@blamejs/blamejs-shop 0.4.56 → 0.4.57

package/lib/vendor/blamejs/lib/guard-domain.js

@@ -56,8 +56,8 @@
 var codepointClass = require("./codepoint-class");
 var lazyRequire = require("./lazy-require");
 var gateContract = require("./gate-contract");
+var ipUtils = require("./ip-utils");
 var C = require("./constants");
-var numericBounds = require("./numeric-bounds");
 var { GuardDomainError } = require("./framework-error");
 
 var observability = lazyRequire(function () { return require("./observability"); });
@@ -88,9 +88,6 @@ var BARE_XN_RE = /^xn--$/i;
 // Wildcard label — `*` alone in any label position.
 var WILDCARD_LABEL_RE = /^\*$/;
 
-// IPv4 decimal-dotted form.
-var IPV4_DOTTED_RE = /^(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(?:\.(?:25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])){3}$/;
-
 // Looser IPv4 detection — every dot-segment is a numeric form
 // (decimal, octal with leading 0, or hex with 0x prefix), or the whole
 // input is a long-decimal / long-hex (no dots). Catches the parser-
@@ -178,10 +175,7 @@ function _shannonEntropy(s) {
 
 var PROFILES = Object.freeze({
   "strict": {
-    bidiPolicy:           "reject",
-    controlPolicy:        "reject",
-    nullBytePolicy:       "reject",
-    zeroWidthPolicy:      "reject",
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     ldhPolicy:            "reject",
     underscorePolicy:     "reject",                                              // strict refuses service labels too
     punycodePolicy:       "reject",
@@ -201,10 +195,7 @@ var PROFILES = Object.freeze({
     maxRuntimeMs:         C.TIME.seconds(2),
   },
   "balanced": {
-    bidiPolicy:           "reject",
-    controlPolicy:        "reject",
-    nullBytePolicy:       "reject",
-    zeroWidthPolicy:      "reject",
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     ldhPolicy:            "reject",
     underscorePolicy:     "reject",
     punycodePolicy:       "audit",
@@ -225,10 +216,7 @@ var PROFILES = Object.freeze({
     maxRuntimeMs:         C.TIME.seconds(2),
   },
   "permissive": {
-    bidiPolicy:           "reject",                                              // BIDI refused at every profile — universal forgery
-    controlPolicy:        "reject",                                              // control bytes refused at every profile
-    nullBytePolicy:       "reject",                                              // null refused at every profile
-    zeroWidthPolicy:      "reject",                                              // zero-width refused at every profile — invisible label-segmentation
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     ldhPolicy:            "audit",
     underscorePolicy:     "allow",                                               // service labels permitted in permissive
     punycodePolicy:       "allow",
@@ -249,62 +237,12 @@ var PROFILES = Object.freeze({
   },
 });
 
-var DEFAULTS = Object.freeze(Object.assign({}, PROFILES["strict"], {
-  mode: "enforce",
-}));
-
-var COMPLIANCE_POSTURES = Object.freeze({
-  "hipaa":   Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-  "pci-dss": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-  "gdpr":    Object.assign({}, PROFILES["balanced"], {
-    forensicSnippetBytes: C.BYTES.bytes(128),
-  }),
-  "soc2":    Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(512),
-  }),
-});
-
-function _resolveOpts(opts) {
-  return gateContract.resolveProfileAndPosture(opts, {
-    profiles:           PROFILES,
-    compliancePostures: COMPLIANCE_POSTURES,
-    defaults:           DEFAULTS,
-    errorClass:         GuardDomainError,
-    errCodePrefix:      "domain",
-  });
-}
-
 // ---- Detection ----
 
