@blamejs/blamejs-shop 0.4.31 → 0.4.32

package/lib/vendor/blamejs/lib/retention.js

@@ -46,6 +46,7 @@ var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
 var safeSql = require("./safe-sql");
+var sql = require("./sql");
 var { defineClass } = require("./framework-error");
 
 var audit = lazyRequire(function () { return require("./audit"); });
@@ -55,6 +56,25 @@ var legalHold = lazyRequire(function () { return require("./legal-hold"); });
 var RetentionError = defineClass("RetentionError", { alwaysPermanent: true });
 var _err = RetentionError.factory;
 
+// Resolve the b.sql dialect for the operator-supplied handle. The framework's
+// local b.db handle is always node:sqlite (db.js pins { dialect: "sqlite",
+// quoteName: true }) and exposes no .dialect, so this defaults to "sqlite" —
+// every sweep statement runs against that handle via .prepare(). An operator
+// handle that DOES advertise a dialect (string or () -> string) has it
+// threaded through so the emitted identifier quoting + idioms match the
+// backend the handle dispatches to. quoteName stays on for every retention
+// statement: the rule's table / ageField / softDeleteField identifiers are
+// validated then quoted by construction (no clusterStorage prefix rewrite on
+// this operator-app-schema path).
+function _handleDialect(db) {
+  if (db && typeof db.dialect === "function") {
+    try { var d = db.dialect(); return typeof d === "string" ? d : "sqlite"; }
+    catch (_e) { return "sqlite"; }
+  }
+  if (db && typeof db.dialect === "string") return db.dialect;
+  return "sqlite";
+}
+
 // Identifier-level SQLi defense: every operator-supplied table name,
 // column name, and cascade FK must pass safeSql.validateIdentifier
 // before reaching SQL string concatenation. Without this gate a
@@ -196,6 +216,11 @@ function create(opts) {
     throw _err("BAD_OPT", "create: opts.db is required (a b.db handle with .prepare(sql))");
   }
   var db = opts.db;
+  // b.sql opts for every retention statement built against this handle. The
+  // dialect tracks the handle (sqlite for the framework's local b.db); the
+  // validated operator identifiers are quoted by construction (quoteName)
+  // with no clusterStorage prefix rewrite on this path.
+  var SQL_OPTS = { dialect: _handleDialect(db), quoteName: true };
   var auditOn = opts.audit !== false && opts.audit != null;
   var auditInstance = (opts.audit && opts.audit !== true) ? opts.audit : null;
   var rules = {};
@@ -235,21 +260,28 @@ function create(opts) {
 
   function _hardDelete(table, rowId, dryRun) {
     if (dryRun) return { wouldDelete: 1 };
-    var del = db.prepare("DELETE FROM \"" + table + "\" WHERE _id = ?");
-    del.run(rowId);
+    // Operator app table — quoteName so the validated identifier emits as a
+    // quoted local name; the row id binds as a placeholder.
+    var built = sql.delete(table, SQL_OPTS)
+      .where("_id", rowId)
+      .toSql();
+    var del = db.prepare(built.sql);
+    del.run.apply(del, built.params);
     return { deleted: 1 };
   }
 
   function _softDelete(table, rowId, softField, dryRun) {
     if (dryRun) return { wouldSoftDelete: 1 };
-    var upd = db.prepare(
-      "UPDATE \"" + table + "\" SET \"" + softField + "\" = ? WHERE _id = ?");
-    upd.run(Date.now(), rowId);
+    var built = sql.update(table, SQL_OPTS)
+      .set(softField, Date.now())
+      .where("_id", rowId)
+      .toSql();
+    var upd = db.prepare(built.sql);
+    upd.run.apply(upd, built.params);
     return { softDeleted: 1 };
   }
 
