@blamejs/blamejs-shop 0.2.12 → 0.2.14

package/lib/vendor/blamejs/lib/calendar.js

@@ -107,8 +107,9 @@ var MAX_EXPAND_SPAN_MS   = 10 * 365 * 24 * 60 * 60 * 1000;
  * @since     0.11.31
  * @status    stable
  *
- * Validate a JSCalendar Event / Task object's required-field shape per
- * RFC 8984 §5 (Event) + §6 (Task). Returns the input on success; throws
+ * Validate a JSCalendar Event / Task / Note / Group object's
+ * required-field shape per RFC 8984 §5 (Event) / §6 (Task) / §7 (Note) /
+ * §1.4.4 (Group). Returns the input on success; throws
  * `CalendarError` on refusal with a `.code` naming the specific shape
  * rule that failed.
  *
@@ -337,10 +338,11 @@ function validate(jsCal) {
  * @since     0.11.31
  * @status    stable
  *
- * Parse iCalendar text (RFC 5545) via `b.safeIcal.parse` and map the
- * first VEVENT into a JSCalendar Event object (RFC 8984 §5). Returns
- * a single Event when the VCALENDAR contains exactly one VEVENT, or
- * an array when multiple VEVENTs are present.
+ * Parse iCalendar text (RFC 5545) via `b.safeIcal.parse` and map each
+ * VEVENT → JSCalendar Event, VTODO → Task, and VJOURNAL → Note
+ * (RFC 8984 §5 / §6 / §7). Returns a single object when the VCALENDAR
+ * holds exactly one component, or an array across all components when
+ * there are several.
  *
  * @opts
  *   safeIcalOpts: object,   // forwarded to b.safeIcal.parse (caps, allowExperimental, etc.)
@@ -381,10 +383,12 @@ function fromIcal(text, opts) {
  * @since     0.11.31
  * @status    stable
  *
- * Render a JSCalendar Event back to RFC 5545 iCalendar text. Returns a
- * CRLF-terminated string wrapped in a `BEGIN:VCALENDAR / VERSION:2.0 /
- * PRODID:-//blamejs//Calendar//EN / BEGIN:VEVENT ... END:VEVENT /
- * END:VCALENDAR` envelope per RFC 5545 §3.4.
+ * Render a JSCalendar object back to RFC 5545 iCalendar text — Event →
+ * VEVENT, Task → VTODO, Note → VJOURNAL, and a Group to a VCALENDAR
+ * carrying each member component. Returns a CRLF-terminated string
+ * wrapped in a `BEGIN:VCALENDAR / VERSION:2.0 /
+ * PRODID:-//blamejs//Calendar//EN / … / END:VCALENDAR` envelope per
+ * RFC 5545 §3.4.
  *
  * @opts
  *   prodid: string,   // PRODID value to emit; default "-//blamejs//Calendar//EN"

package/lib/vendor/blamejs/lib/circuit-breaker.js

@@ -36,8 +36,10 @@ var retryHelper = require("./retry");
  * Build a circuit-breaker. Returns a CircuitBreaker instance with
  * `wrap(fn)` (executes `fn` if the breaker is closed; throws an
  * `Error` with `code: "CIRCUIT_OPEN"` + `isObjectStoreError: true` +
- * `permanent: false` when open), `state()`, `reset()`, and
- * `onStateChange(handler)` listener registration. Pass-through
+ * `permanent: false` when open), `getState()`, `reset()`, and
+ * `onStateChange(handler)` listener registration (the handler, and the
+ * `onStateChange` opt, receive `{ name, from, to, at }` on every
+ * transition). Pass-through
  * factory: identical instance shape to `b.retry.CircuitBreaker`,
  * with the framework's `create(opts)` vocabulary.
  *
@@ -53,8 +55,8 @@ var retryHelper = require("./retry");
  *   failureThreshold: number,    // failures in the closed state before opening
  *   cooldownMs:       number,    // milliseconds the breaker stays open before probing
  *   successThreshold: number,    // probe successes required to close from half-open
- *   audit:            Object,    // optional b.audit instance for state-change emission
- *   onStateChange:    Function,  // ({ name, from, to, at }) → void
+ *   onStateChange:    Function,  // ({ name, from, to, at }) → void; also emits the
+ *                                //   `breaker.state.change` observability event
  *
  * @example
  *   var cb = b.circuitBreaker.create({

