@blamejs/core 0.18.46 → 0.18.48

package/lib/guard-domain.js

@@ -657,7 +657,29 @@ var INTEGRATION_FIXTURES = gateContract.identifierFixtures("example.com", "192.1
 // standard serve -> audit-only -> refuse chain — reading ctx.identifier ||
 // ctx.domain via ctxFields. No sanitize action: an allowlist gate never
 // rewrites the operator's stored allowlist key.
+// Each policy's vocabulary, taken from this guard's own documented opts above,
+// so a misspelling is a boot error rather than a runtime surprise. Read
+// leniently, a typo takes whichever branch is not the strict one:
+// `punycodePolicy: "rejct"` is not "allow", so the check runs, and it is not
+// "reject" either, so the finding drops to a warning — the operator asked to
+// refuse punycode and silently got an audit.
+//
+// trailingDotPolicy is deliberately different on both counts: it takes
+// `normalize` rather than `allow`, and it does NOT take `audit-only`, because
+// its check compares `=== "audit"` exactly and the synonym would not be
+// honoured. A shared list would have advertised it.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "ldhPolicy", "punycodePolicy", "mixedScriptPolicy", "specialUsePolicy",
+  "ipLiteralPolicy", "wildcardPolicy", "singleLabelPolicy", "underscorePolicy",
+  "dgaPolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow, {
+  // No `allow`, and no `audit-only`: a trailing dot is either removed or
+  // reported, and the code compares for "audit" exactly.
+  trailingDotPolicy: ["normalize", "audit", "reject"],
+});
+
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "domain",
   kind:        "identifier",
   errorClass:  GuardDomainError,

package/lib/guard-email.js

@@ -1115,9 +1115,27 @@ var INTEGRATION_FIXTURES = Object.freeze({
 // the address/message entries (validateAddress / validateMessage) passed
 // through verbatim. The bespoke `gate` validates via validateMessage and
 // carries the serve->audit-only->refuse chain unchanged.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `crlfHeaderInjectionPolicy: "rejct"` is not "allow", so the
+// check runs, and it is not "reject" either, so a header-injection attempt
+// drops to a warning.
+//
+// The character policies are absent on purpose — they are derived for the
+// whole guard family, and an entry here would shadow that derivation.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "multiAtPolicy", "ipLiteralPolicy", "punycodePolicy", "mixedScriptPolicy",
+  "addressCommentPolicy", "crlfHeaderInjectionPolicy", "bareCrPolicy",
+  "bareLfPolicy", "smtpSmugglingPolicy", "displayNameSpoofPolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow, {
+  bomPolicy: gateContract.POLICY_VALUES.rejectStripAuditAllow,
+});
+
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "email",
   kind:        "content",
+  charRepair:  true,
   errorClass:  GuardEmailError,
   profiles:    PROFILES,
   defaults:    DEFAULTS,

package/lib/guard-filename.js

@@ -399,7 +399,9 @@ function _detectIssues(input, opts) {
   // by the maxBytes check at the end of this function (issues are
   // reported all-at-once; an oversized name still gets traversal-shape
   // detection so operators see the full failure surface).
-  if (opts.traversalPolicy !== "allow") {
+  // Unconditional, as the opts block has always said: a leaf name has no
+  // legitimate `..` component, so there is no policy value that turns this off.
+  {
     if (_hasTraversalSegment(name) || name === "..") {
       issues.push({
         kind: "path-traversal", severity: "critical",
@@ -457,8 +459,10 @@ function _detectIssues(input, opts) {
     }
   }
 
-  // 6. NTFS alternate data streams — `name:stream`.
-  if (opts.adsPolicy !== "allow") {
+  // 6. NTFS alternate data streams — `name:stream`. Unconditional: a write to
+  // `name:stream` lands on a hidden stream of the base file rather than the
+  // file the caller named, which no policy value makes safe.
+  {
     if (_hasAdsSuffix(name) && name.charAt(0) !== "/") {
       // Only flag when there's a `:` followed by stream-name characters
       // and we're NOT at the start (relative path indicator).
@@ -616,11 +620,9 @@ function _sanitize(input, opts) {
   if (opts.unicodeNormalization === "NFC") name = _normalizeNFC(name);
 
