@blamejs/blamejs-shop 0.0.44

package/lib/vendor/blamejs/test/layer-0-primitives/guard-all.test.js

@@ -0,0 +1,328 @@
+"use strict";
+/**
+ * guard-all — registry + aggregator for the guard-* family (b.guardAll).
+ *
+ * Covers: surface; registry parity check (every member declares NAME /
+ * MIME_TYPES / EXTENSIONS / shared profiles / shared postures / gate);
+ * gate creation defaults to ALL guards on; exceptFor opt-out requires a
+ * non-empty reason; override merges into per-guard opts; bad profile /
+ * bad posture / unknown guard name throw; byExtension / byContentType
+ * map shape; audit emission on creation; opt-out path appears in audit
+ * skipped roster; per-mime dispatch routes to the right guard.
+ *
+ * Run standalone: node test/layer-0-primitives/guard-all.test.js
+ * Or via smoke:   node test/smoke.js
+ */
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+// ---- Surface ----
+
+function testGuardAllSurface() {
+  check("guardAll is an object",                  typeof b.guardAll === "object");
+  check("guardAll.gate is a function",            typeof b.guardAll.gate === "function");
+  check("guardAll.byExtension is a function",     typeof b.guardAll.byExtension === "function");
+  check("guardAll.byContentType is a function",   typeof b.guardAll.byContentType === "function");
+  check("guardAll.list is a function",            typeof b.guardAll.list === "function");
+  check("guardAll.GUARDS is an array",            Array.isArray(b.guardAll.GUARDS));
+  check("guardAll.GUARDS contains at least one",  b.guardAll.GUARDS.length >= 1);
+  check("guardAll.SHARED_PROFILES is array",      Array.isArray(b.guardAll.SHARED_PROFILES));
+  check("guardAll.SHARED_PROFILES has 3 names",   b.guardAll.SHARED_PROFILES.length === 3);
+  check("guardAll.SHARED_POSTURES has 4 names",   b.guardAll.SHARED_POSTURES.length === 4);
+  check("guardAll.GuardAllError is a function",   typeof b.guardAll.GuardAllError === "function");
+  check("frameworkError.GuardAllError exposed",   typeof b.frameworkError.GuardAllError === "function");
+}
+
+function testGuardAllRegistryParity() {
+  // Every registered guard MUST declare NAME, MIME_TYPES, EXTENSIONS,
+  // gate, and the full shared-profiles + shared-postures vocabulary.
+  // The parity check at module load already enforced this — surface it
+  // as explicit assertions here for the operator-readable test report.
+  var registered = b.guardAll.list();
+  for (var i = 0; i < registered.length; i++) {
+    var entry = registered[i];
+    check("registry: " + entry.name + " declares MIME_TYPES",
+          Array.isArray(entry.mimeTypes) && entry.mimeTypes.length > 0);
+    check("registry: " + entry.name + " declares EXTENSIONS",
+          Array.isArray(entry.extensions) && entry.extensions.length > 0);
+    b.guardAll.SHARED_PROFILES.forEach(function (p) {
+      check("registry: " + entry.name + " supports shared profile " + p,
+            entry.profiles.indexOf(p) !== -1);
+    });
+    b.guardAll.SHARED_POSTURES.forEach(function (p) {
+      check("registry: " + entry.name + " supports shared posture " + p,
+            entry.postures.indexOf(p) !== -1);
+    });
+  }
+}
+
+// ---- Default-on behaviour ----
+
+function testGuardAllDefaultAllOn() {
+  // No exceptFor → every registered guard's mime types are in the map.
