@blamejs/blamejs-shop 0.4.56 → 0.4.58

package/lib/vendor/blamejs/test/layer-0-primitives/guard-csv.test.js

@@ -448,6 +448,48 @@ function testGuardCsvCellTooLargeCap() {
         threw && /maxCellBytes|too-large/.test(threw.message));
 }
 
+function testGuardCsvCellByteCapMultibyte() {
+  // The cap is named in BYTES; a multibyte char must count its UTF-8 byte
+  // width, not its UTF-16 code-unit count. "é" (U+00E9) is 1 code unit but
+  // 2 UTF-8 bytes. Five of them: .length === 5, byteLength === 10.
+  var multibyte = "é".repeat(5);
+  check("multibyte fixture: .length 5 < byteLength 10",
+        multibyte.length === 5 && Buffer.byteLength(multibyte, "utf8") === 10);
+
+  // Cap at 6 bytes. byteLength(10) > 6 → refuse. The old char-length check
+  // (5 <= 6) would have let this 10-byte cell through under-enforced.
+  var threwCell = null;
+  try {
+    b.guardCsv.escapeCell(multibyte, { maxCellBytes: 6 });
+  } catch (e) { threwCell = e; }
+  check("escapeCell: multibyte cell over byte cap refused",
+        threwCell && threwCell.code === "csv.cell-too-large");
+  check("escapeCell: refusal reports the byte count, not the code-unit count",
+        threwCell && /\b10 bytes\b/.test(threwCell.message));
+
+  // The same cell through the shipped serialize consumer path.
+  var threwSer = null;
+  try {
+    b.guardCsv.serialize([[multibyte]], { maxCellBytes: 6 });
+  } catch (e) { threwSer = e; }
+  check("serialize: multibyte cell over byte cap refused",
+        threwSer && /maxCellBytes|too-large/.test(threwSer.message));
+
+  // A multibyte cell UNDER the byte cap is not falsely flagged: two "é" =
+  // 4 bytes < 6. And ASCII at the boundary is unchanged (5 bytes <= 6).
+  var underThrew = false;
+  try {
+    b.guardCsv.escapeCell("éé", { maxCellBytes: 6 });
+  } catch (_e) { underThrew = true; }
+  check("escapeCell: multibyte cell under byte cap accepted", underThrew === false);
+
+  var asciiThrew = false;
+  try {
+    b.guardCsv.escapeCell("alice", { maxCellBytes: 6 });
+  } catch (_e) { asciiThrew = true; }
+  check("escapeCell: ASCII under byte cap unchanged", asciiThrew === false);
+}
+
 function testGuardCsvTooManyRows() {
   var threw = null;
   try {
@@ -560,6 +602,46 @@ function testGuardCsvCompliancePosture() {
   check("compliancePosture: unknown name throws",       threw && /unknown/.test(threw.message));
 }
 
