@blamejs/blamejs-shop 0.4.56 → 0.4.58

package/lib/vendor/blamejs/lib/static.js

@@ -489,84 +489,147 @@ function _httpDate(date) {
 }
 
 function _validateCreateOpts(opts) {
-  validateOpts.requireObject(opts, "staticServe.create", StaticServeError);
-  validateOpts.requireNonEmptyString(opts.root, "staticServe.create: root", StaticServeError, "BAD_OPT");
+  // Declarative per-field validation. shape() runs requireObject(opts)
+  // itself (same "opts must be an object" / BAD_OPT contract the inline
+  // requireObject produced), then dispatches each field. A field whose
+  // check is one of the rule tokens maps to the token directly; a field
+  // with a bespoke message (mountPath / hashedPathPattern), a
+  // duck-typed-handle shape (permissions / cache / fileType / retention /
+  // revokeStore — each carrying its own operator-facing description), a
+  // numeric bound, or an audit/observability shape uses the
+  // validator-function hatch so the exact thrown code + message + label
+  // are preserved. Cross-field business logic (root existence,
+  // allowedFileTypes↔fileType wiring, the contentSafety map, the
+  // mountType enum, the quota↔cache requirement) stays below shape.
+  validateOpts.shape(opts, {
+    root: "required-string",
+    mountPath: function (value, _label, errorClass, code) {
+      // empty string is operator-permissible: "no mount, root is request URL"
+      if (typeof value === "string" && value.length === 0) return;
+      if (value !== undefined && value !== null && typeof value !== "string") {
+        throw errorClass.factory(code, "staticServe.create: mountPath must be a string");
+      }
+    },
+    hashedPathPattern: function (value, _label, errorClass, code) {
+      if (value !== undefined && value !== null && !(value instanceof RegExp)) {
+        throw errorClass.factory(code, "staticServe.create: hashedPathPattern must be a RegExp");
+      }
+    },
+    // indexFile === null is the operator's "disable" sentinel; the helper
+    // returns null/undefined unchanged so we keep that semantic.
+    indexFile: "optional-string",
+    defaultMaxAge: function (value, label, errorClass, code) {
+      numericBounds.requireNonNegativeFiniteIntIfPresent(value, label, errorClass, code);
+    },
+    contentTypes: "optional-plain-object",
+    // contentSafety — extension-keyed gate map. undefined → the framework
+    // wires b.guardAll.byExtension({ profile: "strict" }) so every shipped
+    // guard is ON by default; null is the explicit opt-out (audited at
+    // create() time); a plain { ext: gate } object validates each value is a
+    // gate (a .check fn). The label / code / message match the prior inline
+    // check exactly so a test asserting them still holds.
+    contentSafety: function (value, _label, errorClass, code) {
+      if (value === undefined || value === null) return;
+      validateOpts.optionalPlainObject(value,
+        "staticServe.create: contentSafety", errorClass, code,
+        "must be a plain { ext: gate } object, null to opt out, or " +
+        "undefined for the default-on b.guardAll wiring");
+      var safetyKeys = Object.keys(value);
+      for (var sk = 0; sk < safetyKeys.length; sk++) {
+        var ext = safetyKeys[sk];
+        var g = value[ext];
+        if (!g || typeof g.check !== "function") {
+          throw errorClass.factory(code,
+            "staticServe.create: contentSafety[" + JSON.stringify(ext) +
+            "] must be a gate (b.guardCsv.gate / b.guardHtml.gate / etc.)");
+        }
+      }
+    },
+    permissions: function (value, label, errorClass, code) {
+      validateOpts.optionalObjectWithMethod(value, "check", label, errorClass, code,
+        "must be a b.permissions instance (check fn)");
+    },
+    cache: function (value, label, errorClass, code) {
+      validateOpts.optionalObjectWithMethod(value, "get", label, errorClass, code,
+        "must be a b.cache instance (used for cluster-shared bandwidth + concurrency tracking)");
+    },
+    fileType: function (value, label, errorClass, code) {
+      validateOpts.optionalObjectWithMethod(value, "detect", label, errorClass, code,
+        "must be a b.fileType instance (magic-byte MIME detection)");
+    },
+    retention: function (value, label, errorClass, code) {
+      validateOpts.optionalObjectWithMethod(value, "isServable", label, errorClass, code,
+        "must expose isServable(absPath, ctx) → boolean (compliance retention check)");
+    },
+    revokeStore: function (value, label, errorClass, code) {
+      validateOpts.optionalObjectWithMethod(value, "isRevoked", label, errorClass, code,
+        "must expose isRevoked(key) and revoke(key) for force-revoke support");
+    },
+    allowedFileTypes: "optional-string-array",
+    audit: function (value, _label, errorClass, _code) {