package/lib/vendor/blamejs/lib/compliance-ai-act-transparency.js

@@ -31,8 +31,8 @@
  * The framework provides:
  *
  *   - banner({ kind })           → builder for the standard disclosure banner
- *   - watermark({ kind, ... })   → builder for content-marking tags
- *   - cspMetaTag({ ... })        → meta tag pair for HTML pages
+ *   - watermark({ mediaKind, ... }) → builder for content-marking tags
+ *   - metaTags({ ... })          → meta tag pair for HTML pages
  *   - jsonLdDisclosure({ ... })  → JSON-LD <script> for structured-data emit
  *   - C2pa-stub                  → operator-feeds-claims pattern for
  *                                  C2PA Content Credentials integration

package/lib/vendor/blamejs/lib/compliance.js

@@ -1407,14 +1407,11 @@ function postureDefault(posture, key) {
  *
  * @example
  *   b.compliance.posturesByDomain("privacy");
- *   // → ["ccpa", "gdpr", "lgpd-br", "pipl-cn", "appi-jp",
- *   //    "pdpa-sg", "pipeda-ca", "uk-gdpr"]
+ *   // → ["ccpa", "gdpr", "lgpd-br", ...] — every posture whose
+ *   //    domain is "privacy" (the full set grows as regimes are added)
  *
  *   b.compliance.posturesByDomain("health");
- *   // → ["hipaa", "wmhmda"]
- *
- *   b.compliance.posturesByDomain("payment");
- *   // → ["pci-dss"]
+ *   // → ["hipaa", "wmhmda", ...] — every "health"-domain posture
  *
  *   b.compliance.posturesByDomain("not-a-domain");
  *   // → []
@@ -1450,13 +1447,14 @@ function posturesByDomain(domain) {
  *
  * @example
  *   b.compliance.posturesByJurisdiction("EU");
- *   // → ["gdpr", "dora", "nis2", "cra", "ai-act"]
+ *   // → ["gdpr", "dora", "nis2", ...] — every EU-jurisdiction posture
+ *   //    (the full set grows as regimes are added)
  *
  *   b.compliance.posturesByJurisdiction("US");
- *   // → ["hipaa", "soc2", "sox"]
+ *   // → ["hipaa", "soc2", "sox", ...] — every US-jurisdiction posture
  *
  *   b.compliance.posturesByJurisdiction("US-CA");
- *   // → ["ccpa"]
+ *   // → ["ccpa", ...] — every US-CA (California) posture
  *
  *   b.compliance.posturesByJurisdiction("XX");
  *   // → []

package/lib/vendor/blamejs/lib/cookies.js

@@ -127,8 +127,8 @@ function _scrubAttr(s) {
  * `parseSafe`.
  *
  * @example
- *   var jar = b.cookies.parse("session=abc; theme=%22dark%22");
- *   // → { session: "abc", theme: "dark" }
+ *   var jar = b.cookies.parse("session=abc; theme=dark%20mode");
+ *   // → { session: "abc", theme: "dark mode" }   // percent-decoded
  */
 function parse(cookieHeader) {
   var out = {};

package/lib/vendor/blamejs/lib/cose.js

@@ -227,7 +227,7 @@ async function sign(payload, opts) {
  * @primitive b.cose.verify
  * @signature b.cose.verify(coseSign1, opts)
  * @since     0.12.33
- * @status    experimental
+ * @status    stable
  * @related   b.cose.sign, b.cbor.decode
  *
  * Verify a COSE_Sign1 (RFC 9052) and return its payload + headers.

package/lib/vendor/blamejs/lib/crypto-field.js

@@ -495,9 +495,14 @@ function unsealRow(table, row) {
         } catch (_e) { /* drop-silent */ }
         unsealed = null;
       }
-      // If the value wasn't actually sealed, vault.unseal returns the input
-      // unchanged — keep the original.
-      out[field] = unsealed !== undefined && unsealed !== null ? unsealed : out[field];
+      // Assign unconditionally. `unsealed` already carries the right value
+      // for every branch: the plaintext on success, the original value on
+      // the not-actually-sealed pass-through (set above), and `null` on an
+      // unseal failure. The failure case MUST null the column so downstream
+      // sees "no value" rather than the attacker-crafted `vault:<…>` string
+      // (a prior `... ? unsealed : out[field]` guard silently kept the
+      // forged ciphertext on failure, defeating the documented defense).
+      out[field] = unsealed;
     }
   }
 

