@oxy.so/core 1.0.0

package/src/utils/__tests__/validationUtils.test.ts

@@ -0,0 +1,703 @@
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import {
+  isRequiredString,
+  isRequiredNumber,
+  isRequiredBoolean,
+  isValidArray,
+  isValidObject,
+  isValidEmail,
+  isValidPassword,
+  isValidDisplayName,
+  DISPLAY_NAME_ALLOWED_SCRIPTS,
+  DISPLAY_NAME_DISALLOWED_SOURCE,
+  DISPLAY_NAME_ORPHANED_MARK_SOURCE,
+  DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE,
+  isValidUUID,
+  isValidDate,
+  isValidFileSize,
+  isValidFileType,
+  sanitizeString,
+  sanitizeHTML,
+  validateAndSanitizeUserInput
+} from '../validationUtils';
+// Imported from the generated module rather than re-exported through
+// `validationUtils`: the broad letters class is an internal operand of the
+// orphaned-mark lookbehind, and the denylist is a generation-time operand
+// already subtracted from the allowlist — neither is part of the policy's
+// public runtime surface.
+import {
+  DISPLAY_NAME_DENIED_SYMBOL_LETTERS_RANGES,
+  DISPLAY_NAME_LETTERS_RANGES,
+  DISPLAY_NAME_NAME_SEPARATORS_RANGES,
+} from '../displayNamePolicyRanges.generated';
+
+describe('Validation Utils', () => {
+  describe('isRequiredString', () => {
+    it('should return true for valid non-empty strings', () => {
+      expect(isRequiredString('hello')).toBe(true);
+      expect(isRequiredString('  hello  ')).toBe(true); // trims whitespace
+    });
+
+    it('should return false for invalid or empty strings', () => {
+      expect(isRequiredString('')).toBe(false);
+      expect(isRequiredString('   ')).toBe(false); // only whitespace
+      expect(isRequiredString(null)).toBe(false);
+      expect(isRequiredString(undefined)).toBe(false);
+      expect(isRequiredString(123)).toBe(false);
+    });
+  });
+
+  describe('isRequiredNumber', () => {
+    it('should return true for valid numbers', () => {
+      expect(isRequiredNumber(123)).toBe(true);
+      expect(isRequiredNumber(0)).toBe(true);
+      expect(isRequiredNumber(-456)).toBe(true);
+      expect(isRequiredNumber(3.14)).toBe(true);
+    });
+
+    it('should return false for invalid numbers', () => {
+      expect(isRequiredNumber(Number.NaN)).toBe(false);
+      expect(isRequiredNumber('123')).toBe(false);
+      expect(isRequiredNumber(null)).toBe(false);
+      expect(isRequiredNumber(undefined)).toBe(false);
+    });
+  });
+
+  describe('isRequiredBoolean', () => {
+    it('should return true for boolean values', () => {
+      expect(isRequiredBoolean(true)).toBe(true);
+      expect(isRequiredBoolean(false)).toBe(true);
+    });
+
+    it('should return false for non-boolean values', () => {
+      expect(isRequiredBoolean('true')).toBe(false);
+      expect(isRequiredBoolean(1)).toBe(false);
+      expect(isRequiredBoolean(0)).toBe(false);
+      expect(isRequiredBoolean(null)).toBe(false);
+      expect(isRequiredBoolean(undefined)).toBe(false);
+    });
+  });
+
+  describe('isValidArray', () => {
+    it('should return true for arrays', () => {
+      expect(isValidArray([])).toBe(true);
+      expect(isValidArray([1, 2, 3])).toBe(true);
+      expect(isValidArray(['a', 'b'])).toBe(true);
+    });
+
+    it('should return false for non-arrays', () => {
+      expect(isValidArray({})).toBe(false);
+      expect(isValidArray('[]')).toBe(false);
+      expect(isValidArray(null)).toBe(false);
+      expect(isValidArray(undefined)).toBe(false);
+    });
+  });
+
+  describe('isValidObject', () => {
+    it('should return true for plain objects', () => {
+      expect(isValidObject({})).toBe(true);
+      expect(isValidObject({ key: 'value' })).toBe(true);
+    });
+
+    it('should return false for non-objects', () => {
+      expect(isValidObject([])).toBe(false);
+      expect(isValidObject(null)).toBe(false);
+      expect(isValidObject(undefined)).toBe(false);
+      expect(isValidObject('object')).toBe(false);
+      expect(isValidObject(123)).toBe(false);
+    });
+  });
+
+  describe('isValidEmail', () => {
+    it('should return true for valid email addresses', () => {
+      expect(isValidEmail('test@example.com')).toBe(true);
+      expect(isValidEmail('user.name+tag@domain.co.uk')).toBe(true);
+      expect(isValidEmail('simple@test.io')).toBe(true);
+    });
+
+    it('should return false for invalid email addresses', () => {
+      expect(isValidEmail('invalid-email')).toBe(false);
+      expect(isValidEmail('test@')).toBe(false);
+      expect(isValidEmail('@domain.com')).toBe(false);
+      expect(isValidEmail('test.domain.com')).toBe(false);
+      expect(isValidEmail('')).toBe(false);
+    });
+  });
+
+  /**
+   * `isValidUsername` and `USERNAME_REGEX` were REMOVED from this module: they
+   * were a second username policy, looser than the one the server enforced, so
+   * the SDK could call a name valid and the API 400 it. The rule now lives once,
+   * in `@oxy.so/contracts`, and its own suite covers it. What survives here is the
+   * one thing this module still does with a username — sanitise-then-validate,
+   * asserted below to answer from that single policy.