 function _detectIssues(input, opts) {
-  var issues = [];
-  if (typeof input !== "string") {
-    return [{ kind: "bad-input", severity: "high",
-              ruleId: "domain.bad-input",
-              snippet: "domain is not a string" }];
-  }
-
-  // Total-length cap (UTF-8 byte count, not codepoint count, per RFC 1035).
-  var byteLen = Buffer.byteLength(input, "utf8");
-  if (byteLen > opts.maxDomainOctets) {
-    issues.push({
-      kind: "domain-cap", severity: "high",
-      ruleId: "domain.domain-cap",
-      snippet: "domain " + byteLen + " octets exceeds " +
-               opts.maxDomainOctets + " (RFC 1035 §2.3.4)",
-    });
-    return issues;                                                               // size cap is structural — abort further checks
-  }
-
-  // Codepoint-class threats (BIDI / control / null / zero-width). These
-  // are universal-refuse — running them first lets the more specific
-  // structural checks operate on a sanitized-or-refused input.
-  var charThreats = codepointClass.detectCharThreats(input, opts, "domain");
-  for (var ci = 0; ci < charThreats.length; ci += 1) issues.push(charThreats[ci]);
+  var pre = gateContract.detectStringInput(input, opts, { name: "domain", emptyMode: "skip", cap: { bytes: opts.maxDomainOctets, snippet: function (byteLen, max) { return "domain " + byteLen + " octets exceeds " + max + " (RFC 1035 §2.3.4)"; } } });
+  if (pre.done) return pre.issues;
+  var issues = pre.issues;
 
   // Trailing-dot — FQDN distinguisher. Normalize for downstream checks
   // but record as audit if operator wants to know.
@@ -336,7 +274,7 @@ function _detectIssues(input, opts) {
   }
 
   // IPv4 detection — strict dotted-decimal AND loose (octal/hex/long).
-  if (IPV4_DOTTED_RE.test(name) || _looksLikeIpv4Permissive(name)) {
+  if (ipUtils.IPV4_RE.test(name) || _looksLikeIpv4Permissive(name)) {
     if (opts.ipLiteralPolicy !== "allow") {
       issues.push({
         kind: "ipv4-as-domain",
@@ -601,21 +539,10 @@ function _detectIssues(input, opts) {
  *   var ok = b.guardDomain.validate("example.com", { profile: "strict" });
  *   ok.ok;                                             // → true
  */
-function validate(input, opts) {
-  opts = _resolveOpts(opts);
-  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
-    ["maxLabelOctets", "maxDomainOctets", "maxBytes", "dgaMinLabelLen"],
-    "guardDomain.validate", GuardDomainError, "domain.bad-opt");
-  if (typeof input !== "string") {
-    return {
-      ok: false,
-      issues: [{ kind: "bad-input", severity: "high",
-                 ruleId: "domain.bad-input",
-                 snippet: "domain is not a string" }],
-    };
-  }
-  return gateContract.aggregateIssues(_detectIssues(input, opts));
-}
+// validate is assembled by gateContract.defineGuard from `detect`
+// (_detectIssues) below — `validate(input, opts) = aggregateIssues(detect(
+// input, resolveOpts(opts)))`, with the length/byte caps declared via
+// `intOpts`. The @primitive block above documents the resulting public ABI.
 
 /**
  * @primitive  b.guardDomain.sanitize
@@ -641,14 +568,10 @@ function validate(input, opts) {
  *   var safe = b.guardDomain.sanitize("Example.Com.", { profile: "balanced" });
  *   safe;                                              // → "example.com"
  */
-function sanitize(input, opts) {
-  opts = _resolveOpts(opts);
-  if (typeof input !== "string") {
-    throw _err("domain.bad-input", "sanitize requires string input");
-  }
-  // Critical refuses can't be repaired.
-  var issues = _detectIssues(input, opts);
-  gateContract.throwOnRefusalSeverity(issues, { errorClass: GuardDomainError, codePrefix: "domain" });
+// _sanitizeTransform — the guard-specific normalize applied by defineGuard's
+// generated sanitize AFTER resolve → detect → throw-on-refusal. Input is an
+// already-validated string at this point (a non-string refuses upstream).
+function _sanitizeTransform(input) {
   // Safe transforms: lowercase ASCII, strip trailing dot.
   var out = input.toLowerCase();
   if (out.charAt(out.length - 1) === ".") out = out.slice(0, -1);
@@ -660,15 +583,9 @@ function sanitize(input, opts) {
 // single-sourced @abiTemplate (defineGuard) blocks in gate-contract.js,
 // instantiated per guard by the page generator.
 
