@blamejs/blamejs-shop 0.0.44

package/lib/vendor/blamejs/lib/uuid.js

@@ -0,0 +1,207 @@
+"use strict";
+/**
+ * @module b.uuid
+ * @featured true
+ * @nav    Tools
+ * @title  UUID
+ *
+ * @intro
+ *   RFC 4122 v4 (random) + RFC 9562 v7 (time-ordered).
+ *
+ *   v4 is fully random — the standard portable choice when ordering
+ *   doesn't matter. v7 prefixes a 48-bit Unix-millisecond timestamp,
+ *   then 74 random bits — IDs sort by creation time even
+ *   lexicographically, ideal as a database PK because B-tree inserts
+ *   stay near the right edge.
+ *
+ *   All entropy comes from `b.crypto.generateBytes`, which routes
+ *   through Node's `crypto.randomBytes` — same source as
+ *   `crypto.randomUUID()`.
+ *
+ *   Why ship v7 ourselves? Native `crypto.randomUUID()` only emits
+ *   v4. v7 is the modern recommendation for any UUID landing in a
+ *   sortable column (job queues, audit chain extensions, anything
+ *   where insertion order matters for index locality).
+ *
+ * @card
+ *   RFC 4122 v4 (random) + RFC 9562 v7 (time-ordered).
+ */
+var C = require("./constants");
+var { generateBytes } = require("./crypto");
+
+// Canonical UUID layout: 8-4-4-4-12 hex digits, version nibble at byte
+// 6 high-nibble, variant bits at byte 8 high two bits (must be 10).
+var UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-7][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+// Loose form for `isValid` shape-only check — accepts any version 1-8 and
+// any variant top-2-bit value. Operators wanting strict version+variant
+// gating use `parse()`.
+var UUID_LOOSE_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+// RFC 4122 §4.1 byte counts and field positions. UUID is 16 bytes; the
+// canonical hex form is 32 chars with dashes between the time-low (4 B),
+// time-mid (2 B), time-hi+version (2 B), clock-seq+variant (2 B) and
+// node (6 B) fields. Maximum length of the canonical form is 36 chars.
+var UUID_BYTE_LEN          = C.BYTES.bytes(16);
+var UUID_STR_MAX_LEN       = 36;
+// Hex-string slice offsets (each pair = 1 byte); routed through C.BYTES
+// so the framework's byte math stays in one place.
+var HEX_TIME_LOW_END       = C.BYTES.bytes(8);   // chars 0..8   (bytes 0-3)
+var HEX_TIME_MID_END       = C.BYTES.bytes(12);  // chars 8..12  (bytes 4-5)
+var HEX_TIME_HI_VER_END    = C.BYTES.bytes(16);  // chars 12..16 (bytes 6-7)
+var HEX_CLOCK_SEQ_END      = C.BYTES.bytes(20);  // chars 16..20 (bytes 8-9)
+var HEX_NODE_END           = C.BYTES.bytes(32);  // chars 20..32 (bytes 10-15)
+// Byte-index positions for version + variant manipulation. Variant
+// index value (8) is routed through C.BYTES so every byte literal in
+// the file routes through one helper.
+var BYTE_VERSION_IDX       = 6;
+var BYTE_VARIANT_IDX       = C.BYTES.bytes(8);
+
+function _bytesToString(bytes) {
+  var hex = bytes.toString("hex");
+  return hex.slice(0, HEX_TIME_LOW_END) + "-" +
+         hex.slice(HEX_TIME_LOW_END, HEX_TIME_MID_END) + "-" +
+         hex.slice(HEX_TIME_MID_END, HEX_TIME_HI_VER_END) + "-" +
+         hex.slice(HEX_TIME_HI_VER_END, HEX_CLOCK_SEQ_END) + "-" +
+         hex.slice(HEX_CLOCK_SEQ_END, HEX_NODE_END);
+}
+
+/**
+ * @primitive b.uuid.v4
+ * @signature b.uuid.v4()
+ * @since     0.1.0
+ * @related   b.uuid.v7, b.uuid.parse
+ *
+ * Fully random 128-bit UUID. Standard, portable; the default choice
+ * when ordering doesn't matter. Returns the canonical 8-4-4-4-12
+ * hex form.