   // Reject path traversal even in sanitize — there's no safe sanitization.
-  if (opts.traversalPolicy === "reject") {
-    if (_hasTraversalSegment(name) || _hasAnyFolded(name, PERCENT_ENCODED_TRAVERSALS) ||
-        name === "." || name === "..") {
-      throw _err("filename.traversal", "filename contains path-traversal sequence");
-    }
+  if (_hasTraversalSegment(name) || _hasAnyFolded(name, PERCENT_ENCODED_TRAVERSALS) ||
+      name === "." || name === "..") {
+    throw _err("filename.traversal", "filename contains path-traversal sequence");
   }
   if (_hasUncPrefix(name)) {
     throw _err("filename.unc", "UNC path syntax");
@@ -659,7 +661,7 @@ function _sanitize(input, opts) {
   }
 
   // ADS detection.
-  if (opts.adsPolicy === "reject" && _hasAdsSuffix(name)) {
+  if (_hasAdsSuffix(name)) {
     throw _err("filename.ntfs-ads", "filename contains NTFS alternate data stream syntax");
   }
 
@@ -707,7 +709,9 @@ function _sanitize(input, opts) {
  *   traversalPolicy:      "reject",                       // always reject
  *   reservedCharPolicy:   "reject"|"strip"|"allow",
  *   reservedNamePolicy:   "reject"|"audit"|"allow",
- *   adsPolicy:            "reject",                       // always reject
+ *   adsPolicy:            "reject"|"allow",               // reject here; "allow"
+ *                                                         //   is honoured only
+ *                                                         //   by verifyExtractionPath
  *   leadingTrailingPolicy: "reject"|"strip"|"allow",
  *   shellExecExtPolicy:   "reject"|"audit"|"allow",
  *   pathSeparatorsPolicy: "reject"|"audit"|"allow",
@@ -1081,7 +1085,7 @@ var PATH_MAX_BYTES = 4096;
  * @opts
  *   followSymlinks:       boolean,  // default false — symlink in the
  *                                   //   resolved path refuses unless set
- *   reservedNamePolicy:   string,   // "allow" opts out of the Windows
+ *   reservedNamePolicy:   string,   // "allow" opts out of the Windows-
  *                                   //   reserved-device-name segment check
  *   adsPolicy:            string,   // "allow" opts out of the NTFS-ADS check
  *   leadingTrailingPolicy: string,  // "allow" opts out of the trailing-dot /
@@ -1303,9 +1307,40 @@ var INTEGRATION_FIXTURES = Object.freeze({
 // factory only supplies the error class, registry exports, buildProfile /
 // compliancePosture / loadRulePack wiring, and the verifyExtractionPath /
 // WIN_RESERVED_NAMES / SHELL_EXEC_EXTS extras.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `reservedNamePolicy: "rejct"` is not "allow", so the check runs,
+// and it is not "reject" either, so the finding drops to a warning.
+//
+// `traversalPolicy` and `nullBytePolicy` take one value each, as the opts block
+// has always said: a leaf name has no legitimate `..` component, and a NUL
+// truncates the name at whichever consumer reads it first. Both were reading
+// `"allow"` to turn the check off — a value neither of them offered, and one
+// the gate's floor overrode anyway, so it disabled the finding while the
+// refusal stood.
+//
+// `adsPolicy` keeps two, for a narrower reason: the detection is likewise a
+// floor, but `verifyExtractionPath` honours `"allow"` for an operator who is
+// deliberately extracting stream-suffixed names. `"audit"` was accepted there
+// and did nothing.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "homoglyphPolicy", "reservedNamePolicy", "shellExecExtPolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow, {
+  // No `audit-only`: the separator check suppresses its finding on the literal
+  // "audit", so the synonym would fail a path-shaped name that "audit" accepts.
+  pathSeparatorsPolicy:  ["reject", "audit", "allow"],
+  traversalPolicy:       ["reject"],
+  nullBytePolicy:        ["reject"],
+  adsPolicy:             ["reject", "allow"],
+  reservedCharPolicy:    ["reject", "strip", "allow"],
+  leadingTrailingPolicy: ["reject", "strip", "allow"],
+});
+
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "filename",
   kind:        "filename",
+  charRepair:  true,
   errorClass:  GuardFilenameError,
   profiles:    PROFILES,
   defaults:    DEFAULTS,