-var INTEGRATION_FIXTURES = Object.freeze({
-  kind:        "identifier",
-  benignBytes: Buffer.from("example.com", "utf8"),
-  // Hostile: dotted-decimal IPv4 (CVE-2021-22931 class) — every
-  // profile refuses (allowlist-bypass via DNS rebinding).
-  hostileBytes: Buffer.from("192.168.1.1", "utf8"),
-  benignIdentifier:  "example.com",
-  hostileIdentifier: "192.168.1.1",
-});
+// Hostile: dotted-decimal IPv4 (CVE-2021-22931 class) — every profile
+// refuses (allowlist-bypass via DNS rebinding).
+var INTEGRATION_FIXTURES = gateContract.identifierFixtures("example.com", "192.168.1.1");
 
 // Assembled from the gate-contract guard factory: error class, registry
 // exports (NAME / KIND / INTEGRATION_FIXTURES), buildProfile /
@@ -682,10 +599,10 @@ module.exports = gateContract.defineGuard({
   kind:        "identifier",
   errorClass:  GuardDomainError,
   profiles:    PROFILES,
-  defaults:    DEFAULTS,
-  postures:    COMPLIANCE_POSTURES,
+  base:        256,
   integrationFixtures: INTEGRATION_FIXTURES,
-  validate:    validate,
-  sanitize:    sanitize,
+  detect:           _detectIssues,
+  sanitizeTransform: _sanitizeTransform,
+  intOpts:          ["maxLabelOctets", "maxDomainOctets", "maxBytes", "dgaMinLabelLen"],
   ctxFields:   ["identifier", "domain"],
 });

package/lib/vendor/blamejs/lib/guard-dsn.js

@@ -100,8 +100,11 @@
  */
 
 var C                  = require("./constants");
+var safeBuffer         = require("./safe-buffer");
 var { defineClass }    = require("./framework-error");
 var gateContract       = require("./gate-contract");
+var codepointClass     = require("./codepoint-class");
+var structuredFields   = require("./structured-fields");
 
 var GuardDsnError = defineClass("GuardDsnError", { alwaysPermanent: true });
 
@@ -168,7 +171,7 @@ function parse(deliveryStatusBody, opts) {
     throw new GuardDsnError("guard-dsn/bad-input",
       "parse: deliveryStatusBody must be a Buffer or string");
   }
-  if (bytes.length > caps.maxBytes) {
+  if (safeBuffer.byteLengthOf(bytes) > caps.maxBytes) {
     throw new GuardDsnError("guard-dsn/oversize-body",
       "parse: body " + bytes.length + " bytes exceeds maxBytes=" + caps.maxBytes);
   }
@@ -295,8 +298,9 @@ function _parseFieldBlock(block, maxHeaderLine) {
       throw new GuardDsnError("guard-dsn/malformed-field",
         "parse: line '" + raw + "' missing ':' field-name terminator");
     }
-    var name = raw.slice(0, colon).trim().toLowerCase();
-    var value = raw.slice(colon + 1).trim();
+    var dkv = structuredFields.parseKeyValuePiece(raw, ":");
+    var name = dkv.key;
+    var value = dkv.value.trim();
     if (name.length === 0) {
       throw new GuardDsnError("guard-dsn/malformed-field",
         "parse: empty field name on line '" + raw + "'");
@@ -312,12 +316,12 @@ function _checkControlChars(line) {
   // continuation), DEL. Bare CR and LF can't appear because we
   // already split on \n; this catches forms that survive the
   // split (e.g. backslash + literal sequence).
-  for (var i = 0; i < line.length; i += 1) {
-    var c = line.charCodeAt(i);
-    if (c === 0x00 || c === 0x7f || (c < 0x20 && c !== 0x09)) {                                          // RFC 5322 control char + TAB allow
-      throw new GuardDsnError("guard-dsn/control-char",
-        "parse: control char 0x" + c.toString(16) + " in field line refused (header-injection defense)");
-    }
+  // Refuse NUL / C0 (except TAB) / DEL — CR & LF already removed by the
+  // upstream split, so they are forbidden here (header-injection defense).
+  var ctrlAt = codepointClass.firstControlCharOffset(line);
+  if (ctrlAt !== -1) {
+    throw new GuardDsnError("guard-dsn/control-char",
+      "parse: control char 0x" + line.charCodeAt(ctrlAt).toString(16) + " in field line refused (header-injection defense)");
   }
 }
 
