@blamejs/blamejs-shop 0.4.56 → 0.4.57

package/lib/vendor/blamejs/lib/tsa.js

@@ -53,6 +53,7 @@
 
 var nodeCrypto = require("node:crypto");
 var bCrypto = require("./crypto");
+var safeBuffer = require("./safe-buffer");
 var asn1 = require("./asn1-der");
 var cms = require("./cms-codec");
 var validateOpts = require("./validate-opts");
@@ -104,12 +105,12 @@ var DIGEST_OID_TO_NODE = {
   "2.16.840.1.101.3.4.2.10": "sha3-512",
 };
 
-function _bytes(x, what) {
-  if (Buffer.isBuffer(x)) return x;
-  if (x instanceof Uint8Array) return Buffer.from(x);
-  if (typeof x === "string") return Buffer.from(x, "utf8");
-  throw new TsaError("tsa/bad-bytes", "tsa: " + what + " must be Buffer / Uint8Array / string");
-}
+var _bytes = safeBuffer.makeByteCoercer({
+  errorClass:    TsaError,
+  typeCode:      "tsa/bad-bytes",
+  messagePrefix: "tsa: ",
+  messageSuffix: " must be Buffer / Uint8Array / string",
+});
 
 function _normHex(h) {
   return String(h).replace(/[^0-9a-fA-F]/g, "").replace(/^0+(?=.)/, "").toUpperCase();
@@ -658,15 +659,10 @@ function verifyToken(token, opts) {
       throw new TsaError("tsa/bad-trust-anchors",
         "tsa.verifyToken: trustAnchorsPem must be a non-empty PEM string or array of PEM strings");
     }
-    // A supplied opts.at must be a valid Date — an Invalid Date would
-    // make every validity-window comparison NaN (silently disabling it).
-    var at = tst.genTime;
-    if (opts.at !== undefined && opts.at !== null) {
-      if (!(opts.at instanceof Date) || !isFinite(opts.at.getTime())) {
-        throw new TsaError("tsa/bad-at", "tsa.verifyToken: opts.at must be a valid Date");
-      }
-      at = opts.at;
-    }
+    // A supplied opts.at must be a valid Date — an Invalid Date would make
+    // every validity-window comparison NaN (silently disabling it).
+    validateOpts.optionalDate(opts.at, "tsa.verifyToken: opts.at", TsaError, "tsa/bad-at");
+    var at = (opts.at !== undefined && opts.at !== null) ? opts.at : tst.genTime;
     _verifyChain(signerCertDer, sd.certificates, anchors, at);
   }
 

package/lib/vendor/blamejs/lib/validate-opts.js

@@ -28,6 +28,7 @@
  */
 
 var numericBounds = require("./numeric-bounds");
+var pick = require("./pick");
 
 function _format(primitive, unknownKey, allowedKeys) {
   return primitive + ": unknown option '" + unknownKey + "'. " +
@@ -78,13 +79,18 @@ function auditShape(audit, callerLabel, errorClass, code) {
 // _throw — shared error-emission for the optional* validators. Routes
 // through the caller's framework-error class when supplied, falls back
 // to plain Error so this helper itself stays decoupled from any one
-// error hierarchy.
-function _throw(errorClass, code, msg, defaultCode) {
+// error hierarchy. `permanent` (optional) is forwarded as the framework
+// error's third constructor argument so callers whose config-time failure
+// is non-retryable (a misconfigured dependency never becomes valid on
+// retry) keep that flag when they route through these validators instead
+// of hand-throwing; omitted → undefined → the class default (false), so
+// existing callers are unaffected.
+function _throw(errorClass, code, msg, defaultCode, permanent) {
   if (errorClass && errorClass.factory) {
-    throw errorClass.factory(code || "BAD_OPT", msg);
+    throw errorClass.factory(code || "BAD_OPT", msg, permanent);
   }
   if (typeof errorClass === "function") {
-    throw new errorClass(code || defaultCode, msg);
+    throw new errorClass(code || defaultCode, msg, permanent);
   }
   throw new Error(msg);
 }
@@ -132,6 +138,15 @@ function optionalFiniteNonNegative(value, label, errorClass, code) {
   return value;
 }
 
