@blamejs/blamejs-shop 0.4.55 → 0.4.57

package/lib/vendor/blamejs/test/layer-0-primitives/codepoint-class.test.js

@@ -0,0 +1,78 @@
+"use strict";
+/**
+ * b.codepointClass — control-char predicate helpers
+ * (isForbiddenControlChar / firstControlCharOffset).
+ */
+var helpers = require("../helpers");
+var check = helpers.check;
+var codepointClass = require("../../lib/codepoint-class");
+
+function testIsForbiddenControlChar() {
+  var f = codepointClass.isForbiddenControlChar;
+  // NUL and other C0 controls are forbidden by default.
+  check("isForbiddenControlChar: NUL forbidden", f(0x00) === true);
+  check("isForbiddenControlChar: 0x01 forbidden", f(0x01) === true);
+  check("isForbiddenControlChar: 0x1f forbidden", f(0x1f) === true);
+  // TAB always permitted.
+  check("isForbiddenControlChar: TAB permitted", f(0x09) === false);
+  // DEL always forbidden, regardless of opts.
+  check("isForbiddenControlChar: DEL forbidden", f(0x7f) === true);
+  check("isForbiddenControlChar: DEL forbidden even with allowLf/allowCr",
+        f(0x7f, { allowLf: true, allowCr: true }) === true);
+  // Printable + high-bit are not control chars.
+  check("isForbiddenControlChar: space ok", f(0x20) === false);
+  check("isForbiddenControlChar: 'A' ok", f(0x41) === false);
+  check("isForbiddenControlChar: 0xff ok", f(0xff) === false);
+  // LF / CR forbidden by default, permitted only when opted in.
+  check("isForbiddenControlChar: LF forbidden by default", f(0x0a) === true);
+  check("isForbiddenControlChar: CR forbidden by default", f(0x0d) === true);
+  check("isForbiddenControlChar: LF permitted with allowLf", f(0x0a, { allowLf: true }) === false);
+  check("isForbiddenControlChar: CR still forbidden with allowLf only", f(0x0d, { allowLf: true }) === true);
+  check("isForbiddenControlChar: CR permitted with allowCr", f(0x0d, { allowCr: true }) === false);
+  check("isForbiddenControlChar: LF still forbidden with allowCr only", f(0x0a, { allowCr: true }) === true);
+  // forbidTab — the stricter identifier / key / name contexts forbid TAB too,
+  // making the predicate exactly `code < 0x20 || code === 0x7f`.
+  check("isForbiddenControlChar: TAB forbidden with forbidTab", f(0x09, { forbidTab: true }) === true);
+  check("isForbiddenControlChar: NUL still forbidden with forbidTab", f(0x00, { forbidTab: true }) === true);
+  check("isForbiddenControlChar: DEL still forbidden with forbidTab", f(0x7f, { forbidTab: true }) === true);
+  check("isForbiddenControlChar: space ok with forbidTab", f(0x20, { forbidTab: true }) === false);
+  check("isForbiddenControlChar: 'A' ok with forbidTab", f(0x41, { forbidTab: true }) === false);
+  // forbidTab is byte-equivalent to the open-coded `code < 0x20 || code === 0x7f`
+  // across every codepoint (the routed name/key validators rely on this).
+  var forbidTabParity = true;
+  for (var cp = 0; cp <= 0x200; cp += 1) {
+    if (f(cp, { forbidTab: true }) !== (cp < 0x20 || cp === 0x7f)) { forbidTabParity = false; break; }
+  }
+  check("isForbiddenControlChar: forbidTab === (code < 0x20 || code === 0x7f)", forbidTabParity);
+  check("firstControlCharOffset: TAB forbidden with forbidTab → offset",
+        codepointClass.firstControlCharOffset("a\tb", { forbidTab: true }) === 1);
+  check("firstControlCharOffset: TAB allowed by default → -1",
+        codepointClass.firstControlCharOffset("a\tb") === -1);
+}
+
+function testFirstControlCharOffset() {
+  var g = codepointClass.firstControlCharOffset;
+  check("firstControlCharOffset: clean string → -1", g("hello world") === -1);
+  check("firstControlCharOffset: TAB ok → -1", g("a\tb\tc") === -1);
+  check("firstControlCharOffset: empty → -1", g("") === -1);
+  check("firstControlCharOffset: NUL at 1", g("a\x00b") === 1);
+  check("firstControlCharOffset: DEL at 2", g("ab\x7fc") === 2);
+  check("firstControlCharOffset: first of multiple", g("ok\x01\x02") === 2);
+  check("firstControlCharOffset: LF found by default", g("a\nb") === 1);
+  check("firstControlCharOffset: LF skipped with allowLf", g("a\nb", { allowLf: true }) === -1);
+  check("firstControlCharOffset: CRLF skipped with allowLf+allowCr",
+        g("a\r\nb", { allowLf: true, allowCr: true }) === -1);
+  check("firstControlCharOffset: CR found when only allowLf", g("a\rb", { allowLf: true }) === 1);
+}
+
+async function run() {
+  testIsForbiddenControlChar();
+  testFirstControlCharOffset();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { console.log("OK"); })
+       .catch(function (e) { console.error(e); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/crypto-base64url.test.js

