@blamejs/blamejs-shop 0.4.55 → 0.4.57

package/lib/vendor/blamejs/lib/guard-time.js

@@ -37,11 +37,9 @@
  *   ISO 8601 / RFC 3339 datetime identifier-safety guard.
  */
 
-var codepointClass = require("./codepoint-class");
 var lazyRequire = require("./lazy-require");
 var gateContract = require("./gate-contract");
 var C = require("./constants");
-var numericBounds = require("./numeric-bounds");
 var { GuardTimeError } = require("./framework-error");
 
 var observability = lazyRequire(function () { return require("./observability"); });
@@ -65,10 +63,7 @@ var MAX_FRACTIONAL_DIGITS = 9;
 
 var PROFILES = Object.freeze({
   "strict": {
-    bidiPolicy:               "reject",
-    controlPolicy:             "reject",
-    nullBytePolicy:            "reject",
-    zeroWidthPolicy:           "reject",
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     naiveDatetimePolicy:       "reject",
     nonUtcOffsetPolicy:        "reject",
     leapSecondPolicy:          "reject",
@@ -82,10 +77,7 @@ var PROFILES = Object.freeze({
     maxRuntimeMs:              C.TIME.seconds(2),
   },
   "balanced": {
-    bidiPolicy:               "reject",
-    controlPolicy:             "reject",
-    nullBytePolicy:            "reject",
-    zeroWidthPolicy:           "reject",
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     naiveDatetimePolicy:       "reject",
     nonUtcOffsetPolicy:        "audit",
     leapSecondPolicy:          "audit",
@@ -99,10 +91,7 @@ var PROFILES = Object.freeze({
     maxRuntimeMs:              C.TIME.seconds(2),
   },
   "permissive": {
-    bidiPolicy:               "reject",                                          // BIDI refused at every profile
-    controlPolicy:             "reject",                                          // controls refused at every profile
-    nullBytePolicy:            "reject",                                          // null refused at every profile
-    zeroWidthPolicy:           "reject",                                          // zero-width refused at every profile
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     naiveDatetimePolicy:       "audit",
     nonUtcOffsetPolicy:        "allow",
     leapSecondPolicy:          "allow",
@@ -117,57 +106,16 @@ var PROFILES = Object.freeze({
   },
 });
 
-var DEFAULTS = Object.freeze(Object.assign({}, PROFILES["strict"], {
-  mode: "enforce",
-}));
+var DEFAULTS = gateContract.strictDefaults(PROFILES);
 
-var COMPLIANCE_POSTURES = Object.freeze({
-  "hipaa":   Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(128),
-  }),
-  "pci-dss": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(128),
-  }),
-  "gdpr":    Object.assign({}, PROFILES["balanced"], {
-    forensicSnippetBytes: C.BYTES.bytes(64),
-  }),
-  "soc2":    Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-});
-
-function _resolveOpts(opts) {
-  return gateContract.resolveProfileAndPosture(opts, {
-    profiles:           PROFILES,
-    compliancePostures: COMPLIANCE_POSTURES,
-    defaults:           DEFAULTS,
-    errorClass:         GuardTimeError,
-    errCodePrefix:      "time",
-  });
-}
+var COMPLIANCE_POSTURES = gateContract.compliancePostures(PROFILES, { base: 128 });
 
 // ---- Detection ----
 
 function _detectIssues(input, opts) {
-  var issues = [];
-  if (typeof input !== "string") {
-    return [{ kind: "bad-input", severity: "high",
-              ruleId: "time.bad-input",
-              snippet: "time is not a string" }];
-  }
-  if (input.length === 0) {
-    return [{ kind: "empty", severity: "high",
-              ruleId: "time.empty",
-              snippet: "time is empty" }];
-  }
-  if (Buffer.byteLength(input, "utf8") > opts.maxBytes) {
-    return [{ kind: "time-cap", severity: "high",
-              ruleId: "time.time-cap",
-              snippet: "time input exceeds maxBytes " + opts.maxBytes }];
-  }
-
-  var charThreats = codepointClass.detectCharThreats(input, opts, "time");
-  for (var ci = 0; ci < charThreats.length; ci += 1) issues.push(charThreats[ci]);
+  var pre = gateContract.detectStringInput(input, opts, { name: "time", cap: { bytes: opts.maxBytes } });
+  if (pre.done) return pre.issues;
+  var issues = pre.issues;
 