@@ -325,10 +329,9 @@ function _stripRecipientType(value) {
   // RFC 3464 §2.3.2: "rfc822;alice@example.com" — type prefix
   // before semicolon classifies the address. Strip for the common
   // case of rfc822, surface the raw value otherwise.
-  var semi = value.indexOf(";");
-  if (semi === -1) return value;
-  var type = value.slice(0, semi).trim().toLowerCase();
-  if (type === "rfc822") return value.slice(semi + 1).trim();
+  var skv = structuredFields.parseKeyValuePiece(value, ";");
+  if (skv.value === null) return value;
+  if (skv.key === "rfc822") return skv.value.trim();
   return value;
 }
 

package/lib/vendor/blamejs/lib/guard-email.js

@@ -51,6 +51,7 @@
  */
 
 var codepointClass = require("./codepoint-class");
+var mimeParse = require("./mime-parse");
 var lazyRequire = require("./lazy-require");
 var gateContract = require("./gate-contract");
 var C = require("./constants");
@@ -215,10 +216,7 @@ var PROFILES = Object.freeze({
     mixedScriptPolicy:            "reject",
     displayNameSpoofPolicy:       "reject",
     bomPolicy:                    "reject",
-    bidiPolicy:                   "reject",
-    controlPolicy:                "reject",
-    nullBytePolicy:               "reject",
-    zeroWidthPolicy:              "reject",
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     allowedScripts:               ["latin"],
     maxLocalPartBytes:            LIMIT_LOCAL_PART,
     maxDomainBytes:               LIMIT_DOMAIN,
@@ -277,26 +275,12 @@ var PROFILES = Object.freeze({
   },
 });
 
-var DEFAULTS = Object.freeze(Object.assign({}, PROFILES["strict"], {
-  mode:          "enforce",
+var DEFAULTS = gateContract.strictDefaults(PROFILES, {
   maxRuntimeMs:  C.TIME.seconds(10),
-}));
-
-var COMPLIANCE_POSTURES = Object.freeze({
-  "hipaa": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-  "pci-dss": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-  "gdpr": Object.assign({}, PROFILES["balanced"], {
-    forensicSnippetBytes: C.BYTES.bytes(128),
-  }),
-  "soc2": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(512),
-  }),
 });
 
+var COMPLIANCE_POSTURES = gateContract.compliancePostures(PROFILES, { base: 256 });
+
 function _resolveOpts(opts) {
   return gateContract.resolveProfileAndPosture(opts, {
     profiles:           PROFILES,
@@ -317,10 +301,11 @@ function _detectAddressIssues(input, opts) {
   }
 
   // Total-address length cap.
-  if (input.length > opts.maxAddressBytes) {
+  var addressBytes = Buffer.byteLength(input, "utf8");
+  if (addressBytes > opts.maxAddressBytes) {
     issues.push({
       kind: "address-cap", severity: "high", ruleId: "email.address-cap",
-      snippet: "address " + input.length + " bytes exceeds maxAddressBytes " +
+      snippet: "address " + addressBytes + " bytes exceeds maxAddressBytes " +
                opts.maxAddressBytes,
     });
   }
@@ -374,19 +359,21 @@ function _detectAddressIssues(input, opts) {
     var localPart = atIdx === -1 ? input : input.slice(0, atIdx);
     var domain = atIdx === -1 ? "" : input.slice(atIdx + 1);
 