+function optionalDate(value, label, errorClass, code) {
+  if (value === undefined || value === null) return value;
+  if (!(value instanceof Date) || !isFinite(value.getTime())) {
+    _throw(errorClass, code, (label || "opt") + " must be a valid Date",
+           "validate-opts/bad-date");
+  }
+  return value;
+}
+
 function optionalPositiveFinite(value, label, errorClass, code) {
   if (value === undefined || value === null) return value;
   if (typeof value !== "number" || !isFinite(value) || value <= 0) {
@@ -218,18 +233,25 @@ function requireObject(opts, callerLabel, errorClass, code) {
 // (b.agent.*.reseal stores, b.dsr / b.outbox create() backends, etc.)
 // into one definition. Throws on null / non-object / any missing-or-
 // non-function method; returns obj on success.
-function requireMethods(obj, methods, callerLabel, errorClass, code) {
+//
+// `permanent` (optional) forwards to the framework error's permanent flag
+// — pass true for a config-time dependency check whose failure is not
+// retryable (a backend/store/vault missing its contract never becomes
+// valid on retry). Omitted → the error class default (false), matching
+// the historical bare `new Err(code, msg)` shape, so existing callers are
+// unchanged.
+function requireMethods(obj, methods, callerLabel, errorClass, code, permanent) {
   var label = callerLabel || "dependency";
   if (!obj || typeof obj !== "object") {
     _throw(errorClass, code, label + " must be an object exposing { " +
            methods.join(", ") + " }, got " + (obj === null ? "null" : typeof obj),
-           "validate-opts/bad-methods-object");
+           "validate-opts/bad-methods-object", permanent);
   }
   for (var i = 0; i < methods.length; i += 1) {
     if (typeof obj[methods[i]] !== "function") {
       _throw(errorClass, code, label + " must expose a " + methods[i] +
              "() method (requires { " + methods.join(", ") + " })",
-             "validate-opts/missing-method");
+             "validate-opts/missing-method", permanent);
     }
   }
   return obj;
@@ -331,6 +353,128 @@ function optionalPlainObject(value, label, errorClass, code, description) {
   return value;
 }
 
