@futdevpro/fsm-dynamo 1.20.23 → 1.20.24

package/build/_modules/request-safety/_collections/request-safety-inspector.util.d.ts

@@ -0,0 +1,56 @@
+import { DyFM_RequestSafetyPolicy_Interface, DyFM_RequestSafetyResult_Interface } from '../_models/request-safety.interface';
+/**
+ * BFR-CTM-034 — cross-runtime, content-free request safety inspector.
+ *
+ * ⚠️ **What this is for:** a value is about to cross a boundary (browser → transport, or transport →
+ * state mutation / provider dispatch). Once it has crossed, masking it afterwards is too late — the
+ * value has already been serialized, stored or sent. This inspector runs BEFORE that, and answers a
+ * single question: *may this cross?* — without ever repeating what it saw.
+ *
+ * ⛔ **No side effects, by construction.** No logging, no network, no storage, no timers, no `Math.random`,
+ * no environment access. That is not stylistic: the inspector runs on hostile input, so anything it
+ * touched would become an attack surface, and anything it logged would re-leak the value it rejected.
+ * The same source therefore runs unchanged in a browser, a Worker and Node.
+ */
+export declare class DyFM_RequestSafetyInspector_Util {
+    /**
+     * Format/invisible characters that hide a value from a naive matcher while remaining meaningful to a
+     * human reader or a downstream parser: zero-width space/non-joiner/joiner, word joiner, BOM, the
+     * bidirectional overrides, and the soft hyphen.
+     *
+     * ⭐ These are removed AFTER NFKC. NFKC alone does not drop them, so a `p​assword` key would
+     * still slip past a forbidden-key set that only normalizes.
+     */
+    private static readonly formatObfuscators;
+    /**
+     * Normalizes a string for matching: NFKC, then format-obfuscator removal, then case folding.
+     *
+     * ⚠️ The order matters. NFKC first folds the full-width and compatibility forms (`ｐａｓｓｗｏｒｄ`,
+     * `𝐩𝐚𝐬𝐬𝐰𝐨𝐫𝐝`) onto their ASCII equivalents; only then can the invisible-character strip and the
+     * case fold see a plain string. Reversing the steps leaves obfuscated forms unmatched.
+     */
+    static normalize(value: string): string;
+    /**
+     * Inspects `input` against a caller-owned policy.
+     *
+     * Fail-closed everywhere: an invalid policy, an unsupported value type, a hostile prototype, an
+     * accessor or a blown budget all DECLINE. There is no path that returns `accepted: true` because the
+     * inspector could not decide.
+     *
+     * @returns a content-free outcome; the input itself is never echoed in any form.
+     */
+    static inspect(input: unknown, policy: DyFM_RequestSafetyPolicy_Interface): DyFM_RequestSafetyResult_Interface;
+    /** A string vizsgalata: budget, kanari, tiltott ertek-mintak, nem tamogatott kepessegek. */
+    private static inspectString;
+    /**
+     * Egy minta-csoport illesztese, csoportonként LEGFELJEBB EGY leletet szamolva.
+     *
+     * ⚠️ A `lastIndex` szandekosan nullazva: egy `/g` flag-es minta allapotot visz magaval, es a hivo
+     * altal atadott, ujrahasznalt RegExp kulonben a MASODIK hivasnal mast talalna, mint az elson —
+     * ugyanarra a bemenetre. Ez a fajta nem-determinizmus egy biztonsagi kapunal elfogadhatatlan.
+     */
+    private static recordPatternHit;
+    /** A policy strukturalis ervenyessege. Barmelyik hianyzo budget = ervenytelen. */
+    private static isPolicyValid;
+}
+//# sourceMappingURL=request-safety-inspector.util.d.ts.map

package/build/_modules/request-safety/_collections/request-safety-inspector.util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-safety-inspector.util.d.ts","sourceRoot":"","sources":["../../../../src/_modules/request-safety/_collections/request-safety-inspector.util.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kCAAkC,EAAE,kCAAkC,EACvE,MAAM,qCAAqC,CAAC;AAE7C;;;;;;;;;;;;GAYG;AACH,qBAAa,gCAAgC;IAE3C;;;;;;;OAOG;IACH,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CACkB;IAE3D;;;;;;OAMG;IACH,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAOvC;;;;;;;;OAQG;IACH,MAAM,CAAC,OAAO,CACZ,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,kCAAkC,GACzC,kCAAkC;IA6HrC,4FAA4F;IAC5F,OAAO,CAAC,MAAM,CAAC,aAAa;IA8B5B;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,gBAAgB;IAuB/B,kFAAkF;IAClF,OAAO,CAAC,MAAM,CAAC,aAAa;CAY7B"}

package/build/_modules/request-safety/_collections/request-safety-inspector.util.js