-    if (localPart.length > opts.maxLocalPartBytes) {
+    var localPartBytes = Buffer.byteLength(localPart, "utf8");
+    if (localPartBytes > opts.maxLocalPartBytes) {
       issues.push({
         kind: "local-part-cap", severity: "high",
         ruleId: "email.local-part-cap",
-        snippet: "local-part " + localPart.length + " bytes exceeds " +
+        snippet: "local-part " + localPartBytes + " bytes exceeds " +
                  opts.maxLocalPartBytes + " (RFC 5321 §4.5.3.1.1)",
       });
     }
-    if (domain.length > opts.maxDomainBytes) {
+    var domainBytes = Buffer.byteLength(domain, "utf8");
+    if (domainBytes > opts.maxDomainBytes) {
       issues.push({
         kind: "domain-cap", severity: "high",
         ruleId: "email.domain-cap",
-        snippet: "domain " + domain.length + " bytes exceeds " +
+        snippet: "domain " + domainBytes + " bytes exceeds " +
                  opts.maxDomainBytes + " (RFC 5321 §4.5.3.1.2)",
       });
     }
@@ -516,23 +503,16 @@ function validateAddress(input, opts) {
                  snippet: "address is not a string" }],
     };
   }
-  return gateContract.aggregateIssues(_detectAddressIssues(input, opts));
+  // "raw" contract — the detector type-checks its own string input.
+  return gateContract.runIssueValidator(input, opts, _detectAddressIssues, "raw");
 }
 
 // ---- Message validation (full RFC 822 / 5322) ----
 
 function _detectMessageIssues(input, opts) {
-  var issues = [];
-  if (typeof input !== "string") {
-    return [{ kind: "bad-input", severity: "high",
-              snippet: "input is not a string" }];
-  }
-  if (input.length > opts.maxBytes) {
-    return [{ kind: "too-large", severity: "high",
-              ruleId: "email.too-large",
-              snippet: "input " + input.length +
-                       " bytes exceeds maxBytes " + opts.maxBytes }];
-  }
+  var pre = gateContract.detectStringInput(input, opts, { name: "email", noun: "input", emptyMode: "skip", scanCodepoints: false, cap: { bytes: opts.maxBytes, kind: "too-large", snippet: function (byteLen, max) { return "input " + byteLen + " bytes exceeds maxBytes " + max; } } });
+  if (pre.done) return pre.issues;
+  var issues = pre.issues;
 
   // BOM at start of message — header-injection prelude.
   if (opts.bomPolicy !== "allow") {
@@ -591,11 +571,12 @@ function _detectMessageIssues(input, opts) {
     });
   }
   for (var li = 0; li < lines.length; li += 1) {
-    if (lines[li].length > opts.maxHeaderLineBytes) {
+    var lineBytes = Buffer.byteLength(lines[li], "utf8");
+    if (lineBytes > opts.maxHeaderLineBytes) {
       issues.push({
         kind: "header-line-cap", severity: "high",
         ruleId: "email.header-line-cap",
-        snippet: "header line " + (li + 1) + " is " + lines[li].length +
+        snippet: "header line " + (li + 1) + " is " + lineBytes +
                  " bytes (RFC 5322 §2.1.1 limit " + opts.maxHeaderLineBytes + ")",
       });
       break;
@@ -632,6 +613,27 @@ function _detectMessageIssues(input, opts) {
     }
   }
 
+  // Header-block STRUCTURE — a line in the header section that is neither a
+  // valid `name: value` field nor a folding continuation is malformed per RFC
+  // 5322 §2.2, and is the header-injection / SMTP-smuggling signal. This is the
+  // auto-router footgun: a value an operator intends as a single address (e.g.
+  // `a@b.com\r\nBcc: evil@x.com`) has a newline so `validate` treats it as a
+  // message; the bare `a@b.com` line is the smuggled content preceding the
+  // injected `Bcc` header. The shared mimeParse.classifyHeaderBlock surfaces
+  // every such line (the silent-skip parsers used to drop them).
+  if (opts.crlfHeaderInjectionPolicy !== "allow") {
+    var block = mimeParse.classifyHeaderBlock(input);
+    for (var mi = 0; mi < block.malformed.length; mi += 1) {
+      issues.push({
+        kind: "malformed-header-line", severity: "high",
+        ruleId: "email.malformed-header-line",
+        snippet: "header-section line " + (block.malformed[mi].lineIndex + 1) +
+                 " is neither a header field nor a folding continuation — " +
+                 "malformed message / header-injection signal",
+      });
+    }
+  }
+
   // Codepoint-class threats in the full message.
   issues.push.apply(issues, codepointClass.detectCharThreats(input, opts, "email"));
 