+   */
+
+  describe('isValidPassword', () => {
+    it('should return true for valid passwords', () => {
+      expect(isValidPassword('password123')).toBe(true);
+      expect(isValidPassword('mySecurePass')).toBe(true);
+      expect(isValidPassword('12345678')).toBe(true);
+    });
+
+    it('should return false for invalid passwords', () => {
+      expect(isValidPassword('')).toBe(false);
+      expect(isValidPassword('short')).toBe(false); // too short
+      expect(isValidPassword('1234567')).toBe(false); // too short
+    });
+  });
+
+  describe('isValidDisplayName', () => {
+    it('should return true for clean names (letters, spaces, apostrophe)', () => {
+      expect(isValidDisplayName("Renée O'Brien")).toBe(true);
+      expect(isValidDisplayName('Ada Lovelace')).toBe(true);
+      expect(isValidDisplayName('山田太郎')).toBe(true);
+      expect(isValidDisplayName('')).toBe(true); // empty is valid; non-empty enforced elsewhere
+    });
+
+    it.each([
+      ['Владимир', 'Cyrillic'],
+      ['مُحَمَد', 'Arabic with harakat'],
+      ['נתן', 'Hebrew'],
+      ['नमस्ते', 'Devanagari'],
+      ['김철수', 'Hangul'],
+      ['Αριστοτέλης', 'Greek'],
+      ['Արամ', 'Armenian'],
+      ['დავით', 'Georgian'],
+      ['สมชาย', 'Thai'],
+      ['ᏔᎳ', 'Cherokee'],
+      ['ᠮᠣᠩᠭᠣᠯ', 'Mongolian'],
+    ])('should return true for allowlisted-script real name %p (%s)', (name) => {
+      expect(isValidDisplayName(name)).toBe(true);
+    });
+
+    it('should return false for emoji, symbols, digits, and punctuation', () => {
+      expect(isValidDisplayName('nixCraft \u{1f427}')).toBe(false); // penguin emoji
+      expect(isValidDisplayName('Agent007')).toBe(false);
+      expect(isValidDisplayName('Jean-Luc')).toBe(false);
+      expect(isValidDisplayName('J.R.')).toBe(false);
+    });
+
+    it.each([
+      ['ᯅ', 'Batak U+1BC5 (Limited-Use script)'],
+      ['ᚠ', 'Runic'],
+      ['Miguel de Icaza ᯅ', 'a Latin name with a trailing Batak letter'],
+    ])('should return false for non-allowlisted-script letter %p (%s)', (name) => {
+      // These characters are General_Category Lo (letters), so the old
+      // all-scripts policy accepted them; the curated script allowlist rejects
+      // decorative / limited-use scripts a real name never uses.
+      expect(isValidDisplayName(name)).toBe(false);
+    });
+
+    it('should return false for control whitespace (tab/newline/CR)', () => {
+      // Space separators only (General_Category Zs) rejects layout-breaking /
+      // multi-line spoofing whitespace that \s would have admitted.
+      expect(isValidDisplayName('Ada\tLovelace')).toBe(false);
+      expect(isValidDisplayName('Ada\nLovelace')).toBe(false);
+      expect(isValidDisplayName('Ada\rLovelace')).toBe(false);
+    });
+
+    it('should return true for Unicode space separators', () => {
+      expect(isValidDisplayName('Ada Lovelace')).toBe(true); // NBSP
+      expect(isValidDisplayName('山田　太郎')).toBe(true); // ideographic space
+    });
+  });
+
+  // Hermes (React Native) has Unicode property escapes compiled OUT: any such
+  // escape (Script_Extensions "scx=…" or General_Category classes) in a `u`-flag
+  // regex throws "Invalid RegExp: Invalid property name" at module load and
+  // crashes every Oxy RN/Expo app at boot. The display-name policy therefore
+  // ships explicit code-point RANGES instead. This block guards that invariant
+  // AND proves the range regexes behave identically.
