embedded literals, the database key is bound to its location, sealed-column lookup hashes gain a keyed mode, audit-chain purges can require dual control, and breach deadlines ship a running clock.** This release tightens the data and audit layers against a set of failure modes that were previously reachable. Database queries are now checked against the columns a table declared in its schema: a reference to an undeclared column fails closed by default instead of silently matching nothing, and the `whereRaw` escape hatch refuses an embedded string literal so values bind through placeholders. The database encryption key is sealed with its purpose, data directory, and key path as additional authenticated data, so a key file cannot be relocated to another deployment and unsealed there; an older key without that binding upgrades itself on first load. Sealed-column equality-lookup hashes can now be computed as a keyed MAC (HMAC-SHAKE256) off a per-deployment key, making the lookup hash unforgeable without that key, while the salted-SHA3 default is unchanged. Purging the tamper-evident audit chain can be placed under a two-authorizer dual-control grant so one operator cannot erase it alone, and database credential-rejection audits now record which relation the rejected credential tried to reach. Finally, breach-notification deadlines get a running clock that raises approaching and passed alerts as each regime's window elapses. One behavior change to note: the column gate defaults to reject — if a service issues queries against columns it did not declare in its schema, set `db.init({ columnGate: "warn" })` (audited, allowed) or `"off"` while the schema is reconciled. **Added:** *Column-membership gate on every query* — `b.db.from(table)` now checks each referenced column against the table's declared schema. The mode is set with `db.init({ columnGate: "reject" | "warn" | "off" })` (default `reject`), and `query.allowedColumns([...])` narrows a single query to an explicit allowlist that is always enforced. `b.db.getDeclaredColumns(table)` returns a table's declared column names (or `null` for an unknown table). This is defense in depth against typo'd or caller-influenced column names reaching the SQL layer (CWE-89). · *Keyed mode for sealed-column lookup hashes* — Equality-lookup ("derived") hashes for sealed columns can be computed as `hmac-shake256` — a keyed MAC over a per-deployment key — instead of the default `salted-sha3`. Set it per table with `cryptoField.registerTable(name, { derivedHashMode: "hmac-shake256" })` or per column with `{ from, mode: "hmac-shake256" }`. The keyed hash is unforgeable and un-correlatable without the deployment's MAC key, which raises the bar against offline lookup-table attacks on low-entropy sealed values (CWE-916). `b.vault.getDerivedHashMacKey()` exposes the 32-byte per-deployment key; it is created on first use and re-sealed across key rotation automatically. · *Dual-control gate on audit-chain purge* — `b.auditTools.purge` accepts `dualControlGrant`. When `audit_log` is placed under dual control, a verified archive and `confirm: true` are no longer sufficient: the purge additionally requires a consumed m-of-n grant whose action is bound to the purge, so a grant minted for another operation cannot be replayed and one operator cannot erase the tamper-evident chain alone (NIST SP 800-53 AU-9, separation of duties). · *Running clock for breach-notification deadlines* — `b.incident.report.createDeadlineClock({ notify, approachThresholds })` tracks open incidents and raises `deadline_approaching` and `deadline_passed` alerts as each regime's window elapses (GDPR 72h, DORA, NIS2, and the rest of the registry). Alerts are deduplicated per incident and stage, suppressed once a submission stage is acknowledged, and the clock can run on an interval or be ticked manually. **Changed:** *Queries against undeclared columns now fail closed by default* — The column gate defaults to `reject`: a query that references a column the table did not declare throws rather than silently matching nothing. A service that intentionally queries undeclared columns can set `db.init({ columnGate: "warn" })` to audit and allow, or `"off"` to disable the gate, while its schema is reconciled. Framework-declared columns (including `_id` and derived-hash columns) are always members. **Security:** *Database encryption key bound to its location* — `db.key.enc` is sealed with additional authenticated data over its purpose, resolved data directory, and resolved key path. A sealed key copied to a different deployment or path no longer unseals there — the AEAD authentication fails — which prevents silent key relocation. A legacy key sealed without this binding is detected and re-sealed in the bound format on first load, with no operator action required. · *`whereRaw` refuses embedded string literals* — `whereRaw(sql, params)` and `WhereBuilder.raw(sql, params)` reject a raw fragment containing a string literal (`'...'`); values must bind through the `params` array. A static, operator-controlled literal can opt in with `{ allowLiterals: true }`. This closes a path where a value concatenated into a raw fragment would reintroduce SQL injection (CWE-89). · *Credential-rejection audits record the attempted relation* — A `db.auth.failed` audit row (SQLSTATE 28000 / 28P01 / 42501) now carries `attemptedTable`, the relation the rejected credential tried to reach, extracted defensively from the statement. Triage can scope the blast radius of a credential-abuse event without correlating back to the raw SQL log (CWE-778). **Detectors:** *Audit-purge dual-control gate* — A new check fails the build if a call to `purgeAuditChain` appears in a file that does not also route through the dual-control gate, so a future caller cannot physically delete chain rows without two-authorizer enforcement. · *Raw-SQL literal/interpolation guard* — A new check fails the build on a `whereRaw` / `.raw` call whose SQL argument is built by template interpolation or string concatenation, keeping the bound-params discipline enforceable in framework code. · *Hand-rolled lookup-hash guard* — A new check fails the build if a sealed-column lookup hash is derived from the per-deployment salt outside the canonical helper, so call sites cannot bypass the keyed-mode and per-column mode policy. · *Auth-audit attempted-relation guard* — A new check fails the build if a `db.auth.failed` audit is emitted in a file that does not name `attemptedTable`, so the forensic field cannot be dropped from a future emitter.