+      validateOpts.auditShape(value, "staticServe.create", errorClass);
+    },
+    observability: function (value, _label, errorClass, _code) {
+      validateOpts.observabilityShape(value, "staticServe.create", errorClass);
+    },
+    onServe: "optional-function",
+    onError: "optional-function",
+    acceptRanges: "optional-boolean",
+    auditSuccess: "optional-boolean",
+    auditFailures: "optional-boolean",
+    safeAttachmentForRiskyMimes: "optional-boolean",
+    forceAttachmentForNonText: "optional-boolean",
+    safeRenderSvg: "optional-boolean",
+    safeRenderPdf: "optional-boolean",
+    maxBytesPerActorPerWindowMs: function (value, label, errorClass, code) {
+      numericBounds.requireNonNegativeFiniteIntIfPresent(value, label, errorClass, code);
+    },
+    maxBytesAllActorsPerWindowMs: function (value, label, errorClass, code) {
+      numericBounds.requireNonNegativeFiniteIntIfPresent(value, label, errorClass, code);
+    },
+    bandwidthWindowMs: function (value, label, errorClass, code) {
+      numericBounds.requirePositiveFiniteIntIfPresent(value, label, errorClass, code);
+    },
+    maxConcurrentDownloadsPerActor: function (value, label, errorClass, code) {
+      numericBounds.requireNonNegativeFiniteIntIfPresent(value, label, errorClass, code);
+    },
+    maxIdleMs: function (value, label, errorClass, code) {
+      numericBounds.requirePositiveFiniteIntIfPresent(value, label, errorClass, code);
+    },
+    // maxRangeBytes — per-range byte cap (slowloris-range defense). A
+    // positive finite integer caps Range requests; Infinity is the
+    // documented opt-out, so the numericBounds finite-int helpers (which
+    // reject Infinity) can't be used directly here.
+    maxRangeBytes: function (value, label, errorClass, code) {
+      if (value === undefined || value === null || value === Infinity) return;
+      numericBounds.requirePositiveFiniteInt(value, label, errorClass, code);
+    },
+  }, "staticServe.create", StaticServeError, "BAD_OPT", {
+    // contentSafetyDisabledReason (audit-row string) and mountType (curated
+    // | user-content enum) carry dedicated cross-field validation below
+    // shape — the audit reason read and the enum throw whose exact message a
+    // test asserts. Listing them here keeps that bespoke logic the single
+    // validator rather than re-checking the same key inside shape.
+    allow: ["contentSafetyDisabledReason", "mountType"],
+  });
+
   if (!nodeFs.existsSync(opts.root)) {
     throw _err("BAD_OPT", "staticServe.create: root does not exist: " + opts.root);
   }
-  if (typeof opts.mountPath === "string" && opts.mountPath.length === 0) {
-    // empty string is operator-permissible: "no mount, root is request URL"
-  } else if (opts.mountPath !== undefined && opts.mountPath !== null &&
-             typeof opts.mountPath !== "string") {
-    throw _err("BAD_OPT", "staticServe.create: mountPath must be a string");
-  }
-  if (opts.hashedPathPattern !== undefined && opts.hashedPathPattern !== null &&
-      !(opts.hashedPathPattern instanceof RegExp)) {
-    throw _err("BAD_OPT", "staticServe.create: hashedPathPattern must be a RegExp");
-  }
-  // indexFile === null is the operator's "disable" sentinel; the helper
-  // returns null/undefined unchanged so we keep that semantic.
-  validateOpts.optionalNonEmptyString(opts.indexFile,
-    "staticServe.create: indexFile", StaticServeError, "BAD_OPT");
-  numericBounds.requireNonNegativeFiniteIntIfPresent(opts.defaultMaxAge,
-    "staticServe.create: defaultMaxAge", StaticServeError, "BAD_OPT");
-  validateOpts.optionalPlainObject(opts.contentTypes,
-    "staticServe.create: contentTypes", StaticServeError, "BAD_OPT");
-  validateOpts.optionalObjectWithMethod(opts.permissions, "check",
-    "staticServe.create: permissions", StaticServeError, "BAD_OPT",
-    "must be a b.permissions instance (check fn)");
-  validateOpts.optionalObjectWithMethod(opts.cache, "get",
-    "staticServe.create: cache", StaticServeError, "BAD_OPT",
-    "must be a b.cache instance (used for cluster-shared bandwidth + concurrency tracking)");
-  validateOpts.optionalObjectWithMethod(opts.fileType, "detect",
-    "staticServe.create: fileType", StaticServeError, "BAD_OPT",
-    "must be a b.fileType instance (magic-byte MIME detection)");
-  validateOpts.optionalObjectWithMethod(opts.retention, "isServable",
-    "staticServe.create: retention", StaticServeError, "BAD_OPT",
-    "must expose isServable(absPath, ctx) → boolean (compliance retention check)");
-  validateOpts.optionalObjectWithMethod(opts.revokeStore, "isRevoked",
-    "staticServe.create: revokeStore", StaticServeError, "BAD_OPT",
-    "must expose isRevoked(key) and revoke(key) for force-revoke support");
-  validateOpts.optionalNonEmptyStringArray(opts.allowedFileTypes,
