@blamejs/core 0.18.39 → 0.18.40

package/lib/guard-yaml.js

@@ -735,6 +735,69 @@ function _sanitizeTransform(input, opts) {
   return codepointClass.scrubCharThreats(input, opts, _err, "yaml");
 }
 
+/**
+ * @primitive  b.guardYaml.gate
+ * @signature  b.guardYaml.gate(opts?)
+ * @since      0.7.14
+ * @status     stable
+ * @compliance hipaa, pci-dss, gdpr, soc2
+ * @related    b.guardYaml.validate, b.guardYaml.parse, b.staticServe.create, b.fileUpload.create
+ *
+ * Build a `b.gateContract` gate for plugging into
+ * `b.staticServe({ contentSafety: { ".yaml": gate } })`,
+ * `b.fileUpload({ contentSafety: { "application/yaml": gate } })`,
+ * or any host primitive that consumes the gate-contract shape.
+ *
+ * The action comes from the POLICY the active profile declares for each
+ * finding, not from the finding's severity: a character class set to `strip`
+ * is repaired and returned as `sanitize`, one set to `audit` reports
+ * `audit-only`, and one set to `reject` refuses. Findings that carry no policy
+ * and admit no repair — an alias explosion, a blown anchor cap, an oversized
+ * document, one that does not parse — fall back to the conservative severity
+ * answer and refuse.
+ *
+ * Only character-level repair is offered. Stripping an invisible or control
+ * character is a text edit needing no re-emit; the tag, alias and
+ * multi-document shapes have no faithful round-trip, so they refuse through
+ * their own policies rather than being rewritten.
+ *
+ * @opts
+ *   profile:    "strict"|"balanced"|"permissive",
+ *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
+ *   name:       string,    // gate identity for audit / observability
+ *
+ * @example
+ *   var yamlGate = b.guardYaml.gate({ profile: "balanced" });
+ *   var d = await yamlGate.check({ bytes: Buffer.from("key: value\n") });
+ *   d.action;                                            // → "serve"
+ */
+// The gate every other content guard builds explicitly. Without it `defineGuard`
+// falls back to the default gate, which ends in `severityDisposition` and never
+// consults this guard's disposition map — so a class the profile sets to `strip`
+// or `audit` was refused anyway, because its finding happens to carry a high
+// severity. Seven of the twelve character-policy cells resolved that way.
+function gate(opts) {
+  // Resolve the profile FIRST. `buildContentGate` hands these opts straight to
+  // the disposition map, and an unresolved bag carries no `zeroWidthPolicy` /
+  // `bidiPolicy` / `controlPolicy` / `nullBytePolicy` at all — so every char
+  // finding falls through to the severity answer and refuses, which is the
+  // same wrong outcome by a different route.
+  opts = gateContract.resolveProfileAndPosture(opts, {
+    profiles:           PROFILES,
+    compliancePostures: COMPLIANCE_POSTURES,
+    defaults:           DEFAULTS,
+    errorClass:         GuardYamlError,
+    errCodePrefix:      "yaml",
+  });
+  return gateContract.buildContentGate({
+    name:     opts.name || "guardYaml:" + (opts.profile || "default"),
+    opts:     opts,
+    validate: module.exports.validate,
+    dispositionFor:   _gateDispositionFor,
+    produceSanitized: _sanitizeTransform,
+  });
+}
+
 module.exports = gateContract.defineGuard({
   name:        "yaml",
   kind:        "content",
@@ -748,6 +811,7 @@ module.exports = gateContract.defineGuard({
   detect:      _detectIssues,
   intOpts:     ["maxBytes", "maxDepth", "maxAnchors", "maxAliasDepth",
                 "maxDocuments", "maxNodes", "maxScalarLength"],
+  gate:              gate,
   dispositionFor:    _gateDispositionFor,
   sanitizeTransform: _sanitizeTransform,
   extra: {