is-unsafe 2.0.2: HTML, SQL, allUnsafe

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:npm/is-unsafe@2.0.2
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:npm/is-unsafe@2.0.2
Demonstrate these symbols/APIs:
  - HTML
  - SQL
  - allUnsafe
  - isUnsafe
  - whyUnsafe

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

{"case":{"caseId":"case:sha256:40a91c3228122cc967a01dc3f60f39cf6a1d207473d232102d68614eb6abce4c","contract":["isUnsafe detects unsafe input in HTML and SQL contexts and returns boolean","whyUnsafe returns match result object for unsafe input and null for safe input","allUnsafe returns all matching rules as an array or empty array when safe","HTML and SQL context pattern lists contain rule objects with label identifiers","isUnsafe throws TypeError when input value is not a string or context is invalid"],"goal":"verify pkg:npm/is-unsafe@2.0.2","kind":"HOW","packages":["pkg:npm/is-unsafe@2.0.2"],"schemaVersion":1,"symbols":["HTML","SQL","allUnsafe","isUnsafe","whyUnsafe"]},"contractCommand":["node","test/contract.mjs"],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"npm","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"npm","schemaVersion":1},"license":"MIT-0","packages":["pkg:npm/is-unsafe@2.0.2"],"schemaVersion":1,"subject":"pkg:npm/is-unsafe@2.0.2","symbols":["HTML","SQL","allUnsafe","isUnsafe","whyUnsafe"],"verifierAdapter":"node-typescript@1"}

import { isUnsafe, whyUnsafe, allUnsafe, HTML, SQL } from 'is-unsafe';

export {
  isUnsafe,
  whyUnsafe,
  allUnsafe,
  HTML,
  SQL,
};

{
  "name": "sample-is-unsafe",
  "version": "1.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "sample-is-unsafe",
      "version": "1.0.0",
      "license": "MIT-0",
      "dependencies": {
        "is-unsafe": "2.0.2"
      }
    },
    "node_modules/is-unsafe": {
      "version": "2.0.2",
      "resolved": "https://registry.npmjs.org/is-unsafe/-/is-unsafe-2.0.2.tgz",
      "integrity": "sha512-HgbIHPBH0KHHCcjLfGsCvhtPTVxjaAZlXjwdz7/GQC40SjSe4sfQsar8J5VFo8JOSbarkpV0OLG95bbaNd9aAQ==",
      "license": "MIT"
    }
  }
}

{
  "name": "sample-is-unsafe",
  "version": "1.0.0",
  "type": "module",
  "private": true,
  "license": "MIT-0",
  "dependencies": {
    "is-unsafe": "2.0.2"
  }
}

{
  "schemaVersion": 1,
  "goal": "verify pkg:npm/is-unsafe@2.0.2",
  "kind": "HOW",
  "packages": [
    "pkg:npm/is-unsafe@2.0.2"
  ],
  "symbols": [
    "HTML",
    "SQL",
    "allUnsafe",
    "isUnsafe",
    "whyUnsafe"
  ]
}

import assert from 'node:assert/strict';
import {
  isUnsafe,
  whyUnsafe,
  allUnsafe,
  HTML,
  SQL,
} from 'is-unsafe';

// Context pattern lists
assert.strictEqual(HTML.label, 'HTML', 'HTML context has label HTML');
assert.strictEqual(SQL.label, 'SQL', 'SQL context has label SQL');
assert.ok(Array.isArray(HTML) && HTML.length > 0, 'HTML is non-empty array of rules');
assert.ok(Array.isArray(SQL) && SQL.length > 0, 'SQL is non-empty array of rules');

// isUnsafe boolean predicate
assert.strictEqual(isUnsafe('<script>alert(1)</script>', HTML), true, 'HTML script tag is unsafe');
assert.strictEqual(isUnsafe('hello world', HTML), false, 'plain text is safe in HTML');
assert.strictEqual(isUnsafe("SELECT * FROM users WHERE id = '1' OR '1'='1'", SQL), true, 'SQL injection is unsafe');
assert.strictEqual(isUnsafe('SELECT id FROM users WHERE id = 1', SQL), false, 'plain SQL query is safe');
assert.strictEqual(isUnsafe('hello', [HTML, SQL]), false, 'plain text is safe across multiple contexts');
assert.strictEqual(isUnsafe('<script>', [HTML, SQL]), true, 'script tag is unsafe across multiple contexts');

// whyUnsafe diagnosis
const whyHtml = whyUnsafe('<script>alert(1)</script>', HTML);
assert.ok(whyHtml, 'whyUnsafe returns MatchResult for unsafe HTML');
assert.strictEqual(whyHtml.context, 'HTML');
assert.strictEqual(typeof whyHtml.id, 'string');
assert.strictEqual(typeof whyHtml.description, 'string');
assert.ok(whyHtml.pattern instanceof RegExp);

const whySafe = whyUnsafe('hello world', HTML);
assert.strictEqual(whySafe, null, 'whyUnsafe returns null for safe input');

// allUnsafe collection
const allMatches = allUnsafe('<script src="test.js"></script><img src=x onerror=alert(1)>', HTML);
assert.ok(Array.isArray(allMatches), 'allUnsafe returns an array');
assert.ok(allMatches.length >= 1, 'allUnsafe finds matches for multi-vector input');

const allSafe = allUnsafe('hello world', HTML);
assert.deepStrictEqual(allSafe, [], 'allUnsafe returns empty array for safe input');

// Input validation / error handling
assert.throws(
  () => isUnsafe(123, HTML),
  { name: 'TypeError' },
  'isUnsafe throws TypeError on non-string input'
);
assert.throws(
  () => isUnsafe('test', 'not-a-context'),
  { name: 'TypeError' },
  'isUnsafe throws TypeError on invalid context'
);