@blamejs/core 0.15.12 → 0.15.14

package/lib/guard-svg.js

@@ -107,10 +107,11 @@
  */
 
 var codepointClass = require("./codepoint-class");
+var markupTokenizer = require("./markup-tokenizer");
+var markupEscape = require("./markup-escape").markupEscape;
 var lazyRequire = require("./lazy-require");
 var gateContract = require("./gate-contract");
 var C = require("./constants");
-var numericBounds = require("./numeric-bounds");
 var safeUrl = require("./safe-url");
 var { GuardSvgError } = require("./framework-error");
 
@@ -118,7 +119,6 @@ var observability = lazyRequire(function () { return require("./observability");
 void observability;
 
 var _err = GuardSvgError.factory;
-var HEX_RADIX = 16;                                                 // base-16 radix, not byte size
 
 // ---- Codepoint catalog (shared via lib/codepoint-class) ----
 
@@ -197,12 +197,10 @@ var URL_ATTRS = Object.freeze([
   "background", "poster", "icon",
 ]);
 
-var SAFE_SCHEMES = Object.freeze(["http", "https", "mailto", "tel"]);
+var SAFE_SCHEMES = gateContract.SAFE_URL_SCHEMES;
 
-var DANGEROUS_SCHEMES = Object.freeze([
-  "javascript", "vbscript", "livescript", "mocha", "ecmascript",
-  "file", "mhtml", "jar", "intent", "view-source", "feed", "data",
-]);
+// Markup-attribute scheme denylist — the shared XSS / dangerous-resource set.
+var DANGEROUS_SCHEMES = gateContract.DANGEROUS_URL_SCHEMES;
 
 var CSS_DANGEROUS_PATTERNS = Object.freeze([
   /expression\s*\(/i,
@@ -305,68 +303,14 @@ var PROFILES = Object.freeze({
   },
 });
 
-var DEFAULTS = Object.freeze(Object.assign({}, PROFILES["strict"], {
-  mode:          "enforce",
+var DEFAULTS = gateContract.strictDefaults(PROFILES, {
   maxRuntimeMs:  C.TIME.seconds(30),
-}));
-
-var COMPLIANCE_POSTURES = Object.freeze({
-  "hipaa": {
-    allowedTags:        STRICT_ALLOWED_TAGS,
-    bidiPolicy:         "reject",
-    controlPolicy:      "reject",
-    nullBytePolicy:     "reject",
-    cssPolicy:          "reject",
-    doctypePolicy:      "reject",
-    allowExternalRefs:  false,
-    allowAnimation:     false,
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  },
-  "pci-dss": {
-    allowedTags:        STRICT_ALLOWED_TAGS,
-    bidiPolicy:         "reject",
-    controlPolicy:      "reject",
-    nullBytePolicy:     "reject",
-    cssPolicy:          "reject",
-    doctypePolicy:      "reject",
-    allowExternalRefs:  false,
-    allowAnimation:     false,
-    urlSchemes:         SAFE_SCHEMES,
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  },
-  "gdpr": {
-    allowedTags:        BALANCED_ALLOWED_TAGS,
-    bidiPolicy:         "strip",
-    controlPolicy:      "strip",
-    cssPolicy:          "strip",
-    doctypePolicy:      "reject",
-    allowAnimation:     false,
-    forensicSnippetBytes: C.BYTES.bytes(128),
-  },
-  "soc2": {
-    allowedTags:        STRICT_ALLOWED_TAGS,
-    bidiPolicy:         "reject",
-    controlPolicy:      "reject",
-    nullBytePolicy:     "reject",
-    cssPolicy:          "reject",
-    doctypePolicy:      "reject",
-    allowExternalRefs:  false,
-    allowAnimation:     false,
-    forensicSnippetBytes: C.BYTES.bytes(512),
-  },
 });
 
+var COMPLIANCE_POSTURES = gateContract.compliancePostures(PROFILES, { base: 256 });
+
 // ---- Internal helpers ----
 