-    "staticServe.create: allowedFileTypes", StaticServeError, "BAD_OPT");
   if (Array.isArray(opts.allowedFileTypes) && opts.allowedFileTypes.length > 0 &&
       (!opts.fileType || typeof opts.fileType.detect !== "function")) {
     throw _err("BAD_OPT",
       "staticServe.create: allowedFileTypes is set but fileType primitive is not wired " +
       "(pass fileType: b.fileType so the framework can sniff magic bytes before serving)");
   }
-  validateOpts.auditShape(opts.audit, "staticServe.create", StaticServeError);
-  validateOpts.observabilityShape(opts.observability, "staticServe.create", StaticServeError);
-  validateOpts.optionalFunction(opts.onServe, "staticServe.create: onServe", StaticServeError);
-  validateOpts.optionalFunction(opts.onError, "staticServe.create: onError", StaticServeError);
-  // contentSafety — extension-keyed gate map. Default behaviour: when
-  // undefined, the framework wires b.guardAll.byExtension({ profile:
-  // "strict" }) automatically so every shipped guard is ON by default.
-  // Explicit opt-out: contentSafety: null (audited at create() time so
-  // a security review can reconstruct which deploys disabled the
-  // default-on protection).
+  // contentSafety — extension-keyed gate map; validated in the shape above
+  // (plain { ext: gate } object / null opt-out / undefined default-on).
+  // When undefined, the framework wires b.guardAll.byExtension({ profile:
+  // "strict" }) automatically so every shipped guard is ON by default;
+  // contentSafety: null is the explicit opt-out, audited at create() time so
+  // a security review can reconstruct which deploys disabled the default-on
+  // protection.
   // Example: contentSafety: { ".csv": b.guardCsv.gate({ profile: "strict" }) }
-  if (opts.contentSafety !== undefined && opts.contentSafety !== null) {
-    validateOpts.optionalPlainObject(opts.contentSafety,
-      "staticServe.create: contentSafety", StaticServeError, "BAD_OPT",
-      "must be a plain { ext: gate } object, null to opt out, or " +
-      "undefined for the default-on b.guardAll wiring");
-    var safetyKeys = Object.keys(opts.contentSafety);
-    for (var sk = 0; sk < safetyKeys.length; sk++) {
-      var ext = safetyKeys[sk];
-      var g = opts.contentSafety[ext];
-      if (!g || typeof g.check !== "function") {
-        throw _err("BAD_OPT",
-          "staticServe.create: contentSafety[" + JSON.stringify(ext) +
-          "] must be a gate (b.guardCsv.gate / b.guardHtml.gate / etc.)");
-      }
-    }
-  }
-  validateOpts.optionalBoolean(opts.acceptRanges, "staticServe.create: acceptRanges", StaticServeError);
-  validateOpts.optionalBoolean(opts.auditSuccess, "staticServe.create: auditSuccess", StaticServeError);
-  validateOpts.optionalBoolean(opts.auditFailures, "staticServe.create: auditFailures", StaticServeError);
-  validateOpts.optionalBoolean(opts.safeAttachmentForRiskyMimes,
-    "staticServe.create: safeAttachmentForRiskyMimes", StaticServeError);
   // mountType — config-time enum. A typo ("usercontent", "uploads")
   // would silently fall back to the curated default and serve untrusted
   // HTML inline, so THROW at boot rather than mis-type the mount.
@@ -576,22 +639,6 @@ function _validateCreateOpts(opts) {
       "staticServe.create: mountType must be 'curated' (default) or " +
       "'user-content'; got " + JSON.stringify(opts.mountType));
   }
-  validateOpts.optionalBoolean(opts.forceAttachmentForNonText,
-    "staticServe.create: forceAttachmentForNonText", StaticServeError);
-  validateOpts.optionalBoolean(opts.safeRenderSvg,
-    "staticServe.create: safeRenderSvg", StaticServeError);
-  validateOpts.optionalBoolean(opts.safeRenderPdf,
-    "staticServe.create: safeRenderPdf", StaticServeError);
-  numericBounds.requireNonNegativeFiniteIntIfPresent(opts.maxBytesPerActorPerWindowMs,
-    "staticServe.create: maxBytesPerActorPerWindowMs", StaticServeError, "BAD_OPT");
-  numericBounds.requireNonNegativeFiniteIntIfPresent(opts.maxBytesAllActorsPerWindowMs,
-    "staticServe.create: maxBytesAllActorsPerWindowMs", StaticServeError, "BAD_OPT");
-  numericBounds.requirePositiveFiniteIntIfPresent(opts.bandwidthWindowMs,
-    "staticServe.create: bandwidthWindowMs", StaticServeError, "BAD_OPT");
-  numericBounds.requireNonNegativeFiniteIntIfPresent(opts.maxConcurrentDownloadsPerActor,
-    "staticServe.create: maxConcurrentDownloadsPerActor", StaticServeError, "BAD_OPT");
-  numericBounds.requirePositiveFiniteIntIfPresent(opts.maxIdleMs,
-    "staticServe.create: maxIdleMs", StaticServeError, "BAD_OPT");
   // Quotas require a cache for cluster-shared coordination.
   if ((opts.maxBytesPerActorPerWindowMs > 0 ||
        opts.maxBytesAllActorsPerWindowMs > 0 ||
@@ -701,20 +748,11 @@ async function integrity(absPath) {
 
