@blamejs/core 0.15.12 → 0.15.14

package/lib/gdpr-ropa.js

@@ -37,6 +37,7 @@
 var defineClass = require("./framework-error").defineClass;
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
+var boundedMap = require("./bounded-map");
 
 var audit = lazyRequire(function () { return require("./audit"); });
 
@@ -68,21 +69,11 @@ function create(opts) {
   var controller = opts.controller;
   var dpo = opts.dpo || null;
   var supervisoryAuthority = opts.supervisoryAuthority || null;
-  var auditOn = opts.audit !== false;
   var now = typeof opts.now === "function" ? opts.now : function () { return Date.now(); };
 
   var activities = new Map();
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({
-        action:   "gdpr.ropa." + action,
-        outcome:  outcome,
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent */ }
-  }
+  var _emitAudit = audit().namespaced("gdpr.ropa", opts.audit);
 
   function _validateActivity(activity, op) {
     if (!activity || typeof activity !== "object") {
@@ -100,7 +91,7 @@ function create(opts) {
       throw new GdprRopaError("gdpr-ropa/bad-id",
         "gdpr.ropa." + op + ": activity.id must be a non-empty string");
     }
-    if (!VALID_LEGAL_BASES[activity.legalBasis]) {
+    if (!Object.prototype.hasOwnProperty.call(VALID_LEGAL_BASES, activity.legalBasis)) {
       throw new GdprRopaError("gdpr-ropa/bad-legal-basis",
         "gdpr.ropa." + op + ": activity.legalBasis must be one of " + Object.keys(VALID_LEGAL_BASES).join(", "));
     }
@@ -108,10 +99,10 @@ function create(opts) {
 
   function register(activity) {
     _validateActivity(activity, "register");
-    if (activities.has(activity.id)) {
+    boundedMap.requireAbsent(activities, activity.id, function () {
       throw new GdprRopaError("gdpr-ropa/duplicate-id",
         "gdpr.ropa.register: activity '" + activity.id + "' already registered");
-    }
+    });
     var rec = Object.assign({}, activity, {
       registeredAt: now(),
       lastUpdatedAt: now(),
@@ -136,7 +127,7 @@ function create(opts) {
       registeredAt: existing.registeredAt,
       lastUpdatedAt: now(),
     });
-    if (patch.legalBasis && !VALID_LEGAL_BASES[merged.legalBasis]) {
+    if (patch.legalBasis && !Object.prototype.hasOwnProperty.call(VALID_LEGAL_BASES, merged.legalBasis)) {
       throw new GdprRopaError("gdpr-ropa/bad-legal-basis",
         "gdpr.ropa.update: legalBasis must be one of " + Object.keys(VALID_LEGAL_BASES).join(", "));
     }
@@ -182,6 +173,21 @@ function create(opts) {
       activities:           list(),
     };
   }
+  // Quote a CSV cell AND neutralize spreadsheet formula injection (CWE-1236):
+  // a value beginning with = + - @ TAB or CR is evaluated as a formula by
+  // Excel / Google Sheets when the export is opened, so a RoPA field like
+  // "=HYPERLINK(...)" or "=cmd|..." would execute. Prefix such a value with a
+  // single quote so the spreadsheet renders it as literal text; then RFC-4180
+  // quote (double internal quotes).
+  function _csvCell(v) {
+    var s = (v === undefined || v === null) ? ""
+      : (Array.isArray(v) ? JSON.stringify(v) : String(v));
+    var c0 = s.charCodeAt(0);
+    if (c0 === 0x3d || c0 === 0x2b || c0 === 0x2d || c0 === 0x40 || c0 === 0x09 || c0 === 0x0d) {
+      s = "'" + s;
+    }
+    return '"' + s.replace(/"/g, '""') + '"';
+  }
   function _exportCsv() {
     var headers = [
       "id", "name", "purposes", "legalBasis", "dataCategories",
@@ -192,13 +198,7 @@ function create(opts) {
     var entries = list();
     for (var i = 0; i < entries.length; i++) {
       var e = entries[i];
-      var row = headers.map(function (h) {
-        var v = e[h];
-        if (v === undefined || v === null) return "";
-        if (Array.isArray(v)) return JSON.stringify(v).replace(/"/g, "\"\"");
-        return String(v).replace(/"/g, "\"\"");
-      });
-      rows.push(row.map(function (c) { return '"' + c + '"'; }).join(","));
+      rows.push(headers.map(function (h) { return _csvCell(e[h]); }).join(","));
     }
     return rows.join("\n");
   }