+  describe('display-name policy is property-escape-free (Hermes safety)', () => {
+    const PROPERTY_ESCAPE = /\\[pP]\{/;
+
+    it('exposes runtime regex sources that contain NO Unicode property escape', () => {
+      expect(PROPERTY_ESCAPE.test(DISPLAY_NAME_ALLOWED_SCRIPTS)).toBe(false);
+      expect(PROPERTY_ESCAPE.test(DISPLAY_NAME_DISALLOWED_SOURCE)).toBe(false);
+      expect(PROPERTY_ESCAPE.test(DISPLAY_NAME_ORPHANED_MARK_SOURCE)).toBe(false);
+      expect(PROPERTY_ESCAPE.test(DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE)).toBe(false);
+    });
+
+    it('only uses code-point escapes (\\x / \\u) in the class bodies', () => {
+      // regexpu-core lowers the property escapes to `\x…` / `\u…` / `\u{…}`
+      // code-point escapes. Every backslash-escape in the runtime sources must
+      // be one of those forms — never a property escape.
+      const escapeLeads = new Set<string>();
+      for (const src of [
+        DISPLAY_NAME_DISALLOWED_SOURCE,
+        DISPLAY_NAME_ORPHANED_MARK_SOURCE,
+        DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE,
+      ]) {
+        for (const [, lead] of src.matchAll(/\\(.)/g)) {
+          escapeLeads.add(lead);
+        }
+      }
+      expect([...escapeLeads].sort()).toEqual(['u', 'x']);
+    });
+
+    it('the shipped (non-test) policy source files contain NO property escape', () => {
+      const utilsDir = join(__dirname, '..');
+      for (const file of [
+        'validationUtils.ts',
+        'displayNamePolicyRanges.generated.ts',
+        'textNormalization.ts',
+      ]) {
+        const contents = readFileSync(join(utilsDir, file), 'utf8');
+        expect(PROPERTY_ESCAPE.test(contents)).toBe(false);
+      }
+    });
+
+    // Build the actual regexes exactly as production does (range-only sources +
+    // `u` flag + lookbehind — the shape Hermes must accept) and assert the full
+    // policy behaves as before across scripts, marks, and rejections.
+    const disallowed = new RegExp(DISPLAY_NAME_DISALLOWED_SOURCE, 'u');
+    const orphaned = new RegExp(DISPLAY_NAME_ORPHANED_MARK_SOURCE, 'u');
+    const passesPolicy = (raw: string) =>
+      !disallowed.test(raw) && !orphaned.test(raw.normalize('NFC'));
+
+    it('constructs the `u`-flag regexes without throwing', () => {
+      expect(() => new RegExp(DISPLAY_NAME_DISALLOWED_SOURCE, 'u')).not.toThrow();
+      expect(() => new RegExp(DISPLAY_NAME_ORPHANED_MARK_SOURCE, 'u')).not.toThrow();
+      // Global variants are what @oxy.so/api compiles for the strip path.
+      expect(() => new RegExp(DISPLAY_NAME_DISALLOWED_SOURCE, 'gu')).not.toThrow();
+      expect(() => new RegExp(DISPLAY_NAME_ORPHANED_MARK_SOURCE, 'gu')).not.toThrow();
+    });
+
+    it.each([
+      ["Renée O'Brien", 'Latin with decomposed accent + apostrophe'],
+      ['Ada Lovelace', 'ASCII Latin'],
+      ['山田太郎', 'Han'],
+      ['田中\u{20000}', 'Han incl. astral CJK Extension B'],
+      ['Владимир', 'Cyrillic'],
+      ['مُحَمَد', 'Arabic with harakat (combining marks on base letters)'],
+      ['נתן', 'Hebrew'],
+      ['नमस्ते', 'Devanagari'],
+      ['김철수', 'Hangul'],
+      ['Αριστοτέλης', 'Greek'],
+      ['ᏔᎳ', 'Cherokee'],
+      ['ᠮᠣᠩᠭᠣᠯ', 'Mongolian'],
+    ])('range regexes ACCEPT allowlisted %p (%s)', (name) => {
+      expect(passesPolicy(name)).toBe(true);
+      // Parity with the public predicate.
