@blamejs/blamejs-shop 0.5.12 → 0.5.13

package/lib/vendor/blamejs/test/layer-0-primitives/codepoint-class.test.js

@@ -119,6 +119,14 @@ function testPublicSurface() {
   check("b.codepointClass.decodeNumericEntities",
         b.codepointClass.decodeNumericEntities("javascript:") === "javascript:" &&
         b.codepointClass.decodeNumericEntities("&#106avascript:") === "javascript:");
+  check("b.codepointClass.decodeMarkupEntities",
+        b.codepointClass.decodeMarkupEntities("expression(") === "expression(" &&
+        b.codepointClass.decodeMarkupEntities("behavior:url(") === "behavior:url(" &&
+        b.codepointClass.decodeMarkupEntities("a	b").charCodeAt(1) === 0x09);
+  check("b.codepointClass.stripUrlSchemeWhitespace",
+        b.codepointClass.stripUrlSchemeWhitespace("  javascript:x") === "javascript:x" &&
+        b.codepointClass.stripUrlSchemeWhitespace(
+          "java" + b.codepointClass.fromCp(0x09) + "script:") === "javascript:");
   // The remaining catalog constants the issue lists are reachable.
   check("b.codepointClass.BOM_CHAR",
         typeof b.codepointClass.BOM_CHAR === "string" && b.codepointClass.BOM_CHAR.charCodeAt(0) === 0xFEFF);

package/lib/vendor/blamejs/test/layer-0-primitives/compliance-ai-act.test.js

@@ -54,6 +54,28 @@ function run() {
   });
   check("prohibited.classify: social-scoring caught",  hits1.indexOf("social-scoring") !== -1);
 
+  // Art. 5(1)(c) of the ADOPTED Regulation (EU) 2024/1689 prohibits social
+  // scoring by ANY actor. The "by public authorities or on their behalf"
+  // limitation present in the 2021 Commission proposal was removed from the
+  // final text; the catalog's own description already reflects that (it does
+  // not mention public authorities). A private-company social-scoring system
+  // must therefore classify as prohibited, not fall through to minimal-risk.
+  var hitsPriv = aiAct.prohibited.classify({
+    purpose: "social-scoring", deployerType: "private-company",
+  });
+  check("prohibited.classify: private-actor social-scoring caught",
+        hitsPriv.indexOf("social-scoring") !== -1);
+  var hitsNoDeployer = aiAct.prohibited.classify({ purpose: "social-scoring" });
+  check("prohibited.classify: social-scoring caught without deployerType",
+        hitsNoDeployer.indexOf("social-scoring") !== -1);
+  var assessPrivSocial = aiAct.classify({
+    purpose: "social-scoring", deployerType: "private-company",
+  });
+  check("classify: private-actor social-scoring → prohibited",
+        assessPrivSocial.tier === "prohibited");
+  check("classify: private-actor social-scoring cites Art. 5",
+        assessPrivSocial.legalReference[0] && assessPrivSocial.legalReference[0].indexOf("Art. 5") !== -1);
+
   var hits2 = aiAct.prohibited.classify({
     builds: "facial-recognition-db", scrapesUntargeted: true,
   });
@@ -182,6 +204,25 @@ function run() {
   check("transparency.htmlBanner: HTML element",        html.indexOf('<div ') === 0);
   check("transparency.htmlBanner: data attr",           html.indexOf('data-blamejs-aiAct="Art. 50(2)"') !== -1);
 
+  // htmlBanner serializes the operator-supplied `lang` into a double-quoted
+  // HTML attribute. lang is free-form (a request locale / Accept-Language /
+  // query param in a server-rendered banner), so a value carrying a double
+  // quote must be entity-escaped or it breaks out of the attribute and injects
+  // active content (reflected XSS). Only the element TEXT was escaped before;
+  // the attribute values were concatenated raw.
+  var xssLang = t.htmlBanner({ kind: "ai-interaction", lang: '"><script>alert(1)</script><x y="' });
+  check("transparency.htmlBanner: lang cannot break out of attribute",
+        xssLang.indexOf("<script>alert(1)</script>") === -1);
+  check("transparency.htmlBanner: lang quote is entity-escaped",
+        xssLang.indexOf("&quot;") !== -1);
+  var xssHandler = t.htmlBanner({ kind: "ai-interaction", lang: 'en" onmouseover=alert(document.cookie) x="' });
+  // The handler substring survives as inert text INSIDE the quoted value; the
+  // invariant is that no RAW quote precedes it (which would close the attribute
+  // and make onmouseover a real event handler).
