@blamejs/blamejs-shop 0.4.56 → 0.4.58

package/lib/vendor/blamejs/lib/pipl-cn.js

@@ -159,43 +159,50 @@ function _requireRecordedAt(value, label) {
 function sccFilingAssessment(opts) {
   validateOpts.requireObject(opts, "b.pipl.sccFilingAssessment: opts", PiplError, "pipl/bad-opts");
   validateOpts(opts, SCC_ASSESSMENT_ALLOWED_KEYS, "b.pipl.sccFilingAssessment");
-  validateOpts.requireNonEmptyString(opts.assessmentId,
-    "b.pipl.sccFilingAssessment: opts.assessmentId", PiplError, "pipl/bad-assessment-id");
-  validateOpts.requireNonEmptyString(opts.transferType,
-    "b.pipl.sccFilingAssessment: opts.transferType", PiplError, "pipl/bad-transfer-type");
-  validateOpts.requireNonEmptyString(opts.recipientJurisdiction,
-    "b.pipl.sccFilingAssessment: opts.recipientJurisdiction", PiplError, "pipl/bad-recipient");
+  validateOpts.shape(opts, {
+    assessmentId:          { rule: "required-string", code: "pipl/bad-assessment-id", label: "b.pipl.sccFilingAssessment: opts.assessmentId" },
+    transferType:          { rule: "required-string", code: "pipl/bad-transfer-type", label: "b.pipl.sccFilingAssessment: opts.transferType" },
+    recipientJurisdiction: { rule: "required-string", code: "pipl/bad-recipient", label: "b.pipl.sccFilingAssessment: opts.recipientJurisdiction" },
+    dataCategories: function (value) {
+      if (!Array.isArray(value) || value.length === 0) {
+        throw new PiplError("pipl/bad-data-categories",
+          "b.pipl.sccFilingAssessment: opts.dataCategories must be a non-empty array of strings");
+      }
+      validateOpts.optionalNonEmptyStringArray(value,
+        "b.pipl.sccFilingAssessment: opts.dataCategories", PiplError, "pipl/bad-data-categories");
+    },
+    legalBasis: function (value) {
+      if (LEGAL_BASES.indexOf(value) === -1) {
+        throw new PiplError("pipl/bad-legal-basis",
+          "b.pipl.sccFilingAssessment: opts.legalBasis must be one of " +
+          LEGAL_BASES.join(" | ") + " (PIPL Art. 38(1)) — got " + JSON.stringify(value));
+      }
+    },
+    volume: function (value) {
+      if (typeof value !== "number" || !isFinite(value) || value < 0) {
+        throw new PiplError("pipl/bad-volume",
+          "b.pipl.sccFilingAssessment: opts.volume must be a non-negative finite number (data-subject count)");
+      }
+    },
+    sensitivePI: function (value) {
+      if (typeof value !== "boolean") {
+        throw new PiplError("pipl/bad-sensitive-pi",
+          "b.pipl.sccFilingAssessment: opts.sensitivePI must be a boolean");
+      }
+    },
+    ciio:                  { rule: "optional-boolean", code: "pipl/bad-ciio", label: "b.pipl.sccFilingAssessment: opts.ciio" },
+    importantData:         { rule: "optional-boolean", code: "pipl/bad-important-data", label: "b.pipl.sccFilingAssessment: opts.importantData" },
+    cumulativePI:          { rule: "optional-non-negative", code: "pipl/bad-cumulative-pi", label: "b.pipl.sccFilingAssessment: opts.cumulativePI" },
+    cumulativeSensitivePI: { rule: "optional-non-negative", code: "pipl/bad-cumulative-sensitive-pi", label: "b.pipl.sccFilingAssessment: opts.cumulativeSensitivePI" },
+    recordedAt: function (value) {
+      _requireRecordedAt(value, "b.pipl.sccFilingAssessment: opts.recordedAt");
+    },
+  }, "b.pipl.sccFilingAssessment: opts", PiplError, "pipl/bad-opts", { allow: ["audit"] });
 