@@ -0,0 +1,189 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyFM_RequestSafetyInspector_Util = void 0;
+const request_safety_finding_type_enum_1 = require("../_enums/request-safety-finding.type-enum");
+/**
+ * BFR-CTM-034 — cross-runtime, content-free request safety inspector.
+ *
+ * ⚠️ **What this is for:** a value is about to cross a boundary (browser → transport, or transport →
+ * state mutation / provider dispatch). Once it has crossed, masking it afterwards is too late — the
+ * value has already been serialized, stored or sent. This inspector runs BEFORE that, and answers a
+ * single question: *may this cross?* — without ever repeating what it saw.
+ *
+ * ⛔ **No side effects, by construction.** No logging, no network, no storage, no timers, no `Math.random`,
+ * no environment access. That is not stylistic: the inspector runs on hostile input, so anything it
+ * touched would become an attack surface, and anything it logged would re-leak the value it rejected.
+ * The same source therefore runs unchanged in a browser, a Worker and Node.
+ */
+class DyFM_RequestSafetyInspector_Util {
+    /**
+     * Format/invisible characters that hide a value from a naive matcher while remaining meaningful to a
+     * human reader or a downstream parser: zero-width space/non-joiner/joiner, word joiner, BOM, the
+     * bidirectional overrides, and the soft hyphen.
+     *
+     * ⭐ These are removed AFTER NFKC. NFKC alone does not drop them, so a `p​assword` key would
+     * still slip past a forbidden-key set that only normalizes.
+     */
+    static formatObfuscators = /[\u00ad\u200b-\u200f\u202a-\u202e\u2060-\u2064\ufeff]/g;
+    /**
+     * Normalizes a string for matching: NFKC, then format-obfuscator removal, then case folding.
+     *
+     * ⚠️ The order matters. NFKC first folds the full-width and compatibility forms (`ｐａｓｓｗｏｒｄ`,
+     * `𝐩𝐚𝐬𝐬𝐰𝐨𝐫𝐝`) onto their ASCII equivalents; only then can the invisible-character strip and the
+     * case fold see a plain string. Reversing the steps leaves obfuscated forms unmatched.
+     */
+    static normalize(value) {
+        return `${value ?? ''}`
+            .normalize('NFKC')
+            .replace(DyFM_RequestSafetyInspector_Util.formatObfuscators, '')
+            .toLowerCase();
+    }
+    /**
+     * Inspects `input` against a caller-owned policy.
+     *
+     * Fail-closed everywhere: an invalid policy, an unsupported value type, a hostile prototype, an
+     * accessor or a blown budget all DECLINE. There is no path that returns `accepted: true` because the
+     * inspector could not decide.
+     *
+     * @returns a content-free outcome; the input itself is never echoed in any form.
+     */
+    static inspect(input, policy) {
+        const counts = {};
+        let inspectedNodes = 0;
+        const namespace = typeof policy?.namespace === 'string' ? policy.namespace.trim() : '';
+        const record = (finding) => {
+            const code = `${namespace}:${finding}`;
+            counts[code] = (counts[code] ?? 0) + 1;
+        };
+        if (!DyFM_RequestSafetyInspector_Util.isPolicyValid(policy)) {
+            // A hibas policy NEM "nincs szabaly, tehat mehet" — az a leghangosabb fail-open lenne.
+            const code = `${namespace || 'unknown'}:${request_safety_finding_type_enum_1.DyFM_RequestSafetyFinding_Type.invalidPolicy}`;
+            return {
+                contractVersion: 'dyfm-request-safety/1',
+                accepted: false,
+                findingCodes: [code],
+                findingCounts: { [code]: 1 },
+                inspectedNodes: 0,
+            };
+        }
+        const forbiddenKeys = new Set((policy.forbiddenKeys ?? []).map((key) => DyFM_RequestSafetyInspector_Util.normalize(key)));
+        const canaries = (policy.canaries ?? []).map((canary) => DyFM_RequestSafetyInspector_Util.normalize(canary));
+        // ⚠️ A ciklus-vedelem a MEGLATOGATOTT objektumok halmaza, nem melyseg-szamlalo: egy `a.b.a`
+        // onhivatkozas veges melysegben is vegtelen bejarast okozna.
+        const seen = new Set();
+        const walk = (value, depth) => {
+            if (inspectedNodes >= policy.maxNodes) {
+                record(request_safety_finding_type_enum_1.DyFM_RequestSafetyFinding_Type.nodeBudget);
+                return;
+            }
+            inspectedNodes++;
+            if (depth > policy.maxDepth) {
+                record(request_safety_finding_type_enum_1.DyFM_RequestSafetyFinding_Type.depthBudget);
+                return;
+            }
+            if (value === null || typeof value === 'boolean' || typeof value === 'number') {
+                return;
+            }
+            if (typeof value === 'string') {
+                DyFM_RequestSafetyInspector_Util.inspectString(value, policy, canaries, record);
+                return;
+            }
+            if (typeof value === 'undefined') {
+                return;
+            }
+            if (typeof value !== 'object') {
+                // fuggveny, symbol, bigint — a kontraktus nem hordozza oket
