@blamejs/core 0.7.44 → 0.7.46

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.7.x
 
+- **0.7.46** (2026-05-05) — `b.guardTime` — RFC 3339 / ISO 8601 datetime identifier-safety primitive (KIND="identifier"). Validates user-supplied datetime strings destined for audit timestamps, scheduling, retention windows, query ranges, and cross-system event correlation. Threat catalog: shape malformation against the RFC 3339 §5.6 grammar; year-window overflow (default `[1970, 9999]`); naive datetime (no offset) refuse; non-UTC offset policy (strict requires `Z` / `+00:00`); leap-second `60` field policy (RFC 3339 §5.6 valid but parser-panic prone); excessive fractional precision cap (default 9 digits / nanoseconds); date-only and time-only refuse for full-datetime contexts; structural range violations (month / day-in-month / hour / minute / second); BIDI / zero-width / control / null-byte universal refuse. `sanitize` normalizes a space date/time separator to `T` and uppercases the trailing `z` UTC marker. Profiles: `strict` (refuse all of the above), `balanced` (refuse naive; audit non-UTC + leap + fractional + date/time-only), `permissive` (universal-refuse class still refused). Postures: `hipaa` / `pci-dss` / `soc2` strict overlay; `gdpr` balanced overlay. Auto-registers into `b.guardAll` as a STANDALONE_GUARD.
+
+- **0.7.45** (2026-05-05) — `b.guardCidr` — CIDR identifier-safety primitive (KIND="identifier"). Validates user-supplied CIDR notation strings (IPv4 + IPv6) destined for network allowlists, ACLs, security-group rules, and tenant-boundary configuration. Threat catalog: shape malformation, IPv4 octet overflow + leading-zero refuse, IPv6 zero-group ambiguity, mask out-of-range (IPv4 32 / IPv6 128 ceiling), network-address misalignment (host bits set on a non-/32 / non-/128 prefix — common typo class), reserved-range membership covering all the IPv4 RFC 1918 private blocks (`10/8`, `172.16/12`, `192.168/16`) plus loopback `127/8`, link-local `169.254/16`, multicast `224/4`, class-E `240/4`, RFC 5737 documentation `192.0.2/24` + `198.51.100/24` + `203.0.113/24`, benchmarking `198.18/15`, CGNAT `100.64/10`, this-network `0/8`, plus IPv6 loopback `::1`, unspecified `::/128`, ULA `fc00::/7`, link-local `fe80::/10`, multicast `ff00::/8`, documentation `2001:db8::/32`, teredo, deprecated 6to4 `2002::/16`. Includes IPv4-mapped IPv6 dual-stack confusion detection (`::ffff:0:0/96` — CVE-2021-22931 IPv6 variant). Bare-IP-without-mask policy (strict refuses; balanced audits; permissive allows). BIDI / zero-width / control / null-byte universal refuse. Profiles: `strict` / `balanced` / `permissive`. Postures: `hipaa` / `pci-dss` / `soc2` strict overlay; `gdpr` balanced overlay. Auto-registers into `b.guardAll` as a STANDALONE_GUARD.
+
 - **0.7.44** (2026-05-05) — `b.guardUuid` — UUID identifier-safety primitive (KIND="identifier"). Validates user-supplied UUID strings per RFC 9562 (May 2024, obsoletes RFC 4122). Threat catalog: shape malformation across the four canonical forms (hyphenated 8-4-4-4-12, hyphenless 32-hex, Microsoft GUID braces `{…}`, `urn:uuid:` prefix); RFC 9562 §4.2 unassigned version digits (only 1-8 are defined); non-RFC 4122 variant bits (only the `10xx` high-bits family is the canonical UUID variant); nil UUID §5.9 / max UUID §5.10 sentinel-leak refuse; format policy enforcement (strict default = `hyphenated-only`); BIDI / zero-width / control / null-byte universal refuse via `lib/codepoint-class.js`. `sanitize` returns canonical lowercase hyphenated form (strips braces / urn prefix). Profiles: `strict` (hyphenated-only, refuse all sentinels and non-canonical forms), `balanced` (accept any form, audit sentinels), `permissive` (universal-refuse class still refused). Postures: `hipaa` / `pci-dss` / `soc2` strict overlay; `gdpr` balanced overlay. Auto-registers into `b.guardAll` as a STANDALONE_GUARD; the adaptive integration harness picks it up automatically via the KIND="identifier" dispatcher.
 
 - **0.7.43** (2026-05-05) — `b.guardDomain` — domain-name identifier-safety primitive (KIND="identifier"). Validates user-supplied DNS names destined for allowlists, redirect targets, webhook endpoints, email-domain extraction, and CORS origin checks. Threat catalog: RFC 1035 §2.3.4 length caps (63 octets per label, 253 octets per FQDN), RFC 952 / 1123 LDH-rule violations (no leading/trailing hyphen, no `--` at positions 3-4 except `xn--`), IDN homograph mixed-script confusables (Latin / Cyrillic / Greek / Cherokee / Armenian / Han / Hiragana / Katakana / Hangul / Arabic / Hebrew range tables), BIDI / zero-width / control / null universal refuse via `lib/codepoint-class.js` (CVE-2021-42574 Trojan Source class), Punycode A-label malformation (bare `xn--`, double-encoded), RFC 6761 special-use suffix matching (`.localhost` / `.local` / `.invalid` / `.test` / `.onion` / `.alt` / `.home.arpa` / `.internal`), IPv4-as-domain confusion (CVE-2021-22931 — dotted-decimal / octal / hex / long-decimal forms), IPv6 bracket-literal, single-label / TLD-only refuse, wildcard `*` label refuse at every profile, RFC 8552 underscore-service-label policy, DGA Shannon-entropy heuristic for high-entropy long single labels (Mirai / Conficker C2 shape). Profiles: `strict` (Latin-only scripts, refuse-on-everything), `balanced` (audit Punycode, allow major international scripts, audit DGA), `permissive` (universal-refuse class still refused; everything else audit / allow). Compliance postures: `hipaa` / `pci-dss` / `soc2` strict overlay; `gdpr` balanced overlay. Auto-registers into `b.guardAll` as a STANDALONE_GUARD; the adaptive integration harness at `test/layer-5-integration/guard-host-integration.test.js` picks it up automatically. Defer-with-condition: full UTS #46 ToASCII / ToUnicode round-trip and Public-Suffix-List boundary enforcement ship behind operator-supplied callbacks (`opts.idnToAscii`, `opts.publicSuffixList`); re-open conditions are documented in the wiki page.