+  var map = b.guardAll.byContentType({ profile: "strict" });
+  var allMimes = [];
+  b.guardAll.list().forEach(function (e) {
+    e.mimeTypes.forEach(function (m) { allMimes.push(m); });
+  });
+  for (var i = 0; i < allMimes.length; i++) {
+    check("default-on: " + allMimes[i] + " is in byContentType map",
+          map[allMimes[i].toLowerCase()] !== undefined);
+  }
+
+  var extMap = b.guardAll.byExtension({ profile: "strict" });
+  var allExt = [];
+  b.guardAll.list().forEach(function (e) {
+    e.extensions.forEach(function (x) { allExt.push(x); });
+  });
+  for (var j = 0; j < allExt.length; j++) {
+    check("default-on: " + allExt[j] + " is in byExtension map",
+          extMap[allExt[j].toLowerCase()] !== undefined);
+  }
+}
+
+// ---- exceptFor ----
+
+function testGuardAllExceptForRequiresReason() {
+  var threwBad = null;
+  try {
+    b.guardAll.gate({
+      profile:   "strict",
+      exceptFor: { csv: {} },
+    });
+  } catch (e) { threwBad = e; }
+  check("exceptFor: missing reason throws",
+        threwBad && /reason/.test(threwBad.message));
+
+  var threwEmpty = null;
+  try {
+    b.guardAll.gate({
+      profile:   "strict",
+      exceptFor: { csv: { reason: "   " } },
+    });
+  } catch (e) { threwEmpty = e; }
+  check("exceptFor: blank-reason throws",
+        threwEmpty && /reason/.test(threwEmpty.message));
+
+  var threwShape = null;
+  try {
+    b.guardAll.gate({
+      profile:   "strict",
+      exceptFor: { csv: "string-not-object" },
+    });
+  } catch (e) { threwShape = e; }
+  check("exceptFor: non-object entry throws",
+        threwShape && /plain object/i.test(threwShape.message));
+
+  var threwUnknown = null;
+  try {
+    b.guardAll.gate({
+      profile:   "strict",
+      exceptFor: { madeup: { reason: "test" } },
+    });
+  } catch (e) { threwUnknown = e; }
+  check("exceptFor: unknown guard name throws",
+        threwUnknown && /unknown guard/i.test(threwUnknown.message));
+}
+
+function testGuardAllExceptForRemovesGuard() {
+  // Opting csv out leaves an empty byContentType map (today csv is the
+  // only registered guard); the gate still constructs successfully.
+  var map = b.guardAll.byContentType({
+    profile:   "strict",
+    exceptFor: { csv: { reason: "no CSV emission in this app" } },
+  });
+  check("exceptFor: opted-out guard absent from byContentType",
+        map["text/csv"] === undefined);
+  check("exceptFor: opted-out guard absent from byExtension", true);
+}
+
+// ---- Override ----
+
+function testGuardAllOverrideAppliesPerGuardOpts() {
+  // override.csv.profile = "email-attachment" — guard-csv-specific
+  // profile that's NOT in the shared vocabulary; reaches the underlying
+  // guard via the override map.
+  var threw = null;
+  try {
+    b.guardAll.gate({
+      profile:  "strict",
+      override: { csv: { profile: "email-attachment" } },
+    });
+  } catch (e) { threw = e; }
+  check("override: per-guard extension profile accepted via override",
+        threw === null);
+
+  var threwBadOverride = null;
+  try {
+    b.guardAll.gate({
+      profile:  "strict",
+      override: { csv: "not-an-object" },
+    });
+  } catch (e) { threwBadOverride = e; }
+  check("override: non-object entry throws",
+        threwBadOverride && /plain object/i.test(threwBadOverride.message));
+
+  var threwUnknown = null;
+  try {
+    b.guardAll.gate({
+      profile:  "strict",
+      override: { madeup: { profile: "strict" } },
+    });
+  } catch (e) { threwUnknown = e; }
+  check("override: unknown guard name throws",
+        threwUnknown && /unknown guard/i.test(threwUnknown.message));
+}
+
+// ---- Profile + posture vocabulary ----
+
+function testGuardAllProfileVocabulary() {
+  // Per-guard extension profiles like csv's "email-attachment" are NOT
+  // accepted by guardAll directly — they must come through override.