   function _erase(table, row, dryRun) {
-    var erased = cryptoField.eraseRow(table, row);
     var sealedFields = cryptoField.getSealedFields(table) || [];
     var hashFields = [];
     var schema = cryptoField.getSchema(table);
@@ -261,21 +293,38 @@ function create(opts) {
       return _hardDelete(table, row._id, dryRun);
     }
     if (dryRun) return { wouldErase: 1, sealedFieldCount: sealedFields.length };
-    var setClauses = [];
-    var values = [];
-    for (var si = 0; si < sealedFields.length; si++) {
-      setClauses.push('"' + sealedFields[si] + '" = ?');
-      values.push(null);
-    }
-    for (var hi = 0; hi < hashFields.length; hi++) {
-      setClauses.push('"' + hashFields[hi] + '" = ?');
-      values.push(null);
+    // eraseRow produces the in-memory tombstone AND drives the posture-gated
+    // side effects: under a regime whose POSTURE_DEFAULTS sets
+    // requireVacuumAfterErase it schedules db.vacuumAfterErase({ mode: "full" })
+    // and emits cryptofield.erase.row. Both belong only to the COMMITTING path
+    // — running them above the dry-run gate made a preview VACUUM the whole
+    // database file per candidate row (#120). Its return value is unused (the
+    // UPDATE below NULLs the columns directly); we keep the call for the
+    // tombstone bucketing + posture vacuum on the real path.
+    var erased = cryptoField.eraseRow(table, row);
+    // NULL every sealed column + its derived-hash sibling. b.sql binds each
+    // null as a placeholder (the set map preserves the column ordering).
+    var eraseSet = {};
+    for (var si = 0; si < sealedFields.length; si++) eraseSet[sealedFields[si]] = null;
+    for (var hi = 0; hi < hashFields.length; hi++) eraseSet[hashFields[hi]] = null;
+    var eraseBuilt = sql.update(table, SQL_OPTS)
+      .set(eraseSet)
+      .where("_id", row._id)
+      .toSql();
+    var upd2 = db.prepare(eraseBuilt.sql);
+    upd2.run.apply(upd2, eraseBuilt.params);
+    // Per-row-key tables (declarePerRowKey): NULLing the sealed columns
+    // is not enough — WAL / replica residuals keep the old K_row cells.
+    // Destroy the row's wrapped secret so K_row is unrecoverable and the
+    // residual ciphertext reads as absent (crypto-shred, GDPR Art. 17).
+    // rowId is row._id, the same identity materialize / eraseHard use.
+    var perRowKeysDestroyed = 0;
+    if (cryptoField.hasPerRowKey(table)) {
+      var dr = cryptoField.destroyPerRowKey(table, row._id, db);
+      perRowKeysDestroyed = (dr && dr.destroyed) || 0;
     }
-    values.push(row._id);
-    var upd2 = db.prepare("UPDATE \"" + table + "\" SET " + setClauses.join(", ") + " WHERE _id = ?");
-    upd2.run.apply(upd2, values);
     void erased;
-    return { erased: 1, sealedFieldCount: sealedFields.length };
+    return { erased: 1, sealedFieldCount: sealedFields.length, perRowKeysDestroyed: perRowKeysDestroyed };
   }
 