package/lib/vendor/blamejs/lib/data-act.js

@@ -20,8 +20,9 @@
  *
  *     - Art 4 §1 — let the user access "readily available product
  *       data" generated by their use of the connected product.
- *       `b.dataAct.userAccessible(productId, userId)` returns the
- *       operator-supplied data slice.
+ *       `b.dataAct.recordUserAccess({ productId, userId, dataSlice })`
+ *       records the operator-supplied data slice for the regulator
+ *       record.
  *     - Art 5 §1 — share that data with a third-party data
  *       recipient on the user's request, "without undue delay,
  *       free of charge to the user, of the same quality as is
@@ -46,7 +47,7 @@
  *     b.dataAct.declareProduct({ productId, dataHolder, ... })
  *     b.dataAct.recordUserAccess({ productId, userId, dataSlice, ... })
  *     b.dataAct.shareWithThirdParty({ productId, userId, recipient, scope })
- *     b.dataAct.refuseGatekeeper({ recipient })
+ *       — refuses a DMA-gatekeeper recipient per Art 32 §1
  *     b.dataAct.recordSwitchRequest({ customerId, targetProvider, dataSlices })
  *
  *   The framework does NOT host the connected-product data itself;

package/lib/vendor/blamejs/lib/did.js

@@ -365,7 +365,7 @@ function resolve(did, opts) {
     return { didDocument: docW, verificationMethods: _extractVerificationMethods(docW) };
   }
 
-  throw new DidError("did/unsupported-method", "did.resolve: unsupported DID method '" + parsed.method + "' (did:key and did:web only)");
+  throw new DidError("did/unsupported-method", "did.resolve: unsupported DID method '" + parsed.method + "' (did:key, did:jwk, and did:web only)");
 }
 
 // Import a publicKeyJwk after allowlisting its kty/crv — a DID document

package/lib/vendor/blamejs/lib/file-upload.js

@@ -18,7 +18,14 @@
  *   for content gating and `b.guardFilename.gate({ profile: "strict" })`
  *   for filename gating. Operators opt out via `contentSafety: null`
  *   / `filenameSafety: null` (audited at create time so a security
- *   review can find the disabled-on-deploy rows). Per-chunk hooks
+ *   review can find the disabled-on-deploy rows). The byte-level
+ *   content gate inspects the reassembled buffer, so it runs on uploads
+ *   up to `maxStreamReassemblyBytes` (default 64 MiB); a larger upload
+ *   is handed to `onFinalize` as a stream and the byte-content gate is
+ *   skipped (MIME-sniff + filename gates still run, and the skip emits a
+ *   `fileUpload.content_safety_skipped` warning audit). To guarantee
+ *   content-gating of a type, cap `maxFileBytes` at or below
+ *   `maxStreamReassemblyBytes`. Per-chunk hooks
  *   (`onChunk`) are the integration point for virus scanners and
  *   schema-shape checks; rejecting from the hook surfaces as a
  *   permanent `FileUploadError`.
@@ -1076,6 +1083,16 @@ function create(opts) {
           // Clear the streaming alias if present — sanitized fits in memory.
           bodyStream = null;
         }
+      } else if (safetyGate && typeof safetyGate.check === "function" && !bodyBuffer) {
+        // A content-safety gate is configured for this extension, but the
+        // upload streamed past maxStreamReassemblyBytes and was never
+        // reassembled into a buffer the byte-level gate can inspect. The
+        // MIME-sniff and filename gates still ran; the per-extension
+        // content gate did NOT. Surface it (rather than skipping silently)
+        // via an observability counter so operators can alert, lower
+        // maxStreamReassemblyBytes, or cap maxFileBytes to force
+        // content-gating of this type.
+        _emitObs("fileUpload.content_safety_skipped_streamed", 1, { ext: safetyExt });
       }
     }
 