package/lib/vendor/blamejs/api-snapshot.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
-  "frameworkVersion": "0.14.8",
-  "createdAt": "2026-05-30T23:08:17.846Z",
+  "frameworkVersion": "0.14.9",
+  "createdAt": "2026-05-31T03:42:29.026Z",
   "exports": {
     "a2a": {
       "type": "object",

package/lib/vendor/blamejs/lib/auth/saml.js

@@ -842,7 +842,7 @@ function create(opts) {
       "</md:EntityDescriptor>";
   }
 
-  // ---- v0.10.16 — Single Logout (RFC SAML Bindings §3.4 HTTP-Redirect) ----
+  // ---- Single Logout (RFC SAML Bindings §3.4 HTTP-Redirect) ----
 
   /**
    * @primitive b.auth.saml.sp.buildLogoutRequest
@@ -1250,7 +1250,7 @@ function create(opts) {
     };
   }
 
-  // ---- v0.10.16 — SLO HTTP-POST binding (SAML Bindings §3.5) ----
+  // ---- SLO HTTP-POST binding (SAML Bindings §3.5) ----
 
   /**
    * @primitive b.auth.saml.sp.buildLogoutRequestPost
@@ -1524,7 +1524,7 @@ function create(opts) {
   };
 }
 
-// ---- v0.10.16 — SAML EncryptedAssertion decrypt (XMLEnc) ----
+// ---- SAML EncryptedAssertion decrypt (XMLEnc) ----
 
 // XMLEnc Algorithm URIs we support.
 //
@@ -1722,7 +1722,7 @@ function _decryptEncryptedAssertion(encAssertion, spPrivateKeyPem) {
   return clearBytes.toString("utf8");
 }
 
-// ---- v0.10.16 — SAML SLO XMLDSig-Enveloped (HTTP-POST/SOAP) ----
+// ---- SAML SLO XMLDSig-Enveloped (HTTP-POST/SOAP) ----
 
 // PQC SignatureMethod URIs used by the embedded XMLDSig signatures.
 // Standard XMLDSig vocabulary classical signing URIs (W3C XMLDSig
@@ -1936,7 +1936,7 @@ function _verifyEmbeddedXmlDsig(xml, idpVerifyKey, idpVerifyAlg, expectedRootLoc
   }
 }
 
-// ---- v0.10.16 SAML SLO signature-alg dispatch ----
+// ---- SAML SLO signature-alg dispatch ----
 
 function _sigAlgUrn(alg) {
   // PQC signers — framework-private experimental URIs. The `urn:`

package/lib/vendor/blamejs/lib/backup/index.js

@@ -1015,7 +1015,7 @@ module.exports = {
   BUNDLE_ID_RE:              BUNDLE_ID_RE,
 };
 
-// ---- v0.12.7: bundleAdapterStorage ---------------------------------------
+// ---- bundleAdapterStorage ---------------------------------------
 
 /**
  * @primitive b.backup.bundleAdapterStorage
@@ -2257,7 +2257,7 @@ bundleAdapterStorage.fsAdapter = function (fsOpts) {
   };
 };
 
-// ---- v0.12.13: objectStoreAdapter ----------------------------------------
+// ---- objectStoreAdapter ----------------------------------------
 
 /**
  * @primitive b.backup.bundleAdapterStorage.objectStoreAdapter
@@ -2475,7 +2475,7 @@ bundleAdapterStorage.objectStoreAdapter = function (client, osOpts) {
   };
 };
 
-// ---- v0.12.8: migrate ----------------------------------------------------
+// ---- migrate ----------------------------------------------------
 