package/index.js

@@ -112,6 +112,8 @@ var guardMarkdown = require("./lib/guard-markdown");
 var guardEmail = require("./lib/guard-email");
 var guardDomain = require("./lib/guard-domain");
 var guardUuid = require("./lib/guard-uuid");
+var guardCidr = require("./lib/guard-cidr");
+var guardTime = require("./lib/guard-time");
 var guardAll = require("./lib/guard-all");
 var ssrfGuard = require("./lib/ssrf-guard");
 var authHeader = require("./lib/auth-header");
@@ -255,6 +257,8 @@ module.exports = {
   guardEmail:       guardEmail,
   guardDomain:      guardDomain,
   guardUuid:        guardUuid,
+  guardCidr:        guardCidr,
+  guardTime:        guardTime,
   guardAll:         guardAll,
   ssrfGuard:        ssrfGuard,
   authHeader:       authHeader,

package/lib/framework-error.js

@@ -264,6 +264,22 @@ var GuardDomainError      = defineClass("GuardDomainError",      { alwaysPermane
 // declared formatPolicy, BIDI / zero-width / control-byte / null-byte
 // universal refuse. alwaysPermanent.
 var GuardUuidError        = defineClass("GuardUuidError",        { alwaysPermanent: true });
+// GuardCidrError covers CIDR identifier violations: shape malformation,
+// IPv4 octet overflow, IPv6 zero-group ambiguity, mask out-of-range,
+// network-address misalignment (host bits set), reserved-range membership
+// (RFC 1918, loopback, link-local, multicast, documentation, benchmarking,
+// CGNAT, IPv6 ULA / link-local / multicast / documentation), IPv4-mapped
+// IPv6 dual-stack confusion, BIDI / zero-width / control / null-byte
+// universal refuse. alwaysPermanent.
+var GuardCidrError        = defineClass("GuardCidrError",        { alwaysPermanent: true });
+// GuardTimeError covers RFC 3339 / ISO 8601 datetime identifier
+// violations: shape malformation, year-window overflow (pre-epoch /
+// far-future), naive datetime (no offset), non-UTC offset, leap-second
+// `60` field policy, excessive fractional precision, date-only /
+// time-only refuse, BIDI / zero-width / control / null-byte universal
+// refuse, structural range violations (month / day-in-month / hour /
+// minute / second). alwaysPermanent.
+var GuardTimeError        = defineClass("GuardTimeError",        { alwaysPermanent: true });
 // DoraError covers DORA Article 17 incident-reporting workflow errors
 // (classification refusal, report-shape validation, ESA-template
 // generation, audit-chain integration). Permanent — these are
@@ -325,6 +341,8 @@ module.exports = {
   GuardEmailError:        GuardEmailError,
   GuardDomainError:       GuardDomainError,
   GuardUuidError:         GuardUuidError,
+  GuardCidrError:         GuardCidrError,
+  GuardTimeError:         GuardTimeError,
   DoraError:              DoraError,
   ComplianceError:        ComplianceError,
   SmtpPolicyError:        SmtpPolicyError,

package/lib/guard-all.js

@@ -91,6 +91,8 @@ var STANDALONE_GUARDS = [
   require("./guard-filename"),
   require("./guard-domain"),
   require("./guard-uuid"),
+  require("./guard-cidr"),
+  require("./guard-time"),
 ];
 
 // Framework-wide profile + posture vocabulary that every guard MUST

package/lib/guard-cidr.js

@@ -0,0 +1,513 @@
+"use strict";
+/**
+ * guard-cidr — CIDR identifier-safety primitive (b.guardCidr).
+ *
+ * Validates user-supplied CIDR notation strings (IPv4 + IPv6) destined
+ * for network-allowlists, ACLs, security-group rules, and tenant-
+ * boundary configuration. KIND="identifier" — consumes ctx.identifier
+ * (or ctx.cidr).
+ *
+ * Threat catalog:
+ *   - Shape malformation — not "address/mask".
+ *   - IPv4 octet out of range (> 255), wrong number of octets.
+ *   - IPv6 zero-group inflation, multiple `::` (ambiguous).
+ *   - Mask out of range (IPv4: 0-32; IPv6: 0-128); negative.
+ *   - Network-address misalignment — `10.0.0.1/24` carries host bits
+ *     set when /24 implies the pure network address `10.0.0.0/24`.
+ *     Often a typo that produces unexpected match semantics.
+ *   - Reserved IPv4 ranges (RFC 1918 private 10/8, 172.16/12,
+ *     192.168/16; loopback 127/8; link-local 169.254/16; multicast
+ *     224/4; reserved 240/4; documentation 192.0.2/24, 198.51.100/24,
+ *     203.0.113/24; benchmarking 198.18/15; CGNAT 100.64/10).
+ *   - Reserved IPv6 ranges — loopback `::1`, unspecified `::/128`,
+ *     ULA `fc00::/7`, link-local `fe80::/10`, multicast `ff00::/8`,
+ *     IPv4-mapped `::ffff:0:0/96`, documentation `2001:db8::/32`,
+ *     teredo `2001::/32`, deprecated 6to4 `2002::/16`.
+ *   - IPv4-mapped IPv6 confusion (CVE-2021-22931 IPv6 / IPv4 dual-
+ *     stack class) — `::ffff:192.168.1.1` represents the IPv4 address
+ *     in IPv6 namespace and trips dual-stack allowlist matchers.
+ *   - BIDI / zero-width / control / null-byte universal refuse.
+ *
+ *   var rv = b.guardCidr.validate("10.0.0.0/8", { profile: "strict" });
+ *   var safe = b.guardCidr.sanitize("10.0.0.1/24", { profile: "balanced" });
+ *   var g = b.guardCidr.gate({ profile: "strict" });
+ */
+
+var codepointClass = require("./codepoint-class");
+var lazyRequire = require("./lazy-require");
+var gateContract = require("./gate-contract");
+var C = require("./constants");
+var numericBounds = require("./numeric-bounds");
+var { GuardCidrError } = require("./framework-error");
+
+var observability = lazyRequire(function () { return require("./observability"); });
+void observability;
+
+var _err = GuardCidrError.factory;
+
+var IPV4_OCTET_MAX = 255;                                                        // allow:raw-byte-literal — RFC 791 octet ceiling
+var IPV4_MASK_MAX  = 32;                                                         // allow:raw-byte-literal — IPv4 prefix ceiling
+var IPV6_MASK_MAX  = 128;                                                        // allow:raw-byte-literal — IPv6 prefix ceiling
+var IPV4_OCTETS    = 4;                                                          // allow:raw-byte-literal — IPv4 dotted-quad count
+var IPV6_GROUPS    = 8;                                                          // allow:raw-byte-literal — IPv6 16-bit group count
+
+// ---- IPv4 reserved ranges (CIDR network, /mask) ----
+//
+// Each entry: [networkAsUint32, maskBits, label].