+  check("transparency.htmlBanner: lang cannot inject an event handler",
+        xssHandler.indexOf('"en" onmouseover') === -1 &&
+        xssHandler.indexOf('en&quot; onmouseover') !== -1);
+
   var w = t.watermark({ mediaKind: "image", modelId: "myco/img-gen-3", modelVersion: "v3.1" });
   check("transparency.watermark: manifest",             w.aiActArticle === "Art. 50(2)");
   check("transparency.watermark: modelId",              w.modelId === "myco/img-gen-3");
@@ -193,6 +234,24 @@ function run() {
   var jl = t.jsonLdDisclosure({ mediaKind: "audio", modelId: "myco/voice-gen-2" });
   check("transparency.jsonLdDisclosure: tag",            jl.indexOf('<script type="application/ld+json"') === 0);
 
+  // jsonLdDisclosure embeds the operator-supplied watermark manifest via
+  // JSON.stringify inside a <script> element. Raw JSON.stringify does not
+  // escape "</script>" (or "<"), so a model id / deployer name carrying that
+  // sequence terminates the script block early and injects active markup. The
+  // HTML parser ends a <script> at the first "</script>" regardless of the
+  // type="application/ld+json" attribute, so the injected element executes.
+  var jlXss = t.jsonLdDisclosure({
+    mediaKind: "image",
+    modelId:   "x</script><script>alert(document.domain)</script>",
+  });
+  check("transparency.jsonLdDisclosure: cannot break out of <script>",
+        jlXss.indexOf("</script><script>alert(document.domain)</script>") === -1);
+  check("transparency.jsonLdDisclosure: '<' is unicode-escaped in the payload",
+        jlXss.indexOf("\\u003c/script\\u003e") !== -1);
+  // Exactly one real closing </script> tag (the element terminator) survives.
+  check("transparency.jsonLdDisclosure: single real closing tag",
+        jlXss.split("</script>").length === 2);
+
   var meta = t.metaTags({ kind: "deep-fake", policyUri: "https://example.com/ai-policy" });
   check("transparency.metaTags: notice",                meta.indexOf('<meta name="ai-act-notice"') !== -1);
   check("transparency.metaTags: article",               meta.indexOf('<meta name="ai-act-article"') !== -1);
@@ -776,6 +835,141 @@ function run() {
       });
     }, /copVersion/);
 
+  // ---- full-dotted-path drive: FRIA (Art. 27), GPAI training-data
+  // summary (Art. 53(1)(d)), COP adherence form + signed-declaration
+  // verify. Each primitive is exercised through the real
+  // b.compliance.aiAct.* consumer path with a valid input plus a
+  // missing-required-field typed refusal. ----
+
+  // b.compliance.aiAct.fundamentalRightsImpactAssessment — Art. 27 FRIA
+  var friaDoc = b.compliance.aiAct.fundamentalRightsImpactAssessment({
+    systemId:          "credit-scoring-v3",
+    systemDescription: { purpose: "loan approval / creditworthiness" },
+    deploymentContext: { purpose: "loan approval", sector: "financial",
+                         geography: "EU", scale: "1M decisions/year" },
+    affectedPersons:   { categories: ["EU consumers"], estimatedCount: 1000000 },
+    risksToFundamentalRights: ["discriminatory denial", "right to explanation"],
+    mitigations:       ["bias audit every 6 months", "human review threshold"],
+    humanOversight:    { roles: ["credit officer"], escalationPath: "ombudsman" },
+    reviewCadence:     "semi-annual",
+  });
+  check("fria: Article 27 document",                    friaDoc.article.indexOf("Article 27") !== -1);
+  check("fria: systemId echoed",                        friaDoc.systemId === "credit-scoring-v3");
+  check("fria: risks carried through",                  friaDoc.risks.length === 2);
+  check("fria: mitigations carried through",            friaDoc.mitigations.length === 2);
+  check("fria: humanOversight carried through",         friaDoc.humanOversight.escalationPath === "ombudsman");
+  check("fria: reviewCadence honored",                  friaDoc.reviewCadence === "semi-annual");
+  check("fria: classification derived from systemDescription",
+        friaDoc.classification !== null && typeof friaDoc.classification.tier === "string");
+  check("fria: operator-must-notify status",            friaDoc.notificationStatus === "operator-must-notify");
+
+  // Defaults when optional context + systemDescription are omitted
+  var friaMin = b.compliance.aiAct.fundamentalRightsImpactAssessment({ systemId: "s1" });
+  check("fria: classification null without systemDescription", friaMin.classification === null);
+  check("fria: reviewCadence defaults to annual",       friaMin.reviewCadence === "annual");