+function testGdprPostureMatchesBalancedTier() {
+  // csv is a `content` guard. Its four-posture COMPLIANCE_POSTURES map must be
+  // built by gateContract.compliancePostures(PROFILES, { base, overlays }) like
+  // every other content guard: hipaa/pci/soc2 -> strict tier, gdpr -> balanced
+  // tier, with piiPolicy:"redact" overlaid on hipaa/pci/gdpr only.
+  //
+  // The drift this pins: a hand-written PARTIAL gdpr literal omitted keys
+  // (nullByteHandling / trailingWhitespacePolicy / bomPrefix / ...) that
+  // backfilled from the strict-leaning DEFAULTS at resolve time, making gdpr an
+  // incoherent strict/balanced hybrid. Once routed, gdpr is the balanced tier
+  // plus the forensic-snippet budget (base/2 = 128) plus the piiPolicy overlay.
+  var P = require("../../lib/guard-csv.js");
+  var POSTURES = P.COMPLIANCE_POSTURES;
+
+  // PRIMARY (deep-equal): gdpr resolves to the balanced tier + 128-byte snippet
+  // budget + the piiPolicy overlay — no DEFAULTS backfill.
+  var wantGdpr = Object.assign({}, P.PROFILES.balanced, {
+    forensicSnippetBytes: 128,
+    piiPolicy:            "redact",
+  });
+  check("gdpr posture deep-equals balanced tier + forensic(128) + piiPolicy overlay",
+        JSON.stringify(POSTURES.gdpr) === JSON.stringify(wantGdpr));
+
+  // Overlay lands on the right postures only.
+  check("piiPolicy overlay survives on hipaa",   POSTURES.hipaa.piiPolicy === "redact");
+  check("piiPolicy overlay survives on pci-dss", POSTURES["pci-dss"].piiPolicy === "redact");
+  check("piiPolicy overlay survives on gdpr",    POSTURES.gdpr.piiPolicy === "redact");
+  check("soc2 carries no piiPolicy overlay",     POSTURES.soc2.piiPolicy === undefined);
+
+  // REGRESSION (deep-equal): hipaa is the strict tier + 256-byte snippet budget
+  // + the piiPolicy overlay — confirms the strict-tier postures are coherent
+  // (no partial-literal backfill) after routing too.
+  var wantHipaa = Object.assign({}, P.PROFILES.strict, {
+    forensicSnippetBytes: 256,
+    piiPolicy:            "redact",
+  });
+  check("hipaa posture deep-equals strict tier + forensic(256) + piiPolicy overlay",
+        JSON.stringify(POSTURES.hipaa) === JSON.stringify(wantHipaa));
+}
+
 async function testGuardCsvGateClean() {
   var g = b.guardCsv.gate({ profile: "strict" });
   var d = await g.check({ bytes: Buffer.from("a,b\r\n1,2\r\n"), filename: "ok.csv" });
@@ -754,6 +836,7 @@ async function run() {
   testGuardCsvNullByteReject();
   testGuardCsvNumericPrecisionDecimalString();
   testGuardCsvCellTooLargeCap();
+  testGuardCsvCellByteCapMultibyte();
   testGuardCsvTooManyRows();
   testGuardCsvValidateBidi();
   testGuardCsvValidateClean();
@@ -766,6 +849,7 @@ async function run() {
   testGuardCsvSchemaNonNullable();
   testGuardCsvSchemaRegex();
   testGuardCsvCompliancePosture();
+  testGdprPostureMatchesBalancedTier();
   await testGuardCsvGateClean();
   await testGuardCsvGateRefuseBidi();
   await testGuardCsvGateSanitize();

package/lib/vendor/blamejs/test/layer-0-primitives/guard-email.test.js

@@ -65,6 +65,57 @@ function testGuardEmailLengthCaps() {
         }));
 }
 
+function testGuardEmailMultibyteByteCaps() {
+  // A cap named in *Bytes must measure UTF-8 bytes, not UTF-16 .length code
+  // units. A 2-byte codepoint (U+00E9, "e acute") counts as 1 code unit, so a
+  // length-based comparison under-enforces: input over the byte cap slips
+  // through. Build inputs whose byteLength EXCEEDS the cap while .length does
+  // NOT, and assert each cap fires. Codepoint built programmatically so the
+  // source stays pure ASCII.
+  var acute = String.fromCodePoint(0x00e9);                                       // U+00E9 = 2 UTF-8 bytes
+  var mb40  = new Array(41).join(acute);                                          // .length 40, 80 bytes
+  var mb50  = new Array(51).join(acute);                                          // .length 50, 100 bytes
+
+  // Message total-byte cap (maxBytes).
+  var rvMsg = b.guardEmail.validateMessage(mb50, { profile: "strict", maxBytes: 60 });
+  check("message maxBytes cap measures bytes (multibyte over byte cap → too-large)",
+        rvMsg.issues.some(function (i) { return i.kind === "too-large"; }));
+
+  // Total-address byte cap (maxAddressBytes).
+  var rvAddr = b.guardEmail.validateAddress(mb40 + "@example.com",
+    { profile: "strict", maxAddressBytes: 60, maxLocalPartBytes: 100000, maxDomainBytes: 100000 });
+  check("address maxAddressBytes cap measures bytes (multibyte over byte cap → address-cap)",
+        rvAddr.issues.some(function (i) { return i.kind === "address-cap"; }));
+
+  // Local-part byte cap (maxLocalPartBytes).
+  var rvLp = b.guardEmail.validateAddress(mb40 + "@example.com",
+    { profile: "strict", maxLocalPartBytes: 60, maxAddressBytes: 100000, maxDomainBytes: 100000 });
+  check("local-part maxLocalPartBytes cap measures bytes (multibyte over byte cap → local-part-cap)",
+        rvLp.issues.some(function (i) { return i.kind === "local-part-cap"; }));
+
+  // Domain byte cap (maxDomainBytes).
+  var rvDom = b.guardEmail.validateAddress("a@" + mb40 + ".com",
+    { profile: "strict", maxDomainBytes: 60, maxAddressBytes: 100000, maxLocalPartBytes: 100000 });
+  check("domain maxDomainBytes cap measures bytes (multibyte over byte cap → domain-cap)",
+        rvDom.issues.some(function (i) { return i.kind === "domain-cap"; }));
+
+  // Header-line byte cap (maxHeaderLineBytes).
+  var msg = "From: alice@example.com\r\nSubject: " + mb40 + "\r\n\r\nbody\r\n";
+  var rvHdr = b.guardEmail.validateMessage(msg, { profile: "strict", maxHeaderLineBytes: 60 });
+  check("header-line maxHeaderLineBytes cap measures bytes (multibyte over byte cap → header-line-cap)",
+        rvHdr.issues.some(function (i) { return i.kind === "header-line-cap"; }));
+
+  // ASCII regression: clean inputs are unchanged; a real over-cap ASCII
+  // local-part still fires (byte count == code-unit count for ASCII).
+  var cleanAddr = b.guardEmail.validateAddress("alice@example.com", { profile: "strict" });
+  check("ASCII clean address unchanged (byte-cap fix is ASCII-transparent)",
+        cleanAddr.ok === true && cleanAddr.issues.length === 0);
+  var asciiLp = b.guardEmail.validateAddress(new Array(67).join("a") + "@example.com",
+    { profile: "strict" });
+  check("ASCII local-part > 64 still caps after byte-measure fix",
+        asciiLp.issues.some(function (i) { return i.kind === "local-part-cap"; }));
+}
+
 function testGuardEmailIpLiteral() {
   var rv = b.guardEmail.validateAddress("user@[1.2.3.4]", { profile: "strict" });
   check("IP literal address detected (DMARC alignment bypass)",
@@ -138,6 +189,31 @@ function testGuardEmailCrlfHeaderInjection() {
         }));
 }
 