 /**
  * @primitive b.backup.migrate

package/lib/vendor/blamejs/lib/compliance-ai-act.js

@@ -538,8 +538,8 @@ function deployerChecklist(assessment) {
 }
 
 /**
- * @primitive b.complianceAiAct.fundamentalRightsImpactAssessment
- * @signature b.complianceAiAct.fundamentalRightsImpactAssessment(opts)
+ * @primitive b.compliance.aiAct.fundamentalRightsImpactAssessment
+ * @signature b.compliance.aiAct.fundamentalRightsImpactAssessment(opts)
  * @since     0.8.77
  *
  * EU AI Act Article 27 — Fundamental Rights Impact Assessment (FRIA).
@@ -569,7 +569,7 @@ function deployerChecklist(assessment) {
  *   }
  *
  * @example
- *   var fria = b.complianceAiAct.fundamentalRightsImpactAssessment({
+ *   var fria = b.compliance.aiAct.fundamentalRightsImpactAssessment({
  *     systemId: "credit-scoring-v3",
  *     deploymentContext: { purpose: "loan approval", sector: "financial",
  *                          geography: "EU", scale: "1M decisions/year" },
@@ -603,13 +603,13 @@ function fundamentalRightsImpactAssessment(opts) {
     notificationStatus:   "operator-must-notify",
     note:                 "Notify national market-surveillance authority before first use (Art 27(3))",
     auditHook:            "b.audit emission action='aiact.fria.completed' recommended",
-    annexIVReference:     "see b.complianceAiAct.annexIVScaffold for technical documentation",
+    annexIVReference:     "see b.compliance.aiAct.annexIVScaffold for technical documentation",
   };
 }
 
 /**
- * @primitive b.complianceAiAct.gpai.trainingDataSummary
- * @signature b.complianceAiAct.gpai.trainingDataSummary(opts)
+ * @primitive b.compliance.aiAct.gpai.trainingDataSummary
+ * @signature b.compliance.aiAct.gpai.trainingDataSummary(opts)
  * @since     0.8.77
  *
  * EU AI Act Article 53(1)(d) — GPAI training-data summary template
@@ -634,7 +634,7 @@ function fundamentalRightsImpactAssessment(opts) {
  *   contentProvenance: object,    // { synthIdEmbed, c2paManifestEmbed, watermarkProvider }
  *
  * @example
- *   var summary = b.complianceAiAct.gpai.trainingDataSummary({
+ *   var summary = b.compliance.aiAct.gpai.trainingDataSummary({
  *     modelId:        "acme-llm-7b",
  *     modelVersion:   "1.0",
  *     provider:       { name: "Acme AI", address: "1 St", contact: "ai@acme.example" },

