@blamejs/core 0.18.46 → 0.18.48

package/lib/guard-template.js

@@ -228,7 +228,7 @@ function _detectIssues(input, opts) {
  *   bidiPolicy:              "reject"|"audit"|"allow",
  *   controlPolicy:           "reject"|"audit"|"allow",
  *   nullBytePolicy:          "reject"|"audit"|"allow",
- *   zeroWidthPolicy:         "reject"|"strip"|"audit"|"allow",
+ *   zeroWidthPolicy:         "reject"|"audit"|"allow",
  *   jinjaPolicy:             "reject"|"audit"|"allow",
  *   erbPolicy:               "reject"|"audit"|"allow",
  *   pugPolicy:               "reject"|"audit"|"allow",
@@ -316,7 +316,20 @@ var INTEGRATION_FIXTURES = gateContract.identifierFixtures("Hello world", "Hello
 // factory default serve -> audit-only -> refuse chain; ctxFields names the
 // ctx fields it reads (ctx.identifier, then ctx.text) so untrusted strings on
 // either field reach the SSTI validator before any engine renders them.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `jinjaPolicy: "rejct"` is not "allow", so the check runs, and it
+// is not "reject" either, so the finding drops to a warning.
+//
+// The character policies are absent on purpose — they are derived for the
+// whole guard family, and an entry here would shadow that derivation.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "jinjaPolicy", "erbPolicy", "pugPolicy", "dollarBracePolicy",
+  "velocityDirectivePolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow);
+
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "template",
   kind:        "identifier",
   errorClass:  GuardTemplateError,

package/lib/guard-text.js

@@ -118,6 +118,20 @@ var COMPLIANCE_POSTURES = gateContract.compliancePostures(PROFILES, { base: 256
 // so this guard's hand-bound resolver holds a caller to the same rules the
 // generated validate() does. maxRuntimeMs is deliberately absent: zero there
 // means no runtime budget. See guard-image for the full reasoning.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `encodingPolicy: "rejct"` is not "allow", so the check runs, and
+// it is not "reject" either, so malformed UTF-8 drops to a warning.
+var POLICY_ENUM = gateContract.policyVocabulary(
+  ["confusablePolicy", "encodingPolicy"],
+  gateContract.POLICY_VALUES.rejectAuditAllow);
+
+// The same table for the entry points that bind their own resolver, with the
+// family's character policies folded in — defineGuard adds those itself, a
+// hand-bound resolver has to be given them.
+var RESOLVER_ENUMS = Object.freeze(Object.assign({},
+  gateContract.charPolicyEnums(DEFAULTS, { canRepair: true }), POLICY_ENUM));
+
 var INT_OPTS = ["maxBytes"];
 
 // ---- Internal helpers ----
@@ -129,9 +143,13 @@ function _resolveOpts(opts) {
     defaults:           DEFAULTS,
     errorClass:         GuardTextError,
     errCodePrefix:      "text",
-    // Own resolver, own cap declaration — see guard-image.gate.
+    // Own resolver, own cap declaration — see guard-image.gate. The policy
+    // vocabulary comes with it for the same reason: a hand-bound resolver that
+    // omits it accepts `bidiPolicy: "rejct"` on gate() and validate() while the
+    // generated path refuses it.
     intOpts:            INT_OPTS,
     nonNegativeOpts:    gateContract.capKeysOf(DEFAULTS),
+    enumOpts:           RESOLVER_ENUMS,
   });
 }
 
@@ -571,8 +589,10 @@ var INTEGRATION_FIXTURES = Object.freeze({
 // inspection surface (validate / sanitize / gate). The bespoke `gate` carries
 // the text sanitize-then-refuse chain (confusables are non-repairable).
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "text",
   kind:        "content",
+  charRepair:  true,
   errorClass:  GuardTextError,
   profiles:    PROFILES,
   defaults:    DEFAULTS,