@@ -2,6 +2,9 @@
 /**
  * b.crypto.toBase64Url + b.crypto.fromBase64Url — RFC 4648 §5
  * base64url encode/decode routed through Node's built-in encoding.
+ * Also covers b.crypto.importPublicJwk — JWK → public KeyObject import —
+ * and b.crypto.makeBase64UrlDecoder — typed-error binding around the strict
+ * fromBase64Url decoder.
  */
 
 var helpers = require("../helpers");
@@ -67,6 +70,64 @@ function testRoundTripWithUrlSafeChars() {
   check("round-trip preserves bytes", dec.equals(buf));
 }
 
+function testImportPublicJwk() {
+  check("importPublicJwk is fn", typeof b.crypto.importPublicJwk === "function");
+
+  // A valid Ed25519 public JWK (RFC 8037 §A.1 example) imports to a KeyObject.
+  var jwk = { kty: "OKP", crv: "Ed25519", x: "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo" };
+  var key = b.crypto.importPublicJwk(jwk, { errorClass: TypeError, code: "x", messagePrefix: "p: " });
+  check("importPublicJwk returns a public KeyObject", key && key.type === "public");
+
+  // A malformed JWK (missing x) throws the bound class with interpolated message.
+  function KeyErr(code, message) { this.code = code; this.message = message; }
+  var threw = null;
+  try {
+    b.crypto.importPublicJwk({ kty: "OKP", crv: "Ed25519" },
+      { errorClass: KeyErr, code: "bad/key", messagePrefix: "import failed: " });
+  } catch (e) { threw = e; }
+  check("importPublicJwk wraps a bad JWK in the bound error class",
+    threw instanceof KeyErr && threw.code === "bad/key" &&
+    threw.message.indexOf("import failed: ") === 0);
+
+  // Without errorClass, the raw Node error propagates unchanged.
+  var rawThrew = null;
+  try { b.crypto.importPublicJwk({ kty: "OKP", crv: "Ed25519" }); }
+  catch (e) { rawThrew = e; }
+  check("importPublicJwk without errorClass rethrows raw",
+    rawThrew !== null && !(rawThrew instanceof KeyErr));
+}
+
+function testMakeBase64UrlDecoder() {
+  check("makeBase64UrlDecoder is fn", typeof b.crypto.makeBase64UrlDecoder === "function");
+  function DErr(code, message) { this.code = code; this.message = message; }
+
+  // With typeMessage: valid decodes; non-string → typeMessage; malformed → badMessage.
+  var decode = b.crypto.makeBase64UrlDecoder({
+    errorClass: DErr, code: "x/bad", typeMessage: "must be a string", badMessage: "not valid base64url",
+  });
+  check("makeBase64UrlDecoder decodes valid base64url",
+    Buffer.isBuffer(decode("aGVsbG8")) && decode("aGVsbG8").toString() === "hello");
+  var t1 = null; try { decode(123); } catch (e) { t1 = e; }
+  check("makeBase64UrlDecoder non-string throws typeMessage",
+    t1 instanceof DErr && t1.code === "x/bad" && t1.message === "must be a string");
+  var t2 = null; try { decode("!!!not-base64!!!"); } catch (e) { t2 = e; }
+  check("makeBase64UrlDecoder malformed throws badMessage",
+    t2 instanceof DErr && t2.code === "x/bad" && t2.message === "not valid base64url");
+
+  // Without typeMessage: a non-string falls into the decode-failure path (badMessage).
+  var decode2 = b.crypto.makeBase64UrlDecoder({ errorClass: DErr, code: "y/bad", badMessage: "bad" });
+  var t3 = null; try { decode2(123); } catch (e) { t3 = e; }
+  check("makeBase64UrlDecoder without typeMessage: non-string → badMessage",
+    t3 instanceof DErr && t3.message === "bad");
+
+  // config-time validation.
+  function r(fn) { try { fn(); return false; } catch (e) { return e instanceof TypeError; } }
+  check("makeBase64UrlDecoder rejects missing errorClass",
+    r(function () { b.crypto.makeBase64UrlDecoder({ code: "x", badMessage: "y" }); }));
+  check("makeBase64UrlDecoder rejects missing badMessage",
+    r(function () { b.crypto.makeBase64UrlDecoder({ errorClass: DErr, code: "x" }); }));
+}
+
 function run() {
   testSurface();
   testRoundTripBuffer();
@@ -76,6 +137,8 @@ function run() {
   testDecodeRefusesBadShape();
   testNoTrailingPadding();
   testRoundTripWithUrlSafeChars();
+  testImportPublicJwk();
+  testMakeBase64UrlDecoder();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/crypto-hash-stream.test.js

@@ -22,7 +22,8 @@ async function run() {
   check("crypto.hashStream is fn", typeof b.crypto.hashStream === "function");
 
   // ---- Default algorithm = sha3-512 → 64-byte digest ----
-  var tmp = path.join(os.tmpdir(), "blamejs-hashfile-" + Date.now() + ".txt");
+  var tmp = path.join(
+    fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-hashfile-")), "payload.txt");
   var payload = "hello blamejs streaming hash";
   fs.writeFileSync(tmp, payload);
 

package/lib/vendor/blamejs/test/layer-0-primitives/csp-builder.test.js

@@ -102,6 +102,54 @@ function testCspErrorClass() {
   check("CspError carries code", e.code === "csp/test");
 }
 
