@blamejs/blamejs-shop 0.4.55 → 0.4.57

package/lib/vendor/blamejs/eslint.config.mjs

@@ -143,6 +143,7 @@ export default [
       "**/data-e2e/**",
       "**/.git/**",
       ".test-output/**",
+      ".scratch/**",
       ".claude/**",
       // Wiki snippets are embedded into pages where `b` / `db` /
       // `req` / `res` are in scope; some use top-level await. They're

package/lib/vendor/blamejs/examples/wiki/lib/source-comment-block-validator.js

@@ -128,7 +128,10 @@ function _knownPrimitiveSet(docs, seederIndex, parser) {
         var headingRe = /<h[23](?:\s+[^>]*)?>([\s\S]*?)<\/h[23]>/g;
         var m;
         while ((m = headingRe.exec(page.body)) !== null) {
-          var inner = m[1].replace(/<[^>]+>/g, "").replace(/&amp;/g, "&");
+          var inner = m[1];
+          var prevInner;   // strip tags until stable (incomplete-multi-char-sanitization)
+          do { prevInner = inner; inner = inner.replace(/<[^>]+>/g, ""); } while (inner !== prevInner);
+          inner = inner.replace(/&amp;/g, "&");
           var sigRe = /b\.[a-zA-Z][a-zA-Z0-9_.]*/g;
           var sm;
           while ((sm = sigRe.exec(inner)) !== null) set[_bare(sm[0])] = true;

package/lib/vendor/blamejs/examples/wiki/lib/symbol-index.js

@@ -26,8 +26,11 @@ function _stripAnchorMarkup(s) {
   // double-decodes &amp;lt; -> <).
   var stripped = String(s)
     .replace(/<a\s+class="anchor"[^>]*>[\s\S]*?<\/a>/g, "")
-    .replace(/<\/?code>/g, "")
-    .replace(/<[^>]+>/g, "");
+    .replace(/<\/?code>/g, "");
+  // Re-run the generic tag strip until stable so nested-bracket residue
+  // can't survive a single pass (incomplete-multi-character-sanitization).
+  var prev;
+  do { prev = stripped; stripped = stripped.replace(/<[^>]+>/g, ""); } while (stripped !== prev);
   return htmlEntities.unescapeBuiltinEntities(stripped)
     .replace(/\s+/g, " ")
     .replace(/^\s+|\s+$/g, "");

package/lib/vendor/blamejs/examples/wiki/routes/pages.js

@@ -58,7 +58,10 @@ function _synthDescription(body, fallback) {
   if (typeof body !== "string") return fallback;
   var m = body.match(/<p[^>]*>([\s\S]*?)<\/p>/i);
   if (!m) return fallback;
-  var text = m[1].replace(/<[^>]+>/g, "").replace(/&[a-z0-9#]+;/gi, " ").replace(/\s+/g, " ").trim();
+  var text = m[1];
+  var prevText;   // strip tags until stable (incomplete-multi-char-sanitization)
+  do { prevText = text; text = text.replace(/<[^>]+>/g, ""); } while (text !== prevText);
+  text = text.replace(/&[a-z0-9#]+;/gi, " ").replace(/\s+/g, " ").trim();
   if (!text) return fallback;
   var maxLen = b.constants.BYTES.bytes(160);
   if (text.length > maxLen) text = text.slice(0, maxLen - 3).trimEnd() + "...";

package/lib/vendor/blamejs/fuzz/guard-text.fuzz.js

@@ -0,0 +1,20 @@
+"use strict";
+
+var b        = require("..");
+var expected = require("./_expected");
+
+// Fuzz the free-text guard's two parsing surfaces: validate() (pure inspection,
+// must never throw on arbitrary bytes) and sanitize() (strip pass, must either
+// return a shrunk string or throw a recognized GuardTextError, never crash).
+module.exports.fuzz = function (data) {
+  var input;
+  try { input = data.toString("utf8"); }
+  catch (_e) { return; }
+  try {
+    b.guardText.validate(input, { profile: "strict" });
+    b.guardText.sanitize(input, { profile: "balanced" });
+  } catch (e) {
+    if (expected.isExpected(e)) return;
+    throw e;
+  }
+};