package/lib/vendor/blamejs/lib/guard-archive.js

@@ -650,7 +650,7 @@ function _detectIssues(entries, opts) {
  *
  * @opts
  *   profile:    "strict"|"balanced"|"permissive",
- *   compliance: "hipaa"|"pci-dss"|"gdpr"|"soc2",
+ *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  *   traversalPolicy:                "reject"|"audit"|"allow",
  *   absolutePathPolicy:             "reject"|"audit"|"allow",
  *   symlinkPolicy:                  "reject"|"audit"|"allow",
@@ -723,7 +723,7 @@ function validateEntries(entries, opts) {
  *
  * @opts
  *   profile:    "strict"|"balanced"|"permissive",
- *   compliance: "hipaa"|"pci-dss"|"gdpr"|"soc2",
+ *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  *   name:       string,
  *   ...:        any validateEntries opt
  *

package/lib/vendor/blamejs/lib/guard-auth.js

@@ -34,7 +34,7 @@
  *
  *   Profiles: `strict` / `balanced` / `permissive`. Compliance postures:
  *   `hipaa` / `pci-dss` / `gdpr` / `soc2`. Operators select via
- *   `{ profile: "strict" }` or `{ compliance: "hipaa" }`; postures
+ *   `{ profile: "strict" }` or `{ compliancePosture: "hipaa" }`; postures
  *   overlay on the profile baseline.
  *
  * @card
@@ -205,7 +205,7 @@ function _detectIssues(bundle, opts) {
  * @compliance hipaa, pci-dss, gdpr, soc2
  * @related    b.guardAuth.sanitize, b.guardAuth.gate, b.guardJwt.validate, b.guardOauth.validate
  *
- * Inspect an auth-bundle object and return `{ ok, issues, summary }`.
+ * Inspect an auth-bundle object and return `{ ok, issues }`.
  * Each issue carries `{ kind, severity, ruleId, source, snippet }`
  * with severity in `"warn"|"high"|"critical"` and `source` tagging
  * the sub-guard that raised it (`"jwt"` / `"oauth"` / `"cookies"` /
@@ -219,7 +219,7 @@ function _detectIssues(bundle, opts) {
  *
  * @opts
  *   profile:           "strict"|"balanced"|"permissive",
- *   compliance:        "hipaa"|"pci-dss"|"gdpr"|"soc2",
+ *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  *   childProfile:      "strict"|"balanced"|"permissive",   // forwarded to guardJwt / guardOauth
  *   requireAtLeastOne: boolean,
  *   allowedRedirectUris: string[],   // forwarded to guardOauth
@@ -256,7 +256,7 @@ function validate(input, opts) {
  *
  * @opts
  *   profile:    "strict"|"balanced"|"permissive",
- *   compliance: "hipaa"|"pci-dss"|"gdpr"|"soc2",
+ *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  *
  * @example
  *   var clean = b.guardAuth.sanitize({
@@ -300,7 +300,7 @@ function sanitize(input, opts) {
  *
  * @opts
  *   profile:    "strict"|"balanced"|"permissive",
- *   compliance: "hipaa"|"pci-dss"|"gdpr"|"soc2",
+ *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  *   name:       string,    // gate identity for audit / observability
  *   childProfile: "strict"|"balanced"|"permissive",
  *   allowedRedirectUris: string[],

package/lib/vendor/blamejs/lib/guard-cidr.js

@@ -437,7 +437,7 @@ function _detectIssues(input, opts) {
  * @compliance hipaa, pci-dss, gdpr, soc2
  * @related    b.guardCidr.sanitize, b.guardCidr.gate
  *
- * Inspect a CIDR notation string and return `{ ok, issues, summary }`.
+ * Inspect a CIDR notation string and return `{ ok, issues }`.
  * Each issue carries `{ kind, severity, ruleId, snippet }` with
  * severity in `"warn"|"high"|"critical"`. Detected: malformed address
  * shape, octet-out-of-range, mask-out-of-range, network-address
@@ -448,7 +448,7 @@ function _detectIssues(input, opts) {
  *
  * @opts
  *   profile:    "strict"|"balanced"|"permissive",
- *   compliance: "hipaa"|"pci-dss"|"gdpr"|"soc2",
+ *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  *   family:     "either"|"ipv4-only"|"ipv6-only",
  *   networkAlignmentPolicy: "reject"|"audit"|"allow",
  *   reservedRangesPolicy:   "reject"|"audit"|"allow",
@@ -496,7 +496,7 @@ function validate(input, opts) {
  *
  * @opts
  *   profile:    "strict"|"balanced"|"permissive",
- *   compliance: "hipaa"|"pci-dss"|"gdpr"|"soc2",
+ *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  *
  * @example
  *   var safe = b.guardCidr.sanitize("2001:DB8::/32", { profile: "permissive" });
@@ -542,7 +542,7 @@ function sanitize(input, opts) {
  *
  * @opts
  *   profile:    "strict"|"balanced"|"permissive",
- *   compliance: "hipaa"|"pci-dss"|"gdpr"|"soc2",
+ *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  *   name:       string,    // gate identity for audit / observability
  *   family:     "either"|"ipv4-only"|"ipv6-only",
  *