+      expect(isValidDisplayName(name)).toBe(true);
+    });
+
+    it.each([
+      ['nixCraft \u{1f427}', 'emoji (astral)'],
+      ['Agent007', 'digit'],
+      ['Jean-Luc', 'hyphen'],
+      ['J.R.', 'dot'],
+      ['ᯅ', 'Batak (non-allowlisted script)'],
+      ['ᚠ', 'Runic (non-allowlisted script)'],
+      ['Ada\tLovelace', 'tab (control whitespace)'],
+      ['Ada\nLovelace', 'newline (control whitespace)'],
+      ['Ada\rLovelace', 'carriage return (control whitespace)'],
+    ])('range regexes REJECT %p (%s)', (name) => {
+      expect(passesPolicy(name)).toBe(false);
+      expect(isValidDisplayName(name)).toBe(false);
+    });
+
+    it('rejects an orphaned combining mark not riding a base letter', () => {
+      expect(passesPolicy('༘⋆')).toBe(false); // lone Tibetan mark + star
+      expect(orphaned.test('༘')).toBe(true); // bare mark at string start
+      // A decomposed accent recomposes under NFC and rides its base letter.
+      expect(orphaned.test('é'.normalize('NFC'))).toBe(false);
+    });
+  });
+
+  // A Unicode script is not only its letters: `scx=X` also carries script X's
+  // own digits, punctuation and symbols. The allowlist is therefore generated as
+  // `scripts ∩ General_Category L`. Before that intersection existed the class
+  // admitted 1831 non-letter code points, so the documented policy ("digits,
+  // hyphens, dots, symbols are removed") held for ASCII input only — a federated
+  // actor could keep Arabic-Indic digits, a Bengali currency sign, or the U+061C
+  // bidi control in their display name. This block is the regression guard.
+  describe('display-name allowlist admits ONLY letters', () => {
+    const allowed = new RegExp(`[${DISPLAY_NAME_ALLOWED_SCRIPTS}]`, 'u');
+    // Built from the same generated ranges the policy ships, so this assertion
+    // stays property-escape-free and cannot drift from the runtime regex.
+    const letter = new RegExp(`[${DISPLAY_NAME_LETTERS_RANGES}]`, 'u');
+
+    // Scanning the FULL code-point space, not a sample: one leaked invisible
+    // control is a spoofing vector, and a sample cannot prove its absence.
+    const leaks: number[] = [];
+    let admitted = 0;
+    for (let cp = 0; cp <= 0x10ffff; cp++) {
+      if (cp >= 0xd800 && cp <= 0xdfff) continue; // lone surrogates
+      const ch = String.fromCodePoint(cp);
+      if (!allowed.test(ch)) continue;
+      admitted++;
+      if (!letter.test(ch)) leaks.push(cp);
+    }
+
+    it('admits no non-letter code point anywhere in Unicode', () => {
+      const named = leaks
+        .slice(0, 16)
+        .map((cp) => `U+${cp.toString(16).toUpperCase().padStart(4, '0')}`);
+      expect({ count: leaks.length, sample: named }).toEqual({ count: 0, sample: [] });
+    });
+
+    // Vacuity floor: an allowlist that collapsed to (near) nothing would satisfy
+    // the assertion above while silently rejecting every real name.
+    it('still admits the expected bulk of letters', () => {
+      expect(admitted).toBeGreaterThan(100_000);
+    });
+
+    it.each([
+      ['٥', 'Arabic-Indic digit (scx=Arabic, GC=Nd)'],
+      ['०', 'Devanagari digit (scx=Devanagari, GC=Nd)'],
+      ['۞', 'Arabic ornament (scx=Arabic, GC=So)'],
+      ['৳', 'Bengali rupee sign (scx=Bengali, GC=Sc)'],
+      ['।', 'Devanagari danda (scx=Devanagari, GC=Po)'],
+      ['،', 'Arabic comma (scx=Arabic, GC=Po)'],
+      ['؜', 'ARABIC LETTER MARK - invisible bidi control (scx=Arabic, GC=Cf)'],
+      ['᠎', 'MONGOLIAN VOWEL SEPARATOR - invisible (scx=Mongolian, GC=Cf)'],
+    ])('rejects %p, a non-letter from an allowlisted script (%s)', (ch) => {
+      expect(isValidDisplayName(ch)).toBe(false);
+    });
+
+    // The intersection narrows the allowlist, so every previously-accepted real
+    // name must still pass — these are the ones whose scripts own the code
+    // points removed above.
