examples/protect: demo the static-rule delivery + remote-promotion chain via Pulse

[patchstackdave]

What

demo.mjs proves Verified Vulnerability Shielding but wires the rule from a local file. This adds demo-pulse-chain.mjs, which proves the real delivery path the pilot ships on: the rule is served by Pulse over HTTP, fetched by the guard's own Pulse client by site UUID, enforced through the .fetch() HTTP guard, then promoted dry-run → block remotely (Pulse flips the bundle's enforcement; the guard hot-swaps on refresh — no redeploy), and re-verified against the same exploit.

Run it:

cd examples/protect && npm install && npm run demo:pulse

Chain (all against a real, unmodified vulnerable lodash@4.17.11, CVE-2019-10744):

1. Rule fetched from Pulse over HTTP by site UUID (not a local file).
2. Guard adopts Pulse's enforcement: dry-run — exploit detected + logged but served.
3. Pulse flips to enforcement: block (new ETag); a refresh hot-swaps the guard.
4. The same exploit is now blocked (403); the sink never runs; a benign request still returns 200.
5. A no-change refresh revalidates as 304 Not Modified (conditional fetch).

Tests

Adds tests/protect/pulse-chain.test.ts — guards the same chain in CI without a socket (stubbed fetch honoring If-None-Match → 304): siteUuid fetch, dry-run pass-through with onDetect, manual refresh() promotion to block (403), benign 200, and 304 revalidation. Complements runtime-pulse.test.ts (server-fn guard + timer-driven hot-swap). Full suite green (635 passing).

Notes

Public CVE + a mock Pulse endpoint only — no rule corpus, no tokens/secrets. The remote-promotion seam demonstrated here is what the observed→enforced auto-promote flow will build on.

[coderbuds]

Comprehensive Pulse delivery and remote-promotion demo with robust testing

🎯 Quality: 100% Elite · 📦 Size: Medium

📈 This month: Your 48th PR — above team average · Averaging Excellent

_{See how your team is trending →}

[patchstackdave]

/review