package/lib/vendor/blamejs/lib/guard-csv.js

@@ -43,7 +43,7 @@
  *   Profiles: `strict` / `balanced` / `permissive` /
  *   `email-attachment`. Compliance postures: `hipaa` / `pci-dss` /
  *   `gdpr` / `soc2`. Operators select via `{ profile: "strict" }` or
- *   `{ compliance: "hipaa" }`; postures overlay on top of the
+ *   `{ compliancePosture: "hipaa" }`; postures overlay on top of the
  *   profile baseline.
  *
  *   Threat-detection regex literals are composed programmatically
@@ -696,7 +696,7 @@ function schema(spec) {
  *
  * @opts
  *   profile:    "strict"|"balanced"|"permissive"|"email-attachment",
- *   compliance: "hipaa"|"pci-dss"|"gdpr"|"soc2",
+ *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  *   headers:    string[]|false,    // explicit column order; false suppresses header row
  *   delimiter:  string,            // default ","
  *   lineEnding: string,            // default "\r\n"
@@ -802,7 +802,7 @@ function serialize(rows, opts) {
  * @related    b.guardCsv.sanitize, b.guardCsv.gate
  *
  * Inspect `input` (string or Buffer of CSV text) and return
- * `{ ok, issues, summary }`. Each issue carries `{ kind, severity,
+ * `{ ok, issues }`. Each issue carries `{ kind, severity,
  * ruleId, location, snippet }` with severity in
  * `"warn"|"high"|"critical"`. Detected: BOM mid-stream, Unicode
  * bidi override (CVE-2021-42574), C0 control char, null byte,
@@ -813,7 +813,7 @@ function serialize(rows, opts) {
  *
  * @opts
  *   profile:    "strict"|"balanced"|"permissive"|"email-attachment",
- *   compliance: "hipaa"|"pci-dss"|"gdpr"|"soc2",
+ *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  *   bidiCharPolicy:        "reject"|"strip"|"audit"|"allow",
  *   controlCharPolicy:     "reject"|"strip"|"allow",
  *   nullByteHandling:      "reject"|"strip"|"allow",
@@ -860,7 +860,7 @@ function validate(input, opts) {
  *
  * @opts
  *   profile:    "strict"|"balanced"|"permissive"|"email-attachment",
- *   compliance: "hipaa"|"pci-dss"|"gdpr"|"soc2",
+ *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  *   bidiCharPolicy:    "reject"|"strip"|"audit"|"allow",
  *   controlCharPolicy: "reject"|"strip"|"allow",
  *   nullByteHandling:  "reject"|"strip"|"allow",
@@ -981,7 +981,7 @@ function detect(input) {
  *
  * @opts
  *   profile:    "strict"|"balanced"|"permissive"|"email-attachment",
- *   compliance: "hipaa"|"pci-dss"|"gdpr"|"soc2",
+ *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  *   name:       string,    // gate identity for audit / observability
  *   operatorRules: [{ id: string, severity: "warn"|"high"|"critical",
  *                    detect: function, reason: string }],