package/lib/guard-time.js

@@ -299,10 +299,10 @@ function _detectIssues(input, opts) {
  * @opts
  *   profile:                "strict"|"balanced"|"permissive",
  *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
- *   bidiPolicy:             "reject"|"strip"|"audit"|"allow",
- *   controlPolicy:          "reject"|"strip"|"allow",
- *   nullBytePolicy:         "reject"|"strip"|"allow",
- *   zeroWidthPolicy:        "reject"|"strip"|"allow",
+ *   bidiPolicy:             "reject"|"audit"|"allow",
+ *   controlPolicy:          "reject"|"audit"|"allow",
+ *   nullBytePolicy:         "reject"|"audit"|"allow",
+ *   zeroWidthPolicy:        "reject"|"audit"|"allow",
  *   naiveDatetimePolicy:    "reject"|"audit"|"allow",
  *   nonUtcOffsetPolicy:     "reject"|"audit"|"allow",
  *   leapSecondPolicy:       "reject"|"audit"|"allow",
@@ -393,7 +393,23 @@ var INTEGRATION_FIXTURES = gateContract.identifierFixtures("2026-05-05T12:34:56Z
 // surface (validate / sanitize). The gate is the factory default — the
 // standard serve -> audit-only -> refuse chain — reading
 // ctx.identifier / ctx.timestamp / ctx.time via ctxFields.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `naiveDatetimePolicy: "rejct"` is not "allow", so the check
+// runs, and it is not "reject" either, so a zone-less timestamp drops to a
+// warning.
+//
+// `fractionalDigitsPolicy` carries "truncate" because over-precise fractional
+// seconds are the one finding here that can be repaired rather than reported.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "naiveDatetimePolicy", "nonUtcOffsetPolicy", "leapSecondPolicy",
+  "dateOnlyPolicy", "timeOnlyPolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow, {
+  fractionalDigitsPolicy: ["reject", "truncate", "audit", "audit-only", "allow"],
+});
+
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "time",
   kind:        "identifier",
   errorClass:  GuardTimeError,

package/lib/guard-uuid.js

@@ -286,10 +286,10 @@ function _detectIssues(input, opts) {
  * @opts
  *   profile:                "strict"|"balanced"|"permissive",
  *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
- *   bidiPolicy:             "reject"|"strip"|"audit"|"allow",
- *   controlPolicy:          "reject"|"strip"|"allow",
- *   nullBytePolicy:         "reject"|"strip"|"allow",
- *   zeroWidthPolicy:        "reject"|"strip"|"allow",
+ *   bidiPolicy:             "reject"|"audit"|"allow",
+ *   controlPolicy:          "reject"|"audit"|"allow",
+ *   nullBytePolicy:         "reject"|"audit"|"allow",
+ *   zeroWidthPolicy:        "reject"|"audit"|"allow",
  *   formatPolicy:           "hyphenated"|"hyphenless"|"braced"|"urn"|"hyphenated-only"|"any",
  *   versionPolicy:          "reject-unassigned"|"audit"|"allow",
  *   variantPolicy:          "reject-non-rfc"|"audit"|"allow",
@@ -371,10 +371,34 @@ var INTEGRATION_FIXTURES = gateContract.identifierFixtures("550e8400-e29b-41d4-a
 // surface (validate / sanitize). The gate is the factory default — the
 // standard serve -> audit-only -> refuse chain — reading ctx.identifier ||
 // ctx.uuid via ctxFields.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `versionPolicy: "reject-unassinged"` is not "allow", so the check
+// runs, and it is not the reject spelling either, so the finding drops to a
+// warning — the operator asked to refuse an unassigned version and silently got
+// an audit. The values are the ones written beside each profile entry above,
+// confirmed against what the code compares.
+//
+// `audit-only` rides with `audit` because it behaves identically here and the
+// framework treats them as synonyms everywhere else; refusing it here while
+// accepting it elsewhere would be a fresh disagreement between two spellings of
+// one setting.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "nilPolicy", "maxPolicy", "urnPolicy", "bracedPolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow, {
+  // These three name their own values because their findings are not "this
+  // construct appeared" but "the identifier is the wrong shape", and the
+  // refusal has to say which shape it wanted.
+  formatPolicy:  ["hyphenated", "hyphenless", "braced", "urn", "hyphenated-only", "any"],
+  versionPolicy: ["reject-unassigned", "audit", "audit-only", "allow"],
+  variantPolicy: ["reject-non-rfc", "audit", "audit-only", "allow"],
+});
+
 module.exports = gateContract.defineGuard({
   name:        "uuid",
   kind:        "identifier",
   errorClass:  GuardUuidError,
+  enumOpts:    POLICY_ENUM,
   profiles:    PROFILES,
   defaults:    DEFAULTS,
   postures:    COMPLIANCE_POSTURES,