+// b.csp.mergeDirectives / mergePermissionsPolicy — per-route additive merge (#333).
+function _code(fn) { try { fn(); return null; } catch (e) { return e.code || e.message; } }
+
+function testMergeDirectives() {
+  // Deriving from the strict default must NOT re-validate (and thus refuse)
+  // the default's own img-src 'self' data: — only the ADDED sources are gated.
+  var merged = b.csp.mergeDirectives(undefined, {
+    "script-src": ["https://js.stripe.com"], "frame-src": ["https://js.stripe.com"],
+  });
+  check("mergeDirectives derives from DEFAULT_CSP without re-validating the base data:",
+        /img-src[^;]*data:/.test(merged));
+  check("mergeDirectives appends the host to script-src", /script-src[^;]*js\.stripe\.com/.test(merged));
+  check("mergeDirectives appends the host to frame-src", /frame-src[^;]*js\.stripe\.com/.test(merged));
+  check("mergeDirectives leaves frame-ancestors untouched", merged.indexOf("frame-ancestors") !== -1);
+
+  // The merge is additive — a second pass over its own output is idempotent.
+  var twice = b.csp.mergeDirectives(merged, { "script-src": ["https://js.stripe.com"] });
+  check("mergeDirectives de-dupes an already-present source",
+        (twice.match(/js\.stripe\.com/g) || []).length === merged.match(/js\.stripe\.com/g).length);
+
+  // Only the added sources are gated.
+  check("mergeDirectives refuses an unknown directive",
+        _code(function () { b.csp.mergeDirectives(undefined, { "bogus-src": ["x"] }); }) === "csp/unknown-directive");
+  check("mergeDirectives refuses an added catch-all source",
+        _code(function () { b.csp.mergeDirectives(undefined, { "script-src": ["*"] }); }) === "csp/catch-all-source");
+  check("mergeDirectives refuses an added data: without allowDataImages",
+        _code(function () { b.csp.mergeDirectives(undefined, { "img-src": ["data:"] }); }) === "csp/data-source");
+  check("mergeDirectives admits an added data: with allowDataImages",
+        typeof b.csp.mergeDirectives(undefined, { "img-src": ["data:"] }, { allowDataImages: true }) === "string");
+  check("mergeDirectives refuses CR/LF in an added source",
+        _code(function () { b.csp.mergeDirectives(undefined, { "script-src": ["https://x\r\ny"] }); }) === "csp/header-injection");
+  // Prototype-pollution guard — the hostile key must be own-enumerable (JSON).
+  check("mergeDirectives refuses a __proto__ directive name",
+        _code(function () { b.csp.mergeDirectives(undefined, JSON.parse('{"__proto__":["https://x"]}')); }) === "csp/bad-directive-name");
+}
+
+function testMergePermissionsPolicy() {
+  var pp = b.csp.mergePermissionsPolicy(undefined, { payment: '(self "https://js.stripe.com")' });
+  check("mergePermissionsPolicy re-enables the named feature", /payment=\(self "https:\/\/js\.stripe\.com"\)/.test(pp));
+  check("mergePermissionsPolicy leaves other features denied", /camera=\(\)/.test(pp));
+  check("mergePermissionsPolicy refuses a non-RFC-9651 value",
+        _code(function () { b.csp.mergePermissionsPolicy(undefined, { payment: "yes" }); }) === "csp/bad-feature-value");
+  check("mergePermissionsPolicy refuses a comma-bearing value (header injection)",
+        _code(function () { b.csp.mergePermissionsPolicy(undefined, { payment: "(self), camera=*" }); }) === "csp/bad-feature-value");
+  check("mergePermissionsPolicy refuses a __proto__ feature name",
+        _code(function () { b.csp.mergePermissionsPolicy(undefined, JSON.parse('{"__proto__":"(self)"}')); }) === "csp/bad-feature-name");
+}
+
 function run() {
   testDefaultCspRoundTrips();
   testWebrtcDirective();
@@ -113,6 +161,8 @@ function run() {
   testNonce();
   testHash();
   testCspErrorClass();
+  testMergeDirectives();
+  testMergePermissionsPolicy();
 }
 
 if (require.main === module) {

package/lib/vendor/blamejs/test/layer-0-primitives/csp-nonce.test.js

@@ -396,6 +396,6 @@ module.exports = { run: run };
 if (require.main === module) {
   run().then(
     function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
-    function (e) { console.error("FAIL:", e.message); process.exit(1); }
+    function (e) { console.error("FAIL: " + helpers.formatErr(e)); process.exit(1); }
   );
 }

package/lib/vendor/blamejs/test/layer-0-primitives/daemon.test.js

@@ -21,8 +21,9 @@ var check   = helpers.check;
 
 var processSpawn = require("../../lib/process-spawn");
 