 function create(opts) {
   opts = opts || {};
-  // The v0.6.x test surface called `validateOpts(opts, [...allowed], label)`
-  // for the unknown-key check. Preserve that gate in addition to the
-  // throw-at-config-time validation so tests catch typos.
-  validateOpts(opts, [
-    "root", "mountPath", "hashedPathPattern",
-    "indexFile", "defaultMaxAge", "contentTypes",
-    "permissions", "cache", "fileType", "retention", "revokeStore",
-    "allowedFileTypes", "audit", "observability", "onServe", "onError",
-    "acceptRanges", "auditSuccess", "auditFailures",
-    "maxBytesPerActorPerWindowMs", "maxBytesAllActorsPerWindowMs",
-    "bandwidthWindowMs", "maxConcurrentDownloadsPerActor", "maxIdleMs",
-    "contentSafety", "contentSafetyDisabledReason",
-    "mountType", "forceAttachmentForNonText", "safeRenderSvg", "safeRenderPdf",
-  ], "staticServe.create");
+  // The exhaustive shape() in _validateCreateOpts is the authoritative
+  // unknown-key gate: any opt not declared in its schema (nor listed in
+  // its options.allow pass-through) is rejected as an unknown opt, so the
+  // typo-catching the v0.6.x `validateOpts(opts, [...allowed])` call gave
+  // is now subsumed by the per-field validation below.
   _validateCreateOpts(opts);
   var cfg = validateOpts.applyDefaults(opts, DEFAULTS);
   var root            = nodePath.resolve(opts.root);