+ *
+ * @example
+ *   var id = b.uuid.v4();
+ *   // → "f47ac10b-58cc-4372-a567-0e02b2c3d479"
+ */
+function v4() {
+  var b = generateBytes(UUID_BYTE_LEN);
+  // version = 4 (0100): high nibble of byte 6
+  b[BYTE_VERSION_IDX] = (b[BYTE_VERSION_IDX] & 0x0f) | 0x40;
+  // variant = RFC 4122 (10xx): top two bits of byte 8
+  b[BYTE_VARIANT_IDX] = (b[BYTE_VARIANT_IDX] & 0x3f) | 0x80;
+  return _bytesToString(b);
+}
+
+/**
+ * @primitive b.uuid.v7
+ * @signature b.uuid.v7(opts?)
+ * @since     0.4.0
+ * @related   b.uuid.v4, b.uuid.parse
+ *
+ * RFC 9562 §5.7 time-ordered UUID. The first 48 bits encode a Unix
+ * millisecond timestamp (big-endian); the next 4 bits are version (7);
+ * the remaining 74 bits are random. IDs generated within the same
+ * millisecond sort by their random suffix; across milliseconds they
+ * sort by time. B-tree index locality is dramatically better than v4
+ * for INSERT-heavy tables.
+ *
+ * @opts
+ *   now: number,   // override the timestamp (testing / fixtures)
+ *
+ * @example
+ *   var id = b.uuid.v7();
+ *   // → "01941bf3-9c4a-7d8e-9c11-3a4b5c6d7e8f"
+ *
+ *   // Deterministic fixture: same ms produces the same time prefix.
+ *   var fixed = b.uuid.v7({ now: Date.UTC(2026, 0, 1) });
+ *
+ *   // v7 sorts by time even as plain strings:
+ *   var earlier = b.uuid.v7({ now: 1700000000000 });
+ *   var later   = b.uuid.v7({ now: 1700000001000 });
+ *   earlier < later;   // → true
+ */
+function v7(opts) {
+  // RFC 9562 §5.7 layout:
+  //   bytes 0-5  : 48-bit big-endian Unix timestamp in milliseconds
+  //   bytes 6-7  : version nibble (7) + 12 bits random_a
+  //   bytes 8-15 : variant bits + 62 bits random_b
+  var ms = (opts && typeof opts.now === "number") ? opts.now : Date.now();
+  var b = generateBytes(UUID_BYTE_LEN);
+  // 48-bit ms timestamp (big-endian) into bytes 0-5.
+  // ms can exceed 2^32 (we're in 2026, ms is ~1.78e12), so split via
+  // Math.floor + unsigned shift instead of relying on 32-bit bit-ops.
+  var msHi = Math.floor(ms / 0x100000000);
+  var msLo = ms >>> 0;
+  b[0] = (msHi >> 8) & 0xff;
+  b[1] = msHi & 0xff;
+  b[2] = (msLo >>> 24) & 0xff;
+  b[3] = (msLo >>> 16) & 0xff;
+  b[4] = (msLo >>>  8) & 0xff;
+  b[5] = msLo & 0xff;
+  // version = 7 (0111) in high nibble of byte 6, random_a in low nibble + byte 7
+  b[BYTE_VERSION_IDX] = (b[BYTE_VERSION_IDX] & 0x0f) | 0x70;
+  // variant = RFC 4122 (10xx) in top two bits of byte 8
+  b[BYTE_VARIANT_IDX] = (b[BYTE_VARIANT_IDX] & 0x3f) | 0x80;
+  return _bytesToString(b);
+}
+
+/**
+ * @primitive b.uuid.parse
+ * @signature b.uuid.parse(str)
+ * @since     0.1.0
+ * @related   b.uuid.isValid
+ *
+ * Strict parse: validates canonical form AND version (1-7) AND
+ * RFC 4122 variant. Returns `{ ok: true, version, bytes }` on success;
+ * `{ ok: false, reason }` on failure. Never throws — operators who
+ * want a thrown error layer one on top.