   function _cascade(rule, rowId, dryRun) {
@@ -284,15 +333,20 @@ function create(opts) {
     for (var i = 0; i < rule.cascade.length; i++) {
       var c = rule.cascade[i];
       if (dryRun) {
-        var sel = db.prepare(
-          "SELECT COUNT(*) AS n FROM \"" + c.table + "\" WHERE \"" + c.foreignKey + "\" = ?");
-        var n = sel.get(rowId);
+        var selBuilt = sql.select(c.table, SQL_OPTS)
+          .count("*", "n")
+          .where(c.foreignKey, rowId)
+          .toSql();
+        var sel = db.prepare(selBuilt.sql);
+        var n = sel.get.apply(sel, selBuilt.params);
         cascadeSummary.push({ table: c.table, foreignKey: c.foreignKey,
           wouldDelete: (n && typeof n.n === "number") ? n.n : 0 });
       } else {
-        var del = db.prepare(
-          "DELETE FROM \"" + c.table + "\" WHERE \"" + c.foreignKey + "\" = ?");
-        var result = del.run(rowId);
+        var delBuilt = sql.delete(c.table, SQL_OPTS)
+          .where(c.foreignKey, rowId)
+          .toSql();
+        var del = db.prepare(delBuilt.sql);
+        var result = del.run.apply(del, delBuilt.params);
         cascadeSummary.push({ table: c.table, foreignKey: c.foreignKey,
           deleted: result.changes || 0 });
       }
@@ -382,24 +436,31 @@ function create(opts) {
       while (moreRows) {
         var rows;
         // The candidate WHERE-clause: age + not-already-erased + not-on-legal-hold +
-        // (when soft-delete is configured) not-already-soft-deleted.
-        var whereParts = ['"' + rule.ageField + '" <= ?'];
-        var whereArgs = [cutoff];
-        if (rule.softDeleteField) {
-          whereParts.push('("' + rule.softDeleteField + '" IS NULL)');
+        // (when soft-delete is configured) not-already-soft-deleted. Built
+        // through b.sql so the operator-supplied table / ageField / softDeleteField
+        // identifiers are quoted by construction and every value binds as a
+        // placeholder (the '' empty-string compare included — no embedded literal).
+        function _candidateBase() {
+          var qb = sql.select(rule.table, SQL_OPTS)
+            .where(rule.ageField, "<=", cutoff);
+          if (rule.softDeleteField) qb.whereNull(rule.softDeleteField);
+          return qb;
         }
-        var sql = "SELECT * FROM \"" + rule.table + "\" " +
-          "WHERE " + whereParts.join(" AND ") + " " +
-          "AND (__erasedAt IS NULL OR __erasedAt = '') " +
-          "LIMIT ?";
         var selStmt;
-        try { selStmt = db.prepare(sql); rows = selStmt.all.apply(selStmt, whereArgs.concat([rule.batchSize])); }
-        catch (_eA) {
+        try {
+          var built = _candidateBase()
+            .whereGroup(function (g) {
+              g.whereNull("__erasedAt").orWhereOp("__erasedAt", "=", "");
+            })
+            .limit(rule.batchSize)
+            .toSql();
+          selStmt = db.prepare(built.sql);
+          rows = selStmt.all.apply(selStmt, built.params);
+        } catch (_eA) {
           // Fallback: tables without __erasedAt
-          var sqlPlain = "SELECT * FROM \"" + rule.table + "\" " +
-            "WHERE " + whereParts.join(" AND ") + " LIMIT ?";
-          var selPlain = db.prepare(sqlPlain);
-          rows = selPlain.all.apply(selPlain, whereArgs.concat([rule.batchSize]));
+          var plainBuilt = _candidateBase().limit(rule.batchSize).toSql();
+          var selPlain = db.prepare(plainBuilt.sql);
+          rows = selPlain.all.apply(selPlain, plainBuilt.params);
         }
         if (!rows || rows.length === 0) { moreRows = false; break; }
         summary.scanned += rows.length;

package/lib/vendor/blamejs/lib/router.js

@@ -42,6 +42,7 @@ var lazyRequire = require("./lazy-require");
 var safeAsync = require("./safe-async");
 var safeEnv = require("./parsers/safe-env");
 var safeUrl = require("./safe-url");
+var validateOpts = require("./validate-opts");
 var websocket = require("./websocket");
 var { boot } = require("./log");
 var { RouterError } = require("./framework-error");
@@ -301,6 +302,13 @@ class Router {
   constructor(opts) {
     opts = opts || {};
     this.routes = [];
+    // Registration-ordered middleware table. Each entry is
+    // `{ prefix, prefixSegments, fn }`: `prefix === null` is a global
+    // middleware (runs on every request); a non-null `prefix` is a
+    // path-scoped middleware that runs only when the request path
+    // matches the prefix on segment boundaries. Path-scoped and global
+    // entries interleave in registration order so a gate registered
+    // before a route still runs before it.
     this.middleware = [];
     // WebSocket routes are kept separate from HTTP routes — they're
     // matched on the upgrade / Extended CONNECT nodePath, not on a method
@@ -453,8 +461,23 @@ class Router {
     return conns.length;
   }
 
-  use(fn) {
-    this.middleware.push(fn);
+  // use(mw)                       — global middleware (runs on every request)
+  // use(mw1, mw2, ...)            — several global middlewares, in order
+  // use(prefix, mw1, mw2, ...)    — path-scoped: mw runs only when the
+  //                                 request path is at or beneath `prefix`
+  //                                 on segment boundaries ("/admin" covers
+  //                                 "/admin" + "/admin/x", not "/administrator")
+  // use([prefixA, prefixB], mw)   — scoped to any of several prefixes
+  //
+  // Bad input throws at config time (a non-string / non-array prefix, a
+  // prefix that doesn't begin with "/", a non-function middleware) so an
+  // operator wiring typo surfaces at boot instead of silently dropping a
+  // security gate or 500-ing every request.
+  use() {
+    var entries = _normalizeUseArgs(Array.prototype.slice.call(arguments));
+    for (var i = 0; i < entries.length; i++) {
+      this.middleware.push(entries[i]);
+    }
   }
 