+// _SHAPE_RULES — rule-token → validator dispatch table for `shape`. Each
+// validator has the uniform (value, label, errorClass, code) signature, so the
+// table drives them all from a declarative schema.
+var _SHAPE_RULES = {
+  "required-string":          requireNonEmptyString,
+  "optional-string":          optionalNonEmptyString,
+  "optional-string-array":    optionalNonEmptyStringArray,
+  "optional-boolean":         optionalBoolean,
+  "optional-positive-int":    optionalPositiveInt,
+  "optional-positive-finite": optionalPositiveFinite,
+  "optional-non-negative":    optionalFiniteNonNegative,
+  "optional-date":            optionalDate,
+  "optional-function":        optionalFunction,
+  "optional-plain-object":    optionalPlainObject,
+  "optional-port":            optionalPort,
+  // numeric-bounds finite-int family (rejects Infinity/NaN, unlike the
+  // optional-positive-int sugar) — so byte/count caps declare in the shape
+  // rather than a separate numericBounds call outside it.
+  "optional-positive-finite-int":     numericBounds.requirePositiveFiniteIntIfPresent,
+  "optional-non-negative-finite-int": numericBounds.requireNonNegativeFiniteIntIfPresent,
+  "required-positive-finite-int":     numericBounds.requirePositiveFiniteInt,
+};
+
+// shape — declarative opts validator. Collapses the `requireObject(opts) +
+// requireNonEmptyString(opts.a) + optionalPositiveFinite(opts.b) + ...` preamble
+// that every create()/build() factory re-rolls into one schema-driven call.
+// The schema is expressive enough that a factory never has to contort its
+// validation to fit a fixed vocabulary — each opt's rule is ANY of:
+//
+//   - a rule TOKEN (see _SHAPE_RULES) — sugar for the common per-field checks,
+//     using the call-wide `code`;
+//   - a per-field DESCRIPTOR `{ rule: "<token>", code?, label? }` — keeps a
+//     DISTINCT per-field code (BAD_THIRD_PARTY vs BAD_CONSUMER_REF) or a custom
+//     label, so behavior a per-field test asserts is preserved;
+//   - an injected-DEPENDENCY `{ methods: [...], optional?, code?, label? }` —
+//     validated via requireMethods;
+//   - a NESTED `{ shape: {...}, optional?, code?, label? }` — recurses into a
+//     sub-object field (e.g. opts.authServer.{issuer,jwksUri});
+//   - an arbitrary VALIDATOR FUNCTION `(value, label, errorClass, code, opts)
+//     => void` that throws on invalid — the universal hatch for a bespoke check.
+//     It receives the whole `opts` as the 5th arg, so CROSS-FIELD logic ("field
+//     B required when opts.a === X", a custom message, a numeric-bounds call)
+//     lives IN the shape rather than as a hand-rolled check outside it.
+//
+// Validates `opts` is an object, then dispatches each declared field; returns
+// opts. An unknown rule token throws at call time — a schema typo is the
+// author's bug, surfaced loudly rather than silently skipping a field.
+//
+// The schema is ALWAYS the authoritative, exhaustive opts contract — there is
+// no opt-in: any key present on `opts` that the schema does not declare (nor
+// list in `options.allow`) is rejected. This is mandatory by design, so the
+// "future code adds an opt but forgets to validate it" gap cannot reopen — an
+// undeclared opt can't be silently consumed, because it is refused here;
+// adding it forces declaring its rule in the schema, where it is validated.
+// (A field declared in the schema is always validated; exhaustiveness adds the
+// converse — nothing reaches the body unvalidated.) `options.allow` is the only
+// escape: an explicit list of keys a factory forwards to a sub-component rather
+// than validating locally — there is no "skip the contract" mode.
+function shape(opts, schema, callerLabel, errorClass, code, options) {
+  requireObject(opts, callerLabel, errorClass, code);
+  var fields = Object.keys(schema);
+  for (var i = 0; i < fields.length; i += 1) {
+    var field = fields[i];
+    var rule = schema[field];
+    var fieldCode = code;
+    var label = (callerLabel || "opts") + ": " + field;
+    var value = opts[field];
+    // Arbitrary validator function — the universal hatch. Receives the whole