package/lib/guard-graphql.js

@@ -626,7 +626,23 @@ var INTEGRATION_FIXTURES = Object.freeze({
 // surface (validate / sanitize / bespoke gate) passed through verbatim.
 // The custom KIND ("graphql-request") is accepted because the bespoke
 // gate reads its own ctx fields (ctx.graphqlRequest / ctx.gql).
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `introspectionPolicy: "rejct"` is not "allow", so the check
+// runs, and it is not "reject" either, so the finding drops to a warning.
+//
+// `persistedQueryPolicy` opens with "require" rather than "reject" because the
+// finding is an absence: the operator is demanding a persisted-query id, not
+// refusing a construct that appeared.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "introspectionPolicy", "operationNamePolicy", "batchPolicy",
+  "aliasBombPolicy", "depthPolicy", "variableShapePolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow, {
+  persistedQueryPolicy: ["require", "audit", "audit-only", "allow"],
+});
+
 var _guard = module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "graphql",
   kind:        "graphql-request",
   errorClass:  GuardGraphqlError,

package/lib/guard-html.js

@@ -980,9 +980,30 @@ var INTEGRATION_FIXTURES = Object.freeze({
 // (escapeText / escapeAttr / wcag + the tag/attr/scheme/clobber tables)
 // passed through verbatim. The bespoke `gate` carries HTML's
 // sanitize-and-reemit chain unchanged.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `cssPolicy: "rejct"` is not "allow", so the check runs, and it
+// is not "reject" either, so a dangerous style attribute drops to a warning.
+//
+// The opts block types these as `string` rather than naming the values; these
+// are the values the profiles use and the code compares against.
+//
+// The character policies are absent on purpose — they are derived for the
+// whole guard family, and an entry here would shadow that derivation.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "cssPolicy", "domClobberPolicy",
+], gateContract.POLICY_VALUES.rejectStripAuditAllow, {
+  mxssHintPolicy: gateContract.POLICY_VALUES.rejectAuditAllow,
+});
+
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "html",
   kind:        "content",
+  // sanitize rewrites the document, so `strip` on a character policy is an
+  // instruction this guard can carry out. Declared rather than inferred from
+  // the presence of a sanitize — an identifier guard has one that only throws.
+  charRepair:  true,
   errorClass:  GuardHtmlError,
   profiles:    PROFILES,
   defaults:    DEFAULTS,

package/lib/guard-image.js

@@ -161,6 +161,21 @@ var DEFAULTS = gateContract.strictDefaults(PROFILES);
 // maxRuntimeMs among them, where zero means no runtime budget.
 var INT_OPTS = ["maxBytes", "maxWidth", "maxHeight", "maxFrames"];
 
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `polyglotPolicy: "rejct"` is not "allow", so the check runs, and
+// it is not "reject" either, so the finding drops to a warning.
+//
+// Declared up here because `gate()` below binds its own resolver and needs the
+// same table. Given to the generated path alone, a bad value survived gate
+// construction and surfaced as a refusal on the first image request — a deploy
+// that boots clean and then refuses the route, which is the opposite of what
+// checking at construction is for.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "magicPolicy", "mismatchPolicy", "polyglotPolicy", "svgRoutingPolicy",
+  "dimensionsPolicy", "framesPolicy", "unknownMagicPolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow);
+
 var COMPLIANCE_POSTURES = gateContract.compliancePostures(PROFILES, { base: 256 });
 
 function _bytesAt(buf, offset, sig) {
@@ -676,6 +691,9 @@ function gate(opts) {
     // caller to identical rules.
     intOpts:            INT_OPTS,
     nonNegativeOpts:    gateContract.capKeysOf(DEFAULTS),
+    // And the same policy vocabulary, for the same reason as the limits: a
+    // door that skips it accepts a value the other doors refuse.
+    enumOpts:           POLICY_ENUM,
   });
   return gateContract.buildGuardGate(
     opts.name || "guardImage:" + (opts.profile || "default"),
@@ -745,6 +763,7 @@ var INTEGRATION_FIXTURES = Object.freeze({
 // (operator-feeds-metadata ctx.metadata reader) is REQUIRED and carries the
 // magic-byte / polyglot / dimension chain unchanged.
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "image",
   kind:        "metadata",
   errorClass:  GuardImageError,