+var _tmpBase = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-daemon-test-"));
 function _tmpFile(name) {
-  return path.join(os.tmpdir(), "blamejs-daemon-test-" + Date.now() + "-" +
+  return path.join(_tmpBase, Date.now() + "-" +
     Math.random().toString(36).slice(2, 8) + "-" + name);
 }
 

package/lib/vendor/blamejs/test/layer-0-primitives/defineguard-resolve-opts.test.js

@@ -0,0 +1,76 @@
+"use strict";
+/**
+ * defineGuard resolveOpts — the bound profile/posture resolver every guard
+ * built via gateContract.defineGuard exposes as `<guard>.resolveOpts(opts)`.
+ * Bespoke gates call it instead of hand-rolling the per-guard
+ * `resolveProfileAndPosture(opts, { profiles, postures, defaults, errorClass,
+ * errCodePrefix })` binding. This proves the generated resolver applies the
+ * named profile, applies the compliance posture, and is idempotent over an
+ * already-resolved opts (the property the gate relies on when it re-resolves).
+ */
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+// One representative per defineGuard-built guard that exposes resolveOpts.
+// Referencing the qualified name keeps each in the coverage census.
+var GUARDS = [
+  ["guardCsv",      b.guardCsv.resolveOpts],
+  ["guardHtml",     b.guardHtml.resolveOpts],
+  ["guardSvg",      b.guardSvg.resolveOpts],
+  ["guardXml",      b.guardXml.resolveOpts],
+  ["guardJson",     b.guardJson.resolveOpts],
+  ["guardYaml",     b.guardYaml.resolveOpts],
+  ["guardMarkdown", b.guardMarkdown.resolveOpts],
+  ["guardFilename", b.guardFilename.resolveOpts],
+  ["guardSql",      b.guardSql.resolveOpts],
+  ["guardEmail",    b.guardEmail.resolveOpts],
+  ["guardText",     b.guardText.resolveOpts],
+  ["guardImage",    b.guardImage.resolveOpts],
+  ["guardPdf",      b.guardPdf.resolveOpts],
+];
+
+function testResolveOptsSurface() {
+  GUARDS.forEach(function (pair) {
+    check(pair[0] + ".resolveOpts is a function", typeof pair[1] === "function");
+  });
+}
+
+function testResolveOptsAppliesProfile() {
+  GUARDS.forEach(function (pair) {
+    var resolved = pair[1]({ profile: "strict" });
+    check(pair[0] + ".resolveOpts returns an opts object", resolved && typeof resolved === "object");
+    check(pair[0] + ".resolveOpts records the named profile", resolved.profile === "strict");
+  });
+}
+
+function testResolveOptsIdempotent() {
+  // The bespoke gates re-resolve an already-resolved opts; resolveOpts must be
+  // a fixpoint so the second pass does not throw or drift.
+  GUARDS.forEach(function (pair) {
+    var once  = pair[1]({ profile: "strict" });
+    var twice = pair[1](once);
+    check(pair[0] + ".resolveOpts is idempotent (profile stable)", twice.profile === once.profile);
+  });
+}
+
+function testResolveOptsAppliesPosture() {
+  // A compliance posture overlays its caps; resolveOpts must surface it.
+  var resolved = b.guardCsv.resolveOpts({ compliancePosture: "hipaa" });
+  check("guardCsv.resolveOpts applies a compliance posture", resolved && typeof resolved === "object");
+}
+
+function run() {
+  testResolveOptsSurface();
+  testResolveOptsAppliesProfile();
+  testResolveOptsIdempotent();
+  testResolveOptsAppliesPosture();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  try { run(); console.log("[defineguard-resolve-opts] OK — " + helpers.getChecks() + " checks passed"); }
+  catch (e) { console.error("FAIL:", e.stack || e); process.exit(1); }
+}

package/lib/vendor/blamejs/test/layer-0-primitives/flag.test.js

@@ -126,6 +126,15 @@ function run() {
   check("context.merge: keeps base",             merged.targetingKey === "user-42");
   check("context.merge: adds overlay",           merged.tier === "gold");
 
+  // An own poisoned key (constructor / __proto__ / prototype) on a merge source
+  // is skipped — the merge routes through validateOpts.assignOwnEnumerable, a
+  // prototype-pollution defense the prior hand-rolled own-key copy lacked.
+  var poison = {};
+  Object.defineProperty(poison, "constructor", { value: "EVIL", enumerable: true, configurable: true });
+  var safeMerged = b.flag.context.merge({ targetingKey: "u" }, poison);
+  check("context.merge: skips an own poisoned 'constructor' key",
+        safeMerged.constructor !== "EVIL" && safeMerged.targetingKey === "u");
+
   // bucketOf is deterministic
   var b1 = b.flag.context.bucketOf("user-42", "test-flag");
   var b2 = b.flag.context.bucketOf("user-42", "test-flag");

package/lib/vendor/blamejs/test/layer-0-primitives/gate-contract-content-gate.test.js