-  if (!Array.isArray(opts.dataCategories) || opts.dataCategories.length === 0) {
-    throw new PiplError("pipl/bad-data-categories",
-      "b.pipl.sccFilingAssessment: opts.dataCategories must be a non-empty array of strings");
-  }
-  validateOpts.optionalNonEmptyStringArray(opts.dataCategories,
-    "b.pipl.sccFilingAssessment: opts.dataCategories", PiplError, "pipl/bad-data-categories");
-
-  if (LEGAL_BASES.indexOf(opts.legalBasis) === -1) {
-    throw new PiplError("pipl/bad-legal-basis",
-      "b.pipl.sccFilingAssessment: opts.legalBasis must be one of " +
-      LEGAL_BASES.join(" | ") + " (PIPL Art. 38(1)) — got " + JSON.stringify(opts.legalBasis));
-  }
-
-  if (typeof opts.volume !== "number" || !isFinite(opts.volume) || opts.volume < 0) {
-    throw new PiplError("pipl/bad-volume",
-      "b.pipl.sccFilingAssessment: opts.volume must be a non-negative finite number (data-subject count)");
-  }
-  if (typeof opts.sensitivePI !== "boolean") {
-    throw new PiplError("pipl/bad-sensitive-pi",
-      "b.pipl.sccFilingAssessment: opts.sensitivePI must be a boolean");
-  }
-
-  var ciio = opts.ciio === undefined ? false
-    : validateOpts.optionalBoolean(opts.ciio, "b.pipl.sccFilingAssessment: opts.ciio", PiplError, "pipl/bad-ciio");
-  var importantData = opts.importantData === undefined ? false
-    : validateOpts.optionalBoolean(opts.importantData, "b.pipl.sccFilingAssessment: opts.importantData", PiplError, "pipl/bad-important-data");
-  var cumulativePI = opts.cumulativePI === undefined ? 0
-    : validateOpts.optionalFiniteNonNegative(opts.cumulativePI, "b.pipl.sccFilingAssessment: opts.cumulativePI", PiplError, "pipl/bad-cumulative-pi");
-  var cumulativeSensitivePI = opts.cumulativeSensitivePI === undefined ? 0
-    : validateOpts.optionalFiniteNonNegative(opts.cumulativeSensitivePI, "b.pipl.sccFilingAssessment: opts.cumulativeSensitivePI", PiplError, "pipl/bad-cumulative-sensitive-pi");
+  var ciio = opts.ciio === undefined ? false : opts.ciio;
+  var importantData = opts.importantData === undefined ? false : opts.importantData;
+  var cumulativePI = opts.cumulativePI === undefined ? 0 : opts.cumulativePI;
+  var cumulativeSensitivePI = opts.cumulativeSensitivePI === undefined ? 0 : opts.cumulativeSensitivePI;
 