+
+  rejects("fria: missing systemId refused",
+    function () { b.compliance.aiAct.fundamentalRightsImpactAssessment({}); },
+    /systemId must be a non-empty string/);
+  rejects("fria: missing opts refused",
+    function () { b.compliance.aiAct.fundamentalRightsImpactAssessment(); },
+    /opts must be an object/);
+  check("fria: missing opts is a typed ComplianceError with descriptive message",
+    (function () {
+      try { b.compliance.aiAct.fundamentalRightsImpactAssessment({}); return false; }
+      catch (e) { return e.name === "ComplianceError" && e.code === "compliance-ai-act/no-system-id" &&
+                         /systemId must be a non-empty string/.test(e.message); }
+    })());
+
+  // b.compliance.aiAct.gpai.trainingDataSummary — Art. 53(1)(d) template
+  var tds = b.compliance.aiAct.gpai.trainingDataSummary({
+    modelId:        "acme-llm-7b",
+    modelVersion:   "1.0",
+    provider:       { name: "Acme AI", address: "1 St", contact: "ai@acme.example" },
+    dataCategories: ["web-crawl", "books", "code"],
+    modalities:     ["text"],
+    sources: [
+      { identifier: "CommonCrawl-2024", type: "web-crawl", licenseStatus: "permitted" },
+    ],
+    biasMitigation: { methodsApplied: ["demographic-balance"], auditCadence: "quarterly" },
+  });
+  check("trainingDataSummary: Article 53(1)(d)",        tds.article.indexOf("Article 53(1)(d)") !== -1);
+  check("trainingDataSummary: AI Office template",      tds.template.indexOf("AI Office") !== -1);
+  check("trainingDataSummary: modelId echoed",          tds.modelId === "acme-llm-7b");
+  check("trainingDataSummary: modalities carried",      tds.modalities.length === 1 && tds.modalities[0] === "text");
+  check("trainingDataSummary: source normalized",       tds.sources[0].identifier === "CommonCrawl-2024");
+  check("trainingDataSummary: source defaults applied", tds.sources[0].url === null && tds.sources[0].size === null);
+  check("trainingDataSummary: licenseStatus preserved", tds.sources[0].licenseStatus === "permitted");
+  check("trainingDataSummary: copyrightStatus defaulted", tds.copyrightStatus.respectsRightReservations === null);
+  check("trainingDataSummary: well-known publish note", tds.note.indexOf("well-known") !== -1);
+
+  rejects("trainingDataSummary: missing modelId refused",
+    function () { b.compliance.aiAct.gpai.trainingDataSummary({ modelVersion: "1.0" }); },
+    /modelId must be a non-empty string/);
+  rejects("trainingDataSummary: missing opts refused",
+    function () { b.compliance.aiAct.gpai.trainingDataSummary(); },
+    /opts must be an object/);
+  check("trainingDataSummary: missing modelId is a typed ComplianceError with descriptive message",
+    (function () {
+      try { b.compliance.aiAct.gpai.trainingDataSummary({ modelVersion: "1.0" }); return false; }
+      catch (e) { return e.name === "ComplianceError" && e.code === "compliance-ai-act/no-model-id" &&
+                         /modelId must be a non-empty string/.test(e.message); }
+    })());
+
+  // b.compliance.aiAct.gpai.adherenceForm — derived Art. 53 obligation set
+  var dotEvidence = b.crypto.sha3Hash("annex-xi-technical-documentation-v1");
+  var dotForm = b.compliance.aiAct.gpai.adherenceForm({
+    modelId: "dotted-llm", modelVersion: "2.0",
+    commitments: [{ article: "Art. 53(1)(a)", statement: "Annex XI docs maintained", evidenceHash: dotEvidence }],
+  });
+  check("adherenceForm: derives 4 Art. 53 obligations", dotForm.commitments.length === 4);
+  check("adherenceForm: not systemic by default",       dotForm.isSystemicRisk === false);
+  check("adherenceForm: articles Art. 53 only",         dotForm.articles.length === 1 && dotForm.articles[0] === "Art. 53");
+  check("adherenceForm: bound commitment evidenced",    dotForm.commitments[0].evidenced === true);
+  check("adherenceForm: unsupplied obligation surfaced", dotForm.commitments[1].evidenced === false);
+
+  rejects("adherenceForm: missing modelVersion refused",
+    function () {
+      b.compliance.aiAct.gpai.adherenceForm({
+        modelId: "m",
+        commitments: [{ article: "Art. 53(1)(a)", statement: "x", evidenceHash: dotEvidence }],
+      });
+    }, /modelVersion/);
+  rejects("adherenceForm: missing opts refused",
+    function () { b.compliance.aiAct.gpai.adherenceForm(); },
+    /must be an object|opts/);
+
+  // b.compliance.aiAct.gpai.verifyAdherence — signed round-trip verdict.
