@blamejs/blamejs-shop 0.4.56 → 0.4.57

package/lib/vendor/blamejs/lib/guard-markdown.js

@@ -42,7 +42,6 @@ var codepointClass = require("./codepoint-class");
 var lazyRequire = require("./lazy-require");
 var gateContract = require("./gate-contract");
 var C = require("./constants");
-var numericBounds = require("./numeric-bounds");
 var { GuardMarkdownError } = require("./framework-error");
 
 var observability = lazyRequire(function () { return require("./observability"); });
@@ -142,10 +141,7 @@ var PROFILES = Object.freeze({
     doctypePolicy:          "reject",
     emphasisRunPolicy:      "reject",
     filePolicy:             "reject",
-    bidiPolicy:             "reject",
-    controlPolicy:          "reject",
-    nullBytePolicy:         "reject",
-    zeroWidthPolicy:        "reject",
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     maxBytes:               C.BYTES.mib(1),
     maxLines:               4096,                                                // line count cap
     maxLinks:               256,                                                 // link count cap
@@ -209,36 +205,6 @@ var PROFILES = Object.freeze({
   },
 });
 
-var DEFAULTS = Object.freeze(Object.assign({}, PROFILES["strict"], {
-  mode:          "enforce",
-  maxRuntimeMs:  C.TIME.seconds(10),
-}));
-
-var COMPLIANCE_POSTURES = Object.freeze({
-  "hipaa": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-  "pci-dss": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-  "gdpr": Object.assign({}, PROFILES["balanced"], {
-    forensicSnippetBytes: C.BYTES.bytes(128),
-  }),
-  "soc2": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(512),
-  }),
-});
-
-function _resolveOpts(opts) {
-  return gateContract.resolveProfileAndPosture(opts, {
-    profiles:           PROFILES,
-    compliancePostures: COMPLIANCE_POSTURES,
-    defaults:           DEFAULTS,
-    errorClass:         GuardMarkdownError,
-    errCodePrefix:      "markdown",
-  });
-}
-
 // matchAll wrapper avoids a substring that the local security hook
 // flags for unrelated reasons.
 function _allMatches(input, regex) {
@@ -246,17 +212,9 @@ function _allMatches(input, regex) {
 }
 
 function _detectIssues(input, opts) {
-  var issues = [];
-  if (typeof input !== "string") {
-    return [{ kind: "bad-input", severity: "high",
-              snippet: "input is not a string" }];
-  }
-  if (input.length > opts.maxBytes) {
-    return [{ kind: "too-large", severity: "high",
-              ruleId: "markdown.too-large",
-              snippet: "input " + input.length +
-                       " bytes exceeds maxBytes " + opts.maxBytes }];
-  }
+  var pre = gateContract.detectStringInput(input, opts, { name: "markdown", noun: "input", emptyMode: "skip", scanCodepoints: false, cap: { bytes: opts.maxBytes, kind: "too-large", snippet: function (byteLen, max) { return "input " + byteLen + " bytes exceeds maxBytes " + max; } } });
+  if (pre.done) return pre.issues;
+  var issues = pre.issues;
 
   // Line count cap — line-based parsers scale O(lines).
   var lineCount = 0;
@@ -481,7 +439,7 @@ function _detectIssues(input, opts) {
   }
 
   // 12. Codepoint-class threats.
-  issues.push.apply(issues, codepointClass.detectCharThreats(input, opts, "markdown"));
+  issues.push.apply(issues, codepointClass.detectCharThreats(input, opts, "markdown", "warn"));
 