package/lib/vendor/blamejs/lib/storage.js

@@ -38,10 +38,12 @@
  *   Filesystem-and-cloud-backed object storage with sealed per-file encryption keys, classification routing, and residency enforcement.
  */
 var C = require("./constants");
+var safeBuffer = require("./safe-buffer");
 var { generateBytes, encryptPacked, decryptPacked } = require("./crypto");
 var objectStore = require("./object-store");
 var lazyRequire = require("./lazy-require");
 var numericBounds = require("./numeric-bounds");
+var codepointClass = require("./codepoint-class");
 var canonicalJson = require("./canonical-json");
 var { StorageError } = require("./framework-error");
 
@@ -950,7 +952,7 @@ function _validateAssemblyId(id) {
   for (var i = 0; i < id.length; i += 1) {
     var c = id.charCodeAt(i);
     // Refuse: C0 (0x00-0x1F), DEL (0x7F), slash, backslash, dot-prefix
-    if (c < 0x20 || c === 0x2F || c === 0x5C || c === 0x7F) {
+    if (codepointClass.isForbiddenControlChar(c, { forbidTab: true }) || c === 0x2F || c === 0x5C) {
       throw _err("INVALID_ARGUMENT",
         "chunkScratch: assemblyId carries forbidden character at byte " + i, true);
     }
@@ -1083,7 +1085,7 @@ function chunkScratch(opts) {
     if (!Buffer.isBuffer(args.data)) {
       throw _err("INVALID_ARGUMENT", "chunkScratch.saveChunk: data must be a Buffer", true);
     }
-    if (args.data.length > maxChunkBytes) {
+    if (safeBuffer.byteLengthOf(args.data) > maxChunkBytes) {
       throw _err("INVALID_ARGUMENT",
         "chunkScratch.saveChunk: chunk exceeds maxChunkBytes (" + args.data.length + " > " + maxChunkBytes + ")", true);
     }

package/lib/vendor/blamejs/lib/structured-fields.js

@@ -70,6 +70,7 @@
 // node:util is a builtin (no lib require cycle) — used for strict UTF-8
 // validation of RFC 9651 Display Strings.
 var TextDecoder = require("node:util").TextDecoder;
+var codepointClass = require("./codepoint-class");
 
 function splitTopLevel(s, sep) {
   if (typeof s !== "string") return [];
@@ -103,6 +104,261 @@ function splitTopLevel(s, sep) {
   return out;
 }
 