+function _ipv4ToUint32(o) { return ((o[0] << 24) >>> 0) + (o[1] << 16) + (o[2] << 8) + o[3]; }   // allow:raw-byte-literal — IPv4 octet shifts
+var IPV4_RESERVED = Object.freeze([
+  { net: _ipv4ToUint32([10, 0, 0, 0]),       prefix: 8,  label: "rfc1918-private-10" },          // allow:raw-byte-literal — IPv4 octets
+  { net: _ipv4ToUint32([172, 16, 0, 0]),     prefix: 12, label: "rfc1918-private-172.16" },      // allow:raw-byte-literal — IPv4 octets
+  { net: _ipv4ToUint32([192, 168, 0, 0]),    prefix: 16, label: "rfc1918-private-192.168" },     // allow:raw-byte-literal — IPv4 octets
+  { net: _ipv4ToUint32([127, 0, 0, 0]),      prefix: 8,  label: "loopback" },                    // allow:raw-byte-literal — IPv4 octets
+  { net: _ipv4ToUint32([169, 254, 0, 0]),    prefix: 16, label: "link-local" },                  // allow:raw-byte-literal — IPv4 octets
+  { net: _ipv4ToUint32([224, 0, 0, 0]),      prefix: 4,  label: "multicast" },                   // allow:raw-byte-literal — IPv4 octets
+  { net: _ipv4ToUint32([240, 0, 0, 0]),      prefix: 4,  label: "reserved-class-e" },            // allow:raw-byte-literal — IPv4 octets allow:raw-time-literal — 240 is an IPv4 octet not seconds
+  { net: _ipv4ToUint32([192, 0, 2, 0]),      prefix: 24, label: "documentation-test-net-1" },    // allow:raw-byte-literal — IPv4 octets
+  { net: _ipv4ToUint32([198, 51, 100, 0]),   prefix: 24, label: "documentation-test-net-2" },    // allow:raw-byte-literal — IPv4 octets
+  { net: _ipv4ToUint32([203, 0, 113, 0]),    prefix: 24, label: "documentation-test-net-3" },    // allow:raw-byte-literal — IPv4 octets
+  { net: _ipv4ToUint32([198, 18, 0, 0]),     prefix: 15, label: "benchmarking" },                // allow:raw-byte-literal — IPv4 octets
+  { net: _ipv4ToUint32([100, 64, 0, 0]),     prefix: 10, label: "cgnat" },                       // allow:raw-byte-literal — IPv4 octets
+  { net: _ipv4ToUint32([0, 0, 0, 0]),        prefix: 8,  label: "this-network" },                // allow:raw-byte-literal — IPv4 octets
+]);
+
+// ---- IPv6 reserved prefixes ----
+//
+// Stored as a normalized "first 32 hex chars (no colons)" prefix-byte
+// string. Match by string-prefix on the first ceil(prefix/4) hex chars.
+var IPV6_RESERVED = Object.freeze([
+  { prefix: 128, hexPrefix: "00000000000000000000000000000001", label: "loopback" },             // allow:raw-byte-literal — IPv6 hex form
+  { prefix: 128, hexPrefix: "00000000000000000000000000000000", label: "unspecified" },          // allow:raw-byte-literal — IPv6 hex form
+  { prefix: 7,   hexPrefix: "fc",                                 label: "ula" },                // allow:raw-byte-literal — IPv6 hex form
+  { prefix: 10,  hexPrefix: "fe8",                                label: "link-local" },         // allow:raw-byte-literal — IPv6 hex form
+  { prefix: 8,   hexPrefix: "ff",                                 label: "multicast" },          // allow:raw-byte-literal — IPv6 hex form
+  { prefix: 96,  hexPrefix: "00000000000000000000ffff",           label: "ipv4-mapped" },        // allow:raw-byte-literal — IPv6 hex form
+  { prefix: 32,  hexPrefix: "20010db8",                           label: "documentation" },      // allow:raw-byte-literal — IPv6 hex form
+  { prefix: 32,  hexPrefix: "20010000",                           label: "teredo" },             // allow:raw-byte-literal — IPv6 hex form
+  { prefix: 16,  hexPrefix: "2002",                               label: "deprecated-6to4" },    // allow:raw-byte-literal — IPv6 hex form
+]);
+
+// ---- Profile presets ----
+
+var PROFILES = Object.freeze({
+  "strict": {
+    bidiPolicy:               "reject",
+    controlPolicy:             "reject",
+    nullBytePolicy:            "reject",
+    zeroWidthPolicy:           "reject",
+    networkAlignmentPolicy:    "reject",
+    reservedRangesPolicy:      "reject",
+    ipv4MappedIpv6Policy:      "reject",
+    requireMaskPolicy:         "reject-bare-ip",                                 // bare ip/no mask refused
+    family:                    "either",                                         // "either" | "ipv4-only" | "ipv6-only"
+    maxBytes:                  C.BYTES.bytes(64),
+    maxRuntimeMs:              C.TIME.seconds(2),
+  },
+  "balanced": {
+    bidiPolicy:               "reject",
+    controlPolicy:             "reject",
+    nullBytePolicy:            "reject",
+    zeroWidthPolicy:           "reject",
+    networkAlignmentPolicy:    "audit",
+    reservedRangesPolicy:      "audit",
+    ipv4MappedIpv6Policy:      "audit",
+    requireMaskPolicy:         "audit-bare-ip",                                  // bare ip → audit; treat as host-only prefix
+    family:                    "either",
+    maxBytes:                  C.BYTES.bytes(64),
+    maxRuntimeMs:              C.TIME.seconds(2),
+  },
+  "permissive": {
+    bidiPolicy:               "reject",                                          // BIDI refused at every profile
+    controlPolicy:             "reject",                                          // controls refused at every profile
+    nullBytePolicy:            "reject",                                          // null refused at every profile
+    zeroWidthPolicy:           "reject",                                          // zero-width refused at every profile
+    networkAlignmentPolicy:    "audit",
+    reservedRangesPolicy:      "allow",
+    ipv4MappedIpv6Policy:      "allow",
+    requireMaskPolicy:         "allow-bare-ip",
+    family:                    "either",
+    maxBytes:                  C.BYTES.bytes(64),
+    maxRuntimeMs:              C.TIME.seconds(2),
+  },
+});
+
+var DEFAULTS = Object.freeze(Object.assign({}, PROFILES["strict"], {
+  mode: "enforce",
+}));
+
+var COMPLIANCE_POSTURES = Object.freeze({
+  "hipaa":   Object.assign({}, PROFILES["strict"], {
+    forensicSnippetBytes: C.BYTES.bytes(128),
+  }),
+  "pci-dss": Object.assign({}, PROFILES["strict"], {
+    forensicSnippetBytes: C.BYTES.bytes(128),
+  }),
+  "gdpr":    Object.assign({}, PROFILES["balanced"], {
+    forensicSnippetBytes: C.BYTES.bytes(64),
+  }),
+  "soc2":    Object.assign({}, PROFILES["strict"], {
+    forensicSnippetBytes: C.BYTES.bytes(256),
+  }),
+});
+
+function _resolveOpts(opts) {
+  return gateContract.resolveProfileAndPosture(opts, {
+    profiles:           PROFILES,
+    compliancePostures: COMPLIANCE_POSTURES,
+    defaults:           DEFAULTS,
+    errorClass:         GuardCidrError,
+    errCodePrefix:      "cidr",
+  });
+}
+
+// ---- Parsers ----
+
+function _parseIpv4(s) {
+  // Strict dotted-decimal — every octet is 0-255 with no leading zeros
+  // (octal/hex/long forms refused — see guard-domain for that class).