+function testGuardEmailAutoRouterHeaderInjection() {
+  // The auto-router footgun: a value an operator intends as a single address
+  // but that carries CRLF + an injected header. `validate` sees the newline,
+  // treats it as a message, and (before the fix) the bare `a@b.com` line was
+  // silently dropped while the injected `Bcc` passed — ok:true. The shared
+  // mimeParse.classifyHeaderBlock now surfaces the colon-less header-section
+  // line as malformed → ok:false.
+  var rv = b.guardEmail.validate("a@b.com\r\nBcc: evil@x.com", { profile: "strict" });
+  check("auto-router CRLF+injected-header → ok:false",
+        rv.ok === false &&
+        rv.issues.some(function (i) { return i.kind === "malformed-header-line"; }));
+
+  // A bare address with a trailing CRLF is the same footgun shape.
+  var rv2 = b.guardEmail.validate("alice@example.com\r\n", { profile: "strict" });
+  check("auto-router address+trailing-CRLF → ok:false", rv2.ok === false);
+
+  // A well-formed RFC 5322 message must still pass — header fields, folding, and
+  // bare BODY lines after the blank boundary are all legitimate.
+  var ok = b.guardEmail.validate(
+    "From: a@example.com\r\nTo: b@example.com\r\nSubject: long\r\n folded\r\n" +
+    "Date: Mon, 5 May 2026 10:00:00 +0000\r\n\r\nbare body line\r\nanother\r\n",
+    { profile: "strict" });
+  check("well-formed message (folding + body lines) still passes", ok.ok === true);
+}
+
 function testGuardEmailDisplayNameSpoof() {
   var msg = 'From: "support@apple.com" <attacker@evil.com>\r\n' +
             "To: bob@example.com\r\nSubject: x\r\n\r\nbody\r\n";
@@ -227,6 +303,7 @@ async function run() {
   testGuardEmailCleanAddress();
   testGuardEmailMultiAt();
   testGuardEmailLengthCaps();
+  testGuardEmailMultibyteByteCaps();
   testGuardEmailIpLiteral();
   testGuardEmailAddressComment();
   testGuardEmailPunycode();
@@ -235,6 +312,7 @@ async function run() {
   testGuardEmailSyntaxReject();
   testGuardEmailBareLfSmuggling();
   testGuardEmailCrlfHeaderInjection();
+  testGuardEmailAutoRouterHeaderInjection();
   testGuardEmailDisplayNameSpoof();
   testGuardEmailBom();
   testGuardEmailHeaderLineCap();

package/lib/vendor/blamejs/test/layer-0-primitives/guard-filename.test.js

@@ -344,6 +344,28 @@ function testGuardFilenameSanitizeStripMode() {
         captured[0].outcome === "success");
 }
 