+/**
+ * @primitive b.structuredFields.splitUnquoted
+ * @signature b.structuredFields.splitUnquoted(s, sep)
+ * @since     0.15.13
+ * @status    stable
+ * @related   b.structuredFields.splitTopLevel
+ *
+ * Split `s` on every `sep` that falls OUTSIDE a `"..."` quoted run — the
+ * iCalendar / vCard variant of the quote-aware splitter. A `"` toggles the
+ * quoted state and there is NO backslash escaping of the quote (RFC 5545
+ * 3.1.1 / RFC 6350 3.3 QSAFE-CHAR excludes DQUOTE, so a `"` always opens or
+ * closes a run). This is deliberately simpler than `splitTopLevel`, which
+ * honours HTTP structured-field backslash-quote escapes; the two are NOT
+ * interchangeable. Accepts any single-character separator.
+ *
+ * @example
+ *   b.structuredFields.splitUnquoted('a;b="x;y";c', ";");
+ *   // returns ['a', 'b="x;y"', 'c']
+ */
+function splitUnquoted(s, sep) {
+  var out = [];
+  var inQ = false;
+  var start = 0;
+  for (var i = 0; i < s.length; i++) {
+    var c = s.charAt(i);
+    if (c === '"') { inQ = !inQ; continue; }
+    if (c === sep && !inQ) {
+      out.push(s.slice(start, i));
+      start = i + 1;
+    }
+  }
+  out.push(s.slice(start));
+  return out;
+}
+
+/**
+ * @primitive b.structuredFields.stripDoubleQuotes
+ * @signature b.structuredFields.stripDoubleQuotes(s)
+ * @since     0.15.13
+ * @status    stable
+ * @related   b.structuredFields.splitUnquoted, b.structuredFields.unquoteSfString
+ *
+ * Strip ONE layer of surrounding `"` from `s` when both ends are a double
+ * quote (length ≥ 2), otherwise return `s` unchanged. The plain DQUOTE
+ * unwrap used by the iCal / vCard parsers for a quoted parameter value —
+ * no backslash-escape processing (RFC 5545 3.1 / RFC 6350 5: a quoted
+ * param value is QSAFE-CHAR, which excludes DQUOTE, so there is nothing to
+ * unescape). Distinct from `unquoteSfString`, which decodes HTTP
+ * structured-field `\"` / `\\` escapes.
+ *
+ * @example
+ *   b.structuredFields.stripDoubleQuotes('"a;b"');
+ *   // returns 'a;b'
+ *
+ *   b.structuredFields.stripDoubleQuotes('plain');
+ *   // returns 'plain'
+ */
+function stripDoubleQuotes(s) {
+  if (s.length >= 2 && s.charAt(0) === '"' && s.charAt(s.length - 1) === '"') {
+    return s.slice(1, -1);
+  }
+  return s;
+}
+
+/**
+ * @primitive b.structuredFields.unfoldHeaderContinuations
+ * @signature b.structuredFields.unfoldHeaderContinuations(value)
+ * @since     0.15.13
+ * @status    stable
+ * @related   b.structuredFields.parseTagList
+ *
+ * Collapse RFC 5322 folding whitespace — a CRLF (or bare LF) followed by one
+ * or more spaces/tabs — back to a single space, reversing the line folding a
+ * header value may carry in transit. Used before parsing DKIM / ARC /
+ * Authentication-Results tag lists, where a folded `b=` / `bh=` value must be
+ * rejoined before its base64 is read.
+ *
+ * @example
+ *   b.structuredFields.unfoldHeaderContinuations("v=DKIM1;\r\n  k=rsa");
+ *   // returns "v=DKIM1; k=rsa"
+ */
+function unfoldHeaderContinuations(value) {
+  return String(value).replace(/\r?\n[ \t]+/g, " ");
+}
+
+/**
+ * @primitive b.structuredFields.parseKeyValuePiece
+ * @signature b.structuredFields.parseKeyValuePiece(piece, kvSep?, lowerKey?)
+ * @since     0.15.13
+ * @status    stable
+ * @related   b.structuredFields.parseTagList, b.structuredFields.splitTopLevel
+ *
+ * Parse ONE already-split list piece into a `{ key, value }` pair: `key` is the
+ * text before the first `kvSep` (default "="), trimmed and — unless `lowerKey`
+ * is `false` — lower-cased; `value` is the raw remainder (the caller trims /
+ * unquotes / sf-string-parses it per its own grammar). A piece with NO `kvSep`
+ * is a "bare" item — `value` is null — which the caller handles per its grammar
+ * (skip it, or treat as a flag-style directive).
+ *
+ * The shared per-pair step behind every `key=value` list parser: the naive
+ * `parseTagList` loop AND the quote-aware parsers that first `splitTopLevel`
+ * then parse each piece (Cache-Control directives, Client-Hints brand params,
+ * Content-Type parameters). `lowerKey:false` serves the rare grammar whose key
+ * is case-sensitive (a verbatim tag-list passthrough).
+ *
+ * @example
+ *   b.structuredFields.parseKeyValuePiece("Max-Age=60");   // → { key: "max-age", value: "60" }
+ *   b.structuredFields.parseKeyValuePiece("no-store");      // → { key: "no-store", value: null }
+ *   b.structuredFields.parseKeyValuePiece("Key=a=b", "=", false); // → { key: "Key", value: "a=b" }
+ */
+function parseKeyValuePiece(piece, kvSep, lowerKey) {
+  var sep = kvSep || "=";
+  var at = piece.indexOf(sep);
+  var rawKey = (at === -1 ? piece : piece.slice(0, at)).trim();
+  var key = lowerKey === false ? rawKey : rawKey.toLowerCase();
+  return { key: key, value: at === -1 ? null : piece.slice(at + sep.length) };
+}
+
+/**
+ * @primitive b.structuredFields.parseTagList
+ * @signature b.structuredFields.parseTagList(input, opts?)
+ * @since     0.15.13
+ * @status    stable
+ * @related   b.structuredFields.splitTopLevel
+ *
+ * Parse a NAIVE delimited `key<kvSep>value` tag list into an ordered
+ * array of `[key, value]` pairs. This is the non-quote-aware sibling
+ * of `splitTopLevel`: it is for grammars whose RFC forbids the DQUOTE
+ * structured-string form, so a bare `split` is correct and a
+ * quote-aware walk would be wrong — DKIM (RFC 6376 §3.2), DMARC
+ * (RFC 7489 §6.4), ARC (RFC 8617 §4), BIMI (RFC 9091 §4), and the
+ * MTA-STS policy grammar (RFC 8461, line/colon delimited).
+ *
+ * Pairs are returned (not a map) so a caller whose grammar permits a
+ * repeated key — MTA-STS `mx:` lines list one host each — keeps every
+ * occurrence; a caller wanting last-wins map semantics folds the
+ * pairs into a plain object itself. Order is preserved, so a caller
+ * that throws on a malformed value throws at the same point it would
+ * have mid-loop.
+ *
+ * Entries that are empty after trimming, or carry no `kvSep`, are
+ * skipped (matching every shipped parser's prior behavior).
+ *
+ * @opts
+ *   sep:          string|RegExp,  // entry separator. default: ";"  (MTA-STS uses /\r?\n/)
+ *   kvSep:        string,         // key/value separator. default: "="  (MTA-STS uses ":")
+ *   unfold:       boolean,        // collapse CRLF+WSP folds to a space first (DKIM FWS). default: false
+ *   stripValueWs: boolean,        // strip all whitespace inside each value (DKIM/ARC FWS). default: false
+ *   lowerKey:     boolean,        // lower-case each key. default: true (set false to preserve case)
+ *
+ * @example