   // Date-only / time-only quick checks BEFORE the full RFC 3339 regex
   // so the operator gets a more actionable diagnosis.
@@ -371,21 +319,13 @@ function _detectIssues(input, opts) {
  *   bad.ok;                                            // → false
  *   bad.issues[0].ruleId;                              // → "time.year-out-of-range"
  */
-function validate(input, opts) {
-  opts = _resolveOpts(opts);
-  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
-    ["maxBytes", "minYear", "maxYear", "maxFractionalDigits"],
-    "guardTime.validate", GuardTimeError, "time.bad-opt");
-  if (typeof input !== "string") {
-    return {
-      ok: false,
-      issues: [{ kind: "bad-input", severity: "high",
-                 ruleId: "time.bad-input",
-                 snippet: "time is not a string" }],
-    };
-  }
-  return gateContract.aggregateIssues(_detectIssues(input, opts));
-}
+// validate is assembled by gateContract.defineGuard from `detect`
+// (_detectIssues) below — `validate(input, opts) = aggregateIssues(detect(
+// input, resolveOpts(opts)))`, with maxBytes / minYear / maxYear /
+// maxFractionalDigits declared via `intOpts`. _detectIssues returns the
+// `time.bad-input` issue for a non-string, so validate reports
+// `{ ok: false }` there without a bespoke early-return. The @primitive
+// block above documents the resulting public ABI.
 
 /**
  * @primitive  b.guardTime.sanitize
@@ -417,15 +357,12 @@ function validate(input, opts) {
  *     e.code;                                          // → "time.leap-second"
  *   }
  */
-function sanitize(input, opts) {
-  opts = _resolveOpts(opts);
-  if (typeof input !== "string") {
-    throw _err("time.bad-input", "sanitize requires string input");
-  }
-  var issues = _detectIssues(input, opts);
-  gateContract.throwOnRefusalSeverity(issues, { errorClass: GuardTimeError, codePrefix: "time" });
-  // Normalize: lowercase the trailing `T` separator, uppercase the
-  // `Z` UTC marker.
+// _sanitizeTransform — the guard-specific normalize applied by defineGuard's
+// generated sanitize AFTER resolve → detect → throw-on-refusal. Input is an
+// already-validated string at this point (a non-string refuses upstream).
+function _sanitizeTransform(input) {
+  // Normalize: replace the legacy space separator with `T`, uppercase the
+  // trailing `z` UTC marker.
   return input.replace(/(\d) /, "$1T").replace(/z$/, "Z");
 }
 
@@ -434,15 +371,9 @@ function sanitize(input, opts) {
 // single-sourced @abiTemplate (defineGuard) blocks in gate-contract.js,
 // instantiated per guard by the page generator.
 
-var INTEGRATION_FIXTURES = Object.freeze({
-  kind:              "identifier",
-  benignBytes:       Buffer.from("2026-05-05T12:34:56Z", "utf8"),
-  hostileBytes:      Buffer.from("2026-05-05 12:34:56", "utf8"),
-  benignIdentifier:  "2026-05-05T12:34:56Z",
-  // Hostile: naive datetime (space separator + no offset) — refused
-  // at strict (cross-region ambiguity class).
-  hostileIdentifier: "2026-05-05 12:34:56",
-});
+// Hostile: naive datetime (space separator + no offset) — refused at
+// strict (cross-region ambiguity class).
+var INTEGRATION_FIXTURES = gateContract.identifierFixtures("2026-05-05T12:34:56Z", "2026-05-05 12:34:56");
 