+    it.each([
+      ['مُحَمَد', 'Arabic letters + harakat survive'],
+      ['नमस्ते', 'Devanagari'],
+      ['ᠰᠣᠩᠭᠣᠯ', 'Mongolian'],
+      ['বাংলা', 'Bengali'],
+    ])('still accepts %p (%s)', (name) => {
+      expect(isValidDisplayName(name)).toBe(true);
+    });
+  });
+
+  // A character policy classifies FORM, never MEANING. `卐` U+5350 and `卍`
+  // U+534D are CJK Unified Ideographs (GC=Lo, scx=Han) — to Unicode they are the
+  // same kind of thing as `山` in `山田太郎`, so no script- or category-level rule
+  // can reject them without also rejecting every real Chinese, Japanese and
+  // Korean name. They are therefore subtracted from the allowlist by an explicit
+  // code-point denylist at generation time. This block is the regression guard,
+  // and asserts the division of labour: the denylist covers ONLY what the
+  // intersection cannot.
+  describe('display-name denylist — letters that function as symbols', () => {
+    // The glyphs below are visually confusable with each other and with ordinary
+    // ideographs, so pin them to their code points before relying on them.
+    it('the fixtures below really are U+5350 and U+534D', () => {
+      expect('卐'.codePointAt(0)).toBe(0x5350);
+      expect('卍'.codePointAt(0)).toBe(0x534d);
+    });
+
+    it.each([
+      ['卐', 'U+5350 right-facing swastika (GC=Lo, scx=Han)'],
+      ['卍', 'U+534D left-facing swastika (GC=Lo, scx=Han)'],
+      ['卐 Glowniggers 卐', 'the production display name that motivated the denylist'],
+      ['卍 卐', 'both, alone'],
+      ['山田卍太郎', 'embedded mid-name, between real Han letters'],
+    ])('rejects %p (%s)', (name) => {
+      expect(isValidDisplayName(name)).toBe(false);
+    });
+
+    // The whole point of a per-code-point denylist instead of a script rule.
+    it.each([
+      ['山田太郎', 'Han (Japanese)'],
+      ['김철수', 'Hangul (Korean)'],
+      ['王小明', 'Han (Chinese)'],
+      ['田中\u{20000}', 'Han incl. astral CJK Extension B'],
+      // The four immediate neighbours of the denied pair: the subtraction must
+      // punch out exactly two code points, not a range around them.
+      ['卌', 'U+534C, immediately below U+534D'],
+      ['华', 'U+534E, immediately above U+534D (as in 中华)'],
+      ['协', 'U+534F, immediately below U+5350'],
+      ['卑', 'U+5351, immediately above U+5350'],
+    ])('still accepts %p (%s)', (name) => {
+      expect(isValidDisplayName(name)).toBe(true);
+    });
+
+    // Enumerate what is ACTUALLY denied from the generated class rather than
+    // trusting the literals above, so a future entry that is added to the list
+    // but not enforced by the emitted allowlist fails here.
+    const denied = new RegExp(`[${DISPLAY_NAME_DENIED_SYMBOL_LETTERS_RANGES}]`, 'u');
+    const deniedCodePoints: number[] = [];
+    for (let cp = 0; cp <= 0x10ffff; cp++) {
+      if (cp >= 0xd800 && cp <= 0xdfff) continue; // lone surrogates
+      if (denied.test(String.fromCodePoint(cp))) deniedCodePoints.push(cp);
+    }
+
+    it('denies exactly the two swastika ideographs', () => {
+      expect(deniedCodePoints).toEqual([0x534d, 0x5350]);
+    });
+
+    it('rejects every code point on the denylist', () => {
+      const accepted = deniedCodePoints.filter((cp) =>
+        isValidDisplayName(String.fromCodePoint(cp))
+      );
+      expect(
+        accepted.map((cp) => `U+${cp.toString(16).toUpperCase().padStart(4, '0')}`)
+      ).toEqual([]);
+      // Vacuity floor: an empty denylist would satisfy the assertion above while
+      // enforcing nothing.
+      expect(deniedCodePoints.length).toBeGreaterThanOrEqual(2);
+    });
+
+    // Hermes safety for the new class (see the property-escape block above).
+    it('the denylist ranges contain NO Unicode property escape', () => {
+      expect(/\\[pP]\{/.test(DISPLAY_NAME_DENIED_SYMBOL_LETTERS_RANGES)).toBe(false);
+      expect(() => new RegExp(`[${DISPLAY_NAME_DENIED_SYMBOL_LETTERS_RANGES}]`, 'u')).not.toThrow();
+    });
+
+    // Division of labour: the Tibetan svasti signs look like the entries above
+    // but are GC=So, so the `scripts ∩ General_Category L` intersection already
+    // excludes them. They are rejected — and deliberately NOT on the denylist,
+    // where they would be dead weight that reads as load-bearing. The generator
+    // fails the build if such a redundant entry is added.