+ *
+ * @example
+ *   var parsed = b.uuid.parse("f47ac10b-58cc-4372-a567-0e02b2c3d479");
+ *   if (parsed.ok) {
+ *     console.log(parsed.version);   // → 4
+ *     console.log(parsed.bytes);     // → <Buffer f4 7a c1 0b ...>
+ *   }
+ *
+ *   b.uuid.parse("not-a-uuid").ok;       // → false
+ *   b.uuid.parse("not-a-uuid").reason;   // → "malformed"
+ */
+function parse(str) {
+  if (typeof str !== "string") return { ok: false, reason: "not-a-string" };
+  // Length cap before regex — RFC 4122 canonical form is exactly 36
+  // chars; capping defends the regex engine against pathological-length
+  // inputs even though UUID_RE is anchored.
+  if (str.length > UUID_STR_MAX_LEN) return { ok: false, reason: "malformed" };
+  if (!UUID_RE.test(str))            return { ok: false, reason: "malformed" };
+  var hex = str.replace(/-/g, "");
+  var bytes = Buffer.from(hex, "hex");
+  // Version is the high nibble of byte 6.
+  var version = (bytes[BYTE_VERSION_IDX] >> 4) & 0x0f;
+  // Variant: top two bits of byte 8 must be 10 for RFC 4122 / 9562.
+  var variant = (bytes[BYTE_VARIANT_IDX] >> 6) & 0x03;
+  if (variant !== 0b10) return { ok: false, reason: "bad-variant" };
+  return { ok: true, version: version, bytes: bytes };
+}
+
+/**
+ * @primitive b.uuid.isValid
+ * @signature b.uuid.isValid(str)
+ * @since     0.1.0
+ * @related   b.uuid.parse
+ *
+ * Loose shape-only check — returns `true` for any 8-4-4-4-12 hex
+ * string regardless of version or variant bits. Cheap. Use `parse()`
+ * when version/variant matter (most operator code does).
+ *
+ * @example
+ *   b.uuid.isValid("f47ac10b-58cc-4372-a567-0e02b2c3d479");   // → true
+ *   b.uuid.isValid("not-a-uuid");                             // → false
+ */
+function isValid(str) {
+  if (typeof str !== "string") return false;
+  if (str.length > UUID_STR_MAX_LEN) return false;
+  return UUID_LOOSE_RE.test(str);
+}
+
+module.exports = {
+  v4:      v4,
+  v7:      v7,
+  parse:   parse,
+  isValid: isValid,
+};

package/lib/vendor/blamejs/lib/validate-opts.js

@@ -0,0 +1,381 @@
+"use strict";
+/**
+ * validate-opts — shared call-site helper for primitive create() functions
+ * that throws on unknown / bad-shape opts at config time.
+ *
+ * Catches silent operator typos: `cors({ allowedOrigins: [] })` (wrong
+ * key name) currently looks like config but does nothing — the primitive
+ * sees opts.origins as undefined and falls back to defaults. With this
+ * helper the create() throws at boot with a clear message instead of
+ * the typo silently weakening the operator's setup.
+ *
+ *   var validateOpts = require("./validate-opts");
+ *
+ *   function create(opts) {
+ *     opts = opts || {};
+ *     validateOpts(opts, [
+ *       "origins", "siteOrigin", "methods", "headers",
+ *       "exposeHeaders", "credentials", "maxAgeSeconds", "refuseUnknown",
+ *     ], "middleware.cors");
+ *     ...
+ *   }
+ *
+ * The exported `optional(...)` form lets a primitive accept a
+ * sparsely-populated opts object and only validate keys that ARE present.
+ *
+ * Throws a plain Error with a code-shaped message — primitives that want
+ * a typed error wrap the call.