+                record(request_safety_finding_type_enum_1.DyFM_RequestSafetyFinding_Type.unsupportedValueType);
+                return;
+            }
+            if (seen.has(value)) {
+                record(request_safety_finding_type_enum_1.DyFM_RequestSafetyFinding_Type.cycle);
+                return;
+            }
+            seen.add(value);
+            if (Array.isArray(value)) {
+                for (const item of value) {
+                    walk(item, depth + 1);
+                }
+                return;
+            }
+            const prototype = Object.getPrototypeOf(value);
+            if (prototype !== Object.prototype && prototype !== null) {
+                // Date, Map, class-peldany, `__proto__`-val megmergezett objektum: a szerializalt alak nem
+                // egyezne azzal, amit itt lattunk — tehat az ellenorzes ertelmet vesztene.
+                record(request_safety_finding_type_enum_1.DyFM_RequestSafetyFinding_Type.unsupportedPrototype);
+                return;
+            }
+            for (const key of Object.getOwnPropertyNames(value)) {
+                if (forbiddenKeys.has(DyFM_RequestSafetyInspector_Util.normalize(key))) {
+                    record(request_safety_finding_type_enum_1.DyFM_RequestSafetyFinding_Type.forbiddenKey);
+                }
+                const descriptor = Object.getOwnPropertyDescriptor(value, key);
+                if (descriptor && (descriptor.get || descriptor.set)) {
+                    // ⛔ SOHA nem olvassuk ki: egy getter a hivo kodjat futtatna le a mi vizsgalatunk kozben.
+                    record(request_safety_finding_type_enum_1.DyFM_RequestSafetyFinding_Type.accessor);
+                    continue;
+                }
+                walk(descriptor?.value, depth + 1);
+            }
+        };
+        walk(input, 0);
+        const findingCodes = Object.keys(counts).sort();
+        return {
+            contractVersion: 'dyfm-request-safety/1',
+            accepted: findingCodes.length === 0,
+            findingCodes: findingCodes,
+            findingCounts: counts,
+            inspectedNodes: inspectedNodes,
+        };
+    }
+    /** A string vizsgalata: budget, kanari, tiltott ertek-mintak, nem tamogatott kepessegek. */
+    static inspectString(value, policy, canaries, record) {
+        const normalized = DyFM_RequestSafetyInspector_Util.normalize(value);
+        if (normalized.length > policy.maxStringLength) {
+            record(request_safety_finding_type_enum_1.DyFM_RequestSafetyFinding_Type.stringBudget);
+        }
+        for (const canary of canaries) {
+            if (canary.length > 0 && normalized.includes(canary)) {
+                record(request_safety_finding_type_enum_1.DyFM_RequestSafetyFinding_Type.canary);
+                break;
+            }
+        }
+        DyFM_RequestSafetyInspector_Util.recordPatternHit(normalized, policy.sensitiveValuePatterns, request_safety_finding_type_enum_1.DyFM_RequestSafetyFinding_Type.sensitiveValue, record);
+        DyFM_RequestSafetyInspector_Util.recordPatternHit(normalized, policy.unsupportedCapabilityPatterns, request_safety_finding_type_enum_1.DyFM_RequestSafetyFinding_Type.unsupportedCapability, record);
+    }
+    /**
+     * Egy minta-csoport illesztese, csoportonként LEGFELJEBB EGY leletet szamolva.
+     *
+     * ⚠️ A `lastIndex` szandekosan nullazva: egy `/g` flag-es minta allapotot visz magaval, es a hivo
+     * altal atadott, ujrahasznalt RegExp kulonben a MASODIK hivasnal mast talalna, mint az elson —
+     * ugyanarra a bemenetre. Ez a fajta nem-determinizmus egy biztonsagi kapunal elfogadhatatlan.
+     */
+    static recordPatternHit(normalized, patterns, finding, record) {
+        for (const pattern of patterns ?? []) {
+            pattern.lastIndex = 0;
+            const matched = pattern.test(normalized);
+            // ⚠️ UTANA is nullazunk: a `/g` minta a sikeres `test()` utan a talalat vegen hagyja a
+            // `lastIndex`-et. A hivo UGYANAZT a RegExp-peldanyt hasznalhatja mashol is — ha elmozdulva
+            // adnank vissza, a sajat kovetkezo `test()`-je mast talalna. A vizsgalonak a hivo allapotat
+            // pontosan ugy kell hagynia, ahogy kapta. (Merve: `lastIndex` 6 maradt a nullazas nelkul.)
+            pattern.lastIndex = 0;
+            if (matched) {
+                record(finding);
+                return;
+            }
+        }
+    }
+    /** A policy strukturalis ervenyessege. Barmelyik hianyzo budget = ervenytelen. */
+    static isPolicyValid(policy) {
+        if (!policy || typeof policy !== 'object') {
+            return false;
+        }
+        if (typeof policy.namespace !== 'string' || policy.namespace.trim().length === 0) {
+            return false;
+        }
+        return [policy.maxDepth, policy.maxNodes, policy.maxStringLength].every((budget) => Number.isSafeInteger(budget) && budget > 0);
+    }
+}
+exports.DyFM_RequestSafetyInspector_Util = DyFM_RequestSafetyInspector_Util;
+//# sourceMappingURL=request-safety-inspector.util.js.map