@@ -773,7 +775,8 @@ function validateMessage(input, opts) {
                  snippet: "input is not a string" }],
     };
   }
-  return gateContract.aggregateIssues(_detectMessageIssues(input, opts));
+  // "raw" contract — the detector type-checks its own string input.
+  return gateContract.runIssueValidator(input, opts, _detectMessageIssues, "raw");
 }
 
 /**
@@ -901,17 +904,7 @@ function gate(opts) {
       var text = gateContract.extractBytesAsText(ctx);
       if (!text) return { ok: true, action: "serve" };
       var rv = validateMessage(text, opts);
-      if (rv.issues.length === 0) return { ok: true, action: "serve" };
-      var hasCritical = rv.issues.some(function (i) {
-        return i.severity === "critical";
-      });
-      var hasHigh = rv.issues.some(function (i) {
-        return i.severity === "high";
-      });
-      if (!hasCritical && !hasHigh) {
-        return { ok: true, action: "audit-only", issues: rv.issues };
-      }
-      return { ok: false, action: "refuse", issues: rv.issues };
+      return gateContract.severityDisposition(rv.issues);
     });
 }
 

package/lib/vendor/blamejs/lib/guard-envelope.js

@@ -147,7 +147,7 @@ var COMPLIANCE_POSTURES = gateContract.ALL_STRICT_POSTURES;
  */
 function check(ctx, opts) {
   opts = opts || {};
-  var profile = opts.profile || (opts.posture && COMPLIANCE_POSTURES[opts.posture]) || DEFAULT_PROFILE;
+  var profile = gateContract.resolveProfileName(opts, COMPLIANCE_POSTURES, DEFAULT_PROFILE);
   if (!PROFILES[profile]) {
     throw new GuardEnvelopeError("guard-envelope/bad-profile",
       "check: unknown profile '" + profile + "'");

package/lib/vendor/blamejs/lib/guard-event-bus-topic.js

@@ -26,6 +26,7 @@
 
 var { defineClass } = require("./framework-error");
 var gateContract = require("./gate-contract");
+var codepointClass = require("./codepoint-class");
 
 var GuardEventBusTopicError = defineClass("GuardEventBusTopicError", { alwaysPermanent: true });
 
@@ -97,7 +98,7 @@ function validate(name, opts) {
       throw new GuardEventBusTopicError("event-bus-topic/non-ascii",
         "guardEventBusTopic.validate: name contains non-ASCII codepoint at offset " + i);
     }
-    if (c < 0x20 || c === 0x7F || c === 0x2F || c === 0x5C) {                                         // C0/DEL/slash/backslash
+    if (codepointClass.isForbiddenControlChar(c, { forbidTab: true }) || c === 0x2F || c === 0x5C) {                                         // C0/DEL/slash/backslash
       throw new GuardEventBusTopicError("event-bus-topic/bad-char",
         "guardEventBusTopic.validate: forbidden char 0x" + c.toString(16) + " at offset " + i);
     }

package/lib/vendor/blamejs/lib/guard-filename.js

@@ -136,10 +136,7 @@ var HOMOGLYPH_RE = new RegExp("[" + codepointClass.charClass(HOMOGLYPH_RANGES) +
 
 var PROFILES = Object.freeze({
   "strict": {
-    bidiPolicy:           "reject",
-    controlPolicy:        "reject",
-    nullBytePolicy:       "reject",
-    zeroWidthPolicy:      "reject",
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     homoglyphPolicy:      "reject",
     traversalPolicy:      "reject",
     reservedCharPolicy:   "reject",
@@ -197,49 +194,12 @@ var PROFILES = Object.freeze({
   },
 });
 