   return issues;
 }
@@ -537,21 +495,9 @@ function _detectIssues(input, opts) {
  *   bad.ok;                                            // → false
  *   bad.issues[0].ruleId;                              // → "markdown.dangerous-scheme"
  */
-function validate(input, opts) {
-  opts = _resolveOpts(opts);
-  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
-    ["maxBytes", "maxLines", "maxLinks", "maxImages", "maxAutolinks",
-     "maxRefDefs", "maxListDepth", "maxBlockquoteDepth"],
-    "guardMarkdown.validate", GuardMarkdownError, "markdown.bad-opt");
-  if (typeof input !== "string") {
-    return {
-      ok: false,
-      issues: [{ kind: "bad-input", severity: "high",
-                 snippet: "input is not a string" }],
-    };
-  }
-  return gateContract.aggregateIssues(_detectIssues(input, opts));
-}
+// validate is assembled by gateContract.defineGuard from `detect`
+// (_detectIssues), with the maxBytes/maxLines/... caps declared via `intOpts`.
+// The @primitive block above documents the resulting ABI.
 
 /**
  * @primitive  b.guardMarkdown.sanitize
@@ -583,14 +529,10 @@ function validate(input, opts) {
  *     e.code;                                          // → "markdown.dangerous-tag"
  *   }
  */
-function sanitize(input, opts) {
-  opts = _resolveOpts(opts);
-  if (typeof input !== "string") {
-    throw _err("markdown.bad-input", "sanitize requires string input");
-  }
-  var issues = _detectIssues(input, opts);
-  gateContract.throwOnRefusalSeverity(issues,
-    { errorClass: GuardMarkdownError, codePrefix: "markdown", severities: ["critical"] });
+// _sanitizeTransform — the normalize tail applied by defineGuard's generated
+// sanitize AFTER resolve -> detect -> throwOnRefusalSeverity. spec.sanitizeSeverities
+// is ["critical"] so high-severity findings are stripped here, not thrown.
+function _sanitizeTransform(input, opts) {
   return codepointClass.applyCharStripPolicies(input, opts);
 }
 