+  var parts = s.split(".");
+  if (parts.length !== IPV4_OCTETS) return null;
+  var octets = [];
+  for (var i = 0; i < parts.length; i += 1) {
+    var p = parts[i];
+    if (!/^[0-9]+$/.test(p)) return null;
+    if (p.length > 1 && p.charAt(0) === "0") return null;                        // leading-zero octal/forms refused
+    var n = parseInt(p, 10);                                                     // allow:raw-byte-literal — base-10 radix
+    if (n > IPV4_OCTET_MAX) return null;
+    octets.push(n);
+  }
+  return octets;
+}
+
+function _parseIpv6(s) {
+  // IPv6 — supports `::` zero-group compression. Returns 8 hex groups
+  // expanded to 4-char-each lowercase string, or null on malformation.
+  if (s.indexOf(":::") !== -1) return null;
+  var doubleColons = s.split("::");
+  if (doubleColons.length > 2) return null;
+
+  function _parseGroups(seg) {
+    if (seg === "") return [];
+    var parts = seg.split(":");
+    var out = [];
+    for (var i = 0; i < parts.length; i += 1) {
+      var p = parts[i];
+      if (!/^[0-9a-fA-F]{1,4}$/.test(p)) return null;
+      out.push(p.toLowerCase());
+    }
+    return out;
+  }
+
+  var groups;
+  if (doubleColons.length === 1) {
+    // No `::` — must be exactly 8 groups.
+    groups = _parseGroups(doubleColons[0]);
+    if (!groups || groups.length !== IPV6_GROUPS) return null;
+  } else {
+    var left  = _parseGroups(doubleColons[0]);
+    var right = _parseGroups(doubleColons[1]);
+    if (left === null || right === null) return null;
+    var pad = IPV6_GROUPS - left.length - right.length;
+    if (pad < 0) return null;
+    var zeros = [];
+    for (var z = 0; z < pad; z += 1) zeros.push("0000");                         // allow:raw-byte-literal — IPv6 zero group
+    groups = left.concat(zeros).concat(right);
+    if (groups.length !== IPV6_GROUPS) return null;
+  }
+  // Pad each group to 4 chars.
+  for (var g = 0; g < groups.length; g += 1) {
+    while (groups[g].length < 4) groups[g] = "0" + groups[g];                    // allow:raw-byte-literal — IPv6 group width
+  }
+  return groups;
+}
+
+function _hostBitsSetIpv4(octets, prefix) {
+  if (prefix === IPV4_MASK_MAX) return false;
+  var addr = _ipv4ToUint32(octets);
+  var hostMask = prefix === 0 ? 0xFFFFFFFF : ((1 << (IPV4_MASK_MAX - prefix)) - 1) >>> 0;
+  return (addr & hostMask) !== 0;
+}
+
+function _hostBitsSetIpv6(groups, prefix) {
+  if (prefix === IPV6_MASK_MAX) return false;
+  // Walk groups from most-significant; once we cross the prefix
+  // boundary, every remaining bit must be zero.
+  var bitIdx = 0;
+  for (var i = 0; i < groups.length; i += 1) {
+    var grp = parseInt(groups[i], 16);                                           // allow:raw-byte-literal — base-16 radix
+    for (var b = 15; b >= 0; b -= 1) {                                           // allow:raw-byte-literal — bits per group
+      if (bitIdx >= prefix) {
+        if ((grp >> b) & 1) return true;
+      }
+      bitIdx += 1;
+    }
+  }
+  return false;
+}
+
+function _ipv4InReservedRange(octets, prefix) {
+  var addr = _ipv4ToUint32(octets);
+  var hits = [];
+  for (var i = 0; i < IPV4_RESERVED.length; i += 1) {
+    var r = IPV4_RESERVED[i];
+    if (prefix < r.prefix) continue;                                             // user range broader than reserved → not contained
+    var mask = r.prefix === 0 ? 0 : (0xFFFFFFFF << (IPV4_MASK_MAX - r.prefix)) >>> 0;
+    // JS `&` is signed int32 — `>>> 0` reinterprets back to uint32 so
+    // addresses with the high bit set compare correctly.
+    if (((addr & mask) >>> 0) === r.net) hits.push(r.label);
+  }
+  return hits;
+}
+
+function _ipv6InReservedRange(groups, prefix) {
+  var hex = groups.join("");
+  var hits = [];
+  for (var i = 0; i < IPV6_RESERVED.length; i += 1) {
+    var r = IPV6_RESERVED[i];
+    if (prefix < r.prefix) continue;
+    if (hex.startsWith(r.hexPrefix)) hits.push(r.label);
+  }
+  return hits;
+}
+
+// ---- Detection ----
+
+function _detectIssues(input, opts) {
+  var issues = [];
+  if (typeof input !== "string") {
+    return [{ kind: "bad-input", severity: "high",
+              ruleId: "cidr.bad-input",
+              snippet: "cidr is not a string" }];
+  }
+  if (input.length === 0) {
+    return [{ kind: "empty", severity: "high",
+              ruleId: "cidr.empty",
+              snippet: "cidr is empty" }];
+  }
+  if (Buffer.byteLength(input, "utf8") > opts.maxBytes) {
+    return [{ kind: "cidr-cap", severity: "high",
+              ruleId: "cidr.cidr-cap",
+              snippet: "cidr input exceeds maxBytes " + opts.maxBytes }];
+  }
+
+  var charThreats = codepointClass.detectCharThreats(input, opts, "cidr");
+  for (var ci = 0; ci < charThreats.length; ci += 1) issues.push(charThreats[ci]);
+
+  // Split address from mask.
+  var slashAt = input.indexOf("/");
+  var addrPart = slashAt === -1 ? input : input.slice(0, slashAt);
+  var maskPart = slashAt === -1 ? null   : input.slice(slashAt + 1);
+
+  var hasMask = maskPart !== null;
+  if (!hasMask) {
+    if (opts.requireMaskPolicy === "reject-bare-ip") {
+      issues.push({
+        kind: "bare-ip", severity: "high",
+        ruleId: "cidr.bare-ip",
+        snippet: "input has no `/mask` — bare IP refused at strict; " +
+                 "use /32 (IPv4) or /128 (IPv6) for a single host",
+      });
+      return issues;
+    } else if (opts.requireMaskPolicy === "audit-bare-ip") {
+      issues.push({
+        kind: "bare-ip", severity: "warn",
+        ruleId: "cidr.bare-ip",
+        snippet: "input has no `/mask` — treating as /32 or /128 host",
+      });
+    }
+  }
+
+  // Determine address family.