+function testGdprPostureMatchesBalancedTier() {
+  // gdpr is the balanced tier for a filename guard: it allows non-ASCII
+  // (data-minimization keeps the value usable) rather than inheriting the
+  // strict tier's requireAscii:true. The drift was a partial gdpr posture
+  // object that omitted requireAscii, so resolved opts silently backfilled
+  // it from the strict-derived defaults — making gdpr a strict/balanced
+  // hybrid. Drive the real consumer path: a non-ASCII leaf must NOT raise
+  // a non-ascii issue under gdpr.
+  var rv = b.guardFilename.validate("café.txt", { compliancePosture: "gdpr" });
+  check("gdpr (balanced tier) does not flag non-ascii on a filename leaf",
+        !rv.issues.some(function (issue) { return issue.kind === "non-ascii"; }));
+
+  // The deliberate per-posture overlay survives the routing: gdpr strips
+  // bidi / control on leaf names (data-minimization) where the balanced
+  // profile would reject them. Both together prove balanced-tier base +
+  // intended overlay.
+  check("gdpr posture overlay keeps bidiPolicy=strip",
+        b.guardFilename.COMPLIANCE_POSTURES.gdpr.bidiPolicy === "strip");
+  check("gdpr posture overlay keeps controlPolicy=strip",
+        b.guardFilename.COMPLIANCE_POSTURES.gdpr.controlPolicy === "strip");
+}
+
 function testGuardFilenameCompliancePosture() {
   var hipaa = b.guardFilename.compliancePosture("hipaa");
   check("compliancePosture('hipaa') sets reject policies",
@@ -386,6 +408,7 @@ async function run() {
   testGuardFilenameDoubleExtension();
   testGuardFilenameOverlongUtf8();
   testGuardFilenameAsciiOnlyStrict();
+  testGdprPostureMatchesBalancedTier();
   testGuardFilenameClean();
   testGuardFilenameSanitize();
   testGuardFilenameSanitizeStripMode();

package/lib/vendor/blamejs/test/layer-0-primitives/guard-gate-disposition-coverage.test.js