+    // `opts` as a 5th arg so a rule can do CROSS-FIELD validation (e.g. "field B
+    // is required when opts.a === 'material'") without dropping back to inline
+    // checks outside the shape.
+    if (typeof rule === "function") { rule(value, label, errorClass, fieldCode, opts); continue; }
+    if (rule && typeof rule === "object") {
+      if (Array.isArray(rule.methods)) {
+        if (rule.optional && (value === undefined || value === null)) continue;
+        requireMethods(value, rule.methods, rule.label || label, errorClass, rule.code || code, rule.permanent);
+        continue;
+      }
+      // Nested sub-object: validate it is an object, then recurse.
+      if (rule.shape && typeof rule.shape === "object") {
+        if (rule.optional && (value === undefined || value === null)) continue;
+        requireObject(value, rule.label || label, errorClass, rule.code || code);
+        shape(value, rule.shape, rule.label || label, errorClass, rule.code || code);
+        continue;
+      }
+      // Per-field descriptor: { rule, code?, label? }.
+      if (typeof rule.rule === "string") {
+        if (typeof rule.code === "string") fieldCode = rule.code;
+        if (typeof rule.label === "string") label = rule.label;
+        rule = rule.rule;
+      } else {
+        _throw(errorClass, code, (callerLabel || "opts") +
+               ": unsupported shape rule object for field " + field,
+               "validate-opts/bad-shape-rule");
+      }
+    }
+    if (rule === "required-object") { requireObject(value, label, errorClass, fieldCode); continue; }
+    var fn = _SHAPE_RULES[rule];
+    if (typeof fn !== "function") {
+      _throw(errorClass, code, (callerLabel || "opts") +
+             ": unknown shape rule " + JSON.stringify(rule) + " for field " + field,
+             "validate-opts/bad-shape-rule");
+    }
+    fn(value, label, errorClass, fieldCode);
+  }
+  // Exhaustive contract enforcement — always on (the schema is complete).
+  var declared = Object.create(null);
+  for (var d = 0; d < fields.length; d += 1) declared[fields[d]] = true;
+  var allowList = (options && options.allow) || [];
+  for (var a = 0; a < allowList.length; a += 1) declared[allowList[a]] = true;
+  var present = Object.keys(opts);
+  for (var p = 0; p < present.length; p += 1) {
+    if (!declared[present[p]]) {
+      _throw(errorClass, code, (callerLabel || "opts") +
+             ": unknown opt " + JSON.stringify(present[p]) +
+             " (not in the validated shape; add it to the schema or pass options.allow)",
+             "validate-opts/unknown-opt");
+    }
+  }
+  return opts;
+}
+
 // makeAuditEmitter — closure factory parallel to safeAsync.makeDropCallback.
 // Replaces the per-file `function _emit(action, info) { if (!audit) return;
 // try { audit.safeEmit(Object.assign({ action: action }, info || {})); }
@@ -412,7 +556,7 @@ function assignOwnEnumerable(target, source, reservedKeys) {
   var entries = [];
   for (var i = 0; i < keys.length; i += 1) {
     var k = keys[i];
-    if (k === "__proto__" || k === "constructor" || k === "prototype") continue;
+    if (pick.isPoisonedKey(k)) continue;
     if (reserved[k]) continue;
     entries.push([k, source[k]]);
   }
@@ -445,6 +589,7 @@ module.exports.auditShape = auditShape;
 module.exports.optionalBoolean = optionalBoolean;
 module.exports.optionalPositiveInt = optionalPositiveInt;
 module.exports.optionalFiniteNonNegative = optionalFiniteNonNegative;
+module.exports.optionalDate = optionalDate;
 module.exports.optionalPositiveFinite = optionalPositiveFinite;
 module.exports.optionalPort = optionalPort;
 module.exports.optionalFunction = optionalFunction;
@@ -456,6 +601,7 @@ module.exports.requireNonEmptyString = requireNonEmptyString;
 module.exports.observabilityShape = observabilityShape;
 module.exports.requireObject = requireObject;
 module.exports.requireMethods = requireMethods;
+module.exports.shape = shape;
 module.exports.applyDefaults = applyDefaults;
 module.exports.makeAuditEmitter = makeAuditEmitter;
 module.exports.makeNamespacedEmitters = makeNamespacedEmitters;