package/lib/graphql-federation.js

@@ -35,7 +35,13 @@ var ROUTER_TOKEN_MIN_LEN = 32;
 var NONCE_MIN_LEN = 16;                                                                     // string-length floor for nonce entropy, not bytes
 var NONCE_MAX_LEN = 256;                                                                    // string-length cap, not bytes
 var NONCE_PREVIEW_LEN = 8;                                                                  // log-preview slice length, not bytes
-var SDL_PROBE_RE = /(^|[\s,{])_service\b|_entities\b/;
+// Word-boundary anchored on BOTH probes. A prefix char-class ([\s,{]) on
+// `_service` was bypassable by an alias with no leading space — `query{x:_service{sdl}}`
+// has `:` before `_service`, which is not in the class, so the SDL trust gate
+// was skipped and the subgraph leaked its full SDL. `\b` already prevents
+// matching substrings like `my_service` (no boundary between `y` and `_`), so
+// the prefix class only added the bypass.
+var SDL_PROBE_RE = /\b_service\b|\b_entities\b/;
 
 /**
  * @primitive b.graphqlFederation.queryProbesSdl
@@ -66,7 +72,7 @@ function queryProbesSdl(query) {
 function _readBearer(req) {
   var h = req.headers && req.headers.authorization;
   if (typeof h !== "string") return null;
-  if (h.length > C.BYTES.kib(8)) return null;
+  if (safeBuffer.byteLengthOf(h) > C.BYTES.kib(8)) return null;
   var m = /^Bearer\s+([A-Za-z0-9._~+/=-]+)$/.exec(h.trim());
   return m ? m[1] : null;
 }
@@ -173,14 +179,21 @@ function guardSdl(opts) {
   return function graphqlFedGuard(req, res, next) {
     Promise.resolve().then(function () {
       return _readBody(req, errorClass).then(function (rawBody) {
-        var query = null;
+        var probesSdl = false;
         try {
           var parsed = typeof rawBody === "string" ? safeJson.parse(rawBody, { maxBytes: C.BYTES.mib(1) }) : rawBody;             // routed via safeJson.parse
-          query = parsed && typeof parsed === "object" ? parsed.query : null;
+          // A GraphQL HTTP batch is a JSON ARRAY of operations; probe EVERY
+          // element's query, not just `parsed.query` (which is undefined for an
+          // array → the SDL gate was skipped and a batched `_service{sdl}`
+          // operation leaked the SDL on batching-enabled subgraphs).
+          var candidates = Array.isArray(parsed)
+            ? parsed.map(function (o) { return o && typeof o === "object" ? o.query : null; })
+            : [parsed && typeof parsed === "object" ? parsed.query : null];
+          probesSdl = candidates.some(queryProbesSdl);
         } catch (_e) { /* not JSON; pass through */ }
         if (req.body === undefined) req.body = rawBody;
 
-        if (!queryProbesSdl(query)) {
+        if (!probesSdl) {
           if (typeof next === "function") next();
           return;
         }

package/lib/guard-agent-registry.js

@@ -24,6 +24,7 @@
 
 var { defineClass } = require("./framework-error");
 var gateContract = require("./gate-contract");
+var codepointClass = require("./codepoint-class");
 
 var GuardAgentRegistryError = defineClass("GuardAgentRegistryError", { alwaysPermanent: true });
 
