@blamejs/blamejs-shop 0.0.44

package/lib/vendor/blamejs/test/layer-0-primitives/dual-control.test.js

@@ -0,0 +1,105 @@
+"use strict";
+
+var helpers = require("../helpers");
+var b      = helpers.b;
+var check  = helpers.check;
+
+async function run() {
+  check("dualControl namespace present",  typeof b.dualControl === "object");
+  check("dualControl.create is fn",       typeof b.dualControl.create === "function");
+
+  // Use a memory-backend cache so this test is hermetic.
+  var cache = b.cache.create({ namespace: "dual-test" });
+  var approvals = b.dualControl.create({
+    namespace: "test.destructive",
+    cache:     cache,
+    audit:     b.audit,
+    ttlMs:     60 * 1000,
+  });
+
+  // Step 1 — request
+  var req1 = await approvals.request({
+    action:      "<test>.purge",
+    requestedBy: { id: "alice" },
+    reason:      "test request",
+  });
+  check("request: returns pending",          req1.status === "pending");
+  check("request: needs minApprovers (2)",   req1.needs === 2);
+  check("request: empty approvedBy",         Array.isArray(req1.approvedBy) && req1.approvedBy.length === 0);
+
+  // Self-approve forbidden
+  var selfApprove = await approvals.approve({
+    grantId:  req1.grantId,
+    approver: { id: "alice" },
+  });
+  check("approve: self-approval rejected",   selfApprove.error === "self-approval-forbidden");
+
+  // First valid approver
+  var ap1 = await approvals.approve({
+    grantId:  req1.grantId,
+    approver: { id: "bob" },
+  });
+  check("approve: 1/2 still pending",        ap1.status === "pending" && ap1.approvedBy.length === 1);
+
+  // Second different approver — quorum reached
+  var ap2 = await approvals.approve({
+    grantId:  req1.grantId,
+    approver: { id: "carol" },
+  });
+  check("approve: 2/2 approved",             ap2.status === "approved");
+
+  // Same approver twice — rejected
+  var dupAp = await approvals.approve({
+    grantId:  req1.grantId,
+    approver: { id: "carol" },
+  });
+  check("approve: duplicate approver rejected", dupAp.error === "already-approved-by-this-actor");
+
+  // Status check
+  var st = await approvals.status(req1.grantId);
+  check("status: 'approved' state",          st && st.status === "approved");
+
+  // Consume — single use, then gone
+  var c1 = await approvals.consume(req1.grantId);
+  check("consume: ready",                    c1.ready === true);
+  check("consume: returns action",           c1.action === "<test>.purge");
+
+  var c2 = await approvals.consume(req1.grantId);
+  check("consume: second call grant-not-found",  c2.ready === false && c2.reason === "grant-not-found");
+
+  // Revoke flow
+  var req2 = await approvals.request({
+    action:      "<test>.purge2",
+    requestedBy: { id: "alice" },
+  });
+  await approvals.revoke({ grantId: req2.grantId, revokedBy: { id: "admin" }, reason: "rolled back" });
+  var revokedConsume = await approvals.consume(req2.grantId);
+  check("consume: revoked → not-ready",      revokedConsume.ready === false && revokedConsume.reason === "revoked");
+
+  // Approve attempt against a revoked grant
+  var revokedApprove = await approvals.approve({
+    grantId:  req2.grantId,
+    approver: { id: "bob" },
+  });
+  check("approve: revoked grant rejected",   revokedApprove.error === "grant-revoked");
+
+  // ---- Validation ----
+  var threwBadCache = null;
+  try { b.dualControl.create({ namespace: "x", cache: {} }); }
+  catch (e) { threwBadCache = e; }
+  check("create: rejects non-cache opts.cache", threwBadCache && /BAD_OPT/.test(threwBadCache.code || ""));
+
+  var threwBadMin = null;
+  try { b.dualControl.create({ namespace: "x", cache: cache, minApprovers: 1 }); }
+  catch (e) { threwBadMin = e; }
+  check("create: rejects minApprovers < 2",   threwBadMin && /BAD_OPT/.test(threwBadMin.code || ""));
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("[dual-control] OK"); },
+    function (e) { console.error(e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/early-hints.test.js

@@ -0,0 +1,147 @@
+"use strict";
+/**
+ * b.earlyHints — RFC 8297 103 Early Hints helper.