+    it.each([
+      ['࿕', 'U+0FD5 RIGHT-FACING SVASTI SIGN'],
+      ['࿖', 'U+0FD6 LEFT-FACING SVASTI SIGN'],
+      ['࿗', 'U+0FD7 RIGHT-FACING SVASTI SIGN WITH DOTS'],
+      ['࿘', 'U+0FD8 LEFT-FACING SVASTI SIGN WITH DOTS'],
+    ])('rejects %p (%s) via the intersection, not the denylist', (ch) => {
+      expect(isValidDisplayName(ch)).toBe(false);
+      expect(denied.test(ch)).toBe(false);
+    });
+  });
+
+  // Four punctuation code points JOIN two letters inside one real name. All are
+  // General_Category P, so `scripts ∩ L` strips them by default and stripping
+  // SPLITS the name (`Codeur·euses` → `Codeur euses`). They are re-admitted, but
+  // ONLY between two letters — the same characters are also used as ornament
+  // (a trailing `Roberto ·`), which must keep being trimmed. The conditional is
+  // the whole rule, so it is tested from both sides.
+  describe('display-name name separators — allowed only between letters', () => {
+    // Visually confusable with each other and with ASCII punctuation.
+    it('the fixtures below really are U+00B7 U+05BE U+0F0B U+30FB', () => {
+      expect('·'.codePointAt(0)).toBe(0x00b7);
+      expect('־'.codePointAt(0)).toBe(0x05be);
+      expect('་'.codePointAt(0)).toBe(0x0f0b);
+      expect('・'.codePointAt(0)).toBe(0x30fb);
+    });
+
+    it.each([
+      ['Codeur·euses en Liberté', 'U+00B7 French inclusive writing (production value)'],
+      ['Codeur·euses', 'U+00B7 bare'],
+      ['Pouet·te', 'U+00B7 short form'],
+      ['お坐・エガード', 'U+30FB Japanese name separator (production value)'],
+      ['אייר אברמסקי־קרוננברג', 'U+05BE Hebrew maqaf compound surname (production value)'],
+      ['འོད་ཟེར', 'U+0F0B Tibetan intersyllabic tsheg (production value)'],
+    ])('accepts letter-flanked %p (%s)', (name) => {
+      expect(isValidDisplayName(name)).toBe(true);
+    });
+
+    // A base letter can carry a combining mark, and that mark sits between the
+    // letter and the separator. If the flanking test only looked for a letter,
+    // these would be misread as unflanked and the separator stripped. Both
+    // fixtures use marks that do NOT recompose under NFC, so the mark really
+    // reaches the flanking test instead of being folded into a precomposed
+    // letter — the Tibetan one is the ordinary shape of Tibetan text.
+    it.each([
+      ['ཀི་ཁ', 'Tibetan letter + vowel sign U+0F72 + tsheg + letter'],
+      ['مُ·م', 'Arabic letter + damma U+064F + middle dot + letter'],
+    ])('accepts %p where a combining mark precedes the separator (%s)', (name) => {
+      expect(isValidDisplayName(name)).toBe(true);
+    });
+
+    it.each([
+      ['Roberto ·', 'trailing ornament (production value)'],
+      ['Michał rysiek Woźniak ·', 'trailing ornament (production value)'],
+      ['·Roberto', 'leading'],
+      ['a··b', 'doubled — neither is letter-flanked on both sides'],
+      ['·', 'alone'],
+      ['お坐・', 'trailing katakana middle dot'],
+      ['・エガード', 'leading katakana middle dot'],
+      ['a ·b', 'space on the left'],
+      ['a· b', 'space on the right'],
+    ])('rejects unflanked %p (%s)', (name) => {
+      expect(isValidDisplayName(name)).toBe(false);
+    });
+
+    // Enumerate what is ACTUALLY admitted from the generated class rather than
+    // trusting the literals above, and exercise both sides of the rule for each.