package/lib/vendor/blamejs/lib/compliance.js

@@ -107,12 +107,12 @@ var KNOWN_POSTURES = Object.freeze([
   "bsi-c5",          // Germany BSI C5
   "ens-es",          // Spain Esquema Nacional de Seguridad
   "uk-g-cloud",      // UK G-Cloud
-  // ---- v0.8.70 expansion — 2026 effective deadlines ----
+  // ---- 2026 effective deadlines ----
   "modpa",           // Maryland Online Data Privacy Act (effective 2025-10-01) — strict data-min
   "nydfs-500",       // NYDFS 23 NYCRR 500 Amendment 2 — financial cybersecurity (multi-factor + asset inventory + governance)
   "hipaa-2026",      // HHS HIPAA Security Rule 2026-Q4 final — extends hipaa with mandatory MFA + asset inventory + 72h restoration testing
   "quebec-25",       // Quebec Law 25 final phase (effective 2026-09-22) — DPIA + automated-decision opt-out
-  // ---- v0.8.77 expansion — US state consumer-privacy postures ----
+  // ---- US state consumer-privacy postures ----
   // Each posture carries per-state cure-period, profiling opt-out
   // and minor-consent metadata via b.dsr.stateRules(state). The
   // generic DSR primitive (b.dsr.submit) covers ~80% of the surface;
@@ -139,7 +139,7 @@ var KNOWN_POSTURES = Object.freeze([
   "ct-sb3",          // Connecticut SB 3 Consumer Health Data
   "tx-cubi",         // Texas Capture or Use of Biometric Identifier
   "fl-fdbr",         // Florida Digital Bill of Rights (SB 262, effective 2024-07-01) — narrow scope ($1B+ revenue threshold)
-  // ---- v0.8.81 expansion — AI-governance postures ----
+  // ---- AI-governance postures ----
   // State + sectoral AI regulations crystallizing through 2026. Each
   // posture is a flag that operators pin alongside their base
   // privacy/sectoral posture; the floors enforce audit-chain signing
@@ -153,20 +153,20 @@ var KNOWN_POSTURES = Object.freeze([
   "ca-tfaia",        // California SB 53 — Transparency in Frontier AI Act (effective 2026-01-01)
   "kr-ai-basic",     // South Korea AI Basic Act (effective 2026-01-22)
   "cn-ai-label",     // China Measures for Labelling of AI-Generated Content (effective 2025-09-01)
-  // ---- v0.8.81 expansion — AI management cross-walks ----
+  // ---- AI management cross-walks ----
   "iso-42001",       // ISO/IEC 42001:2023 — AI Management System
   "iso-23894",       // ISO/IEC 23894:2023 — AI Risk Management Guidance
-  // ---- v0.8.81 expansion — content-credentials posture flags ----
+  // ---- content-credentials posture flags ----
   "ca-sb942",        // California SB-942 (Cal. Bus. & Prof. Code §22757) gen-AI disclosure (effective 2026-08-02)             // regulatory identifier + date, not bytes
   "ca-ab853",        // California AB-853 platform-side gen-AI detection (effective 2026-08-02)                                // regulatory identifier + date, not bytes
-  // ---- v0.8.81 expansion — substrate-to-posture cleanup ----
+  // ---- substrate-to-posture cleanup ----
   "eaa",             // EU Accessibility Act / Directive (EU) 2019/882 (effective 2025-06-28)
   "wcag-2-2",        // W3C Web Content Accessibility Guidelines 2.2 (Oct 2023 Recommendation)
   "eu-data-act",     // EU Data Act / Regulation (EU) 2023/2854 (effective 2025-09-12)
   "hitech",          // Health Information Technology for Economic and Clinical Health Act (2009)
   "ferpa",           // Family Educational Rights and Privacy Act (20 U.S.C. §1232g)
   "dpdp",            // India Digital Personal Data Protection Act 2023 (rules-pending; cascade tier exists)
-  // ---- v0.8.82 expansion — privacy 2026 sweep ----
+  // ---- privacy 2026 sweep ----
   // US federal child / financial privacy
   "coppa",           // Children's Online Privacy Protection Act (15 U.S.C. §6501)
   "coppa-2025",      // COPPA 2025 Amendment (FTC final 2025-04-22; effective 2026-06-23 — biometric expansion + knowing-collection disclosure)
@@ -203,7 +203,7 @@ var KNOWN_POSTURES = Object.freeze([
   "eu-cer",          // EU Critical Entities Resilience Directive (2022/2557; transposition 2024-10-17)
   "eu-cyber-sol",    // EU Cyber Solidarity Act (Regulation 2025/38; effective 2025-02-04)
   "eidas-2",         // eIDAS 2 / EUDI Wallet (Regulation 2024/1183; rollout 2026-2027)
-  // ---- v0.8.86 expansion — sectoral + cybersecurity directives ----
+  // ---- sectoral + cybersecurity directives ----
   "cmmc-2.0",        // US DoD Cybersecurity Maturity Model Certification 2.0 (effective 2025-Q1)
   "cjis-v6",         // FBI Criminal Justice Information Services Security Policy v6.0 (Dec 2024)
   "iso-27001-2022",  // ISO/IEC 27001:2022 — Information Security Management System
@@ -214,7 +214,7 @@ var KNOWN_POSTURES = Object.freeze([
   "nist-800-66-r2",  // NIST SP 800-66 Rev 2 — HIPAA Security Rule implementation guidance                                       // NIST publication number, not bytes
   "ehds",            // EU European Health Data Space (Regulation 2025/327; phased 2027-2029)
   "circia",          // US Cyber Incident Reporting for Critical Infrastructure Act (final rule pending)
-  // ---- v0.9.6 expansion — exceptd framework-control-gap closure ----
+  // ---- exceptd framework-control-gap closure ----
   // Postures added to recognise every framework cited in the
   // exceptd 2026-05-11 framework-control-gaps catalog. Each posture
   // either (a) maps to a framework the operator must audit against,
@@ -248,7 +248,7 @@ var KNOWN_POSTURES = Object.freeze([
   "cwe-top-25-2024",             // CWE Top 25 Most Dangerous Software Weaknesses (2024)
   "cis-controls-v8",             // CIS Controls v8