+  // The verify contract RETURNS a verdict { valid, adherence, reason } and
+  // never throws, so its "refusals" are verdicts, not exceptions.
+  var dotPair = b.crypto.generateSigningKeyPair("ml-dsa-87");
+  var dotArticles = ["Art. 53(1)(a)", "Art. 53(1)(b)", "Art. 53(1)(c)", "Art. 53(1)(d)"];
+  var dotCommitments = dotArticles.map(function (a) {
+    return { article: a, statement: "evidence for " + a, evidenceHash: dotEvidence };
+  });
+  var dotEnv = b.compliance.aiAct.gpai.declareAdherence({
+    modelId: "dotted-llm", modelVersion: "2.0",
+    commitments: dotCommitments,
+    privateKeyPem: dotPair.privateKey,
+  });
+  var dotVerdict = b.compliance.aiAct.gpai.verifyAdherence(dotEnv, dotPair.publicKey);
+  check("verifyAdherence: valid round-trip",            dotVerdict.valid === true);
+  check("verifyAdherence: reason null on success",      dotVerdict.reason === null);
+  check("verifyAdherence: surfaces adherence form",     dotVerdict.adherence.modelId === "dotted-llm");
+
+  // Missing required public key → typed verdict refusal (never throws)
+  var dotNoKeyVerdict = b.compliance.aiAct.gpai.verifyAdherence(dotEnv);
+  check("verifyAdherence: missing public key → verdict refusal",
+        dotNoKeyVerdict.valid === false && dotNoKeyVerdict.reason === "public-key-required" &&
+        dotNoKeyVerdict.adherence === null);
+
+  // Wrong signing key → signature-invalid verdict
+  var dotOtherPair = b.crypto.generateSigningKeyPair("ml-dsa-87");
+  var dotBadVerdict = b.compliance.aiAct.gpai.verifyAdherence(dotEnv, dotOtherPair.publicKey);
+  check("verifyAdherence: wrong key → signature-invalid verdict",
+        dotBadVerdict.valid === false && dotBadVerdict.reason === "signature-invalid" &&
+        dotBadVerdict.adherence === null);
+
   console.log("OK — compliance-ai-act tests");
 }
 

package/lib/vendor/blamejs/test/layer-0-primitives/compliance-lifecycle-proto-key.test.js

@@ -0,0 +1,104 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * Regression: compliance lifecycle catalogs indexed by an operator-supplied
+ * string must resolve only OWN keys. A regime / posture whose value collides
+ * with an Object.prototype member ("valueOf", "toString", "constructor",
+ * "hasOwnProperty", ...) previously resolved to the inherited function
+ * instead of falling back / throwing:
+ *
+ *   - b.incident.report.open({ regime: "valueOf" }) picked up
+ *     Object.prototype.valueOf as the deadline table -> every dueBy became
+ *     NaN -> a filing 100 days past the real 30-day final wall was recorded
+ *     late: false and status().late.final stayed 0 (a missed regulatory
+ *     deadline reported as met).
+ *   - b.retention.complianceFloor("valueOf", ttl) returned a function
+ *     instead of throwing retention/unknown-posture (the config-time typo
+ *     guard silently failed open for these ~7 values).
+ */
+var helpers = require("../helpers");
+var b = helpers.b;
+var check = helpers.check;
+
+var PROTO_KEYS = ["valueOf", "toString", "constructor", "hasOwnProperty",
+                  "isPrototypeOf", "propertyIsEnumerable", "toLocaleString"];
+
+async function run() {
+  var HOUR = b.constants.TIME.hours(1);
+  var H24 = b.constants.TIME.hours(24);
+  var H72 = b.constants.TIME.hours(72);
+  var D30 = b.constants.TIME.days(30);
+
+  // ---- incident.report: proto-key regime must fall back to DEFAULT_DEADLINES ----
+  for (var i = 0; i < PROTO_KEYS.length; i++) {
+    var regime = PROTO_KEYS[i];
+    var ir = b.incident.report.create({ audit: false });
+    var rec = await ir.open({ regime: regime, detectedAt: 0 });
+    check("incident regime '" + regime + "' initial is finite wall not NaN",
+      rec.dueBy.initial === H24);
+    check("incident regime '" + regime + "' intermediate is finite wall not NaN",
+      rec.dueBy.intermediate === H72);
+    check("incident regime '" + regime + "' final is finite wall not NaN",
+      rec.dueBy.final === D30);
+  }
+
+  // A genuinely-late FINAL filing under a proto-key regime is flagged late.