   var recordedAt = _requireRecordedAt(opts.recordedAt, "b.pipl.sccFilingAssessment: opts.recordedAt");
   // Resolve + shape-validate the audit sink at the entry-point tier (THROWS
@@ -306,30 +313,33 @@ function sccFilingAssessment(opts) {
 function securityAssessmentCertificate(opts) {
   validateOpts.requireObject(opts, "b.pipl.securityAssessmentCertificate: opts", PiplError, "pipl/bad-opts");
   validateOpts(opts, SECURITY_CERT_ALLOWED_KEYS, "b.pipl.securityAssessmentCertificate");
-  validateOpts.requireNonEmptyString(opts.certId,
-    "b.pipl.securityAssessmentCertificate: opts.certId", PiplError, "pipl/bad-cert-id");
-  validateOpts.requireNonEmptyString(opts.assessmentScope,
-    "b.pipl.securityAssessmentCertificate: opts.assessmentScope", PiplError, "pipl/bad-scope");
-  validateOpts.requireNonEmptyString(opts.dataExporter,
-    "b.pipl.securityAssessmentCertificate: opts.dataExporter", PiplError, "pipl/bad-exporter");
-  validateOpts.requireNonEmptyString(opts.overseasRecipient,
-    "b.pipl.securityAssessmentCertificate: opts.overseasRecipient", PiplError, "pipl/bad-recipient");
-
-  if (RISK_RATINGS.indexOf(opts.riskRating) === -1) {
-    throw new PiplError("pipl/bad-risk-rating",
-      "b.pipl.securityAssessmentCertificate: opts.riskRating must be one of " +
-      RISK_RATINGS.join(" | ") + " — got " + JSON.stringify(opts.riskRating));
-  }
-
-  if (!Array.isArray(opts.safeguards) || opts.safeguards.length === 0) {
-    throw new PiplError("pipl/bad-safeguards",
-      "b.pipl.securityAssessmentCertificate: opts.safeguards must be a non-empty array of strings");
-  }
-  validateOpts.optionalNonEmptyStringArray(opts.safeguards,
-    "b.pipl.securityAssessmentCertificate: opts.safeguards", PiplError, "pipl/bad-safeguards");
+  validateOpts.shape(opts, {
+    certId:            { rule: "required-string", code: "pipl/bad-cert-id", label: "b.pipl.securityAssessmentCertificate: opts.certId" },
+    assessmentScope:   { rule: "required-string", code: "pipl/bad-scope", label: "b.pipl.securityAssessmentCertificate: opts.assessmentScope" },
+    dataExporter:      { rule: "required-string", code: "pipl/bad-exporter", label: "b.pipl.securityAssessmentCertificate: opts.dataExporter" },
+    overseasRecipient: { rule: "required-string", code: "pipl/bad-recipient", label: "b.pipl.securityAssessmentCertificate: opts.overseasRecipient" },
+    riskRating: function (value) {
+      if (RISK_RATINGS.indexOf(value) === -1) {
+        throw new PiplError("pipl/bad-risk-rating",
+          "b.pipl.securityAssessmentCertificate: opts.riskRating must be one of " +
+          RISK_RATINGS.join(" | ") + " — got " + JSON.stringify(value));
+      }
+    },
+    safeguards: function (value) {
+      if (!Array.isArray(value) || value.length === 0) {
+        throw new PiplError("pipl/bad-safeguards",
+          "b.pipl.securityAssessmentCertificate: opts.safeguards must be a non-empty array of strings");
+      }
+      validateOpts.optionalNonEmptyStringArray(value,
+        "b.pipl.securityAssessmentCertificate: opts.safeguards", PiplError, "pipl/bad-safeguards");
+    },
+    filingRef:         { rule: "optional-string", code: "pipl/bad-filing-ref", label: "b.pipl.securityAssessmentCertificate: opts.filingRef" },
+    recordedAt: function (value) {
+      _requireRecordedAt(value, "b.pipl.securityAssessmentCertificate: opts.recordedAt");
+    },
+  }, "b.pipl.securityAssessmentCertificate: opts", PiplError, "pipl/bad-opts", { allow: ["audit"] });
 
-  var filingRef = validateOpts.optionalNonEmptyString(opts.filingRef,
-    "b.pipl.securityAssessmentCertificate: opts.filingRef", PiplError, "pipl/bad-filing-ref");
+  var filingRef = opts.filingRef;
 
   var recordedAt = _requireRecordedAt(opts.recordedAt, "b.pipl.securityAssessmentCertificate: opts.recordedAt");
   // Entry-point shape-validate the audit sink (THROWS) before the drop-silent

package/lib/vendor/blamejs/lib/privacy-pass.js

@@ -36,6 +36,7 @@
 
 var nodeCrypto = require("node:crypto");
 var bCrypto = require("./crypto");
+var safeBuffer = require("./safe-buffer");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -58,12 +59,13 @@ function _b64urlPadded(buf) {
   return s;
 }
 
-function _bytes(x, what) {
-  if (Buffer.isBuffer(x)) return x;
-  if (x instanceof Uint8Array) return Buffer.from(x);
-  if (typeof x === "string") return Buffer.from(x, "base64");
-  throw new PrivacyPassError("privacy-pass/bad-bytes", "privacyPass: " + what + " must be a Buffer / Uint8Array / base64 string");
-}
+var _bytes = safeBuffer.makeByteCoercer({
+  errorClass:    PrivacyPassError,
+  typeCode:      "privacy-pass/bad-bytes",
+  messagePrefix: "privacyPass: ",
+  messageSuffix: " must be a Buffer / Uint8Array / base64 string",
+  encoding:      "base64",
+});
 