+ */
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+function _mockRes() {
+  var calls = [];
+  return {
+    writeEarlyHints: function (h) { calls.push(h); },
+    _calls: function () { return calls; },
+  };
+}
+
+function testSurface() {
+  check("earlyHints.send is fn", typeof b.earlyHints.send === "function");
+  check("REFUSED_HEADERS is array", Array.isArray(b.earlyHints.REFUSED_HEADERS));
+  check("EarlyHintsError is a constructor",
+        typeof b.earlyHints.EarlyHintsError === "function");
+}
+
+function testHappyPath() {
+  var res = _mockRes();
+  var ok = b.earlyHints.send(res, {
+    link: [
+      "</style.css>; rel=preload; as=style",
+      "<https://cdn.example.com>; rel=preconnect",
+    ],
+  });
+  check("send: returns true on success", ok === true);
+  var c = res._calls();
+  check("send: writeEarlyHints called once",  c.length === 1);
+  check("send: link headers passed through",
+        Array.isArray(c[0].link) && c[0].link.length === 2);
+}
+
+function testSingleStringLink() {
+  var res = _mockRes();
+  b.earlyHints.send(res, { link: "</app.js>; rel=preload; as=script" });
+  check("send: single string link wraps to array",
+        Array.isArray(res._calls()[0].link) && res._calls()[0].link.length === 1);
+}
+
+function testRefusesBadShape() {
+  function expectCode(label, fn, code) {
+    var threw = null;
+    try { fn(); } catch (e) { threw = e; }
+    check(label, threw && (threw.code || "").indexOf(code) !== -1);
+  }
+  expectCode("send: bad res",
+             function () { b.earlyHints.send(null, { link: "<x>; rel=preload" }); }, "early-hints/bad-res");
+  var res = _mockRes();
+  expectCode("send: missing opts",
+             function () { b.earlyHints.send(res); }, "early-hints/bad-opts");
+  expectCode("send: missing link",
+             function () { b.earlyHints.send(res, {}); }, "early-hints/no-link");
+  expectCode("send: empty link array",
+             function () { b.earlyHints.send(res, { link: [] }); }, "early-hints/no-link");
+  expectCode("send: link without rel",
+             function () { b.earlyHints.send(res, { link: "</x.css>" }); }, "early-hints/bad-link");
+  expectCode("send: link with unknown rel",
+             function () { b.earlyHints.send(res, { link: "</x.css>; rel=icon" }); }, "early-hints/bad-link");
+  expectCode("send: link without angle-bracketed URI",
+             function () { b.earlyHints.send(res, { link: "/x.css; rel=preload" }); }, "early-hints/bad-link");
+  expectCode("send: refused header (set-cookie)",
+             function () { b.earlyHints.send(res, { link: "<x>; rel=preload", "set-cookie": "a=1" }); }, "early-hints/refused-header");
+  expectCode("send: refused header (authorization)",
+             function () { b.earlyHints.send(res, { link: "<x>; rel=preload", authorization: "Bearer x" }); }, "early-hints/refused-header");
+  expectCode("send: refused header (content-length)",
+             function () { b.earlyHints.send(res, { link: "<x>; rel=preload", "content-length": "100" }); }, "early-hints/refused-header");
+
+  var bigLink = "<" + new Array(5000).join("x") + ">; rel=preload";
+  expectCode("send: huge link refused",
+             function () { b.earlyHints.send(res, { link: bigLink }); }, "early-hints/bad-link");
+}
+
+function testNoWriteEarlyHintsFallback() {
+  // HTTP/1.0 or unmocked res: silent no-op, returns false.
+  var noFn = {};
+  check("send: returns false when writeEarlyHints missing",
+        b.earlyHints.send(noFn, { link: "<x>; rel=preload" }) === false);
+}
+
+function testCaseVariantLinkRefused() {
+  // Pre-v0.8.89 bug: supplying both `link` (lowercase) AND `Link`
+  // (capital) bypassed validation. opts.link got validated; opts.Link
+  // got lowercased in the trailing header loop and overwrote
+  // headers.link with the unvalidated value. Now the case-variant
+  // collision refuses explicitly.
+  var res = _mockRes();
+  var threw = null;
+  try {
+    b.earlyHints.send(res, {
+      link: "</a.css>; rel=preload; as=style",       // would validate
+      Link: "garbage no rel param",                  // would have bypassed validation
+    });
+  } catch (e) { threw = e; }
+  check("send: case-variant Link refused",
+        threw && /duplicate-header/.test(threw.code || ""));
+
+  // Also: a single `Link` (capital-only) variant still gets the
+  // normal validation path applied via canonical-name lookup.