+  var lateIr = b.incident.report.create({
+    audit: false,
+    now:   function () { return b.constants.TIME.days(100); },   // 100d >> 30d final wall
+  });
+  var lateRec = await lateIr.open({ regime: "valueOf", detectedAt: 0 });
+  var filed = await lateIr.recordFinal(lateRec.id, { note: "100d late" });
+  check("incident: 100-days-late final is late:true (not reported as met)",
+    filed.stages.final.late === true);
+  check("incident: late final lateBy is the real overrun",
+    filed.stages.final.lateBy === b.constants.TIME.days(100) - D30);
+  check("incident: status counts the late final",
+    lateIr.status().late.final === 1);
+
+  // Control: a benign unknown regime still falls back (fallback contract intact).
+  var ctlIr = b.incident.report.create({ audit: false });
+  var ctlRec = await ctlIr.open({ regime: "ccpa-not-a-known-regime", detectedAt: 0 });
+  check("incident: benign unknown regime falls back to 30d final",
+    ctlRec.dueBy.final === D30);
+
+  // Regression: real regimes keep their statutory walls (DORA 4h initial).
+  var doraIr = b.incident.report.create({ audit: false });
+  var doraRec = await doraIr.open({ regime: "dora", detectedAt: 0 });
+  check("incident: dora regime keeps 4h initial wall",
+    doraRec.dueBy.initial === 4 * HOUR);
+
+  // ---- retention.complianceFloor: proto-key posture must throw, not return a fn ----
+  for (var j = 0; j < PROTO_KEYS.length; j++) {
+    var posture = PROTO_KEYS[j];
+    var threw = false;
+    var ret;
+    try { ret = b.retention.complianceFloor(posture, 1000); }
+    catch (e) { threw = e && e.code === "retention/unknown-posture"; }
+    check("retention.complianceFloor('" + posture + "') throws unknown-posture (not a function)",
+      threw === true && ret === undefined);
+  }
+
+  // Control + regression: real posture returns its floor; a plain typo throws.
+  check("retention.complianceFloor('hipaa') returns 6-year floor",
+    b.retention.complianceFloor("hipaa") === b.constants.TIME.days(365 * 6));
+  var typoThrew = false;
+  try { b.retention.complianceFloor("hipaa-typo", 1000); }
+  catch (e2) { typoThrew = e2 && e2.code === "retention/unknown-posture"; }
+  check("retention.complianceFloor plain typo still throws", typoThrew === true);
+
+  // applyPosture with a proto-key posture must not inherit a function floor.
+  var ap = b.retention.applyPosture("valueOf");
+  check("retention.applyPosture('valueOf') floorMs is null (no inherited fn)",
+    ap !== null ? ap.floorMs === null : true);
+  b.retention.applyPosture("");   // reset active posture
+
+  console.log("OK — compliance lifecycle proto-key tests");
+}
+
+module.exports = { run: run };
+if (require.main === module) {
+  run().then(function () { process.exit(0); })
+       .catch(function (e) { console.error(e); process.exit(1); });
+}

package/lib/vendor/blamejs/test/layer-0-primitives/compliance-sanctions.test.js

@@ -681,6 +681,249 @@ function testFetcherValidation() {
   check("fetcher.create: missing fetch throws", threwBadFetch);
 }
 
+// ---- Error/edge coverage ----
+
+function _threwCode(fn, code) {
+  try { fn(); return false; }
+  catch (e) { return e && e.code === code; }
+}
+
+// parseOfacCsvRow — exercise the missing-field alternates (Program /
+// Country / Publish_Date absent → defaults) and the Remarks-present
+// consequent, plus every SDN_Type → canonical mapping.
+function testParseOfacCsvRowEdge() {
+  // Minimal row: no Program/Country/Publish_Date/Remarks, no SDN_Type
+  var min = sanctions.parseOfacCsvRow({ ent_num: 5, SDN_Name: "MIN GUY" });
+  check("parseOfacCsvRow min: no Program → []",
+        Array.isArray(min.programs) && min.programs.length === 0);
+  check("parseOfacCsvRow min: no Country → null", min.country === null);
+  check("parseOfacCsvRow min: no Publish_Date → null", min.listedAt === null);
+  check("parseOfacCsvRow min: absent SDN_Type → default entity",
+        min.type === "entity");
+  check("parseOfacCsvRow min: no Remarks → null", min.remarks === null);
+
+  // Remarks present → the String(row.Remarks) consequent
+  var rem = sanctions.parseOfacCsvRow({
+    ent_num: 6, SDN_Name: "REM GUY", SDN_Type: "entity", Remarks: "watchlist note",
+  });
+  check("parseOfacCsvRow: Remarks preserved", rem.remarks === "watchlist note");
+  check("parseOfacCsvRow: SDN_Type entity", rem.type === "entity");
+
+  // Vessel / aircraft / unknown SDN_Type mappings
+  check("parseOfacCsvRow: SDN_Type vessel",
+        sanctions.parseOfacCsvRow({ ent_num: 7, SDN_Name: "BOAT", SDN_Type: "vessel" }).type === "vessel");
+  check("parseOfacCsvRow: SDN_Type aircraft",
+        sanctions.parseOfacCsvRow({ ent_num: 8, SDN_Name: "PLANE", SDN_Type: "aircraft" }).type === "aircraft");
+  check("parseOfacCsvRow: unknown SDN_Type → entity default",
+        sanctions.parseOfacCsvRow({ ent_num: 9, SDN_Name: "X", SDN_Type: "warlord" }).type === "entity");
+
+  // Non-object + name-without-ent_num guards
+  check("parseOfacCsvRow: non-object returns null",
+        sanctions.parseOfacCsvRow("not-an-object") === null);
+  check("parseOfacCsvRow: name without ent_num returns null",
+        sanctions.parseOfacCsvRow({ SDN_Name: "NoNum" }) === null);
+}
+
+// parseOfacAliasRow — the alt-names shim had zero tests.