   // Internal: split a route registration's args into { spec, handlers }.
@@ -687,8 +710,24 @@ class Router {
     }
     req.query = Object.fromEntries(queryEntries);
 
-    // Run middleware
-    for (var mw of this.middleware) {
+    // Run middleware in registration order. Global entries
+    // (prefixSegmentsList === null) run on every request; path-scoped
+    // entries run only when req.pathname is at or beneath one of the
+    // mount's prefixes (segment-boundary match). A skipped scoped
+    // middleware does NOT short-circuit the chain — the next entry
+    // still runs.
+    for (var entry of this.middleware) {
+      if (entry.prefixSegmentsList !== null) {
+        var matched = false;
+        for (var pli = 0; pli < entry.prefixSegmentsList.length; pli++) {
+          if (_pathMatchesPrefix(entry.prefixSegmentsList[pli], req.pathname)) {
+            matched = true;
+            break;
+          }
+        }
+        if (!matched) continue;
+      }
+      var mw = entry.fn;
       var next = false;
       try {
         await mw(req, res, () => (next = true));
@@ -1206,6 +1245,152 @@ class Router {
   }
 }
 
+// ---- Path-scoped `use()` helpers ----
+//
+// These back `Router.use(prefix, mw)`. They live after the class
+// (hoisted function declarations are visible to the methods regardless
+// of source order) so the class methods sit contiguous with the
+// route-matching helpers above.
+
+// Compile a `use(prefix, mw)` path prefix into the segment list the
+// matcher walks. A prefix is the literal-segment portion of a path
+// ("/admin", "/.well-known/jmap") — parameter segments (":id") are not
+// meaningful for a mounting prefix, so they're treated as literals.
+//
+// Normalization mirrors route-pattern handling: split on "/" and drop a
+// single trailing-slash artifact so "/admin" and "/admin/" mount the
+// same. The leading empty segment from the leading "/" is preserved so
+// the prefix anchors at the path root (a prefix that does not begin with
+// "/" is refused at the use() entry point).
+function _compilePrefix(prefix) {
+  var segments = prefix.split("/");
+  // A trailing "/" produces a final empty segment ("/admin/" → ["", "admin", ""]).
+  // Drop it so the trailing slash doesn't force an extra path segment.
+  if (segments.length > 1 && segments[segments.length - 1] === "") {
+    segments.pop();
+  }
+  return segments;
+}
+
+// True when `pathname` is at or beneath the mounting prefix, matching on
+// segment boundaries. "/admin" matches "/admin" and "/admin/x" but NOT
+// "/administrator" (Express-style segment semantics) — a substring
+// prefix that lands mid-segment is a no-match so a security gate scoped
+// to "/admin" never leaks onto a sibling path that merely shares a
+// textual prefix.
+function _pathMatchesPrefix(prefixSegments, pathname) {
+  var pathSegments = pathname.split("/");
+  if (pathSegments.length < prefixSegments.length) return false;
+  // Compare segment-for-segment. This is routing metadata (public URL
+  // path), not secret material, so an ordinary equality walk is correct
+  // — no constant-time comparison is warranted.
+  return prefixSegments.every(function (seg, i) {
+    return pathSegments[i] === seg;
+  });
+}
+
+// Classify the first `use()` argument:
+//   function          → global mount (prefixes stays null)
+//   string / string[] → path-scoped mount (one or more prefixes)
+//   anything else     → operator wiring typo, refused at config time
+// Returns the prefix array (or null for a global mount). Does not touch
+// the middleware functions — the caller validates those.
+function _usePrefixesFromFirstArg(first) {
+  if (typeof first === "function") return null;
+  if (typeof first !== "string" && !Array.isArray(first)) {
+    throw new RouterError("router/use-bad-first-arg",
+      "router.use: first argument must be a middleware function, a path " +
+      "prefix string, or an array of prefix strings (got " +
+      (first === null ? "null" : typeof first) + ")");
+  }
+  var prefixes = Array.isArray(first) ? first : [first];
+  if (prefixes.length === 0) {
+    throw new RouterError("router/use-empty-prefix-array",
+      "router.use: path-prefix array must contain at least one prefix string");
+  }
+  // Array-of-non-empty-strings shape (the index-pointing throw on a
+  // non-string / empty entry) is the shared validate-opts contract.
+  validateOpts.optionalNonEmptyStringArray(
+    prefixes, "router.use: path prefix", RouterError, "router/use-prefix-not-string");
+  // Prefix-specific grammar: anchor at "/" + bounded length.
+  for (var i = 0; i < prefixes.length; i++) {
+    var grammarErr = _prefixGrammarError(prefixes[i]);
+    if (grammarErr) throw grammarErr;
+  }
+  return prefixes;
+}
+
+// Return a RouterError describing why `prefix` is not a valid mounting
+// prefix, or null when it is valid. Split out so the per-prefix grammar
+// check is one branch, not an inline throw-block in the loop.
+function _prefixGrammarError(prefix) {
+  if (prefix.charAt(0) !== "/") {
+    return new RouterError("router/use-prefix-not-absolute",
+      "router.use: path prefix '" + prefix + "' must begin with '/'");
+  }
+  if (prefix.length > MAX_ROUTE_PATTERN_LEN) {