   "cmmc-2.0-level-2",            // CMMC 2.0 Level 2 (Advanced) — 110 NIST 800-171 Rev 2 controls                                                                                                          // NIST pub number / level, not bytes
-  // ---- v0.9.57 — granular CMMC level distinction ----
+  // ---- granular CMMC level distinction ----
   // CMMC 2.0 maturity levels carry distinct control-mapping
   // expectations: Level 1 = 15 controls (FAR 52.204-21), Level 2 =
   // 110 controls (NIST 800-171 Rev 2), Level 3 = additional NIST
@@ -257,7 +257,7 @@ var KNOWN_POSTURES = Object.freeze([
   // L1/L2/L3 postures are the recommended pin for new deployments.
   "cmmc-2.0-level-1",            // CMMC 2.0 Level 1 (Foundational) — 15 FAR controls; FCI-only data        // regulatory identifier, not bytes
   "cmmc-2.0-level-3",            // CMMC 2.0 Level 3 (Expert) — NIST 800-172 enhanced controls atop L2       // regulatory identifier, not bytes
-  // ---- v0.12.1 — promote POSTURE_DEFAULTS-only entries into the
+  // ---- promote POSTURE_DEFAULTS-only entries into the
   // canonical KNOWN_POSTURES surface so operators can actually
   // `b.compliance.set(...)` them. Each entry had cascade
   // configuration wired but couldn't be pinned because set()'s
@@ -757,7 +757,7 @@ var REGIME_MAP = Object.freeze({
   "ct-sb3":    { name: "Connecticut SB 3 Consumer Health Data",        citation: "Conn. P.A. 23-56 (effective 2023-07-01)", jurisdiction: "US-CT", domain: "health" },
   "tx-cubi":   { name: "Texas Capture or Use of Biometric Identifier", citation: "Tex. Bus. & Com. Code §503.001 (effective 2009-09-01)", jurisdiction: "US-TX", domain: "biometric" },
   "fl-fdbr":   { name: "Florida Digital Bill of Rights",              citation: "Fla. Stat. §501.701 et seq. SB 262 (effective 2024-07-01)", jurisdiction: "US-FL", domain: "privacy" },
-  // ---- v0.8.81 — AI governance ----
+  // ---- AI governance ----
   "co-ai":       { name: "Colorado AI Act",                            citation: "C.R.S. §6-1-1701 et seq. SB24-205 (postponed to 2026-06-30; enforcement stayed)", jurisdiction: "US-CO", domain: "ai-governance" },
   "il-hb3773":   { name: "Illinois HB 3773 — AI in Employment",        citation: "775 ILCS 5 IHRA AI amendment (effective 2026-01-01)", jurisdiction: "US-IL", domain: "ai-governance" },
   "tx-traiga":   { name: "Texas Responsible AI Governance Act",        citation: "Tex. Bus. & Com. Code Ch. 552 HB 149 (effective 2026-01-01)", jurisdiction: "US-TX", domain: "ai-governance" },
@@ -766,20 +766,20 @@ var REGIME_MAP = Object.freeze({
   "ca-tfaia":    { name: "California Transparency in Frontier AI Act",  citation: "Cal. Bus. & Prof. Code §22757.10 et seq. SB 53 (effective 2026-01-01)", jurisdiction: "US-CA", domain: "ai-governance" },
   "kr-ai-basic": { name: "South Korea AI Basic Act",                    citation: "Framework Act on Development of AI (effective 2026-01-22)", jurisdiction: "KR", domain: "ai-governance" },
   "cn-ai-label": { name: "China — Measures for Labelling AI-Generated Content", citation: "CAC + MIIT + Ministry of Public Security + NRTA Order (effective 2025-09-01)", jurisdiction: "CN", domain: "ai-governance" },
-  // ---- v0.8.81 — AI management cross-walks ----
+  // ---- AI management cross-walks ----
   "iso-42001":   { name: "ISO/IEC 42001 — AI Management System",        citation: "ISO/IEC 42001:2023", jurisdiction: "international", domain: "ai-governance" },
   "iso-23894":   { name: "ISO/IEC 23894 — AI Risk Management",          citation: "ISO/IEC 23894:2023", jurisdiction: "international", domain: "ai-governance" },
-  // ---- v0.8.81 — content-credentials posture flags ----
+  // ---- content-credentials posture flags ----
   "ca-sb942":    { name: "California Gen-AI Provenance Disclosure",     citation: "Cal. Bus. & Prof. Code §22757 SB-942 (effective 2026-08-02)", jurisdiction: "US-CA", domain: "content-credentials" },
   "ca-ab853":    { name: "California Platform Gen-AI Detection",        citation: "Cal. Bus. & Prof. Code §22757 AB-853 (effective 2026-08-02)", jurisdiction: "US-CA", domain: "content-credentials" },
-  // ---- v0.8.81 — substrate-to-posture cleanup ----
+  // ---- substrate-to-posture cleanup ----
   "eaa":         { name: "EU Accessibility Act",                        citation: "Directive (EU) 2019/882 (effective 2025-06-28)", jurisdiction: "EU", domain: "accessibility" },
   "wcag-2-2":    { name: "W3C Web Content Accessibility Guidelines 2.2", citation: "W3C Recommendation (Oct 2023)", jurisdiction: "international", domain: "accessibility" },
   "eu-data-act": { name: "EU Data Act",                                 citation: "Regulation (EU) 2023/2854 (effective 2025-09-12)", jurisdiction: "EU", domain: "data-sharing" },
   "hitech":      { name: "Health Information Technology for Economic and Clinical Health Act", citation: "Pub. L. 111-5, Title XIII, Subtitle D (2009)", jurisdiction: "US", domain: "health" },
   "ferpa":       { name: "Family Educational Rights and Privacy Act",   citation: "20 U.S.C. §1232g; 34 CFR Part 99", jurisdiction: "US", domain: "student-records" },
   "dpdp":        { name: "Digital Personal Data Protection Act 2023",   citation: "Act 22 of 2023 (India; rules pending)", jurisdiction: "IN", domain: "privacy" },
-  // ---- v0.8.82 — privacy 2026 sweep ----
+  // ---- privacy 2026 sweep ----
   // US federal
   "coppa":           { name: "Children's Online Privacy Protection Act",         citation: "15 U.S.C. §§6501-6506; 16 CFR Part 312 (effective 2000-04-21)", jurisdiction: "US", domain: "child-privacy" },