package/lib/vendor/blamejs/index.js

@@ -225,6 +225,7 @@ var guardYaml = require("./lib/guard-yaml");
 var guardXml = require("./lib/guard-xml");
 var guardMarkdown = require("./lib/guard-markdown");
 var guardEmail = require("./lib/guard-email");
+var guardText = require("./lib/guard-text");
 var guardDomain = require("./lib/guard-domain");
 var guardUuid = require("./lib/guard-uuid");
 var guardCidr = require("./lib/guard-cidr");
@@ -609,6 +610,7 @@ module.exports = {
   guardXml:         guardXml,
   guardMarkdown:    guardMarkdown,
   guardEmail:       guardEmail,
+  guardText:        guardText,
   guardDomain:      guardDomain,
   guardUuid:        guardUuid,
   guardCidr:        guardCidr,

package/lib/vendor/blamejs/lib/a2a-tasks.js

@@ -51,7 +51,7 @@ var validateOpts  = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
 var httpClient = lazyRequire(function () { return require("./http-client"); });
-var audit      = lazyRequire(function () { return require("./audit"); });
+var auditEmit  = require("./audit-emit");
 var C          = require("./constants");
 
 // A2aTasksError is the per-call error class — separate from A2aError
@@ -82,15 +82,7 @@ var TASK_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
 var SKILL_NAME_RE = /^[a-zA-Z][a-zA-Z0-9._-]{0,63}$/;   // allow:duplicate-regex — RFC-3986-unreserved identifier shape, shared across mcp.js + mcp-tool-registry.js
 // RFC-3986-unreserved identifier shape (length cap inside regex), not a byte count
 
-function _emitAudit(action, metadata, outcome) {
-  try {
-    audit().safeEmit({
-      action:   action,
-      outcome:  outcome || "success",
-      metadata: metadata,
-    });
-  } catch (_e) { /* best-effort */ }
-}
+var _emitAudit = auditEmit.emit;
 
 var bCrypto = lazyRequire(function () { return require("./crypto"); });
 
@@ -515,19 +507,11 @@ function _jsonRpcError(id, code, message, data) {
 }
 
 function _readBody(req, maxBytes) {
-  return new Promise(function (resolve, reject) {
-    var collector = safeBuffer.boundedChunkCollector({
-      maxBytes:    maxBytes,
-      errorClass:  A2aTasksError,
-      sizeCode:    "a2a-tasks/body-too-large",
-      sizeMessage: "a2a-tasks: request body exceeded " + maxBytes + " bytes",
-    });
-    req.on("data", function (chunk) {
-      try { collector.push(chunk); }
-      catch (capErr) { reject(capErr); }
-    });
-    req.on("end", function () { resolve(collector.result()); });
-    req.on("error", function (e) { reject(e); });
+  return safeBuffer.collectStream(req, {
+    maxBytes:    maxBytes,
+    errorClass:  A2aTasksError,
+    sizeCode:    "a2a-tasks/body-too-large",
+    sizeMessage: "a2a-tasks: request body exceeded " + maxBytes + " bytes",
   });
 }
 

package/lib/vendor/blamejs/lib/acme.js

@@ -42,6 +42,7 @@
  */
 
 var nodeCrypto = require("node:crypto");
+var safeBuffer = require("./safe-buffer");
 
 var C = require("./constants");
 var asn1 = require("./asn1-der");
@@ -553,7 +554,7 @@ function create(opts) {
       var id = orderOpts.identifiers[i];
       if (!id || typeof id.type !== "string" || typeof id.value !== "string" ||
           id.type.length === 0 || id.value.length === 0 ||
-          id.value.length > C.BYTES.bytes(255)) {
+          safeBuffer.byteLengthOf(id.value) > C.BYTES.bytes(255)) {
         throw _err("acme/bad-identifier",
           "newOrder: identifier must be { type: string, value: string<=255 }", true);
       }
@@ -569,7 +570,7 @@ function create(opts) {
     // the field. v1-defensible scope: refuse non-string + cap length so
     // attacker-supplied profile values can't bloat the JSON payload.
     if (typeof orderOpts.profile === "string") {
-      if (orderOpts.profile.length === 0 || orderOpts.profile.length > C.BYTES.bytes(64)) {
+      if (orderOpts.profile.length === 0 || safeBuffer.byteLengthOf(orderOpts.profile) > C.BYTES.bytes(64)) {
         throw _err("acme/bad-profile",
           "newOrder: profile name must be a non-empty string <= 64 bytes", true);
       }
@@ -611,7 +612,7 @@ function create(opts) {
     } else {
       throw _err("acme/bad-csr", "finalize: csr must be a DER Buffer or PEM string", true);
     }
-    if (csrDer.length === 0 || csrDer.length > C.BYTES.kib(64)) {
+    if (csrDer.length === 0 || safeBuffer.byteLengthOf(csrDer) > C.BYTES.kib(64)) {
       throw _err("acme/bad-csr",
         "finalize: CSR DER size out of range (got " + csrDer.length + " bytes)", true);
     }
@@ -842,7 +843,7 @@ function create(opts) {
     }
     for (var di = 0; di < opts2.domains.length; di += 1) {
       var d = opts2.domains[di];
-      if (typeof d !== "string" || d.length === 0 || d.length > C.BYTES.bytes(255)) {
+      if (typeof d !== "string" || d.length === 0 || safeBuffer.byteLengthOf(d) > C.BYTES.bytes(255)) {
         throw _err("acme/bad-csr-domain",
           "buildCsr: domains[" + di + "] must be a non-empty string <= 255 bytes", true);
       }
@@ -1328,7 +1329,7 @@ function create(opts) {
     if (!opts2 || typeof opts2 !== "object" || typeof opts2.identifier !== "string" || opts2.identifier.length === 0) {
       throw _err("acme/bad-identifier", "dnsAccount01ChallengeRecord: opts.identifier (host) is required", true);
     }
-    if (opts2.identifier.length > C.BYTES.bytes(255)) {
+    if (safeBuffer.byteLengthOf(opts2.identifier) > C.BYTES.bytes(255)) {
       throw _err("acme/bad-identifier", "dnsAccount01ChallengeRecord: identifier exceeds 255 bytes", true);
     }
     if (!state.accountUrl) {

package/lib/vendor/blamejs/lib/agent-event-bus.js

@@ -70,6 +70,7 @@ var agentAudit            = require("./agent-audit");
 var envelopeMac           = require("./agent-envelope-mac");
 var safeJson              = require("./safe-json");
 var bCrypto               = require("./crypto");
+var boundedMap            = require("./bounded-map");
 
 var audit                 = lazyRequire(function () { return require("./audit"); });
 
@@ -149,10 +150,10 @@ function create(opts) {
 
 function _registerTopic(topics, name, topicOpts, auditImpl) {
   guardEventBusTopic.validate(name);
-  if (topics.has(name)) {
+  boundedMap.requireAbsent(topics, name, function () {
     throw new AgentEventBusError("agent-event-bus/topic-duplicate",
       "registerTopic: '" + name + "' already registered");
-  }
+  });
   if (!topicOpts.schema || typeof topicOpts.schema !== "object") {
     throw new AgentEventBusError("agent-event-bus/bad-schema",
       "registerTopic: schema required (flat key→type map)");
@@ -193,10 +194,10 @@ function _registerTopic(topics, name, topicOpts, auditImpl) {
 // lifecycle traceability.
 function _unregisterTopic(topics, name, auditImpl) {
   guardEventBusTopic.validate(name);
-  if (!topics.has(name)) {
+  boundedMap.requirePresent(topics, name, function () {
     throw new AgentEventBusError("agent-event-bus/unknown-topic",
       "unregisterTopic: '" + name + "' not registered");
-  }
+  });
   topics.delete(name);
   _safeAudit(auditImpl, "agent.event_bus.topic_unregistered", null, { name: name });
 }

package/lib/vendor/blamejs/lib/agent-idempotency.js

@@ -143,11 +143,8 @@ function _ensureSealTable() {
 function create(opts) {
   opts = opts || {};
   var store = opts.store || _inMemoryBackend(opts.maxInMemoryEntries);
-  if (typeof store.get !== "function" || typeof store.put !== "function" ||
-      typeof store.delete !== "function") {
-    throw new AgentIdempotencyError("agent-idempotency/bad-store",
-      "create: store must expose { get, put, delete }");
-  }
+  validateOpts.requireMethods(store, ["get", "put", "delete"],
+    "create: store", AgentIdempotencyError, "agent-idempotency/bad-store");
   var ttlMs = typeof opts.ttlMs === "number" ? opts.ttlMs : DEFAULT_TTL_MS;
   if (!Number.isFinite(ttlMs) || ttlMs <= 0) {
     throw new AgentIdempotencyError("agent-idempotency/bad-ttl",

package/lib/vendor/blamejs/lib/agent-orchestrator.js

@@ -157,11 +157,8 @@ var _saltedFnvBasisCache = null;
 function create(opts) {
   opts = opts || {};
   var backend = opts.backend || _inMemoryBackend();
-  if (typeof backend.get !== "function" || typeof backend.set !== "function" ||
-      typeof backend.delete !== "function" || typeof backend.list !== "function") {
-    throw new AgentOrchestratorError("agent-orchestrator/bad-backend",
-      "b.agent.orchestrator.create: backend must expose { get, set, delete, list }");
-  }
+  validateOpts.requireMethods(backend, ["get", "set", "delete", "list"],
+    "b.agent.orchestrator.create: backend", AgentOrchestratorError, "agent-orchestrator/bad-backend");
   var clusterImpl = opts.cluster || cluster();
   var auditImpl   = opts.audit   || audit();
   var permissions = opts.permissions || null;

package/lib/vendor/blamejs/lib/agent-saga.js

@@ -71,6 +71,7 @@
 
 var lazyRequire        = require("./lazy-require");
 var { defineClass }    = require("./framework-error");
+var validateOpts       = require("./validate-opts");
 var guardSagaConfig    = require("./guard-saga-config");
 var bCrypto            = require("./crypto");
 var agentAudit         = require("./agent-audit");
@@ -118,11 +119,8 @@ function create(config) {
   // `agent.saga.no_state_store` surfaces the posture per call).
   var stateStore = config.stateStore || null;
   if (stateStore !== null) {
-    if (typeof stateStore.saveStep !== "function" ||
-        typeof stateStore.loadResumePoint !== "function") {
-      throw new AgentSagaError("agent-saga/bad-state-store",
-        "create: stateStore must expose { saveStep, loadResumePoint, markCompleted?, markFailed? }");
-    }
+    validateOpts.requireMethods(stateStore, ["saveStep", "loadResumePoint"],
+      "create: stateStore", AgentSagaError, "agent-saga/bad-state-store");
   }
   return {
     run:                    function (ctx, initialState, opts) { return _run(config, auditImpl, stateStore, ctx, initialState, opts || {}); },

package/lib/vendor/blamejs/lib/agent-tenant.js

@@ -153,11 +153,8 @@ var TENANT_KEY_BYTES = 32;
 function create(opts) {
   opts = opts || {};
   var backend = opts.backend || _inMemoryBackend();
-  if (typeof backend.get !== "function" || typeof backend.set !== "function" ||
-      typeof backend.delete !== "function" || typeof backend.list !== "function") {
-    throw new AgentTenantError("agent-tenant/bad-backend",
-      "create: backend must expose { get, set, delete, list }");
-  }
+  validateOpts.requireMethods(backend, ["get", "set", "delete", "list"],
+    "create: backend", AgentTenantError, "agent-tenant/bad-backend");
   var auditImpl   = opts.audit || audit();
   var permissions = opts.permissions || null;
   var ctx = {

package/lib/vendor/blamejs/lib/ai-adverse-decision.js

@@ -99,25 +99,12 @@ function wrap(opts) {
   var legalBasis = opts.legalBasis;
   var decide = opts.decide;
   var onAdverse = typeof opts.onAdverse === "function" ? opts.onAdverse : null;
-  var auditOn = opts.audit !== false;
   var now = typeof opts.now === "function" ? opts.now : function () { return Date.now(); };
 
   var deadlines = REGIME_DEADLINES[legalBasis] || REGIME_DEADLINES["operator-defined"];
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({
-        action:   "ai.adverse_decision." + action,
-        outcome:  outcome,
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent */ }
-  }
-  function _emitMetric(verb, n, labels) {
-    try { observability().safeEvent("ai.adverse_decision." + verb, n || 1, labels || {}); }
-    catch (_e) { /* drop-silent */ }
-  }
+  var _emitAudit = audit().namespaced("ai.adverse_decision", opts.audit);
+  var _emitMetric = observability().namespaced("ai.adverse_decision");
 
   return async function adverseDecisionDecorated(subject) {
     if (!subject || typeof subject !== "object") {

package/lib/vendor/blamejs/lib/ai-capability.js

@@ -239,12 +239,7 @@ function create(opts) {
   }
   var auditOn = opts.audit !== false;
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({ action: action, outcome: outcome, metadata: metadata || {} });
-    } catch (_e) { /* audit best-effort — drop-silent */ }
-  }
+  var _emitAudit = audit().namespaced(null, { audit: auditOn });
 
   function describe(modelId) {
     var d = registry.get(modelId);

package/lib/vendor/blamejs/lib/ai-dp.js

@@ -429,11 +429,7 @@ function budget(opts) {
   var spentDelta = 0;
   var rdp = RDP_ORDERS.map(function () { return 0; });   // rdp accounting
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try { audit().safeEmit({ action: action, outcome: outcome, metadata: metadata || {} }); }
-    catch (_e) { /* drop-silent */ }
-  }
+  var _emitAudit = audit().namespaced(null, { audit: auditOn });
 
   function _currentEpsilon(rdpCurve) {
     if (accounting === "basic") return spentEpsilon;

package/lib/vendor/blamejs/lib/ai-input.js

@@ -23,6 +23,7 @@
 var C = require("./constants");
 var numericBounds = require("./numeric-bounds");
 var audit = require("./audit");
+var codepointClass = require("./codepoint-class");
 var { AiInputError } = require("./framework-error");
 
 var SAMPLE_TRUNC = 80;                                                                       // sample truncation length, not bytes
@@ -69,8 +70,7 @@ function _featuresOf(input) {
     var cp = input.charCodeAt(i);
     if ((cp >= 0x202a && cp <= 0x202e) || (cp >= 0x2066 && cp <= 0x2069)) bidi++;
     else if (cp === 0x200b || cp === 0x200c || cp === 0x200d || cp === 0xfeff || cp === 0x2060) zw++;
-    else if (cp < 0x20 && cp !== 0x09 && cp !== 0x0a && cp !== 0x0d) ctrl++;
-    else if (cp === 0x7f) ctrl++;
+    else if (codepointClass.isForbiddenControlChar(cp, { allowLf: true, allowCr: true })) ctrl++;
   }
   return {
     length:    input.length,

package/lib/vendor/blamejs/lib/ai-pref.js

@@ -152,13 +152,8 @@ function parseHeader(value) {
     label:      "aiPref.parseHeader",
   });
   var out = { train: null, infer: null, snippet: null, price: null };
-  var pairs = value.split(",");
-  for (var i = 0; i < pairs.length; i += 1) {
-    var p = pairs[i].trim();
-    var eq = p.indexOf("=");
-    if (eq === -1) continue;
-    var k = p.slice(0, eq).trim().toLowerCase();
-    var val = p.slice(eq + 1).trim();
+  var kvps = structuredFields.parseKeyValuePieces(value.split(","));
+  structuredFields.forEachKeyValue(kvps, function (k, val) {
     if (k === "train"      && TRAIN_VALUES.indexOf(val) !== -1)   out.train = val;
     else if (k === "infer"   && INFER_VALUES.indexOf(val) !== -1) out.infer = val;
     else if (k === "snippet" && SNIPPET_VALUES.indexOf(val) !== -1) out.snippet = val;
@@ -169,7 +164,7 @@ function parseHeader(value) {
       var pt = parseInt(val, 10);
       if (isFinite(pt) && pt > 0) out.price = Object.assign({ perTokens: pt }, out.price || {});
     }
-  }
+  });
   return out;
 }
 

package/lib/vendor/blamejs/lib/ai-quota.js

@@ -318,12 +318,7 @@ function create(opts) {
     return null;
   }
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({ action: action, outcome: outcome, metadata: metadata || {} });
-    } catch (_e) { /* audit best-effort — drop-silent */ }
-  }
+  var _emitAudit = audit().namespaced(null, { audit: auditOn });
 
   function _emitMetric(name, n) {
     try { observability().safeEvent(name, n || 1, {}); }
@@ -507,14 +502,8 @@ function _validateLimitMap(map, label) {
 }
 
 function _validateStore(store) {
-  if (!store || typeof store !== "object" ||
-      typeof store.reserve !== "function" ||
-      typeof store.add !== "function" ||
-      typeof store.get !== "function" ||
-      typeof store.reset !== "function") {
-    throw new AiQuotaError("ai-quota/bad-store",
-      "ai.quota.create: store must expose reserve / add / get / reset functions");
-  }
+  validateOpts.requireMethods(store, ["reserve", "add", "get", "reset"],
+    "ai.quota.create: store", AiQuotaError, "ai-quota/bad-store");
 }
 
 module.exports = {

package/lib/vendor/blamejs/lib/api-key.js

@@ -134,37 +134,46 @@ function _validateIdentifier(name, value) {
 }
 
 function _validateCreateOpts(opts) {
-  validateOpts.requireObject(opts, "apiKey.create", ApiKeyError);
-  _validateIdentifier("apiKey.create: namespace", opts.namespace);
-  if (opts.prefix !== undefined) _validateIdentifier("apiKey.create: prefix", opts.prefix);
-  validateOpts.optionalPositiveInt(opts.idBytes, "apiKey.create: idBytes", ApiKeyError);
-  validateOpts.optionalPositiveInt(opts.secretBytes, "apiKey.create: secretBytes", ApiKeyError);
-  validateOpts.optionalBoolean(opts.trackLastUsedAt, "apiKey.create: trackLastUsedAt", ApiKeyError);
-  validateOpts.optionalBoolean(opts.auditFailures, "apiKey.create: auditFailures", ApiKeyError);
-  validateOpts.optionalBoolean(opts.auditSuccess, "apiKey.create: auditSuccess", ApiKeyError);
-  validateOpts.optionalFiniteNonNegative(opts.purgeAfterMs, "apiKey.create: purgeAfterMs", ApiKeyError);
-  if (opts.hashAlgo !== undefined) {
-    if (typeof opts.hashAlgo !== "string" ||
-        (opts.hashAlgo !== "shake256" && opts.hashAlgo !== "argon2id")) {
-      throw _err("BAD_OPT", "apiKey.create: hashAlgo must be 'shake256' or 'argon2id', got " +
-        JSON.stringify(opts.hashAlgo));
-    }
-  }
-  validateOpts.auditShape(opts.audit, "apiKey.create", ApiKeyError);
-  validateOpts.optionalFunction(opts.clock, "apiKey.create: clock", ApiKeyError);
+  validateOpts.shape(opts, {
+    namespace:       function (v, l) { _validateIdentifier(l, v); },
+    prefix:          function (v, l) { if (v !== undefined) _validateIdentifier(l, v); },
+    idBytes:         "optional-positive-int",
+    secretBytes:     "optional-positive-int",
+    trackLastUsedAt: "optional-boolean",
+    auditFailures:   "optional-boolean",
+    auditSuccess:    "optional-boolean",
+    purgeAfterMs:    "optional-non-negative",
+    hashAlgo:        function (v) {
+      if (v !== undefined) {
+        if (typeof v !== "string" || (v !== "shake256" && v !== "argon2id")) {
+          throw _err("BAD_OPT", "apiKey.create: hashAlgo must be 'shake256' or 'argon2id', got " +
+            JSON.stringify(v));
+        }
+      }
+    },
+    audit:           function (v) { validateOpts.auditShape(v, "apiKey.create", ApiKeyError); },
+    clock:           "optional-function",
+  }, "apiKey.create", ApiKeyError);
 }
 
 function _validateIssueOpts(opts) {
-  validateOpts.requireObject(opts, "apiKey.issue", ApiKeyError);
-  validateOpts.requireNonEmptyString(opts.ownerId, "apiKey.issue: ownerId", ApiKeyError, "MISSING_OWNER");
-  validateOpts.optionalNonEmptyStringArray(opts.scopes, "apiKey.issue: scopes", ApiKeyError, "BAD_SCOPES");
-  validateOpts.optionalPlainObject(opts.metadata, "apiKey.issue: metadata",
-    ApiKeyError, "BAD_METADATA");
-  if (opts.expiresAt !== undefined && opts.expiresAt !== null) {
-    if (typeof opts.expiresAt !== "number" || !isFinite(opts.expiresAt) || opts.expiresAt < 0) {
-      throw _err("BAD_OPT", "apiKey.issue: expiresAt must be a non-negative finite number (unix ms) or null");
-    }
-  }
+  validateOpts.shape(opts, {
+    ownerId:   { rule: "required-string",       code: "MISSING_OWNER" },
+    scopes:    { rule: "optional-string-array", code: "BAD_SCOPES" },
+    metadata:  { rule: "optional-plain-object", code: "BAD_METADATA" },
+    expiresAt: function (v) {
+      if (v !== undefined && v !== null) {
+        if (typeof v !== "number" || !isFinite(v) || v < 0) {
+          throw _err("BAD_OPT", "apiKey.issue: expiresAt must be a non-negative finite number (unix ms) or null");
+        }
+      }
+    },
+  }, "apiKey.issue", ApiKeyError, undefined, {
+    // `req` / `context` are the audit-actor pass-through bag — forwarded
+    // verbatim to requestHelpers.resolveActorWithOverride (via _actor)
+    // to populate the issue audit's 5 W's, not validated locally.
+    allow: ["req", "context"],
+  });
 }
 
 // ---- Token format ----

package/lib/vendor/blamejs/lib/archive-adapters.js

@@ -547,10 +547,8 @@ function http(url, opts) {
  *   for await (var e of reader.entries()) entries.push(e);
  */
 function trustedStream(readable, opts) {
-  if (!readable || typeof readable.pipe !== "function" || typeof readable.on !== "function") {
-    throw new AdapterError("adapter/bad-arg",
-      "trustedStream: arg must be a Readable (or pipe/on-compatible stream)");
-  }
+  validateOpts.requireMethods(readable, ["pipe", "on"],
+    "trustedStream: arg (Readable / pipe-on-compatible stream)", AdapterError, "adapter/bad-arg");
   if (!(readable instanceof nodeStream.Readable) && !readable.readable) {
     // Accept stream-like duck-typed objects; many libraries return
     // Readable-flavored bytes via Symbol.asyncIterator only.

package/lib/vendor/blamejs/lib/archive-entry-policy.js

@@ -0,0 +1,32 @@
+"use strict";
+/**
+ * lib/archive-entry-policy.js — the entry-type extraction policy shared by the
+ * ZIP (archive-read) and TAR (archive-tar-read) readers.
+ *
+ * Special archive entry types — symlinks, hardlinks, device nodes, FIFOs, and
+ * sockets — are a malicious-archive vector (symlink traversal out of the
+ * extraction root, device-node creation, etc.), so every type is DENIED by
+ * default; an operator opts a type in explicitly per archive. Both readers
+ * normalized the same default the same way, so the policy + its overlay live
+ * here once rather than drifting between the two formats.
+ */
+
+var DEFAULT_ENTRY_TYPE_POLICY = Object.freeze({
+  symlinks:  false,
+  hardlinks: false,
+  devices:   false,
+  fifos:     false,
+  sockets:   false,
+});
+
+// normalize(p) — overlay an operator policy onto the all-denied default and
+// freeze it. A falsy `p` returns the shared default object (no allocation).
+function normalize(p) {
+  if (!p) return DEFAULT_ENTRY_TYPE_POLICY;
+  return Object.freeze(Object.assign({}, DEFAULT_ENTRY_TYPE_POLICY, p));
+}
+
+module.exports = {
+  DEFAULT_ENTRY_TYPE_POLICY: DEFAULT_ENTRY_TYPE_POLICY,
+  normalize:                 normalize,
+};

package/lib/vendor/blamejs/lib/archive-read.js

@@ -54,6 +54,8 @@ var guardArchive  = lazyRequire(function () { return require("./guard-archive");
 var safeDecompress = lazyRequire(function () { return require("./safe-decompress"); });
 var safeBuffer     = lazyRequire(function () { return require("./safe-buffer"); });
 var archiveAdapters = lazyRequire(function () { return require("./archive-adapters"); });
+var archiveEntryPolicy = require("./archive-entry-policy");
+var auditEmit = require("./audit-emit");
 
 // ---- Wire-format constants ------------------------------------------------
 // Aligned with the write-side `lib/archive.js`. APPNOTE.TXT § references
@@ -120,13 +122,7 @@ var DEFAULT_BOMB_POLICY = Object.freeze({
   maxExpansionRatio:         100,                                     // compressed → decompressed ratio cap
 });
 
-var DEFAULT_ENTRY_TYPE_POLICY = Object.freeze({
-  symlinks:  false,
-  hardlinks: false,
-  devices:   false,
-  fifos:     false,
-  sockets:   false,
-});
+var DEFAULT_ENTRY_TYPE_POLICY = archiveEntryPolicy.DEFAULT_ENTRY_TYPE_POLICY;
 
 // ---- Helpers --------------------------------------------------------------
 
@@ -629,17 +625,9 @@ function _normalizeBombPolicy(p) {
   return Object.freeze(Object.assign({}, DEFAULT_BOMB_POLICY, p));
 }
 
-function _normalizeEntryTypePolicy(p) {
-  if (!p) return DEFAULT_ENTRY_TYPE_POLICY;
-  return Object.freeze(Object.assign({}, DEFAULT_ENTRY_TYPE_POLICY, p));
-}
+var _normalizeEntryTypePolicy = archiveEntryPolicy.normalize;
 
-function _emitAudit(opts, action, outcome, metadata) {
-  if (!opts || !opts.audit || typeof opts.audit.safeEmit !== "function") return;
-  try {
-    opts.audit.safeEmit({ action: action, outcome: outcome, metadata: metadata });
-  } catch (_e) { /* drop-silent — audit sinks must never crash the reader */ }
-}
+var _emitAudit = auditEmit.emitToSink;   // operator-sink audit emit (opts.audit)
 
 /**
  * @primitive b.archive.read.zip