-function _resolveOpts(opts) {
-  return gateContract.resolveProfileAndPosture(opts, {
-    profiles:           PROFILES,
-    compliancePostures: COMPLIANCE_POSTURES,
-    defaults:           DEFAULTS,
-    errorClass:         GuardSvgError,
-    errCodePrefix:      "svg",
-  });
-}
 
 // HTML5 named-entity ASCII subset — same shape as guard-html.
 // Browsers honor these inside URL contexts; without decoding them,
@@ -384,12 +328,9 @@ var SVG_NAMED_ENTITY_ASCII = {
 
 function _extractScheme(rawUrl) {
   var s = String(rawUrl || "").trim();
-  s = s.replace(/&#x([0-9a-f]+);/gi, function (_m, h) {
-    return String.fromCharCode(parseInt(h, HEX_RADIX));
-  });
-  s = s.replace(/&#(\d+);/g, function (_m, d) {
-    return String.fromCharCode(parseInt(d, 10));
-  });
+  // Numeric entities (hex/decimal, semicolon OPTIONAL) via the shared decoder
+  // so guard-html / guard-svg / guard-markdown can't drift (see codepoint-class).
+  s = codepointClass.decodeNumericEntities(s);
   s = s.replace(/&([A-Za-z][A-Za-z0-9]+);/g, function (m, name) {
     if (Object.prototype.hasOwnProperty.call(SVG_NAMED_ENTITY_ASCII, name)) {
       return SVG_NAMED_ENTITY_ASCII[name];
@@ -436,9 +377,10 @@ function _isSvgz(input) {
 
 function _tokenize(input, maxBytes) {
   var s = String(input || "");
-  if (s.length > maxBytes) {
+  var nb = Buffer.byteLength(s, "utf8");
+  if (nb > maxBytes) {
     throw _err("svg.too-large",
-      "input " + s.length + " bytes exceeds maxBytes " + maxBytes);
+      "input " + nb + " bytes exceeds maxBytes " + maxBytes);
   }
   var tokens = [];
   var len = s.length;
@@ -455,8 +397,11 @@ function _tokenize(input, maxBytes) {
     }
 
     if (s.startsWith("<!--", lt)) {
-      var endC = s.indexOf("-->", lt + 4);
-      if (endC === -1) endC = len; else endC += 3;
+      // WHATWG comment end ("--!>" + abrupt "<!-->" / "<!--->"), not only
+      // "-->", so the comment boundary matches a browser parsing inline SVG
+      // and no element is smuggled past the sanitizer (mXSS differential).
+      var endC = markupTokenizer.htmlCommentEnd(s, lt);
+      if (endC === -1) endC = len;
       tokens.push({ type: "comment", raw: s.slice(lt, endC), start: lt, end: endC });
       pos = endC; continue;
     }
@@ -508,28 +453,16 @@ function _tokenize(input, maxBytes) {
       pos = endE; continue;
     }
 
-    var pp = lt + 1;
-    var inQuote = "";
-    while (pp < len) {
-      var ch = s.charAt(pp);
-      if (inQuote) { if (ch === inQuote) inQuote = ""; }
-      else {
-        if (ch === '"' || ch === "'") inQuote = ch;
-        else if (ch === ">") break;
-      }
-      pp += 1;
-    }
+    var pp = markupTokenizer.scanToTagEnd(s, lt + 1, len);
     var endT = pp < len ? pp + 1 : len;
     var raw = s.slice(lt, endT);
     var inner = raw.slice(1, raw.charAt(raw.length - 1) === ">" ? raw.length - 1 : raw.length);
     var selfClosing = inner.endsWith("/");
     if (selfClosing) inner = inner.slice(0, inner.length - 1);
 
