feat(protect): comprehensive demo/test rule gallery + pack-safety guard

[patchstackdave]

Stacked on #64.

Two things: a loadable demo rule set that showcases many vulnerability classes at once (for demo environments), and a hard guarantee that the demo's real vulnerable dependency never ships to consumers.

Demo gallery

• examples/protect/demo-rules.json — one bundle spanning all three phases, each rule carrying an _demo { exploit, benign } vector. Generic public signatures, clearly labeled NOT the production corpus.
  • request (WAF): prototype pollution · path traversal · SQLi · XSS · command injection · NoSQL injection · XXE · request-side SSRF
  • response (leak): PII redaction (email, credit-card) on top of the built-in secret rules
  • egress (SSRF): outbound call to a blocklisted exfiltration host
• gallery.mjs + demo-runner.mjs — run it live (npm run gallery), one row per rule (exploit blocked/redacted, benign allowed), grouped by phase. No vulnerable dependency needed — runs anywhere, zero install.

── request  (WAF) ──
✓ prototype-pollution  exploit blocked · benign allowed
✓ sqli                 exploit blocked · benign allowed
...
── response (leak) ──
✓ pii-exposure         exploit redacted · benign allowed
── egress   (SSRF) ──
✓ exfiltration         exploit blocked · benign allowed
11/11 demonstrations passed across 3 phases.

Never ships the vulnerable dep

The deep demo (demo.mjs, #61) installs a real lodash@4.17.11 (CVE-2019-10744). This PR makes sure that never reaches consumers:

• tests/pack-safety.test.ts asserts what npm pack would actually publish — fails CI if examples/ (or any lodash artifact) ever enters the tarball.
• .npmignore excludes examples/ as a backstop beneath the existing files allowlist.

Confirmed today: the tarball is dist/ + 3 docs + package.json — 0 examples/lodash files. No workspaces, and node_modules is gitignored, so a clone/install never pulls the vulnerable code either.

Tests

Full suite 370 pass (+4: demo-rules ×2, pack-safety ×2), typecheck + build clean. The gallery and the test share one runner, so they can't drift.

🤖 Generated with Claude Code

[coderbuds]

Comprehensive demo and safety tests integrated with clear structure and comments.

🎯 Quality: 100% Elite · 📦 Size: Large — consider splitting if possible

📈 This month: Your 26th PR — above team average · Averaging Excellent

_{See how your team is trending →}

[patchstackdave]

/review