   "coppa-2025":      { name: "COPPA 2025 Amendment",                              citation: "FTC final rule (2025-04-22; effective 2026-06-23) — biometric expansion + knowing-collection-13-and-under disclosure", jurisdiction: "US", domain: "child-privacy" },
@@ -815,7 +815,7 @@ var REGIME_MAP = Object.freeze({
   "eu-cer":          { name: "EU Critical Entities Resilience Directive",        citation: "Directive (EU) 2022/2557 (transposition 2024-10-17)", jurisdiction: "EU", domain: "cybersecurity" },
   "eu-cyber-sol":    { name: "EU Cyber Solidarity Act",                          citation: "Regulation (EU) 2025/38 (effective 2025-02-04)", jurisdiction: "EU", domain: "cybersecurity" },
   "eidas-2":         { name: "eIDAS 2 / EUDI Wallet",                            citation: "Regulation (EU) 2024/1183 (rollout 2026-2027)", jurisdiction: "EU", domain: "identity" },
-  // ---- v0.8.86 — sectoral + cybersecurity directives ----
+  // ---- sectoral + cybersecurity directives ----
   "cmmc-2.0":        { name: "Cybersecurity Maturity Model Certification 2.0",   citation: "32 CFR Part 170 (DFARS rule effective 2025-Q1)", jurisdiction: "US", domain: "cybersecurity" },
   "cjis-v6":         { name: "FBI CJIS Security Policy v6.0",                    citation: "CJIS Security Policy v6.0 (effective 2024-12)", jurisdiction: "US", domain: "law-enforcement" },
   "iso-27001-2022":  { name: "ISO/IEC 27001:2022 Information Security Management System", citation: "ISO/IEC 27001:2022", jurisdiction: "international", domain: "cybersecurity" },
@@ -826,7 +826,7 @@ var REGIME_MAP = Object.freeze({
   "nist-800-66-r2":  { name: "NIST SP 800-66 Rev 2 — HIPAA Security Rule Guidance", citation: "NIST SP 800-66 Rev 2 (Feb 2024)", jurisdiction: "US", domain: "health" },
   "ehds":            { name: "European Health Data Space",                        citation: "Regulation (EU) 2025/327 (phased 2027-2029)", jurisdiction: "EU", domain: "health" },
   "circia":          { name: "Cyber Incident Reporting for Critical Infrastructure Act", citation: "6 U.S.C. §681 et seq. (final rule pending)", jurisdiction: "US", domain: "cybersecurity" },
-  // ---- v0.12.1 — REGIME_MAP backfill for KNOWN_POSTURES without
+  // ---- REGIME_MAP backfill for KNOWN_POSTURES without
   // describe() coverage. Each entry resolves `b.compliance.describe
   // (posture)` → { name, citation, jurisdiction, domain } so admin
   // UI / generated audit reports rendering "running under <name>
@@ -870,7 +870,7 @@ var REGIME_MAP = Object.freeze({
   "bsi-c5":          { name: "Germany BSI C5 — Cloud Computing Compliance Catalogue", citation: "BSI Cloud Computing Compliance Criteria Catalogue (C5:2020)", jurisdiction: "DE", domain: "cybersecurity" },
   "ens-es":          { name: "Spain Esquema Nacional de Seguridad",             citation: "Real Decreto 311/2022",                            jurisdiction: "ES", domain: "cybersecurity" },
   "uk-g-cloud":      { name: "UK G-Cloud Framework",                            citation: "UK Crown Commercial Service G-Cloud 14",          jurisdiction: "UK", domain: "cybersecurity" },
-  // ---- v0.9.6 expansion REGIME_MAP backfill (cybersecurity / AI / supply-chain frameworks) ----
+  // ---- REGIME_MAP backfill (cybersecurity / AI / supply-chain frameworks) ----
   "nist-800-53":              { name: "NIST SP 800-53 Rev 5 — Security & Privacy Controls", citation: "NIST SP 800-53 Rev 5",                jurisdiction: "US", domain: "cybersecurity" },
   "nist-ai-rmf-1.0":          { name: "NIST AI Risk Management Framework 1.0",  citation: "NIST AI 100-1 (Jan 2023)",                        jurisdiction: "US", domain: "ai" },
   "iso-42001-2023":           { name: "ISO/IEC 42001:2023 — AI Management System", citation: "ISO/IEC 42001:2023",                          jurisdiction: "international", domain: "ai" },
@@ -1176,7 +1176,7 @@ var POSTURE_DEFAULTS = Object.freeze({
   "nist-800-66-r2":  Object.freeze({ backupEncryptionRequired: true,  auditChainSignedRequired: true, tlsMinVersion: "TLSv1.3", requireVacuumAfterErase: true  }),
   "ehds":            Object.freeze({ backupEncryptionRequired: true,  auditChainSignedRequired: true, tlsMinVersion: "TLSv1.3", requireVacuumAfterErase: true  }),
   "circia":          Object.freeze({ backupEncryptionRequired: false, auditChainSignedRequired: true, tlsMinVersion: "TLSv1.3", requireVacuumAfterErase: false }),
-  // ---- v0.9.6 — exceptd framework-control-gap closure cascade ----
+  // ---- exceptd framework-control-gap closure cascade ----
   "nist-800-53":             Object.freeze({ backupEncryptionRequired: true,  auditChainSignedRequired: true, tlsMinVersion: "TLSv1.3", requireVacuumAfterErase: true  }),
   // NIST AI-RMF MANAGE.4.3 / ISO 23894 §6.5 / ISO 42001
   // §A.6 require encrypted backups for AI system state (model
@@ -1242,7 +1242,7 @@ var POSTURE_DEFAULTS = Object.freeze({
   "cmmc-2.0-level-1":        Object.freeze({ backupEncryptionRequired: false, auditChainSignedRequired: true, tlsMinVersion: "TLSv1.3", requireVacuumAfterErase: false }),
   "cmmc-2.0-level-2":        Object.freeze({ backupEncryptionRequired: true,  auditChainSignedRequired: true, tlsMinVersion: "TLSv1.3", requireVacuumAfterErase: true  }),
   "cmmc-2.0-level-3":        Object.freeze({ backupEncryptionRequired: true,  auditChainSignedRequired: true, tlsMinVersion: "TLSv1.3", requireVacuumAfterErase: true, fipsMode: false }),
-  // ---- v0.10.16 — sectoral catch-up ----
+  // ---- sectoral catch-up ----
   // 42 CFR Part 2 — Substance Use Disorder records confidentiality
   // (HHS final rule 2024-04-16 aligns Part 2 with HIPAA but retains
   // a stricter consent floor; encrypted backups + signed audit chain

