@blamejs/core 0.18.47 → 0.18.49

package/lib/guard-text.js

@@ -118,6 +118,20 @@ var COMPLIANCE_POSTURES = gateContract.compliancePostures(PROFILES, { base: 256
 // so this guard's hand-bound resolver holds a caller to the same rules the
 // generated validate() does. maxRuntimeMs is deliberately absent: zero there
 // means no runtime budget. See guard-image for the full reasoning.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `encodingPolicy: "rejct"` is not "allow", so the check runs, and
+// it is not "reject" either, so malformed UTF-8 drops to a warning.
+var POLICY_ENUM = gateContract.policyVocabulary(
+  ["confusablePolicy", "encodingPolicy"],
+  gateContract.POLICY_VALUES.rejectAuditAllow);
+
+// The same table for the entry points that bind their own resolver, with the
+// family's character policies folded in — defineGuard adds those itself, a
+// hand-bound resolver has to be given them.
+var RESOLVER_ENUMS = Object.freeze(Object.assign({},
+  gateContract.charPolicyEnums(DEFAULTS, { canRepair: true }), POLICY_ENUM));
+
 var INT_OPTS = ["maxBytes"];
 
 // ---- Internal helpers ----
@@ -135,7 +149,7 @@ function _resolveOpts(opts) {
     // generated path refuses it.
     intOpts:            INT_OPTS,
     nonNegativeOpts:    gateContract.capKeysOf(DEFAULTS),
-    enumOpts:           gateContract.charPolicyEnums(DEFAULTS, { canRepair: true }),
+    enumOpts:           RESOLVER_ENUMS,
   });
 }
 
@@ -575,6 +589,7 @@ var INTEGRATION_FIXTURES = Object.freeze({
 // inspection surface (validate / sanitize / gate). The bespoke `gate` carries
 // the text sanitize-then-refuse chain (confusables are non-repairable).
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "text",
   kind:        "content",
   charRepair:  true,

package/lib/guard-time.js

@@ -299,10 +299,10 @@ function _detectIssues(input, opts) {
  * @opts
  *   profile:                "strict"|"balanced"|"permissive",
  *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
- *   bidiPolicy:             "reject"|"strip"|"audit"|"allow",
- *   controlPolicy:          "reject"|"strip"|"allow",
- *   nullBytePolicy:         "reject"|"strip"|"allow",
- *   zeroWidthPolicy:        "reject"|"strip"|"allow",
+ *   bidiPolicy:             "reject"|"audit"|"allow",
+ *   controlPolicy:          "reject"|"audit"|"allow",
+ *   nullBytePolicy:         "reject"|"audit"|"allow",
+ *   zeroWidthPolicy:        "reject"|"audit"|"allow",
  *   naiveDatetimePolicy:    "reject"|"audit"|"allow",
  *   nonUtcOffsetPolicy:     "reject"|"audit"|"allow",
  *   leapSecondPolicy:       "reject"|"audit"|"allow",
@@ -393,7 +393,23 @@ var INTEGRATION_FIXTURES = gateContract.identifierFixtures("2026-05-05T12:34:56Z
 // surface (validate / sanitize). The gate is the factory default — the
 // standard serve -> audit-only -> refuse chain — reading
 // ctx.identifier / ctx.timestamp / ctx.time via ctxFields.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `naiveDatetimePolicy: "rejct"` is not "allow", so the check
+// runs, and it is not "reject" either, so a zone-less timestamp drops to a
+// warning.
+//
+// `fractionalDigitsPolicy` carries "truncate" because over-precise fractional
+// seconds are the one finding here that can be repaired rather than reported.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "naiveDatetimePolicy", "nonUtcOffsetPolicy", "leapSecondPolicy",
+  "dateOnlyPolicy", "timeOnlyPolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow, {
+  fractionalDigitsPolicy: ["reject", "truncate", "audit", "audit-only", "allow"],
+});
+
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "time",
   kind:        "identifier",
   errorClass:  GuardTimeError,