+function testParseOfacAliasRow() {
+  check("parseOfacAliasRow: null returns null",
+        sanctions.parseOfacAliasRow(null) === null);
+  check("parseOfacAliasRow: non-object returns null",
+        sanctions.parseOfacAliasRow("nope") === null);
+  check("parseOfacAliasRow: missing ent_num returns null",
+        sanctions.parseOfacAliasRow({ alt_name: "AKA" }) === null);
+  check("parseOfacAliasRow: missing alt_name returns null",
+        sanctions.parseOfacAliasRow({ ent_num: 5 }) === null);
+
+  var full = sanctions.parseOfacAliasRow({
+    ent_num: 5, alt_type: "fka", alt_name: "  JOHNNY SMITH  ", alt_remarks: "former",
+  });
+  check("parseOfacAliasRow: entId formed", full.entId === "OFAC-5");
+  check("parseOfacAliasRow: altType preserved", full.altType === "fka");
+  check("parseOfacAliasRow: altName trimmed", full.altName === "JOHNNY SMITH");
+  check("parseOfacAliasRow: remarks preserved", full.remarks === "former");
+
+  // Defaults: no alt_type → "aka"; no alt_remarks → null
+  var defd = sanctions.parseOfacAliasRow({ ent_num: 6, alt_name: "J SMITH" });
+  check("parseOfacAliasRow: default altType aka", defd.altType === "aka");
+  check("parseOfacAliasRow: default remarks null", defd.remarks === null);
+}
+
+function testMergeAliasesEdge() {
+  check("mergeAliases: non-array entries → []",
+        (function () {
+          var r = sanctions.mergeAliases("nope", []);
+          return Array.isArray(r) && r.length === 0;
+        })());
+  check("mergeAliases: non-array aliasRows → entries unchanged",
+        (function () {
+          var entries = [{ id: "A", aliases: [] }];
+          var r = sanctions.mergeAliases(entries, "nope");
+          return r === entries && r.length === 1;
+        })());
+  // Alias pointing at an unknown entId is a no-op (never crashes,
+  // never mis-attributes to a different entry)
+  check("mergeAliases: unknown entId is a no-op",
+        (function () {
+          var entries = [{ id: "A", aliases: [] }];
+          sanctions.mergeAliases(entries, [{ entId: "ZZZ", altName: "GHOST" }]);
+          return entries[0].aliases.length === 0;
+        })());
+}
+
+// parseEuCslEntry — uppercase field variants, single-object nameAlias,
+// empty-name fallbacks, and every subjectType mapping.