+  var res2 = _mockRes();
+  var ok = b.earlyHints.send(res2, { Link: "</a.css>; rel=preload; as=style" });
+  check("send: capital-Link only validates + sends",
+        ok === true &&
+        Array.isArray(res2._calls()[0].link) &&
+        res2._calls()[0].link[0].indexOf("</a.css>") === 0);
+
+  // And: capital-Link with bad content refuses (validation runs).
+  var res3 = _mockRes();
+  var threw3 = null;
+  try { b.earlyHints.send(res3, { Link: "no-rel-param" }); }
+  catch (e) { threw3 = e; }
+  check("send: capital-Link with bad link refuses",
+        threw3 && /bad-link/.test(threw3.code || ""));
+}
+
+function testKnownRelations() {
+  var res = _mockRes();
+  var relations = ["preload", "preconnect", "prefetch", "dns-prefetch",
+                   "modulepreload", "prerender", "next", "prev"];
+  for (var i = 0; i < relations.length; i += 1) {
+    var ok = b.earlyHints.send(res, { link: "<x>; rel=" + relations[i] });
+    check("send: rel=" + relations[i] + " accepted", ok === true);
+  }
+}
+
+async function run() {
+  testSurface();
+  testHappyPath();
+  testSingleStringLink();
+  testRefusesBadShape();
+  testNoWriteEarlyHintsFallback();
+  testCaseVariantLinkRefused();
+  testKnownRelations();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { console.log("OK"); })
+       .catch(function (e) { console.error(e); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/events.test.js

@@ -0,0 +1,105 @@
+"use strict";
+/**
+ * events — framework breach-detection signal bus.
+ *
+ * Run standalone: `node test/layer-0-primitives/events.test.js`
+ * Or via smoke:   `node test/smoke.js`
+ */
+
+var helpers = require("../helpers");
+var b     = helpers.b;
+var check = helpers.check;
+
+function testEventsSurface() {
+  check("b.events namespace present",        typeof b.events === "object");
+  check("b.events.on is a function",         typeof b.events.on === "function");
+  check("b.events.off is a function",        typeof b.events.off === "function");
+  check("b.events.once is a function",       typeof b.events.once === "function");
+  check("b.events.emit is a function",       typeof b.events.emit === "function");
+  check("b.events.listenerCount is a function", typeof b.events.listenerCount === "function");
+  check("b.events.EVENTS is frozen object",  typeof b.events.EVENTS === "object" && Object.isFrozen(b.events.EVENTS));
+  check("EVENTS.AUDIT_CHAIN_BREAK constant",      b.events.EVENTS.AUDIT_CHAIN_BREAK === "audit:chain-break");
+  check("EVENTS.AUDIT_CHECKPOINT_BREAK constant", b.events.EVENTS.AUDIT_CHECKPOINT_BREAK === "audit:checkpoint-break");
+  check("EVENTS.AUDIT_ROLLBACK_DETECTED constant", b.events.EVENTS.AUDIT_ROLLBACK_DETECTED === "audit:rollback-detected");
+  check("EVENTS.NTP_DRIFT constant",         b.events.EVENTS.NTP_DRIFT === "audit:ntp-drift");
+}
+
+function testEventsListenerFires() {
+  b.events._resetForTest();
+  var got = null;
+  b.events.on(b.events.EVENTS.AUDIT_CHAIN_BREAK, function (info) { got = info; });
+  var hadListener = b.events.emit(b.events.EVENTS.AUDIT_CHAIN_BREAK, { table: "audit_log", reason: "test" });
+  check("emit returns true when listener present",  hadListener === true);
+  check("listener received the payload",            got && got.reason === "test");
+}
+
+function testEventsMultipleListeners() {
+  b.events._resetForTest();
+  var calls = 0;
+  function l1() { calls++; }
+  function l2() { calls++; }
+  b.events.on(b.events.EVENTS.NTP_DRIFT, l1);
+  b.events.on(b.events.EVENTS.NTP_DRIFT, l2);
+  check("listenerCount tracks two listeners",       b.events.listenerCount(b.events.EVENTS.NTP_DRIFT) === 2);
+  b.events.emit(b.events.EVENTS.NTP_DRIFT, { driftMs: 999 });