package/build/_modules/request-safety/_collections/request-safety-inspector.util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-safety-inspector.util.js","sourceRoot":"","sources":["../../../../src/_modules/request-safety/_collections/request-safety-inspector.util.ts"],"names":[],"mappings":";;;AAAA,iGAA4F;AAK5F;;;;;;;;;;;;GAYG;AACH,MAAa,gCAAgC;IAE3C;;;;;;;OAOG;IACK,MAAM,CAAU,iBAAiB,GACvC,wDAAwD,CAAC;IAE3D;;;;;;OAMG;IACH,MAAM,CAAC,SAAS,CAAC,KAAa;QAC5B,OAAO,GAAG,KAAK,IAAI,EAAE,EAAE;aACpB,SAAS,CAAC,MAAM,CAAC;aACjB,OAAO,CAAC,gCAAgC,CAAC,iBAAiB,EAAE,EAAE,CAAC;aAC/D,WAAW,EAAE,CAAC;IACnB,CAAC;IAED;;;;;;;;OAQG;IACH,MAAM,CAAC,OAAO,CACZ,KAAc,EACd,MAA0C;QAE1C,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,IAAI,cAAc,GAAW,CAAC,CAAC;QAE/B,MAAM,SAAS,GAAW,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/F,MAAM,MAAM,GAAG,CAAC,OAAuC,EAAQ,EAAE;YAC/D,MAAM,IAAI,GAAW,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACzC,CAAC,CAAC;QAEF,IAAI,CAAC,gCAAgC,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5D,uFAAuF;YACvF,MAAM,IAAI,GAAW,GAAG,SAAS,IAAI,SAAS,IAAI,iEAA8B,CAAC,aAAa,EAAE,CAAC;YAEjG,OAAO;gBACL,eAAe,EAAE,uBAAuB;gBACxC,QAAQ,EAAE,KAAK;gBACf,YAAY,EAAE,CAAE,IAAI,CAAE;gBACtB,aAAa,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;gBAC5B,cAAc,EAAE,CAAC;aAClB,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAgB,IAAI,GAAG,CACxC,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,GAAG,CAC9B,CAAC,GAAW,EAAU,EAAE,CAAC,gCAAgC,CAAC,SAAS,CAAC,GAAG,CAAC,CACzE,CACF,CAAC;QACF,MAAM,QAAQ,GAAa,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CACpD,CAAC,MAAc,EAAU,EAAE,CAAC,gCAAgC,CAAC,SAAS,CAAC,MAAM,CAAC,CAC/E,CAAC;QAEF,4FAA4F;QAC5F,6DAA6D;QAC7D,MAAM,IAAI,GAAgB,IAAI,GAAG,EAAU,CAAC;QAE5C,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,KAAa,EAAQ,EAAE;YACnD,IAAI,cAAc,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACtC,MAAM,CAAC,iEAA8B,CAAC,UAAU,CAAC,CAAC;gBAElD,OAAO;YACT,CAAC;YACD,cAAc,EAAE,CAAC;YAEjB,IAAI,KAAK,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC5B,MAAM,CAAC,iEAA8B,CAAC,WAAW,CAAC,CAAC;gBAEnD,OAAO;YACT,CAAC;YAED,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9E,OAAO;YACT,CAAC;YAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,gCAAgC,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;gBAEhF,OAAO;YACT,CAAC;YAED,IAAI,OAAO,KAAK,KAAK,WAAW,EAAE,CAAC;gBACjC,OAAO;YACT,CAAC;YAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,4DAA4D;gBAC5D,MAAM,CAAC,iEAA8B,CAAC,oBAAoB,CAAC,CAAC;gBAE5D,OAAO;YACT,CAAC;YAED,IAAI,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,iEAA8B,CAAC,KAAK,CAAC,CAAC;gBAE7C,OAAO;YACT,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC,CAAC;YAE1B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;oBACzB,IAAI,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;gBACxB,CAAC;gBAED,OAAO;YACT,CAAC;YAED,MAAM,SAAS,GAAkB,MAAM,CAAC,cAAc,CAAC,KAAe,CAAC,CAAC;YACxE,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;gBACzD,2FAA2F;gBAC3F,2EAA2E;gBAC3E,MAAM,CAAC,iEAA8B,CAAC,oBAAoB,CAAC,CAAC;gBAE5D,OAAO;YACT,CAAC;YAED,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,mBAAmB,CAAC,KAAe,CAAC,EAAE,CAAC;gBAC9D,IAAI,aAAa,CAAC,GAAG,CAAC,gCAAgC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBACvE,MAAM,CAAC,iEAA8B,CAAC,YAAY,CAAC,CAAC;gBACtD,CAAC;gBAED,MAAM,UAAU,GACd,MAAM,CAAC,wBAAwB,CAAC,KAAe,EAAE,GAAG,CAAC,CAAC;gBAExD,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;oBACrD,yFAAyF;oBACzF,MAAM,CAAC,iEAA8B,CAAC,QAAQ,CAAC,CAAC;oBAChD,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;YACrC,CAAC;QACH,CAAC,CAAC;QAEF,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAEf,MAAM,YAAY,GAAa,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAE1D,OAAO;YACL,eAAe,EAAE,uBAAuB;YACxC,QAAQ,EAAE,YAAY,CAAC,MAAM,KAAK,CAAC;YACnC,YAAY,EAAE,YAAY;YAC1B,aAAa,EAAE,MAAM;YACrB,cAAc,EAAE,cAAc;SAC/B,CAAC;IACJ,CAAC;IAED,4FAA4F;IACpF,MAAM,CAAC,aAAa,CAC1B,KAAa,EACb,MAA0C,EAC1C,QAA2B,EAC3B,MAAyD;QAEzD,MAAM,UAAU,GAAW,gCAAgC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAE7E,IAAI,UAAU,CAAC,MAAM,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC;YAC/C,MAAM,CAAC,iEAA8B,CAAC,YAAY,CAAC,CAAC;QACtD,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;YAC9B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACrD,MAAM,CAAC,iEAA8B,CAAC,MAAM,CAAC,CAAC;gBAC9C,MAAM;YACR,CAAC;QACH,CAAC;QAED,gCAAgC,CAAC,gBAAgB,CAC/C,UAAU,EAAE,MAAM,CAAC,sBAAsB,EAAE,iEAA8B,CAAC,cAAc,EAAE,MAAM,CACjG,CAAC;QACF,gCAAgC,CAAC,gBAAgB,CAC/C,UAAU,EACV,MAAM,CAAC,6BAA6B,EACpC,iEAA8B,CAAC,qBAAqB,EACpD,MAAM,CACP,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,gBAAgB,CAC7B,UAAkB,EAClB,QAAuC,EACvC,OAAuC,EACvC,MAAyD;QAEzD,KAAK,MAAM,OAAO,IAAI,QAAQ,IAAI,EAAE,EAAE,CAAC;YACrC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YACtB,MAAM,OAAO,GAAY,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAClD,uFAAuF;YACvF,2FAA2F;YAC3F,4FAA4F;YAC5F,2FAA2F;YAC3F,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;YAEtB,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,CAAC,OAAO,CAAC,CAAC;gBAEhB,OAAO;YACT,CAAC;QACH,CAAC;IACH,CAAC;IAED,kFAAkF;IAC1E,MAAM,CAAC,aAAa,CAAC,MAA0C;QACrE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACjF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,eAAe,CAAE,CAAC,KAAK,CACvE,CAAC,MAAc,EAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CACxE,CAAC;IACJ,CAAC;;AA7OH,4EA8OC"}