package/lib/guard-uuid.js

@@ -286,10 +286,10 @@ function _detectIssues(input, opts) {
  * @opts
  *   profile:                "strict"|"balanced"|"permissive",
  *   compliancePosture: "hipaa"|"pci-dss"|"gdpr"|"soc2",
- *   bidiPolicy:             "reject"|"strip"|"audit"|"allow",
- *   controlPolicy:          "reject"|"strip"|"allow",
- *   nullBytePolicy:         "reject"|"strip"|"allow",
- *   zeroWidthPolicy:        "reject"|"strip"|"allow",
+ *   bidiPolicy:             "reject"|"audit"|"allow",
+ *   controlPolicy:          "reject"|"audit"|"allow",
+ *   nullBytePolicy:         "reject"|"audit"|"allow",
+ *   zeroWidthPolicy:        "reject"|"audit"|"allow",
  *   formatPolicy:           "hyphenated"|"hyphenless"|"braced"|"urn"|"hyphenated-only"|"any",
  *   versionPolicy:          "reject-unassigned"|"audit"|"allow",
  *   variantPolicy:          "reject-non-rfc"|"audit"|"allow",
@@ -371,10 +371,34 @@ var INTEGRATION_FIXTURES = gateContract.identifierFixtures("550e8400-e29b-41d4-a
 // surface (validate / sanitize). The gate is the factory default — the
 // standard serve -> audit-only -> refuse chain — reading ctx.identifier ||
 // ctx.uuid via ctxFields.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `versionPolicy: "reject-unassinged"` is not "allow", so the check
+// runs, and it is not the reject spelling either, so the finding drops to a
+// warning — the operator asked to refuse an unassigned version and silently got
+// an audit. The values are the ones written beside each profile entry above,
+// confirmed against what the code compares.
+//
+// `audit-only` rides with `audit` because it behaves identically here and the
+// framework treats them as synonyms everywhere else; refusing it here while
+// accepting it elsewhere would be a fresh disagreement between two spellings of
+// one setting.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "nilPolicy", "maxPolicy", "urnPolicy", "bracedPolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow, {
+  // These three name their own values because their findings are not "this
+  // construct appeared" but "the identifier is the wrong shape", and the
+  // refusal has to say which shape it wanted.
+  formatPolicy:  ["hyphenated", "hyphenless", "braced", "urn", "hyphenated-only", "any"],
+  versionPolicy: ["reject-unassigned", "audit", "audit-only", "allow"],
+  variantPolicy: ["reject-non-rfc", "audit", "audit-only", "allow"],
+});
+
 module.exports = gateContract.defineGuard({
   name:        "uuid",
   kind:        "identifier",
   errorClass:  GuardUuidError,
+  enumOpts:    POLICY_ENUM,
   profiles:    PROFILES,
   defaults:    DEFAULTS,
   postures:    COMPLIANCE_POSTURES,

package/lib/guard-xml.js

@@ -733,7 +733,26 @@ var INTEGRATION_FIXTURES = Object.freeze({
 // ENTITY / external / parameter-entity throwing while strip-able char-class
 // threats are repaired. The bespoke `gate` carries XML's per-policy
 // canSanitize matrix unchanged.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `externalEntityPolicy: "rejct"` is not "allow", so the check
+// runs, and it is not "reject" either, so an XXE vector drops to a warning.
+//
+// `xmlDsigPolicy` has no "reject": a signature block is a legitimate part of a
+// signed document, so the guard reports its presence and leaves verification
+// to the caller rather than refusing the document for carrying one.
+//
+// The character policies are absent on purpose — they are derived for the
+// whole guard family, and an entry here would shadow that derivation.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "doctypePolicy", "entityPolicy", "externalEntityPolicy", "xincludePolicy",
+  "processingInstrPolicy", "cdataPolicy", "schemaLocationPolicy",
+], gateContract.POLICY_VALUES.rejectAuditAllow, {
+  xmlDsigPolicy: ["audit", "audit-only", "allow"],
+});
+
 var _guard = module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "xml",
   kind:        "content",
   charRepair:  true,

package/lib/guard-yaml.js

@@ -262,6 +262,25 @@ var COMPLIANCE_POSTURES = gateContract.compliancePostures(PROFILES, { base: 256
 // The options that are genuinely CAPS, where zero is not a setting — named once
 // so this guard's hand-bound parse() and gate() hold a caller to the same rules
 // the generated validate() does. See guard-image for the full reasoning.
+// Each policy's vocabulary, so a misspelling is a boot error rather than a
+// runtime surprise. Read leniently, a typo takes whichever branch is not the
+// strict one: `aliasPolicy: "rejct"` is not "allow", so the check runs, and it
+// is not "reject" either, so a billion-laughs alias drops to a warning.
+//
+// `audit-only` is absent: tagPolicy tests for "audit" exactly, and a guard
+// whose policies do not all take the same values is worse than one that takes
+// fewer.
+var POLICY_ENUM = gateContract.policyVocabulary([
+  "tagPolicy", "aliasPolicy", "multiDocPolicy", "norwayPolicy",
+  "leadingZeroPolicy", "duplicateKeyPolicy", "mergeKeyPolicy",
+], ["reject", "audit", "allow"]);
+
+// The same table for the entry points that bind their own resolver, with the
+// family's character policies folded in — defineGuard adds those itself, a
+// hand-bound resolver has to be given them.
+var RESOLVER_ENUMS = Object.freeze(Object.assign({},
+  gateContract.charPolicyEnums(DEFAULTS, { canRepair: true }), POLICY_ENUM));
+
 var INT_OPTS = ["maxBytes", "maxDepth", "maxAnchors", "maxAliasDepth",
                 "maxDocuments", "maxNodes", "maxScalarLength"];
 
