@blamejs/core 0.18.47 → 0.18.48

package/lib/guard-image.js

@@ -161,6 +161,21 @@ var DEFAULTS = gateContract.strictDefaults(PROFILES);
 // maxRuntimeMs among them, where zero means no runtime budget.
 var INT_OPTS = ["maxBytes", "maxWidth", "maxHeight", "maxFrames"];
 
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `polyglotPolicy: "rejct"` is not "allow", so the check runs, and
+// it is not "reject" either, so the finding drops to a warning.
+//
+// Declared up here because `gate()` below binds its own resolver and needs the
+// same table. Given to the generated path alone, a bad value survived gate
+// construction and surfaced as a refusal on the first image request — a deploy
+// that boots clean and then refuses the route, which is the opposite of what
+// checking at construction is for.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "magicPolicy", "mismatchPolicy", "polyglotPolicy", "svgRoutingPolicy",
+  "dimensionsPolicy", "framesPolicy", "unknownMagicPolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow);
+
 var COMPLIANCE_POSTURES = gateContract.compliancePostures(PROFILES, { base: 256 });
 
 function _bytesAt(buf, offset, sig) {
@@ -676,6 +691,9 @@ function gate(opts) {
     // caller to identical rules.
     intOpts:            INT_OPTS,
     nonNegativeOpts:    gateContract.capKeysOf(DEFAULTS),
+    // And the same policy vocabulary, for the same reason as the limits: a
+    // door that skips it accepts a value the other doors refuse.
+    enumOpts:           POLICY_ENUM,
   });
   return gateContract.buildGuardGate(
     opts.name || "guardImage:" + (opts.profile || "default"),
@@ -745,6 +763,7 @@ var INTEGRATION_FIXTURES = Object.freeze({
 // (operator-feeds-metadata ctx.metadata reader) is REQUIRED and carries the
 // magic-byte / polyglot / dimension chain unchanged.
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "image",
   kind:        "metadata",
   errorClass:  GuardImageError,

package/lib/guard-json.js

@@ -1083,7 +1083,30 @@ var INTEGRATION_FIXTURES = Object.freeze({
 // per-guard inspection surface (validate / parse) and JSON extras
 // (POLLUTION_KEYS, surfaced from the framework's canonical pick.POISONED_KEYS).
 // The bespoke `gate` carries JSON's sanitize-reparse-reserialize chain unchanged.
+// Each policy's vocabulary, taken from this guard's documented opts and
+// confirmed against what the code compares, so a misspelling is a boot error
+// rather than a runtime surprise. Read leniently, a typo takes whichever branch
+// is not the strict one: `duplicateKeyPolicy: "rejct"` is not "allow", so the
+// check runs, and it is not "reject" either, so the finding drops to a warning
+// — the operator asked to refuse a duplicate key and silently got an audit.
+//
+// The character policies are deliberately absent: they are derived for the
+// whole family, and an explicit entry here would override that derivation with
+// a narrower copy.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "duplicateKeyPolicy", "nanInfinityPolicy", "commentPolicy",
+  "trailingCommaPolicy", "json5SyntaxPolicy", "numericPrecisionPolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow, {
+  // No `audit-only`: the parse path decides whether to preserve a poison-named
+  // key by testing for the literal "audit", so the synonym would strip
+  // `__proto__` where "audit" keeps it — a silent difference in the parsed
+  // data, not in a finding.
+  pollutionPolicy: ["reject", "strip", "audit", "allow"],
+  bomPolicy:       ["reject", "strip", "allow"],
+});
+
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "json",
   kind:        "content",
   charRepair:  true,