-var DEFAULTS = Object.freeze(Object.assign({}, PROFILES["strict"], {
-  mode:          "enforce",
+var DEFAULTS = gateContract.strictDefaults(PROFILES, {
   maxRuntimeMs:  C.TIME.seconds(5),
-}));
-
-var COMPLIANCE_POSTURES = Object.freeze({
-  "hipaa": {
-    bidiPolicy: "reject", controlPolicy: "reject", nullBytePolicy: "reject",
-    zeroWidthPolicy: "reject", homoglyphPolicy: "reject",
-    traversalPolicy: "reject", reservedCharPolicy: "reject",
-    reservedNamePolicy: "reject", adsPolicy: "reject",
-    leadingTrailingPolicy: "reject", shellExecExtPolicy: "reject",
-    pathSeparatorsPolicy: "reject",
-    requireAscii: true,
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  },
-  "pci-dss": {
-    bidiPolicy: "reject", controlPolicy: "reject", nullBytePolicy: "reject",
-    zeroWidthPolicy: "reject", homoglyphPolicy: "reject",
-    traversalPolicy: "reject", reservedCharPolicy: "reject",
-    reservedNamePolicy: "reject", adsPolicy: "reject",
-    leadingTrailingPolicy: "reject", shellExecExtPolicy: "reject",
-    pathSeparatorsPolicy: "reject",
-    requireAscii: true,
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  },
-  "gdpr": {
-    bidiPolicy: "strip", controlPolicy: "strip", nullBytePolicy: "reject",
-    zeroWidthPolicy: "strip",
-    traversalPolicy: "reject", reservedCharPolicy: "reject",
-    leadingTrailingPolicy: "strip",
-    forensicSnippetBytes: C.BYTES.bytes(128),
-  },
-  "soc2": {
-    bidiPolicy: "reject", controlPolicy: "reject", nullBytePolicy: "reject",
-    zeroWidthPolicy: "reject", traversalPolicy: "reject",
-    reservedCharPolicy: "reject", reservedNamePolicy: "reject",
-    adsPolicy: "reject", shellExecExtPolicy: "reject",
-    pathSeparatorsPolicy: "reject",
-    forensicSnippetBytes: C.BYTES.bytes(512),
-  },
 });
 
+var COMPLIANCE_POSTURES = gateContract.compliancePostures(PROFILES, { base: 256, overlays: { gdpr: { bidiPolicy: "strip", controlPolicy: "strip" } } });
+
 // ---- Helpers ----
 
 function _resolveOpts(opts) {
@@ -332,19 +292,10 @@ function _detectIssues(input, opts) {
     return issues;
   }
 
-  // 1. Bidi / null / control / zero-width via shared codepoint class.
-  issues.push.apply(issues, codepointClass.detectCharThreats(name, opts, "filename"));
-  if (opts.zeroWidthPolicy !== "allow" && opts.zeroWidthPolicy !== "strip") {
-    var zwMatch = name.match(codepointClass.ZERO_WIDTH_RE);
-    if (zwMatch) {
-      issues.push({
-        kind: "zero-width", severity: "high", ruleId: "filename.zero-width",
-        location: zwMatch.index,
-        snippet: "zero-width / invisible-formatting char U+" +
-                 zwMatch[0].charCodeAt(0).toString(HEX_RADIX),
-      });
-    }
-  }
+  // 1. Bidi / null / control / zero-width via shared codepoint class. In a
+  // filename an invisible char spoofs the name (homoglyph / path confusion), so
+  // zero-width is `high` — passed as the zero-width severity.
+  issues.push.apply(issues, codepointClass.detectCharThreats(name, opts, "filename", "high"));
 
   // 2. Path traversal — raw + percent-encoded forms. `name` is bounded
   // by the maxBytes check at the end of this function (issues are
@@ -685,9 +636,10 @@ function validate(input, opts) {
     ["maxBytes", "maxComponents"],
     "guardFilename.validate", GuardFilenameError, "filename.bad-opt");
 
-  var bad = gateContract.badInputResultIfNotStringOrBuffer(input);
-  if (bad) return bad;
-  return gateContract.aggregateIssues(_detectIssues(input, opts));
+  // "bytes" contract — accept string/Buffer and pass it RAW: _detectIssues
+  // inspects bytes (overlong-UTF-8) before any utf8 conversion, so coercing to
+  // text first would hide the encoding attack.
+  return gateContract.runIssueValidator(input, opts, _detectIssues, "bytes");
 }
 
 function _sanitizeStripMode(input, opts) {