-    var nameMatch = inner.match(/^([A-Za-z][A-Za-z0-9:_-]*)/);
-    var tagName = nameMatch ? nameMatch[1].toLowerCase() : "";
-    var attrSrc = nameMatch ? inner.slice(nameMatch[0].length) : "";
-
-    var attrs = _parseAttrs(attrSrc);
+    var svgParts = markupTokenizer.splitTagNameAttrs(inner, /^([A-Za-z][A-Za-z0-9:_-]*)/);
+    var tagName = svgParts.tagName;
+    var attrs = _parseAttrs(svgParts.attrSrc);
     tokens.push({
       type: "tag", name: tagName, attrs: attrs,
       raw: raw, start: lt, end: endT, selfClosing: selfClosing,
@@ -576,6 +509,10 @@ function _parseAttrs(src) {
 // ---- Detection pass ----
 
 function _detectIssues(input, opts) {
+  if (typeof input !== "string" && !Buffer.isBuffer(input)) {
+    return [{ kind: "bad-input", severity: "high",
+              snippet: "input is not string or Buffer" }];
+  }
   if (_isSvgz(input)) {
     return [{
       kind: "svgz-compressed", severity: "critical", ruleId: "svg.svgz",
@@ -585,7 +522,7 @@ function _detectIssues(input, opts) {
   }
 
   var s = typeof input === "string" ? input : Buffer.from(input).toString("utf8");
-  var issues = codepointClass.detectCharThreats(s, opts, "svg");
+  var issues = codepointClass.detectCharThreats(s, opts, "svg", "warn");
 
   var tokens;
   try { tokens = _tokenize(s, opts.maxBytes); }
@@ -708,7 +645,7 @@ function _detectIssues(input, opts) {
     for (var ai = 0; ai < attrs.length; ai += 1) {
       var a = attrs[ai];
       var an = a.name.toLowerCase();
-      if (a.value && a.value.length > opts.maxAttrValueBytes) {
+      if (a.value && Buffer.byteLength(a.value, "utf8") > opts.maxAttrValueBytes) {
         issues.push({
           kind: "attr-value-too-large", severity: "high",
           ruleId: "svg.attr-size",
@@ -806,9 +743,10 @@ function _sanitize(input, opts) {
     throw _err("svg.svgz", "compressed SVGZ payload — operator must ungzip before sanitize");
   }
   var s = typeof input === "string" ? input : Buffer.from(input).toString("utf8");
-  if (s.length > opts.maxBytes) {
+  var nb = Buffer.byteLength(s, "utf8");
+  if (nb > opts.maxBytes) {
     throw _err("svg.too-large",
-      "input " + s.length + " bytes exceeds maxBytes " + opts.maxBytes);
+      "input " + nb + " bytes exceeds maxBytes " + opts.maxBytes);
   }
   codepointClass.assertNoCharThreats(s, opts, _err, "svg");
 
@@ -873,7 +811,7 @@ function _sanitize(input, opts) {
       var a = attrs[ai];
       var an = a.name.toLowerCase();
       if (EVENT_HANDLER_RE.test(an)) continue;                      // allow:regex-no-length-cap — `an` is a tokenized attribute name, bounded
-      if (a.value && a.value.length > opts.maxAttrValueBytes) continue;
+      if (a.value && Buffer.byteLength(a.value, "utf8") > opts.maxAttrValueBytes) continue;
       if (URL_ATTRS.indexOf(an) !== -1) {
         var scheme = _extractScheme(a.value);
         var fragment = _isFragmentRef(a.value);
@@ -893,9 +831,7 @@ function _sanitize(input, opts) {
             !fragment && !opts.allowExternalRefs) continue;
       }
       if (an === "style" && _isCssDangerous(a.value)) continue;
-      attrParts.push(an + "=\"" + a.value
-        .replace(/&/g, "&amp;").replace(/</g, "&lt;")
-        .replace(/>/g, "&gt;").replace(/"/g, "&quot;") + "\"");
+      attrParts.push(an + "=\"" + markupEscape(a.value) + "\"");
     }
     var open = "<" + tok.name + (attrParts.length ? " " + attrParts.join(" ") : "") +
                (tok.selfClosing ? "/>" : ">");
@@ -951,16 +887,12 @@ function _sanitize(input, opts) {
  *   clean.ok;                        // → true
  *   clean.issues.length;             // → 0
  */
-function validate(input, opts) {
-  opts = _resolveOpts(opts);
-  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
-    ["maxBytes", "maxElementCount", "maxUseDepth"],
-    "guardSvg.validate", GuardSvgError, "svg.bad-opt");
-
-  var bad = gateContract.badInputResultIfNotStringOrBuffer(input);
-  if (bad) return bad;
-  return gateContract.aggregateIssues(_detectIssues(input, opts));
-}
+// validate is assembled by gateContract.defineGuard from `detect`
+// (_detectIssues) below — `validate(input, opts) = aggregateIssues(detect(
+// input, resolveOpts(opts)))`, with the maxBytes/maxElementCount/maxUseDepth
+// caps declared via `intOpts`. Non-string/non-Buffer input returns a single
+// `svg.bad-input` issue from _detectIssues (never throws). The @primitive
+// block above documents the resulting public ABI.
 