package/lib/guard-jsonpath.js

@@ -257,7 +257,7 @@ function _detectIssues(input, opts) {
  *   bidiPolicy:             "reject"|"audit"|"allow",
  *   controlPolicy:          "reject"|"audit"|"allow",
  *   nullBytePolicy:         "reject"|"audit"|"allow",
- *   zeroWidthPolicy:        "reject"|"strip"|"audit"|"allow",
+ *   zeroWidthPolicy:        "reject"|"audit"|"allow",
  *   filterExprPolicy:       "reject"|"audit"|"allow",
  *   scriptExprPolicy:       "reject"|"audit"|"allow",
  *   dynamicHintPolicy:      "reject"|"audit"|"allow",
@@ -350,7 +350,20 @@ var INTEGRATION_FIXTURES = gateContract.identifierFixtures("$.users[*].name", "$
 // surface (validate / sanitize). The gate is the factory default
 // serve/audit-only/refuse chain, reading the path from
 // `ctx.identifier` || `ctx.jsonpath` via `ctxFields`.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `scriptExprPolicy: "rejct"` is not "allow", so the check runs,
+// and it is not "reject" either, so the finding drops to a warning.
+//
+// The character policies are absent on purpose — they are derived for the
+// whole guard family, and an entry here would shadow that derivation.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "filterExprPolicy", "scriptExprPolicy", "dynamicHintPolicy",
+  "bracketNestingPolicy", "recursiveDescentPolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow);
+
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "jsonpath",
   kind:        "identifier",
   errorClass:  GuardJsonpathError,

package/lib/guard-jwt.js

@@ -283,8 +283,10 @@ function _detectIssues(input, opts) {
     }
   }
 
-  // kid path-traversal.
-  if (opts.kidTraversalPolicy !== "allow" && _hasKidTraversal(header.kid)) {
+  // kid path-traversal. Unconditional: `kid` steers key lookup, so a traversal
+  // sequence in it is critical at every profile and there is no policy value
+  // that turns the check off.
+  if (_hasKidTraversal(header.kid)) {
     issues.push({
       kind: "kid-traversal", severity: "critical",
       ruleId: "jwt.kid-traversal",
@@ -578,7 +580,23 @@ var INTEGRATION_FIXTURES = gateContract.identifierFixtures(
 // default gate (no bespoke `gate` passed) and the factory supplies the
 // error class, registry exports, buildProfile / compliancePosture /
 // loadRulePack wiring, and the kidSafe extra.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `typConfusionPolicy: "rejct"` is not "allow", so the check runs,
+// and it is not "reject" either, so the finding drops from high to warn.
+//
+// `algNonePolicy` and `kidTraversalPolicy` take one value each because both
+// threats are unconditional, as their opts block has always said.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "algAllowlistPolicy", "typConfusionPolicy", "expSanityPolicy",
+  "nbfSanityPolicy", "iatSanityPolicy", "critUnknownPolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow, {
+  algNonePolicy:      ["reject"],
+  kidTraversalPolicy: ["reject"],
+});
+
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "jwt",
   kind:        "identifier",
   errorClass:  GuardJwtError,

package/lib/guard-markdown.js

@@ -1902,7 +1902,32 @@ function render(source, opts) {
   }
 }
 
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `dangerousSchemePolicy: "rejct"` is not "allow", so the check
+// runs, and it is not "reject" either, so a `javascript:` link drops to a
+// warning.
+//
+// "strip" is listed only where the opts block offers it — that is, where the
+// renderer can remove the construct and still produce a document. Advertising
+// it more widely would route a finding to a repair that never happens, which
+// is the shape that lets an unrepaired document through as sanitized.
+//
+// The character policies are absent on purpose — they are derived for the
+// whole guard family, and an entry here would shadow that derivation.
+var REPAIRABLE = ["dangerousTagPolicy", "dangerousSchemePolicy",
+                  "autolinkSchemePolicy", "imageSchemePolicy",
+                  "referenceLinkPolicy", "doctypePolicy", "codeFenceLangPolicy"];
+var REPORT_ONLY = ["rawHtmlPolicy", "htmlCommentPolicy", "frontMatterPolicy",
+                   "emphasisRunPolicy", "filePolicy"];
+
+var POLICY_ENUM = gateContract.policyVocabulary(
+  REPAIRABLE, gateContract.POLICY_VALUES.rejectStripAuditAllow,
+  gateContract.policyVocabulary(
+    REPORT_ONLY, gateContract.POLICY_VALUES.rejectAuditAllow));
+
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "markdown",
   kind:        "content",
   charRepair:  true,