 // Assembled from the gate-contract guard factory: error class, registry
 // exports (NAME / KIND / INTEGRATION_FIXTURES), buildProfile /
@@ -458,7 +389,8 @@ module.exports = gateContract.defineGuard({
   defaults:    DEFAULTS,
   postures:    COMPLIANCE_POSTURES,
   integrationFixtures: INTEGRATION_FIXTURES,
-  validate:    validate,
-  sanitize:    sanitize,
+  detect:           _detectIssues,
+  sanitizeTransform: _sanitizeTransform,
+  intOpts:          ["maxBytes", "minYear", "maxYear", "maxFractionalDigits"],
   ctxFields:   ["identifier", "timestamp", "time"],
 });

package/lib/vendor/blamejs/lib/guard-uuid.js

@@ -33,11 +33,9 @@
  *   UUID identifier-safety guard.
  */
 
-var codepointClass = require("./codepoint-class");
 var lazyRequire = require("./lazy-require");
 var gateContract = require("./gate-contract");
 var C = require("./constants");
-var numericBounds = require("./numeric-bounds");
 var { GuardUuidError } = require("./framework-error");
 
 var observability = lazyRequire(function () { return require("./observability"); });
@@ -66,10 +64,7 @@ var MAX_HEX = "ffffffffffffffffffffffffffffffff";
 
 var PROFILES = Object.freeze({
   "strict": {
-    bidiPolicy:        "reject",
-    controlPolicy:     "reject",
-    nullBytePolicy:    "reject",
-    zeroWidthPolicy:   "reject",
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     formatPolicy:      "hyphenated-only",   // hyphenated | hyphenless | braced | urn | hyphenated-only | any
     versionPolicy:     "reject-unassigned", // reject-unassigned | audit | allow
     variantPolicy:     "reject-non-rfc",    // reject-non-rfc | audit | allow
@@ -82,10 +77,7 @@ var PROFILES = Object.freeze({
     maxRuntimeMs:      C.TIME.seconds(2),
   },
   "balanced": {
-    bidiPolicy:        "reject",
-    controlPolicy:     "reject",
-    nullBytePolicy:    "reject",
-    zeroWidthPolicy:   "reject",
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     formatPolicy:      "any",
     versionPolicy:     "reject-unassigned",
     variantPolicy:     "audit",
@@ -98,10 +90,7 @@ var PROFILES = Object.freeze({
     maxRuntimeMs:      C.TIME.seconds(2),
   },
   "permissive": {
-    bidiPolicy:        "reject",                                                 // BIDI refused at every profile
-    controlPolicy:     "reject",                                                 // controls refused at every profile
-    nullBytePolicy:    "reject",                                                 // null refused at every profile
-    zeroWidthPolicy:   "reject",                                                 // zero-width refused at every profile
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     formatPolicy:      "any",
     versionPolicy:     "audit",
     variantPolicy:     "allow",
@@ -115,34 +104,9 @@ var PROFILES = Object.freeze({
   },
 });
 
-var DEFAULTS = Object.freeze(Object.assign({}, PROFILES["strict"], {
-  mode: "enforce",
-}));
+var DEFAULTS = gateContract.strictDefaults(PROFILES);
 
-var COMPLIANCE_POSTURES = Object.freeze({
-  "hipaa":   Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(128),
-  }),
-  "pci-dss": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(128),
-  }),
-  "gdpr":    Object.assign({}, PROFILES["balanced"], {
-    forensicSnippetBytes: C.BYTES.bytes(64),
-  }),
-  "soc2":    Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-});
-
-function _resolveOpts(opts) {
-  return gateContract.resolveProfileAndPosture(opts, {
-    profiles:           PROFILES,
-    compliancePostures: COMPLIANCE_POSTURES,
-    defaults:           DEFAULTS,
-    errorClass:         GuardUuidError,
-    errCodePrefix:      "uuid",
-  });
-}
+var COMPLIANCE_POSTURES = gateContract.compliancePostures(PROFILES, { base: 128 });
 
 function _classifyForm(input) {
   if (UUID_URN_RE.test(input)) return "urn";                                     // allow:regex-no-length-cap — input bounded by maxBytes
@@ -161,26 +125,9 @@ function _toCanonicalHex(input, form) {
 }
 
 function _detectIssues(input, opts) {
-  var issues = [];
-  if (typeof input !== "string") {
-    return [{ kind: "bad-input", severity: "high",
-              ruleId: "uuid.bad-input",
-              snippet: "uuid is not a string" }];
-  }
-  if (input.length === 0) {
-    return [{ kind: "empty", severity: "high",
-              ruleId: "uuid.empty",
-              snippet: "uuid is empty" }];
-  }
-  if (Buffer.byteLength(input, "utf8") > opts.maxBytes) {
-    return [{ kind: "uuid-cap", severity: "high",
-              ruleId: "uuid.uuid-cap",
-              snippet: "uuid input exceeds maxBytes " + opts.maxBytes }];
-  }
-
-  // Codepoint-class threats (universal refuse — runs first).
-  var charThreats = codepointClass.detectCharThreats(input, opts, "uuid");
-  for (var ci = 0; ci < charThreats.length; ci += 1) issues.push(charThreats[ci]);
+  var pre = gateContract.detectStringInput(input, opts, { name: "uuid", cap: { bytes: opts.maxBytes } });
+  if (pre.done) return pre.issues;
+  var issues = pre.issues;
 