package/lib/vendor/blamejs/lib/dsr.js

@@ -1078,7 +1078,7 @@ function dbTicketStore(opts) {
   };
 }
 
-// ---- v0.8.77 — US state-law DSR drift registry -------------------
+// ---- US state-law DSR drift registry -------------------
 //
 // Each US state consumer-privacy law expresses the same DSR core
 // (access / deletion / correction / portability) but with per-state

package/lib/vendor/blamejs/lib/guard-archive.js

@@ -905,7 +905,7 @@ module.exports = {
   tarEntryPolicy:      tarEntryPolicy,
 };
 
-// ---- v0.12.7 extensions ---------------------------------------------------
+// ---- extensions ---------------------------------------------------
 
 /**
  * @primitive b.guardArchive.inspect

package/lib/vendor/blamejs/lib/mail-crypto-pgp.js

@@ -928,7 +928,7 @@ function _audit(auditHandle, action, outcome, metadata) {
   } catch (_e) { /* drop-silent — audit failures must not crash callers */ }
 }
 
-// ---- v0.10.16 experimental encrypt/decrypt + WKD ----
+// ---- experimental encrypt/decrypt + WKD ----
 //
 // PQC PGP encrypt/decrypt for ML-KEM-1024 recipients shipped under
 // `experimental` namespace (RFC 9580bis PKESK ML-KEM codepoints

package/lib/vendor/blamejs/lib/parsers/index.js

@@ -36,12 +36,6 @@
  *           parsed as `country: false`). Block + flow style;
  *           literal `|` and folded `>` block scalars with chomp
  *           indicators.
- *   env  — .env file loader with size cap + schema validation;
- *           refuses to expand $VAR references; refuses to silently
- *           overwrite existing process.env values unless explicitly
- *           opted in. Dev-tooling — production secrets should still
- *           come through the operator's secrets-management; this is
- *           the local-development convenience.
  *   ini  — INI / .gitconfig / systemd-unit / php.ini / tox.ini parser.
  *           Sections (incl. [parent.child] / [parent "child"] nesting),
  *           ; or # comments (inline + leading), single + double quoting

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.14.8",
+  "version": "0.14.9",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.14.9.json

@@ -0,0 +1,40 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.14.9",
+  "date": "2026-05-30",
+  "headline": "Corrects EU AI Act doc paths that named an uncallable namespace, plus source-comment hygiene and two new codebase checks",
+  "summary": "A documentation fix and internal hygiene. The `@primitive` / `@signature` / `@example` blocks for the EU AI Act fundamental-rights-impact-assessment and GPAI training-data-summary helpers advertised `b.complianceAiAct.*`, which is undefined — the callable path is `b.compliance.aiAct.*` — so an operator copying the documented call got `undefined is not a function`. The documented paths now match the real surface. Alongside that: a duplicate parser entry in a doc block is removed, version stamps embedded in section-divider comments are stripped, and two codebase checks are added — one that fails the build when a `@primitive` block documents a wholly-unresolvable namespace (the gap that hid the AI Act paths), and one that flags a version stamp left inside a section divider. No exported API, error code, wire format, or runtime behaviour changes.",
+  "sections": [
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "EU AI Act helper documentation named an uncallable path",
+          "body": "`b.compliance.aiAct.fundamentalRightsImpactAssessment` and `b.compliance.aiAct.gpai.trainingDataSummary` were documented as `b.complianceAiAct.*` in their `@primitive` / `@signature` / `@example` blocks (and one returned reference string). `b.complianceAiAct` is undefined, so the documented call failed; the documented paths now match the callable surface."
+        }
+      ]
+    },
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "Source-comment hygiene",
+          "body": "Removed a duplicate `env` entry from the parsers `@module` doc block, and stripped internal version stamps (`vX.Y.Z`) from `// ---- ... ----` section-divider comments across several files, keeping the descriptive label. Comment-only; no behaviour change."
+        }
+      ]
+    },
+    {
+      "heading": "Detectors",
+      "items": [
+        {
+          "title": "`@primitive` reachability covers wrong-namespace paths",
+          "body": "The reachability check previously only flagged a missing leaf on a resolved namespace; a `@primitive` whose entire dotted prefix is unresolvable (the shape that hid the AI Act doc paths) was silently skipped. It now walks each prefix segment and fails the build on any unresolvable one, while preserving the factory-instance-shorthand exemption."
+        },
+        {
+          "title": "Version-stamp-in-divider check",
+          "body": "A new check flags a version stamp (`vX.Y.Z`) left immediately after a section divider's dashes (`// ---- vX.Y.Z ...`) — internal release vocabulary that does not belong in shipped source comments — without matching legitimate `@since` tags or prose version references."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -10801,12 +10801,46 @@ function testPrimitiveReachability() {
     return cur;
   }
 