+ */
+
+function _format(primitive, unknownKey, allowedKeys) {
+  return primitive + ": unknown option '" + unknownKey + "'. " +
+    "Allowed keys: " + allowedKeys.slice().sort().join(", ") + ".";
+}
+
+function check(opts, allowedKeys, primitive) {
+  if (opts == null) return;
+  if (typeof opts !== "object") {
+    throw new Error(primitive + ": opts must be an object (got " + typeof opts + ")");
+  }
+  if (!Array.isArray(allowedKeys) || allowedKeys.length === 0) {
+    throw new Error("validate-opts: allowedKeys must be a non-empty array");
+  }
+  if (typeof primitive !== "string" || primitive.length === 0) {
+    throw new Error("validate-opts: primitive name must be a non-empty string");
+  }
+  var allowSet = Object.create(null);
+  for (var i = 0; i < allowedKeys.length; i++) allowSet[allowedKeys[i]] = true;
+  var keys = Object.keys(opts);
+  for (var j = 0; j < keys.length; j++) {
+    if (!allowSet[keys[j]]) {
+      throw new Error(_format(primitive, keys[j], allowedKeys));
+    }
+  }
+}
+
+// auditShape — operator-supplied `opts.audit` must expose a
+// `safeEmit` function. 10+ primitive create() functions previously
+// inlined the same shape check + throw. Centralized here so every
+// consumer has one validation contract.
+function auditShape(audit, callerLabel, errorClass, code) {
+  if (audit === undefined || audit === null) return audit;
+  if (typeof audit !== "object" || typeof audit.safeEmit !== "function") {
+    var msg = (callerLabel || "audit") +
+      ": audit must be a b.audit-shaped object (safeEmit fn)";
+    if (errorClass && errorClass.factory) {
+      throw errorClass.factory(code || "BAD_OPT", msg);
+    }
+    if (typeof errorClass === "function") {
+      throw new errorClass(code || "audit/bad-shape", msg);
+    }
+    throw new Error(msg);
+  }
+  return audit;
+}
+
+// _throw — shared error-emission for the optional* validators. Routes
+// through the caller's framework-error class when supplied, falls back
+// to plain Error so this helper itself stays decoupled from any one
+// error hierarchy.
+function _throw(errorClass, code, msg, defaultCode) {
+  if (errorClass && errorClass.factory) {
+    throw errorClass.factory(code || "BAD_OPT", msg);
+  }
+  if (typeof errorClass === "function") {
+    throw new errorClass(code || defaultCode, msg);
+  }
+  throw new Error(msg);
+}
+
+// optionalBoolean / optionalPositiveInt / optionalFiniteNonNegative /
+// optionalPositiveFinite / optionalFunction — opt-time type assertions
+// for fields that may be omitted. Each returns the value unchanged when
+// undefined or null (preserving the caller's "absent → use default"
+// semantics) and throws on any other shape.
+//
+// 10+ primitive create() functions previously rolled identical
+// `if (opts.X !== undefined && typeof opts.X !== "Y") throw`
+// sequences. Centralizing the throw here keeps the operator-facing
+// message format consistent and gives the codebase-pattern catalog one
+// place to point new authors at.