@@ -0,0 +1,93 @@
+"use strict";
+/**
+ * Gate-disposition coverage — every finding kind a content guard can emit MUST
+ * be classified by that guard's dispositionFor (→ refuse / sanitize / audit), so
+ * buildContentGate never falls back to severity for a guard's own finding. The
+ * conservative severity fallback exists only for operator-injected extraIssues
+ * and as a secure backstop; this test proves it is dead code for guard findings.
+ *
+ * The kind set is SCANNED from each guard's source (every `kind:` literal,
+ * including ternary branches) plus the shared character-threat kinds emitted by
+ * codepointClass.detectCharThreats — so a NEW finding kind added to a guard
+ * without a dispositionFor mapping fails this test (RED) rather than silently
+ * inheriting the conservative refuse.
+ */
+
+var fs      = require("fs");
+var path    = require("path");
+var helpers = require("../helpers");
+var check   = helpers.check;
+
+var LIB = path.join(__dirname, "..", "..", "lib");
+
+// Shared char-threat kinds come from codepointClass.detectCharThreats, not the
+// guard source, so they are added to every content guard's expected set
+// (zero-width is opt-in via the detector's 4th arg for the markup guards).
+var SHARED_CHAR_THREATS = ["bidi-override", "null-byte", "control-char", "zero-width"];
+
+var GUARDS = [
+  { name: "csv",      file: "guard-csv.js",      profiles: ["strict", "balanced", "permissive", "email-attachment"] },
+  { name: "html",     file: "guard-html.js",     profiles: ["strict", "balanced", "permissive"] },
+  { name: "svg",      file: "guard-svg.js",      profiles: ["strict", "balanced", "permissive"] },
+  { name: "xml",      file: "guard-xml.js",      profiles: ["strict", "balanced", "permissive"] },
+  { name: "markdown", file: "guard-markdown.js", profiles: ["strict", "balanced", "permissive"] },
+  { name: "json",     file: "guard-json.js",     profiles: ["strict", "balanced", "permissive"] },
+];
+
+// The guard-KIND taxonomy (INTEGRATION_FIXTURES.kind / the guard's KIND export)
+// is "content" | "entries" | "filename" — not a finding kind, so the scan skips
+// these (they are never produced by detect and never reach a content gate).
+var NON_FINDING_KINDS = { content: true, entries: true, filename: true };
+
+// Extract every finding kind from a guard source: the token after `kind:` up to
+// the first comma, then every quoted string inside it (covers both the literal
+// `kind: "x"` and the ternary `kind: c ? "a" : "b"` forms).
+function _scanKinds(source) {
+  var kinds = {};
+  var re = /kind:\s*([^,\n]+)/g;
+  var m;
+  while ((m = re.exec(source)) !== null) {
+    var seg = m[1];
+    var qre = /"([a-z][a-z0-9-]*)"/g;
+    var q;
+    while ((q = qre.exec(seg)) !== null) {
+      if (!NON_FINDING_KINDS[q[1]]) kinds[q[1]] = true;
+    }
+  }
+  return Object.keys(kinds);
+}
+
+function run() {
+  var VALID = { refuse: true, sanitize: true, audit: true };
+
+  GUARDS.forEach(function (g) {
+    var mod = require(path.join(LIB, g.file));
+    check("[" + g.name + "] exposes dispositionFor test hook",
+          typeof mod._gateDispositionForTest === "function");
+    if (typeof mod._gateDispositionForTest !== "function") return;
+
+    var kinds = _scanKinds(fs.readFileSync(path.join(LIB, g.file), "utf8"));
+    SHARED_CHAR_THREATS.forEach(function (k) { if (kinds.indexOf(k) === -1) kinds.push(k); });
+
+    check("[" + g.name + "] scanned a non-empty finding-kind set", kinds.length > 0);
+
+    var unclassified = [];
+    g.profiles.forEach(function (profile) {
+      var opts = mod.resolveOpts({ profile: profile });
+      kinds.forEach(function (kind) {
+        var disp = mod._gateDispositionForTest({ kind: kind, severity: "high" }, opts);
+        if (!VALID[disp]) unclassified.push(profile + ":" + kind + "=" + disp);
+      });
+    });
+    check("[" + g.name + "] every finding kind is classified across all profiles" +
+          (unclassified.length ? " (UNCLASSIFIED: " + unclassified.slice(0, 8).join(", ") + ")" : ""),
+          unclassified.length === 0);
+  });
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  try { run(); console.log("[guard-gate-disposition-coverage] OK — " + helpers.getChecks() + " checks passed"); }
+  catch (e) { console.error("FAIL:", e.stack || e); process.exit(1); }
+}

package/lib/vendor/blamejs/test/layer-0-primitives/guard-html.test.js

@@ -233,6 +233,52 @@ function testGuardHtmlSizeCaps() {
         rv.issues.some(function (issue) { return issue.kind === "depth-cap"; }));
 }
 
+// Byte caps measure UTF-8 bytes, not UTF-16 code units — a multibyte
+// payload under the .length cap but over the byte cap must still be
+// refused. "é" is 1 code unit but 2 UTF-8 bytes.
+function testGuardHtmlByteCaps() {
+  var multi = "é".repeat(8);                 // .length 8, 16 UTF-8 bytes
+  check("fixture: multibyte byteLength exceeds .length",
+        multi.length === 8 && Buffer.byteLength(multi, "utf8") === 16);
+
+  // Top-level maxBytes — validate path (tokenizer refusal surfaces as an issue).
+  var rvSize = b.guardHtml.validate(multi, { profile: "strict", maxBytes: 10 });
+  check("maxBytes caps multibyte input over the byte limit (validate)",
+        rvSize.issues.some(function (issue) {
+          return issue.kind === "tokenize-failed" ||
+                 /exceeds maxBytes/.test(issue.snippet || "");
+        }));
+
+  // Top-level maxBytes — sanitize path throws.
+  var threwBytes = null;
+  try { b.guardHtml.sanitize(multi, { profile: "strict", maxBytes: 10 }); }
+  catch (e) { threwBytes = e; }
+  check("maxBytes caps multibyte input over the byte limit (sanitize)",
+        threwBytes && /exceeds maxBytes/.test(threwBytes.message));
+
+  // Multibyte under BOTH the byte cap and .length stays accepted.
+  var smallMulti = "é".repeat(3);            // .length 3, 6 bytes
+  var rvOk = b.guardHtml.validate(smallMulti, { profile: "strict", maxBytes: 10 });
+  check("maxBytes accepts multibyte input under the byte limit",
+        !rvOk.issues.some(function (issue) {
+          return issue.kind === "tokenize-failed" ||
+                 /exceeds maxBytes/.test(issue.snippet || "");
+        }));
+
+  // Per-attribute maxAttrValueBytes measures bytes.
+  var attrVal = "é".repeat(8);               // .length 8, 16 bytes
+  var rvAttr = b.guardHtml.validate('<a title="' + attrVal + '">x</a>',
+                                    { profile: "strict", maxAttrValueBytes: 10 });
+  check("maxAttrValueBytes caps multibyte attribute value over the byte limit",
+        rvAttr.issues.some(function (issue) { return issue.kind === "attr-value-too-large"; }));
+
+  // ASCII attribute value under the byte cap stays accepted.
+  var rvAttrOk = b.guardHtml.validate('<a title="short">x</a>',
+                                      { profile: "strict", maxAttrValueBytes: 10 });
+  check("maxAttrValueBytes accepts attribute value under the byte limit",
+        !rvAttrOk.issues.some(function (issue) { return issue.kind === "attr-value-too-large"; }));
+}
+
 // ---- Sanitize round-trip ----
 