 /**
  * @primitive b.guardSvg.sanitize
@@ -1003,7 +935,7 @@ function validate(input, opts) {
  *   /onload/.test(clean);            // → false
  */
 function sanitize(input, opts) {
-  opts = _resolveOpts(opts);
+  opts = _guard.resolveOpts(opts);
   if (typeof input !== "string" && !Buffer.isBuffer(input)) {
     throw _err("svg.bad-input", "sanitize requires string or Buffer input");
   }
@@ -1055,42 +987,57 @@ function sanitize(input, opts) {
  *   });
  *   refuse.action;                   // → "refuse"
  */
-function gate(opts) {
-  opts = _resolveOpts(opts);
-  return gateContract.buildGuardGate(
-    opts.name || "guardSvg:" + (opts.profile || "default"),
-    opts,
-    async function (ctx) {
-      var bytes = ctx.bytes;
-      if (!bytes) return { ok: true, action: "serve" };
-      var rv = validate(bytes, opts);
-      if (rv.issues.length === 0) return { ok: true, action: "serve" };
-      var hasCritical = rv.issues.some(function (i) {
-        return i.severity === "critical" || i.severity === "high";
-      });
-      if (!hasCritical) return { ok: true, action: "audit-only", issues: rv.issues };
-
-      // SVGZ never sanitizable — refuse.
-      if (rv.issues.some(function (i) { return i.kind === "svgz-compressed"; })) {
-        return { ok: false, action: "refuse", issues: rv.issues };
-      }
+// Disposition of each svg finding = what the operator's policy for that class
+// selected. CSS injection / DOCTYPE / CDATA / processing-instruction and the
+// bidi / null / control char threats follow their policies (sanitize under
+// `strip`, refuse under `reject`, audit under `audit`). The always-dangerous
+// classes (dangerous / animation tag, event handler, animation target,
+// dangerous URL scheme, external ref, entity declaration) refuse; a gzipped
+// SVGZ payload refuses (it must never reach the text sanitizer); a
+// non-allowlisted but benign tag / scheme sanitizes; structural caps and a
+// tokenizer failure refuse. Exhaustive over every kind _detectIssues emits.
+function _gateDispositionFor(issue, opts) {
+  var shared = gateContract.charThreatDisposition(issue, opts);
+  if (shared) return shared;
+  switch (issue.kind) {
+    case "css-injection":             return gateContract.policyDisposition(opts.cssPolicy);
+    case "doctype":                   return gateContract.policyDisposition(opts.doctypePolicy);
+    case "cdata":                     return gateContract.policyDisposition(opts.cdataPolicy);
+    case "processing-instruction":    return gateContract.policyDisposition(opts.processingInstrPolicy);
+    case "non-allowlisted-tag":
+    case "non-allowlisted-url-scheme": return "sanitize";
+    case "svgz-compressed":
+    case "entity-declaration":
+    case "dangerous-tag":
+    case "event-handler":
+    case "animation-target":
+    case "dangerous-url-scheme":
+    case "external-ref":              return "refuse";
+    case "tokenize-failed":
+    case "element-count-cap":
+    case "attr-count-cap":
+    case "use-depth-cap":
+    case "attr-value-too-large":
+    case "bad-input":                 return "refuse";
+    default:                          return null;
+  }
+}
 