   // Format classification.
   var form = _classifyForm(input);
@@ -330,21 +277,10 @@ function _detectIssues(input, opts) {
  *   bad.ok;                                            // → false
  *   bad.issues[0].ruleId;                              // → "uuid.nil"
  */
-function validate(input, opts) {
-  opts = _resolveOpts(opts);
-  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
-    ["maxBytes"],
-    "guardUuid.validate", GuardUuidError, "uuid.bad-opt");
-  if (typeof input !== "string") {
-    return {
-      ok: false,
-      issues: [{ kind: "bad-input", severity: "high",
-                 ruleId: "uuid.bad-input",
-                 snippet: "uuid is not a string" }],
-    };
-  }
-  return gateContract.aggregateIssues(_detectIssues(input, opts));
-}
+// validate is assembled by gateContract.defineGuard from `detect`
+// (_detectIssues) below — `validate(input, opts) = aggregateIssues(detect(
+// input, resolveOpts(opts)))`, with the maxBytes cap declared via `intOpts`.
+// The @primitive block above documents the resulting public ABI.
 
 /**
  * @primitive  b.guardUuid.sanitize
@@ -376,13 +312,10 @@ function validate(input, opts) {
  *     e.code;                                          // → "uuid.max"
  *   }
  */
-function sanitize(input, opts) {
-  opts = _resolveOpts(opts);
-  if (typeof input !== "string") {
-    throw _err("uuid.bad-input", "sanitize requires string input");
-  }
-  var issues = _detectIssues(input, opts);
-  gateContract.throwOnRefusalSeverity(issues, { errorClass: GuardUuidError, codePrefix: "uuid" });
+// _sanitizeTransform — the guard-specific normalize applied by defineGuard's
+// generated sanitize AFTER resolve → detect → throw-on-refusal. Input is an
+// already-validated string at this point (a non-string refuses upstream).
+function _sanitizeTransform(input) {
   // Safe transforms: lowercase + strip braces / urn prefix → canonical
   // hyphenated form.
   var form = _classifyForm(input);
@@ -398,14 +331,8 @@ function sanitize(input, opts) {
 // single-sourced @abiTemplate (defineGuard) blocks in gate-contract.js,
 // instantiated per guard by the page generator.
 
-var INTEGRATION_FIXTURES = Object.freeze({
-  kind:              "identifier",
-  benignBytes:       Buffer.from("550e8400-e29b-41d4-a716-446655440000", "utf8"),
-  hostileBytes:      Buffer.from("00000000-0000-0000-0000-000000000000", "utf8"),
-  benignIdentifier:  "550e8400-e29b-41d4-a716-446655440000",
-  // Hostile: nil UUID — refused at strict (sentinel-leak class).
-  hostileIdentifier: "00000000-0000-0000-0000-000000000000",
-});
+// Hostile: nil UUID — refused at strict (sentinel-leak class).
+var INTEGRATION_FIXTURES = gateContract.identifierFixtures("550e8400-e29b-41d4-a716-446655440000", "00000000-0000-0000-0000-000000000000");
 
 // Assembled from the gate-contract guard factory: error class, registry
 // exports (NAME / KIND / INTEGRATION_FIXTURES), buildProfile /
@@ -421,7 +348,8 @@ module.exports = gateContract.defineGuard({
   defaults:    DEFAULTS,
   postures:    COMPLIANCE_POSTURES,
   integrationFixtures: INTEGRATION_FIXTURES,
-  validate:    validate,
-  sanitize:    sanitize,
+  detect:            _detectIssues,
+  sanitizeTransform: _sanitizeTransform,
+  intOpts:           ["maxBytes"],
   ctxFields:   ["identifier", "uuid"],
 });