 function testGuardHtmlSanitizeBasic() {
@@ -328,6 +374,18 @@ function testGuardHtmlCompliancePosture() {
         threw && /unknown/.test(threw.message));
 }
 
+// The gdpr posture is the balanced tier (data-minimization strips bytes
+// rather than rejecting the whole value), so it must carry the balanced
+// profile's attribute allowlist — which keeps `href`. The strict tier's
+// 4-attribute allowlist (class/title/lang/dir) drops href; gdpr must not
+// inherit it.
+function testGdprPostureMatchesBalancedTier() {
+  var sanitized = b.guardHtml.sanitize(
+    '<a href="http://x.com/p">L</a>', { compliancePosture: "gdpr" });
+  check("gdpr posture keeps href on <a> (balanced tier, not strict backfill)",
+        sanitized === '<a href="http://x.com/p">L</a>');
+}
+
 // ---- Run all ----
 
 async function run() {
@@ -345,10 +403,12 @@ async function run() {
   testGuardHtmlNullByte();
   testGuardHtmlControlChar();
   testGuardHtmlSizeCaps();
+  testGuardHtmlByteCaps();
   testGuardHtmlSanitizeBasic();
   testGuardHtmlEscape();
   testGuardHtmlBadProfile();
   testGuardHtmlCompliancePosture();
+  testGdprPostureMatchesBalancedTier();
   await testGuardHtmlGateClean();
   await testGuardHtmlGateRefuse();
   await testGuardHtmlGateSanitize();