package/lib/vendor/blamejs/lib/guard-domain.js

@@ -563,7 +563,7 @@ function _detectIssues(input, opts) {
  * @compliance hipaa, pci-dss, gdpr, soc2
  * @related    b.guardDomain.sanitize, b.guardDomain.gate
  *
- * Inspect a domain-name string and return `{ ok, issues, summary }`.
+ * Inspect a domain-name string and return `{ ok, issues }`.
  * Each issue carries `{ kind, severity, ruleId, snippet }` with
  * severity in `"warn"|"high"|"critical"`. Detected: domain/label
  * length cap (RFC 1035 §2.3.4), LDH violation, IDN A-label
@@ -575,7 +575,7 @@ function _detectIssues(input, opts) {
  *
  * @opts
  *   profile:    "strict"|"balanced"|"permissive",
- *   compliance: "hipaa"|"pci-dss"|"gdpr"|"soc2",
+ *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  *   ldhPolicy:           "reject"|"audit"|"allow",
  *   punycodePolicy:      "reject"|"audit"|"allow",
  *   mixedScriptPolicy:   "reject"|"audit"|"allow",
@@ -635,7 +635,7 @@ function validate(input, opts) {
  *
  * @opts
  *   profile:    "strict"|"balanced"|"permissive",
- *   compliance: "hipaa"|"pci-dss"|"gdpr"|"soc2",
+ *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  *
  * @example
  *   var safe = b.guardDomain.sanitize("Example.Com.", { profile: "balanced" });
@@ -677,7 +677,7 @@ function sanitize(input, opts) {
  *
  * @opts
  *   profile:    "strict"|"balanced"|"permissive",
- *   compliance: "hipaa"|"pci-dss"|"gdpr"|"soc2",
+ *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  *   name:       string,    // gate identity for audit / observability
  *
  * @example

package/lib/vendor/blamejs/lib/guard-email.js

@@ -840,9 +840,10 @@ function sanitize(input, opts) {
  * @status    stable
  * @related   b.guardEmail.validateMessage, b.guardEmail.sanitize, b.guardAll.gate
  *
- * Build a guard gate function compatible with the `b.guardAll` family
- * dispatch. The returned async gate accepts a request-shaped context,
- * runs `validateMessage` against the extracted bytes, and returns
+ * Build a guard gate compatible with the `b.guardAll` family
+ * dispatch. The returned gate's async `check(ctx)` method accepts a
+ * request-shaped context, runs `validateMessage` against the extracted
+ * bytes, and returns
  * `{ ok, action, issues? }` where `action` is `serve` (no issues),
  * `audit-only` (warn-level), or `refuse` (high / critical severity).
  *
@@ -854,11 +855,11 @@ function sanitize(input, opts) {
  * @example
  *   var guardEmail = require("./lib/guard-email");
  *   var g = guardEmail.gate({ profile: "strict" });
- *   typeof g;               // → "function"
+ *   typeof g.check;         // → "function"
  *
  *   var msg = "From: alice@example.com\r\nTo: bob@example.com\r\n" +
  *             "Subject: hi\r\nDate: Mon, 5 May 2026 10:00:00 +0000\r\n\r\nbody\r\n";
- *   g({ body: Buffer.from(msg, "utf8") }).then(function (rv) {
+ *   g.check({ body: Buffer.from(msg, "utf8") }).then(function (rv) {
  *     rv.action;            // → "serve"
  *   });
  */

package/lib/vendor/blamejs/lib/guard-filename.js

@@ -634,7 +634,7 @@ function _sanitize(input, opts) {
  * @related    b.guardFilename.sanitize, b.guardFilename.gate
  *
  * Inspect a filename (string or Buffer) and return
- * `{ ok, issues, summary }`. Each issue carries
+ * `{ ok, issues }`. Each issue carries
  * `{ kind, severity, ruleId, location, snippet }` with severity in
  * `"warn"|"high"|"critical"`. Detected: path-traversal raw and
  * percent-encoded, null-byte truncation, NTFS ADS, UNC path,
@@ -647,7 +647,7 @@ function _sanitize(input, opts) {
  *
  * @opts
  *   profile:    "strict"|"balanced"|"permissive",
- *   compliance: "hipaa"|"pci-dss"|"gdpr"|"soc2",
+ *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  *   bidiPolicy:           "reject"|"strip"|"allow",
  *   controlPolicy:        "reject"|"strip"|"allow",
  *   nullBytePolicy:       "reject",                       // always reject
@@ -759,7 +759,7 @@ function _sanitizeStripMode(input, opts) {
  *
  * @opts
  *   profile:    "strict"|"balanced"|"permissive",
- *   compliance: "hipaa"|"pci-dss"|"gdpr"|"soc2",
+ *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  *   mode:       "enforce"|"strip",
  *   audit:      { safeEmit: function },     // optional sink for strip mode
  *   unicodeNormalization: "NFC"|null,
@@ -820,7 +820,7 @@ function sanitize(input, opts) {
  *
  * @opts
  *   profile:    "strict"|"balanced"|"permissive",
- *   compliance: "hipaa"|"pci-dss"|"gdpr"|"soc2",
+ *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  *   name:       string,    // gate identity for audit / observability
  *
  * @example