package/lib/guard-xml.js

@@ -733,9 +733,29 @@ var INTEGRATION_FIXTURES = Object.freeze({
 // ENTITY / external / parameter-entity throwing while strip-able char-class
 // threats are repaired. The bespoke `gate` carries XML's per-policy
 // canSanitize matrix unchanged.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `externalEntityPolicy: "rejct"` is not "allow", so the check
+// runs, and it is not "reject" either, so an XXE vector drops to a warning.
+//
+// `xmlDsigPolicy` has no "reject": a signature block is a legitimate part of a
+// signed document, so the guard reports its presence and leaves verification
+// to the caller rather than refusing the document for carrying one.
+//
+// The character policies are absent on purpose — they are derived for the
+// whole guard family, and an entry here would shadow that derivation.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "doctypePolicy", "entityPolicy", "externalEntityPolicy", "xincludePolicy",
+  "processingInstrPolicy", "cdataPolicy", "schemaLocationPolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow, {
+  xmlDsigPolicy: ["audit", "audit-only", "allow"],
+});
+
 var _guard = module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "xml",
   kind:        "content",
+  charRepair:  true,
   errorClass:  GuardXmlError,
   profiles:    PROFILES,
   defaults:    DEFAULTS,

package/lib/guard-yaml.js

@@ -262,6 +262,25 @@ var COMPLIANCE_POSTURES = gateContract.compliancePostures(PROFILES, { base: 256
 // The options that are genuinely CAPS, where zero is not a setting — named once
 // so this guard's hand-bound parse() and gate() hold a caller to the same rules
 // the generated validate() does. See guard-image for the full reasoning.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `aliasPolicy: "rejct"` is not "allow", so the check runs, and it
+// is not "reject" either, so a billion-laughs alias drops to a warning.
+//
+// `audit-only` is absent: tagPolicy tests for "audit" exactly, and a guard
+// whose policies do not all take the same values is worse than one that takes
+// fewer.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "tagPolicy", "aliasPolicy", "multiDocPolicy", "norwayPolicy",
+  "leadingZeroPolicy", "duplicateKeyPolicy", "mergeKeyPolicy",
+], ["reject", "audit", "allow"]);
+
+// The same table for the entry points that bind their own resolver, with the
+// family's character policies folded in — defineGuard adds those itself, a
+// hand-bound resolver has to be given them.
+var RESOLVER_ENUMS = Object.freeze(Object.assign({},
+  gateContract.charPolicyEnums(DEFAULTS, { canRepair: true }), POLICY_ENUM));
+
 var INT_OPTS = ["maxBytes", "maxDepth", "maxAnchors", "maxAliasDepth",
                 "maxDocuments", "maxNodes", "maxScalarLength"];
 
@@ -648,9 +667,12 @@ function parse(input, opts) {
     defaults:           DEFAULTS,
     errorClass:         GuardYamlError,
     errCodePrefix:      "yaml",
-    // Own resolver, own cap declaration — see guard-image.gate.
+    // Own resolver, own cap declaration — see guard-image.gate. The policy
+    // vocabulary comes with it: a hand-bound resolver that omits it accepts
+    // `bidiPolicy: "rejct"` here while the generated path refuses it.
     intOpts:            INT_OPTS,
     nonNegativeOpts:    gateContract.capKeysOf(DEFAULTS),
+    enumOpts:           RESOLVER_ENUMS,
   });
   if (typeof input !== "string") {
     throw _err("yaml.bad-input", "parse requires string input");
@@ -797,9 +819,12 @@ function gate(opts) {
     defaults:           DEFAULTS,
     errorClass:         GuardYamlError,
     errCodePrefix:      "yaml",
-    // Own resolver, own cap declaration — see guard-image.gate.
+    // Own resolver, own cap declaration — see guard-image.gate. The policy
+    // vocabulary comes with it: a hand-bound resolver that omits it accepts
+    // `bidiPolicy: "rejct"` here while the generated path refuses it.
     intOpts:            INT_OPTS,
     nonNegativeOpts:    gateContract.capKeysOf(DEFAULTS),
+    enumOpts:           RESOLVER_ENUMS,
   });
   return gateContract.buildContentGate({
     name:     opts.name || "guardYaml:" + (opts.profile || "default"),
@@ -811,8 +836,10 @@ function gate(opts) {
 }
 
