Guard All

Aggregate gate that dispatches to every registered b.guard* member by KIND. Content guards (csv / html / svg / archive / json / yaml / xml / markdown / email) route by MIME type or file extension; standalone guards (filename / domain / uuid / cidr / time / mime / jwt / oauth / graphql / shell / regex / jsonpath / template / image / pdf / auth) operate on non-content axes and surface via allGuards() for the adaptive integration harness.

The framework thesis applied to content safety: every shipped guard is ON by default; operators opt OUT explicitly with an audited reason per guard. New guards added in future slices auto-register through GUARDS / STANDALONE_GUARDS and operators inherit the new coverage without re-wiring.

Registry contract — every primitive registered into guard-all MUST export NAME / MIME_TYPES / EXTENSIONS (content guards only) / PROFILES (must include strict / balanced / permissive) / COMPLIANCE_POSTURES (must include hipaa / pci-dss / gdpr / soc2) / gate(opts). A parity check at module load throws GuardAllError if any member drifts from the contract — that's the registry gate that keeps every future guard slice conformant.

Per-guard extension profiles (e.g. csv's "email-attachment") are reached via the override map; the aggregator's profile opt only takes the shared vocabulary so one string applies cleanly across every member.

b.guardAll.gate(opts) #

{
  profile:               "strict" | "balanced" | "permissive",
  compliancePosture:     "hipaa" | "pci-dss" | "gdpr" | "soc2",
  mode:                  "enforce" | "audit-only",
  exceptFor:             { [name]: { reason: string } },
  override:              { [name]: object },          // per-guard opts merged in
  audit:                 object,                      // b.audit handle
  observability:         object,                      // b.observability handle
  forensicEvidenceStore: object,
  forensicSnippetBytes:  number,
  cache:                 object,
  cacheTtlMs:            number,
  maxRuntimeMs:          number,
  beforeCheck:           function,
  afterCheck:            function,
  onIssue:               function,
  onSanitize:            function,
  onRefuse:              function,
  onAudit:               function,
}

Build a single composite gate that dispatches by Content-Type to the active member of every registered content-bytes guard. Active set is the full GUARDS list minus any names listed in exceptFor (each requires a non-empty reason string — opting a guard out is auditable). A guardAll.gate.created audit row records the active + skipped roster so a security review can reconstruct what this deploy did and didn't defend against.

var b = require("@blamejs/core");
var safety = b.guardAll.gate({
  profile: "strict",
  exceptFor: {
    html: { reason: "every HTML response is server-rendered + CSP-locked" },
  },
  override: { csv: { profile: "email-attachment" } },
});
// → contentTypeMux gate dispatching by Content-Type to each active member

b.guardAll.byExtension(opts) #

{
  profile:           "strict" | "balanced" | "permissive",
  compliancePosture: "hipaa" | "pci-dss" | "gdpr" | "soc2",
  exceptFor:         { [name]: { reason: string } },
  override:          { [name]: object },
  audit:             object,
  observability:     object,
}

Return a map of file extension (".csv", ".svg", ...) to the gate of the guard that owns it. Drops directly into b.staticServe.create ({ contentSafety }) so on-disk content is gated by extension match rather than served Content-Type. Honours the same exceptFor / override shape as gate().

var b = require("@blamejs/core");
var byExt = b.guardAll.byExtension({ profile: "strict" });
var csvGate = byExt[".csv"];
// → b.gateContract gate for guard-csv at strict profile

b.guardAll.byContentType(opts) #

{
  profile:           "strict" | "balanced" | "permissive",
  compliancePosture: "hipaa" | "pci-dss" | "gdpr" | "soc2",
  exceptFor:         { [name]: { reason: string } },
  override:          { [name]: object },
  audit:             object,
}

Return a map of canonical MIME type to the gate of the guard that owns it. Useful when the operator already has a non-mux dispatch shape (custom router / per-route content-safety) and wants the per-type gate keyed by MIME directly. gate() wraps this map in gateContract.contentTypeMux; this primitive surfaces the raw map.

var b = require("@blamejs/core");
var byMime = b.guardAll.byContentType({ profile: "balanced" });
var jsonGate = byMime["application/json"];
// → b.gateContract gate for guard-json at balanced profile

b.guardAll.list() #

Enumerate the registered content-bytes guards with their NAME, owned MIME types, owned extensions, and supported profile + posture vocabularies. Operators dump this at boot to surface "what is my deploy actually defending" in their audit attestation.

var b = require("@blamejs/core");
var rows = b.guardAll.list();
// → [{ name: "csv", mimeTypes: ["text/csv"], extensions: [".csv"],
//      profiles: ["strict","balanced","permissive","email-attachment"],
//      postures: ["hipaa","pci-dss","gdpr","soc2"] }, ...]

b.guardAll.allGuards() #

Return every guard module in the family — registered (content-bytes) AND standalone (filename / domain / uuid / cidr / time / mime / jwt / oauth / graphql / shell / regex / jsonpath / template / image / pdf / auth). Used by the adaptive integration harness to iterate the full family without hardcoding the list, so future guards added to either registry pick up automatically.

var b = require("@blamejs/core");
var all = b.guardAll.allGuards();
var names = all.map(function (g) { return g.NAME; });
// → ["csv","html","svg","archive","json","yaml","xml","markdown",
//    "email","filename","domain","uuid","cidr","time","mime","jwt",
//    "oauth","graphql","shell","regex","jsonpath","template",
//    "image","pdf","auth"]

Last updated 2026-08-08T16:39:49.652Z by seeder.