package/lib/guard-mime.js

@@ -328,15 +328,15 @@ function _detectIssues(input, opts) {
  * @opts
  *   profile:                "strict"|"balanced"|"permissive",
  *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
- *   bidiPolicy:             "reject"|"strip"|"audit"|"allow",
- *   controlPolicy:          "reject"|"strip"|"allow",
- *   nullBytePolicy:         "reject"|"strip"|"allow",
- *   zeroWidthPolicy:        "reject"|"strip"|"allow",
+ *   bidiPolicy:             "reject"|"audit"|"allow",
+ *   controlPolicy:          "reject"|"audit"|"allow",
+ *   nullBytePolicy:         "reject"|"audit"|"allow",
+ *   zeroWidthPolicy:        "reject"|"audit"|"allow",
  *   wildcardPolicy:         "reject"|"audit"|"allow",
  *   vendorTreePolicy:       "reject"|"audit"|"allow",
  *   personalTreePolicy:     "reject"|"audit"|"allow",
  *   unregisteredTreePolicy: "reject"|"audit"|"allow",
- *   riskyTypesPolicy:       "reject"|"audit"|"allow",
+ *   riskyTypePolicy:        "reject"|"audit"|"allow",
  *   parameterPolicy:        "reject"|"audit"|"allow",
  *   maxBytes:               number,    // default 256 (RFC-recommended cap)
  *
@@ -418,7 +418,17 @@ var INTEGRATION_FIXTURES = gateContract.identifierFixtures("application/json", "
 // compliancePosture / loadRulePack wiring, plus the per-guard inspection
 // surface (validate / sanitize). The gate is the factory default chain,
 // dispatched to `ctx.identifier` / `ctx.mime` via ctxFields.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `wildcardPolicy: "rejct"` is not "allow", so the check runs, and
+// it is not "reject" either, so the finding drops from high to warn.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "wildcardPolicy", "vendorTreePolicy", "personalTreePolicy",
+  "unregisteredTreePolicy", "riskyTypePolicy", "parameterPolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow);
+
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "mime",
   kind:        "identifier",
   errorClass:  GuardMimeError,

package/lib/guard-oauth.js

@@ -574,7 +574,30 @@ var INTEGRATION_FIXTURES = Object.freeze({
 // surface (validate / sanitize / bespoke gate) passed through verbatim.
 // The custom KIND ("oauth-flow") is accepted because the bespoke gate
 // reads its own ctx fields (ctx.oauthFlow / ctx.flow).
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `statePolicy: "requre"` is not "allow", so the check runs, and
+// it is not "require" either, so a missing state parameter drops to a warning.
+//
+// Several of these open with "require" rather than "reject" because the
+// finding is an absence — no PKCE challenge, no state, no issuer on the
+// callback — so the operator is demanding a parameter, not refusing one.
+var POLICY_ENUM = gateContract.policyVocabulary(
+  ["scopeTamperingPolicy"], gateContract.POLICY_VALUES.rejectAuditAllow, {
+    // No `audit-only`: the PKCE check tests for the literal "audit", so the
+    // synonym would take the enforcing branch and refuse a flow that plain
+    // "audit" serves with a finding. Refusing the value is the honest answer
+    // — the operator picks a spelling that means what they want.
+    pkcePolicy:             ["require-s256", "require-any", "audit", "allow"],
+    statePolicy:            ["require", "audit", "audit-only", "allow"],
+    redirectUriPolicy:      ["require-exact-allowlist", "audit", "audit-only", "allow"],
+    responseTypePolicy:     ["require-allowlist", "audit", "audit-only", "allow"],
+    issuerOnCallbackPolicy: ["require", "audit", "audit-only", "allow"],
+    codeReusePolicy:        ["reject", "allow"],
+  });
+
 var _guard = module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "oauth",
   kind:        "oauth-flow",
   errorClass:  GuardOauthError,

package/lib/guard-pdf.js

@@ -141,6 +141,20 @@ var DEFAULTS = gateContract.strictDefaults(PROFILES);
 // generated validate() does. See guard-image for the full reasoning.
 var INT_OPTS = ["maxBytes", "maxPageCount"];
 
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `javascriptPolicy: "rejct"` is not "allow", so the check runs,
+// and it is not "reject" either, so an embedded script drops to a warning.
+//
+// Declared up here because `gate()` below binds its own resolver and needs the
+// same table. Given to the generated path alone, a bad value survived gate
+// construction and surfaced as a refusal on the first PDF request.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "magicPolicy", "javascriptPolicy", "launchActionPolicy", "openActionPolicy",
+  "embeddedFilePolicy", "embeddedFileCountPolicy", "encryptedPolicy",
+  "polyglotPolicy", "pageCountPolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow);
+
 var COMPLIANCE_POSTURES = gateContract.compliancePostures(PROFILES, { base: 512 });
 