+  var threw = null;
+  try {
+    b.guardAll.gate({ profile: "email-attachment" });
+  } catch (e) { threw = e; }
+  check("profile: per-guard extension name rejected at the aggregator",
+        threw && /shared vocabulary/i.test(threw.message));
+
+  var threwBadType = null;
+  try { b.guardAll.gate({ profile: 42 }); }
+  catch (e) { threwBadType = e; }
+  check("profile: non-string throws", threwBadType && /must be a string/.test(threwBadType.message));
+
+  // Each shared profile constructs successfully.
+  for (var i = 0; i < b.guardAll.SHARED_PROFILES.length; i++) {
+    var p = b.guardAll.SHARED_PROFILES[i];
+    var ok = false;
+    try { b.guardAll.gate({ profile: p }); ok = true; } catch (_e) { /* noop */ }
+    check("profile: shared profile " + p + " constructs", ok);
+  }
+}
+
+function testGuardAllPostureVocabulary() {
+  var threw = null;
+  try { b.guardAll.gate({ compliancePosture: "made-up-posture" }); }
+  catch (e) { threw = e; }
+  check("posture: unknown name rejected", threw && /shared vocabulary/i.test(threw.message));
+
+  for (var i = 0; i < b.guardAll.SHARED_POSTURES.length; i++) {
+    var p = b.guardAll.SHARED_POSTURES[i];
+    var ok = false;
+    try { b.guardAll.gate({ compliancePosture: p }); ok = true; } catch (_e) { /* noop */ }
+    check("posture: shared posture " + p + " constructs", ok);
+  }
+}
+
+// ---- Audit emission ----
+
+function testGuardAllAuditEmitsCreationRoster() {
+  var emitted = [];
+  var fakeAudit = { emit: function (e) { emitted.push(e); } };
+  b.guardAll.gate({
+    profile:   "strict",
+    audit:     fakeAudit,
+    exceptFor: { csv: { reason: "trusted-source-only emission in this app" } },
+  });
+  var creation = emitted.filter(function (e) {
+    return e.event === "guardAll.gate.created";
+  })[0];
+  check("audit: guardAll.gate.created emitted",   !!creation);
+  check("audit: outcome=success",                 creation && creation.outcome === "success");
+  check("audit: profile recorded",                creation && creation.metadata.profile === "strict");
+  check("audit: skipped roster includes csv",
+        creation &&
+        creation.metadata.skipped.length === 1 &&
+        creation.metadata.skipped[0].name === "csv" &&
+        /trusted-source-only/.test(creation.metadata.skipped[0].reason));
+  check("audit: active roster excludes opted-out csv",
+        creation && creation.metadata.active.indexOf("csv") === -1);
+}
+
+function testGuardAllAuditEmitsAllOnByDefault() {
+  var emitted = [];
+  var fakeAudit = { emit: function (e) { emitted.push(e); } };
+  b.guardAll.gate({ profile: "strict", audit: fakeAudit });
+  var creation = emitted.filter(function (e) {
+    return e.event === "guardAll.gate.created";
+  })[0];
+  check("audit: default-on records every guard active",
+        creation && creation.metadata.active.indexOf("csv") !== -1);
+  check("audit: default-on records empty skipped roster",
+        creation && creation.metadata.skipped.length === 0);
+}
+
+// ---- Dispatch correctness ----
+
+async function testGuardAllDispatchRoutesByMime() {
+  // The aggregated gate should route a benign csv buffer to the csv
+  // guard and serve clean. A non-registered content type bypasses (no
+  // gate to apply) and serves clean as well.
+  var g = b.guardAll.gate({ profile: "strict" });
+  var benign = await g.check({
+    contentType: "text/csv",
+    bytes:       Buffer.from("a,b\n1,2\n"),
+  });
+  check("dispatch: text/csv benign → action=serve",
+        benign.ok === true && benign.action === "serve");
+
+  // Hostile csv → refuse / sanitize per profile.