+    const separator = new RegExp(`[${DISPLAY_NAME_NAME_SEPARATORS_RANGES}]`, 'u');
+    const separatorCodePoints: number[] = [];
+    for (let cp = 0; cp <= 0x10ffff; cp++) {
+      if (cp >= 0xd800 && cp <= 0xdfff) continue; // lone surrogates
+      if (separator.test(String.fromCodePoint(cp))) separatorCodePoints.push(cp);
+    }
+
+    it('admits exactly the four name separators', () => {
+      expect(separatorCodePoints).toEqual([0x00b7, 0x05be, 0x0f0b, 0x30fb]);
+    });
+
+    it('every separator is valid between letters and invalid unflanked', () => {
+      const wrongWhenFlanked: string[] = [];
+      const wrongWhenUnflanked: string[] = [];
+      for (const cp of separatorCodePoints) {
+        const ch = String.fromCodePoint(cp);
+        const label = `U+${cp.toString(16).toUpperCase().padStart(4, '0')}`;
+        if (!isValidDisplayName(`a${ch}b`)) wrongWhenFlanked.push(label);
+        if (isValidDisplayName(`a ${ch}`)) wrongWhenUnflanked.push(label);
+      }
+      expect({ wrongWhenFlanked, wrongWhenUnflanked }).toEqual({
+        wrongWhenFlanked: [],
+        wrongWhenUnflanked: [],
+      });
+      // Vacuity floor: an empty separator class would satisfy both loops above.
+      expect(separatorCodePoints.length).toBe(4);
+    });
+
+    // The ASCII hyphen decision is untouched: U+05BE is General_Category Pd like
+    // U+002D, but admitting one says nothing about the other.
+    it('does not admit the ASCII hyphen', () => {
+      expect(separator.test('-')).toBe(false);
+      expect(isValidDisplayName('Jean-Luc')).toBe(false);
+      expect(isValidDisplayName('a-b')).toBe(false);
+    });
+
+    // Hermes safety for the new pattern (see the property-escape block above).
+    it('the unflanked-separator source contains NO Unicode property escape', () => {
+      expect(/\\[pP]\{/.test(DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE)).toBe(false);
+      expect(/\\[pP]\{/.test(DISPLAY_NAME_NAME_SEPARATORS_RANGES)).toBe(false);
+      expect(() => new RegExp(DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE, 'u')).not.toThrow();
+      // Global variant is what @oxy.so/api compiles for the strip path.
+      expect(() => new RegExp(DISPLAY_NAME_UNFLANKED_SEPARATOR_SOURCE, 'gu')).not.toThrow();
+    });
+
+    // Nothing the policy already rejected may become valid.
+    it.each([
+      ['卐', 'denied symbol letter'],
+      ['卍', 'denied symbol letter'],
+      ['Agent007', 'digit'],
+      ['J.R.', 'dot'],
+      ['ᯅ', 'non-allowlisted script'],
+      ['nixCraft \u{1f427}', 'emoji'],
+    ])('still rejects %p (%s)', (name) => {
+      expect(isValidDisplayName(name)).toBe(false);
+    });
+
+    it.each([
+      ['山田太郎', 'Han'],
+      ['김철수', 'Hangul'],
+      ["Renée O'Brien", 'Latin with accent + apostrophe'],
+    ])('still accepts %p (%s)', (name) => {
+      expect(isValidDisplayName(name)).toBe(true);
+    });
+  });
+
+  describe('isValidUUID', () => {
+    it('should return true for valid UUIDs', () => {
+      expect(isValidUUID('123e4567-e89b-12d3-a456-426614174000')).toBe(true);
+      expect(isValidUUID('550e8400-e29b-41d4-a716-446655440000')).toBe(true);
+    });
+
+    /**
+     * The version this ecosystem MINTS. `@oxy.so/db`'s `generatedId()` produces a
+     * uuid v7, so every Postgres primary key since the 2026-07-31 cutover is
+     * one — and the old `[1-5]` version class answered `false` for all of them.
+     * The suite could not see it: both samples above are v1 and v4.
+     */
+    it('accepts a uuid v7 — the version generatedId() produces', () => {
+      expect(isValidUUID('01a0821e-d61a-7a78-b5d1-afb1850bd5a4')).toBe(true);
+      expect(isValidUUID('0197c8f2-1e40-7c9e-8b3a-2f5d6c1a9e04')).toBe(true);
+    });
+
+    it('should return false for invalid UUIDs', () => {
+      expect(isValidUUID('invalid-uuid')).toBe(false);
+      expect(isValidUUID('123-456-789')).toBe(false);
+      expect(isValidUUID('')).toBe(false);
+    });
+
+    // A format check, not an identifier check: version 0 and the wrong variant
+    // are still malformed, and widening the version class must not blur that.