 // Import the issuer public key and capture the SubjectPublicKeyInfo
 // bytes used to derive token_key_id. When the caller supplies the

package/lib/vendor/blamejs/lib/problem-details.js

@@ -378,11 +378,8 @@ function fromError(err, opts2) {
  *   // res.statusCode: 400
  */
 function respond(res, problem, req) {
-  if (!res || typeof res !== "object" || typeof res.setHeader !== "function" ||
-      typeof res.end !== "function") {
-    throw new ProblemDetailsError("problem-details/bad-res",
-      "respond: res must be an HTTP response object (setHeader + end)", true);
-  }
+  validateOpts.requireMethods(res, ["setHeader", "end"],
+    "respond: res (HTTP response object)", ProblemDetailsError, "problem-details/bad-res", true);
   if (!problem || typeof problem !== "object" || Array.isArray(problem)) {
     throw new ProblemDetailsError("problem-details/bad-problem",
       "respond: problem must be a non-null object", true);

package/lib/vendor/blamejs/lib/pubsub.js

@@ -41,6 +41,7 @@ var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var safeJson = require("./safe-json");
 var validateOpts = require("./validate-opts");
+var boundedMap = require("./bounded-map");
 var { defineClass } = require("./framework-error");
 
 var audit  = lazyRequire(function () { return require("./audit"); });
@@ -58,12 +59,8 @@ function _err(code, message) { return new PubsubError(code, message, true); }
 function _resolveBackend(opts) {
   var requested = opts.backend;
   if (requested && typeof requested === "object") {
-    if (typeof requested.publishRemote !== "function" ||
-        typeof requested.start !== "function" ||
-        typeof requested.stop !== "function") {
-      throw _err("BAD_BACKEND",
-        "pubsub: custom backend must implement { publishRemote, start, stop }");
-    }
+    validateOpts.requireMethods(requested, ["publishRemote", "start", "stop"],
+      "pubsub: custom backend", PubsubError, "BAD_BACKEND", true);
     return Object.assign({ name: "custom" }, requested);
   }
   if (!requested || requested === "local") {
@@ -347,8 +344,7 @@ function create(opts) {
       throw _err("BAD_OPT", "pubsub.subscribe: handler must be a function");
     }
     var rec = { channel: channel, handler: handler, isPattern: false };
-    var set = exactSubs.get(channel);
-    if (!set) { set = new Set(); exactSubs.set(channel, set); }
+    var set = boundedMap.getOrInsert(exactSubs, channel, function () { return new Set(); });
     set.add(rec);
     // Remote subscribe is fire-and-forget from the caller's perspective;
     // the redis backend awaits the SUBSCRIBE ack internally before its

package/lib/vendor/blamejs/lib/redact.js

@@ -37,6 +37,7 @@
  */
 
 var C = require("./constants");
+var safeBuffer = require("./safe-buffer");
 var lazyRequire = require("./lazy-require");
 var safeJson = require("./safe-json");
 var validateOpts = require("./validate-opts");
@@ -149,7 +150,7 @@ var VALUE_DETECTORS = [
     name:        "connection-string",
     test:        function (v) {
       if (typeof v !== "string" || v.length < C.BYTES.bytes(8)) return false; // bound BEFORE regex test
-      if (v.length > C.BYTES.kib(8)) return false;
+      if (safeBuffer.byteLengthOf(v) > C.BYTES.kib(8)) return false;
       // user may be empty (e.g. redis://:password@host); password
       // segment is required to flag this as a credentialed URI.
       return /\b[a-zA-Z][a-zA-Z0-9+.-]*:\/\/[^\s:/?#]*:[^\s@/?#]+@/.test(v);

package/lib/vendor/blamejs/lib/render.js

@@ -28,6 +28,8 @@
  *   Server-side HTML / JSON / XML response helpers.
  */
 
+var validateOpts = require("./validate-opts");
+
 var DEFAULT_CHARSET = "utf-8";
 