@@ -120,7 +121,7 @@ function _checkName(name, profile) {
       throw new GuardAgentRegistryError("agent-registry/non-ascii",
         "guardAgentRegistry.validate: name contains non-ASCII codepoint at offset " + i);
     }
-    if (c < 0x20 || c === 0x7F || c === 0x2F || c === 0x5C) {                                         // C0 / DEL / slash / backslash
+    if (codepointClass.isForbiddenControlChar(c, { forbidTab: true }) || c === 0x2F || c === 0x5C) {                                         // C0 / DEL / slash / backslash
       throw new GuardAgentRegistryError("agent-registry/bad-name-char",
         "guardAgentRegistry.validate: name contains forbidden char 0x" + c.toString(16));
     }

package/lib/guard-all.js

@@ -59,6 +59,7 @@ var GUARDS = [
   require("./guard-xml"),
   require("./guard-markdown"),
   require("./guard-email"),
+  require("./guard-text"),
 ];
 
 // STANDALONE_GUARDS — guard-* primitives that don't fit content-type
@@ -127,12 +128,12 @@ function _verifyParity() {
       failures.push(g.NAME + ": missing gate(opts) function");
     }
     SHARED_PROFILES.forEach(function (p) {
-      if (!g.PROFILES || !g.PROFILES[p]) {
+      if (!g.PROFILES || !Object.prototype.hasOwnProperty.call(g.PROFILES, p)) {
         failures.push(g.NAME + ": does not declare shared profile " + JSON.stringify(p));
       }
     });
     SHARED_POSTURES.forEach(function (p) {
-      if (!g.COMPLIANCE_POSTURES || !g.COMPLIANCE_POSTURES[p]) {
+      if (!g.COMPLIANCE_POSTURES || !Object.prototype.hasOwnProperty.call(g.COMPLIANCE_POSTURES, p)) {
         failures.push(g.NAME + ": does not declare shared compliance posture " + JSON.stringify(p));
       }
     });

package/lib/guard-archive.js

@@ -112,10 +112,7 @@ var MAGIC_SIGNATURES = Object.freeze([
 
 var PROFILES = Object.freeze({
   "strict": {
-    bidiPolicy:                "reject",
-    controlPolicy:             "reject",
-    nullBytePolicy:            "reject",
-    zeroWidthPolicy:           "reject",
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     traversalPolicy:           "reject",
     absolutePathPolicy:        "reject",
     symlinkPolicy:             "reject",
@@ -179,26 +176,12 @@ var PROFILES = Object.freeze({
   },
 });
 
-var DEFAULTS = Object.freeze(Object.assign({}, PROFILES["strict"], {
-  mode:          "enforce",
-  maxRuntimeMs:  C.TIME.seconds(10),
-}));
-
-var COMPLIANCE_POSTURES = Object.freeze({
-  "hipaa": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-  "pci-dss": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-  "gdpr": Object.assign({}, PROFILES["balanced"], {
-    forensicSnippetBytes: C.BYTES.bytes(128),
-  }),
-  "soc2": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(512),
-  }),
+var DEFAULTS = gateContract.strictDefaults(PROFILES, {
+  maxRuntimeMs: C.TIME.seconds(10),
 });
 
+var COMPLIANCE_POSTURES = gateContract.compliancePostures(PROFILES, { base: 256 });
+
 // ---- Helpers ----
 
 function _resolveOpts(opts) {
@@ -698,7 +681,8 @@ function validateEntries(entries, opts) {
                  snippet: "entries must be an array" }],
     };
   }
-  return gateContract.aggregateIssues(_detectIssues(entries, opts));
+  // "raw" contract — entries is an array the detector type-checks itself.
+  return gateContract.runIssueValidator(entries, opts, _detectIssues, "raw");
 }
 