package/lib/vendor/blamejs/test/layer-0-primitives/guard-image.test.js

@@ -0,0 +1,184 @@
+"use strict";
+/**
+ * guard-image — image content-safety primitive (b.guardImage).
+ *
+ * Covers: surface; registry parity; magic-byte / declared-MIME mismatch;
+ * polyglot rejection; unknown-magic; dimension + frame caps; inspectMagic;
+ * and the container-framing metadata strip (sanitize) — EXIF/XMP out of
+ * JPEG (APP1), text chunks out of PNG (tEXt), comment/app extensions out of
+ * GIF, EXIF/XMP RIFF chunks out of WebP with the VP8X flag bits cleared,
+ * the unsupported-format / malformed refusals, and refuse-before-strip for a
+ * polyglot / mismatch. The strip is byte-surgery over the linear container
+ * framing, not a pixel decoder.
+ */
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+function _has(buf, s) { return buf.toString("latin1").indexOf(s) !== -1; }
+function _code(fn) { try { fn(); return null; } catch (e) { return e && e.code; } }
+
+// ---- fixture builders (kept ASCII; metadata payloads carry a sentinel) ----
+
+function _jpegWithExif() {
+  return Buffer.concat([
+    Buffer.from([0xFF, 0xD8]),                                                   // SOI
+    Buffer.from([0xFF, 0xE1, 0x00, 0x0F]), Buffer.from("Exif  GPSDATA", "latin1"), // APP1 (EXIF) len=15
+    Buffer.from([0xFF, 0xE0, 0x00, 0x10]), Buffer.from("JFIF ABCDEFGHIJ".slice(0, 14), "latin1"), // APP0 (JFIF) len=16
+    Buffer.from([0xFF, 0xD9]),                                                    // EOI
+  ]);
+}
+
+function _pngWithText() {
+  var ihdr = Buffer.concat([Buffer.from([0, 0, 0, 13]), Buffer.from("IHDR", "latin1"),
+    Buffer.from([0, 0, 0, 1, 0, 0, 0, 1, 8, 0, 0, 0, 0]), Buffer.from([1, 2, 3, 4])]);
+  var text = Buffer.concat([Buffer.from([0, 0, 0, 18]), Buffer.from("tEXt", "latin1"),
+    Buffer.from("Comment secret-gps", "latin1"), Buffer.from([9, 9, 9, 9])]);
+  var iend = Buffer.concat([Buffer.from([0, 0, 0, 0]), Buffer.from("IEND", "latin1"),
+    Buffer.from([0xAE, 0x42, 0x60, 0x82])]);
+  return Buffer.concat([Buffer.from([0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A]), ihdr, text, iend]);
+}
+
+function _gifWithComment() {
+  return Buffer.concat([
+    Buffer.from("GIF89a", "latin1"),
+    Buffer.from([1, 0, 1, 0, 0x00, 0, 0]),                                       // LSD 1x1, no GCT
+    Buffer.from([0x21, 0xFE, 0x0A]), Buffer.from("secret-gps", "latin1"), Buffer.from([0x00]), // comment ext
+    Buffer.from([0x2C, 0, 0, 0, 0, 1, 0, 1, 0, 0x00]),                           // image descriptor
+    Buffer.from([0x02, 0x01, 0x44, 0x00]),                                       // LZW min + sub-block + term
+    Buffer.from([0x3B]),                                                         // trailer
+  ]);
+}
+
+function _webpWithExif() {
+  return Buffer.concat([
+    Buffer.from("RIFF", "latin1"), Buffer.from([34, 0, 0, 0]), Buffer.from("WEBP", "latin1"),
+    Buffer.from("VP8 ", "latin1"), Buffer.from([4, 0, 0, 0]), Buffer.from([1, 2, 3, 4]),
+    Buffer.from("EXIF", "latin1"), Buffer.from([10, 0, 0, 0]), Buffer.from("secret-gps", "latin1"),
+  ]);
+}
+
+function testGuardImageSurface() {
+  check("guardImage is an object",              typeof b.guardImage === "object");
+  check("guardImage.NAME === 'image'",          b.guardImage.NAME === "image");
+  check("guardImage.PROFILES has strict",       !!b.guardImage.PROFILES["strict"]);
+  check("guardImage.COMPLIANCE_POSTURES gdpr",  !!b.guardImage.COMPLIANCE_POSTURES["gdpr"]);
+  check("guardImage.validate is a function",    typeof b.guardImage.validate === "function");
+  check("guardImage.sanitize is a function",    typeof b.guardImage.sanitize === "function");
+  check("guardImage.gate is a function",        typeof b.guardImage.gate === "function");
+  check("guardImage.inspectMagic is a function", typeof b.guardImage.inspectMagic === "function");
+  check("frameworkError.GuardImageError exposed", typeof b.frameworkError.GuardImageError === "function");
+}
+
+function testGuardImageRegistryParity() {
+  check("guardImage registered in guardAll",
+    b.guardAll.allGuards().some(function (g) { return (g.name || g.NAME) === "image"; }));
+}
+
+function testInspectMagic() {
+  check("inspectMagic detects png",
+    b.guardImage.inspectMagic(Buffer.from([0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A])).indexOf("image/png") !== -1);
+  check("inspectMagic empty on garbage",