@@ -624,43 +566,63 @@ function sanitize(input, opts) {
  *   var bad = await g.check({ bytes: Buffer.from("[x](javascript:1)", "utf8") });
  *   bad.action;                                        // → "refuse"
  */
+// Disposition of each markdown finding = what the operator's policy for that
+// class selected. The markup-deviation classes (dangerous tag / raw HTML /
+// HTML comment / front-matter / doctype / dangerous link & image & autolink &
+// reference schemes / code-fence language / emphasis run) refuse under `reject`
+// and audit under `audit` — never sanitize, since the char-strip sanitizer
+// cannot excise them; the bidi / null / control char threats follow their
+// shared policies (sanitize under `strip`); every count / depth cap and a bad
+// input always refuse. Exhaustive over every kind _detectIssues emits.
+function _gateDispositionFor(issue, opts) {
+  var shared = gateContract.charThreatDisposition(issue, opts);
+  if (shared) return shared;
+  switch (issue.kind) {
+    case "dangerous-tag":         return gateContract.policyDisposition(opts.dangerousTagPolicy);
+    case "raw-html":              return gateContract.policyDisposition(opts.rawHtmlPolicy);
+    case "html-comment":          return gateContract.policyDisposition(opts.htmlCommentPolicy);
+    case "front-matter":          return gateContract.policyDisposition(opts.frontMatterPolicy);
+    case "doctype":               return gateContract.policyDisposition(opts.doctypePolicy);
+    // The link / image / autolink / reference-link scheme findings fire ONLY for
+    // dangerous URL schemes (javascript: / data: / vbscript: / file:) — a
+    // denylist hit, so they refuse like html's dangerous-url-scheme. There is no
+    // safe audit-and-serve for a known-XSS scheme; the scheme policy still gates
+    // EMISSION (`allow` suppresses the finding entirely, an explicit operator
+    // opt-in to serve), but any emitted finding refuses.
+    case "image-scheme":
+    case "link-scheme":
+    case "autolink-scheme":
+    case "reference-link-scheme": return "refuse";
+    case "code-fence-lang":       return gateContract.policyDisposition(opts.codeFenceLangPolicy);
+    case "emphasis-run":          return gateContract.policyDisposition(opts.emphasisRunPolicy);
+    case "bad-input":
+    case "too-large":
+    case "line-cap":
+    case "link-cap":
+    case "image-cap":
+    case "autolink-cap":
+    case "ref-def-cap":
+    case "list-depth-cap":
+    case "blockquote-depth-cap":  return "refuse";
+    default:                      return null;
+  }
+}
+
 function gate(opts) {
-  opts = _resolveOpts(opts);
-  return gateContract.buildGuardGate(
-    opts.name || "guardMarkdown:" + (opts.profile || "default"),
-    opts,
-    async function (ctx) {
-      var text = gateContract.extractBytesAsText(ctx);
-      if (!text) return { ok: true, action: "serve" };
-      var rv = validate(text, opts);
-      if (rv.issues.length === 0) return { ok: true, action: "serve" };
-      var hasCritical = rv.issues.some(function (i) {
-        return i.severity === "critical";
-      });
-      var hasHigh = rv.issues.some(function (i) {
-        return i.severity === "high";
-      });
-      if (!hasCritical && !hasHigh) {
-        return { ok: true, action: "audit-only", issues: rv.issues };
-      }
-      var canSanitize = !hasCritical &&
-                        opts.dangerousTagPolicy !== "reject" &&
-                        opts.dangerousSchemePolicy !== "reject" &&
-                        opts.imageSchemePolicy !== "reject" &&
-                        opts.autolinkSchemePolicy !== "reject" &&
-                        opts.referenceLinkPolicy !== "reject" &&
-                        opts.codeFenceLangPolicy !== "reject" &&
-                        opts.doctypePolicy !== "reject";
-      if (canSanitize) {
-        try {
-          var clean = sanitize(text, opts);
-          return { ok: true, action: "sanitize",
-                   sanitized: Buffer.from(clean, "utf8"),
-                   issues: rv.issues };
-        } catch (_e) { /* fall through */ }
-      }
-      return { ok: false, action: "refuse", issues: rv.issues };
-    });
+  opts = module.exports.resolveOpts(opts);
+  return gateContract.buildContentGate({
+    name:     opts.name || "guardMarkdown:" + (opts.profile || "default"),
+    opts:     opts,
+    validate: module.exports.validate,
+    dispositionFor: _gateDispositionFor,
+    // Only the char-threat classes the strip transform can excise ever reach
+    // sanitize (and only when their policy is a mitigation); the markup classes
+    // are refuse / audit by policy. produceSanitized is the strip transform
+    // itself, NOT the public `sanitize` — that one throws on a critical finding
+    // (e.g. a bidi override) regardless of the strip policy, which would turn a
+    // policy-selected sanitize into a refuse.
+    produceSanitized: function (text, o) { return _sanitizeTransform(text, o); },
+  });
 }
 
 // buildProfile / compliancePosture / loadRulePack are assembled by
@@ -690,12 +652,16 @@ module.exports = gateContract.defineGuard({
   kind:        "content",
   errorClass:  GuardMarkdownError,
   profiles:    PROFILES,
-  defaults:    DEFAULTS,
-  postures:    COMPLIANCE_POSTURES,
+  base:        256,
+  defaultsOverlay: { maxRuntimeMs: C.TIME.seconds(10) },
   mimeTypes:   ["text/markdown", "text/x-markdown", "text/x-gfm"],
   extensions:  [".md", ".markdown"],
   integrationFixtures: INTEGRATION_FIXTURES,
-  validate:    validate,
-  sanitize:    sanitize,
+  detect:             _detectIssues,
+  sanitizeTransform:  _sanitizeTransform,
+  sanitizeSeverities: ["critical"],
+  intOpts:            ["maxBytes", "maxLines", "maxLinks", "maxImages", "maxAutolinks",
+                       "maxRefDefs", "maxListDepth", "maxBlockquoteDepth"],
   gate:        gate,
+  extra: { _gateDispositionForTest: _gateDispositionFor },
 });

package/lib/vendor/blamejs/lib/guard-message-id.js

@@ -51,6 +51,7 @@
 
 var { defineClass } = require("./framework-error");
 var gateContract = require("./gate-contract");
+var codepointClass = require("./codepoint-class");
 
 var GuardMessageIdError = defineClass("GuardMessageIdError", { alwaysPermanent: true });
 