+    return new RouterError("router/use-prefix-too-long",
+      "router.use: path prefix exceeds " + MAX_ROUTE_PATTERN_LEN +
+      " chars (got " + prefix.length + ")");
+  }
+  return null;
+}
+
+// Index of the first non-function entry in `fns`, or -1 when all are
+// functions. Kept separate so the middleware-shape check is a scan, not
+// an inline throw inside the normalize flow.
+function _firstNonFunctionIndex(fns) {
+  for (var i = 0; i < fns.length; i++) {
+    if (typeof fns[i] !== "function") return i;
+  }
+  return -1;
+}
+
+// Validate + normalize the `use()` arguments into middleware-table
+// entries. Config-time entry-point tier: a non-string / non-array-of-
+// strings prefix or a non-function middleware is an operator wiring
+// typo and throws so it surfaces at boot, not as a silent dropped gate
+// or a request-time 500. Returns one entry per middleware function:
+//   { prefix: null,        prefixSegmentsList: null,        fn }  — global
+//   { prefix: "/admin",    prefixSegmentsList: [[...], ...], fn }  — scoped
+// A scoped entry matches when ANY of its prefixes match the request
+// path on segment boundaries; the fn runs at most once per request even
+// when two of its prefixes both match (nested prefixes), so a gate never
+// double-executes.
+function _normalizeUseArgs(args) {
+  if (args.length === 0) {
+    throw new RouterError("router/use-no-args",
+      "router.use: requires at least one middleware function");
+  }
+  var prefixes = _usePrefixesFromFirstArg(args[0]);
+  // Global mount uses every arg as a middleware; a scoped mount drops the
+  // leading prefix arg and uses the rest.
+  var fns = (prefixes === null) ? args : args.slice(1);
+  if (fns.length === 0) {
+    throw new RouterError("router/use-no-middleware",
+      "router.use: path-scoped mount requires at least one middleware " +
+      "function after the prefix");
+  }
+  var nonFn = _firstNonFunctionIndex(fns);
+  if (nonFn !== -1) {
+    throw new RouterError("router/use-middleware-not-function",
+      "router.use: middleware at position " + nonFn +
+      " must be a function (got " +
+      (fns[nonFn] === null ? "null" : typeof fns[nonFn]) + ")");
+  }
+  // Pre-compile each prefix to its segment list once at registration so
+  // dispatch only walks segments, never re-splits the prefix per request.
+  var segmentsList = (prefixes === null) ? null : prefixes.map(_compilePrefix);
+  var label = (prefixes === null) ? null
+            : (prefixes.length === 1 ? prefixes[0] : prefixes.slice());
+  // One entry per fn, preserving the order each middleware was passed —
+  // a path-scoped mount with two middlewares interleaves them in
+  // registration order just like two separate use() calls would.
+  return fns.map(function (fn) {
+    return { prefix: label, prefixSegmentsList: segmentsList, fn: fn };
+  });
+}
+
 /**
  * @primitive b.router.serveStatic
  * @signature b.router.serveStatic(dir)
@@ -1266,7 +1451,7 @@ function serveStatic(dir) {
  *
  * Builds a `Router` instance with the framework's security-on-by-
  * default posture. Returned object exposes `get / post / put / patch
- * / delete` for route registration, `use(fn)` for global middleware,
+ * / delete` for route registration, `use(...)` for middleware,
  * `ws(path, handler, opts?)` for WebSocket routes, `onNotFound(fn)`
  * and `onError(fn)` for fallthrough hooks, `inspectRoutes()` and
  * `openapi()` for introspection, `closeWebSockets({ timeoutMs })`
@@ -1274,6 +1459,21 @@ function serveStatic(dir) {
  * which boots an HTTP/2-capable TLS server (ALPN h2 + http/1.1) when
  * `tlsOptions` is provided, an HTTP/1.1 server otherwise.
  *
+ * `use` has two forms. `use(mw)` (and `use(mw1, mw2, ...)`) mounts
+ * global middleware that runs on every request. `use(prefix, mw1,
+ * mw2, ...)` mounts path-scoped middleware that runs only when the
+ * request path is at or beneath `prefix`, matched on segment
+ * boundaries — `"/admin"` covers `"/admin"` and `"/admin/x"` but not
+ * `"/administrator"`. The prefix may be an array of strings to scope a
+ * gate to several path roots at once. Global and scoped middleware
+ * interleave in registration order, so a gate registered before a
+ * route still runs before it. A non-string / non-array prefix, a
+ * prefix not beginning with `"/"`, or a non-function middleware throws
+ * at registration time rather than dropping the gate or 500-ing every
+ * request — scope a security middleware (`csrf`, `bearerAuth`,
+ * `requireAal`, `requireMtls`) to a path with confidence it runs
+ * exactly where mounted.
+ *
  * @opts
  *   tls0Rtt:                "refuse" | "replay-cache",  // RFC 8446 §8 anti-replay; default "refuse"
  *   allowedRedirectOrigins: string[],                    // exact-match HTTPS origins for cross-origin res.redirect()
@@ -1286,6 +1486,13 @@ function serveStatic(dir) {
  *   router.get("/users/:id", function (req, res) {
  *     res.json({ id: req.params.id });
  *   });
+ *
+ *   // Global middleware — runs on every request.
+ *   router.use(b.middleware.securityHeaders());
+ *
+ *   // Path-scoped middleware — the step-up gate runs only under /admin.
+ *   router.use("/admin", b.middleware.requireAal({ minimum: "AAL2" }));
+ *
  *   router.listen(3000);
  */
 function create(opts) {