package/lib/vendor/blamejs/lib/vault/seal-pem-file.js

@@ -185,7 +185,6 @@ function sealPemFile(opts) {
   // optionalPositiveFinite above already threw on a bad-shaped opts.pollInterval;
   // here only undefined / null / valid-positive-finite remain.
   var pollInterval  = opts.pollInterval || DEFAULT_POLL_MS;
-  var auditOn       = opts.audit !== false;
   var onResealed    = typeof opts.onResealed === "function" ? opts.onResealed : null;
   var onError       = typeof opts.onError === "function" ? opts.onError : null;
   validateOpts.optionalPositiveFinite(opts.maxSourceBytes,
@@ -200,16 +199,7 @@ function sealPemFile(opts) {
   var resealing        = false;
   var pendingMtime     = null;
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({
-        action:   "vault.seal_pem_file." + action,
-        outcome:  outcome,
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent */ }
-  }
+  var _emitAudit = audit().namespaced("vault.seal_pem_file", opts.audit);
 
   function _writeSealed(plaintextBytes) {
     // atomicFile.writeSync already does the .tmp + fsync + rename +
@@ -274,43 +264,35 @@ function sealPemFile(opts) {
       // source isn't a symlink we don't expect, then read via fd so
       // a swap-after-stat doesn't change which bytes we read.
       try {
-        var lstat = nodeFs.lstatSync(source);
-        if (lstat.isSymbolicLink()) {
-          throw new SealPemFileError("seal-pem-file/symlink-refused",
-            "source is a symlink (refused; follow + re-stat opens TOCTOU)");
-        }
-        if (lstat.size > maxSourceBytes) {
-          throw new SealPemFileError("seal-pem-file/source-too-large",
-            "source size " + lstat.size + " exceeds maxSourceBytes " + maxSourceBytes);
-        }
-        // CodeQL js/file-system-race: the open-fd + fstat + inode-equality
-        // check (this block and the next) IS the TOCTOU defense. lstat ran
-        // above, then we open(O_NOFOLLOW-equivalent via the symlink refusal
-        // above) and rebind every subsequent measurement to the fd's inode.
-        // Any swap between lstat and open is detected by the fstat.ino !==
-        // lstat.ino branch below and refused as toctou-detected.
-        var fd = nodeFs.openSync(source, "r");
-        try {
-          var fstat = nodeFs.fstatSync(fd);
-          // H6 #3 — confirm the fd points at the same inode lstat saw.
-          if (fstat.ino !== lstat.ino || fstat.size > maxSourceBytes) {
-            throw new SealPemFileError("seal-pem-file/toctou-detected",
-              "source mutated between lstat and open (TOCTOU defense)");
-          }
-          plaintext = Buffer.alloc(fstat.size);
-          var read = 0;
-          while (read < fstat.size) {
-            var n = nodeFs.readSync(fd, plaintext, read, fstat.size - read, null);
-            if (n === 0) break;
-            read += n;
-          }
-          if (read !== fstat.size) {
-            throw new SealPemFileError("seal-pem-file/short-read",
-              "short read: " + read + " of " + fstat.size + " bytes");
-          }
-        } finally {
-          try { nodeFs.closeSync(fd); } catch (_e) { /* close best-effort */ }
-        }
+        // TOCTOU-safe read via atomic-file with the strongest guards:
+        // symlink refusal + inode-equality + a byte cap. The bespoke
+        // SealPemFileError codes/messages are preserved via errorFor; this
+        // call sits inside the outer try/catch that wraps any failure into
+        // seal-pem-file/source-read-failed + audit + the onError callback.
+        plaintext = atomicFile.fdSafeReadSync(source, {
+          refuseSymlink: true,
+          inodeCheck:    true,
+          maxBytes:      maxSourceBytes,
+          errorFor: function (kind, detail) {
+            if (kind === "symlink") {
+              return new SealPemFileError("seal-pem-file/symlink-refused",
+                "source is a symlink (refused; follow + re-stat opens TOCTOU)");
+            }
+            if (kind === "too-large") {
+              return new SealPemFileError("seal-pem-file/source-too-large",
+                "source size " + detail.size + " exceeds maxSourceBytes " + maxSourceBytes);
+            }
+            if (kind === "toctou") {
+              return new SealPemFileError("seal-pem-file/toctou-detected",
+                "source mutated between lstat and open (TOCTOU defense)");
+            }
+            if (kind === "short-read") {
+              return new SealPemFileError("seal-pem-file/short-read",
+                "short read: " + detail.read + " of " + detail.size + " bytes");
+            }
+            return undefined;
+          },
+        });
       }
       catch (e) {
         var err = new SealPemFileError("seal-pem-file/source-read-failed",

package/lib/vendor/blamejs/lib/vault-aad.js

@@ -48,6 +48,7 @@
 
 var lazyRequire     = require("./lazy-require");
 var validateOpts    = require("./validate-opts");
+var pick            = require("./pick");
 var C               = require("./constants");
 var { defineClass } = require("./framework-error");
 var VaultAadError = defineClass("VaultAadError", { alwaysPermanent: true });
@@ -80,7 +81,7 @@ function _canonicalize(parts) {
   chunks.push(Buffer.from([AAD_VERSION]));
   for (var i = 0; i < keys.length; i += 1) {
     var key = keys[i];
-    if (key === "__proto__" || key === "constructor" || key === "prototype") {
+    if (pick.isPoisonedKey(key)) {
       throw new VaultAadError("vault-aad/bad-aad",
         "AAD field name " + JSON.stringify(key) + " is forbidden (poisoned key)");
     }
@@ -130,7 +131,7 @@ function buildContextAad(parts) {
   var out = {};
   for (var k in parts) {
     if (!Object.prototype.hasOwnProperty.call(parts, k)) continue;
-    if (k === "__proto__" || k === "constructor" || k === "prototype") continue;
+    if (pick.isPoisonedKey(k)) continue;
     if (parts[k] == null) continue;
     out[k] = parts[k];
   }

package/lib/vendor/blamejs/lib/vc.js

@@ -316,13 +316,8 @@ async function verify(secured, opts) {
   if (!opts.publicKey && typeof opts.keyResolver !== "function") {
     throw new VcError("vc/no-key", "vc.verify: pass publicKey or keyResolver");
   }
-  var at = new Date();
-  if (opts.at !== undefined && opts.at !== null) {
-    if (!(opts.at instanceof Date) || !isFinite(opts.at.getTime())) {
-      throw new VcError("vc/bad-at", "vc.verify: opts.at must be a valid Date");
-    }
-    at = opts.at;
-  }
+  validateOpts.optionalDate(opts.at, "vc.verify: opts.at", VcError, "vc/bad-at");
+  var at = (opts.at !== undefined && opts.at !== null) ? opts.at : new Date();
 