-      if (opts.bidiPolicy !== "reject" &&
-          opts.controlPolicy !== "reject" &&
-          opts.nullBytePolicy !== "reject" &&
-          opts.cssPolicy !== "reject" &&
-          opts.doctypePolicy !== "reject") {
-        try {
-          var clean = sanitize(bytes, opts);
-          return {
-            ok: true, action: "sanitize",
-            sanitized: Buffer.from(clean, "utf8"),
-            issues: rv.issues,
-          };
-        } catch (_e) { /* fall through */ }
-      }
-      return { ok: false, action: "refuse", issues: rv.issues };
-    });
+function gate(opts) {
+  opts = _guard.resolveOpts(opts);
+  return gateContract.buildContentGate({
+    name:     opts.name || "guardSvg:" + (opts.profile || "default"),
+    opts:     opts,
+    validate: module.exports.validate,
+    dispositionFor: _gateDispositionFor,
+    // SVG reads the RAW bytes (SVGZ gzip detection needs the byte signature).
+    // A gzipped SVGZ must not be fed to the text sanitizer → it is refuse-
+    // disposition, and sanitizeBlockingKinds is a second backstop that skips
+    // the sanitize attempt for it.
+    ctxField: "bytes",
+    sanitizeBlockingKinds: ["svgz-compressed"],
+    produceSanitized: function (bytes, o) { return sanitize(bytes, o); },
+  });
 }
 
 // buildProfile / compliancePosture / loadRulePack are assembled by
@@ -1114,10 +1061,15 @@ var INTEGRATION_FIXTURES = Object.freeze({
 // Assembled from the gate-contract guard factory: error class, registry
 // exports (NAME / KIND / MIME_TYPES / EXTENSIONS / INTEGRATION_FIXTURES),
 // buildProfile / compliancePosture / loadRulePack wiring, plus the
-// per-guard inspection surface (validate / sanitize / gate) and the SVG
-// tag / scheme tables passed through verbatim. The bespoke `gate` carries
-// SVG's sanitize-reserialize chain and SVGZ refuse unchanged.
-module.exports = gateContract.defineGuard({
+// per-guard inspection surface and the SVG tag / scheme tables passed
+// through verbatim. `validate` is generated from `detect` (_detectIssues)
+// with the int caps declared via `intOpts`. The bespoke `sanitize` and
+// `gate` carry SVG's tag/attr strip-reserialize chain — which drops
+// dangerous tags rather than throwing on them — and the SVGZ refuse
+// unchanged; neither reduces to the dynamic
+// detect→throwOnRefusalSeverity→transform path (same-severity findings
+// split throw-vs-strip), so both stay bespoke.
+var _guard = module.exports = gateContract.defineGuard({
   name:        "svg",
   kind:        "content",
   errorClass:  GuardSvgError,
@@ -1127,10 +1079,12 @@ module.exports = gateContract.defineGuard({
   mimeTypes:   ["image/svg+xml"],
   extensions:  [".svg", ".svgz"],
   integrationFixtures: INTEGRATION_FIXTURES,
-  validate:    validate,
+  detect:      _detectIssues,
+  intOpts:     ["maxBytes", "maxElementCount", "maxUseDepth"],
   sanitize:    sanitize,
   gate:        gate,
   extra: {
+    _gateDispositionForTest: _gateDispositionFor,
     DANGEROUS_TAGS:          DANGEROUS_TAGS,
     ANIMATION_TAGS:          ANIMATION_TAGS,
     ANIMATION_SAFE_TARGETS:  ANIMATION_SAFE_TARGETS,

package/lib/guard-template.js

@@ -50,11 +50,9 @@
  *   Server-Side Template Injection (SSTI) content-safety guard — refuses user-supplied strings that contain template-engine syntax BEFORE they're rendered.
  */
 