+
+function optionalBoolean(value, label, errorClass, code) {
+  if (value === undefined || value === null) return value;
+  if (typeof value !== "boolean") {
+    _throw(errorClass, code, (label || "opt") + " must be a boolean, got " + typeof value,
+           "validate-opts/bad-boolean");
+  }
+  return value;
+}
+
+function optionalPositiveInt(value, label, errorClass, code) {
+  if (value === undefined || value === null) return value;
+  if (typeof value !== "number" || !isFinite(value) || value < 1 || Math.floor(value) !== value) {
+    _throw(errorClass, code, (label || "opt") +
+           " must be a positive integer (>= 1, finite), got " +
+           (typeof value === "number" ? String(value) : typeof value),
+           "validate-opts/bad-positive-int");
+  }
+  return value;
+}
+
+function optionalFiniteNonNegative(value, label, errorClass, code) {
+  if (value === undefined || value === null) return value;
+  if (typeof value !== "number" || !isFinite(value) || value < 0) {
+    _throw(errorClass, code, (label || "opt") +
+           " must be a non-negative finite number, got " +
+           (typeof value === "number" ? String(value) : typeof value),
+           "validate-opts/bad-non-negative-finite");
+  }
+  return value;
+}
+
+function optionalPositiveFinite(value, label, errorClass, code) {
+  if (value === undefined || value === null) return value;
+  if (typeof value !== "number" || !isFinite(value) || value <= 0) {
+    _throw(errorClass, code, (label || "opt") +
+           " must be a positive finite number (> 0), got " +
+           (typeof value === "number" ? String(value) : typeof value),
+           "validate-opts/bad-positive-finite");
+  }
+  return value;
+}
+
+function optionalFunction(value, label, errorClass, code) {
+  if (value === undefined || value === null) return value;
+  if (typeof value !== "function") {
+    _throw(errorClass, code, (label || "opt") + " must be a function, got " + typeof value,
+           "validate-opts/bad-function");
+  }
+  return value;
+}
+
+// applyDefaults — resolve every key in DEFAULTS against opts. For each
+// key, the operator's value (if not undefined) wins; otherwise the
+// default is used. Returns a new plain object — NOT a frozen one, so
+// the create() function can layer additional resolved fields if it
+// needs them. 5+ primitives previously rolled their own
+// `var X = (opts.X === undefined) ? DEFAULTS.X : opts.X;` cascade
+// across 5–10 lines per call site; this collapses them all to one.
+//
+// Operator-supplied keys that aren't in DEFAULTS are dropped — use
+// validateOpts(opts, ALLOWED_KEYS, label) at the boundary FIRST to
+// reject typos before this resolves. Pass-through behavior would let
+// `{ ttllMs: 5000 }` silently apply the default ttlMs without warning.
+function applyDefaults(opts, defaults) {
+  if (defaults === null || typeof defaults !== "object") {
+    throw new Error("validate-opts.applyDefaults: defaults must be an object");
+  }
+  opts = opts || {};
+  var out = {};
+  var keys = Object.keys(defaults);
+  for (var i = 0; i < keys.length; i++) {
+    var k = keys[i];
+    out[k] = (opts[k] === undefined) ? defaults[k] : opts[k];
+  }
+  return out;
+}
+
+// requireObject — every primitive's `_validate*Opts(opts)` function
+// previously started with the same `if (!opts || typeof opts !== "object")
+// throw _err(...)` prelude. Centralized here so the contract is one
+// definition. Throws on null / undefined / non-object; returns opts on
+// success.
+function requireObject(opts, callerLabel, errorClass, code) {
+  if (!opts || typeof opts !== "object") {
+    var msg = (callerLabel || "opts") + ": opts must be an object, got " +
+      (opts === null ? "null" : typeof opts);
+    _throw(errorClass, code, msg, "validate-opts/bad-object");
+  }
+  return opts;
+}
+
+function optionalNonEmptyString(value, label, errorClass, code) {
+  if (value === undefined || value === null) return value;
+  if (typeof value !== "string" || value.length === 0) {
+    _throw(errorClass, code, (label || "opt") +
+           " must be a non-empty string, got " +
+           (typeof value === "string" ? "empty string" : typeof value),
+           "validate-opts/bad-non-empty-string");
+  }
+  return value;
+}
+
+// requireNonEmptyString — required-field counterpart to
+// optionalNonEmptyString. Throws on undefined / null / empty / non-
+// string. The dozens of `if (typeof opts.X !== "string" ||
+// opts.X.length === 0) throw` sites every primitive's create() rolled
+// at the top of validation collapse to one call here.