 /**
@@ -777,13 +761,8 @@ function gate(opts) {
         return { ok: true, action: "serve" };
       }
       var rv = validateEntries(entries, opts);
-      if (rv.issues.length === 0) return { ok: true, action: "serve" };
-      var hasCritical = rv.issues.some(function (i) {
-        return i.severity === "critical" || i.severity === "high";
-      });
-      if (!hasCritical) return { ok: true, action: "audit-only", issues: rv.issues };
-      // Archive content has no safe sanitization — refuse.
-      return { ok: false, action: "refuse", issues: rv.issues };
+      // Archive content has no safe sanitization — serve / audit-only / refuse.
+      return gateContract.severityDisposition(rv.issues);
     });
 }
 

package/lib/guard-auth.js

@@ -44,7 +44,6 @@
 var lazyRequire = require("./lazy-require");
 var gateContract = require("./gate-contract");
 var C = require("./constants");
-var numericBounds = require("./numeric-bounds");
 var guardJwt = require("./guard-jwt");
 var guardOauth = require("./guard-oauth");
 var cookies = require("./cookies");
@@ -59,30 +58,21 @@ var _err = GuardAuthError.factory;
 
 var PROFILES = Object.freeze({
   "strict": {
-    bidiPolicy:        "reject",
-    controlPolicy:     "reject",
-    nullBytePolicy:    "reject",
-    zeroWidthPolicy:   "reject",
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     childProfile:      "strict",
     requireAtLeastOne: true,
     maxBytes:          C.BYTES.kib(64),
     maxRuntimeMs:      C.TIME.seconds(2),
   },
   "balanced": {
-    bidiPolicy:        "reject",
-    controlPolicy:     "reject",
-    nullBytePolicy:    "reject",
-    zeroWidthPolicy:   "reject",
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     childProfile:      "balanced",
     requireAtLeastOne: false,
     maxBytes:          C.BYTES.kib(128),
     maxRuntimeMs:      C.TIME.seconds(2),
   },
   "permissive": {
-    bidiPolicy:        "reject",                                                 // BIDI refused at every profile
-    controlPolicy:     "reject",                                                  // controls refused at every profile
-    nullBytePolicy:    "reject",                                                  // null refused at every profile
-    zeroWidthPolicy:   "reject",                                                  // zero-width refused at every profile
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     childProfile:      "permissive",
     requireAtLeastOne: false,
     maxBytes:          C.BYTES.kib(512),
@@ -90,35 +80,6 @@ var PROFILES = Object.freeze({
   },
 });
 
-var DEFAULTS = Object.freeze(Object.assign({}, PROFILES["strict"], {
-  mode: "enforce",
-}));
-
-var COMPLIANCE_POSTURES = Object.freeze({
-  "hipaa":   Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(512),
-  }),
-  "pci-dss": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(512),
-  }),
-  "gdpr":    Object.assign({}, PROFILES["balanced"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-  "soc2":    Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(1024),
-  }),
-});
-
-function _resolveOpts(opts) {
-  return gateContract.resolveProfileAndPosture(opts, {
-    profiles:           PROFILES,
-    compliancePostures: COMPLIANCE_POSTURES,
-    defaults:           DEFAULTS,
-    errorClass:         GuardAuthError,
-    errCodePrefix:      "auth",
-  });
-}
-
 function _detectIssues(bundle, opts) {
   var issues = [];
   if (!bundle || typeof bundle !== "object") {
@@ -232,13 +193,9 @@ function _detectIssues(bundle, opts) {
  *   rv.ok;                                             // → false
  *   rv.issues.some(function (i) { return i.source === "jwt"; });   // → true
  */
-function validate(input, opts) {
-  opts = _resolveOpts(opts);
-  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
-    ["maxBytes"],
-    "guardAuth.validate", GuardAuthError, "auth.bad-opt");
-  return gateContract.aggregateIssues(_detectIssues(input, opts));
-}
+// validate is assembled by gateContract.defineGuard from `detect`
+// (_detectIssues), with the maxBytes cap declared via `intOpts`.
+// The @primitive block above documents the resulting ABI.
 