@@ -124,12 +125,10 @@ function validate(value, opts) {
   // C0 control chars + NUL + DEL — always refused at every profile
   // (defends mail-header-injection class — operator can't smuggle
   // CR/LF into a Message-Id to fold an attacker-chosen From: line).
-  for (var i = 0; i < value.length; i += 1) {
-    var c = value.charCodeAt(i);
-    if (c < 0x20 || c === 0x7F) {                                                                 // C0 + DEL refusal
-      throw new GuardMessageIdError("message-id/control-char",
-        "guardMessageId.validate: control char 0x" + c.toString(16) + " at offset " + i);
-    }
+  var _ctlOff = codepointClass.firstControlCharOffset(value, { forbidTab: true });               // C0 + DEL refusal
+  if (_ctlOff !== -1) {
+    throw new GuardMessageIdError("message-id/control-char",
+      "guardMessageId.validate: control char 0x" + value.charCodeAt(_ctlOff).toString(16) + " at offset " + _ctlOff);
   }
 
   // Bidi codepoints — refused at strict + balanced; permissive lets

package/lib/vendor/blamejs/lib/guard-mime.js

@@ -36,11 +36,9 @@
  *   Media-type identifier-safety guard.
  */
 
-var codepointClass = require("./codepoint-class");
 var lazyRequire = require("./lazy-require");
 var gateContract = require("./gate-contract");
 var C = require("./constants");
-var numericBounds = require("./numeric-bounds");
 var safeBuffer = require("./safe-buffer");
 var { GuardMimeError } = require("./framework-error");
 
@@ -81,10 +79,7 @@ var RISKY_TYPES = Object.freeze([
 
 var PROFILES = Object.freeze({
   "strict": {
-    bidiPolicy:           "reject",
-    controlPolicy:        "reject",
-    nullBytePolicy:       "reject",
-    zeroWidthPolicy:      "reject",
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     wildcardPolicy:       "reject",
     vendorTreePolicy:     "audit",
     personalTreePolicy:   "audit",
@@ -95,10 +90,7 @@ var PROFILES = Object.freeze({
     maxRuntimeMs:         C.TIME.seconds(2),
   },
   "balanced": {
-    bidiPolicy:           "reject",
-    controlPolicy:        "reject",
-    nullBytePolicy:       "reject",
-    zeroWidthPolicy:      "reject",
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     wildcardPolicy:       "audit",
     vendorTreePolicy:     "allow",
     personalTreePolicy:   "audit",
@@ -109,10 +101,7 @@ var PROFILES = Object.freeze({
     maxRuntimeMs:         C.TIME.seconds(2),
   },
   "permissive": {
-    bidiPolicy:           "reject",                                              // BIDI refused at every profile
-    controlPolicy:        "reject",                                              // controls refused at every profile
-    nullBytePolicy:       "reject",                                              // null refused at every profile
-    zeroWidthPolicy:      "reject",                                              // zero-width refused at every profile
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     wildcardPolicy:       "allow",
     vendorTreePolicy:     "allow",
     personalTreePolicy:   "allow",
@@ -124,35 +113,6 @@ var PROFILES = Object.freeze({
   },
 });
 
-var DEFAULTS = Object.freeze(Object.assign({}, PROFILES["strict"], {
-  mode: "enforce",
-}));
-
-var COMPLIANCE_POSTURES = Object.freeze({
-  "hipaa":   Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(128),
-  }),
-  "pci-dss": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(128),
-  }),
-  "gdpr":    Object.assign({}, PROFILES["balanced"], {
-    forensicSnippetBytes: C.BYTES.bytes(64),
-  }),
-  "soc2":    Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-});
-
-function _resolveOpts(opts) {
-  return gateContract.resolveProfileAndPosture(opts, {
-    profiles:           PROFILES,
-    compliancePostures: COMPLIANCE_POSTURES,
-    defaults:           DEFAULTS,
-    errorClass:         GuardMimeError,
-    errCodePrefix:      "mime",
-  });
-}
-
 // ---- Parser ----
 