+    it('still rejects a zero version nibble and a bad variant', () => {
+      expect(isValidUUID('01a0821e-d61a-0a78-b5d1-afb1850bd5a4')).toBe(false);
+      expect(isValidUUID('01a0821e-d61a-7a78-c5d1-afb1850bd5a4')).toBe(false);
+    });
+  });
+
+  describe('isValidDate', () => {
+    it('should return true for valid date strings', () => {
+      expect(isValidDate('2024-01-01')).toBe(true);
+      expect(isValidDate('2024-12-31T23:59:59.999Z')).toBe(true);
+      expect(isValidDate('January 1, 2024')).toBe(true);
+    });
+
+    it('should return false for invalid date strings', () => {
+      expect(isValidDate('invalid-date')).toBe(false);
+      expect(isValidDate('2024-13-01')).toBe(false); // invalid month
+      expect(isValidDate('')).toBe(false);
+    });
+  });
+
+  describe('isValidFileSize', () => {
+    const maxSize = 1024 * 1024; // 1MB
+
+    it('should return true for valid file sizes', () => {
+      expect(isValidFileSize(1024, maxSize)).toBe(true);
+      expect(isValidFileSize(maxSize, maxSize)).toBe(true);
+      expect(isValidFileSize(1, maxSize)).toBe(true);
+    });
+
+    it('should return false for invalid file sizes', () => {
+      expect(isValidFileSize(0, maxSize)).toBe(false);
+      expect(isValidFileSize(-1, maxSize)).toBe(false);
+      expect(isValidFileSize(maxSize + 1, maxSize)).toBe(false);
+    });
+  });
+
+  describe('isValidFileType', () => {
+    const allowedTypes = ['jpg', 'png', 'gif', 'pdf'];
+
+    it('should return true for allowed file types', () => {
+      expect(isValidFileType('image.jpg', allowedTypes)).toBe(true);
+      expect(isValidFileType('document.PDF', allowedTypes)).toBe(true); // case insensitive
+      expect(isValidFileType('photo.png', allowedTypes)).toBe(true);
+    });
+
+    it('should return false for disallowed file types', () => {
+      expect(isValidFileType('script.js', allowedTypes)).toBe(false);
+      expect(isValidFileType('data.txt', allowedTypes)).toBe(false);
+      expect(isValidFileType('noextension', allowedTypes)).toBe(false);
+    });
+  });
+
+  describe('sanitizeString', () => {
+    it('should trim whitespace and remove dangerous characters', () => {
+      expect(sanitizeString('  hello  ')).toBe('hello');
+      expect(sanitizeString('hello<script>alert("xss")</script>world')).toBe('helloalert("xss")world');
+      expect(sanitizeString('normal text')).toBe('normal text');
+    });
+  });
+
+  describe('sanitizeHTML', () => {
+    it('should escape HTML characters', () => {
+      expect(sanitizeHTML('<script>alert("xss")</script>')).toBe('&lt;script&gt;alert(&quot;xss&quot;)&lt;/script&gt;');
+      expect(sanitizeHTML('Hello & Goodbye')).toBe('Hello &amp; Goodbye');
+      expect(sanitizeHTML("It's a test")).toBe('It&#x27;s a test');
+    });
+  });
+
+  describe('validateAndSanitizeUserInput', () => {
+    it('should validate and sanitize email input', () => {
+      expect(validateAndSanitizeUserInput('  test@example.com  ', 'email')).toBe('test@example.com');
+      expect(validateAndSanitizeUserInput('invalid-email', 'email')).toBeNull();
+      expect(validateAndSanitizeUserInput(123, 'email')).toBeNull();
+    });
+
+    it('should validate and sanitize username input', () => {
+      expect(validateAndSanitizeUserInput('  testuser  ', 'username')).toBe('testuser');
+      expect(validateAndSanitizeUserInput('ab', 'username')).toBeNull(); // too short
+      expect(validateAndSanitizeUserInput(123, 'username')).toBeNull();
+      // Answers from the one policy in `@oxy.so/contracts`, not from a rule of its
+      // own: a dot and an edge separator are rejected here because they are
+      // rejected there.
+      expect(validateAndSanitizeUserInput('my-bot', 'username')).toBe('my-bot');
+      expect(validateAndSanitizeUserInput('my.bot', 'username')).toBeNull();
+      expect(validateAndSanitizeUserInput('-mybot', 'username')).toBeNull();
+    });
+
+    it('should validate and sanitize string input', () => {
+      expect(validateAndSanitizeUserInput('  hello world  ', 'string')).toBe('hello world');
+      expect(validateAndSanitizeUserInput('', 'string')).toBeNull();
+      expect(validateAndSanitizeUserInput(123, 'string')).toBeNull();
+    });
+  });
+});