 function _hasPdfMagic(buf) {
@@ -441,9 +455,12 @@ function gate(opts) {
     defaults:           DEFAULTS,
     errorClass:         GuardPdfError,
     errCodePrefix:      "pdf",
-    // Own resolver, own cap declaration — see guard-image.gate.
+    // Own resolver, own cap declaration — see guard-image.gate. The policy
+    // vocabulary comes with it, for the same reason: a door that skips it
+    // accepts a value the other doors refuse.
     intOpts:            INT_OPTS,
     nonNegativeOpts:    gateContract.capKeysOf(DEFAULTS),
+    enumOpts:           POLICY_ENUM,
   });
   return gateContract.buildGuardGate(
     opts.name || "guardPdf:" + (opts.profile || "default"),
@@ -512,6 +529,7 @@ var INTEGRATION_FIXTURES = Object.freeze({
 // (operator-feeds-metadata ctx.metadata reader) is REQUIRED and carries the
 // JavaScript / launch-action / embedded-file chain unchanged.
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "pdf",
   kind:        "metadata",
   errorClass:  GuardPdfError,

package/lib/guard-regex.js

@@ -2586,7 +2586,7 @@ function _detectNestedExtglob(input, opts, issues) {
  *   bidiPolicy:             "reject"|"audit"|"allow",
  *   controlPolicy:          "reject"|"audit"|"allow",
  *   nullBytePolicy:         "reject"|"audit"|"allow",
- *   zeroWidthPolicy:        "reject"|"strip"|"audit"|"allow",
+ *   zeroWidthPolicy:        "reject"|"audit"|"allow",
  *   nestedQuantPolicy:      "reject"|"audit"|"allow",
  *   alternationQuantPolicy: "reject"|"audit"|"allow",
  *   boundedRepeatPolicy:    "reject"|"audit"|"allow",
@@ -2840,7 +2840,22 @@ function assertSafe(input, label, ErrorClass, code, opts) {
 // compliancePosture / loadRulePack wiring, plus the per-guard inspection
 // surface (validate / sanitize / gate). The bespoke `gate` carries
 // guardRegex's ctx.identifier || ctx.pattern dispatch unchanged.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `nestedQuantPolicy: "rejct"` is not "allow", so the check runs,
+// and it is not "reject" either, so a catastrophic-backtracking pattern drops
+// from high to warn.
+//
+// The character policies are absent on purpose — they are derived for the
+// whole guard family, and an entry here would shadow that derivation.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "nestedQuantPolicy", "alternationQuantPolicy", "boundedRepeatPolicy",
+  "lookaroundQuantPolicy", "consecutiveStarPolicy", "nestedExtglobPolicy",
+  "unanchoredScanPolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow);
+
 var _guard = module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "regex",
   kind:        "identifier",
   errorClass:  GuardRegexError,

package/lib/guard-shell.js

@@ -241,7 +241,7 @@ function _detectIssues(input, opts) {
  *   bidiPolicy:        "reject"|"audit"|"allow",
  *   controlPolicy:     "reject"|"audit"|"allow",
  *   nullBytePolicy:    "reject"|"audit"|"allow",
- *   zeroWidthPolicy:   "reject"|"strip"|"audit"|"allow",
+ *   zeroWidthPolicy:   "reject"|"audit"|"allow",
  *   posixMetaPolicy:   "reject"|"audit"|"allow",
  *   cmdMetaPolicy:     "reject"|"audit"|"allow",
  *   dollarSubstPolicy: "reject"|"audit"|"allow",
@@ -338,7 +338,20 @@ var INTEGRATION_FIXTURES = gateContract.identifierFixtures("safe-arg-value", "sa
 // compliancePosture / loadRulePack wiring, plus the per-guard inspection
 // surface (validate / sanitize). The gate is the factory default chain,
 // dispatched to `ctx.identifier` / `ctx.arg` via ctxFields.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `backtickPolicy: "rejct"` is not "allow", so the check runs, and
+// it is not "reject" either, so command substitution drops to a warning.
+//
+// The character policies are absent on purpose — they are derived for the
+// whole guard family, and an entry here would shadow that derivation.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "posixMetaPolicy", "cmdMetaPolicy", "dollarSubstPolicy", "processSubstPolicy",
+  "backtickPolicy", "newlinePolicy", "argHyphenPolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow);
+
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "shell",
   kind:        "identifier",
   errorClass:  GuardShellError,