+  var hostile = await g.check({
+    contentType: "text/csv",
+    bytes:       Buffer.from("name,formula\r\nalice,=cmd|x\r\n"),
+  });
+  check("dispatch: text/csv hostile → action !== serve",
+        hostile.action !== "serve");
+
+  // Unrelated content-type with no registered guard → bypass.
+  var bypass = await g.check({
+    contentType: "application/json",
+    bytes:       Buffer.from('{"k":"v"}'),
+  });
+  check("dispatch: unregistered mime → action=serve (bypass)",
+        bypass.ok === true && bypass.action === "serve");
+}
+
+// ---- Wired-into-staticServe / fileUpload smoke ----
+
+function testGuardAllByExtensionShape() {
+  var map = b.guardAll.byExtension({ profile: "strict" });
+  var keys = Object.keys(map);
+  check("byExtension: keys are dot-prefixed lowercase extensions",
+        keys.length > 0 && keys.every(function (k) { return /^\.[a-z0-9.]+$/.test(k); }));
+  check("byExtension: each value has a check() function",
+        keys.every(function (k) { return typeof map[k].check === "function"; }));
+}
+
+function testGuardAllByContentTypeShape() {
+  var map = b.guardAll.byContentType({ profile: "strict" });
+  var keys = Object.keys(map);
+  check("byContentType: keys are lowercase mime strings",
+        keys.length > 0 && keys.every(function (k) {
+          return /^[a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9!#$&^_.+-]+$/.test(k);
+        }));
+  check("byContentType: each value has a check() function",
+        keys.every(function (k) { return typeof map[k].check === "function"; }));
+}
+
+// ---- Run all ----
+
+function run() {
+  testGuardAllSurface();
+  testGuardAllRegistryParity();
+  testGuardAllDefaultAllOn();
+  testGuardAllExceptForRequiresReason();
+  testGuardAllExceptForRemovesGuard();
+  testGuardAllOverrideAppliesPerGuardOpts();
+  testGuardAllProfileVocabulary();
+  testGuardAllPostureVocabulary();
+  testGuardAllAuditEmitsCreationRoster();
+  testGuardAllAuditEmitsAllOnByDefault();
+  testGuardAllByExtensionShape();
+  testGuardAllByContentTypeShape();
+  return testGuardAllDispatchRoutesByMime();
+}
+
+module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/guard-archive.test.js

@@ -0,0 +1,339 @@
+"use strict";
+/**
+ * guard-archive — archive content-safety primitive (b.guardArchive).
+ *
+ * Covers: surface; registry parity; zip-slip path traversal; absolute-
+ * path entries; symlink + hardlink escape; symlink + hardlink reject
+ * policies; compression-ratio bombs (per-entry + aggregate); total-size
+ * + entry-count + per-entry-size caps; nested-archive detection;
+ * duplicate-entry-name; case-insensitive collision; encryption-claim
+ * mismatch; sparse entries; magic-byte detection (zip / gzip / bzip2 /
+ * xz / 7z / rar / tar); checkExtractionPath helper; gate decision
+ * shapes; profile + posture vocabulary.