+  check("both listeners fire",                      calls === 2);
+}
+
+function testEventsOffRemovesListener() {
+  b.events._resetForTest();
+  var calls = 0;
+  function l() { calls++; }
+  b.events.on(b.events.EVENTS.AUDIT_ROLLBACK_DETECTED, l);
+  b.events.emit(b.events.EVENTS.AUDIT_ROLLBACK_DETECTED, {});
+  b.events.off(b.events.EVENTS.AUDIT_ROLLBACK_DETECTED, l);
+  b.events.emit(b.events.EVENTS.AUDIT_ROLLBACK_DETECTED, {});
+  check("off() removes listener — second emit not received", calls === 1);
+}
+
+function testEventsOnceFiresOnceOnly() {
+  b.events._resetForTest();
+  var calls = 0;
+  b.events.once(b.events.EVENTS.NTP_DRIFT, function () { calls++; });
+  b.events.emit(b.events.EVENTS.NTP_DRIFT, {});
+  b.events.emit(b.events.EVENTS.NTP_DRIFT, {});
+  check("once() listener fires exactly once",       calls === 1);
+}
+
+function testEventsEmitSwallowsListenerThrows() {
+  b.events._resetForTest();
+  var secondCalled = false;
+  b.events.on(b.events.EVENTS.AUDIT_CHAIN_BREAK, function () { throw new Error("boom"); });
+  b.events.on(b.events.EVENTS.AUDIT_CHAIN_BREAK, function () { secondCalled = true; });
+  // Should NOT throw — emit must be best-effort because callers fire it
+  // immediately before process.exit on fail-fast paths.
+  var threw = null;
+  try { b.events.emit(b.events.EVENTS.AUDIT_CHAIN_BREAK, {}); } catch (e) { threw = e; }
+  check("emit swallows per-listener throws",        threw === null);
+  check("subsequent listener still fires after a thrower", secondCalled === true);
+}
+
+function testEventsEmitWithNoListenersIsNoop() {
+  b.events._resetForTest();
+  var hadListener = b.events.emit("audit:nonexistent", { x: 1 });
+  check("emit with no listeners returns false",     hadListener === false);
+}
+
+async function run() {
+  testEventsSurface();
+  testEventsListenerFires();
+  testEventsMultipleListeners();
+  testEventsOffRemovesListener();
+  testEventsOnceFiresOnceOnly();
+  testEventsEmitSwallowsListenerThrows();
+  testEventsEmitWithNoListenersIsNoop();
+}
+
+module.exports = { run: run };
+
+// Standalone execution: node test/layer-0-primitives/events.test.js
+if (require.main === module) {
+  run().then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e.message); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/exploit-replay.test.js

@@ -0,0 +1,243 @@
+"use strict";
+/**
+ * exploit-replay - replay every fixture under test/fixtures/exploit-corpus/
+ * against the named target primitive and assert the documented outcome.
+ *
+ * Fixture format (test/fixtures/exploit-corpus/*.json):
+ *   { entries: [{
+ *       id, cve, category,
+ *       exploit_input | exploit_input_b64,   // raw OR base64-encoded
+ *       target_primitive,                    // dotted b.* path
+ *       expected_outcome,                    // 'refused' | 'sanitized'
+ *       expected_audit?: [...]               // optional audit-shape list
+ *   }, ...] }
+ *
+ * The harness handles each `target_primitive` via a small dispatch
+ * table - the corpus stays declarative; new exploit classes add an
+ * entry without touching test code (provided the target primitive is
+ * already wired in DISPATCHERS below).
+ *
+ * Resolution rules:
+ *   - 'refused':   primitive returns ok=false / action=refuse OR throws
+ *                  a *Error class.
+ *   - 'sanitized': primitive returns ok=true with action != 'refuse'
+ *                  (action='serve' / 'audit-only' / 'sanitize') OR
+ *                  primitive's sanitize() runs without throwing.
+ *
+ * Runs in the default smoke (layer-0). Adding entries grows the
+ * corpus without scaling the harness.