package/lib/guard-json.js

@@ -1083,9 +1083,33 @@ var INTEGRATION_FIXTURES = Object.freeze({
 // per-guard inspection surface (validate / parse) and JSON extras
 // (POLLUTION_KEYS, surfaced from the framework's canonical pick.POISONED_KEYS).
 // The bespoke `gate` carries JSON's sanitize-reparse-reserialize chain unchanged.
+// Each policy's vocabulary, taken from this guard's documented opts and
+// confirmed against what the code compares, so a misspelling is a boot error
+// rather than a runtime surprise. Read leniently, a typo takes whichever branch
+// is not the strict one: `duplicateKeyPolicy: "rejct"` is not "allow", so the
+// check runs, and it is not "reject" either, so the finding drops to a warning
+// — the operator asked to refuse a duplicate key and silently got an audit.
+//
+// The character policies are deliberately absent: they are derived for the
+// whole family, and an explicit entry here would override that derivation with
+// a narrower copy.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "duplicateKeyPolicy", "nanInfinityPolicy", "commentPolicy",
+  "trailingCommaPolicy", "json5SyntaxPolicy", "numericPrecisionPolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow, {
+  // No `audit-only`: the parse path decides whether to preserve a poison-named
+  // key by testing for the literal "audit", so the synonym would strip
+  // `__proto__` where "audit" keeps it — a silent difference in the parsed
+  // data, not in a finding.
+  pollutionPolicy: ["reject", "strip", "audit", "allow"],
+  bomPolicy:       ["reject", "strip", "allow"],
+});
+
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "json",
   kind:        "content",
+  charRepair:  true,
   errorClass:  GuardJsonError,
   profiles:    PROFILES,
   defaults:    DEFAULTS,

package/lib/guard-jsonpath.js

@@ -257,7 +257,7 @@ function _detectIssues(input, opts) {
  *   bidiPolicy:             "reject"|"audit"|"allow",
  *   controlPolicy:          "reject"|"audit"|"allow",
  *   nullBytePolicy:         "reject"|"audit"|"allow",
- *   zeroWidthPolicy:        "reject"|"strip"|"audit"|"allow",
+ *   zeroWidthPolicy:        "reject"|"audit"|"allow",
  *   filterExprPolicy:       "reject"|"audit"|"allow",
  *   scriptExprPolicy:       "reject"|"audit"|"allow",
  *   dynamicHintPolicy:      "reject"|"audit"|"allow",
@@ -350,7 +350,20 @@ var INTEGRATION_FIXTURES = gateContract.identifierFixtures("$.users[*].name", "$
 // surface (validate / sanitize). The gate is the factory default
 // serve/audit-only/refuse chain, reading the path from
 // `ctx.identifier` || `ctx.jsonpath` via `ctxFields`.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `scriptExprPolicy: "rejct"` is not "allow", so the check runs,
+// and it is not "reject" either, so the finding drops to a warning.
+//
+// The character policies are absent on purpose — they are derived for the
+// whole guard family, and an entry here would shadow that derivation.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "filterExprPolicy", "scriptExprPolicy", "dynamicHintPolicy",
+  "bracketNestingPolicy", "recursiveDescentPolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow);
+
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "jsonpath",
   kind:        "identifier",
   errorClass:  GuardJsonpathError,

