Add policy-bound credential submission and native DLP audit proofs

tests/credential-policy.test.mjs

@@ -0,0 +1,5 @@
+import test from 'node:test';import assert from 'node:assert/strict';import {ControlledSubmissionSchema,credentialActionUrlAllowed} from '../packages/core/credential-policy.mjs';
+const rule=()=>({id:'company-login',actionUrl:'https://login.example/signin',usernameField:'username',passwordField:'password'});
+test('controlled submission defaults off and enabled configuration needs explicit forms',()=>{assert.deepEqual(ControlledSubmissionSchema.parse({}),{enabled:false,forms:[]});assert.throws(()=>ControlledSubmissionSchema.parse({enabled:true}));assert.equal(ControlledSubmissionSchema.parse({enabled:true,forms:[rule()]}).forms.length,1);});
+test('credential rules require exact HTTPS target and bounded metadata only',()=>{for(const url of ['http://login.example/signin','https://u:[email protected]/signin','https://login.example/signin?x=y','https://login.example/signin#fragment','https://login.example/signin?','https://login.example/signin#','https://LOGIN.example/signin','https://login.example','https://login.example/sign in'])assert.equal(credentialActionUrlAllowed(url),false,url);for(const extra of ['password','username','token','formValues'])assert.throws(()=>ControlledSubmissionSchema.parse({forms:[{...rule(),[extra]:'private'}]}));for(const value of ['','a'.repeat(129),'user name','üser','x\ny'])assert.throws(()=>ControlledSubmissionSchema.parse({forms:[{...rule(),usernameField:value}]}));});
+test('duplicate rule identities or target signatures and overlapping fields are rejected',()=>{for(const forms of [[rule(),{...rule(),actionUrl:'https://other.example/'}],[rule(),{...rule(),id:'other'}],[{...rule(),passwordField:'username'}],Array.from({length:33},(_,n)=>({...rule(),id:'rule'+n,actionUrl:'https://login.example/'+n}))])assert.throws(()=>ControlledSubmissionSchema.parse({forms}));assert.equal(ControlledSubmissionSchema.parse({forms:[rule(),{...rule(),id:'other',actionUrl:'https://other.example/'}]}).forms.length,2);});