+ *   b.structuredFields.parseTagList("v=DKIM1; k=rsa; p=MIGf");
+ *   // → [ ["v", "DKIM1"], ["k", "rsa"], ["p", "MIGf"] ]
+ *
+ *   b.structuredFields.parseTagList("version:STSv1\nmx:a.example\nmx:b.example",
+ *     { sep: /\r?\n/, kvSep: ":" });
+ *   // → [ ["version","STSv1"], ["mx","a.example"], ["mx","b.example"] ]
+ */
+function parseTagList(input, opts) {
+  opts = opts || {};
+  var sep = opts.sep === undefined ? ";" : opts.sep;
+  var kvSep = opts.kvSep === undefined ? "=" : opts.kvSep;
+  var s = String(input);
+  if (opts.unfold) s = unfoldHeaderContinuations(s);
+  var kvps = parseKeyValuePieces(s.split(sep), 0, kvSep, opts.lowerKey);
+  var out = [];
+  forEachKeyValue(kvps, function (key, val) {
+    if (opts.stripValueWs) val = val.replace(/\s+/g, "");
+    out.push([key, val]);
+  });
+  return out;
+}
+
+/**
+ * @primitive b.structuredFields.parseKeyValuePieces
+ * @signature b.structuredFields.parseKeyValuePieces(pieces, startIndex?, kvSep?, lowerKey?)
+ * @since     0.15.13
+ * @status    stable
+ * @related   b.structuredFields.parseKeyValuePiece, b.structuredFields.parseTagList
+ *
+ * Iterate an already-split list of structured-field pieces, trimming each,
+ * dropping empties, and parsing the survivors into `{ key, value }` records
+ * via `parseKeyValuePiece`. `startIndex` skips a leading non-pair token (the
+ * media type in a `Content-Type`, the brand in a `Sec-CH-UA` member); `kvSep`
+ * overrides the default `"="`; `lowerKey:false` preserves key case for a
+ * case-sensitive grammar.
+ *
+ * The split is left to the caller because the boundary discipline differs by
+ * grammar — `splitTopLevel` honours quotes/parens for RFC 8941 lists, while a
+ * plain `String(value).split(";")` is right where inner separators cannot be
+ * quoted. Per-piece dispatch (unquote, numeric coercion, poisoned-key drops)
+ * stays with the caller; this owns only the uniform iterate-trim-skip-parse
+ * spine the parsers shared verbatim.
+ *
+ * @opts
+ *   startIndex: number,   // default: 0 — first piece treated as a key/value pair
+ *   kvSep:      string,   // default: "=" — key/value separator within a piece
+ *   lowerKey:   boolean,  // default: true — lower-case each parsed key
+ *
+ * @example
+ *   var kvps = b.structuredFields.parseKeyValuePieces(
+ *     b.structuredFields.splitTopLevel("max-age=600, immutable", ","));
+ *   // → [ { key: "max-age", value: "600" }, { key: "immutable", value: null } ]
+ */
+function parseKeyValuePieces(pieces, startIndex, kvSep, lowerKey) {
+  var out = [];
+  for (var i = startIndex || 0; i < pieces.length; i += 1) {
+    var p = pieces[i].trim();
+    if (p.length === 0) continue;
+    out.push(parseKeyValuePiece(p, kvSep, lowerKey));
+  }
+  return out;
+}
+
+/**
+ * @primitive b.structuredFields.forEachKeyValue
+ * @signature b.structuredFields.forEachKeyValue(kvps, handler)
+ * @since     0.15.13
+ * @status    stable
+ * @related   b.structuredFields.parseKeyValuePieces, b.structuredFields.parseTagList
+ *
+ * Consume the `{ key, value }` records from `parseKeyValuePieces`: skip
+ * the bare entries (those with a `null` value — a key that carried no
+ * separator), trim each surviving value, and invoke
+ * `handler(key, trimmedValue, index)`. The mirror of
+ * `parseKeyValuePieces` on the consuming side — that primitive owns the
+ * parse spine, this owns the iterate-skip-bare-trim spine every header
+ * parser repeated verbatim before dispatching.
+ *
+ * Per-key dispatch (sf-string unquoting, numeric coercion, poisoned-key
+ * drops, building a typed result) stays in the handler — a handler that
+ * `return`s skips the current entry, exactly like a `continue`. Parsers
+ * that instead treat a bare key as meaningful (a value-less directive)
+ * iterate the records directly rather than calling this.
+ *
+ * @example
+ *   var b = require("blamejs");
+ *
+ *   var out = {};
+ *   var kvps = b.structuredFields.parseKeyValuePieces("a=1; b=2".split(";"));
+ *   b.structuredFields.forEachKeyValue(kvps, function (key, value) {
+ *     out[key] = value;
+ *   });
+ *   // out → { a: "1", b: "2" }
+ */
+function forEachKeyValue(kvps, handler) {
+  if (typeof handler !== "function") {
+    throw new TypeError("structuredFields.forEachKeyValue: handler must be a function");
+  }
+  for (var i = 0; i < kvps.length; i += 1) {
+    if (kvps[i].value === null) continue;
+    handler(kvps[i].key, kvps[i].value.trim(), i);
+  }
+}
+
 /**
  * @primitive b.structuredFields.refuseControlBytes
  * @signature b.structuredFields.refuseControlBytes(value, opts)
@@ -155,22 +411,18 @@ function refuseControlBytes(value, opts) {
   if (!opts.label || typeof opts.label !== "string") {
     throw new TypeError("refuseControlBytes: opts.label (non-empty string) is required");
   }
-  var allowHt = opts.allowHt !== false;
-  for (var i = 0; i < value.length; i += 1) {
-    var cc = value.charCodeAt(i);
-    if (allowHt && cc === 9) continue;                                                            // ASCII HT (folding whitespace)
-    if (cc < 32 || cc === 127) {                                                                  // C0 + DEL codepoint range
-      var msg = opts.label + ": value contains control characters (C0 / DEL)";
-      // opts.useNativeError === true → call the ErrorClass with a
-      // single-arg `message` (matches native Error / TypeError /
-      // RangeError signatures used by defensive request-shape
-      // readers). Default false → call with (code, message) which
-      // matches every framework-error class generated by `defineClass`.
-      if (opts.useNativeError === true) {
-        throw new opts.ErrorClass(msg);
-      }
-      throw new opts.ErrorClass(opts.code, msg);
+  var allowHt = opts.allowHt !== false;                                                            // ASCII HT (folding whitespace) permitted unless allowHt === false
+  if (codepointClass.firstControlCharOffset(value, { forbidTab: !allowHt }) !== -1) {              // C0 + DEL codepoint range
+    var msg = opts.label + ": value contains control characters (C0 / DEL)";
+    // opts.useNativeError === true → call the ErrorClass with a
+    // single-arg `message` (matches native Error / TypeError /
+    // RangeError signatures used by defensive request-shape
+    // readers). Default false → call with (code, message) which
+    // matches every framework-error class generated by `defineClass`.
+    if (opts.useNativeError === true) {
+      throw new opts.ErrorClass(msg);
     }
+    throw new opts.ErrorClass(opts.code, msg);
   }
 }
 