package/lib/guard-jwt.js

@@ -283,8 +283,10 @@ function _detectIssues(input, opts) {
     }
   }
 
-  // kid path-traversal.
-  if (opts.kidTraversalPolicy !== "allow" && _hasKidTraversal(header.kid)) {
+  // kid path-traversal. Unconditional: `kid` steers key lookup, so a traversal
+  // sequence in it is critical at every profile and there is no policy value
+  // that turns the check off.
+  if (_hasKidTraversal(header.kid)) {
     issues.push({
       kind: "kid-traversal", severity: "critical",
       ruleId: "jwt.kid-traversal",
@@ -578,7 +580,23 @@ var INTEGRATION_FIXTURES = gateContract.identifierFixtures(
 // default gate (no bespoke `gate` passed) and the factory supplies the
 // error class, registry exports, buildProfile / compliancePosture /
 // loadRulePack wiring, and the kidSafe extra.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `typConfusionPolicy: "rejct"` is not "allow", so the check runs,
+// and it is not "reject" either, so the finding drops from high to warn.
+//
+// `algNonePolicy` and `kidTraversalPolicy` take one value each because both
+// threats are unconditional, as their opts block has always said.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "algAllowlistPolicy", "typConfusionPolicy", "expSanityPolicy",
+  "nbfSanityPolicy", "iatSanityPolicy", "critUnknownPolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow, {
+  algNonePolicy:      ["reject"],
+  kidTraversalPolicy: ["reject"],
+});
+
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "jwt",
   kind:        "identifier",
   errorClass:  GuardJwtError,

package/lib/guard-markdown.js

@@ -1902,9 +1902,35 @@ function render(source, opts) {
   }
 }
 
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `dangerousSchemePolicy: "rejct"` is not "allow", so the check
+// runs, and it is not "reject" either, so a `javascript:` link drops to a
+// warning.
+//
+// "strip" is listed only where the opts block offers it — that is, where the
+// renderer can remove the construct and still produce a document. Advertising
+// it more widely would route a finding to a repair that never happens, which
+// is the shape that lets an unrepaired document through as sanitized.
+//
+// The character policies are absent on purpose — they are derived for the
+// whole guard family, and an entry here would shadow that derivation.
+var REPAIRABLE = ["dangerousTagPolicy", "dangerousSchemePolicy",
+                  "autolinkSchemePolicy", "imageSchemePolicy",
+                  "referenceLinkPolicy", "doctypePolicy", "codeFenceLangPolicy"];
+var REPORT_ONLY = ["rawHtmlPolicy", "htmlCommentPolicy", "frontMatterPolicy",
+                   "emphasisRunPolicy", "filePolicy"];
+
+var POLICY_ENUM = gateContract.policyVocabulary(
+  REPAIRABLE, gateContract.POLICY_VALUES.rejectStripAuditAllow,
+  gateContract.policyVocabulary(
+    REPORT_ONLY, gateContract.POLICY_VALUES.rejectAuditAllow));
+
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "markdown",
   kind:        "content",
+  charRepair:  true,
   errorClass:  GuardMarkdownError,
   profiles:    PROFILES,
   base:        256,

package/lib/guard-mime.js

@@ -328,15 +328,15 @@ function _detectIssues(input, opts) {
  * @opts
  *   profile:                "strict"|"balanced"|"permissive",
  *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
- *   bidiPolicy:             "reject"|"strip"|"audit"|"allow",
- *   controlPolicy:          "reject"|"strip"|"allow",
- *   nullBytePolicy:         "reject"|"strip"|"allow",
- *   zeroWidthPolicy:        "reject"|"strip"|"allow",
+ *   bidiPolicy:             "reject"|"audit"|"allow",
+ *   controlPolicy:          "reject"|"audit"|"allow",
+ *   nullBytePolicy:         "reject"|"audit"|"allow",
+ *   zeroWidthPolicy:        "reject"|"audit"|"allow",
  *   wildcardPolicy:         "reject"|"audit"|"allow",
  *   vendorTreePolicy:       "reject"|"audit"|"allow",
  *   personalTreePolicy:     "reject"|"audit"|"allow",
  *   unregisteredTreePolicy: "reject"|"audit"|"allow",
- *   riskyTypesPolicy:       "reject"|"audit"|"allow",
+ *   riskyTypePolicy:        "reject"|"audit"|"allow",
  *   parameterPolicy:        "reject"|"audit"|"allow",
  *   maxBytes:               number,    // default 256 (RFC-recommended cap)
  *
@@ -418,7 +418,17 @@ var INTEGRATION_FIXTURES = gateContract.identifierFixtures("application/json", "
 // compliancePosture / loadRulePack wiring, plus the per-guard inspection
 // surface (validate / sanitize). The gate is the factory default chain,
 // dispatched to `ctx.identifier` / `ctx.mime` via ctxFields.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `wildcardPolicy: "rejct"` is not "allow", so the check runs, and
+// it is not "reject" either, so the finding drops from high to warn.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "wildcardPolicy", "vendorTreePolicy", "personalTreePolicy",
+  "unregisteredTreePolicy", "riskyTypePolicy", "parameterPolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow);
+
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "mime",
   kind:        "identifier",
   errorClass:  GuardMimeError,