package/build/_modules/request-safety/_enums/request-safety-finding.type-enum.d.ts

@@ -0,0 +1,37 @@
+/**
+ * BFR-CTM-034 — the closed, content-free finding vocabulary.
+ *
+ * ⛔ These codes are the ONLY thing an inspection may say about *why* it declined. They deliberately
+ * describe the **class** of problem, never the offending value, key, path or pattern: a finding that
+ * echoes what it found turns a safety check into the very leak it was meant to prevent.
+ *
+ * The caller prefixes them with its own namespace, so two products can never confuse each other's
+ * findings while still sharing this vocabulary.
+ */
+export declare enum DyFM_RequestSafetyFinding_Type {
+    /** A key matched the caller's forbidden-key set (after normalization). */
+    forbiddenKey = "forbidden-key",
+    /** A string value matched one of the caller's sensitive-value patterns. */
+    sensitiveValue = "sensitive-value",
+    /** A string value matched one of the caller's unsupported-capability patterns. */
+    unsupportedCapability = "unsupported-capability",
+    /** A caller-planted canary was found — proof that a rejected value reached the boundary. */
+    canary = "canary",
+    /** The graph contains a cycle. */
+    cycle = "cycle",
+    /** Nesting exceeded the caller's depth budget. */
+    depthBudget = "depth-budget",
+    /** The node count exceeded the caller's budget. */
+    nodeBudget = "node-budget",
+    /** A string exceeded the caller's length budget. */
+    stringBudget = "string-budget",
+    /** A property is defined by an accessor (getter/setter) — reading it could execute caller code. */
+    accessor = "accessor",
+    /** An object's prototype is neither `Object.prototype` nor `null`. */
+    unsupportedPrototype = "unsupported-prototype",
+    /** A value is of a type the contract does not carry (function, symbol, bigint, class instance…). */
+    unsupportedValueType = "unsupported-value-type",
+    /** The policy itself is invalid — fail-closed, the input is never inspected. */
+    invalidPolicy = "invalid-policy"
+}
+//# sourceMappingURL=request-safety-finding.type-enum.d.ts.map