+  var ipv4Octets = _parseIpv4(addrPart);
+  var ipv6Groups = ipv4Octets ? null : _parseIpv6(addrPart);
+
+  if (!ipv4Octets && !ipv6Groups) {
+    issues.push({
+      kind: "address-shape", severity: "high",
+      ruleId: "cidr.address-shape",
+      snippet: "address `" + addrPart + "` is not a valid IPv4 dotted-" +
+               "decimal or IPv6 hex-group form",
+    });
+    return issues;
+  }
+
+  var family = ipv4Octets ? "ipv4" : "ipv6";
+
+  // Family-restriction enforcement.
+  if (opts.family === "ipv4-only" && family !== "ipv4") {
+    issues.push({
+      kind: "family-mismatch", severity: "high",
+      ruleId: "cidr.family-mismatch",
+      snippet: "address is " + family + " but family policy is `ipv4-only`",
+    });
+  }
+  if (opts.family === "ipv6-only" && family !== "ipv6") {
+    issues.push({
+      kind: "family-mismatch", severity: "high",
+      ruleId: "cidr.family-mismatch",
+      snippet: "address is " + family + " but family policy is `ipv6-only`",
+    });
+  }
+
+  // Mask validation.
+  var maskMax = family === "ipv4" ? IPV4_MASK_MAX : IPV6_MASK_MAX;
+  var prefix = hasMask ? -1 : maskMax;
+  if (hasMask) {
+    if (!/^[0-9]+$/.test(maskPart)) {
+      issues.push({
+        kind: "mask-shape", severity: "high",
+        ruleId: "cidr.mask-shape",
+        snippet: "mask `" + maskPart + "` is not a non-negative integer",
+      });
+      return issues;
+    }
+    prefix = parseInt(maskPart, 10);                                             // allow:raw-byte-literal — base-10 radix
+    if (prefix > maskMax) {
+      issues.push({
+        kind: "mask-cap", severity: "high",
+        ruleId: "cidr.mask-cap",
+        snippet: "mask /" + prefix + " exceeds " + family + " maximum /" +
+                 maskMax,
+      });
+      return issues;
+    }
+  }
+
+  // Network-address alignment — host bits must be zero unless the
+  // mask is /32 or /128 (single host).
+  var misaligned;
+  if (family === "ipv4") misaligned = _hostBitsSetIpv4(ipv4Octets, prefix);
+  else                   misaligned = _hostBitsSetIpv6(ipv6Groups, prefix);
+  if (misaligned && opts.networkAlignmentPolicy !== "allow") {
+    issues.push({
+      kind: "network-misaligned",
+      severity: opts.networkAlignmentPolicy === "reject" ? "high" : "warn",
+      ruleId: "cidr.network-misaligned",
+      snippet: "host bits set in `" + addrPart + "/" + prefix + "` — " +
+               "network address would be different; common typo class",
+    });
+  }
+
+  // Reserved-range membership.
+  var reserved = family === "ipv4"
+    ? _ipv4InReservedRange(ipv4Octets, prefix)
+    : _ipv6InReservedRange(ipv6Groups, prefix);
+  if (reserved.length > 0 && opts.reservedRangesPolicy !== "allow") {
+    issues.push({
+      kind: "reserved-range",
+      severity: opts.reservedRangesPolicy === "reject" ? "high" : "warn",
+      ruleId: "cidr.reserved-range",
+      snippet: "cidr falls inside reserved range(s): " + reserved.join(", "),
+    });
+  }
+
+  // IPv4-mapped IPv6 confusion check.
+  if (family === "ipv6" &&
+      reserved.indexOf("ipv4-mapped") !== -1 &&
+      opts.ipv4MappedIpv6Policy !== "allow") {
+    issues.push({
+      kind: "ipv4-mapped-ipv6",
+      severity: opts.ipv4MappedIpv6Policy === "reject" ? "high" : "warn",
+      ruleId: "cidr.ipv4-mapped-ipv6",
+      snippet: "address is IPv4-mapped IPv6 (`::ffff:0:0/96`) — dual-" +
+               "stack allowlist confusion class (CVE-2021-22931 IPv6 " +
+               "variant)",
+    });
+  }
+
+  return issues;
+}
+
+function validate(input, opts) {
+  opts = _resolveOpts(opts);
+  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
+    ["maxBytes"],
+    "guardCidr.validate", GuardCidrError, "cidr.bad-opt");
+  if (typeof input !== "string") {
+    return {
+      ok: false,
+      issues: [{ kind: "bad-input", severity: "high",
+                 ruleId: "cidr.bad-input",
+                 snippet: "cidr is not a string" }],
+    };
+  }
+  return gateContract.aggregateIssues(_detectIssues(input, opts));
+}
+
+function sanitize(input, opts) {
+  opts = _resolveOpts(opts);
+  if (typeof input !== "string") {
+    throw _err("cidr.bad-input", "sanitize requires string input");
+  }
+  var issues = _detectIssues(input, opts);
+  for (var i = 0; i < issues.length; i += 1) {
+    if (issues[i].severity === "critical" || issues[i].severity === "high") {
+      throw _err(issues[i].ruleId || "cidr.refused",
+        "guardCidr.sanitize: " + issues[i].snippet);
+    }
+  }
+  // Normalize: lowercase IPv6 groups + canonical mask form.
+  var slashAt = input.indexOf("/");
+  var addr = slashAt === -1 ? input : input.slice(0, slashAt);
+  var mask = slashAt === -1 ? null  : input.slice(slashAt + 1);
+  if (_parseIpv4(addr)) return mask === null ? addr : addr + "/" + mask;
+  return mask === null ? addr.toLowerCase() : addr.toLowerCase() + "/" + mask;
+}
+
+function gate(opts) {
+  opts = _resolveOpts(opts);
+  return gateContract.buildGuardGate(
+    opts.name || "guardCidr:" + (opts.profile || "default"),
+    opts,
+    async function (ctx) {
+      var identifier = ctx && (ctx.identifier || ctx.cidr || "");
+      if (!identifier) return { ok: true, action: "serve" };
+      var rv = validate(identifier, opts);
+      if (rv.issues.length === 0) return { ok: true, action: "serve" };
+      var hasCritical = rv.issues.some(function (i) {
+        return i.severity === "critical";
+      });
+      var hasHigh = rv.issues.some(function (i) {
+        return i.severity === "high";
+      });
+      if (!hasCritical && !hasHigh) {
+        return { ok: true, action: "audit-only", issues: rv.issues };
+      }
+      return { ok: false, action: "refuse", issues: rv.issues };
+    });
+}
+
+var buildProfile = gateContract.makeProfileBuilder(PROFILES);
+
+function compliancePosture(name) {
+  return gateContract.lookupCompliancePosture(name, COMPLIANCE_POSTURES,
+    _err, "cidr");
+}
+
+var _cidrRulePacks = gateContract.makeRulePackLoader(GuardCidrError, "cidr");
+var loadRulePack = _cidrRulePacks.load;
+
+module.exports = {
+  // ---- guard-* family registry exports ----
+  NAME:                "cidr",
+  KIND:                "identifier",
+  INTEGRATION_FIXTURES: Object.freeze({
+    kind:              "identifier",
+    benignBytes:       Buffer.from("8.8.8.0/24", "utf8"),
+    hostileBytes:      Buffer.from("10.0.0.0/8", "utf8"),
+    benignIdentifier:  "8.8.8.0/24",
+    // Hostile: RFC 1918 private range — refused at strict.