package/lib/vendor/blamejs/lib/guard-xml.js

@@ -71,7 +71,6 @@ var codepointClass = require("./codepoint-class");
 var lazyRequire = require("./lazy-require");
 var gateContract = require("./gate-contract");
 var C = require("./constants");
-var numericBounds = require("./numeric-bounds");
 var { GuardXmlError } = require("./framework-error");
 
 var observability = lazyRequire(function () { return require("./observability"); });
@@ -113,10 +112,7 @@ var PROFILES = Object.freeze({
     processingInstrPolicy:  "reject",
     cdataPolicy:            "reject",
     xmlDsigPolicy:          "audit",
-    bidiPolicy:             "reject",
-    controlPolicy:          "reject",
-    nullBytePolicy:         "reject",
-    zeroWidthPolicy:        "reject",
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     maxBytes:               C.BYTES.mib(2),
     maxDepth:               64,                                                  // recursion depth, not byte size
     maxElements:            8192,                                                // element count cap, not byte size
@@ -166,47 +162,17 @@ var PROFILES = Object.freeze({
   },
 });
 
-var DEFAULTS = Object.freeze(Object.assign({}, PROFILES["strict"], {
-  mode:          "enforce",
+var DEFAULTS = gateContract.strictDefaults(PROFILES, {
   maxRuntimeMs:  C.TIME.seconds(10),
-}));
-
-var COMPLIANCE_POSTURES = Object.freeze({
-  "hipaa": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-  "pci-dss": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-  "gdpr": Object.assign({}, PROFILES["balanced"], {
-    forensicSnippetBytes: C.BYTES.bytes(128),
-  }),
-  "soc2": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(512),
-  }),
 });
 
-function _resolveOpts(opts) {
-  return gateContract.resolveProfileAndPosture(opts, {
-    profiles:           PROFILES,
-    compliancePostures: COMPLIANCE_POSTURES,
-    defaults:           DEFAULTS,
-    errorClass:         GuardXmlError,
-    errCodePrefix:      "xml",
-  });
-}
+var COMPLIANCE_POSTURES = gateContract.compliancePostures(PROFILES, { base: 256 });
+
 
 function _detectIssues(input, opts) {
-  var issues = [];
-  if (typeof input !== "string") {
-    return [{ kind: "bad-input", severity: "high",
-              snippet: "input is not a string" }];
-  }
-  if (input.length > opts.maxBytes) {
-    return [{ kind: "too-large", severity: "high", ruleId: "xml.too-large",
-              snippet: "input " + input.length +
-                       " bytes exceeds maxBytes " + opts.maxBytes }];
-  }
+  var pre = gateContract.detectStringInput(input, opts, { name: "xml", noun: "input", emptyMode: "skip", scanCodepoints: false, cap: { bytes: opts.maxBytes, kind: "too-large", snippet: function (byteLen, max) { return "input " + byteLen + " bytes exceeds maxBytes " + max; } } });
+  if (pre.done) return pre.issues;
+  var issues = pre.issues;
 
   // 1. DOCTYPE.
   if (opts.doctypePolicy !== "allow" && DOCTYPE_RE.test(input)) {                // allow:regex-no-length-cap — input bounded by maxBytes above
@@ -301,8 +267,8 @@ function _detectIssues(input, opts) {
   // CVE-2026-33036 .NET XmlReader class). Counted regardless of
   // entityPolicy so signed-XML paths that need entities-allowed don't
   // get the NCR cap disabled with them. The `maxNumericCharRefs` opt
-  // is validated by `numericBounds.requireAllPositiveFiniteIntIfPresent`
-  // at the public-surface boundary above.
+  // is validated as a positive-finite int via defineGuard's `intOpts`
+  // at the public validate boundary.
   var ncrCap = opts.maxNumericCharRefs;
   if (ncrCap !== undefined && ncrCap !== null) {
     var ncrMatches = input.match(NUMERIC_CHAR_REF_RE);                           // allow:regex-no-length-cap — input bounded by maxBytes above
@@ -320,7 +286,7 @@ function _detectIssues(input, opts) {
   }
 
   // 9. Codepoint-class threats.
-  issues.push.apply(issues, codepointClass.detectCharThreats(input, opts, "xml"));
+  issues.push.apply(issues, codepointClass.detectCharThreats(input, opts, "xml", "warn"));
 