package/lib/vendor/blamejs/lib/guard-graphql.js

@@ -458,7 +458,7 @@ function _detectIssues(req, opts) {
  * @related    b.guardGraphql.sanitize, b.guardGraphql.gate
  *
  * Apply the full guard-graphql threat catalog to a request bundle
- * (or batch array). Returns `{ ok, issues, refusal? }` per
+ * (or batch array). Returns `{ ok, issues }` per
  * `gateContract.aggregateIssues`. Detected classes include
  * `query-missing`, `query-cap`, `variables-cap`, `request-cap`,
  * `batch-size`, `introspection`, `persisted-query-missing`,
@@ -469,7 +469,7 @@ function _detectIssues(req, opts) {
  *
  * @opts
  *   profile:                 "strict"|"balanced"|"permissive",
- *   compliance:              "hipaa"|"pci-dss"|"gdpr"|"soc2",
+ *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  *   introspectionPolicy:     "reject"|"audit"|"allow",
  *   persistedQueryPolicy:    "require"|"audit"|"allow",
  *   operationNamePolicy:     "reject"|"audit"|"allow",
@@ -528,7 +528,7 @@ function validate(input, opts) {
  *
  * @opts
  *   profile:    "strict"|"balanced"|"permissive",
- *   compliance: "hipaa"|"pci-dss"|"gdpr"|"soc2",
+ *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  *   ...:        every guardGraphql.validate opt is honored,
  *
  * @example
@@ -573,13 +573,13 @@ function sanitize(input, opts) {
  *
  * @opts
  *   profile:    "strict"|"balanced"|"permissive",
- *   compliance: "hipaa"|"pci-dss"|"gdpr"|"soc2",
+ *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  *   name:       string,            // gate label for audit trails
  *   ...:        every guardGraphql.validate opt is honored,
  *
  * @example
  *   var gqlGate = b.guardGraphql.gate({ profile: "strict" });
- *   var rv = await gqlGate.run({
+ *   var rv = await gqlGate.check({
  *     graphqlRequest: {
  *       query: "{ a:me { id } b:me { id } c:me { id } d:me { id } " +
  *              "e:me { id } f:me { id } g:me { id } h:me { id } " +

package/lib/vendor/blamejs/lib/guard-html.js

@@ -1030,7 +1030,7 @@ function sanitize(input, opts) {
  * Returns a guard descriptor that plugs into the framework's
  * content-safety wiring (`b.fileUpload.contentSafety` /
  * `b.staticServe.contentSafety` / `b.guardAll`). The descriptor's
- * `inspect(ctx)` resolves to one of four actions: `serve` (no
+ * `check(ctx)` resolves to one of four actions: `serve` (no
  * issues), `audit-only` (low-severity issues observed), `sanitize`
  * (sanitized buffer attached when no policy is "reject"), or
  * `refuse` (critical issue with at least one reject-policy active).
@@ -1057,7 +1057,7 @@ function sanitize(input, opts) {
  *
  *   // Refuse on tag-budget exceeded — strict profile rejects <script>.
  *   var hostileBuf = Buffer.from("<p>hi</p><script>alert(1)</script>", "utf8");
- *   var rv = await g.inspect({ bytes: hostileBuf, contentType: "text/html" });
+ *   var rv = await g.check({ bytes: hostileBuf, contentType: "text/html" });
  *   rv.ok;       // → false
  *   rv.action;   // → "refuse"
  */

package/lib/vendor/blamejs/lib/guard-image.js

@@ -421,7 +421,7 @@ function sanitize(input, opts) {
  *
  * @opts
  *   profile:    "strict"|"balanced"|"permissive",
- *   compliance: "hipaa"|"pci-dss"|"gdpr"|"soc2",
+ *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  *   name:       string,
  *   ...:        any validate opt
  *