package/lib/vendor/blamejs/lib/safe-dns.js

@@ -57,6 +57,7 @@
 
 var C                  = require("./constants");
 var { defineClass }    = require("./framework-error");
+var gateContract       = require("./gate-contract");
 
 var SafeDnsError = defineClass("SafeDnsError", { alwaysPermanent: true });
 
@@ -153,11 +154,15 @@ var PROFILES = Object.freeze({
   },
 });
 
-var COMPLIANCE_POSTURES = Object.freeze({
-  hipaa:     "strict",
-  "pci-dss": "strict",
-  gdpr:      "strict",
-  soc2:      "strict",
+var COMPLIANCE_POSTURES = gateContract.ALL_STRICT_POSTURES;
+
+var _resolveProfile = gateContract.makeProfileResolver({
+  profiles:   PROFILES,
+  postures:   COMPLIANCE_POSTURES,
+  defaults:   DEFAULT_PROFILE,
+  errorClass: SafeDnsError,
+  codePrefix: "safe-dns",
+  byObject:   true,
 });
 
 /**
@@ -349,22 +354,6 @@ function checkCnameChainDepth(depth, opts) {
   }
 }
 
-/**
- * @primitive b.safeDns.compliancePosture
- * @signature b.safeDns.compliancePosture(posture)
- * @since     0.9.31
- * @status    stable
- *
- * Return the effective profile name for a compliance posture, or
- * `null` for unknown posture names (operator typo surfaces here).
- *
- * @example
- *   b.safeDns.compliancePosture("hipaa");   // → "strict"
- */
-function compliancePosture(posture) {
-  return COMPLIANCE_POSTURES[posture] || null;
-}
-
 function _readName(state, pointerDepth) {
   if (pointerDepth > state.caps.maxPointerDepth) {
     throw new SafeDnsError("safe-dns/oversize-pointer-depth",
@@ -639,27 +628,22 @@ function _decodeOpt(rr, caps) {
   };
 }
 