+function requireNonEmptyString(value, label, errorClass, code) {
+  if (typeof value !== "string" || value.length === 0) {
+    var got = value === undefined ? "undefined"
+            : value === null      ? "null"
+            : typeof value === "string" ? "empty string"
+            : typeof value;
+    _throw(errorClass, code, (label || "opt") +
+           " must be a non-empty string, got " + got,
+           "validate-opts/missing-non-empty-string");
+  }
+  return value;
+}
+
+// optionalNonEmptyStringArray — required-shape validator for optional
+// array-of-non-empty-strings opts (scopes / allowedFileTypes / dependsOn /
+// rtlLanguages / eagerLocales / etc.). Replaces the recurring four-line
+// cascade `if (opts.X !== undefined) { if (!Array.isArray) throw; for
+// (i...) if (typeof !== "string" || === "") throw }` that 5+ primitives
+// previously rolled by hand.
+//
+// undefined / null → returns the value unchanged (caller can default).
+// non-array → throws via errorClass with the provided code.
+// any non-string or empty-string element → throws with index-pointing message.
+function optionalNonEmptyStringArray(value, label, errorClass, code) {
+  if (value === undefined || value === null) return value;
+  if (!Array.isArray(value)) {
+    _throw(errorClass, code, (label || "opt") +
+           " must be an array of non-empty strings, got " + typeof value,
+           "validate-opts/bad-string-array");
+  }
+  for (var i = 0; i < value.length; i += 1) {
+    if (typeof value[i] !== "string" || value[i].length === 0) {
+      _throw(errorClass, code, (label || "opt") +
+             "[" + i + "] must be a non-empty string",
+             "validate-opts/bad-string-array-element");
+    }
+  }
+  return value;
+}
+
+// optionalObjectWithMethod — required-shape validator for optional opts
+// that accept a "duck-typed handle": an object that exposes a specific
+// method. Replaces the recurring `if (opts.X !== undefined && opts.X !==
+// null) { if (typeof opts.X !== "object" || typeof opts.X.method !==
+// "function") throw ... }` cascade shared by file-upload (permissions),
+// notify (queue), seeders (db), webhook (nonceStore), and others.
+//
+// undefined / null → returns the value unchanged (caller can default).
+// non-object OR missing method → throws via errorClass with the operator-
+// facing description (e.g. "must be a b.permissions instance (check fn)").
+function optionalObjectWithMethod(value, method, label, errorClass, code, description) {
+  if (value === undefined || value === null) return value;
+  if (typeof value !== "object" || typeof value[method] !== "function") {
+    _throw(errorClass, code, (label || "opt") + " " +
+           (description || ("must expose " + method + "() method")),
+           "validate-opts/bad-shaped-handle");
+  }
+  return value;
+}
+
+// optionalPlainObject — required-shape validator for optional opts that
+// accept a plain object (not array, not null when undefined-meaning-absent
+// is intended). Replaces the recurring `if (X !== undefined && X !== null)
+// { if (typeof X !== "object" || Array.isArray(X)) throw }` cascade
+// shared by api-key (metadata), db-declare-view, db-declare-row-policy,
+// and static.js (contentSafety).
+//
+// undefined / null → returns the value unchanged (caller can default).
+// non-object OR array → throws via errorClass with the operator-facing
+// description (e.g. "metadata must be a plain object or null").
+function optionalPlainObject(value, label, errorClass, code, description) {
+  if (value === undefined || value === null) return value;
+  if (typeof value !== "object" || Array.isArray(value)) {
+    _throw(errorClass, code, (label || "opt") + " " +
+           (description || "must be a plain object or null"),
+           "validate-opts/bad-plain-object");
+  }
+  return value;
+}
+
+// makeAuditEmitter — closure factory parallel to safeAsync.makeDropCallback.
+// Replaces the per-file `function _emit(action, info) { if (!audit) return;
+// try { audit.safeEmit(Object.assign({ action: action }, info || {})); }
+// catch (_e) { /* audit best-effort */ } }` boilerplate that 5 primitives
+// previously rolled by hand (api-key / cache / notify / permissions /
+// sigv4-bucket-ops).
+//
+// audit may be null/undefined — returns a no-op emitter in that case so
+// callers don't need to null-check at every call site.