package/lib/guard-oauth.js

@@ -574,7 +574,30 @@ var INTEGRATION_FIXTURES = Object.freeze({
 // surface (validate / sanitize / bespoke gate) passed through verbatim.
 // The custom KIND ("oauth-flow") is accepted because the bespoke gate
 // reads its own ctx fields (ctx.oauthFlow / ctx.flow).
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `statePolicy: "requre"` is not "allow", so the check runs, and
+// it is not "require" either, so a missing state parameter drops to a warning.
+//
+// Several of these open with "require" rather than "reject" because the
+// finding is an absence — no PKCE challenge, no state, no issuer on the
+// callback — so the operator is demanding a parameter, not refusing one.
+var POLICY_ENUM = gateContract.policyVocabulary(
+  ["scopeTamperingPolicy"], gateContract.POLICY_VALUES.rejectAuditAllow, {
+    // No `audit-only`: the PKCE check tests for the literal "audit", so the
+    // synonym would take the enforcing branch and refuse a flow that plain
+    // "audit" serves with a finding. Refusing the value is the honest answer
+    // — the operator picks a spelling that means what they want.
+    pkcePolicy:             ["require-s256", "require-any", "audit", "allow"],
+    statePolicy:            ["require", "audit", "audit-only", "allow"],
+    redirectUriPolicy:      ["require-exact-allowlist", "audit", "audit-only", "allow"],
+    responseTypePolicy:     ["require-allowlist", "audit", "audit-only", "allow"],
+    issuerOnCallbackPolicy: ["require", "audit", "audit-only", "allow"],
+    codeReusePolicy:        ["reject", "allow"],
+  });
+
 var _guard = module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "oauth",
   kind:        "oauth-flow",
   errorClass:  GuardOauthError,

package/lib/guard-pdf.js

@@ -141,6 +141,20 @@ var DEFAULTS = gateContract.strictDefaults(PROFILES);
 // generated validate() does. See guard-image for the full reasoning.
 var INT_OPTS = ["maxBytes", "maxPageCount"];
 
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `javascriptPolicy: "rejct"` is not "allow", so the check runs,
+// and it is not "reject" either, so an embedded script drops to a warning.
+//
+// Declared up here because `gate()` below binds its own resolver and needs the
+// same table. Given to the generated path alone, a bad value survived gate
+// construction and surfaced as a refusal on the first PDF request.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "magicPolicy", "javascriptPolicy", "launchActionPolicy", "openActionPolicy",
+  "embeddedFilePolicy", "embeddedFileCountPolicy", "encryptedPolicy",
+  "polyglotPolicy", "pageCountPolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow);
+
 var COMPLIANCE_POSTURES = gateContract.compliancePostures(PROFILES, { base: 512 });
 
 function _hasPdfMagic(buf) {
@@ -441,9 +455,12 @@ function gate(opts) {
     defaults:           DEFAULTS,
     errorClass:         GuardPdfError,
     errCodePrefix:      "pdf",
-    // Own resolver, own cap declaration — see guard-image.gate.
+    // Own resolver, own cap declaration — see guard-image.gate. The policy
+    // vocabulary comes with it, for the same reason: a door that skips it
+    // accepts a value the other doors refuse.
     intOpts:            INT_OPTS,
     nonNegativeOpts:    gateContract.capKeysOf(DEFAULTS),
+    enumOpts:           POLICY_ENUM,
   });
   return gateContract.buildGuardGate(
     opts.name || "guardPdf:" + (opts.profile || "default"),
@@ -512,6 +529,7 @@ var INTEGRATION_FIXTURES = Object.freeze({
 // (operator-feeds-metadata ctx.metadata reader) is REQUIRED and carries the
 // JavaScript / launch-action / embedded-file chain unchanged.
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "pdf",
   kind:        "metadata",
   errorClass:  GuardPdfError,