 /**
  * @primitive  b.guardAuth.sanitize
@@ -266,19 +223,15 @@ function validate(input, opts) {
  *   }, { profile: "balanced" });
  *   clean.cookieHeader;                                // → "sid=abc123"
  */
-function sanitize(input, opts) {
-  opts = _resolveOpts(opts);
-  if (!input || typeof input !== "object") {
-    throw _err("auth.bad-input", "sanitize requires bundle object");
-  }
-  var issues = _detectIssues(input, opts);
-  for (var i = 0; i < issues.length; i += 1) {
-    if (issues[i].severity === "critical" || issues[i].severity === "high") {
-      throw _err(issues[i].ruleId || "auth.refused",
-        "guardAuth.sanitize [" + issues[i].source + "]: " +
-        issues[i].snippet);
-    }
-  }
+// _sanitizeTransform — the normalize tail applied by defineGuard's generated
+// sanitize AFTER resolve -> detect -> throwOnRefusalSeverity (default severities
+// ['critical','high']). The auth-bundle is composed of values the framework
+// cannot safely mutate (forging a JWT alg / rewriting an OAuth state parameter /
+// dropping cookies would silently disarm an actual attack token), so the
+// transform is identity — the bundle is returned unchanged when no high/critical
+// issue refused upstream. A non-object input refuses upstream via the high-
+// severity auth.bad-input issue _detectIssues raises.
+function _sanitizeTransform(input) {
   return input;
 }
 
@@ -313,25 +266,15 @@ function sanitize(input, opts) {
  *   verdict.action;                                    // → "refuse"
  */
 function gate(opts) {
-  opts = _resolveOpts(opts);
+  opts = _guard.resolveOpts(opts);
   return gateContract.buildGuardGate(
     opts.name || "guardAuth:" + (opts.profile || "default"),
     opts,
     async function (ctx) {
       var bundle = ctx && (ctx.authBundle || ctx.auth);
       if (!bundle) return { ok: true, action: "serve" };
-      var rv = validate(bundle, opts);
-      if (rv.issues.length === 0) return { ok: true, action: "serve" };
-      var hasCritical = rv.issues.some(function (i) {
-        return i.severity === "critical";
-      });
-      var hasHigh = rv.issues.some(function (i) {
-        return i.severity === "high";
-      });
-      if (!hasCritical && !hasHigh) {
-        return { ok: true, action: "audit-only", issues: rv.issues };
-      }
-      return { ok: false, action: "refuse", issues: rv.issues };
+      var rv = module.exports.validate(bundle, opts);
+      return gateContract.severityDisposition(rv.issues);
     });
 }
 
@@ -367,15 +310,15 @@ var INTEGRATION_FIXTURES = Object.freeze({
 // surface (validate / sanitize / bespoke gate) passed through verbatim.
 // The custom KIND ("auth-bundle") is accepted because the bespoke gate
 // reads its own ctx fields (ctx.authBundle / ctx.auth).
-module.exports = gateContract.defineGuard({
+var _guard = module.exports = gateContract.defineGuard({
   name:        "auth",
   kind:        "auth-bundle",
   errorClass:  GuardAuthError,
   profiles:    PROFILES,
-  defaults:    DEFAULTS,
-  postures:    COMPLIANCE_POSTURES,
+  base:        512,
   integrationFixtures: INTEGRATION_FIXTURES,
-  validate:    validate,
-  sanitize:    sanitize,
+  detect:            _detectIssues,
+  sanitizeTransform: _sanitizeTransform,
+  intOpts:           ["maxBytes"],
   gate:        gate,
 });

package/lib/guard-cidr.js

@@ -43,11 +43,9 @@
  *   CIDR identifier-safety primitive (KIND="identifier").
  */
 