+//
+//   var _emit = validateOpts.makeAuditEmitter(opts.audit);
+//   _emit("apikey.create", { actor: ..., resource: ..., outcome: "success" });
+function makeAuditEmitter(audit) {
+  if (!audit || typeof audit.safeEmit !== "function") {
+    return function _noopEmit() {};
+  }
+  return function _emit(action, info) {
+    try { audit.safeEmit(Object.assign({ action: action }, info || {})); }
+    catch (_e) { /* audit best-effort — never break the caller */ }
+  };
+}
+
+// makeNamespacedEmitters — collapses the per-primitive
+//   function _emitAudit(action, outcome, metadata) { audit.safeEmit({...}) }
+//   function _emitMetric(verb)                    { observability.safeEvent(...) }
+// boilerplate into one helper. Every primitive that emits both audit
+// events AND observability metrics under a fixed prefix shares the
+// same shape; pre-v0.8.62 this was inlined in 13+ lib/auth files.
+//
+//   var emit = validateOpts.makeNamespacedEmitters("auth.ciba", { audit, observability });
+//   emit.audit("token_received", "success", { hash: ... });
+//   emit.metric("token-received");
+//
+// The audit/observability arguments are lazyRequire-resolved at the
+// call site so the helper itself adds no module-load coupling.
+function makeNamespacedEmitters(prefix, deps) {
+  if (typeof prefix !== "string" || prefix.length === 0) {
+    throw new Error("makeNamespacedEmitters: prefix must be a non-empty string");
+  }
+  deps = deps || {};
+  function audit(action, outcome, metadata) {
+    var auditMod = deps.audit;
+    if (typeof auditMod === "function") auditMod = auditMod();
+    if (!auditMod || typeof auditMod.safeEmit !== "function") return;
+    try {
+      auditMod.safeEmit({
+        action:   prefix + "." + action,
+        outcome:  outcome,
+        metadata: metadata || {},
+      });
+    } catch (_e) { /* audit best-effort */ }
+  }
+  function metric(verb, value, attrs) {
+    var obsMod = deps.observability;
+    if (typeof obsMod === "function") obsMod = obsMod();
+    if (!obsMod || typeof obsMod.safeEvent !== "function") return;
+    try { obsMod.safeEvent(prefix + "." + verb, value || 1, attrs || {}); }
+    catch (_e) { /* observability best-effort */ }
+  }
+  return { audit: audit, metric: metric };
+}
+
+// observabilityShape — operator-supplied `opts.observability` must
+// expose an `event` function. Parallel to auditShape; the n=1 catalog
+// tracks both inline-shape regexes.
+function observabilityShape(observability, callerLabel, errorClass, code) {
+  if (observability === undefined || observability === null) return observability;
+  if (typeof observability !== "object" || typeof observability.event !== "function") {
+    var msg = (callerLabel || "observability") +
+      ": observability must be a b.observability-shaped object (event fn)";
+    _throw(errorClass, code, msg, "observability/bad-shape");
+  }
+  return observability;
+}
+
+module.exports = check;
+module.exports.check = check;
+module.exports.auditShape = auditShape;
+module.exports.optionalBoolean = optionalBoolean;
+module.exports.optionalPositiveInt = optionalPositiveInt;
+module.exports.optionalFiniteNonNegative = optionalFiniteNonNegative;
+module.exports.optionalPositiveFinite = optionalPositiveFinite;
+module.exports.optionalFunction = optionalFunction;
+module.exports.optionalNonEmptyString = optionalNonEmptyString;
+module.exports.optionalNonEmptyStringArray = optionalNonEmptyStringArray;
+module.exports.optionalObjectWithMethod = optionalObjectWithMethod;
+module.exports.optionalPlainObject = optionalPlainObject;
+module.exports.requireNonEmptyString = requireNonEmptyString;
+module.exports.observabilityShape = observabilityShape;
+module.exports.requireObject = requireObject;
+module.exports.applyDefaults = applyDefaults;
+module.exports.makeAuditEmitter = makeAuditEmitter;
+module.exports.makeNamespacedEmitters = makeNamespacedEmitters;