package/lib/vendor/blamejs/lib/guard-json.js

@@ -59,7 +59,7 @@
  *
  *   Profiles: `strict` / `balanced` / `permissive`. Compliance
  *   postures: `hipaa` / `pci-dss` / `gdpr` / `soc2`. Operators select
- *   via `{ profile: "strict" }` or `{ compliance: "hipaa" }`;
+ *   via `{ profile: "strict" }` or `{ compliancePosture: "hipaa" }`;
  *   postures overlay on top of the profile baseline.
  *
  *   Source files MUST be pure ASCII; threat-detection regexes
@@ -571,7 +571,7 @@ function _stripPollutionTree(value, opts, depth) {
  *
  * Inspect `input` (string of JSON source) for the full guard-json
  * threat catalog without committing to a parsed value. Returns
- * `{ ok, issues, severities }` where `issues` is the aggregated
+ * `{ ok, issues }` where `issues` is the aggregated
  * detector output — every prototype-pollution key, depth/breadth
  * cap hit, duplicate-key smuggle, JSON5-quirk match, BOM placement,
  * unicode threat, and numeric-precision-loss candidate is reported
@@ -587,7 +587,7 @@ function _stripPollutionTree(value, opts, depth) {
  *
  * @opts
  *   profile:                  "strict"|"balanced"|"permissive",
- *   compliance:               "hipaa"|"pci-dss"|"gdpr"|"soc2",
+ *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  *   pollutionPolicy:          "reject"|"strip"|"audit"|"allow",
  *   duplicateKeyPolicy:       "reject"|"audit"|"allow",
  *   nanInfinityPolicy:        "reject"|"audit"|"allow",
@@ -660,7 +660,7 @@ function validate(input, opts) {
  *
  * @opts
  *   profile:    "strict"|"balanced"|"permissive",
- *   compliance: "hipaa"|"pci-dss"|"gdpr"|"soc2",
+ *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  *   pollutionPolicy: "reject"|"strip"|"audit"|"allow",
  *   bomPolicy:       "reject"|"strip"|"allow",
  *   controlPolicy:   "reject"|"strip"|"allow",
@@ -770,7 +770,7 @@ function _policyKeyForRuleId(ruleId) {
  *
  * @opts
  *   profile:    "strict"|"balanced"|"permissive",
- *   compliance: "hipaa"|"pci-dss"|"gdpr"|"soc2",
+ *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  *   name:       string,    // gate identity for audit / observability
  *
  * @example

package/lib/vendor/blamejs/lib/guard-jsonpath.js

@@ -34,7 +34,7 @@
  *   Profiles: `strict` / `balanced` / `permissive`. Compliance
  *   postures: `hipaa` / `pci-dss` / `gdpr` / `soc2`. Operators
  *   select via `{ profile: "strict" }` or
- *   `{ compliance: "hipaa" }`; postures overlay on top of the
+ *   `{ compliancePosture: "hipaa" }`; postures overlay on top of the
  *   profile baseline. Filter / script / dynamic-hint refusal holds
  *   at every profile — the RCE class is never an operator opt-in.
  *
@@ -257,7 +257,7 @@ function _detectIssues(input, opts) {
  *
  * @opts
  *   profile:                "strict"|"balanced"|"permissive",
- *   compliance:             "hipaa"|"pci-dss"|"gdpr"|"soc2",
+ *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  *   bidiPolicy:             "reject"|"audit"|"allow",
  *   controlPolicy:          "reject"|"audit"|"allow",
  *   nullBytePolicy:         "reject"|"audit"|"allow",
@@ -308,7 +308,7 @@ function validate(input, opts) {
  *
  * @opts
  *   profile:                "strict"|"balanced"|"permissive",
- *   compliance:             "hipaa"|"pci-dss"|"gdpr"|"soc2",
+ *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  *   filterExprPolicy:       "reject"|"audit"|"allow",
  *   scriptExprPolicy:       "reject"|"audit"|"allow",
  *   dynamicHintPolicy:      "reject"|"audit"|"allow",
@@ -360,7 +360,7 @@ function sanitize(input, opts) {
  *
  * @opts
  *   profile:                "strict"|"balanced"|"permissive",
- *   compliance:             "hipaa"|"pci-dss"|"gdpr"|"soc2",
+ *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
  *   name:                   string,    // override gate name in audit emissions
  *   filterExprPolicy:       "reject"|"audit"|"allow",
  *   scriptExprPolicy:       "reject"|"audit"|"allow",