package/build/_modules/request-safety/_enums/request-safety-finding.type-enum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-safety-finding.type-enum.d.ts","sourceRoot":"","sources":["../../../../src/_modules/request-safety/_enums/request-safety-finding.type-enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,oBAAY,8BAA8B;IACxC,0EAA0E;IAC1E,YAAY,kBAAkB;IAC9B,2EAA2E;IAC3E,cAAc,oBAAoB;IAClC,kFAAkF;IAClF,qBAAqB,2BAA2B;IAChD,4FAA4F;IAC5F,MAAM,WAAW;IACjB,kCAAkC;IAClC,KAAK,UAAU;IACf,kDAAkD;IAClD,WAAW,iBAAiB;IAC5B,mDAAmD;IACnD,UAAU,gBAAgB;IAC1B,oDAAoD;IACpD,YAAY,kBAAkB;IAC9B,mGAAmG;IACnG,QAAQ,aAAa;IACrB,sEAAsE;IACtE,oBAAoB,0BAA0B;IAC9C,oGAAoG;IACpG,oBAAoB,2BAA2B;IAC/C,gFAAgF;IAChF,aAAa,mBAAmB;CACjC"}

package/build/_modules/request-safety/_enums/request-safety-finding.type-enum.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DyFM_RequestSafetyFinding_Type = void 0;
+/**
+ * BFR-CTM-034 — the closed, content-free finding vocabulary.
+ *
+ * ⛔ These codes are the ONLY thing an inspection may say about *why* it declined. They deliberately
+ * describe the **class** of problem, never the offending value, key, path or pattern: a finding that
+ * echoes what it found turns a safety check into the very leak it was meant to prevent.
+ *
+ * The caller prefixes them with its own namespace, so two products can never confuse each other's
+ * findings while still sharing this vocabulary.
+ */
+var DyFM_RequestSafetyFinding_Type;
+(function (DyFM_RequestSafetyFinding_Type) {
+    /** A key matched the caller's forbidden-key set (after normalization). */
+    DyFM_RequestSafetyFinding_Type["forbiddenKey"] = "forbidden-key";
+    /** A string value matched one of the caller's sensitive-value patterns. */
+    DyFM_RequestSafetyFinding_Type["sensitiveValue"] = "sensitive-value";
+    /** A string value matched one of the caller's unsupported-capability patterns. */
+    DyFM_RequestSafetyFinding_Type["unsupportedCapability"] = "unsupported-capability";
+    /** A caller-planted canary was found — proof that a rejected value reached the boundary. */
+    DyFM_RequestSafetyFinding_Type["canary"] = "canary";
+    /** The graph contains a cycle. */
+    DyFM_RequestSafetyFinding_Type["cycle"] = "cycle";
+    /** Nesting exceeded the caller's depth budget. */
+    DyFM_RequestSafetyFinding_Type["depthBudget"] = "depth-budget";
+    /** The node count exceeded the caller's budget. */
+    DyFM_RequestSafetyFinding_Type["nodeBudget"] = "node-budget";
+    /** A string exceeded the caller's length budget. */
+    DyFM_RequestSafetyFinding_Type["stringBudget"] = "string-budget";
+    /** A property is defined by an accessor (getter/setter) — reading it could execute caller code. */
+    DyFM_RequestSafetyFinding_Type["accessor"] = "accessor";
+    /** An object's prototype is neither `Object.prototype` nor `null`. */
+    DyFM_RequestSafetyFinding_Type["unsupportedPrototype"] = "unsupported-prototype";
+    /** A value is of a type the contract does not carry (function, symbol, bigint, class instance…). */
+    DyFM_RequestSafetyFinding_Type["unsupportedValueType"] = "unsupported-value-type";
+    /** The policy itself is invalid — fail-closed, the input is never inspected. */
+    DyFM_RequestSafetyFinding_Type["invalidPolicy"] = "invalid-policy";
+})(DyFM_RequestSafetyFinding_Type || (exports.DyFM_RequestSafetyFinding_Type = DyFM_RequestSafetyFinding_Type = {}));
+//# sourceMappingURL=request-safety-finding.type-enum.js.map