-var codepointClass = require("./codepoint-class");
 var lazyRequire = require("./lazy-require");
 var gateContract = require("./gate-contract");
 var C = require("./constants");
-var numericBounds = require("./numeric-bounds");
 var { GuardTemplateError } = require("./framework-error");
 
 var observability = lazyRequire(function () { return require("./observability"); });
@@ -74,10 +72,7 @@ var VELOCITY_DIR_RE = /#(?:set|if|else|elseif|end|foreach|parse|include|stop)\b/
 
 var PROFILES = Object.freeze({
   "strict": {
-    bidiPolicy:               "reject",
-    controlPolicy:             "reject",
-    nullBytePolicy:            "reject",
-    zeroWidthPolicy:           "reject",
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     jinjaPolicy:               "reject",
     erbPolicy:                 "reject",
     pugPolicy:                 "reject",
@@ -87,10 +82,7 @@ var PROFILES = Object.freeze({
     maxRuntimeMs:              C.TIME.seconds(2),
   },
   "balanced": {
-    bidiPolicy:               "reject",
-    controlPolicy:             "reject",
-    nullBytePolicy:            "reject",
-    zeroWidthPolicy:           "reject",
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     jinjaPolicy:               "reject",                                          // SSTI class — refused at every profile
     erbPolicy:                 "reject",
     pugPolicy:                 "reject",
@@ -100,10 +92,7 @@ var PROFILES = Object.freeze({
     maxRuntimeMs:              C.TIME.seconds(2),
   },
   "permissive": {
-    bidiPolicy:               "reject",                                          // BIDI refused at every profile
-    controlPolicy:             "reject",                                          // controls refused at every profile
-    nullBytePolicy:            "reject",                                          // null refused at every profile
-    zeroWidthPolicy:           "reject",                                          // zero-width refused at every profile
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     jinjaPolicy:               "reject",                                          // SSTI class refused at every profile
     erbPolicy:                 "reject",                                          // SSTI class refused at every profile
     pugPolicy:                 "reject",                                          // SSTI class refused at every profile
@@ -114,51 +103,14 @@ var PROFILES = Object.freeze({
   },
 });
 
-var DEFAULTS = Object.freeze(Object.assign({}, PROFILES["strict"], {
-  mode: "enforce",
-}));
+var DEFAULTS = gateContract.strictDefaults(PROFILES);
 
-var COMPLIANCE_POSTURES = Object.freeze({
-  "hipaa":   Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(512),
-  }),
-  "pci-dss": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(512),
-  }),
-  "gdpr":    Object.assign({}, PROFILES["balanced"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-  "soc2":    Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(1024),
-  }),
-});
-
-function _resolveOpts(opts) {
-  return gateContract.resolveProfileAndPosture(opts, {
-    profiles:           PROFILES,
-    compliancePostures: COMPLIANCE_POSTURES,
-    defaults:           DEFAULTS,
-    errorClass:         GuardTemplateError,
-    errCodePrefix:      "template",
-  });
-}
+var COMPLIANCE_POSTURES = gateContract.compliancePostures(PROFILES, { base: 512 });
 
 function _detectIssues(input, opts) {
-  var issues = [];
-  if (typeof input !== "string") {
-    return [{ kind: "bad-input", severity: "high",
-              ruleId: "template.bad-input",
-              snippet: "template input is not a string" }];
-  }
-  if (input.length === 0) return [];
-  if (Buffer.byteLength(input, "utf8") > opts.maxBytes) {
-    return [{ kind: "input-cap", severity: "high",
-              ruleId: "template.input-cap",
-              snippet: "template input exceeds maxBytes " + opts.maxBytes }];
-  }
-
-  var charThreats = codepointClass.detectCharThreats(input, opts, "template");
-  for (var ci = 0; ci < charThreats.length; ci += 1) issues.push(charThreats[ci]);
+  var pre = gateContract.detectStringInput(input, opts, { name: "template", noun: "template input", emptyMode: "ok", cap: { bytes: opts.maxBytes, kind: "input-cap", snippet: "template input exceeds maxBytes " + opts.maxBytes } });
+  if (pre.done) return pre.issues;
+  var issues = pre.issues;
 