 function _alreadyDone(res) {
@@ -53,8 +55,8 @@ function _writeResponse(res, status, headers, body) {
 function _mergedHeaders(base, extra) {
   if (!extra) return base;
   var out = {};
-  for (var k in base)  { if (Object.prototype.hasOwnProperty.call(base,  k)) out[k] = base[k]; }
-  for (var j in extra) { if (Object.prototype.hasOwnProperty.call(extra, j)) out[j] = extra[j]; }
+  validateOpts.assignOwnEnumerable(out, base);
+  validateOpts.assignOwnEnumerable(out, extra);
   return out;
 }
 

package/lib/vendor/blamejs/lib/request-helpers.js

@@ -42,6 +42,8 @@
 // every consumer reads HTTP_STATUS.<NAME> rather than the underlying
 // integer, so the hex form is purely an internal storage detail.
 var structuredFields = require("./structured-fields");
+var pick = require("./pick");
+var codepointClass = require("./codepoint-class");
 
 var HTTP_STATUS = Object.freeze({
   OK:                            0xC8,
@@ -468,6 +470,91 @@ function resolveRoute(req) {
   return qIdx === -1 ? url : url.slice(0, qIdx);
 }
 
+/**
+ * @primitive  b.requestHelpers.makeSkipMatcher
+ * @signature  b.requestHelpers.makeSkipMatcher(opts, label)
+ * @since      0.15.13
+ * @status     stable
+ * @related    b.requestHelpers.resolveRoute
+ *
+ * Build a `(req) => boolean` path-match predicate shared by the state-change
+ * guards (`csrfProtect` / `fetchMetadata` / `botGuard` / `rateLimit`) AND the
+ * route-exemption / mount checks in `auth.accessLock`, `middleware.ageGate`,
+ * `middleware.botDisclose`, and `middleware.dailyByteQuota` — so a single route
+ * can be exempted (or a middleware mounted on a path subset) without each caller
+ * re-rolling the loop. `opts.skipPaths` entries are validated at build time —
+ * each must be a string or a RegExp — so an operator typo dies at boot, not on
+ * the first request; the optional `opts.skip(req)` predicate is validated the
+ * same way.
+ *
+ * A STRING entry matches on a SEGMENT BOUNDARY, not a raw prefix: `"/api"`
+ * matches `/api` and `/api/x` but NOT `/apixyz` — a raw `startsWith` would skip
+ * the guard on an unintended sibling path (a guard-bypass class). An entry that
+ * already ends in `/` is itself a segment prefix. Pass `exact: true` to require
+ * a whole-path match (no descendant). A RegExp entry uses `.test(path)`. The
+ * tested path is `req.pathname || req.url || req.originalUrl || "/"` with the
+ * query string stripped (matching is on the path, never the query). A `skip`
+ * predicate that throws is treated as "do not skip", so a buggy exemption can
+ * only keep the guard ON, never silently bypass it.
+ *
+ * @opts
+ *   skipPaths:  Array<string|RegExp>,   // string = segment-boundary match; RegExp = .test(path)
+ *   exact:      boolean,                // string entries match whole-path only (no descendant). default false
+ *   skip:       function,               // (req) => boolean, optional route-aware predicate
+ *
+ * @example
+ *   var shouldSkip = b.requestHelpers.makeSkipMatcher(
+ *     { skipPaths: ["/healthz", /^\/webhooks\//] }, "middleware.csrfProtect");
+ *   if (shouldSkip(req)) return next();
+ */
+// _skipStrMatch — does the request path match a single STRING skip entry?
+// SEGMENT-BOUNDARY semantics, NOT a raw `startsWith`: entry "/api" matches
+// "/api" and "/api/x" but NOT "/apixyz" (a raw prefix would wrongly skip the
+// guard on the sibling path — a guard-bypass class). An entry that already
+// ends in "/" is itself a segment prefix ("/webhooks/" matches "/webhooks/x").
+// `exact` restricts to a whole-path equality (no descendant match).
+function _skipStrMatch(path, entry, exact) {
+  if (exact) return path === entry;
+  if (entry.charAt(entry.length - 1) === "/") return path.indexOf(entry) === 0;
+  return path === entry || path.indexOf(entry + "/") === 0;
+}
+
+function makeSkipMatcher(opts, label) {
+  opts = opts || {};
+  label = label || "makeSkipMatcher";
+  var skipPaths = opts.skipPaths || [];
+  if (!Array.isArray(skipPaths)) {
+    throw new TypeError(label + ": skipPaths must be an array of string prefixes or RegExp");
+  }
+  for (var i = 0; i < skipPaths.length; i++) {
+    if (typeof skipPaths[i] !== "string" && !(skipPaths[i] instanceof RegExp)) {
+      throw new TypeError(label + ": skipPaths[" + i + "] must be a string prefix or RegExp, got " +
+        typeof skipPaths[i]);
+    }
+  }
+  var skipFn = opts.skip;
+  if (skipFn !== undefined && skipFn !== null && typeof skipFn !== "function") {
+    throw new TypeError(label + ": skip must be a function (req) => boolean");
+  }
+  var exact = opts.exact === true;
+  return function _shouldSkip(req) {
+    var path = (req && (req.pathname || req.url || req.originalUrl)) || "/";
+    var qpos = path.indexOf("?");
+    if (qpos !== -1) path = path.slice(0, qpos);   // match on the path, never the query string
+    for (var j = 0; j < skipPaths.length; j++) {
+      var entry = skipPaths[j];
+      if (typeof entry === "string" ? _skipStrMatch(path, entry, exact) : entry.test(path)) {
+        return true;
+      }
+    }
+    if (skipFn) {
+      try { return skipFn(req) === true; }
+      catch (_e) { return false; }
+    }
+    return false;
+  };
+}
+
 /**
  * @primitive b.requestHelpers.captureResponseStatus
  * @signature b.requestHelpers.captureResponseStatus(res, onEnd)
@@ -667,11 +754,8 @@ function extractBearer(req) {
   if (raw.indexOf(",") !== -1) return null;
   // Reject ASCII control characters BEFORE prefix-matching so a header
   // like "Bearer\rinjected" never reaches consumers.
-  for (var ci = 0; ci < raw.length; ci += 1) {
-    var cc = raw.charCodeAt(ci);
-    if (cc === 0x00 || cc === 0x0A || cc === 0x0D || cc === 0x09 || cc < 0x20 || cc === 0x7F) {
-      return null;
-    }
+  if (codepointClass.firstControlCharOffset(raw, { forbidTab: true }) !== -1) {
+    return null;
   }
   // RFC 6750 §2.1 — auth-scheme is case-insensitive. The "Bearer "
   // prefix + at least one token byte must be present; the literal
@@ -747,15 +831,58 @@ function safeHeadersDistinct(req) {
     // skip __proto__ / constructor / prototype as keys — they are the
     // exact strings that triggered the upstream getter throw, and we
     // refuse to surface them as accessible header names.
-    if (lower === "__proto__" || lower === "constructor" || lower === "prototype") continue;
+    if (pick.isPoisonedKey(lower)) continue;
     if (out[lower]) out[lower].push(value);
     else out[lower] = [value];
   }
   return out;
 }
 