package/build/_modules/request-safety/_enums/request-safety-finding.type-enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-safety-finding.type-enum.js","sourceRoot":"","sources":["../../../../src/_modules/request-safety/_enums/request-safety-finding.type-enum.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;GASG;AACH,IAAY,8BAyBX;AAzBD,WAAY,8BAA8B;IACxC,0EAA0E;IAC1E,gEAA8B,CAAA;IAC9B,2EAA2E;IAC3E,oEAAkC,CAAA;IAClC,kFAAkF;IAClF,kFAAgD,CAAA;IAChD,4FAA4F;IAC5F,mDAAiB,CAAA;IACjB,kCAAkC;IAClC,iDAAe,CAAA;IACf,kDAAkD;IAClD,8DAA4B,CAAA;IAC5B,mDAAmD;IACnD,4DAA0B,CAAA;IAC1B,oDAAoD;IACpD,gEAA8B,CAAA;IAC9B,mGAAmG;IACnG,uDAAqB,CAAA;IACrB,sEAAsE;IACtE,gFAA8C,CAAA;IAC9C,oGAAoG;IACpG,iFAA+C,CAAA;IAC/C,gFAAgF;IAChF,kEAAgC,CAAA;AAClC,CAAC,EAzBW,8BAA8B,8CAA9B,8BAA8B,QAyBzC"}

package/build/_modules/request-safety/_models/request-safety.interface.d.ts

@@ -0,0 +1,67 @@
+import { DyFM_RequestSafetyFinding_Type } from '../_enums/request-safety-finding.type-enum';
+/**
+ * BFR-CTM-034 — the caller-owned inspection policy.
+ *
+ * ⚠️ **Every product rule lives here, not in the framework.** The bedrock deliberately does NOT decide
+ * that an API mention, a URL or a credential-looking string is invalid — one product forbids external
+ * network access, another is built on it. Hard-coding that judgement would make this primitive
+ * unusable for half the fleet and would silently impose one product's contract on the others.
+ *
+ * What the framework owns is the *mechanics*: normalization, cycle-safe traversal, budgets and the
+ * content-free outcome. What the caller owns is *what counts as unsafe*.
+ */
+export interface DyFM_RequestSafetyPolicy_Interface {
+    /**
+     * Stable caller namespace, prefixed onto every finding code (e.g. `ctm-r5`).
+     *
+     * Two products can then share this vocabulary without their findings becoming ambiguous in a shared
+     * log or dashboard.
+     */
+    readonly namespace: string;
+    /**
+     * Keys the caller refuses to transport. Matched against the **normalized** key, so a key hidden with
+     * zero-width joiners or full-width characters is still caught.
+     */
+    readonly forbiddenKeys?: readonly string[];
+    /** Patterns for values the caller treats as secret/PII. Matched against the normalized string. */
+    readonly sensitiveValuePatterns?: readonly RegExp[];
+    /** Patterns for capabilities the caller's product contract does not support. */
+    readonly unsupportedCapabilityPatterns?: readonly RegExp[];
+    /**
+     * Exact canary strings the caller planted upstream.
+     *
+     * ⭐ A canary hit is qualitatively different from the other findings: it proves a value the caller
+     * already rejected **reached this boundary anyway**, i.e. an earlier guard leaked.
+     */
+    readonly canaries?: readonly string[];
+    /** Maximum nesting depth. The root is depth 0. */
+    readonly maxDepth: number;
+    /** Maximum number of inspected nodes (values), including the root. */
+    readonly maxNodes: number;
+    /** Maximum length of any single string, measured AFTER normalization. */
+    readonly maxStringLength: number;
+}
+/**
+ * BFR-CTM-034 — the content-free inspection outcome.
+ *
+ * ⛔ **There is deliberately no field that could carry the offending data.** No matched text, no key,
+ * no pattern source, no object path, no payload fragment, no stack. Only: which classes of problem
+ * occurred, and how many times. A reviewer can act on this; an attacker learns nothing from it, and a
+ * log that captures it cannot become a secondary leak.
+ */
+export interface DyFM_RequestSafetyResult_Interface {
+    readonly contractVersion: 'dyfm-request-safety/1';
+    /** `false` if ANY finding occurred — the inspection is deny-only and fail-closed. */
+    readonly accepted: boolean;
+    /** Namespaced, de-duplicated finding codes, e.g. `ctm-r5:forbidden-key`. Sorted for stability. */
+    readonly findingCodes: readonly string[];
+    /** How many times each finding class occurred. Aggregate only — never per-occurrence detail. */
+    readonly findingCounts: Readonly<Record<string, number>>;
+    /** How many nodes were actually inspected (bounded by `maxNodes`). */
+    readonly inspectedNodes: number;
+}
+/** BFR-CTM-034 — an internal, per-run finding tally. Never leaves the module in this shape. */
+export interface DyFM_RequestSafetyTally_Interface {
+    readonly finding: DyFM_RequestSafetyFinding_Type;
+}
+//# sourceMappingURL=request-safety.interface.d.ts.map