@@ -0,0 +1,290 @@
+"use strict";
+/**
+ * b.gateContract.buildContentGate — the content-guard gate action-chain
+ * (serve / audit-only / sanitize / refuse) every content guard composes.
+ *
+ * The disposition of each finding is what the operator's POLICY for that class
+ * selected, NOT the finding's impact severity:
+ *   reject → refuse · a mitigation (strip / prefix / redact) → sanitize ·
+ *   audit → audit-only.
+ * The guard declares the binding via spec.dispositionFor(issue, opts), routed
+ * through b.gateContract.policyDisposition / b.gateContract.charThreatDisposition. `refuse`
+ * wins over `sanitize` wins over `audit-only`. Operator-injected extraIssues
+ * carry no guard sanitizer, so a refusal-severity hit can only refuse. There is
+ * NO re-validation: a sanitize-disposition finding runs the guard's sanitizer
+ * and the output is served (a mitigation may be in-place, not removal, so a
+ * second detector pass would wrongly refuse it); a sanitizer that throws falls
+ * through to refuse.
+ */
+
+var helpers = require("../helpers");
+var check   = helpers.check;
+var gc      = require("../../lib/gate-contract");
+
+// Synthetic content guard. Each marker token emits a finding; the governing
+// "policy" is operator-set via opts.cfgPolicy, so the SAME finding refuses /
+// sanitizes / audits purely by policy — proving disposition is read from policy
+// and not from the (here deliberately critical) severity.
+//   "CFG"  → configurable (governed by opts.cfgPolicy)
+//   "DENY" → always-dangerous denylist (always refuse)
+//   "OBS"  → observational (always audit)
+function _validate(input) {
+  var text = Buffer.isBuffer(input) ? input.toString("utf8") : input;
+  var issues = [];
+  if (text.indexOf("CFG")  !== -1) issues.push({ kind: "configurable", severity: "critical", ruleId: "x.cfg" });
+  if (text.indexOf("DENY") !== -1) issues.push({ kind: "denylisted",   severity: "critical", ruleId: "x.deny" });
+  if (text.indexOf("OBS")  !== -1) issues.push({ kind: "observe",      severity: "warn",     ruleId: "x.obs" });
+  return { ok: issues.length === 0, issues: issues };
+}
+function _dispositionFor(issue, opts) {
+  switch (issue.kind) {
+    case "configurable": return gc.policyDisposition(opts.cfgPolicy);
+    case "denylisted":   return "refuse";
+    case "observe":      return "audit";
+    default:             return null;
+  }
+}
+// The sanitizer removes the "CFG" marker (the only mitigable class).
+function _produceSanitized(input) {
+  var text = Buffer.isBuffer(input) ? input.toString("utf8") : input;
+  return text.split("CFG").join("");
+}
+
+function _gate(opts, extra) {
+  return gc.buildContentGate(Object.assign({
+    name:             "synthetic:test",
+    opts:             opts,
+    validate:         _validate,
+    dispositionFor:   _dispositionFor,
+    produceSanitized: function (t) { return _produceSanitized(t); },
+  }, extra || {}));
+}
+
+async function run() {
+  function act(gate, text) {
+    return gate.check({ bytes: Buffer.from(text, "utf8") }).then(function (d) { return d.action; });
+  }
+
+  var strip  = _gate({ cfgPolicy: "strip" });
+  var reject = _gate({ cfgPolicy: "reject" });
+  var audit  = _gate({ cfgPolicy: "audit" });
+
+  check("clean input → serve",                         (await act(strip, "hello world")) === "serve");
+  check("observational-only → audit-only",             (await act(strip, "a OBS b")) === "audit-only");
+  check("denylist finding → refuse (always)",          (await act(strip, "x DENY y")) === "refuse");
+
+  // The SAME configurable finding, three policies — disposition follows policy.
+  check("configurable under strip-policy → sanitize",  (await act(strip,  "a CFG b")) === "sanitize");
+  check("configurable under reject-policy → refuse",   (await act(reject, "a CFG b")) === "refuse");
+  check("configurable under audit-policy → audit-only",(await act(audit,  "a CFG b")) === "audit-only");
+
+  // Precedence: refuse > sanitize > audit.
+  check("denylist beside a sanitizable finding → refuse",
+                                                       (await act(strip, "CFG DENY")) === "refuse");
+  check("sanitizable beside an observational finding → sanitize",
+                                                       (await act(strip, "CFG OBS")) === "sanitize");
+
+  // The sanitize output is the repaired bytes (the CFG marker removed).
+  var d = await strip.check({ bytes: Buffer.from("keep CFG keep", "utf8") });
+  check("sanitize: output is a Buffer with the finding removed",
+        d.action === "sanitize" && Buffer.isBuffer(d.sanitized) &&
+        d.sanitized.toString("utf8").indexOf("CFG") === -1 &&