-function _resolveProfile(opts) {
-  if (opts.posture && COMPLIANCE_POSTURES[opts.posture]) {
-    return PROFILES[COMPLIANCE_POSTURES[opts.posture]];
-  }
-  var p = opts.profile || DEFAULT_PROFILE;
-  if (!PROFILES[p]) {
-    throw new SafeDnsError("safe-dns/bad-profile",
-      "safeDns: unknown profile '" + p + "' (valid: strict / balanced / permissive)");
-  }
-  return PROFILES[p];
-}
-
-module.exports = {
-  parseResponse:        parseResponse,
-  boundEdns0:           boundEdns0,
-  checkCnameChainDepth: checkCnameChainDepth,
-  compliancePosture:    compliancePosture,
-  PROFILES:             PROFILES,
-  COMPLIANCE_POSTURES:  COMPLIANCE_POSTURES,
-  RTYPE_NAMES:          RTYPE_NAMES,
-  SafeDnsError:         SafeDnsError,
-  NAME:                 "dns",
-  KIND:                 "dns-response",
-};
+// compliancePosture is assembled by gateContract.defineParser below; its
+// wiki section renders from the single-sourced @abiTemplate (defineParser)
+// block in gate-contract.js, instantiated for this guard by the page
+// generator.
+module.exports = gateContract.defineParser({
+  name:       "dns",
+  entry:      parseResponse,
+  entryName:  "parseResponse",
+  errorClass: SafeDnsError,
+  profiles:   PROFILES,
+  postures:   COMPLIANCE_POSTURES,
+  extra: {
+    boundEdns0:           boundEdns0,
+    checkCnameChainDepth: checkCnameChainDepth,
+    RTYPE_NAMES:          RTYPE_NAMES,
+    NAME:                 "dns",
+    KIND:                 "dns-response",
+  },
+});

package/lib/vendor/blamejs/lib/safe-ical.js

@@ -81,6 +81,7 @@
 
 var C = require("./constants");
 var { defineClass } = require("./framework-error");
+var gateContract = require("./gate-contract");
 
 var SafeIcalError = defineClass("SafeIcalError", { alwaysPermanent: true });
 
@@ -116,12 +117,7 @@ var PROFILES = Object.freeze({
   }),
 });
 
-var COMPLIANCE_POSTURES = Object.freeze({
-  hipaa:     "strict",
-  "pci-dss": "strict",
-  gdpr:      "strict",
-  soc2:      "strict",
-});
+var COMPLIANCE_POSTURES = gateContract.ALL_STRICT_POSTURES;
 
 // Property-name allowlist per RFC 5545 §8.7 (Property Registry) +
 // RFC 5546 §4.3 (iTIP additions) + RFC 7986 §5 (new calendar
@@ -273,24 +269,6 @@ function parse(text, opts) {
     : { vcalendar: vcalendars[0], vcalendars: vcalendars };
 }
 
-/**
- * @primitive b.safeIcal.compliancePosture
- * @signature b.safeIcal.compliancePosture(name)
- * @since     0.9.81
- * @status    stable
- * @related   b.safeIcal.parse
- *
- * Map a compliance-posture name to its profile. Returns the profile
- * string for a known posture, `null` for unknown names.
- *
- * @example
- *   b.safeIcal.compliancePosture("hipaa");   // → "strict"
- *   b.safeIcal.compliancePosture("loose");   // → null
- */
-function compliancePosture(name) {
-  return COMPLIANCE_POSTURES[name] || null;
-}
-
 // ---- Profile / opt resolution ----
 
 function _resolveCaps(opts) {
@@ -623,12 +601,19 @@ function _preview(s) {
   return s.length > 64 ? s.slice(0, 64) + "..." : s;                                                       // log-preview length cap
 }
 
-module.exports = {
-  parse:               parse,
-  compliancePosture:   compliancePosture,
-  PROFILES:            PROFILES,
-  COMPLIANCE_POSTURES: COMPLIANCE_POSTURES,
-  KNOWN_PROPERTIES:    KNOWN_PROPERTIES,
-  KNOWN_COMPONENTS:    KNOWN_COMPONENTS,
-  SafeIcalError:       SafeIcalError,
-};
+// compliancePosture is assembled by gateContract.defineParser below; its
+// wiki section renders from the single-sourced @abiTemplate (defineParser)
+// block in gate-contract.js, instantiated for this guard by the page
+// generator.
+module.exports = gateContract.defineParser({
+  name:       "ical",
+  entry:      parse,
+  entryName:  "parse",
+  errorClass: SafeIcalError,
+  profiles:   PROFILES,
+  postures:   COMPLIANCE_POSTURES,
+  extra: {
+    KNOWN_PROPERTIES: KNOWN_PROPERTIES,
+    KNOWN_COMPONENTS: KNOWN_COMPONENTS,
+  },
+});