+function testParseEuCslEntryEdge() {
+  check("parseEuCslEntry: null returns null", sanctions.parseEuCslEntry(null) === null);
+  check("parseEuCslEntry: non-object returns null", sanctions.parseEuCslEntry("x") === null);
+
+  // Uppercase variants (NAMEALIAS / LOGICALID / SUBJECTTYPE / WHOLENAME),
+  // no regulation/country/designationDate → default alternates
+  var up = sanctions.parseEuCslEntry({
+    NAMEALIAS: [{ WHOLENAME: "UPPER BANK" }, { WHOLENAME: "UPPER ALIAS" }],
+    LOGICALID: 42,
+    SUBJECTTYPE: "person",
+  });
+  check("parseEuCslEntry upper: id via LOGICALID", up.id === "EU-CSL-42");
+  check("parseEuCslEntry upper: primary via WHOLENAME", up.primaryName === "UPPER BANK");
+  check("parseEuCslEntry upper: alias via WHOLENAME",
+        up.aliases.length === 1 && up.aliases[0] === "UPPER ALIAS");
+  check("parseEuCslEntry upper: SUBJECTTYPE person → individual", up.type === "individual");
+  check("parseEuCslEntry upper: no regulation → []", up.programs.length === 0);
+  check("parseEuCslEntry upper: no country → null", up.country === null);
+  check("parseEuCslEntry upper: no designationDate → null", up.listedAt === null);
+
+  // No nameAlias at all → null (empty name-list guard)
+  check("parseEuCslEntry: no names → null",
+        sanctions.parseEuCslEntry({ logicalId: 7 }) === null);
+
+  // Single (non-array) nameAlias object → wrapped; no id fields → "EU-CSL-"
+  var solo = sanctions.parseEuCslEntry({ nameAlias: { wholeName: "Solo Vessel" }, subjectType: "vessel" });
+  check("parseEuCslEntry solo: non-array nameAlias wrapped", solo.primaryName === "Solo Vessel");
+  check("parseEuCslEntry solo: no id fields → EU-CSL-", solo.id === "EU-CSL-");
+  check("parseEuCslEntry solo: subjectType vessel", solo.type === "vessel");
+
+  // Empty name objects → "" fallbacks; absent subjectType → default entity
+  var empties = sanctions.parseEuCslEntry({ nameAlias: [{}, {}], logicalId: 9 });
+  check("parseEuCslEntry empties: primary → ''", empties.primaryName === "");
+  check("parseEuCslEntry empties: blank aliases filtered out", empties.aliases.length === 0);
+  check("parseEuCslEntry empties: absent subjectType → entity default", empties.type === "entity");
+
+  // subjectType aircraft mapping
+  check("parseEuCslEntry: subjectType aircraft",
+        sanctions.parseEuCslEntry({ nameAlias: [{ wholeName: "Y" }], subjectType: "aircraft" }).type === "aircraft");
+}
+
+// parseUn1267Entry — lowercase/FIRST_NAME name fallbacks, empty-name
+// null, ALIASES array branch, DATAID/empty id fallbacks, Entity type,
+// missing LISTED_ON.
+function testParseUn1267EntryEdge() {
+  check("parseUn1267Entry: null returns null", sanctions.parseUn1267Entry(null) === null);
+  check("parseUn1267Entry: non-object returns null", sanctions.parseUn1267Entry("x") === null);
+
+  var lower = sanctions.parseUn1267Entry({ name: "lower guy", REFERENCE_NUMBER: "R1" });
+  check("parseUn1267Entry: lowercase name fallback", lower.primaryName === "lower guy");
+
+  var first = sanctions.parseUn1267Entry({ FIRST_NAME: "First Only", REFERENCE_NUMBER: "R2" });
+  check("parseUn1267Entry: FIRST_NAME fallback", first.primaryName === "First Only");
+
+  check("parseUn1267Entry: no name fields → null",
+        sanctions.parseUn1267Entry({ REFERENCE_NUMBER: "R3" }) === null);
+
+  var arr = sanctions.parseUn1267Entry({ NAME: "Guy", ALIASES: ["A1", "A2"], REFERENCE_NUMBER: "R4" });
+  check("parseUn1267Entry: ALIASES array branch", arr.aliases.length === 2 && arr.aliases[0] === "A1");
+
+  var byData = sanctions.parseUn1267Entry({ NAME: "Guy2", DATAID: "D9" });
+  check("parseUn1267Entry: id via DATAID", byData.id === "UN-1267-D9");
+  check("parseUn1267Entry: no LISTED_ON → null", byData.listedAt === null);
+
+  var noId = sanctions.parseUn1267Entry({ NAME: "Guy3" });
+  check("parseUn1267Entry: no id fields → UN-1267-", noId.id === "UN-1267-");
+
+  var ent = sanctions.parseUn1267Entry({ NAME: "Some Corp", NAME_TYPE: "Entity", REFERENCE_NUMBER: "R5" });
+  check("parseUn1267Entry: NAME_TYPE Entity → entity", ent.type === "entity");
+}
+
+// _normalizeEntry — driven through create(): empty primaryName, non-array
+// aliases/programs, falsy type, dateOfBirth as array vs scalar string.