   // 10. Element + depth + attribute caps via tag count.
   var openTags = (input.match(/<[A-Za-z][\w:-]*/g) || []).length;
@@ -415,21 +381,11 @@ function _detectIssues(input, opts) {
  *   rv.ok;                                              // → false
  *   rv.issues.some(function (i) { return i.kind === "doctype"; });  // → true
  */
-function validate(input, opts) {
-  opts = _resolveOpts(opts);
-  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
-    ["maxBytes", "maxDepth", "maxElements", "maxAttrsPerElement",
-     "maxAttrValueBytes", "maxNumericCharRefs"],
-    "guardXml.validate", GuardXmlError, "xml.bad-opt");
-  if (typeof input !== "string") {
-    return {
-      ok: false,
-      issues: [{ kind: "bad-input", severity: "high",
-                 snippet: "input is not a string" }],
-    };
-  }
-  return gateContract.aggregateIssues(_detectIssues(input, opts));
-}
+// validate is assembled by gateContract.defineGuard from `detect`
+// (_detectIssues), with the positive-finite-int caps declared via `intOpts`.
+// A non-string input falls through _detectIssues' xml.bad-input issue, which
+// aggregateIssues reports as ok:false. The @primitive block above documents
+// the resulting ABI.
 
 /**
  * @primitive  b.guardXml.sanitize
@@ -469,18 +425,12 @@ function validate(input, opts) {
  *   });
  *   clean.indexOf(ZWSP) === -1;                         // → true
  */
-function sanitize(input, opts) {
-  opts = _resolveOpts(opts);
-  if (typeof input !== "string") {
-    throw _err("xml.bad-input", "sanitize requires string input");
-  }
-  // XML sanitization — strip what's strip-able per policy. Critical
-  // shapes (DOCTYPE / ENTITY / external / parameter-entity) have no
-  // safe sanitization; throw.
-  var issues = _detectIssues(input, opts);
-  gateContract.throwOnRefusalSeverity(issues,
-    { errorClass: GuardXmlError, codePrefix: "xml", severities: ["critical"] });
-  // Strip character-class threats per policy via the shared helper.
+// _sanitizeTransform — the normalize tail applied by defineGuard's generated
+// sanitize AFTER resolve -> detect -> throwOnRefusalSeverity. spec.sanitizeSeverities
+// is ["critical"], so the critical structural shapes (DOCTYPE / ENTITY /
+// external / parameter-entity) throw upstream; the strip-able character-class
+// threats (BOM, bidi, C0, null, zero-width) are repaired here per policy.
+function _sanitizeTransform(input, opts) {
   return codepointClass.applyCharStripPolicies(input, opts);
 }
 