package/lib/guard-svg.js

@@ -1005,7 +1005,24 @@ var INTEGRATION_FIXTURES = Object.freeze({
 // unchanged; neither reduces to the dynamic
 // detect→throwOnRefusalSeverity→transform path (same-severity findings
 // split throw-vs-strip), so both stay bespoke.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `cdataPolicy: "rejct"` is not "allow", so the check runs, and it
+// is not "reject" either, so the finding drops from critical to warn.
+//
+// `svgzPolicy` takes one value: a gzip signature is refused before any parse
+// and sanitize throws on it, so no other value has ever meant anything.
+//
+// The character policies are absent on purpose — they are derived for the whole
+// guard family, and an entry here would shadow that derivation.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "cssPolicy", "doctypePolicy", "cdataPolicy", "processingInstrPolicy",
+], gateContract.POLICY_VALUES.rejectStripAuditAllow, {
+  svgzPolicy: ["reject"],
+});
+
 var _guard = module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "svg",
   kind:        "content",
   charRepair:  true,

package/lib/guard-template.js

@@ -228,7 +228,7 @@ function _detectIssues(input, opts) {
  *   bidiPolicy:              "reject"|"audit"|"allow",
  *   controlPolicy:           "reject"|"audit"|"allow",
  *   nullBytePolicy:          "reject"|"audit"|"allow",
- *   zeroWidthPolicy:         "reject"|"strip"|"audit"|"allow",
+ *   zeroWidthPolicy:         "reject"|"audit"|"allow",
  *   jinjaPolicy:             "reject"|"audit"|"allow",
  *   erbPolicy:               "reject"|"audit"|"allow",
  *   pugPolicy:               "reject"|"audit"|"allow",
@@ -316,7 +316,20 @@ var INTEGRATION_FIXTURES = gateContract.identifierFixtures("Hello world", "Hello
 // factory default serve -> audit-only -> refuse chain; ctxFields names the
 // ctx fields it reads (ctx.identifier, then ctx.text) so untrusted strings on
 // either field reach the SSTI validator before any engine renders them.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `jinjaPolicy: "rejct"` is not "allow", so the check runs, and it
+// is not "reject" either, so the finding drops to a warning.
+//
+// The character policies are absent on purpose — they are derived for the
+// whole guard family, and an entry here would shadow that derivation.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "jinjaPolicy", "erbPolicy", "pugPolicy", "dollarBracePolicy",
+  "velocityDirectivePolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow);
+
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "template",
   kind:        "identifier",
   errorClass:  GuardTemplateError,

package/lib/guard-text.js

@@ -118,6 +118,20 @@ var COMPLIANCE_POSTURES = gateContract.compliancePostures(PROFILES, { base: 256
 // so this guard's hand-bound resolver holds a caller to the same rules the
 // generated validate() does. maxRuntimeMs is deliberately absent: zero there
 // means no runtime budget. See guard-image for the full reasoning.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `encodingPolicy: "rejct"` is not "allow", so the check runs, and
+// it is not "reject" either, so malformed UTF-8 drops to a warning.
+var POLICY_ENUM = gateContract.policyVocabulary(
+  ["confusablePolicy", "encodingPolicy"],
+  gateContract.POLICY_VALUES.rejectAuditAllow);
+
+// The same table for the entry points that bind their own resolver, with the
+// family's character policies folded in — defineGuard adds those itself, a
+// hand-bound resolver has to be given them.
+var RESOLVER_ENUMS = Object.freeze(Object.assign({},
+  gateContract.charPolicyEnums(DEFAULTS, { canRepair: true }), POLICY_ENUM));
+
 var INT_OPTS = ["maxBytes"];
 
 // ---- Internal helpers ----
@@ -135,7 +149,7 @@ function _resolveOpts(opts) {
     // generated path refuses it.
     intOpts:            INT_OPTS,
     nonNegativeOpts:    gateContract.capKeysOf(DEFAULTS),
-    enumOpts:           gateContract.charPolicyEnums(DEFAULTS, { canRepair: true }),
+    enumOpts:           RESOLVER_ENUMS,
   });
 }
 