+    b.guardImage.inspectMagic(Buffer.from([0x00, 0x01, 0x02])).length === 0);
+}
+
+function testValidateMismatchAndPolyglot() {
+  var rv = b.guardImage.validate({ bytes: Buffer.from([0xFF, 0xD8, 0xFF]), declaredMime: "image/png" }, { profile: "strict" });
+  check("mismatch: validate ok:false", rv.ok === false);
+  check("mismatch: kind reported", rv.issues.some(function (i) { return i.kind === "mime-mismatch"; }));
+}
+
+// ---- the real metadata strip ----
+
+function testStripJpegExif() {
+  var src = _jpegWithExif();
+  var out = b.guardImage.sanitize({ bytes: src });
+  check("jpeg: EXIF (APP1) payload removed", !_has(out.bytes, "GPSDATA") && !_has(out.bytes, "Exif"));
+  check("jpeg: JFIF (APP0) preserved",       _has(out.bytes, "JFIF"));
+  check("jpeg: output shrank",               out.bytes.length < src.length);
+  check("jpeg: SOI + EOI intact",
+    out.bytes[0] === 0xFF && out.bytes[1] === 0xD8 &&
+    out.bytes[out.bytes.length - 2] === 0xFF && out.bytes[out.bytes.length - 1] === 0xD9);
+  check("jpeg: bag is a fresh object (bytes replaced)", typeof out === "object" && Buffer.isBuffer(out.bytes));
+}
+
+function testStripPngText() {
+  var out = b.guardImage.sanitize({ bytes: _pngWithText() });
+  check("png: tEXt payload removed",   !_has(out.bytes, "secret-gps"));
+  check("png: IHDR preserved",         _has(out.bytes, "IHDR"));
+  check("png: IEND preserved",         _has(out.bytes, "IEND"));
+  check("png: signature intact",       out.bytes[0] === 0x89 && out.bytes[1] === 0x50);
+}
+
+function testStripGifComment() {
+  var out = b.guardImage.sanitize({ bytes: _gifWithComment() });
+  check("gif: comment payload removed", !_has(out.bytes, "secret-gps"));
+  check("gif: header preserved",        _has(out.bytes, "GIF89a"));
+  check("gif: trailer preserved",       out.bytes[out.bytes.length - 1] === 0x3B);
+}
+
+function testStripWebpExif() {
+  var out = b.guardImage.sanitize({ bytes: _webpWithExif() });
+  check("webp: EXIF payload removed",   !_has(out.bytes, "secret-gps"));
+  check("webp: VP8 chunk preserved",    _has(out.bytes, "VP8 "));
+  check("webp: RIFF size rewritten",    out.bytes.readUInt32LE(4) === 16);
+}
+
+function testStripWebpVp8xFlags() {
+  var webpx = Buffer.concat([
+    Buffer.from("RIFF", "latin1"), Buffer.from([0, 0, 0, 0]), Buffer.from("WEBP", "latin1"),
+    Buffer.from("VP8X", "latin1"), Buffer.from([10, 0, 0, 0]), Buffer.from([0x0C, 0, 0, 0, 0, 0, 0, 0, 0, 0]),
+    Buffer.from("EXIF", "latin1"), Buffer.from([4, 0, 0, 0]), Buffer.from([9, 9, 9, 9]),
+  ]);
+  var out = b.guardImage.sanitize({ bytes: webpx });
+  check("webp: VP8X EXIF+XMP flag bits cleared", (out.bytes[20] & 0x0C) === 0);
+}
+
+function testRefuseBeforeStrip() {
+  // A MIME-mismatch / polyglot must refuse, never strip-and-serve.
+  check("mismatch refuses (not strips)",
+    _code(function () { b.guardImage.sanitize({ bytes: _jpegWithExif(), declaredMime: "image/png" }, { profile: "strict" }); }) === "image.mime-mismatch");
+}
+
+function testRefuseUnsupportedFormat() {
+  var tiff = Buffer.from([0x49, 0x49, 0x2A, 0x00, 8, 0, 0, 0]);
+  check("tiff: refuse unsupported-format",
+    _code(function () { b.guardImage.sanitize({ bytes: tiff }); }) === "image.sanitize-unsupported-format");
+}
+
+function testRefuseMalformed() {
+  var bad = Buffer.from([0xFF, 0xD8, 0xFF, 0xE1, 0x00, 0xFF]);                    // APP1 length overruns
+  check("malformed: refuse, not half-strip",
+    _code(function () { b.guardImage.sanitize({ bytes: bad }); }) === "image.sanitize-malformed");
+}
+
+function testBmpPassthrough() {
+  // BMP carries no text/EXIF metadata container — pass through unchanged.
+  var bmp = Buffer.from([0x42, 0x4D, 0x10, 0x00, 0x00, 0x00, 0, 0, 0, 0, 0, 0, 0, 0]);
+  var out = b.guardImage.sanitize({ bytes: bmp });
+  check("bmp: passes through (no metadata container)", out.bytes === bmp);
+}
+
+function run() {
+  testGuardImageSurface();
+  testGuardImageRegistryParity();
+  testInspectMagic();
+  testValidateMismatchAndPolyglot();
+  testStripJpegExif();
+  testStripPngText();
+  testStripGifComment();
+  testStripWebpExif();
+  testStripWebpVp8xFlags();
+  testRefuseBeforeStrip();
+  testRefuseUnsupportedFormat();
+  testRefuseMalformed();
+  testBmpPassthrough();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  try { run(); console.log("[guard-image] OK — " + helpers.getChecks() + " checks passed"); }
+  catch (e) { console.error("FAIL:", e.stack || e); process.exit(1); }
+}