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "yaml",
   kind:        "content",
+  charRepair:  true,
   errorClass:  GuardYamlError,
   profiles:    PROFILES,
   defaults:    DEFAULTS,

package/lib/network-dns.js

@@ -2086,8 +2086,13 @@ function isNullMx(mxRecords) {
  * Classify a DNSKEY / RRSIG algorithm number against the IANA DNS
  * Security Algorithm Numbers registry, flagging SHA-1-based and
  * other deprecated algorithms per RFC 9905 (Deprecating DNSSEC
- * SHA-1 Usage), RFC 8624 (Algorithm Implementation Requirements),
- * and RFC 6944 / RFC 6725 (RSAMD5 deprecation).
+ * SHA-1 Usage), RFC 9904 (Algorithm Implementation Requirements,
+ * which obsoletes RFC 8624), and RFC 6725 (RSAMD5 deprecation).
+ *
+ * `deprecated` answers "should this still be accepted", so it follows
+ * the VALIDATION requirement. Where a spelling differs between signing
+ * and validation — RSASHA512 is NOT RECOMMENDED to sign with but MUST
+ * still validate — the `reason` names both, since one boolean cannot.
  *
  * Returns `{ algorithm, name, deprecated, reason, known }` for any
  * IANA-assigned number; `known: false` for unassigned numbers
@@ -2123,18 +2128,22 @@ function isNullMx(mxRecords) {
 // auditing DNSSEC chain-of-trust evidence know they cannot validate
 // the entry against a public algorithm registry.
 var DNSKEY_ALGORITHMS = Object.freeze({
-  1:   { name: "RSAMD5",             deprecated: true,  reason: "MD5 broken (RFC 6944 §2.1, RFC 6725)" },
+  1:   { name: "RSAMD5",             deprecated: true,  reason: "MD5 broken; deprecated for zone signing (RFC 6725 §2.2)" },
   2:   { name: "DH",                 deprecated: true,  reason: "Diffie-Hellman key (RFC 2539) — never widely deployed; superseded by signature algorithms" },
-  3:   { name: "DSA",                deprecated: true,  reason: "DSA deprecated (RFC 8624 §3.1)" },
+  3:   { name: "DSA",                deprecated: true,  reason: "DSA MUST NOT be used for signing or validation (RFC 9904 Table 2)" },
   4:   { name: "Reserved",           deprecated: true,  reason: "Reserved (RFC 4034 §A.1) — not for production use" },
   5:   { name: "RSASHA1",            deprecated: true,  reason: "SHA-1 deprecated (RFC 9905 §3)" },
-  6:   { name: "DSA-NSEC3-SHA1",     deprecated: true,  reason: "SHA-1 deprecated (RFC 9905 §3); DSA deprecated (RFC 8624 §3.1)" },
+  6:   { name: "DSA-NSEC3-SHA1",     deprecated: true,  reason: "SHA-1 deprecated (RFC 9905 §3); DSA MUST NOT be used (RFC 9904 Table 2)" },
   7:   { name: "RSASHA1-NSEC3-SHA1", deprecated: true,  reason: "SHA-1 deprecated (RFC 9905 §3)" },
   8:   { name: "RSASHA256",          deprecated: false, reason: "current — RFC 5702" },                                  // IANA DNSKEY algorithm number
   9:   { name: "Reserved",           deprecated: true,  reason: "Reserved (RFC 5155) — not for production use" },
-  10:  { name: "RSASHA512",          deprecated: false, reason: "current — RFC 5702" },
+  // Not deprecated — validation is still MUST, so a caller deciding whether to
+  // ACCEPT a zone must keep accepting it. But it is NOT RECOMMENDED to sign
+  // with, and reporting it as plainly "current" answered a signing question
+  // with the opposite of what the current RFC says.
+  10:  { name: "RSASHA512",          deprecated: false, reason: "defined in RFC 5702; RFC 9904 Table 2 — signing NOT RECOMMENDED, validation MUST" },
   11:  { name: "Reserved",           deprecated: true,  reason: "Reserved (RFC 5155) — not for production use" },
-  12:  { name: "ECC-GOST",           deprecated: true,  reason: "deprecated (RFC 8624 §3.1)" },
+  12:  { name: "ECC-GOST",           deprecated: true,  reason: "MUST NOT be used for signing (RFC 9904 Table 2)" },
   13:  { name: "ECDSAP256SHA256",    deprecated: false, reason: "current — RFC 6605" },
   14:  { name: "ECDSAP384SHA384",    deprecated: false, reason: "current — RFC 6605" },
   15:  { name: "ED25519",            deprecated: false, reason: "current — RFC 8080" },
@@ -2173,15 +2182,19 @@ var DNSKEY_ALGORITHMS = Object.freeze({
  *   // → { digestType: 2, name: "SHA-256", deprecated: false, ... }
  */
 