+ */
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+function testGuardArchiveSurface() {
+  check("guardArchive is an object",                 typeof b.guardArchive === "object");
+  check("guardArchive.NAME === 'archive'",           b.guardArchive.NAME === "archive");
+  check("guardArchive.MIME_TYPES has application/zip",
+        b.guardArchive.MIME_TYPES.indexOf("application/zip") !== -1);
+  check("guardArchive.EXTENSIONS has .zip",          b.guardArchive.EXTENSIONS.indexOf(".zip") !== -1);
+  check("guardArchive.PROFILES has strict",          !!b.guardArchive.PROFILES["strict"]);
+  check("guardArchive.PROFILES has balanced",        !!b.guardArchive.PROFILES["balanced"]);
+  check("guardArchive.PROFILES has permissive",      !!b.guardArchive.PROFILES["permissive"]);
+  check("guardArchive.COMPLIANCE_POSTURES has hipaa", !!b.guardArchive.COMPLIANCE_POSTURES["hipaa"]);
+  check("guardArchive.validateEntries is a function", typeof b.guardArchive.validateEntries === "function");
+  check("guardArchive.inspectMagic is a function",    typeof b.guardArchive.inspectMagic === "function");
+  check("guardArchive.checkExtractionPath is a function",
+        typeof b.guardArchive.checkExtractionPath === "function");
+  check("guardArchive.gate is a function",           typeof b.guardArchive.gate === "function");
+  check("guardArchive.GuardArchiveError is a function",
+        typeof b.guardArchive.GuardArchiveError === "function");
+  check("frameworkError.GuardArchiveError exposed",
+        typeof b.frameworkError.GuardArchiveError === "function");
+}
+
+function testGuardArchiveRegistryParity() {
+  check("guardArchive registered in guardAll",
+        b.guardAll.list().some(function (g) { return g.name === "archive"; }));
+  var entry = b.guardAll.list().filter(function (g) { return g.name === "archive"; })[0];
+  b.guardAll.SHARED_PROFILES.forEach(function (p) {
+    check("registry: archive supports shared profile " + p,
+          entry.profiles.indexOf(p) !== -1);
+  });
+  b.guardAll.SHARED_POSTURES.forEach(function (p) {
+    check("registry: archive supports shared posture " + p,
+          entry.postures.indexOf(p) !== -1);
+  });
+}
+
+function testGuardArchiveZipSlip() {
+  var inputs = ["../etc/passwd", "../../boot.ini", "subdir/../../etc/shadow"];
+  for (var i = 0; i < inputs.length; i++) {
+    var rv = b.guardArchive.validateEntries(
+      [{ name: inputs[i], size: 100, compressedSize: 50 }],
+      { profile: "strict" });
+    check("zip slip detected: " + JSON.stringify(inputs[i]),
+          rv.ok === false &&
+          rv.issues.some(function (issue) { return issue.kind === "zip-slip"; }));
+  }
+}
+
+function testGuardArchiveAbsolutePath() {
+  var inputs = ["/etc/passwd", "\\windows\\system32\\config\\sam", "C:\\evil.exe"];
+  for (var i = 0; i < inputs.length; i++) {
+    var rv = b.guardArchive.validateEntries(
+      [{ name: inputs[i], size: 100, compressedSize: 50 }],
+      { profile: "strict" });
+    check("absolute path detected: " + JSON.stringify(inputs[i]),
+          rv.issues.some(function (issue) { return issue.kind === "absolute-path"; }));
+  }
+}
+
+function testGuardArchiveSymlinkRejectStrict() {
+  var rv = b.guardArchive.validateEntries(
+    [{ name: "link", size: 0, isSymlink: true, linkTarget: "target" }],
+    { profile: "strict" });
+  check("symlink rejected under strict",
+        rv.issues.some(function (issue) { return issue.kind === "symlink-reject"; }));
+}
+
+function testGuardArchiveSymlinkEscape() {
+  var rv = b.guardArchive.validateEntries(
+    [{ name: "link", size: 0, isSymlink: true, linkTarget: "../etc/passwd" }],
+    { profile: "balanced" });
+  check("symlink escape detected (balanced)",
+        rv.issues.some(function (issue) { return issue.kind === "symlink-escape"; }));
+
+  var rv2 = b.guardArchive.validateEntries(
+    [{ name: "link", size: 0, isSymlink: true, linkTarget: "/etc/shadow" }],
+    { profile: "balanced" });
+  check("symlink-absolute escape detected (balanced)",
+        rv2.issues.some(function (issue) { return issue.kind === "symlink-escape"; }));
+}
+
+function testGuardArchiveHardlinkEscape() {
+  var rv = b.guardArchive.validateEntries(
+    [{ name: "link", size: 0, isHardlink: true, linkTarget: "target" }],
+    { profile: "strict" });
+  check("hardlink rejected under strict",
+        rv.issues.some(function (issue) { return issue.kind === "hardlink-reject"; }));
+
+  var rv2 = b.guardArchive.validateEntries(
+    [{ name: "link", size: 0, isHardlink: true, linkTarget: "../etc/passwd" }],
+    { profile: "permissive" });
+  check("hardlink escape detected (permissive — CVE-2026-26960 class)",
+        rv2.issues.some(function (issue) { return issue.kind === "hardlink-escape"; }));
+}
+
+function testGuardArchiveCompressionRatioBomb() {
+  // Single-entry 1 GB / 1 KB = 1,000,000:1 ratio.