+ */
+
+var fs = require("node:fs");
+var path = require("node:path");
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+var CORPUS_DIR = path.resolve(__dirname, "..", "fixtures", "exploit-corpus");
+
+function _loadCorpus() {
+  var entries = [];
+  var files;
+  try { files = fs.readdirSync(CORPUS_DIR); }
+  catch (_e) { return []; }
+  for (var i = 0; i < files.length; i += 1) {
+    if (!/\.json$/.test(files[i])) continue;
+    var full = path.join(CORPUS_DIR, files[i]);
+    var raw;
+    try { raw = JSON.parse(fs.readFileSync(full, "utf8")); }
+    catch (e) {
+      throw new Error("exploit-replay: failed to parse " + full + ": " + (e && e.message));
+    }
+    if (raw && Array.isArray(raw.entries)) {
+      for (var j = 0; j < raw.entries.length; j += 1) {
+        entries.push(Object.assign({}, raw.entries[j], { _file: files[i] }));
+      }
+    }
+  }
+  return entries;
+}
+
+function _decodeInput(entry) {
+  if (typeof entry.exploit_input === "string") return entry.exploit_input;
+  if (typeof entry.exploit_input_b64 === "string") {
+    return Buffer.from(entry.exploit_input_b64, "base64").toString("utf8");
+  }
+  throw new Error("exploit-replay[" + entry.id + "]: missing exploit_input / exploit_input_b64");
+}
+
+// ---- Dispatch table ----
+//
+// Maps `target_primitive` (the corpus's dotted name) to a function
+// that runs the primitive against the decoded input and returns one
+// of:
+//   { result: 'refused' }    primitive refused (action=refuse | threw)
+//   { result: 'sanitized' }  primitive accepted (any non-refuse action)
+//
+// Each dispatcher catches errors so the harness handles them
+// uniformly.
+function _runValidate(guard, input, opts) {
+  try {
+    var rv = guard.validate(input, opts || { profile: "strict" });
+    if (!rv) return { result: "refused" };
+    if (rv.action === "refuse" || rv.ok === false) return { result: "refused" };
+    return { result: "sanitized" };
+  } catch (e) { return { result: "refused", caught: e }; }
+}
+
+function _runValidateBytes(guard, input, opts) {
+  try {
+    var bytes = Buffer.from(input, "utf8");
+    var rv = guard.validate(bytes, opts || { profile: "strict" });
+    if (!rv) return { result: "refused" };
+    if (rv.action === "refuse" || rv.ok === false) return { result: "refused" };
+    return { result: "sanitized" };
+  } catch (e) { return { result: "refused", caught: e }; }
+}
+
+var DISPATCHERS = {
+  "ssrfGuard.assertSafe": function (input) {
+    try {
+      // ssrfGuard.assertSafe throws on refuse; returns silently on safe.
+      b.ssrfGuard.assertSafe(input);
+      return { result: "sanitized" };
+    } catch (e) { return { result: "refused", caught: e }; }
+  },
+  "safeUrl.parse": function (input) {
+    try {
+      var p = b.safeUrl.parse(input);
+      // safeUrl returns a parsed URL or throws on malformed input.
+      // For CSRF origin spoof we expect a parseable but flagged URL;
+      // the primitive doesn't refuse based on origin alone (operator
+      // wires CSRF middleware on top). Treat as 'sanitized' when
+      // parse succeeds.
+      return { result: p ? "sanitized" : "refused" };
+    } catch (e) { return { result: "refused", caught: e }; }
+  },
+  "safeSql.assertIdentifier": function (input) {
+    try {
+      b.safeSql.assertIdentifier(input);
+      return { result: "sanitized" };
+    } catch (e) { return { result: "refused", caught: e }; }
+  },
+  "fileType.detect": function (input) {
+    try {
+      var bytes = Buffer.from(input, "utf8");
+      var det = b.fileType.detect(bytes);
+      // Polyglot detection surfaces as either an unknown type or a
+      // multi-magic flag; either is 'sanitized' (caller reads the
+      // detection and refuses upstream).
+      return { result: det ? "sanitized" : "refused" };
+    } catch (e) { return { result: "refused", caught: e }; }
+  },
+  "guardCsv.validate":     function (i) { return _runValidate(b.guardCsv,     i); },
+  "guardHtml.validate":    function (i) { return _runValidate(b.guardHtml,    i); },
+  "guardSvg.validate":     function (i) { return _runValidateBytes(b.guardSvg, i); },
+  "guardJson.validate":    function (i) { return _runValidate(b.guardJson,    i); },
+  "guardYaml.validate":    function (i) { return _runValidate(b.guardYaml,    i); },
+  "guardXml.validate":     function (i) { return _runValidate(b.guardXml,     i); },
+  "guardMarkdown.validate":function (i) { return _runValidate(b.guardMarkdown,i); },
+  "guardEmail.validate":   function (i) { return _runValidate(b.guardEmail,   i); },
+  "guardEmail.validateMessage": function (input) {
+    try {
+      if (typeof b.guardEmail.validateMessage !== "function") {
+        // Fallback to validate() when the validateMessage surface
+        // isn't registered (bare-address profile).