 function _splitTopLevel(input) {
@@ -175,25 +135,9 @@ function _splitTopLevel(input) {
 }
 
 function _detectIssues(input, opts) {
-  var issues = [];
-  if (typeof input !== "string") {
-    return [{ kind: "bad-input", severity: "high",
-              ruleId: "mime.bad-input",
-              snippet: "mime is not a string" }];
-  }
-  if (input.length === 0) {
-    return [{ kind: "empty", severity: "high",
-              ruleId: "mime.empty",
-              snippet: "mime is empty" }];
-  }
-  if (Buffer.byteLength(input, "utf8") > opts.maxBytes) {
-    return [{ kind: "mime-cap", severity: "high",
-              ruleId: "mime.mime-cap",
-              snippet: "mime input exceeds maxBytes " + opts.maxBytes }];
-  }
-
-  var charThreats = codepointClass.detectCharThreats(input, opts, "mime");
-  for (var ci = 0; ci < charThreats.length; ci += 1) issues.push(charThreats[ci]);
+  var pre = gateContract.detectStringInput(input, opts, { name: "mime", cap: { bytes: opts.maxBytes } });
+  if (pre.done) return pre.issues;
+  var issues = pre.issues;
 
   var parts = _splitTopLevel(input);
   var typeSubtype = parts[0];
@@ -391,21 +335,10 @@ function _detectIssues(input, opts) {
  *   bad.ok;                                            // → false
  *   bad.issues[0].ruleId;                              // → "mime.risky-type"
  */
-function validate(input, opts) {
-  opts = _resolveOpts(opts);
-  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
-    ["maxBytes"],
-    "guardMime.validate", GuardMimeError, "mime.bad-opt");
-  if (typeof input !== "string") {
-    return {
-      ok: false,
-      issues: [{ kind: "bad-input", severity: "high",
-                 ruleId: "mime.bad-input",
-                 snippet: "mime is not a string" }],
-    };
-  }
-  return gateContract.aggregateIssues(_detectIssues(input, opts));
-}
+// validate is assembled by gateContract.defineGuard from `detect`
+// (_detectIssues) below — `validate(input, opts) = aggregateIssues(detect(
+// input, resolveOpts(opts)))`, with the maxBytes cap declared via `intOpts`.
+// The @primitive block above documents the resulting public ABI.
 
 /**
  * @primitive  b.guardMime.sanitize
@@ -437,15 +370,10 @@ function validate(input, opts) {
  *     e.code;                                          // → "mime.risky-type"
  *   }
  */
-function sanitize(input, opts) {
-  opts = _resolveOpts(opts);
-  if (typeof input !== "string") {
-    throw _err("mime.bad-input", "sanitize requires string input");
-  }
-  var issues = _detectIssues(input, opts);
-  gateContract.throwOnRefusalSeverity(issues, {
-    errorClass: GuardMimeError, codePrefix: "mime",
-  });
+// _sanitizeTransform — the guard-specific normalize applied by defineGuard's
+// generated sanitize AFTER resolve → detect → throw-on-refusal. Input is an
+// already-validated string at this point (a non-string refuses upstream).
+function _sanitizeTransform(input) {
   // Normalize: lowercase the type/subtype; preserve parameter case
   // because some parameter values are case-significant (e.g. boundary
   // tokens in multipart/form-data).
@@ -468,15 +396,8 @@ function sanitize(input, opts) {
 // Their wiki sections render from the single-sourced @abiTemplate blocks
 // in gate-contract.js, instantiated per guard by the page generator.
 