@@ -575,6 +589,7 @@ var INTEGRATION_FIXTURES = Object.freeze({
 // inspection surface (validate / sanitize / gate). The bespoke `gate` carries
 // the text sanitize-then-refuse chain (confusables are non-repairable).
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "text",
   kind:        "content",
   charRepair:  true,

package/lib/guard-time.js

@@ -299,10 +299,10 @@ function _detectIssues(input, opts) {
  * @opts
  *   profile:                "strict"|"balanced"|"permissive",
  *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
- *   bidiPolicy:             "reject"|"strip"|"audit"|"allow",
- *   controlPolicy:          "reject"|"strip"|"allow",
- *   nullBytePolicy:         "reject"|"strip"|"allow",
- *   zeroWidthPolicy:        "reject"|"strip"|"allow",
+ *   bidiPolicy:             "reject"|"audit"|"allow",
+ *   controlPolicy:          "reject"|"audit"|"allow",
+ *   nullBytePolicy:         "reject"|"audit"|"allow",
+ *   zeroWidthPolicy:        "reject"|"audit"|"allow",
  *   naiveDatetimePolicy:    "reject"|"audit"|"allow",
  *   nonUtcOffsetPolicy:     "reject"|"audit"|"allow",
  *   leapSecondPolicy:       "reject"|"audit"|"allow",
@@ -393,7 +393,23 @@ var INTEGRATION_FIXTURES = gateContract.identifierFixtures("2026-05-05T12:34:56Z
 // surface (validate / sanitize). The gate is the factory default — the
 // standard serve -> audit-only -> refuse chain — reading
 // ctx.identifier / ctx.timestamp / ctx.time via ctxFields.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `naiveDatetimePolicy: "rejct"` is not "allow", so the check
+// runs, and it is not "reject" either, so a zone-less timestamp drops to a
+// warning.
+//
+// `fractionalDigitsPolicy` carries "truncate" because over-precise fractional
+// seconds are the one finding here that can be repaired rather than reported.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "naiveDatetimePolicy", "nonUtcOffsetPolicy", "leapSecondPolicy",
+  "dateOnlyPolicy", "timeOnlyPolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow, {
+  fractionalDigitsPolicy: ["reject", "truncate", "audit", "audit-only", "allow"],
+});
+
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "time",
   kind:        "identifier",
   errorClass:  GuardTimeError,

package/lib/guard-uuid.js

@@ -286,10 +286,10 @@ function _detectIssues(input, opts) {
  * @opts
  *   profile:                "strict"|"balanced"|"permissive",
  *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
- *   bidiPolicy:             "reject"|"strip"|"audit"|"allow",
- *   controlPolicy:          "reject"|"strip"|"allow",
- *   nullBytePolicy:         "reject"|"strip"|"allow",
- *   zeroWidthPolicy:        "reject"|"strip"|"allow",
+ *   bidiPolicy:             "reject"|"audit"|"allow",
+ *   controlPolicy:          "reject"|"audit"|"allow",
+ *   nullBytePolicy:         "reject"|"audit"|"allow",
+ *   zeroWidthPolicy:        "reject"|"audit"|"allow",
  *   formatPolicy:           "hyphenated"|"hyphenless"|"braced"|"urn"|"hyphenated-only"|"any",
  *   versionPolicy:          "reject-unassigned"|"audit"|"allow",
  *   variantPolicy:          "reject-non-rfc"|"audit"|"allow",
@@ -371,10 +371,34 @@ var INTEGRATION_FIXTURES = gateContract.identifierFixtures("550e8400-e29b-41d4-a
 // surface (validate / sanitize). The gate is the factory default — the
 // standard serve -> audit-only -> refuse chain — reading ctx.identifier ||
 // ctx.uuid via ctxFields.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `versionPolicy: "reject-unassinged"` is not "allow", so the check
+// runs, and it is not the reject spelling either, so the finding drops to a
+// warning — the operator asked to refuse an unassigned version and silently got
+// an audit. The values are the ones written beside each profile entry above,
+// confirmed against what the code compares.
+//
+// `audit-only` rides with `audit` because it behaves identically here and the
+// framework treats them as synonyms everywhere else; refusing it here while
+// accepting it elsewhere would be a fresh disagreement between two spellings of
+// one setting.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "nilPolicy", "maxPolicy", "urnPolicy", "bracedPolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow, {
+  // These three name their own values because their findings are not "this
+  // construct appeared" but "the identifier is the wrong shape", and the
+  // refusal has to say which shape it wanted.
+  formatPolicy:  ["hyphenated", "hyphenless", "braced", "urn", "hyphenated-only", "any"],
+  versionPolicy: ["reject-unassigned", "audit", "audit-only", "allow"],
+  variantPolicy: ["reject-non-rfc", "audit", "audit-only", "allow"],
+});
+
 module.exports = gateContract.defineGuard({
   name:        "uuid",
   kind:        "identifier",
   errorClass:  GuardUuidError,
+  enumOpts:    POLICY_ENUM,
   profiles:    PROFILES,
   defaults:    DEFAULTS,
   postures:    COMPLIANCE_POSTURES,