package/lib/guard-regex.js

@@ -2586,7 +2586,7 @@ function _detectNestedExtglob(input, opts, issues) {
  *   bidiPolicy:             "reject"|"audit"|"allow",
  *   controlPolicy:          "reject"|"audit"|"allow",
  *   nullBytePolicy:         "reject"|"audit"|"allow",
- *   zeroWidthPolicy:        "reject"|"strip"|"audit"|"allow",
+ *   zeroWidthPolicy:        "reject"|"audit"|"allow",
  *   nestedQuantPolicy:      "reject"|"audit"|"allow",
  *   alternationQuantPolicy: "reject"|"audit"|"allow",
  *   boundedRepeatPolicy:    "reject"|"audit"|"allow",
@@ -2840,7 +2840,22 @@ function assertSafe(input, label, ErrorClass, code, opts) {
 // compliancePosture / loadRulePack wiring, plus the per-guard inspection
 // surface (validate / sanitize / gate). The bespoke `gate` carries
 // guardRegex's ctx.identifier || ctx.pattern dispatch unchanged.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `nestedQuantPolicy: "rejct"` is not "allow", so the check runs,
+// and it is not "reject" either, so a catastrophic-backtracking pattern drops
+// from high to warn.
+//
+// The character policies are absent on purpose — they are derived for the
+// whole guard family, and an entry here would shadow that derivation.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "nestedQuantPolicy", "alternationQuantPolicy", "boundedRepeatPolicy",
+  "lookaroundQuantPolicy", "consecutiveStarPolicy", "nestedExtglobPolicy",
+  "unanchoredScanPolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow);
+
 var _guard = module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "regex",
   kind:        "identifier",
   errorClass:  GuardRegexError,

package/lib/guard-shell.js

@@ -241,7 +241,7 @@ function _detectIssues(input, opts) {
  *   bidiPolicy:        "reject"|"audit"|"allow",
  *   controlPolicy:     "reject"|"audit"|"allow",
  *   nullBytePolicy:    "reject"|"audit"|"allow",
- *   zeroWidthPolicy:   "reject"|"strip"|"audit"|"allow",
+ *   zeroWidthPolicy:   "reject"|"audit"|"allow",
  *   posixMetaPolicy:   "reject"|"audit"|"allow",
  *   cmdMetaPolicy:     "reject"|"audit"|"allow",
  *   dollarSubstPolicy: "reject"|"audit"|"allow",
@@ -338,7 +338,20 @@ var INTEGRATION_FIXTURES = gateContract.identifierFixtures("safe-arg-value", "sa
 // compliancePosture / loadRulePack wiring, plus the per-guard inspection
 // surface (validate / sanitize). The gate is the factory default chain,
 // dispatched to `ctx.identifier` / `ctx.arg` via ctxFields.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `backtickPolicy: "rejct"` is not "allow", so the check runs, and
+// it is not "reject" either, so command substitution drops to a warning.
+//
+// The character policies are absent on purpose — they are derived for the
+// whole guard family, and an entry here would shadow that derivation.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "posixMetaPolicy", "cmdMetaPolicy", "dollarSubstPolicy", "processSubstPolicy",
+  "backtickPolicy", "newlinePolicy", "argHyphenPolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow);
+
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "shell",
   kind:        "identifier",
   errorClass:  GuardShellError,

package/lib/guard-svg.js

@@ -1005,9 +1005,27 @@ var INTEGRATION_FIXTURES = Object.freeze({
 // unchanged; neither reduces to the dynamic
 // detect→throwOnRefusalSeverity→transform path (same-severity findings
 // split throw-vs-strip), so both stay bespoke.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `cdataPolicy: "rejct"` is not "allow", so the check runs, and it
+// is not "reject" either, so the finding drops from critical to warn.
+//
+// `svgzPolicy` takes one value: a gzip signature is refused before any parse
+// and sanitize throws on it, so no other value has ever meant anything.
+//
+// The character policies are absent on purpose — they are derived for the whole
+// guard family, and an entry here would shadow that derivation.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "cssPolicy", "doctypePolicy", "cdataPolicy", "processingInstrPolicy",
+], gateContract.POLICY_VALUES.rejectStripAuditAllow, {
+  svgzPolicy: ["reject"],
+});
+
 var _guard = module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "svg",
   kind:        "content",
+  charRepair:  true,
   errorClass:  GuardSvgError,
   profiles:    PROFILES,
   defaults:    DEFAULTS,