+    hostileIdentifier: "10.0.0.0/8",
+  }),
+  // ---- primitive surface ----
+  validate:            validate,
+  sanitize:            sanitize,
+  gate:                gate,
+  buildProfile:        buildProfile,
+  compliancePosture:   compliancePosture,
+  loadRulePack:        loadRulePack,
+  PROFILES:            PROFILES,
+  DEFAULTS:            DEFAULTS,
+  COMPLIANCE_POSTURES: COMPLIANCE_POSTURES,
+  GuardCidrError:      GuardCidrError,
+};

package/lib/guard-time.js

@@ -0,0 +1,420 @@
+"use strict";
+/**
+ * guard-time — RFC 3339 / ISO 8601 datetime identifier-safety primitive
+ * (b.guardTime).
+ *
+ * Validates user-supplied datetime strings destined for audit
+ * timestamps, scheduling, retention windows, query ranges, and
+ * cross-system event correlation. KIND="identifier" — consumes
+ * ctx.identifier (or ctx.timestamp).
+ *
+ * Threat catalog:
+ *   - Shape malformation — not RFC 3339 / ISO 8601 datetime.
+ *   - Pre-epoch / far-future — year before 1970 or after the
+ *     operator's far-future ceiling (default 9999); often a parsing
+ *     bug or sentinel-leak shape.
+ *   - Naive datetime (no offset) — strict refuses; downstream
+ *     interpretation depends on local timezone, breaks
+ *     cross-region equality.
+ *   - Non-UTC offset — strict accepts only `Z` / `+00:00`; balanced
+ *     accepts any offset; permissive allows naive too.
+ *   - Leap-second `60` in seconds field — RFC 3339 §5.6 explicitly
+ *     valid (`23:59:60Z` is a real wall-clock time); most parsers
+ *     panic. Flagged-by-default with operator policy.
+ *   - Excessive fractional precision — RFC 3339 allows any digits
+ *     after the dot but every consuming system has a cap; flag > 9
+ *     fractional digits.
+ *   - Date-only / time-only — refused for full-datetime contexts.
+ *   - Whitespace / control / null-byte / BIDI universal refuse.
+ *
+ *   var rv = b.guardTime.validate("2026-05-05T12:34:56Z",
+ *                                 { profile: "strict" });
+ *   var safe = b.guardTime.sanitize("2026-05-05T12:34:56.123+05:30",
+ *                                   { profile: "balanced" });
+ *   var g = b.guardTime.gate({ profile: "strict" });
+ */
+
+var codepointClass = require("./codepoint-class");
+var lazyRequire = require("./lazy-require");
+var gateContract = require("./gate-contract");
+var C = require("./constants");
+var numericBounds = require("./numeric-bounds");
+var { GuardTimeError } = require("./framework-error");
+
+var observability = lazyRequire(function () { return require("./observability"); });
+void observability;
+
+var _err = GuardTimeError.factory;
+
+// RFC 3339 §5.6 full-date + full-time grammar — anchored.
+//
+// Capture groups:
+//   1: year (4 digits)         2: month (2)         3: day (2)
+//   4: hour (2)                5: minute (2)        6: second (2; allows 60 for leap-second)
+//   7: fractional incl. dot (optional)              8: offset (Z or +HH:MM/-HH:MM)
+var RFC3339_RE = /^(\d{4})-(\d{2})-(\d{2})[Tt ](\d{2}):(\d{2}):(\d{2})(\.\d+)?([Zz]|[+-]\d{2}:\d{2})?$/;
+
+var DEFAULT_MIN_YEAR = 1970;                                                     // allow:raw-byte-literal — Unix epoch year
+var DEFAULT_MAX_YEAR = 9999;                                                     // allow:raw-byte-literal — RFC 3339 4-digit year ceiling
+var MAX_FRACTIONAL_DIGITS = 9;                                                   // allow:raw-byte-literal — nanosecond precision cap
+
+// ---- Profile presets ----
+
+var PROFILES = Object.freeze({
+  "strict": {
+    bidiPolicy:               "reject",
+    controlPolicy:             "reject",
+    nullBytePolicy:            "reject",
+    zeroWidthPolicy:           "reject",
+    naiveDatetimePolicy:       "reject",
+    nonUtcOffsetPolicy:        "reject",
+    leapSecondPolicy:          "reject",
+    fractionalDigitsPolicy:    "reject",
+    dateOnlyPolicy:            "reject",
+    timeOnlyPolicy:            "reject",
+    minYear:                   DEFAULT_MIN_YEAR,
+    maxYear:                   DEFAULT_MAX_YEAR,
+    maxFractionalDigits:       MAX_FRACTIONAL_DIGITS,
+    maxBytes:                  C.BYTES.bytes(64),
+    maxRuntimeMs:              C.TIME.seconds(2),
+  },
+  "balanced": {
+    bidiPolicy:               "reject",
+    controlPolicy:             "reject",
+    nullBytePolicy:            "reject",
+    zeroWidthPolicy:           "reject",
+    naiveDatetimePolicy:       "reject",
+    nonUtcOffsetPolicy:        "audit",
+    leapSecondPolicy:          "audit",
+    fractionalDigitsPolicy:    "audit",
+    dateOnlyPolicy:            "audit",
+    timeOnlyPolicy:            "audit",
+    minYear:                   DEFAULT_MIN_YEAR,
+    maxYear:                   DEFAULT_MAX_YEAR,
+    maxFractionalDigits:       MAX_FRACTIONAL_DIGITS,
+    maxBytes:                  C.BYTES.bytes(64),
+    maxRuntimeMs:              C.TIME.seconds(2),
+  },
+  "permissive": {
+    bidiPolicy:               "reject",                                          // BIDI refused at every profile
+    controlPolicy:             "reject",                                          // controls refused at every profile
+    nullBytePolicy:            "reject",                                          // null refused at every profile
+    zeroWidthPolicy:           "reject",                                          // zero-width refused at every profile
+    naiveDatetimePolicy:       "audit",
+    nonUtcOffsetPolicy:        "allow",
+    leapSecondPolicy:          "allow",
+    fractionalDigitsPolicy:    "allow",
+    dateOnlyPolicy:            "allow",
+    timeOnlyPolicy:            "allow",
+    minYear:                   DEFAULT_MIN_YEAR,
+    maxYear:                   DEFAULT_MAX_YEAR,
+    maxFractionalDigits:       MAX_FRACTIONAL_DIGITS,
+    maxBytes:                  C.BYTES.bytes(64),
+    maxRuntimeMs:              C.TIME.seconds(2),
+  },
+});
+
+var DEFAULTS = Object.freeze(Object.assign({}, PROFILES["strict"], {
+  mode: "enforce",
+}));
+
+var COMPLIANCE_POSTURES = Object.freeze({
+  "hipaa":   Object.assign({}, PROFILES["strict"], {
+    forensicSnippetBytes: C.BYTES.bytes(128),
+  }),
+  "pci-dss": Object.assign({}, PROFILES["strict"], {
+    forensicSnippetBytes: C.BYTES.bytes(128),
+  }),