+function testNormalizeEntryEdge() {
+  var screener = sanctions.create({
+    entries: [
+      { id: "NORM-1", primaryName: "", aliases: "notarray", type: "", programs: "notarray", dateOfBirth: ["1990-01-01"] },
+      { id: "NORM-2", primaryName: "SOMEONE", dateOfBirth: "1985-07-04" },
+    ],
+    algorithm: "custom",
+  });
+  var n1 = screener.entryById("NORM-1");
+  check("normalizeEntry: empty primaryName preserved", n1.primaryName === "");
+  check("normalizeEntry: non-array aliases → []",
+        Array.isArray(n1.aliases) && n1.aliases.length === 0);
+  check("normalizeEntry: falsy type → entity default", n1.type === "entity");
+  check("normalizeEntry: non-array programs → []",
+        Array.isArray(n1.programs) && n1.programs.length === 0);
+  check("normalizeEntry: array dateOfBirth sliced",
+        Array.isArray(n1.dateOfBirth) && n1.dateOfBirth.length === 1 && n1.dateOfBirth[0] === "1990-01-01");
+  var n2 = screener.entryById("NORM-2");
+  check("normalizeEntry: scalar dateOfBirth wrapped in array",
+        Array.isArray(n2.dateOfBirth) && n2.dateOfBirth.length === 1 && n2.dateOfBirth[0] === "1985-07-04");
+}
+
+function testCreateDefaultAlgorithm() {
+  var screener = sanctions.create({ entries: [] });
+  check("create: omitted algorithm defaults to custom", screener.algorithm === "custom");
+}
+
+function testCreateFuzzyNonObject() {
+  check("create: fuzzy as array throws bad-fuzzy",
+        _threwCode(function () { sanctions.create({ entries: [], fuzzy: [] }); }, "sanctions/bad-fuzzy"));
+  check("create: fuzzy as string throws bad-fuzzy",
+        _threwCode(function () { sanctions.create({ entries: [], fuzzy: "nope" }); }, "sanctions/bad-fuzzy"));
+}
+
+function testCreateFuzzyDisabled() {
+  var screener = sanctions.create({
+    entries:   _sampleEntries(),
+    algorithm: "ofac-sdn",
+    fuzzy:     { enabled: false, strategy: "jaro-winkler" },
+  });
+  check("create fuzzy-disabled: reported strategy is exact", screener.strategy === "exact");
+
+  var exact = screener.screen({ name: "JOHN ALEXANDER SMITH" });
+  check("screen fuzzy-disabled: exact name still matches", exact.match === true);
+  check("screen fuzzy-disabled: result strategy is exact", exact.strategy === "exact");
+
+  // With fuzzy off, a typo must NOT match (exact-only comparison)
+  var typo = screener.screen({ name: "John Aleksander Smyth" });
+  check("screen fuzzy-disabled: typo does not match", typo.match === false);
+}
+
+function testScreenNonObjectInput() {
+  var screener = sanctions.create({ entries: _sampleEntries(), algorithm: "ofac-sdn" });
+  check("screen: null input throws bad-input",
+        _threwCode(function () { screener.screen(null); }, "sanctions/bad-input"));
+  check("screen: string input throws bad-input",
+        _threwCode(function () { screener.screen("John Smith"); }, "sanctions/bad-input"));
+  check("screen: number input throws bad-input",
+        _threwCode(function () { screener.screen(42); }, "sanctions/bad-input"));
+}
+
+function testScreenFuzzyReasonBand() {
+  // A transliteration variant scoring inside [threshold, 0.92) exercises
+  // the "fuzzy" reason band (below the substring/token and near-exact bands).
+  var screener = sanctions.create({
+    entries: [
+      { id: "FZ-1", primaryName: "MOHAMMED", aliases: [], type: "individual", programs: ["SDGT"], country: null, listedAt: null },
+    ],
+    algorithm: "ofac-sdn",
+    fuzzy:     { strategy: "jaro-winkler", threshold: 0.80 },
+  });
+  var r = screener.screen({ name: "MUHAMMAD" });
+  check("screen fuzzy-band: transliteration matches", r.match === true);
+  check("screen fuzzy-band: score in [0.80, 0.92)",
+        r.hits[0].score >= 0.80 && r.hits[0].score < 0.92);
+  check("screen fuzzy-band: reason is 'fuzzy'", r.hits[0].reason === "fuzzy");
+}
+
 // ---- Run all ----
 
 function _syncTests() {
@@ -701,9 +944,20 @@ function _syncTests() {
   testCreateValidation();
   testScreenInputValidation();
   testParseOfacCsvRow();
+  testParseOfacCsvRowEdge();
+  testParseOfacAliasRow();
   testMergeAliases();
+  testMergeAliasesEdge();
   testParseEuCslEntry();
+  testParseEuCslEntryEdge();
   testParseUn1267Entry();
+  testParseUn1267EntryEdge();
+  testNormalizeEntryEdge();
+  testCreateDefaultAlgorithm();
+  testCreateFuzzyNonObject();
+  testCreateFuzzyDisabled();
+  testScreenNonObjectInput();
+  testScreenFuzzyReasonBand();
   testEntryById();
   testScreenBulk();
   testScreenBulkValidation();