+/**
+ * @primitive  b.requestHelpers.makeResourceAuditEmitter
+ * @signature  b.requestHelpers.makeResourceAuditEmitter(sink, resourceKind, idFor?)
+ * @since      0.15.13
+ * @status     stable
+ * @related    b.requestHelpers.extractActorContext
+ *
+ * Build a drop-silent audit emitter `(action, key, outcome, metadata, req)` for
+ * a request-scoped resource. The emitter is disabled when `sink` is falsy (the
+ * operator supplied no audit instance), so a primitive can wire it
+ * unconditionally and let the operator opt in by passing `opts.audit`. Each
+ * event carries `resource: { kind, id }` and, when a request is passed, the
+ * actor extracted from it (`extractActorContext`); a throwing sink is swallowed
+ * so audit emission can never break the request the event describes.
+ *
+ * The auth lockout / bot-challenge and session device-binding primitives emit
+ * this exact shape, varying only in the resource kind and how the id derives
+ * from the per-call key. `idFor(key)` maps the per-call key to the resource id
+ * (default: the key verbatim); pass it when the id needs a prefix or transform.
+ *
+ * @example
+ *   var emitAudit = b.requestHelpers.makeResourceAuditEmitter(
+ *     opts.audit, "auth.lockout", function (key) { return ns + ":" + key; });
+ *   emitAudit("locked", key, "denied", { attempts: n }, req);
+ */
+function makeResourceAuditEmitter(sink, resourceKind, idFor) {
+  return function (action, key, outcome, metadata, req) {
+    if (!sink) return;
+    try {
+      var event = {
+        action:   action,
+        outcome:  outcome,
+        resource: { kind: resourceKind, id: idFor ? idFor(key) : key },
+        metadata: metadata || {},
+      };
+      if (req) event.actor = extractActorContext(req);
+      sink.safeEmit(event);
+    } catch (_e) { /* audit best-effort — never let a sink throw escape */ }
+  };
+}
+
 module.exports = {
   resolveRoute:              resolveRoute,
+  makeResourceAuditEmitter:  makeResourceAuditEmitter,
+  makeSkipMatcher:           makeSkipMatcher,
   captureResponseStatus:     captureResponseStatus,
   extractActorContext:       extractActorContext,
   resolveActorWithOverride:  resolveActorWithOverride,