+  "gdpr":    Object.assign({}, PROFILES["balanced"], {
+    forensicSnippetBytes: C.BYTES.bytes(64),
+  }),
+  "soc2":    Object.assign({}, PROFILES["strict"], {
+    forensicSnippetBytes: C.BYTES.bytes(256),
+  }),
+});
+
+function _resolveOpts(opts) {
+  return gateContract.resolveProfileAndPosture(opts, {
+    profiles:           PROFILES,
+    compliancePostures: COMPLIANCE_POSTURES,
+    defaults:           DEFAULTS,
+    errorClass:         GuardTimeError,
+    errCodePrefix:      "time",
+  });
+}
+
+// ---- Detection ----
+
+function _detectIssues(input, opts) {
+  var issues = [];
+  if (typeof input !== "string") {
+    return [{ kind: "bad-input", severity: "high",
+              ruleId: "time.bad-input",
+              snippet: "time is not a string" }];
+  }
+  if (input.length === 0) {
+    return [{ kind: "empty", severity: "high",
+              ruleId: "time.empty",
+              snippet: "time is empty" }];
+  }
+  if (Buffer.byteLength(input, "utf8") > opts.maxBytes) {
+    return [{ kind: "time-cap", severity: "high",
+              ruleId: "time.time-cap",
+              snippet: "time input exceeds maxBytes " + opts.maxBytes }];
+  }
+
+  var charThreats = codepointClass.detectCharThreats(input, opts, "time");
+  for (var ci = 0; ci < charThreats.length; ci += 1) issues.push(charThreats[ci]);
+
+  // Date-only / time-only quick checks BEFORE the full RFC 3339 regex
+  // so the operator gets a more actionable diagnosis.
+  if (/^\d{4}-\d{2}-\d{2}$/.test(input)) {                                       // allow:regex-no-length-cap — input bounded by maxBytes; allow:duplicate-regex — same RFC 3339 full-date shape used by safe-json + safe-schema; not consolidatable across module boundaries
+    if (opts.dateOnlyPolicy !== "allow") {
+      issues.push({
+        kind: "date-only",
+        severity: opts.dateOnlyPolicy === "reject" ? "high" : "warn",
+        ruleId: "time.date-only",
+        snippet: "input is RFC 3339 full-date only — full datetime " +
+                 "(date + time + offset) required",
+      });
+      return issues;
+    }
+  }
+  if (/^\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})?$/.test(input)) {           // allow:regex-no-length-cap — input bounded by maxBytes
+    if (opts.timeOnlyPolicy !== "allow") {
+      issues.push({
+        kind: "time-only",
+        severity: opts.timeOnlyPolicy === "reject" ? "high" : "warn",
+        ruleId: "time.time-only",
+        snippet: "input is RFC 3339 partial-time only — full datetime " +
+                 "(date + time + offset) required",
+      });
+      return issues;
+    }
+  }
+
+  var match = input.match(RFC3339_RE);                                           // allow:regex-no-length-cap — input bounded by maxBytes
+  if (!match) {
+    issues.push({
+      kind: "datetime-shape", severity: "high",
+      ruleId: "time.datetime-shape",
+      snippet: "input does not match RFC 3339 §5.6 date-time grammar",
+    });
+    return issues;
+  }
+
+  var year = parseInt(match[1], 10);                                             // allow:raw-byte-literal — base-10 radix
+  var month = parseInt(match[2], 10);                                            // allow:raw-byte-literal — base-10 radix
+  var day = parseInt(match[3], 10);                                              // allow:raw-byte-literal — base-10 radix
+  var hour = parseInt(match[4], 10);                                             // allow:raw-byte-literal — base-10 radix
+  var minute = parseInt(match[5], 10);                                           // allow:raw-byte-literal — base-10 radix
+  var second = parseInt(match[6], 10);                                           // allow:raw-byte-literal — base-10 radix
+  var fractional = match[7] || "";
+  var offset = match[8];
+
+  // Year window.
+  if (year < opts.minYear || year > opts.maxYear) {
+    issues.push({
+      kind: "year-window", severity: "high",
+      ruleId: "time.year-window",
+      snippet: "year " + year + " outside operator window [" +
+               opts.minYear + ", " + opts.maxYear + "]",
+    });
+  }
+
+  // Month / day / hour / minute structural ranges.
+  if (month < 1 || month > 12) {                                                 // allow:raw-byte-literal — month range
+    issues.push({
+      kind: "month-range", severity: "high",
+      ruleId: "time.month-range",
+      snippet: "month " + month + " outside [1, 12]",
+    });
+  }
+  if (day < 1 || day > 31) {                                                     // allow:raw-byte-literal — day-of-month upper bound
+    issues.push({
+      kind: "day-range", severity: "high",
+      ruleId: "time.day-range",
+      snippet: "day " + day + " outside [1, 31]",
+    });
+  }
+  if (hour > 23) {                                                               // allow:raw-byte-literal — hour ceiling
+    issues.push({
+      kind: "hour-range", severity: "high",
+      ruleId: "time.hour-range",
+      snippet: "hour " + hour + " > 23",
+    });
+  }
+  if (minute > 59) {                                                             // allow:raw-byte-literal — minute ceiling
+    issues.push({
+      kind: "minute-range", severity: "high",
+      ruleId: "time.minute-range",
+      snippet: "minute " + minute + " > 59",
+    });
+  }
+  if (second > 60) {                                                             // allow:raw-time-literal — leap-second ceiling, RFC 3339 §5.6 (not seconds-of-time)
+    issues.push({
+      kind: "second-range", severity: "high",
+      ruleId: "time.second-range",
+      snippet: "second " + second + " > 60 (RFC 3339 §5.6 ceiling " +
+               "including leap)",
+    });
+  }
+
+  // Leap-second flag.
+  if (second === 60 && opts.leapSecondPolicy !== "allow") {                      // allow:raw-time-literal — leap-second sentinel, RFC 3339 §5.6
+    issues.push({
+      kind: "leap-second",
+      severity: opts.leapSecondPolicy === "reject" ? "high" : "warn",
+      ruleId: "time.leap-second",
+      snippet: "second field is 60 (leap second; RFC 3339 §5.6 valid " +
+               "but most parsers panic)",
+    });
+  }
+
+  // Day-in-month structural sanity (light — not full Gregorian
+  // rollover; the framework refuses obviously-out-of-bounds dates
+  // like Feb 30 / Apr 31).