@@ -653,7 +672,7 @@ function parse(input, opts) {
     // `bidiPolicy: "rejct"` here while the generated path refuses it.
     intOpts:            INT_OPTS,
     nonNegativeOpts:    gateContract.capKeysOf(DEFAULTS),
-    enumOpts:           gateContract.charPolicyEnums(DEFAULTS, { canRepair: true }),
+    enumOpts:           RESOLVER_ENUMS,
   });
   if (typeof input !== "string") {
     throw _err("yaml.bad-input", "parse requires string input");
@@ -805,7 +824,7 @@ function gate(opts) {
     // `bidiPolicy: "rejct"` here while the generated path refuses it.
     intOpts:            INT_OPTS,
     nonNegativeOpts:    gateContract.capKeysOf(DEFAULTS),
-    enumOpts:           gateContract.charPolicyEnums(DEFAULTS, { canRepair: true }),
+    enumOpts:           RESOLVER_ENUMS,
   });
   return gateContract.buildContentGate({
     name:     opts.name || "guardYaml:" + (opts.profile || "default"),
@@ -817,6 +836,7 @@ function gate(opts) {
 }
 
 module.exports = gateContract.defineGuard({
+  enumOpts:    POLICY_ENUM,
   name:        "yaml",
   kind:        "content",
   charRepair:  true,

package/lib/mail-auth.js

@@ -1227,12 +1227,9 @@ function _dmarcAuthorDomainLabels(domain) {
   if (!d) return null;
   // Both RFC 1035 §2.3.4 bounds — 63 octets per label and 253 for the whole
   // name — are enforced by `canonicalDomain` itself, so an over-long or empty
-  // label has already returned "" above. This function used to re-check the
-  // label bound because canonicalDomain enforced only the total; the comment
-  // here argued a label cap was a DNS wire rule rather than a naming one, which
-  // did not survive the observation that the 253 cap is equally a wire rule and
-  // was enforced there anyway. Fixing it at the definition means every caller
-  // gets it, not just this one.
+  // label has already returned "" above. No re-check here: both are wire rules
+  // of the same kind, and enforcing them where the name is defined gives them
+  // to every caller rather than to whichever ones remembered.
   return d.split(".");
 }
 

package/lib/metrics.js

@@ -1024,7 +1024,7 @@ function _serializeRegistry(registry) {
   // a JSON-friendly structured shape. Histograms get full buckets +
   // bucket counts so downstream consumers compose
   // `histogram_quantile()` against the snapshot without a separate
-  // exposition endpoint (issue #100).
+  // exposition endpoint.
   var out = {};
   var names = registry.metrics instanceof Map
     ? Array.from(registry.metrics.keys()).sort()
@@ -1073,8 +1073,8 @@ function snapshotStartWriter(opts) {
     throw new MetricsError("metrics-snapshot/bad-fields",
       "metrics.snapshot.startWriter: opts.fields must be a function returning the snapshot object");
   }
-  // Issue #100 — optional `registry` handle pulls every registered
-  // metric into a structured `metrics` field in the JSON snapshot:
+  // The optional `registry` handle pulls every registered metric into a
+  // structured `metrics` field in the JSON snapshot:
   // counters / gauges as `{ value }` per label set, histograms as
   // `{ buckets, observations }` with bucket counts + sum + count.
   // Sidecar readers compose `histogram_quantile()` against the
@@ -1420,7 +1420,7 @@ function snapshotRender(snap, opts) {
       "metrics.snapshot.render: snap must be a startWriter-produced object (got " + typeof snap + ")");
   }
   var fields = snap.fields;
-  // Labeled registry families (issue #430) — a snapshot written with
+  // Labeled registry families — a snapshot written with
   // startWriter's `registry` option carries every registered counter /
   // gauge / histogram under `metrics`. Both formats render them so a
   // sidecar consuming a snapshot written by another process gets the