package/lib/vendor/blamejs/lib/restore.js

@@ -59,9 +59,8 @@ var bCrypto = require("./crypto");
 var numericChecks = require("./numeric-checks");
 var restoreBundle = require("./restore-bundle");
 var restoreRollback = require("./restore-rollback");
-var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
-var audit = lazyRequire(function () { return require("./audit"); });
+var auditEmit = require("./audit-emit");
 var { FrameworkError } = require("./framework-error");
 
 class RestoreError extends FrameworkError {
@@ -74,17 +73,9 @@ class RestoreError extends FrameworkError {
 }
 
 function _validateStorage(storage) {
-  if (!storage || typeof storage !== "object") {
-    throw new RestoreError("restore/bad-storage",
-      "storage backend is required (use b.backup.diskStorage or pass a custom one)");
-  }
-  var required = ["readBundle", "listBundles", "hasBundle"];
-  for (var i = 0; i < required.length; i++) {
-    if (typeof storage[required[i]] !== "function") {
-      throw new RestoreError("restore/bad-storage",
-        "storage backend missing method '" + required[i] + "'");
-    }
-  }
+  validateOpts.requireMethods(storage,
+    ["readBundle", "listBundles", "hasBundle"],
+    "storage backend", RestoreError, "restore/bad-storage");
 }
 
 function create(opts) {
@@ -152,15 +143,7 @@ function create(opts) {
     return { totalBytes: totalBytes, fileCount: fileCount };
   }
 
-  function _emitAudit(action, info, outcome) {
-    if (!auditOn) return;
-    audit().safeEmit({
-      action:   action,
-      outcome:  outcome,
-      metadata: info || {},
-      reason:   info && info.reason ? info.reason : null,
-    });
-  }
+  var _emitAudit = auditEmit.gatedReasonEmitter({ audit: auditOn });
 
   async function list() { return await storage.listBundles(); }
 

package/lib/vendor/blamejs/lib/retention.js

@@ -47,6 +47,7 @@ var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
 var safeSql = require("./safe-sql");
 var sql = require("./sql");
+var numericBounds = require("./numeric-bounds");
 var { defineClass } = require("./framework-error");
 
 var audit = lazyRequire(function () { return require("./audit"); });
@@ -116,11 +117,8 @@ function _validateRule(rule) {
     throw _err("BAD_RULE",
       "rule.action string must be 'erase' / 'delete' / 'soft-delete', got " + JSON.stringify(action));
   }
-  if (rule.batchSize !== undefined &&
-      (typeof rule.batchSize !== "number" || !isFinite(rule.batchSize) ||
-       rule.batchSize <= 0 || Math.floor(rule.batchSize) !== rule.batchSize)) {
-    throw _err("BAD_RULE", "rule.batchSize must be a positive integer");
-  }
+  numericBounds.requirePositiveFiniteIntIfPresent(rule.batchSize,
+    "rule.batchSize", RetentionError, "BAD_RULE");
   if (rule.softDeleteField !== undefined &&
       (typeof rule.softDeleteField !== "string" || rule.softDeleteField.length === 0)) {
     throw _err("BAD_RULE", "rule.softDeleteField must be a non-empty string");