   var result = await _verifySecured(secured, opts, JOSE_TYP, COSE_TYP);
 

package/lib/vendor/blamejs/lib/vex.js

@@ -475,18 +475,39 @@ function document(opts) {
     throw new VexError("vex/bad-opts",
       "document: opts must be a non-null object");
   }
-  validateOpts.requireNonEmptyString(opts.documentId,  "documentId",  VexError, "vex/missing-documentId");
-  validateOpts.requireNonEmptyString(opts.title,       "title",       VexError, "vex/missing-title");
-  validateOpts.requireNonEmptyString(opts.trackingId,  "trackingId",  VexError, "vex/missing-trackingId");
-  validateOpts.requireNonEmptyString(opts.trackingVersion, "trackingVersion", VexError, "vex/missing-trackingVersion");
-  validateOpts.requireNonEmptyString(opts.currentReleaseDate, "currentReleaseDate", VexError, "vex/missing-currentReleaseDate");
-  validateOpts.requireNonEmptyString(opts.initialReleaseDate, "initialReleaseDate", VexError, "vex/missing-initialReleaseDate");
-  if (!opts.publisher || typeof opts.publisher !== "object") {
-    throw new VexError("vex/missing-publisher",
-      "document: publisher object is required ({ name, namespace })");
-  }
-  validateOpts.requireNonEmptyString(opts.publisher.name,      "publisher.name",      VexError, "vex/missing-publisher-name");
-  validateOpts.requireNonEmptyString(opts.publisher.namespace, "publisher.namespace", VexError, "vex/missing-publisher-namespace");
+  validateOpts.shape(opts, {
+    documentId:         { rule: "required-string", code: "vex/missing-documentId",         label: "documentId" },
+    title:              { rule: "required-string", code: "vex/missing-title",              label: "title" },
+    trackingId:         { rule: "required-string", code: "vex/missing-trackingId",         label: "trackingId" },
+    trackingVersion:    { rule: "required-string", code: "vex/missing-trackingVersion",    label: "trackingVersion" },
+    currentReleaseDate: { rule: "required-string", code: "vex/missing-currentReleaseDate", label: "currentReleaseDate" },
+    initialReleaseDate: { rule: "required-string", code: "vex/missing-initialReleaseDate", label: "initialReleaseDate" },
+    // publisher is required; the missing/sub-field checks own their own
+    // codes (vex/missing-publisher{,-name,-namespace}) the test asserts
+    // on. A truthy non-plain-object (array / string) is rejected with
+    // vex/bad-opts (optional-plain-object semantics) BEFORE the absent
+    // check, then a null/undefined publisher throws vex/missing-publisher,
+    // then name/namespace are required non-empty strings.
+    publisher:          function (v, label, e, c) {
+      validateOpts.optionalPlainObject(v, label, e, c);
+      if (!v || typeof v !== "object") {
+        throw new VexError("vex/missing-publisher",
+          "document: publisher object is required ({ name, namespace })");
+      }
+      validateOpts.requireNonEmptyString(v.name,      "publisher.name",      VexError, "vex/missing-publisher-name");
+      validateOpts.requireNonEmptyString(v.namespace, "publisher.namespace", VexError, "vex/missing-publisher-namespace");
+    },
+    // The body's Array.isArray check throws vex/bad-statements; the shape
+    // only needs to accept the key (an array is not a plain object).
+    statements:         function () {},
+    tlp:                "optional-string",
+    lang:               "optional-string",
+    trackingStatus:     "optional-string",
+    productTreeNames:   "optional-plain-object",
+    distributionText:   { rule: "optional-string", code: "vex/bad-distribution-text", label: "document.distributionText" },
+    // distributor is copied onto distribution as-is when truthy.
+    distributor:        function () {},
+  }, "document", VexError, "vex/bad-opts");
   if (!Array.isArray(opts.statements)) {
     throw new VexError("vex/bad-statements",
       "document: statements must be an array of b.vex.statement objects");
@@ -530,7 +551,8 @@ function document(opts) {
     throw new VexError("vex/bad-product-tree-names",
       "document: productTreeNames must be a { <productId>: <displayName> } object");
   }
-  validateOpts.optionalNonEmptyString(opts.distributionText, "document.distributionText", VexError, "vex/bad-distribution-text");
+  // distributionText is validated by the shape's optional-string rule
+  // above (label "document.distributionText", code vex/bad-distribution-text).
   // FIRST TLP 2.0 + CSAF §3.2.1.12.1.1.1 — distribution.text is
   // REQUIRED when TLP label is RED or AMBER+STRICT (the
   // recipient-restricted tiers carry mandatory boilerplate prose).