@@ -521,35 +471,49 @@ function sanitize(input, opts) {
  *   var verdict = await xmlGate.check({ bytes: hostile });
  *   verdict.action;                                     // → "refuse"
  */
+// Disposition of each xml finding = what the operator's policy for that class
+// selected. The XXE / injection classes (DOCTYPE / entity / external-entity /
+// XInclude / schema-location / processing-instruction / CDATA / XML-signature)
+// and the bidi / null / control char threats follow their policies (refuse
+// under `reject`, audit under `audit`, sanitize under `strip`). A parameter
+// entity rides the entity policy. The numeric-char-ref / element / depth caps
+// and a bad input always refuse. Exhaustive over every kind _detectIssues emits.
+function _gateDispositionFor(issue, opts) {
+  var shared = gateContract.charThreatDisposition(issue, opts);
+  if (shared) return shared;
+  switch (issue.kind) {
+    case "doctype":                return gateContract.policyDisposition(opts.doctypePolicy);
+    case "entity-declaration":
+    case "parameter-entity":       return gateContract.policyDisposition(opts.entityPolicy);
+    case "external-entity":        return gateContract.policyDisposition(opts.externalEntityPolicy);
+    case "xinclude":               return gateContract.policyDisposition(opts.xincludePolicy);
+    case "schema-location":        return gateContract.policyDisposition(opts.schemaLocationPolicy);
+    case "processing-instruction": return gateContract.policyDisposition(opts.processingInstrPolicy);
+    case "cdata":                  return gateContract.policyDisposition(opts.cdataPolicy);
+    case "xml-signature":          return gateContract.policyDisposition(opts.xmlDsigPolicy);
+    case "numeric-char-ref-cap":
+    case "element-cap":
+    case "depth-cap":
+    case "bad-input":
+    case "too-large":              return "refuse";
+    default:                       return null;
+  }
+}
+
 function gate(opts) {
-  opts = _resolveOpts(opts);
-  return gateContract.buildGuardGate(
-    opts.name || "guardXml:" + (opts.profile || "default"),
-    opts,
-    async function (ctx) {
-      var text = gateContract.extractBytesAsText(ctx);
-      if (!text) return { ok: true, action: "serve" };
-      var rv = validate(text, opts);
-      if (rv.issues.length === 0) return { ok: true, action: "serve" };
-      var hasCritical = rv.issues.some(function (i) {
-        return i.severity === "critical" || i.severity === "high";
-      });
-      if (!hasCritical) return { ok: true, action: "audit-only", issues: rv.issues };
-
-      // Sanitize-eligibility: every reject-policy off.
-      var canSanitize = opts.doctypePolicy !== "reject" &&
-                        opts.entityPolicy !== "reject" &&
-                        opts.externalEntityPolicy !== "reject";
-      if (canSanitize) {
-        try {
-          var clean = sanitize(text, opts);
-          return { ok: true, action: "sanitize",
-                   sanitized: Buffer.from(clean, "utf8"),
-                   issues: rv.issues };
-        } catch (_e) { /* fall through */ }
-      }
-      return { ok: false, action: "refuse", issues: rv.issues };
-    });
+  opts = _guard.resolveOpts(opts);
+  return gateContract.buildContentGate({
+    name:     opts.name || "guardXml:" + (opts.profile || "default"),
+    opts:     opts,
+    validate: module.exports.validate,
+    dispositionFor: _gateDispositionFor,
+    // The strip transform, NOT the public `sanitize` — that one throws on a
+    // critical finding (e.g. a bidi override) regardless of the strip policy,
+    // which would turn a policy-selected sanitize into a refuse. Only the
+    // char-threat classes (strip policy) reach sanitize; the XXE / injection
+    // classes are refuse / audit by policy.
+    produceSanitized: function (text, o) { return _sanitizeTransform(text, o); },
+  });
 }
 
 // buildProfile / compliancePosture / loadRulePack are assembled by
@@ -571,11 +535,13 @@ var INTEGRATION_FIXTURES = Object.freeze({
 
 // Assembled from the gate-contract guard factory: error class, registry
 // exports (NAME / KIND / MIME_TYPES / EXTENSIONS / INTEGRATION_FIXTURES),
-// buildProfile / compliancePosture / loadRulePack wiring, plus the
-// per-guard inspection surface (validate / sanitize / bespoke gate)
-// passed through verbatim. The bespoke `gate` carries XML's
-// per-policy canSanitize matrix unchanged.
-module.exports = gateContract.defineGuard({
+// buildProfile / compliancePosture / loadRulePack wiring, plus validate /
+// sanitize generated from `detect` (_detectIssues) + `sanitizeTransform`
+// (_sanitizeTransform) — sanitizeSeverities ["critical"] keeps DOCTYPE /
+// ENTITY / external / parameter-entity throwing while strip-able char-class
+// threats are repaired. The bespoke `gate` carries XML's per-policy
+// canSanitize matrix unchanged.
+var _guard = module.exports = gateContract.defineGuard({
   name:        "xml",
   kind:        "content",
   errorClass:  GuardXmlError,
@@ -585,7 +551,11 @@ module.exports = gateContract.defineGuard({
   mimeTypes:   ["application/xml", "text/xml"],
   extensions:  [".xml"],
   integrationFixtures: INTEGRATION_FIXTURES,
-  validate:    validate,
-  sanitize:    sanitize,
+  detect:             _detectIssues,
+  sanitizeTransform:  _sanitizeTransform,
+  sanitizeSeverities: ["critical"],
+  intOpts:            ["maxBytes", "maxDepth", "maxElements", "maxAttrsPerElement",
+                       "maxAttrValueBytes", "maxNumericCharRefs"],
   gate:        gate,
+  extra: { _gateDispositionForTest: _gateDispositionFor },
 });