package/lib/mtls-ca.js

@@ -25,9 +25,9 @@
  *   `ca.crl` (signed CRL derived from the registry).
  *
  *   `caKeySealedMode` defaults to "required" — sealed file required,
- *   plaintext refused. The legacy "auto" fallback was removed; it
- *   defaulted to writing plaintext on a fresh install, which is the
- *   inverse of the framework's security-defaults-on posture for
+ *   plaintext refused. There is no "auto" mode, because deciding
+ *   for the operator means writing plaintext on a fresh install,
+ *   which is the inverse of the framework's security-defaults-on posture for
  *   at-rest key material. The "disabled" mode is a dev-only opt-out
  *   (operator must justify with audited reason).
  *
@@ -2554,7 +2554,7 @@ function create(opts) {
              path: paths.crl };
   }
 
-  // ---- Algorithm migration (issue #532) ----
+  // ---- Algorithm migration ----
 
   // Serialize rotations on this handle. Two concurrent rotate() calls must not
   // both read the same current generation, both mint the next one, and clobber

package/lib/network-dns.js

@@ -535,8 +535,8 @@ function _dnsQueryLabels(host, primitive) {
   // A delimiter is the one that bites, because `domainToASCII` TRUNCATES at
   // one, so `example.com/evil` can masquerade as a trusted prefix of itself.
   //
-  // Mirroring the rule was tried first, and the list of near-misses above is
-  // what that produced. Asking the owner is the version that cannot drift.
+  // Mirroring the rule locally produces the list of near-misses above. Asking
+  // the owner is the version that cannot drift.
   var canonical = publicSuffix.canonicalDomain(h);
   if (!canonical) {
     throw new DnsError("dns/bad-host",

package/lib/session-device-binding.js

@@ -301,8 +301,8 @@ function create(opts) {
   // A no-store instance is still useful: the stateless fingerprint() reads no
   // store and is the soft device-binding building block for self-validating
   // tokens (a sealed cookie / JWT carrying the fingerprint inside). Rather than
-  // refuse to construct (issue #330 — fingerprint() unreachable without a
-  // store), build the instance and let the persisted bind()/verify() lifecycle
+  // refuse to construct, which would put fingerprint() out of reach for want of
+  // a store, build the instance and let the persisted bind()/verify() lifecycle
   // throw a clear "no store configured" when actually called. Operators wanting
   // ONLY the stateless digest can also use the static
   // b.sessionDeviceBinding.fingerprint(req, opts) with no create() at all.

package/lib/vault/index.js

@@ -472,8 +472,8 @@ async function initFirstRunWrapped() {
       "failed to wrap new vault key: " + e.message);
   }
 
-  // Atomic write via the framework's atomic-file primitive (temp + fsync +
-  // rename + dir fsync — same flow this code used to inline manually).
+  // Atomic write via the framework's atomic-file primitive: temp + fsync +
+  // rename + dir fsync.
   atomicFile.writeSync(paths.sealed, sealed, { fileMode: 0o600 });
 
   log("generated and sealed new vault keypair (ML-KEM-1024 + P-384 hybrid)");

package/lib/ws-client.js

@@ -453,8 +453,8 @@ class WsClient extends EventEmitter {
       if (lookup) tlsOpts.lookup = lookup;
       // The group preference arrives with the shared posture above, already
       // reflecting a runtime setKeyShares(). It lands as `ecdhCurve`: node:tls
-      // has no `curves` option — it accepts that key and ignores it, which is
-      // how this preference used to be dropped from the handshake in silence,
+      // has no `curves` option — it accepts that key and ignores it, so a
+      // preference sent under that name leaves the handshake in silence,
       // whereas a bad `ecdhCurve` throws. An operator value in dialTlsOpts
       // still wins, since it is merged last.
       socket = tls.connect(tlsOpts);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.18.47",
+  "version": "0.18.49",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:2b85824f-8c87-4b4e-9ee7-abfe05e1b852",
+  "serialNumber": "urn:uuid:a6344adf-71aa-4268-ba0f-0073a6ead16a",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-22T12:32:06.262Z",
+    "timestamp": "2026-08-22T18:41:08.842Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.18.47",
+      "bom-ref": "@blamejs/core@0.18.49",
       "type": "application",
       "name": "blamejs",
-      "version": "0.18.47",
+      "version": "0.18.49",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.18.47",
+      "purl": "pkg:npm/%40blamejs/core@0.18.49",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.18.47",
+      "ref": "@blamejs/core@0.18.49",
       "dependsOn": []
     }
   ]