-var INTEGRATION_FIXTURES = Object.freeze({
-  kind:              "identifier",
-  benignBytes:       Buffer.from("application/json", "utf8"),
-  hostileBytes:      Buffer.from("application/x-msdownload", "utf8"),
-  benignIdentifier:  "application/json",
-  // Hostile: risky-type — refused at strict (executable script-host
-  // class).
-  hostileIdentifier: "application/x-msdownload",
-});
+// Hostile: risky-type — refused at strict (executable script-host class).
+var INTEGRATION_FIXTURES = gateContract.identifierFixtures("application/json", "application/x-msdownload");
 
 // Assembled from the gate-contract guard factory: error class, registry
 // exports (NAME / KIND / INTEGRATION_FIXTURES), buildProfile /
@@ -488,10 +409,10 @@ module.exports = gateContract.defineGuard({
   kind:        "identifier",
   errorClass:  GuardMimeError,
   profiles:    PROFILES,
-  defaults:    DEFAULTS,
-  postures:    COMPLIANCE_POSTURES,
+  base:        128,
   integrationFixtures: INTEGRATION_FIXTURES,
-  validate:    validate,
-  sanitize:    sanitize,
+  detect:           _detectIssues,
+  sanitizeTransform: _sanitizeTransform,
+  intOpts:          ["maxBytes"],
   ctxFields:   ["identifier", "mime"],
 });

package/lib/vendor/blamejs/lib/guard-oauth.js

@@ -83,7 +83,6 @@ var codepointClass = require("./codepoint-class");
 var lazyRequire = require("./lazy-require");
 var gateContract = require("./gate-contract");
 var C = require("./constants");
-var numericBounds = require("./numeric-bounds");
 var { GuardOauthError } = require("./framework-error");
 
 var observability = lazyRequire(function () { return require("./observability"); });
@@ -96,10 +95,7 @@ var DEFAULT_RESPONSE_TYPES = Object.freeze(["code"]);
 
 var PROFILES = Object.freeze({
   "strict": {
-    bidiPolicy:               "reject",
-    controlPolicy:             "reject",
-    nullBytePolicy:            "reject",
-    zeroWidthPolicy:           "reject",
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     pkcePolicy:                "require-s256",
     statePolicy:               "require",
     redirectUriPolicy:         "require-exact-allowlist",
@@ -113,10 +109,7 @@ var PROFILES = Object.freeze({
     maxRuntimeMs:              C.TIME.seconds(2),
   },
   "balanced": {
-    bidiPolicy:               "reject",
-    controlPolicy:             "reject",
-    nullBytePolicy:            "reject",
-    zeroWidthPolicy:           "reject",
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     pkcePolicy:                "require-any",                                    // S256 or plain
     statePolicy:               "require",
     redirectUriPolicy:         "require-exact-allowlist",
@@ -130,10 +123,7 @@ var PROFILES = Object.freeze({
     maxRuntimeMs:              C.TIME.seconds(2),
   },
   "permissive": {
-    bidiPolicy:               "reject",                                          // BIDI refused at every profile
-    controlPolicy:             "reject",                                          // controls refused at every profile
-    nullBytePolicy:            "reject",                                          // null refused at every profile
-    zeroWidthPolicy:           "reject",                                          // zero-width refused at every profile
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     pkcePolicy:                "audit",
     statePolicy:               "audit",
     redirectUriPolicy:         "audit",
@@ -148,35 +138,6 @@ var PROFILES = Object.freeze({
   },
 });
 