+        return _runValidate(b.guardEmail, input);
+      }
+      var rv = b.guardEmail.validateMessage(input, { profile: "strict" });
+      if (!rv || rv.action === "refuse" || rv.ok === false) return { result: "refused" };
+      return { result: "sanitized" };
+    } catch (e) { return { result: "refused", caught: e }; }
+  },
+  "guardDomain.validate":  function (i) { return _runValidate(b.guardDomain,  i); },
+  "guardUuid.validate":    function (i) { return _runValidate(b.guardUuid,    i); },
+  "guardJwt.validate":     function (i) { return _runValidate(b.guardJwt,     i); },
+  "guardOauth.validate":   function (i) { return _runValidate(b.guardOauth,   i); },
+  "guardShell.validate":   function (i) { return _runValidate(b.guardShell,   i); },
+  "guardRegex.validate":   function (i, entry) {
+    return _runValidate(b.guardRegex, i,
+      Object.assign({ profile: "strict" }, (entry && entry.opts) || {}));
+  },
+  "guardGraphql.validate": function (i, entry) {
+    return _runValidate(b.guardGraphql, i,
+      Object.assign({ profile: "strict" }, (entry && entry.opts) || {}));
+  },
+  "guardJsonpath.validate":function (i) { return _runValidate(b.guardJsonpath,i); },
+  "guardTemplate.validate":function (i) { return _runValidate(b.guardTemplate,i); },
+  "guardFilename.validate":function (i) { return _runValidate(b.guardFilename,i); },
+  "guardArchive.validateEntries": function (input) {
+    try {
+      // operator-feeds-metadata pattern — guardArchive doesn't parse
+      // the bytes; we synthesize a single-entry list with the input
+      // taken as a path. For the zip-slip fixture, that's sufficient.
+      var rv = b.guardArchive.validateEntries([{ path: input, sizeBytes: 1 }],
+        { profile: "strict" });
+      if (!rv || rv.action === "refuse" || rv.ok === false) return { result: "refused" };
+      return { result: "sanitized" };
+    } catch (e) { return { result: "refused", caught: e }; }
+  },
+};
+
+function testCorpusReplay() {
+  var entries = _loadCorpus();
+  check("corpus has at least 30 entries", entries.length >= 30);
+
+  var byCategory = Object.create(null);
+  var unsupported = [];
+  var wrongOutcome = [];
+  for (var i = 0; i < entries.length; i += 1) {
+    var entry = entries[i];
+    byCategory[entry.category] = (byCategory[entry.category] || 0) + 1;
+    var dispatcher = DISPATCHERS[entry.target_primitive];
+    if (!dispatcher) {
+      unsupported.push(entry.id + " -> " + entry.target_primitive);
+      continue;
+    }
+    var input;
+    try { input = _decodeInput(entry); }
+    catch (e) {
+      wrongOutcome.push(entry.id + ": decode failed - " + (e && e.message));
+      continue;
+    }
+    var observed;
+    try { observed = dispatcher(input, entry); }
+    catch (e) {
+      wrongOutcome.push(entry.id + ": dispatcher threw - " + (e && e.message));
+      continue;
+    }
+    if (observed.result !== entry.expected_outcome) {
+      wrongOutcome.push(entry.id + " (" + entry.target_primitive + "): expected '" +
+        entry.expected_outcome + "' got '" + observed.result + "'" +
+        (observed.caught ? " [" + observed.caught.code + ": " + observed.caught.message + "]" : ""));
+    }
+  }
+
+  if (unsupported.length > 0) {
+    console.warn("exploit-replay: corpus references unsupported primitives:");
+    unsupported.forEach(function (u) { console.warn("  - " + u); });
+  }
+  check("every corpus target is wired in the dispatch table", unsupported.length === 0);
+
+  if (wrongOutcome.length > 0) {
+    console.error("exploit-replay: " + wrongOutcome.length + " fixture(s) regressed:");
+    wrongOutcome.forEach(function (w) { console.error("  - " + w); });
+  }
+  check("every fixture matches its expected_outcome", wrongOutcome.length === 0);
+
+  var categoryCount = Object.keys(byCategory).length;
+  check("corpus covers at least 15 distinct exploit categories", categoryCount >= 15);
+}
+
+async function run() {
+  testCorpusReplay();
+}
+
+module.exports = { run: run, _loadCorpus: _loadCorpus };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("OK - " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", (e && e.stack) || e); process.exit(1); }
+  );
+}