-// DS digest-type vocabulary (RFC 4034 §5.1 + RFC 6605 §6 + RFC 8624
-// §3.2 + RFC 9558). Digest type 1 = SHA-1 is deprecated per RFC 9905
-// §4. Digest types 5 (GOST R 34.11-2012) and 6 (SM3) added by RFC
-// 9558. Reserved value 0 surfaced for completeness.
+// DS digest-type vocabulary (RFC 4034 §5.1 + RFC 6605 §6 + RFC 9904
+// Table 3 + RFC 9558). Digest type 1 = SHA-1 is deprecated per RFC 9905
+// §4 — RFC 9904 Table 3 spells it MUST NOT for delegation and MUST for
+// validation, so `deprecated` follows the delegation side here for the
+// same reason it follows validation in the DNSKEY table: that is the
+// side an operator can still choose. Digest types 5 (GOST R 34.11-2012)
+// and 6 (SM3) added by RFC 9558. Reserved value 0 surfaced for
+// completeness.
 var DS_DIGEST_TYPES = Object.freeze({
   0: { name: "Reserved",            deprecated: true,  reason: "Reserved (RFC 3658) — not for production use" },
   1: { name: "SHA-1",               deprecated: true,  reason: "SHA-1 deprecated (RFC 9905 §4)" },
   2: { name: "SHA-256",             deprecated: false, reason: "current — RFC 4509" },
-  3: { name: "GOST R 34.11-94",     deprecated: true,  reason: "deprecated (RFC 8624 §3.2; superseded by GOST 2012 in RFC 9558)" },
+  3: { name: "GOST R 34.11-94",     deprecated: true,  reason: "MUST NOT be used for delegation (RFC 9904 Table 3); superseded by GOST 2012 in RFC 9558" },
   4: { name: "SHA-384",             deprecated: false, reason: "current — RFC 6605 §6" },
   5: { name: "GOST R 34.11-2012",   deprecated: false, reason: "current — RFC 9558 §3" },
   6: { name: "SM3",                 deprecated: false, reason: "current — RFC 9558 §3 (Chinese national standard)" },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.18.46",
+  "version": "0.18.48",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:7d5783b2-ffef-415c-b303-2b4cc46bc73c",
+  "serialNumber": "urn:uuid:a63c2af3-b9b9-4c06-b74a-dd7049ac3f6c",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-22T08:31:57.142Z",
+    "timestamp": "2026-08-22T16:44:54.517Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.18.46",
+      "bom-ref": "@blamejs/core@0.18.48",
       "type": "application",
       "name": "blamejs",
-      "version": "0.18.46",
+      "version": "0.18.48",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.18.46",
+      "purl": "pkg:npm/%40blamejs/core@0.18.48",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.18.46",
+      "ref": "@blamejs/core@0.18.48",
       "dependsOn": []
     }
   ]