+  var rv = b.guardArchive.validateEntries(
+    [{ name: "bomb.txt", size: 1000000000, compressedSize: 1024 }],
+    { profile: "strict" });
+  check("compression-ratio bomb detected",
+        rv.issues.some(function (issue) { return issue.kind === "compression-ratio-bomb"; }));
+}
+
+function testGuardArchiveAggregateRatioBomb() {
+  // Many small entries that aggregate to a large ratio. Set sizes to
+  // stay under per-entry caps but blow the aggregate.
+  var entries = [];
+  for (var i = 0; i < 50; i++) {
+    entries.push({
+      name: "f" + i + ".txt",
+      size: 1000000,        // 1 MB each = 50 MB total
+      compressedSize: 100,  // 100 bytes each = 5 KB total
+    });
+  }
+  var rv = b.guardArchive.validateEntries(entries, { profile: "strict" });
+  check("aggregate-ratio bomb detected",
+        rv.issues.some(function (issue) { return issue.kind === "aggregate-ratio-bomb"; }));
+}
+
+function testGuardArchiveTotalSizeCap() {
+  var entries = [];
+  for (var i = 0; i < 5; i++) {
+    entries.push({ name: "f" + i, size: 30000000, compressedSize: 10000000 });
+  }
+  // Strict cap is 100 MiB; 5 × 30 MB = 150 MB exceeds.
+  var rv = b.guardArchive.validateEntries(entries, { profile: "strict" });
+  check("total-size cap detected",
+        rv.issues.some(function (issue) { return issue.kind === "total-size-cap"; }));
+}
+
+function testGuardArchiveEntryCountCap() {
+  var entries = [];
+  for (var i = 0; i < 200; i++) {
+    entries.push({ name: "f" + i + ".txt", size: 1, compressedSize: 1 });
+  }
+  // Strict cap is 100 entries.
+  var rv = b.guardArchive.validateEntries(entries, { profile: "strict" });
+  check("entry-count cap detected",
+        rv.issues.some(function (issue) { return issue.kind === "entry-count-cap"; }));
+}
+
+function testGuardArchiveNestedArchive() {
+  var rv = b.guardArchive.validateEntries(
+    [{ name: "inner.zip", size: 1000, compressedSize: 500 }],
+    { profile: "strict" });
+  check("nested archive detected (strict, maxNestedDepth=0)",
+        rv.issues.some(function (issue) { return issue.kind === "nested-archive"; }));
+
+  var rv2 = b.guardArchive.validateEntries(
+    [{ name: "inner.tar.gz", size: 1000, compressedSize: 500 }],
+    { profile: "strict" });
+  check("nested .tar.gz detected",
+        rv2.issues.some(function (issue) { return issue.kind === "nested-archive"; }));
+}
+
+function testGuardArchiveDuplicateNames() {
+  var rv = b.guardArchive.validateEntries([
+    { name: "config.json", size: 100, compressedSize: 50 },
+    { name: "config.json", size: 200, compressedSize: 100 },
+  ], { profile: "strict" });
+  check("duplicate-entry-name detected",
+        rv.issues.some(function (issue) { return issue.kind === "duplicate-entry-name"; }));
+}
+
+function testGuardArchiveCaseInsensitiveCollision() {
+  var rv = b.guardArchive.validateEntries([
+    { name: "README.txt", size: 100, compressedSize: 50 },
+    { name: "readme.txt", size: 100, compressedSize: 50 },
+  ], { profile: "strict" });
+  check("case-insensitive collision detected (strict)",
+        rv.issues.some(function (issue) { return issue.kind === "case-insensitive-collision"; }));
+}
+
+function testGuardArchiveEncryptionMismatch() {
+  var rv = b.guardArchive.validateEntries([