+        d.sanitized.toString("utf8").indexOf("keep") !== -1);
+
+  // No produceSanitized → a sanitize-disposition finding cannot be repaired → refuse.
+  var noSan = gc.buildContentGate({ name: "n", opts: { cfgPolicy: "strip" },
+    validate: _validate, dispositionFor: _dispositionFor });
+  check("no produceSanitized: sanitizable finding → refuse",
+        (await noSan.check({ bytes: Buffer.from("CFG", "utf8") })).action === "refuse");
+
+  // A sanitizer that throws falls through to refuse.
+  var throws = _gate({ cfgPolicy: "strip" }, { produceSanitized: function () { throw new Error("boom"); } });
+  check("sanitizer throws → refuse",
+        (await throws.check({ bytes: Buffer.from("CFG", "utf8") })).action === "refuse");
+
+  // sanitizeBlockingKinds: skip the attempt for a class the sanitizer must not touch.
+  var blocked = _gate({ cfgPolicy: "strip" }, { sanitizeBlockingKinds: ["configurable"] });
+  check("blocking-kind present → refuse without sanitize attempt",
+        (await blocked.check({ bytes: Buffer.from("CFG", "utf8") })).action === "refuse");
+
+  // extraIssues: operator-injected detect-only findings refuse on a high hit
+  // (the guard owns no sanitizer for them) regardless of the guard's own policy.
+  var withExtra = _gate({ cfgPolicy: "strip" }, {
+    extraIssues: function (subject) {
+      var text = Buffer.isBuffer(subject) ? subject.toString("utf8") : subject;
+      return text.indexOf("RULE") !== -1
+        ? [{ kind: "operator.rule", severity: "high", ruleId: "operator.rule" }] : [];
+    },
+  });
+  check("extraIssues high hit → refuse (no guard sanitizer for it)",
+        (await withExtra.check({ bytes: Buffer.from("RULE", "utf8") })).action === "refuse");
+  check("extraIssues with no hit → still serve",
+        (await withExtra.check({ bytes: Buffer.from("clean", "utf8") })).action === "serve");
+
+  // ctxField:"bytes" reads ctx.bytes raw (no utf8 round-trip in the contract).
+  var bytesGate = _gate({ cfgPolicy: "strip" }, { ctxField: "bytes" });
+  check("ctxField bytes: still drives the chain",
+        (await bytesGate.check({ bytes: Buffer.from("a CFG b", "utf8") })).action === "sanitize");
+
+  // policyDisposition unit.
+  check("policyDisposition reject → refuse",     gc.policyDisposition("reject") === "refuse");
+  check("policyDisposition strip → sanitize",    gc.policyDisposition("strip") === "sanitize");
+  check("policyDisposition prefix-tab → sanitize", gc.policyDisposition("prefix-tab") === "sanitize");
+  check("policyDisposition audit → audit",       gc.policyDisposition("audit") === "audit");
+  check("policyDisposition audit-only → audit",  gc.policyDisposition("audit-only") === "audit");
+
+  // severityDisposition unit: the non-sanitizing gate's serve/audit-only/refuse chain.
+  check("severityDisposition no issues → serve",
+        JSON.stringify(gc.severityDisposition([])) === JSON.stringify({ ok: true, action: "serve" }));
+  check("severityDisposition low/medium only → audit-only",
+        gc.severityDisposition([{ severity: "low" }, { severity: "medium" }]).action === "audit-only");
+  check("severityDisposition any high → refuse",
+        gc.severityDisposition([{ severity: "low" }, { severity: "high" }]).ok === false &&
+        gc.severityDisposition([{ severity: "high" }]).action === "refuse");
+  check("severityDisposition any critical → refuse",
+        gc.severityDisposition([{ severity: "critical" }]).action === "refuse");
+  check("severityDisposition carries issues on audit-only/refuse, omits on serve",
+        gc.severityDisposition([{ severity: "low" }]).issues.length === 1 &&
+        gc.severityDisposition([]).issues === undefined);
+
+  // charThreatDisposition unit: shared bidi/null/control read their policies.
+  check("charThreatDisposition bidi under strip → sanitize",
+        gc.charThreatDisposition({ kind: "bidi-override" }, { bidiPolicy: "strip" }) === "sanitize");
+  check("charThreatDisposition null under reject → refuse",
+        gc.charThreatDisposition({ kind: "null-byte" }, { nullBytePolicy: "reject" }) === "refuse");
+  check("charThreatDisposition unrelated kind → null",
+        gc.charThreatDisposition({ kind: "configurable" }, {}) === null);
+
+  // compliancePostures unit: the four-posture regulation-disposition policy.
+  // hipaa/pci-dss/soc2 → strict tier, gdpr → balanced tier; snippet base / ÷2 / ×2.
+  var PROFILES = {
+    strict:   { bidiPolicy: "reject", maxBytes: 1000 },
+    balanced: { bidiPolicy: "strip",  maxBytes: 2000 },
+  };
+  var cp = gc.compliancePostures(PROFILES, { base: 256 });
+  check("compliancePostures hipaa/pci/soc2 use the strict tier",