@@ -271,7 +523,7 @@ function containsControlBytes(value, opts) {
   for (var i = 0; i < value.length; i += 1) {
     var cc = value.charCodeAt(i);
     if (allowHt && cc === 9) continue;                                                            // ASCII HT (folding whitespace)
-    if (cc < 32 || cc === 127) return true;                                                       // C0 + DEL codepoint range
+    if (codepointClass.isForbiddenControlChar(cc, { forbidTab: true })) return true;                                                       // C0 + DEL codepoint range
   }
   return false;
 }
@@ -707,6 +959,13 @@ function serialize(value, type, opts) {
 
 module.exports = {
   splitTopLevel:        splitTopLevel,
+  splitUnquoted:        splitUnquoted,
+  stripDoubleQuotes:    stripDoubleQuotes,
+  parseTagList:         parseTagList,
+  unfoldHeaderContinuations: unfoldHeaderContinuations,
+  parseKeyValuePiece:   parseKeyValuePiece,
+  parseKeyValuePieces:  parseKeyValuePieces,
+  forEachKeyValue:      forEachKeyValue,
   refuseControlBytes:   refuseControlBytes,
   containsControlBytes: containsControlBytes,
   unquoteSfString:      unquoteSfString,

package/lib/vendor/blamejs/lib/tenant-quota.js

@@ -183,16 +183,7 @@ function create(opts) {
     return defaultBytesCap;
   }
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({
-        action:   action,
-        outcome:  outcome,
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* audit best-effort */ }
-  }
+  var _emitAudit = audit().namespaced(null, { audit: auditOn });
 
   function _emitMetric(name, n) {
     try { observability().safeEvent(name, n || 1, {}); }
@@ -375,16 +366,7 @@ function budget(opts) {
     return c;
   }
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({
-        action:   action,
-        outcome:  outcome,
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* audit best-effort */ }
-  }
+  var _emitAudit = audit().namespaced(null, { audit: auditOn });
 
   function _emitMetric(name, n) {
     try { observability().safeEvent(name, n || 1, {}); }