   if (opts.jinjaPolicy !== "allow") {
     if (JINJA_EXPR_RE.test(input)) {                                             // allow:regex-no-length-cap — input bounded by maxBytes
@@ -258,13 +210,10 @@ function _detectIssues(input, opts) {
  *   hostile.ok;                                        // → false
  *   hostile.issues.some(function (i) { return i.kind === "jinja-expression"; });  // → true
  */
-function validate(input, opts) {
-  opts = _resolveOpts(opts);
-  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
-    ["maxBytes"],
-    "guardTemplate.validate", GuardTemplateError, "template.bad-opt");
-  return gateContract.aggregateIssues(_detectIssues(input, opts));
-}
+// validate is assembled by gateContract.defineGuard from `detect`
+// (_detectIssues) below — `validate(input, opts) = aggregateIssues(detect(
+// input, resolveOpts(opts)))`, with the maxBytes cap declared via `intOpts`.
+// The @primitive block above documents the resulting public ABI.
 
 /**
  * @primitive  b.guardTemplate.sanitize
@@ -305,13 +254,12 @@ function validate(input, opts) {
  *     e.code;                                          // → "template.jinja-expression"
  *   }
  */
-function sanitize(input, opts) {
-  opts = _resolveOpts(opts);
-  if (typeof input !== "string") {
-    throw _err("template.bad-input", "sanitize requires string input");
-  }
-  var issues = _detectIssues(input, opts);
-  gateContract.throwOnRefusalSeverity(issues, { errorClass: GuardTemplateError, codePrefix: "template" });
+// _sanitizeTransform — the guard-specific normalize applied by defineGuard's
+// generated sanitize AFTER resolve → detect → throw-on-refusal. Input is an
+// already-validated string at this point (a non-string refuses upstream).
+// Template input cannot be repaired safely, so the transform is pass-through:
+// clean input is returned verbatim once no high/critical issue fired.
+function _sanitizeTransform(input) {
   return input;
 }
 
@@ -323,14 +271,8 @@ function sanitize(input, opts) {
 // @abiTemplate (defineGuard) blocks in gate-contract.js, instantiated per
 // guard by the page generator.
 
-var INTEGRATION_FIXTURES = Object.freeze({
-  kind:              "identifier",
-  benignBytes:       Buffer.from("Hello world", "utf8"),
-  hostileBytes:      Buffer.from("Hello {{7*7}}", "utf8"),
-  benignIdentifier:  "Hello world",
-  // Hostile: Jinja-shape SSTI probe.
-  hostileIdentifier: "Hello {{7*7}}",
-});
+// Hostile: Jinja-shape SSTI probe.
+var INTEGRATION_FIXTURES = gateContract.identifierFixtures("Hello world", "Hello {{7*7}}");
 
 // Assembled from the gate-contract guard factory: error class, registry
 // exports (NAME / KIND / INTEGRATION_FIXTURES), the default gate, buildProfile
@@ -347,7 +289,8 @@ module.exports = gateContract.defineGuard({
   defaults:    DEFAULTS,
   postures:    COMPLIANCE_POSTURES,
   integrationFixtures: INTEGRATION_FIXTURES,
-  validate:    validate,
-  sanitize:    sanitize,
+  detect:           _detectIssues,
+  sanitizeTransform: _sanitizeTransform,
+  intOpts:          ["maxBytes"],
   ctxFields:   ["identifier", "text"],
 });

package/lib/guard-tenant-id.js

@@ -24,6 +24,7 @@
 
 var { defineClass } = require("./framework-error");
 var gateContract = require("./gate-contract");
+var codepointClass = require("./codepoint-class");
 
 var GuardTenantIdError = defineClass("GuardTenantIdError", { alwaysPermanent: true });
 
@@ -93,7 +94,7 @@ function validate(tenantId, opts) {
       throw new GuardTenantIdError("tenant-id/non-ascii",
         "guardTenantId.validate: non-ASCII codepoint at offset " + i);
     }
-    if (c < 0x20 || c === 0x7F || c === 0x2F || c === 0x5C) {                                         // C0/DEL/slash/backslash
+    if (codepointClass.isForbiddenControlChar(c, { forbidTab: true }) || c === 0x2F || c === 0x5C) {                                         // C0/DEL/slash/backslash
       throw new GuardTenantIdError("tenant-id/bad-char",
         "guardTenantId.validate: forbidden char 0x" + c.toString(16) + " at offset " + i);
     }