-var codepointClass = require("./codepoint-class");
 var lazyRequire = require("./lazy-require");
 var gateContract = require("./gate-contract");
 var C = require("./constants");
-var numericBounds = require("./numeric-bounds");
 var safeBuffer = require("./safe-buffer");
 var { GuardCidrError } = require("./framework-error");
 
@@ -102,10 +100,7 @@ var IPV6_RESERVED = Object.freeze([
 
 var PROFILES = Object.freeze({
   "strict": {
-    bidiPolicy:               "reject",
-    controlPolicy:             "reject",
-    nullBytePolicy:            "reject",
-    zeroWidthPolicy:           "reject",
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     networkAlignmentPolicy:    "reject",
     reservedRangesPolicy:      "reject",
     ipv4MappedIpv6Policy:      "reject",
@@ -115,10 +110,7 @@ var PROFILES = Object.freeze({
     maxRuntimeMs:              C.TIME.seconds(2),
   },
   "balanced": {
-    bidiPolicy:               "reject",
-    controlPolicy:             "reject",
-    nullBytePolicy:            "reject",
-    zeroWidthPolicy:           "reject",
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     networkAlignmentPolicy:    "audit",
     reservedRangesPolicy:      "audit",
     ipv4MappedIpv6Policy:      "audit",
@@ -128,10 +120,7 @@ var PROFILES = Object.freeze({
     maxRuntimeMs:              C.TIME.seconds(2),
   },
   "permissive": {
-    bidiPolicy:               "reject",                                          // BIDI refused at every profile
-    controlPolicy:             "reject",                                          // controls refused at every profile
-    nullBytePolicy:            "reject",                                          // null refused at every profile
-    zeroWidthPolicy:           "reject",                                          // zero-width refused at every profile
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     networkAlignmentPolicy:    "audit",
     reservedRangesPolicy:      "allow",
     ipv4MappedIpv6Policy:      "allow",
@@ -142,35 +131,6 @@ var PROFILES = Object.freeze({
   },
 });
 
-var DEFAULTS = Object.freeze(Object.assign({}, PROFILES["strict"], {
-  mode: "enforce",
-}));
-
-var COMPLIANCE_POSTURES = Object.freeze({
-  "hipaa":   Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(128),
-  }),
-  "pci-dss": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(128),
-  }),
-  "gdpr":    Object.assign({}, PROFILES["balanced"], {
-    forensicSnippetBytes: C.BYTES.bytes(64),
-  }),
-  "soc2":    Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-});
-
-function _resolveOpts(opts) {
-  return gateContract.resolveProfileAndPosture(opts, {
-    profiles:           PROFILES,
-    compliancePostures: COMPLIANCE_POSTURES,
-    defaults:           DEFAULTS,
-    errorClass:         GuardCidrError,
-    errCodePrefix:      "cidr",
-  });
-}
-
 // ---- Parsers ----
 
 function _parseIpv4(s) {
@@ -284,25 +244,9 @@ function _ipv6InReservedRange(groups, prefix) {
 // ---- Detection ----
 
 function _detectIssues(input, opts) {
-  var issues = [];
-  if (typeof input !== "string") {
-    return [{ kind: "bad-input", severity: "high",
-              ruleId: "cidr.bad-input",
-              snippet: "cidr is not a string" }];
-  }
-  if (input.length === 0) {
-    return [{ kind: "empty", severity: "high",
-              ruleId: "cidr.empty",
-              snippet: "cidr is empty" }];
-  }
-  if (Buffer.byteLength(input, "utf8") > opts.maxBytes) {
-    return [{ kind: "cidr-cap", severity: "high",
-              ruleId: "cidr.cidr-cap",
-              snippet: "cidr input exceeds maxBytes " + opts.maxBytes }];
-  }
-
-  var charThreats = codepointClass.detectCharThreats(input, opts, "cidr");
-  for (var ci = 0; ci < charThreats.length; ci += 1) issues.push(charThreats[ci]);
+  var pre = gateContract.detectStringInput(input, opts, { name: "cidr", cap: { bytes: opts.maxBytes } });
+  if (pre.done) return pre.issues;
+  var issues = pre.issues;
 