+        cp.hipaa.bidiPolicy === "reject" && cp["pci-dss"].bidiPolicy === "reject" && cp.soc2.bidiPolicy === "reject");
+  check("compliancePostures gdpr uses the balanced tier (data-minimization strips)",
+        cp.gdpr.bidiPolicy === "strip" && cp.gdpr.maxBytes === 2000);
+  check("compliancePostures snippet budget scales base / ÷2 / ×2",
+        cp.hipaa.forensicSnippetBytes === 256 && cp["pci-dss"].forensicSnippetBytes === 256 &&
+        cp.gdpr.forensicSnippetBytes === 128 && cp.soc2.forensicSnippetBytes === 512);
+  check("compliancePostures every posture is frozen", Object.isFrozen(cp) && Object.isFrozen(cp.gdpr));
+  var cpOv = gc.compliancePostures(PROFILES, { base: 256, overlays: { gdpr: { bidiPolicy: "audit" } } });
+  check("compliancePostures overlay merges last (per-posture intended delta)",
+        cpOv.gdpr.bidiPolicy === "audit" && cpOv.gdpr.maxBytes === 2000);
+  var threwBase = null;
+  try { gc.compliancePostures(PROFILES, { base: 7 }); } catch (e) { threwBase = e; }
+  check("compliancePostures throws on a non-even base (config-time)", threwBase !== null);
+  var threwProf = null;
+  try { gc.compliancePostures({ strict: {} }, { base: 256 }); } catch (e) { threwProf = e; }
+  check("compliancePostures throws when profiles lack strict+balanced", threwProf !== null);
+
+  // strictDefaults unit: strict profile + enforce mode + overlay.
+  var sd = gc.strictDefaults({ strict: { bidiPolicy: "reject", maxBytes: 100 } });
+  check("strictDefaults = strict profile + mode:enforce",
+        sd.bidiPolicy === "reject" && sd.maxBytes === 100 && sd.mode === "enforce" && Object.isFrozen(sd));
+  var sdo = gc.strictDefaults({ strict: { bidiPolicy: "reject" } }, { maxRuntimeMs: 9000 });
+  check("strictDefaults overlay merges last", sdo.maxRuntimeMs === 9000 && sdo.mode === "enforce");
+  check("strictDefaults overlay may override mode",
+        gc.strictDefaults({ strict: {} }, { mode: "audit" }).mode === "audit");
+  var sdThrew = null;
+  try { gc.strictDefaults({ balanced: {} }); } catch (e) { sdThrew = e; }
+  check("strictDefaults throws when profiles lack strict", sdThrew !== null);
+
+  // detectStringInput unit: the whole string-detector preamble → { done, issues }.
+  var dsiBad = gc.detectStringInput(12345, {}, { name: "cidr" });
+  check("detectStringInput non-string → done + typed bad-input issue",
+        dsiBad.done === true && dsiBad.issues[0].kind === "bad-input" &&
+        dsiBad.issues[0].ruleId === "cidr.bad-input" && dsiBad.issues[0].snippet === "cidr is not a string");
+  var dsiEmpty = gc.detectStringInput("", {}, { name: "cidr" });
+  check("detectStringInput empty (issue mode) → done + <name>.empty issue",
+        dsiEmpty.done === true && dsiEmpty.issues[0].kind === "empty" &&
+        dsiEmpty.issues[0].ruleId === "cidr.empty" && dsiEmpty.issues[0].snippet === "cidr is empty");
+  var dsiOk = gc.detectStringInput("", {}, { name: "shell", emptyMode: "ok" });
+  check("detectStringInput emptyMode 'ok' → done + [] (empty is legal)",
+        dsiOk.done === true && JSON.stringify(dsiOk.issues) === "[]");
+  check("detectStringInput emptyMode 'skip' → not done on empty (detector owns empty)",
+        gc.detectStringInput("", {}, { name: "domain", emptyMode: "skip" }).done === false);
+  var dsiCap = gc.detectStringInput("aaaa", {}, { name: "cidr", cap: { bytes: 2 } });
+  check("detectStringInput over byte cap → done + default <name>-cap issue",
+        dsiCap.done === true && dsiCap.issues[0].kind === "cidr-cap" &&
+        dsiCap.issues[0].ruleId === "cidr.cidr-cap" && dsiCap.issues[0].snippet === "cidr input exceeds maxBytes 2");
+  var dsiCapOv = gc.detectStringInput("aaaa", {}, { name: "jsonpath", cap: { bytes: 2, kind: "pattern-cap", snippet: "jsonpath exceeds maxPatternBytes 2" } });
+  check("detectStringInput cap.kind + cap.snippet override",
+        dsiCapOv.issues[0].kind === "pattern-cap" && dsiCapOv.issues[0].ruleId === "jsonpath.pattern-cap" &&
+        dsiCapOv.issues[0].snippet === "jsonpath exceeds maxPatternBytes 2");
+  check("detectStringInput cap.snippet function receives (byteLen, bytes)",
+        gc.detectStringInput("aaaa", {}, { name: "domain", cap: { bytes: 2, snippet: function (n, m) { return "domain " + n + " octets exceeds " + m; } } }).issues[0].snippet === "domain 4 octets exceeds 2");
+  var dsiCont = gc.detectStringInput("hello", {}, { name: "cidr" });
+  check("detectStringInput non-empty under cap → not done + codepoint-threat array",
+        dsiCont.done === false && Array.isArray(dsiCont.issues));
+  check("detectStringInput scanCodepoints:false → not done + [] (guard scans later / parses its own)",