+  var daysInMonth = [31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];            // allow:raw-byte-literal — Gregorian month-day table
+  if (month >= 1 && month <= 12 && day > daysInMonth[month - 1]) {               // allow:raw-byte-literal — month range
+    issues.push({
+      kind: "day-in-month", severity: "high",
+      ruleId: "time.day-in-month",
+      snippet: "day " + day + " not valid in month " + month,
+    });
+  }
+
+  // Fractional digits cap.
+  var fracLen = fractional.length > 0 ? fractional.length - 1 : 0;
+  if (fracLen > opts.maxFractionalDigits &&
+      opts.fractionalDigitsPolicy !== "allow") {
+    issues.push({
+      kind: "fractional-digits",
+      severity: opts.fractionalDigitsPolicy === "reject" ? "high" : "warn",
+      ruleId: "time.fractional-digits",
+      snippet: "fractional precision " + fracLen + " exceeds " +
+               opts.maxFractionalDigits + " digits — downstream " +
+               "consumers may truncate or reject",
+    });
+  }
+
+  // Naive datetime (no offset).
+  if (!offset) {
+    if (opts.naiveDatetimePolicy !== "allow") {
+      issues.push({
+        kind: "naive-datetime",
+        severity: opts.naiveDatetimePolicy === "reject" ? "high" : "warn",
+        ruleId: "time.naive-datetime",
+        snippet: "datetime has no offset (`Z` or `+HH:MM`) — naive " +
+                 "datetimes break cross-region equality",
+      });
+    }
+  } else {
+    // Non-UTC offset.
+    var isUtc = offset === "Z" || offset === "z" ||
+                offset === "+00:00" || offset === "-00:00";
+    if (!isUtc && opts.nonUtcOffsetPolicy !== "allow") {
+      issues.push({
+        kind: "non-utc-offset",
+        severity: opts.nonUtcOffsetPolicy === "reject" ? "high" : "warn",
+        ruleId: "time.non-utc-offset",
+        snippet: "datetime offset `" + offset + "` is not UTC — " +
+                 "strict requires `Z` or `+00:00` for unambiguous " +
+                 "cross-system comparison",
+      });
+    }
+  }
+
+  return issues;
+}
+
+function validate(input, opts) {
+  opts = _resolveOpts(opts);
+  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
+    ["maxBytes", "minYear", "maxYear", "maxFractionalDigits"],
+    "guardTime.validate", GuardTimeError, "time.bad-opt");
+  if (typeof input !== "string") {
+    return {
+      ok: false,
+      issues: [{ kind: "bad-input", severity: "high",
+                 ruleId: "time.bad-input",
+                 snippet: "time is not a string" }],
+    };
+  }
+  return gateContract.aggregateIssues(_detectIssues(input, opts));
+}
+
+function sanitize(input, opts) {
+  opts = _resolveOpts(opts);
+  if (typeof input !== "string") {
+    throw _err("time.bad-input", "sanitize requires string input");
+  }
+  var issues = _detectIssues(input, opts);
+  for (var i = 0; i < issues.length; i += 1) {
+    if (issues[i].severity === "critical" || issues[i].severity === "high") {
+      throw _err(issues[i].ruleId || "time.refused",
+        "guardTime.sanitize: " + issues[i].snippet);
+    }
+  }
+  // Normalize: lowercase the trailing `T` separator, uppercase the
+  // `Z` UTC marker.
+  return input.replace(/(\d) /, "$1T").replace(/z$/, "Z");
+}
+
+function gate(opts) {
+  opts = _resolveOpts(opts);
+  return gateContract.buildGuardGate(
+    opts.name || "guardTime:" + (opts.profile || "default"),
+    opts,
+    async function (ctx) {
+      var identifier = ctx && (ctx.identifier || ctx.timestamp || ctx.time || "");
+      if (!identifier) return { ok: true, action: "serve" };
+      var rv = validate(identifier, opts);
+      if (rv.issues.length === 0) return { ok: true, action: "serve" };
+      var hasCritical = rv.issues.some(function (i) {
+        return i.severity === "critical";
+      });
+      var hasHigh = rv.issues.some(function (i) {
+        return i.severity === "high";
+      });
+      if (!hasCritical && !hasHigh) {
+        return { ok: true, action: "audit-only", issues: rv.issues };
+      }
+      return { ok: false, action: "refuse", issues: rv.issues };
+    });
+}
+
+var buildProfile = gateContract.makeProfileBuilder(PROFILES);
+
+function compliancePosture(name) {
+  return gateContract.lookupCompliancePosture(name, COMPLIANCE_POSTURES,
+    _err, "time");
+}
+
+var _timeRulePacks = gateContract.makeRulePackLoader(GuardTimeError, "time");
+var loadRulePack = _timeRulePacks.load;
+
+module.exports = {
+  // ---- guard-* family registry exports ----
+  NAME:                "time",
+  KIND:                "identifier",
+  INTEGRATION_FIXTURES: Object.freeze({
+    kind:              "identifier",
+    benignBytes:       Buffer.from("2026-05-05T12:34:56Z", "utf8"),
+    hostileBytes:      Buffer.from("2026-05-05 12:34:56", "utf8"),
+    benignIdentifier:  "2026-05-05T12:34:56Z",
+    // Hostile: naive datetime (space separator + no offset) — refused
+    // at strict (cross-region ambiguity class).
+    hostileIdentifier: "2026-05-05 12:34:56",
+  }),
+  // ---- primitive surface ----
+  validate:            validate,
+  sanitize:            sanitize,
+  gate:                gate,
+  buildProfile:        buildProfile,
+  compliancePosture:   compliancePosture,
+  loadRulePack:        loadRulePack,
+  PROFILES:            PROFILES,
+  DEFAULTS:            DEFAULTS,
+  COMPLIANCE_POSTURES: COMPLIANCE_POSTURES,
+  GuardTimeError:      GuardTimeError,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.7.44",
+  "version": "0.7.46",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cyclonedx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:2273cc28-4cb1-4b48-8b09-c33dd95383b2",
+  "serialNumber": "urn:uuid:2e0e50c0-9f28-4f7f-9a4e-4be5cb7f3707",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-05T21:06:13.872Z",
+    "timestamp": "2026-05-05T21:40:55.433Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.7.44",
+      "bom-ref": "@blamejs/core@0.7.46",
       "type": "library",
       "name": "blamejs",
-      "version": "0.7.44",
+      "version": "0.7.46",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.7.44",
+      "purl": "pkg:npm/%40blamejs/core@0.7.46",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.7.44",
+      "ref": "@blamejs/core@0.7.46",
       "dependsOn": []
     }
   ]