   // Split address from mask.
   var slashAt = input.indexOf("/");
@@ -464,21 +408,10 @@ function _detectIssues(input, opts) {
  *   var clean = b.guardCidr.validate("8.8.8.0/24", { profile: "strict" });
  *   clean.ok;                                          // → true
  */
-function validate(input, opts) {
-  opts = _resolveOpts(opts);
-  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
-    ["maxBytes"],
-    "guardCidr.validate", GuardCidrError, "cidr.bad-opt");
-  if (typeof input !== "string") {
-    return {
-      ok: false,
-      issues: [{ kind: "bad-input", severity: "high",
-                 ruleId: "cidr.bad-input",
-                 snippet: "cidr is not a string" }],
-    };
-  }
-  return gateContract.aggregateIssues(_detectIssues(input, opts));
-}
+// validate is assembled by gateContract.defineGuard from `detect`
+// (_detectIssues) below — `validate(input, opts) = aggregateIssues(detect(
+// input, resolveOpts(opts)))`, with the maxBytes cap declared via `intOpts`.
+// The @primitive block above documents the resulting public ABI.
 
 /**
  * @primitive  b.guardCidr.sanitize
@@ -505,13 +438,10 @@ function validate(input, opts) {
  *   var v4 = b.guardCidr.sanitize("8.8.8.0/24", { profile: "strict" });
  *   v4;                                                // → "8.8.8.0/24"
  */
-function sanitize(input, opts) {
-  opts = _resolveOpts(opts);
-  if (typeof input !== "string") {
-    throw _err("cidr.bad-input", "sanitize requires string input");
-  }
-  var issues = _detectIssues(input, opts);
-  gateContract.throwOnRefusalSeverity(issues, { errorClass: GuardCidrError, codePrefix: "cidr" });
+// _sanitizeTransform — the guard-specific normalize applied by defineGuard's
+// generated sanitize AFTER resolve → detect → throw-on-refusal. Input is an
+// already-validated string at this point (a non-string refuses upstream).
+function _sanitizeTransform(input) {
   // Normalize: lowercase IPv6 groups + canonical mask form.
   var slashAt = input.indexOf("/");
   var addr = slashAt === -1 ? input : input.slice(0, slashAt);
@@ -525,14 +455,8 @@ function sanitize(input, opts) {
 // single-sourced @abiTemplate (defineGuard) blocks in gate-contract.js,
 // instantiated per guard by the page generator.
 
-var INTEGRATION_FIXTURES = Object.freeze({
-  kind:              "identifier",
-  benignBytes:       Buffer.from("8.8.8.0/24", "utf8"),
-  hostileBytes:      Buffer.from("10.0.0.0/8", "utf8"),
-  benignIdentifier:  "8.8.8.0/24",
-  // Hostile: RFC 1918 private range — refused at strict.
-  hostileIdentifier: "10.0.0.0/8",
-});
+// Hostile: RFC 1918 private range — refused at strict.
+var INTEGRATION_FIXTURES = gateContract.identifierFixtures("8.8.8.0/24", "10.0.0.0/8");
 
 // Assembled from the gate-contract guard factory: error class, registry
 // exports (NAME / KIND / INTEGRATION_FIXTURES), buildProfile /
@@ -546,10 +470,10 @@ module.exports = gateContract.defineGuard({
   kind:        "identifier",
   errorClass:  GuardCidrError,
   profiles:    PROFILES,
-  defaults:    DEFAULTS,
-  postures:    COMPLIANCE_POSTURES,
+  base:        128,
   integrationFixtures: INTEGRATION_FIXTURES,
-  validate:    validate,
-  sanitize:    sanitize,
+  detect:           _detectIssues,
+  sanitizeTransform: _sanitizeTransform,
+  intOpts:          ["maxBytes"],
   ctxFields:   ["identifier", "cidr"],
 });