package/lib/vendor/blamejs/lib/web-push-vapid.js

@@ -109,22 +109,25 @@ function buildVapidAuthHeader(opts) {
   validateOpts(opts, ["subscription", "contact", "privateKeyPem",
                        "publicKeyB64Url", "ttlSec"],
     "webPush.buildVapidAuthHeader");
-  if (!opts.subscription || typeof opts.subscription.endpoint !== "string") {
-    throw new WebPushError("web-push/bad-subscription",
-      "buildVapidAuthHeader: opts.subscription must include a string endpoint");
-  }
-  validateOpts.requireNonEmptyString(opts.contact, "contact",
-    WebPushError, "web-push/bad-contact");
-  if (!/^(mailto:|https:)/i.test(opts.contact)) {
-    throw new WebPushError("web-push/bad-contact",
-      "buildVapidAuthHeader: contact must start with 'mailto:' or 'https:' per RFC 8292 §2");
-  }
-  validateOpts.requireNonEmptyString(opts.privateKeyPem, "privateKeyPem",
-    WebPushError, "web-push/bad-key");
-  validateOpts.requireNonEmptyString(opts.publicKeyB64Url, "publicKeyB64Url",
-    WebPushError, "web-push/bad-key");
-  validateOpts.optionalPositiveFinite(opts.ttlSec, "webPush.buildVapidAuthHeader: ttlSec",
-    WebPushError, "web-push/bad-ttl");
+  validateOpts.shape(opts, {
+    subscription: function (value) {
+      if (!value || typeof value.endpoint !== "string") {
+        throw new WebPushError("web-push/bad-subscription",
+          "buildVapidAuthHeader: opts.subscription must include a string endpoint");
+      }
+    },
+    contact: function (value) {
+      validateOpts.requireNonEmptyString(value, "contact",
+        WebPushError, "web-push/bad-contact");
+      if (!/^(mailto:|https:)/i.test(value)) {
+        throw new WebPushError("web-push/bad-contact",
+          "buildVapidAuthHeader: contact must start with 'mailto:' or 'https:' per RFC 8292 §2");
+      }
+    },
+    privateKeyPem:   { rule: "required-string",          code: "web-push/bad-key", label: "privateKeyPem" },
+    publicKeyB64Url: { rule: "required-string",          code: "web-push/bad-key", label: "publicKeyB64Url" },
+    ttlSec:          { rule: "optional-positive-finite", code: "web-push/bad-ttl" },
+  }, "webPush.buildVapidAuthHeader", WebPushError, "web-push/bad-opts");
   var ttlSec = opts.ttlSec || C.TIME.hours(12);
   // Audience: origin of the subscription endpoint per RFC 8292 §2.
   var endpointUrl;
@@ -232,10 +235,10 @@ function encrypt(opts) {
     throw new WebPushError("web-push/bad-subscription",
       "encrypt: subscription must have a keys: { p256dh, auth } object");
   }
-  validateOpts.requireNonEmptyString(opts.subscription.keys.p256dh, "p256dh",
-    WebPushError, "web-push/bad-p256dh");
-  validateOpts.requireNonEmptyString(opts.subscription.keys.auth, "auth",
-    WebPushError, "web-push/bad-auth");
+  validateOpts.shape(opts.subscription.keys, {
+    p256dh: { rule: "required-string", code: "web-push/bad-p256dh", label: "p256dh" },
+    auth:   { rule: "required-string", code: "web-push/bad-auth",   label: "auth" },
+  }, "webPush.encrypt.keys", WebPushError, "web-push/bad-opts");
   var plaintext = Buffer.isBuffer(opts.payload) ? opts.payload
                 : typeof opts.payload === "string" ? Buffer.from(opts.payload, "utf8")
                 : null;