package/build/_modules/request-safety/_models/request-safety.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-safety.interface.d.ts","sourceRoot":"","sources":["../../../../src/_modules/request-safety/_models/request-safety.interface.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,8BAA8B,EAAE,MAAM,4CAA4C,CAAC;AAE5F;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kCAAkC;IACjD;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,kGAAkG;IAClG,QAAQ,CAAC,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpD,gFAAgF;IAChF,QAAQ,CAAC,6BAA6B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3D;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,kDAAkD;IAClD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;CAClC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kCAAkC;IACjD,QAAQ,CAAC,eAAe,EAAE,uBAAuB,CAAC;IAClD,qFAAqF;IACrF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,kGAAkG;IAClG,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,gGAAgG;IAChG,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,sEAAsE;IACtE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,+FAA+F;AAC/F,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,OAAO,EAAE,8BAA8B,CAAC;CAClD"}

package/build/_modules/request-safety/_models/request-safety.interface.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=request-safety.interface.js.map

package/build/_modules/request-safety/_models/request-safety.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"request-safety.interface.js","sourceRoot":"","sources":["../../../../src/_modules/request-safety/_models/request-safety.interface.ts"],"names":[],"mappings":""}

package/build/_modules/request-safety/index.d.ts

@@ -0,0 +1,4 @@
+export * from './_collections/request-safety-inspector.util';
+export * from './_enums/request-safety-finding.type-enum';
+export * from './_models/request-safety.interface';
+//# sourceMappingURL=index.d.ts.map

package/build/_modules/request-safety/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/_modules/request-safety/index.ts"],"names":[],"mappings":"AAAA,cAAc,8CAA8C,CAAC;AAC7D,cAAc,2CAA2C,CAAC;AAC1D,cAAc,oCAAoC,CAAC"}

package/build/_modules/request-safety/index.js

@@ -0,0 +1,7 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const tslib_1 = require("tslib");
+tslib_1.__exportStar(require("./_collections/request-safety-inspector.util"), exports);
+tslib_1.__exportStar(require("./_enums/request-safety-finding.type-enum"), exports);
+tslib_1.__exportStar(require("./_models/request-safety.interface"), exports);
+//# sourceMappingURL=index.js.map

package/build/_modules/request-safety/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/_modules/request-safety/index.ts"],"names":[],"mappings":";;;AAAA,uFAA6D;AAC7D,oFAA0D;AAC1D,6EAAmD"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@futdevpro/fsm-dynamo",
-  "version": "1.20.23",
+  "version": "1.20.24",
   "description": "Full Stack Model Collection for Dynamic (NodeJS-Typescript) Framework called Dynamo, by Future Development Ltd.",
   "DyBu_settings": {
     "packageType": "full-stack-package",
@@ -131,6 +131,12 @@
       "types": "./build/_modules/crypto/index.d.ts",
       "typings": "./build/_modules/crypto/index.d.ts"
     },
+    "./request-safety": {
+      "default": "./build/_modules/request-safety/index.js",
+      "module": "./build/_modules/request-safety/index.js",
+      "types": "./build/_modules/request-safety/index.d.ts",
+      "typings": "./build/_modules/request-safety/index.d.ts"
+    },
     "./deployment": {
       "default": "./build/_modules/deployment/index.js",
       "module": "./build/_modules/deployment/index.js",
@@ -257,6 +263,9 @@
       "crypto": [
         "build/_modules/crypto/index.d.ts"
       ],
+      "request-safety": [
+        "build/_modules/request-safety/index.d.ts"
+      ],
       "deployment": [
         "build/_modules/deployment/index.d.ts"
       ],