package/lib/guard-xml.js

@@ -733,7 +733,26 @@ var INTEGRATION_FIXTURES = Object.freeze({
 // ENTITY / external / parameter-entity throwing while strip-able char-class
 // threats are repaired. The bespoke `gate` carries XML's per-policy
 // canSanitize matrix unchanged.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `externalEntityPolicy: "rejct"` is not "allow", so the check
+// runs, and it is not "reject" either, so an XXE vector drops to a warning.
+//
+// `xmlDsigPolicy` has no "reject": a signature block is a legitimate part of a
+// signed document, so the guard reports its presence and leaves verification
+// to the caller rather than refusing the document for carrying one.
+//
+// The character policies are absent on purpose — they are derived for the
+// whole guard family, and an entry here would shadow that derivation.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "doctypePolicy", "entityPolicy", "externalEntityPolicy", "xincludePolicy",
+  "processingInstrPolicy", "cdataPolicy", "schemaLocationPolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow, {
+  xmlDsigPolicy: ["audit", "audit-only", "allow"],
+});
+
 var _guard = module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "xml",
   kind:        "content",
   charRepair:  true,

package/lib/guard-yaml.js

@@ -262,6 +262,25 @@ var COMPLIANCE_POSTURES = gateContract.compliancePostures(PROFILES, { base: 256
 // The options that are genuinely CAPS, where zero is not a setting — named once
 // so this guard's hand-bound parse() and gate() hold a caller to the same rules
 // the generated validate() does. See guard-image for the full reasoning.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `aliasPolicy: "rejct"` is not "allow", so the check runs, and it
+// is not "reject" either, so a billion-laughs alias drops to a warning.
+//
+// `audit-only` is absent: tagPolicy tests for "audit" exactly, and a guard
+// whose policies do not all take the same values is worse than one that takes
+// fewer.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "tagPolicy", "aliasPolicy", "multiDocPolicy", "norwayPolicy",
+  "leadingZeroPolicy", "duplicateKeyPolicy", "mergeKeyPolicy",
+], ["reject", "audit", "allow"]);
+
+// The same table for the entry points that bind their own resolver, with the
+// family's character policies folded in — defineGuard adds those itself, a
+// hand-bound resolver has to be given them.
+var RESOLVER_ENUMS = Object.freeze(Object.assign({},
+  gateContract.charPolicyEnums(DEFAULTS, { canRepair: true }), POLICY_ENUM));
+
 var INT_OPTS = ["maxBytes", "maxDepth", "maxAnchors", "maxAliasDepth",
                 "maxDocuments", "maxNodes", "maxScalarLength"];
 
@@ -653,7 +672,7 @@ function parse(input, opts) {
     // `bidiPolicy: "rejct"` here while the generated path refuses it.
     intOpts:            INT_OPTS,
     nonNegativeOpts:    gateContract.capKeysOf(DEFAULTS),
-    enumOpts:           gateContract.charPolicyEnums(DEFAULTS, { canRepair: true }),
+    enumOpts:           RESOLVER_ENUMS,
   });
   if (typeof input !== "string") {
     throw _err("yaml.bad-input", "parse requires string input");
@@ -805,7 +824,7 @@ function gate(opts) {
     // `bidiPolicy: "rejct"` here while the generated path refuses it.
     intOpts:            INT_OPTS,
     nonNegativeOpts:    gateContract.capKeysOf(DEFAULTS),
-    enumOpts:           gateContract.charPolicyEnums(DEFAULTS, { canRepair: true }),
+    enumOpts:           RESOLVER_ENUMS,
   });
   return gateContract.buildContentGate({
     name:     opts.name || "guardYaml:" + (opts.profile || "default"),
@@ -817,6 +836,7 @@ function gate(opts) {
 }
 
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "yaml",
   kind:        "content",
   charRepair:  true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.18.47",
+  "version": "0.18.48",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",