+  // Walk the dotted prefix (every segment except the leaf) so a break at
+  // ANY segment — including a wholesale-wrong namespace whose parent
+  // resolves to undefined — is surfaced rather than silently skipped. A
+  // function OR a `.create`-bearing object anywhere in the chain is a
+  // factory-instance shorthand and stays exempt.
+  function walkPrefix(name, surface) {
+    var parts = name.split(".");
+    var cur = surface;
+    for (var i = 1; i < parts.length - 1; i += 1) {
+      // A missing prefix segment is a wrong-namespace doc path even when
+      // `cur` is itself a factory (has `.create`): a namespace that ALSO
+      // has real static children (e.g. b.mail.create + b.mail.bimi /
+      // b.mail.rbl) is used statically, so an undefined child is a typo,
+      // not a factory-instance method. The factory-shorthand exemption is
+      // therefore applied ONLY at the leaf parent (the trailing function
+      // check below + the caller's `.create` check) — never at an
+      // intermediate segment, which would mask the typo.
+      if (cur == null || typeof cur[parts[i]] === "undefined") {
+        return { brokenName: parts.slice(0, i + 1).join(".") };
+      }
+      cur = cur[parts[i]];
+    }
+    if (typeof cur === "function") return { factory: true };
+    return { parent: cur, parentName: parts.slice(0, -1).join(".") };
+  }
+
   // @primitive paths that legitimately don't resolve as a flat member
   // (documented elsewhere / intentional). Keyed by dotted name.
   var REACHABILITY_ALLOWLIST = {
     // (none — every surfaced gap is fixed in-tree)
   };
 
+  // Self-test (locks the fix): a missing intermediate segment under a
+  // mixed factory+static namespace must be flagged, never masked by the
+  // factory-shorthand exemption.
+  var _rMock  = { mail: { create: function () {}, bimi: {} } };
+  var _rProbe = walkPrefix("b.mail.bmi.recordShape", _rMock);
+  check("primitive-reachability: typo under a mixed factory namespace is flagged",
+        _rProbe.brokenName === "b.mail.bmi");
+
   var libFiles = _libFiles();
   var unreachable = [];
   for (var i = 0; i < libFiles.length; i += 1) {
@@ -10818,9 +10852,24 @@ function testPrimitiveReachability() {
       var name = m[1];
       if (REACHABILITY_ALLOWLIST[name]) continue;
       if (typeof resolve(name) !== "undefined") continue;
-      var parts = name.split(".");
-      var parentName = parts.slice(0, -1).join(".");
-      var parent = resolve(parentName);
+      var w = walkPrefix(name, bSurface);
+      // Factory-instance shorthands (b.X.create() → instance method) skip.
+      if (w.factory) continue;
+      if (w.brokenName) {
+        // The whole dotted namespace prefix is unresolvable — the parent
+        // resolved to undefined, so the flat-namespace check below never
+        // fired and the doc-lie was silently skipped. Flag it.
+        unreachable.push({
+          file:    rel,
+          line:    1,
+          content: "@primitive " + name + " documents a b.* path that does not resolve (the namespace `" +
+                   w.brokenName + "` is undefined — no prefix segment resolves on the public surface). " +
+                   "Correct the @primitive/@signature namespace, or wire the namespace into the surface.",
+        });
+        continue;
+      }
+      var parent = w.parent;
+      var parentName = w.parentName;
       // Flag only flat namespaces (object parent without a `create`
       // factory). Factory-instance shorthands are skipped.
       if (parent && typeof parent === "object" && typeof parent.create !== "function") {
@@ -10913,6 +10962,7 @@ function testNoInternalNarrativeComments() {
     { re: /\b[Aa]udit\s+\d{4}-\d{2}-\d{2}/,         what: "dated audit/decision residue" },
     { re: /\bReported\s+\d{4}-\d{2}-\d{2}/,         what: "dated report residue" },
     { re: /\bCore Rule\s+§\d/,                 what: "internal CLAUDE.md rule-number citation" },
+    { re: /----\s*v\d+\.\d+\.\d+/,             what: "version stamp in a section-divider comment" },
   ];
   var files = _libFiles();
   var bad = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.18",
+  "version": "0.3.20",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {