@blamejs/blamejs-shop 0.4.56 → 0.4.57

package/lib/vendor/blamejs/lib/ddl-change-control.js

@@ -207,20 +207,24 @@ function _memoryStore() {
  */
 function create(opts) {
   opts = opts || {};
-  validateOpts(opts, [
-    "audit", "approvers", "windowSpec", "posture", "signWith",
-    "verifyWith", "store", "now", "selfApproval",
-  ], "ddlChangeControl.create");
-  validateOpts.auditShape(opts.audit, "ddlChangeControl",
-    DdlChangeControlError, "ddl-change-control/bad-audit");
-  validateOpts.optionalFunction(opts.signWith,
-    "ddlChangeControl: signWith", DdlChangeControlError, "ddl-change-control/bad-signer");
-  validateOpts.optionalFunction(opts.verifyWith,
-    "ddlChangeControl: verifyWith", DdlChangeControlError, "ddl-change-control/bad-verifier");
-  validateOpts.optionalFunction(opts.now,
-    "ddlChangeControl: now", DdlChangeControlError, "ddl-change-control/bad-now");
-  validateOpts.optionalNonEmptyString(opts.posture,
-    "ddlChangeControl: posture", DdlChangeControlError, "ddl-change-control/bad-posture");
+  validateOpts.shape(opts, {
+    audit: function (value) {
+      validateOpts.auditShape(value, "ddlChangeControl",
+        DdlChangeControlError, "ddl-change-control/bad-audit");
+    },
+    signWith:   { rule: "optional-function", code: "ddl-change-control/bad-signer" },
+    verifyWith: { rule: "optional-function", code: "ddl-change-control/bad-verifier" },
+    now:        { rule: "optional-function", code: "ddl-change-control/bad-now" },
+    posture:    { rule: "optional-string",   code: "ddl-change-control/bad-posture" },
+    // approvers / windowSpec / store keep their own bespoke validation in
+    // the factory body (distinct error codes, floor semantics, the window
+    // grammar parser, the silent in-memory fallback) — declared here so the
+    // exhaustive contract accepts them while the body remains authoritative.
+    approvers:    function () {},
+    windowSpec:   function () {},
+    store:        function () {},
+    selfApproval: { rule: "optional-boolean", code: "ddl-change-control/bad-self-approval" },
+  }, "ddlChangeControl", DdlChangeControlError, "ddl-change-control/bad-posture");
 
   var approvers = 2;
   if (opts.approvers !== undefined) {

package/lib/vendor/blamejs/lib/deprecate.js

@@ -48,6 +48,7 @@
 
 var safeEnv = require("./parsers/safe-env");
 var validateOpts = require("./validate-opts");
+var boundedMap = require("./bounded-map");
 var { FrameworkError } = require("./framework-error");
 
 class DeprecateError extends FrameworkError {
@@ -131,9 +132,8 @@ function warn(name, opts) {
   _validateOpts(opts, "warn");
 
   var key = name + ":" + opts.since;
-  var entry = _seen.get(key);
-  if (!entry) {
-    entry = {
+  var entry = boundedMap.getOrInsert(_seen, key, function () {
+    return {
       name:      name,
       since:     opts.since,
       removeIn:  opts.removeIn,
@@ -142,8 +142,7 @@ function warn(name, opts) {
       callCount: 0,
       firstSeen: new Date().toISOString(),
     };
-    _seen.set(key, entry);
-  }
+  });
   entry.callCount++;
 
   var mode = _modeFromEnv();

package/lib/vendor/blamejs/lib/did.js

@@ -46,6 +46,7 @@
  */
 
 var nodeCrypto = require("node:crypto");
+var bCrypto = require("./crypto");
 var safeJson = require("./safe-json");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
@@ -380,8 +381,11 @@ function _jwkToKey(jwk) {
     throw new DidError("did/unsupported-key",
       "did: verificationMethod publicKeyJwk has unsupported kty/crv (" + jwk.kty + "/" + jwk.crv + ")");
   }
-  try { return nodeCrypto.createPublicKey({ key: jwk, format: "jwk" }); }
-  catch (e) { throw new DidError("did/bad-key", "did: verificationMethod publicKeyJwk is invalid: " + ((e && e.message) || e)); }
+  return bCrypto.importPublicJwk(jwk, {
+    errorClass:    DidError,
+    code:          "did/bad-key",
+    messagePrefix: "did: verificationMethod publicKeyJwk is invalid: ",
+  });
 }
 
 // Extract verification methods from a DID document → KeyObjects.

package/lib/vendor/blamejs/lib/dsr.js

@@ -114,6 +114,7 @@ var bCrypto = require("./crypto");
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
 var safeSql = require("./safe-sql");
+var boundedMap = require("./bounded-map");
 var { defineClass } = require("./framework-error");
 
 var DsrError = defineClass("DsrError", { alwaysPermanent: true });
@@ -372,10 +373,7 @@ function create(opts) {
     } catch (_e) { /* drop-silent — audit sink */ }
   }
 
-  function _emitMetric(verb, n, labels) {
-    try { observability().safeEvent("dsr." + verb, n || 1, labels || {}); }
-    catch (_e) { /* drop-silent */ }
-  }
+  var _emitMetric = observability().namespaced("dsr");
 
   function _newTicketId() {
     var ts = String(Date.now()).slice(-7);                                         // last 7 chars of unix-ms timestamp; collision-resistant when paired with the random suffix
@@ -894,10 +892,10 @@ function memoryTicketStore() {
   var byId = new Map();
   return {
     insert: async function (ticket) {
-      if (byId.has(ticket.id)) {
+      boundedMap.requireAbsent(byId, ticket.id, function () {
         throw new DsrError("dsr/duplicate-ticket-id",
           "memoryTicketStore: duplicate ticket id " + ticket.id);
-      }
+      });
       byId.set(ticket.id, Object.assign({}, ticket));
     },
     get: async function (id) {
@@ -919,10 +917,10 @@ function memoryTicketStore() {
       return out;
     },
     update: async function (id, ticket) {
-      if (!byId.has(id)) {
+      boundedMap.requirePresent(byId, id, function () {
         throw new DsrError("dsr/ticket-not-found",
           "memoryTicketStore: ticket " + id + " not found for update");
-      }
+      });
       byId.set(id, Object.assign({}, ticket));
     },
     delete: async function (id) {
@@ -1023,10 +1021,8 @@ function _ensureDsrSealTable() {
 function dbTicketStore(opts) {
   opts = opts || {};
   var db = opts.db;
-  if (!db || typeof db.runSql !== "function" || typeof db.prepare !== "function") {
-    throw new DsrError("dsr/bad-db",
-      "dbTicketStore: opts.db must be a b.db-shaped handle (with runSql + prepare)");
-  }
+  validateOpts.requireMethods(db, ["runSql", "prepare"],
+    "dbTicketStore: opts.db (b.db-shaped handle)", DsrError, "dsr/bad-db");
   var tableRaw = opts.table || "dsr_tickets";
   var qTable, qEmailIdx, qStatusIdx;
   try {

package/lib/vendor/blamejs/lib/external-db-migrate.js

@@ -49,6 +49,7 @@
  *   - externaldb.migrate.lock.released   { holder }
  */
 var nodePath = require("node:path");
+var moduleLoader = require("./module-loader");
 var atomicFile = require("./atomic-file");
 var canonicalJson = require("./canonical-json");
 var { sha3Hash } = require("./crypto");
@@ -379,19 +380,10 @@ function _list(dir) {
 }
 
 function _loadMigration(file, dir) {
-  var fullPath = nodePath.join(dir, file);
-  // Drop the require cache so a test/dev that edits a file picks up the
-  // new content. Matches lib/migrations.js semantics.
-  try { delete require.cache[require.resolve(fullPath)]; } catch (_e) { /* not yet cached */ }
-  var mod;
-  // Operator-supplied migration file — dynamic by design, won't survive
-  // SEA / pkg bundling. External DB migration tooling is host-CLI scope,
-  // not framework-internal scope.
-  try { mod = require(fullPath); }   // allow:dynamic-require — operator-supplied migration
-  catch (e) {
-    throw _err("externaldb-migrate/load-failed",
+  var mod = moduleLoader.requireFresh(nodePath.join(dir, file), function (e) {
+    return _err("externaldb-migrate/load-failed",
       "migration '" + file + "' failed to load: " + ((e && e.message) || String(e)));
-  }
+  });
   if (!mod || typeof mod.up !== "function") {
     throw _err("externaldb-migrate/missing-up",
       "migration '" + file + "' must export an `up(xdb, ctx)` function");
@@ -437,16 +429,23 @@ function _resolveBackendName(opts) {
 
 function create(opts) {
   opts = opts || {};
-  validateOpts(opts, [
-    "dir", "backend", "audit", "staleAfterMs",
-    "schemaIntrospect", "ranBy", "signHistory",
-  ], "b.externalDb.migrate");
-  validateOpts.requireNonEmptyString(opts.dir, "externalDb.migrate.create: opts.dir (path to migrations directory)", ExternalDbMigrateError, "externaldb-migrate/no-dir");
-  validateOpts.optionalFiniteNonNegative(opts.staleAfterMs, "externalDb.migrate: staleAfterMs", ExternalDbMigrateError, "externaldb-migrate/bad-stale");
-  validateOpts.auditShape(opts.audit, "externalDb.migrate", ExternalDbMigrateError, "externaldb-migrate/bad-audit");
-  validateOpts.optionalFunction(opts.schemaIntrospect,
-    "externalDb.migrate: schemaIntrospect", ExternalDbMigrateError,
-    "externaldb-migrate/bad-introspect");
+  validateOpts.shape(opts, {
+    dir: { rule: "required-string", code: "externaldb-migrate/no-dir",
+           label: "externalDb.migrate.create: opts.dir (path to migrations directory)" },
+    staleAfterMs: { rule: "optional-non-negative", code: "externaldb-migrate/bad-stale",
+                    label: "externalDb.migrate: staleAfterMs" },
+    audit: function (value) {
+      validateOpts.auditShape(value, "externalDb.migrate", ExternalDbMigrateError, "externaldb-migrate/bad-audit");
+    },
+    schemaIntrospect: { rule: "optional-function", code: "externaldb-migrate/bad-introspect",
+                        label: "externalDb.migrate: schemaIntrospect" },
+    backend: { rule: "optional-string", code: "externaldb-migrate/bad-backend",
+               label: "externalDb.migrate: backend (externalDb backend name)" },
+    ranBy: { rule: "optional-string", code: "externaldb-migrate/bad-ran-by",
+             label: "externalDb.migrate: ranBy (schema-history actor)" },
+    signHistory: { rule: "optional-boolean", code: "externaldb-migrate/bad-sign-history",
+                   label: "externalDb.migrate: signHistory" },
+  }, "externalDb.migrate", ExternalDbMigrateError, "externaldb-migrate/bad-opt");
   var dir = opts.dir;
   var audit = opts.audit || null;
   var schemaIntrospect = typeof opts.schemaIntrospect === "function"

package/lib/vendor/blamejs/lib/external-db.js

@@ -36,7 +36,9 @@
  *   External-database integration for app data — Postgres / MySQL / SQLite / MongoDB connection pooling, retry, circuit breaker, classification routing, residency enforcement, and audit hooks.
  */
 var retryHelper = require("./retry");
+var safeBuffer = require("./safe-buffer");
 var bCrypto = require("./crypto");
+var numericBounds = require("./numeric-bounds");
 var C = require("./constants");
 var dbRoleContext = require("./db-role-context");
 var externalDbMigrate = require("./external-db-migrate");
@@ -45,6 +47,7 @@ var { boot } = require("./log");
 var safeAsync = require("./safe-async");
 var safeSql = require("./safe-sql");
 var validateOpts = require("./validate-opts");
+var codepointClass = require("./codepoint-class");
 var { ExternalDbError } = require("./framework-error");
 
 var log = boot("external-db");
@@ -417,11 +420,7 @@ function _otelDbAttributes(b, sql, includeStatement) {
 // legitimately-quoted relation name still surfaces in the audit row.
 var _RELATION_RE = /\b(?:FROM|INTO|UPDATE|JOIN|TABLE|COPY)\s+((?:"[^"]+"|`[^`]+`|[A-Za-z_][\w$]*)(?:\.(?:"[^"]+"|`[^`]+`|[A-Za-z_][\w$]*))?)/ig;
 function _hasControlChar(s) {
-  for (var i = 0; i < s.length; i += 1) {
-    var c = s.charCodeAt(i);
-    if (c < 0x20 || c === 0x7f) return true;
-  }
-  return false;
+  return codepointClass.firstControlCharOffset(s, { forbidTab: true }) !== -1;
 }
 function _extractTargetRelation(sql) {
   if (typeof sql !== "string" || sql.length === 0) return null;
@@ -747,7 +746,7 @@ function init(opts) {
       throw _err("INVALID_CONFIG",
         "backend '" + name + "': applicationName must not contain CR, LF, or NUL characters", true);
       }
-      if (applicationName.length > C.BYTES.bytes(63)) {
+      if (safeBuffer.byteLengthOf(applicationName) > C.BYTES.bytes(63)) {
       throw _err("INVALID_CONFIG",
         "backend '" + name + "': applicationName exceeds Postgres 63-byte limit (got " +
         applicationName.length + ")", true);
@@ -1440,7 +1439,7 @@ function _buildSessionGucsStatements(sessionGucs) {
       // that bloats query logs and consumes max_stack_depth. The cap
       // is generous for legitimate tenant identifiers but rejects
       // amplification.
-      if (value.length > C.BYTES.kib(4)) {
+      if (safeBuffer.byteLengthOf(value) > C.BYTES.kib(4)) {
         throw _err("INVALID_SESSION_GUCS",
           "sessionGucs['" + name + "']: value exceeds 4 KiB cap (got " +
           value.length + " chars)", true);
@@ -1725,11 +1724,9 @@ function _buildReplicas(backendName, cfg) {
         "backend '" + backendName + "': replicas[" + i + "].query must be a function", true);
     }
     var weight = r.weight !== undefined ? r.weight : 1;
-    if (typeof weight !== "number" || !isFinite(weight) || weight <= 0 ||
-        Math.floor(weight) !== weight) {
-      throw _err("INVALID_CONFIG",
-        "backend '" + backendName + "': replicas[" + i + "].weight must be a positive integer", true);
-    }
+    numericBounds.requirePositiveFiniteInt(weight,
+      "backend '" + backendName + "': replicas[" + i + "].weight", ExternalDbError,
+      "INVALID_CONFIG", null, { permanent: true });
     var replicaTag = r.residencyTag || "unrestricted";
     var allowCrossBorder = r.allowCrossBorder === true;
     if (!_residencyCompatible(primaryTag, replicaTag) && !allowCrossBorder) {
@@ -2066,15 +2063,9 @@ function configurePool(backendName, opts) {
         "configurePool: unknown option '" + k + "'. Allowed: " + allowed.join(", "), true);
     }
   }
-  function _requirePosInt(name, value) {
-    if (typeof value !== "number" || !isFinite(value) || value <= 0 || Math.floor(value) !== value) {
-      throw _err("INVALID_CONFIG",
-        "configurePool: " + name + " must be a positive integer, got " + JSON.stringify(value), true);
-    }
-  }
-  if (opts.min           !== undefined) _requirePosInt("min", opts.min);
-  if (opts.max           !== undefined) _requirePosInt("max", opts.max);
-  if (opts.idleTimeoutMs !== undefined) _requirePosInt("idleTimeoutMs", opts.idleTimeoutMs);
+  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
+    ["min", "max", "idleTimeoutMs"], "configurePool", ExternalDbError,
+    "INVALID_CONFIG", { permanent: true });
   if (opts.min !== undefined && opts.max !== undefined && opts.min > opts.max) {
     throw _err("INVALID_CONFIG", "configurePool: min must be <= max", true);
   }
@@ -2146,11 +2137,8 @@ function _connectAs(rawConnect, query, opts) {
     throw _err("INVALID_CONFIG", "connectAs: applicationName must be a string", true);
   }
   if (opts.statementTimeoutMs !== undefined) {
-    if (typeof opts.statementTimeoutMs !== "number" || !isFinite(opts.statementTimeoutMs) ||
-        opts.statementTimeoutMs <= 0 || Math.floor(opts.statementTimeoutMs) !== opts.statementTimeoutMs) {
-      throw _err("INVALID_CONFIG",
-        "connectAs: statementTimeoutMs must be a positive integer", true);
-    }
+    numericBounds.requirePositiveFiniteIntIfPresent(opts.statementTimeoutMs,
+      "connectAs: statementTimeoutMs", ExternalDbError, "INVALID_CONFIG", { permanent: true });
   }
   if (opts.gucs !== undefined && (typeof opts.gucs !== "object" || opts.gucs === null)) {
     throw _err("INVALID_CONFIG", "connectAs: gucs must be an object", true);

package/lib/vendor/blamejs/lib/fda-21cfr11.js

@@ -181,14 +181,18 @@ function posture(opts) {
     "audit", "signWith", "verifyWith", "meanings", "gxpNamespaces",
     "interceptAudit", "now",
   ], "fda21cfr11.posture");
-  validateOpts.auditShape(opts.audit, "fda21cfr11.posture",
-    Fda21Cfr11Error, "fda21cfr11/bad-audit");
-  validateOpts.optionalFunction(opts.signWith,
-    "fda21cfr11.posture: signWith", Fda21Cfr11Error, "fda21cfr11/bad-signer");
-  validateOpts.optionalFunction(opts.verifyWith,
-    "fda21cfr11.posture: verifyWith", Fda21Cfr11Error, "fda21cfr11/bad-verifier");
-  validateOpts.optionalFunction(opts.now,
-    "fda21cfr11.posture: now", Fda21Cfr11Error, "fda21cfr11/bad-now");
+  validateOpts.shape(opts, {
+    audit: function (value) {
+      validateOpts.auditShape(value, "fda21cfr11.posture",
+        Fda21Cfr11Error, "fda21cfr11/bad-audit");
+    },
+    signWith:       { rule: "optional-function", code: "fda21cfr11/bad-signer" },
+    verifyWith:     { rule: "optional-function", code: "fda21cfr11/bad-verifier" },
+    now:            { rule: "optional-function", code: "fda21cfr11/bad-now" },
+    meanings:       { rule: "optional-string-array", code: "fda21cfr11/bad-meanings" },
+    gxpNamespaces:  { rule: "optional-string-array", code: "fda21cfr11/bad-gxp-namespaces" },
+    interceptAudit: { rule: "optional-boolean", code: "fda21cfr11/bad-intercept-audit" },
+  }, "fda21cfr11.posture", Fda21Cfr11Error, "fda21cfr11/bad-opts");
 
   var auditMod = opts.audit && typeof opts.audit.safeEmit === "function" ? opts.audit : null;
   var signWith = typeof opts.signWith === "function" ? opts.signWith : null;

package/lib/vendor/blamejs/lib/fdx.js

@@ -168,10 +168,13 @@ function bind(opts) {
     throw FdxError.factory("fdx/bad-auth-server",
       "fdx.bind: authServer object required");
   }
-  validateOpts.requireNonEmptyString(opts.authServer.issuer,
-    "fdx.bind: authServer.issuer", FdxError, "BAD_ISSUER");
-  validateOpts.requireNonEmptyString(opts.authServer.jwksUri,
-    "fdx.bind: authServer.jwksUri", FdxError, "BAD_JWKS_URI");
+  validateOpts.shape(opts.authServer, {
+    issuer:  { rule: "required-string", code: "BAD_ISSUER",   label: "fdx.bind: authServer.issuer" },
+    jwksUri: { rule: "required-string", code: "BAD_JWKS_URI", label: "fdx.bind: authServer.jwksUri" },
+  }, "fdx.bind: authServer", FdxError, "fdx/bad-auth-server",
+    // fapi2 is forwarded verbatim to fapi2.assertOAuthConfig, which owns
+    // its shape ({ pkce, dpop?, mtls?, par }) — validated there, not here.
+    { allow: ["fapi2"] });
 
   if (!Array.isArray(opts.resources) || opts.resources.length === 0) {
     throw FdxError.factory("fdx/bad-resources",
@@ -315,20 +318,21 @@ function consentReceipt(opts) {
   if (!opts || typeof opts !== "object") {
     throw FdxError.factory("fdx/bad-opts", "fdx.consentReceipt: opts required");
   }
-  validateOpts.requireNonEmptyString(opts.dataProvider,
-    "fdx.consentReceipt: dataProvider", FdxError, "BAD_DATA_PROVIDER");
-  validateOpts.requireNonEmptyString(opts.consumerRef,
-    "fdx.consentReceipt: consumerRef", FdxError, "BAD_CONSUMER_REF");
-  validateOpts.requireNonEmptyString(opts.thirdParty,
-    "fdx.consentReceipt: thirdParty", FdxError, "BAD_THIRD_PARTY");
-  validateOpts.requireNonEmptyString(opts.revocationUrl,
-    "fdx.consentReceipt: revocationUrl", FdxError, "BAD_REVOCATION_URL");
-  if (!Array.isArray(opts.scopes) || opts.scopes.length === 0) {
-    throw FdxError.factory("fdx/bad-scopes",
-      "fdx.consentReceipt: scopes must be a non-empty array");
-  }
-  numericBounds.requirePositiveFiniteIntIfPresent(opts.durationMs,
-    "fdx.consentReceipt: durationMs", FdxError, "BAD_DURATION");
+  validateOpts.shape(opts, {
+    dataProvider:  { rule: "required-string", code: "BAD_DATA_PROVIDER" },
+    consumerRef:   { rule: "required-string", code: "BAD_CONSUMER_REF" },
+    thirdParty:    { rule: "required-string", code: "BAD_THIRD_PARTY" },
+    revocationUrl: { rule: "required-string", code: "BAD_REVOCATION_URL" },
+    scopes: function (value) {
+      if (!Array.isArray(value) || value.length === 0) {
+        throw FdxError.factory("fdx/bad-scopes",
+          "fdx.consentReceipt: scopes must be a non-empty array");
+      }
+    },
+    durationMs: function (value, label) {
+      numericBounds.requirePositiveFiniteIntIfPresent(value, label, FdxError, "BAD_DURATION");
+    },
+  }, "fdx.consentReceipt", FdxError, "fdx/bad-opts");
 
   var issuedAt = Date.now();
   var expiresAt = issuedAt + (opts.durationMs || C.TIME.weeks(52));

package/lib/vendor/blamejs/lib/file-upload.js

@@ -259,73 +259,87 @@ function _validateUploadId(id) {
 }
 
 function _validateCreateOpts(opts) {
-  validateOpts.requireObject(opts, "fileUpload.create", FileUploadError);
-  validateOpts.requireNonEmptyString(opts.stagingDir, "fileUpload.create: stagingDir", FileUploadError);
-  if (!nodePath.isAbsolute(opts.stagingDir)) {
-    throw _err("BAD_OPT", "fileUpload.create: stagingDir must be an absolute path, got " +
-      JSON.stringify(opts.stagingDir));
-  }
-  validateOpts.optionalFunction(opts.onFinalize, "fileUpload.create: onFinalize", FileUploadError);
-  validateOpts.optionalFunction(opts.onChunk, "fileUpload.create: onChunk", FileUploadError);
-  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
-    ["maxFileBytes", "maxChunkBytes", "maxStreamReassemblyBytes",
-     "maxStagingBytes", "maxActiveUploadsPerActor"],
-    "fileUpload.create", FileUploadError, "BAD_OPT");
-  numericBounds.requireNonNegativeFiniteIntIfPresent(opts.incompleteTtlMs,
-    "fileUpload.create: incompleteTtlMs", FileUploadError, "BAD_OPT");
-  numericBounds.requireNonNegativeFiniteIntIfPresent(opts.maxIdleMs,
-    "fileUpload.create: maxIdleMs", FileUploadError, "BAD_OPT");
-  numericBounds.requirePositiveFiniteIntIfPresent(opts.maxChunks,
-    "fileUpload.create: maxChunks", FileUploadError, "BAD_OPT");
-  validateOpts.auditShape(opts.audit, "fileUpload.create", FileUploadError);
-  validateOpts.observabilityShape(opts.observability, "fileUpload.create", FileUploadError);
-  validateOpts.optionalFunction(opts.clock, "fileUpload.create: clock", FileUploadError);
-  // allowedFileTypes — operator's MIME allowlist. Empty / undefined
-  // disables the gate. Setting it without wiring a fileType primitive
-  // is a misconfig — the gate would have nothing to enforce against.
-  validateOpts.optionalNonEmptyStringArray(opts.allowedFileTypes,
-    "fileUpload.create: allowedFileTypes", FileUploadError, "BAD_OPT");
-  if (Array.isArray(opts.allowedFileTypes) && opts.allowedFileTypes.length > 0 &&
-      (!opts.fileType || typeof opts.fileType.detect !== "function")) {
-    throw _err("BAD_OPT",
-      "fileUpload.create: allowedFileTypes is set but fileType primitive is not wired " +
-      "(pass fileType: b.fileType so the framework can sniff magic bytes at finalize)");
-  }
-  // permissions — when set, must expose check(actor, scope) → boolean.
-  validateOpts.optionalObjectWithMethod(opts.permissions, "check",
-    "fileUpload.create: permissions", FileUploadError, "BAD_OPT",
-    "must be a b.permissions instance (check fn)");
-  // contentSafety — extension-keyed gate map for per-extension content
-  // validation. Default behaviour: when undefined, the framework wires
-  // b.guardAll.byExtension({ profile: "strict" }) automatically so every
-  // shipped guard is ON by default. Explicit opt-out: contentSafety:
-  // null (audited at create() time so a security review can reconstruct
-  // which deploys disabled the default-on protection).
-  // Example: contentSafety: { ".csv": b.guardCsv.gate({ profile: "strict" }) }
-  if (opts.contentSafety !== undefined && opts.contentSafety !== null) {
-    validateOpts.optionalPlainObject(opts.contentSafety,
-      "fileUpload.create: contentSafety", FileUploadError, "BAD_OPT",
-      "must be a plain { ext: gate } object, null to opt out, or " +
-      "undefined for the default-on b.guardAll wiring");
-    var safetyKeys = Object.keys(opts.contentSafety);
-    for (var sk = 0; sk < safetyKeys.length; sk++) {
-      var ext = safetyKeys[sk];
-      var g = opts.contentSafety[ext];
-      if (!g || typeof g.check !== "function") {
+  validateOpts.shape(opts, {
+    stagingDir: function (v, label) {
+      validateOpts.requireNonEmptyString(v, label, FileUploadError);
+      if (!nodePath.isAbsolute(v)) {
+        throw _err("BAD_OPT", "fileUpload.create: stagingDir must be an absolute path, got " +
+          JSON.stringify(v));
+      }
+    },
+    onFinalize: "optional-function",
+    onChunk:    "optional-function",
+    // Byte / count caps — finite positive ints; TTL/idle windows allow 0.
+    maxFileBytes:             "optional-positive-finite-int",
+    maxChunkBytes:            "optional-positive-finite-int",
+    maxStreamReassemblyBytes: "optional-positive-finite-int",
+    maxStagingBytes:          "optional-positive-finite-int",
+    maxActiveUploadsPerActor: "optional-positive-finite-int",
+    maxChunks:                "optional-positive-finite-int",
+    incompleteTtlMs:          "optional-non-negative-finite-int",
+    maxIdleMs:                "optional-non-negative-finite-int",
+    audit:         function (v) { validateOpts.auditShape(v, "fileUpload.create", FileUploadError); },
+    observability: function (v) { validateOpts.observabilityShape(v, "fileUpload.create", FileUploadError); },
+    clock:         "optional-function",
+    // allowedFileTypes — operator's MIME allowlist. Empty / undefined
+    // disables the gate. Setting it without wiring a fileType primitive
+    // is a misconfig — the gate would have nothing to enforce against.
+    allowedFileTypes: function (v, label) {
+      validateOpts.optionalNonEmptyStringArray(v, label, FileUploadError, "BAD_OPT");
+      if (Array.isArray(v) && v.length > 0 &&
+          (!opts.fileType || typeof opts.fileType.detect !== "function")) {
         throw _err("BAD_OPT",
-          "fileUpload.create: contentSafety[" + JSON.stringify(ext) +
-          "] must be a gate (b.guardCsv.gate / b.guardHtml.gate / etc.)");
+          "fileUpload.create: allowedFileTypes is set but fileType primitive is not wired " +
+          "(pass fileType: b.fileType so the framework can sniff magic bytes at finalize)");
       }
-    }
-  }
-  // filenameSafety — single gate for filename validation. Default: on.
-  // Operator opts out with filenameSafety: null (audited).
-  if (opts.filenameSafety !== undefined && opts.filenameSafety !== null) {
-    validateOpts.optionalObjectWithMethod(opts.filenameSafety, "check",
-      "fileUpload.create: filenameSafety", FileUploadError, "BAD_OPT",
-      "must be a gate (b.guardFilename.gate(...)), null to opt out, or " +
-      "undefined for the default-on wiring");
-  }
+    },
+    // permissions — when set, must expose check(actor, scope) → boolean.
+    permissions: function (v, label) {
+      validateOpts.optionalObjectWithMethod(v, "check", label, FileUploadError, "BAD_OPT",
+        "must be a b.permissions instance (check fn)");
+    },
+    // contentSafety — extension-keyed gate map for per-extension content
+    // validation. Default behaviour: when undefined, the framework wires
+    // b.guardAll.byExtension({ profile: "strict" }) automatically so every
+    // shipped guard is ON by default. Explicit opt-out: contentSafety:
+    // null (audited at create() time so a security review can reconstruct
+    // which deploys disabled the default-on protection).
+    // Example: contentSafety: { ".csv": b.guardCsv.gate({ profile: "strict" }) }
+    contentSafety: function (v, label) {
+      if (v === undefined || v === null) return;
+      validateOpts.optionalPlainObject(v, label, FileUploadError, "BAD_OPT",
+        "must be a plain { ext: gate } object, null to opt out, or " +
+        "undefined for the default-on b.guardAll wiring");
+      var safetyKeys = Object.keys(v);
+      for (var sk = 0; sk < safetyKeys.length; sk++) {
+        var ext = safetyKeys[sk];
+        var g = v[ext];
+        if (!g || typeof g.check !== "function") {
+          throw _err("BAD_OPT",
+            "fileUpload.create: contentSafety[" + JSON.stringify(ext) +
+            "] must be a gate (b.guardCsv.gate / b.guardHtml.gate / etc.)");
+        }
+      }
+    },
+    // filenameSafety — single gate for filename validation. Default: on.
+    // Operator opts out with filenameSafety: null (audited).
+    filenameSafety: function (v, label) {
+      if (v === undefined || v === null) return;
+      validateOpts.optionalObjectWithMethod(v, "check", label, FileUploadError, "BAD_OPT",
+        "must be a gate (b.guardFilename.gate(...)), null to opt out, or " +
+        "undefined for the default-on wiring");
+    },
+    // fileType — magic-byte sniffer (b.fileType) consumed at finalize when
+    // allowedFileTypes is set; validated here so it can't be passed un-typed.
+    fileType: function (v, label) {
+      if (v === undefined || v === null) return;
+      validateOpts.optionalObjectWithMethod(v, "detect", label, FileUploadError, "BAD_OPT",
+        "must be a b.fileType instance (detect fn)");
+    },
+    // Reason strings recorded when a default-on safety is explicitly disabled.
+    contentSafetyDisabledReason:  "optional-string",
+    filenameSafetyDisabledReason: "optional-string",
+  }, "fileUpload.create", FileUploadError, "BAD_OPT", { exhaustive: true });
 }
 
 /**
@@ -698,7 +712,7 @@ function create(opts) {
       throw _err("EMPTY_CHUNK",
         "fileUpload.acceptChunk: body is empty (0 bytes)");
     }
-    if (body.length > maxChunkBytes) {
+    if (safeBuffer.byteLengthOf(body) > maxChunkBytes) {
       _emitObs("fileUpload.chunk_too_large", 1);
       throw _err("CHUNK_TOO_LARGE",
         "fileUpload.acceptChunk: chunk body is " + body.length +

package/lib/vendor/blamejs/lib/flag-evaluation-context.js

@@ -17,6 +17,7 @@
  */
 
 var nodeCrypto    = require("node:crypto");
+var pick          = require("./pick");
 var validateOpts  = require("./validate-opts");
 var lazyRequire   = require("./lazy-require");
 var { defineClass } = require("./framework-error");
@@ -33,7 +34,7 @@ function _normalize(input, label) {
   var out = {};
   for (var key in input) {
     if (!Object.prototype.hasOwnProperty.call(input, key)) continue;
-    if (key === "__proto__" || key === "constructor" || key === "prototype") {
+    if (pick.isPoisonedKey(key)) {
       continue;                                          // poisoned-keys defense
     }
     out[key] = input[key];
@@ -55,12 +56,8 @@ function merge(base, overlay) {
   var b = _normalize(base, "merge.base");
   var o = _normalize(overlay, "merge.overlay");
   var out = {};
-  for (var k1 in b) {
-    if (Object.prototype.hasOwnProperty.call(b, k1)) out[k1] = b[k1];
-  }
-  for (var k2 in o) {
-    if (Object.prototype.hasOwnProperty.call(o, k2)) out[k2] = o[k2];
-  }
+  validateOpts.assignOwnEnumerable(out, b);
+  validateOpts.assignOwnEnumerable(out, o);
   return Object.freeze(out);
 }
 
@@ -110,7 +107,7 @@ function fromRequest(req, opts) {
   if (opts.extra && typeof opts.extra === "object") {
     for (var k in opts.extra) {
       if (Object.prototype.hasOwnProperty.call(opts.extra, k)) {
-        if (k === "__proto__" || k === "constructor" || k === "prototype") continue;
+        if (pick.isPoisonedKey(k)) continue;
         ctx[k] = opts.extra[k];
       }
     }