-var DEFAULTS = Object.freeze(Object.assign({}, PROFILES["strict"], {
-  mode: "enforce",
-}));
-
-var COMPLIANCE_POSTURES = Object.freeze({
-  "hipaa":   Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-  "pci-dss": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-  "gdpr":    Object.assign({}, PROFILES["balanced"], {
-    forensicSnippetBytes: C.BYTES.bytes(128),
-  }),
-  "soc2":    Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(512),
-  }),
-});
-
-function _resolveOpts(opts) {
-  return gateContract.resolveProfileAndPosture(opts, {
-    profiles:           PROFILES,
-    compliancePostures: COMPLIANCE_POSTURES,
-    defaults:           DEFAULTS,
-    errorClass:         GuardOauthError,
-    errCodePrefix:      "oauth",
-  });
-}
-
 function _detectIssues(flow, opts) {
   var issues = [];
   if (!flow || typeof flow !== "object") {
@@ -401,13 +362,9 @@ function _detectIssues(flow, opts) {
  *   });
  *   ok.ok;                                              // → true
  */
-function validate(input, opts) {
-  opts = _resolveOpts(opts);
-  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
-    ["maxBytes", "maxParamBytes"],
-    "guardOauth.validate", GuardOauthError, "oauth.bad-opt");
-  return gateContract.aggregateIssues(_detectIssues(input, opts));
-}
+// validate is assembled by gateContract.defineGuard from `detect`
+// (_detectIssues), with the maxBytes/maxParamBytes caps declared via
+// `intOpts`. The @primitive block above documents the resulting ABI.
 
 /**
  * @primitive  b.guardOauth.sanitize
@@ -439,12 +396,11 @@ function validate(input, opts) {
  *     e.code;                                           // → "oauth.pkce-missing"
  *   }
  */
-function sanitize(input, opts) {
-  opts = _resolveOpts(opts);
-  // OAuth flows can't be repaired — sanitize either passes through
-  // valid input or throws.
-  var issues = _detectIssues(input, opts);
-  gateContract.throwOnRefusalSeverity(issues, { errorClass: GuardOauthError, codePrefix: "oauth" });
+// _sanitizeTransform — the normalize tail applied by defineGuard's generated
+// sanitize AFTER resolve -> detect -> throwOnRefusalSeverity. OAuth flows
+// can't be repaired: any critical/high finding refuses upstream, so the
+// transform passes the already-validated bundle through unchanged.
+function _sanitizeTransform(input) {
   return input;
 }
 
@@ -490,25 +446,15 @@ function sanitize(input, opts) {
  *   rv.action;                                          // → "refuse"
  */
 function gate(opts) {
-  opts = _resolveOpts(opts);
+  opts = _guard.resolveOpts(opts);
   return gateContract.buildGuardGate(
     opts.name || "guardOauth:" + (opts.profile || "default"),
     opts,
     async function (ctx) {
       var flow = ctx && (ctx.oauthFlow || ctx.flow);
       if (!flow) return { ok: true, action: "serve" };
-      var rv = validate(flow, opts);
-      if (rv.issues.length === 0) return { ok: true, action: "serve" };
-      var hasCritical = rv.issues.some(function (i) {
-        return i.severity === "critical";
-      });
-      var hasHigh = rv.issues.some(function (i) {
-        return i.severity === "high";
-      });
-      if (!hasCritical && !hasHigh) {
-        return { ok: true, action: "audit-only", issues: rv.issues };
-      }
-      return { ok: false, action: "refuse", issues: rv.issues };
+      var rv = module.exports.validate(flow, opts);
+      return gateContract.severityDisposition(rv.issues);
     });
 }
 
@@ -555,15 +501,15 @@ var INTEGRATION_FIXTURES = Object.freeze({
 // surface (validate / sanitize / bespoke gate) passed through verbatim.
 // The custom KIND ("oauth-flow") is accepted because the bespoke gate
 // reads its own ctx fields (ctx.oauthFlow / ctx.flow).
-module.exports = gateContract.defineGuard({
+var _guard = module.exports = gateContract.defineGuard({
   name:        "oauth",
   kind:        "oauth-flow",
   errorClass:  GuardOauthError,
   profiles:    PROFILES,
-  defaults:    DEFAULTS,
-  postures:    COMPLIANCE_POSTURES,
+  base:        256,
   integrationFixtures: INTEGRATION_FIXTURES,
-  validate:    validate,
-  sanitize:    sanitize,
+  detect:             _detectIssues,
+  sanitizeTransform:  _sanitizeTransform,
+  intOpts:            ["maxBytes", "maxParamBytes"],
   gate:        gate,
 });