+        (function () { var r = gc.detectStringInput("hello", {}, { name: "json", scanCodepoints: false }); return r.done === false && JSON.stringify(r.issues) === "[]"; })());
+  check("detectStringInput cap measures BYTES not chars (multibyte over byte cap caps)",
+        gc.detectStringInput("é", {}, { name: "x", cap: { bytes: 1 } }).done === true &&
+        gc.detectStringInput("é", {}, { name: "x", cap: { bytes: 1 } }).issues[0].kind === "x-cap");
+  check("detectStringInput noun overrides the bad-input subject",
+        gc.detectStringInput(1, {}, { name: "regex", noun: "regex pattern" }).issues[0].snippet === "regex pattern is not a string");
+  var dsiThrew = null;
+  try { gc.detectStringInput("x", {}, {}); } catch (e) { dsiThrew = e; }
+  check("detectStringInput throws on missing cfg.name (config-time)", dsiThrew !== null);
+
+  // ---- identifierFixtures: an identifier guard's INTEGRATION_FIXTURES from
+  //      one benign + one hostile sample (byte forms derived, not re-typed).
+  var idfx = gc.identifierFixtures("example.com", "192.168.1.1");
+  check("identifierFixtures kind is identifier", idfx.kind === "identifier");
+  check("identifierFixtures keeps the benign/hostile identifier strings",
+        idfx.benignIdentifier === "example.com" && idfx.hostileIdentifier === "192.168.1.1");
+  check("identifierFixtures derives byte forms as utf8 Buffers",
+        Buffer.isBuffer(idfx.benignBytes) && idfx.benignBytes.equals(Buffer.from("example.com", "utf8")) &&
+        Buffer.isBuffer(idfx.hostileBytes) && idfx.hostileBytes.equals(Buffer.from("192.168.1.1", "utf8")));
+  check("identifierFixtures result is frozen", Object.isFrozen(idfx));
+  var idfxAscii = gc.identifierFixtures("EHLO x", "A\r\n.\r\nB", "ascii");
+  check("identifierFixtures encoding param drives the byte form (ascii)",
+        idfxAscii.benignBytes.equals(Buffer.from("EHLO x", "ascii")) &&
+        idfxAscii.hostileBytes.equals(Buffer.from("A\r\n.\r\nB", "ascii")));
+  var idfxThrew = function (fn) { try { fn(); return false; } catch (_e) { return true; } };
+  check("identifierFixtures throws on empty benign (config-time)",
+        idfxThrew(function () { gc.identifierFixtures("", "h"); }));
+  check("identifierFixtures throws on non-string hostile (config-time)",
+        idfxThrew(function () { gc.identifierFixtures("b", 5); }));
+  check("identifierFixtures throws on unknown encoding (config-time)",
+        idfxThrew(function () { gc.identifierFixtures("b", "h", "utf-99"); }));
+
+  // ---- markup URL-scheme constants (shared by guard-html / guard-svg).
+  check("DANGEROUS_URL_SCHEMES denies the script + dangerous-resource schemes",
+        gc.DANGEROUS_URL_SCHEMES.indexOf("javascript") !== -1 &&
+        gc.DANGEROUS_URL_SCHEMES.indexOf("ecmascript") !== -1 &&
+        gc.DANGEROUS_URL_SCHEMES.indexOf("data") !== -1 &&
+        gc.DANGEROUS_URL_SCHEMES.indexOf("file") !== -1);
+  check("DANGEROUS_URL_SCHEMES does not contain a safe scheme",
+        gc.DANGEROUS_URL_SCHEMES.indexOf("https") === -1 &&
+        gc.DANGEROUS_URL_SCHEMES.indexOf("mailto") === -1);
+  check("DANGEROUS_URL_SCHEMES is frozen", Object.isFrozen(gc.DANGEROUS_URL_SCHEMES));
+  check("SAFE_URL_SCHEMES is the strict allowlist base [http, https, mailto, tel]",
+        JSON.stringify(gc.SAFE_URL_SCHEMES) === JSON.stringify(["http", "https", "mailto", "tel"]) &&
+        Object.isFrozen(gc.SAFE_URL_SCHEMES));
+  check("SAFE and DANGEROUS scheme sets are disjoint",
+        gc.SAFE_URL_SCHEMES.every(function (s) { return gc.DANGEROUS_URL_SCHEMES.indexOf(s) === -1; }));
+
+  // ---- resolveProfileName: profile-precedence name resolution, no throw.
+  var POST = { hipaa: "strict", gdpr: "balanced" };
+  check("resolveProfileName: explicit profile wins",
+        gc.resolveProfileName({ profile: "permissive", posture: "hipaa" }, POST, "strict") === "permissive");
+  check("resolveProfileName: posture maps to its tier when no profile",
+        gc.resolveProfileName({ posture: "gdpr" }, POST, "strict") === "balanced");
+  check("resolveProfileName: falls back to the default",
+        gc.resolveProfileName({}, POST, "strict") === "strict");
+  check("resolveProfileName: does not validate (returns an unknown name unchanged)",
+        gc.resolveProfileName({ profile: "bogus" }, POST, "strict") === "bogus");
+  check("resolveProfileName: tolerates null opts",
+        gc.resolveProfileName(null, POST, "strict") === "strict");
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(function () { console.log("[gate-contract-content-gate] OK — " + helpers.getChecks() + " checks passed"); })
+       .catch(function (e) { console.error("FAIL:", e.stack || e); process.exit(1); });
+}