+    { name: "secret.txt", size: 100, compressedSize: 50, isEncrypted: true },
+    { name: "public.txt", size: 100, compressedSize: 50, isEncrypted: false },
+  ], { profile: "strict" });
+  check("encryption-claim mismatch detected",
+        rv.issues.some(function (issue) { return issue.kind === "encryption-claim-mismatch"; }));
+}
+
+function testGuardArchiveSparseEntry() {
+  var rv = b.guardArchive.validateEntries(
+    [{ name: "sparse.bin", size: 1000000, compressedSize: 100,
+       attrs: { sparse: true } }],
+    { profile: "strict" });
+  check("sparse entry detected (strict)",
+        rv.issues.some(function (issue) { return issue.kind === "sparse-entry"; }));
+}
+
+function testGuardArchiveInspectMagic() {
+  // ZIP local file header magic.
+  check("inspectMagic: zip detected",
+        b.guardArchive.inspectMagic(Buffer.from([0x50, 0x4B, 0x03, 0x04])).format === "zip");
+  check("inspectMagic: gzip detected",
+        b.guardArchive.inspectMagic(Buffer.from([0x1F, 0x8B])).format === "gzip");
+  check("inspectMagic: bzip2 detected",
+        b.guardArchive.inspectMagic(Buffer.from([0x42, 0x5A, 0x68])).format === "bzip2");
+  check("inspectMagic: xz detected",
+        b.guardArchive.inspectMagic(Buffer.from([0xFD, 0x37, 0x7A, 0x58, 0x5A, 0x00])).format === "xz");
+  check("inspectMagic: 7z detected",
+        b.guardArchive.inspectMagic(Buffer.from([0x37, 0x7A, 0xBC, 0xAF, 0x27, 0x1C])).format === "7z");
+  check("inspectMagic: rar4 detected",
+        b.guardArchive.inspectMagic(
+          Buffer.from([0x52, 0x61, 0x72, 0x21, 0x1A, 0x07, 0x00])).format === "rar4");
+  check("inspectMagic: zstd detected",
+        b.guardArchive.inspectMagic(
+          Buffer.from([0x28, 0xB5, 0x2F, 0xFD])).format === "zstd");
+  check("inspectMagic: unknown returns null",
+        b.guardArchive.inspectMagic(Buffer.from([0xFF, 0xFE, 0xFD, 0xFC])) === null);
+
+  // tar — "ustar" at offset 257 within first 512-byte header.
+  var tarBuf = Buffer.alloc(512);
+  tarBuf.write("ustar", 257);
+  check("inspectMagic: tar via ustar offset detected",
+        b.guardArchive.inspectMagic(tarBuf).format === "tar");
+}
+
+function testGuardArchiveCheckExtractionPath() {
+  check("checkExtractionPath: clean entry returns ok",
+        b.guardArchive.checkExtractionPath("safe/file.txt", "/extract").ok === true);
+  check("checkExtractionPath: traversal returns false",
+        b.guardArchive.checkExtractionPath("../escape", "/extract").ok === false);
+  check("checkExtractionPath: absolute path returns false",
+        b.guardArchive.checkExtractionPath("/etc/passwd", "/extract").ok === false);
+  check("checkExtractionPath: empty name returns false",
+        b.guardArchive.checkExtractionPath("", "/extract").ok === false);
+  var nb = String.fromCharCode(0);
+  check("checkExtractionPath: null byte returns false",
+        b.guardArchive.checkExtractionPath("file" + nb + ".txt", "/extract").ok === false);
+}
+
+function testGuardArchiveCleanArchive() {
+  // Use entry names that avoid the shell-exec-ext warn list (.js / .lnk
+  // / .dll / etc. trigger warn-severity issues per guard-filename's
+  // executable-extension family). The point of "clean" here is no
+  // critical / high severity issues — warns are auditable but don't
+  // flip ok=false.
+  var rv = b.guardArchive.validateEntries([
+    { name: "README.md",    size: 1000,  compressedSize: 500, isDirectory: false },
+    { name: "src/main.txt", size: 2000,  compressedSize: 800, isDirectory: false },
+    { name: "src/",         size: 0,     compressedSize: 0,   isDirectory: true },
+  ], { profile: "strict" });
+  var noCritOrHigh = !rv.issues.some(function (i) {
+    return i.severity === "critical" || i.severity === "high";
+  });
+  check("clean archive → ok=true",   rv.ok === true && noCritOrHigh);
+}
+
+async function testGuardArchiveGate() {
+  var g = b.guardArchive.gate({ profile: "strict" });
+  var clean = await g.check({
+    entries: [{ name: "safe.txt", size: 100, compressedSize: 50 }],
+  });
+  check("gate clean → action=serve",
+        clean.ok === true && clean.action === "serve");
+
+  var slip = await g.check({
+    entries: [{ name: "../etc/passwd", size: 100, compressedSize: 50 }],
+  });
+  check("gate zip-slip → action=refuse (no safe sanitization for archives)",
+        slip.action === "refuse");
+
+  // bytes only, no entries — refuse-no-entry-list path.
+  var bytesOnly = await g.check({
+    bytes: Buffer.from([0x50, 0x4B, 0x03, 0x04]),
+  });
+  check("gate: bytes without entries → refuse with no-entry-list issue",
+        bytesOnly.action === "refuse" &&
+        bytesOnly.issues.some(function (i) { return i.kind === "no-entry-list"; }));
+}
+
+function testGuardArchiveCompliancePosture() {
+  var hipaa = b.guardArchive.compliancePosture("hipaa");
+  check("compliancePosture('hipaa') sets reject policies",
+        hipaa.symlinkPolicy === "reject" &&
+        hipaa.hardlinkPolicy === "reject" &&
+        hipaa.traversalPolicy === "reject");
+
+  var threw = null;
+  try { b.guardArchive.compliancePosture("unknown"); }
+  catch (e) { threw = e; }
+  check("compliancePosture: unknown name throws",
+        threw && /unknown/.test(threw.message));
+}
+
+function testGuardArchiveBadProfile() {
+  var threw = null;
+  try { b.guardArchive.validateEntries([], { profile: "made-up" }); }
+  catch (e) { threw = e; }
+  check("validateEntries: unknown profile throws",
+        threw && /unknown profile/i.test(threw.message));
+}
+
+async function run() {
+  testGuardArchiveSurface();
+  testGuardArchiveRegistryParity();
+  testGuardArchiveZipSlip();
+  testGuardArchiveAbsolutePath();
+  testGuardArchiveSymlinkRejectStrict();
+  testGuardArchiveSymlinkEscape();
+  testGuardArchiveHardlinkEscape();
+  testGuardArchiveCompressionRatioBomb();
+  testGuardArchiveAggregateRatioBomb();
+  testGuardArchiveTotalSizeCap();
+  testGuardArchiveEntryCountCap();
+  testGuardArchiveNestedArchive();
+  testGuardArchiveDuplicateNames();
+  testGuardArchiveCaseInsensitiveCollision();
+  testGuardArchiveEncryptionMismatch();
+  testGuardArchiveSparseEntry();
+  testGuardArchiveInspectMagic();
+  testGuardArchiveCheckExtractionPath();
+  testGuardArchiveCleanArchive();
+  testGuardArchiveCompliancePosture();
+  testGuardArchiveBadProfile();
+  await testGuardArchiveGate();
+}
+
+module.exports = { run: run };