@blamejs/core 0.15.11 → 0.15.13

package/lib/observability.js

@@ -343,6 +343,98 @@ function safeEvent(name, value, labels) {
   catch (_e) { /* hot-path observability sink — drops silent on internal throws */ }
 }
 
+/**
+ * @primitive b.observability.safeEmit
+ * @signature b.observability.safeEmit(sink, name, value, labels)
+ * @since     0.15.13
+ * @related   b.observability.safeEvent, b.observability.event
+ *
+ * The sink-aware sibling of `safeEvent`: emit a metric event to an
+ * explicitly-configured observability `sink` (a per-instance
+ * observability object) when one is supplied, otherwise fall back to
+ * the global registry — each path wrapped in a try/catch so a
+ * misconfigured counter never crashes the request that triggered it.
+ * Replaces the `_emitObs` + `_safeGlobalObs` helper pair that the auth
+ * brute-force modules (bot-challenge / lockout / session-device-binding)
+ * each duplicated to route a configured observability instance with a
+ * global fallback.
+ *
+ * @example
+ *   b.observability.safeEmit(opts.observability, "auth.lockout.hit", 1,
+ *     { namespace: ns });
+ */
+function safeEmit(sink, name, value, labels) {
+  if (sink) {
+    try { sink.event(name, value, labels); }
+    catch (_e) { /* per-instance observability sink — drops silent */ }
+    return;
+  }
+  safeEvent(name, value, labels);
+}
+
+/**
+ * @primitive b.observability.makeCounterEmitter
+ * @signature b.observability.makeCounterEmitter(sink)
+ * @since      0.15.13
+ * @status     stable
+ * @related    b.observability.safeEmit, b.observability.namespaced
+ *
+ * Bind a per-instance counter emitter. Returns `(name, labels)` that
+ * increments metric `name` by 1 (with `labels`) on the supplied
+ * observability `sink`, drop-silent on a sink throw and falling back to
+ * the global tap when `sink` is null. The shorthand every primitive that
+ * accepts an `observability` instance wrapped in a private
+ * `_emitObs(name, labels)` closure around
+ * `safeEmit(obsInst, name, 1, labels)` — build it once with the instance
+ * and call the returned emitter.
+ *
+ * @example
+ *   var b = require("blamejs");
+ *   var emit = b.observability.makeCounterEmitter(myObsInstance);
+ *   emit("auth.lockout.tripped", { actor: "alice" });
+ */
+function makeCounterEmitter(sink) {
+  return function (name, labels) {
+    safeEmit(sink, name, 1, labels);
+  };
+}
+
+/**
+ * @primitive b.observability.namespaced
+ * @signature b.observability.namespaced(prefix, gateFlag?)
+ * @since     0.15.13
+ * @status    stable
+ * @related   b.observability.safeEvent, b.observability.event, b.audit.namespaced
+ *
+ * Build a drop-silent metric emitter bound to one name prefix — the shape every
+ * primitive hand-rolled as a private `_emitMetric(verb, n, labels)` closure
+ * (`try { observability().safeEvent("ns." + verb, n || 1, labels || {}); }
+ * catch {}`). The returned function prefixes `verb` with `prefix + "."`,
+ * defaults the value to `1` and labels to `{}`, and routes through `safeEvent`
+ * so a misconfigured counter / label name cannot crash the caller. The metric
+ * sibling of `b.audit.namespaced`. Metrics emit unconditionally by default;
+ * pass `gateFlag === false` to disable a primitive's own metrics in lockstep
+ * with its audit (the few primitives that gate both behind one `opts.audit`).
+ *
+ * @example
+ *   var emitMetric = b.observability.namespaced("network.byte_quota");
+ *   emitMetric("exceeded", 1, { key: k });
+ *   // → safeEvent("network.byte_quota.exceeded", 1, { key: k })
+ *   emitMetric("reset");
+ *   // → safeEvent("network.byte_quota.reset", 1, {})
+ */
+function namespaced(prefix, gateFlag) {
+  var on = gateFlag !== false;
+  return function (verb, n, labels) {
+    if (!on) return;
+    // module.exports.safeEvent (late-bound) so a test that stubs
+    // b.observability.safeEvent still observes the emit — the closures this
+    // replaces all called `observability().safeEvent(...)`.
+    try { module.exports.safeEvent(prefix + "." + verb, n || 1, labels || {}); }
+    catch (_e) { /* drop-silent — observability sink */ }
+  };
+}
+
 // timed — convenience wrapper that measures wall-clock duration of a
 // sync or async operation and emits a counter event with
 // duration_ms in the labels. Returns the wrapped function's return
@@ -870,6 +962,9 @@ module.exports = {
   tap:           tap,
   event:         event,
   safeEvent:     safeEvent,
+  safeEmit:      safeEmit,
+  makeCounterEmitter: makeCounterEmitter,
+  namespaced:    namespaced,
   timed:         timed,
   setTap:        setTap,
   setRedactor:   setRedactor,

package/lib/openapi-paths-builder.js

@@ -25,6 +25,7 @@
 
 var validateOpts = require("./validate-opts");
 var schemaWalk   = require("./openapi-schema-walk");
+var pick         = require("./pick");
 var { defineClass } = require("./framework-error");
 var OpenApiError = defineClass("OpenApiError", { alwaysPermanent: true });
 
@@ -44,7 +45,10 @@ function _extractPathParams(pathTemplate) {
 }
 
 function PathsBuilder() {
-  this._paths = {};
+  // null-proto so a urlPattern keyed into _paths (operator-supplied API path)
+  // can never reach Object.prototype — a "__proto__" / "constructor" path lands
+  // as an own property, not a prototype mutation (prototype-polluting-assignment).
+  this._paths = Object.create(null);
 }
 
 // _buildOperation — normalise a single Operation Object from operator
@@ -133,7 +137,7 @@ PathsBuilder.prototype.add = function (method, urlPattern, opts) {
     }
   }
 
-  if (!this._paths[urlPattern]) this._paths[urlPattern] = {};
+  if (!this._paths[urlPattern]) this._paths[urlPattern] = Object.create(null);
   if (this._paths[urlPattern][method.toLowerCase()]) {
     throw new OpenApiError("openapi/duplicate-operation",
       "paths.add: duplicate operation " + method.toUpperCase() + " " + urlPattern);
@@ -279,7 +283,7 @@ WebhooksBuilder.prototype.add = function (name, method, opts) {
   opts = opts || {};
   validateOpts.requireNonEmptyString(name, "webhook.add: name",
     OpenApiError, "openapi/bad-webhook");
-  if (name === "__proto__" || name === "constructor" || name === "prototype") {
+  if (pick.isPoisonedKey(name)) {
     throw new OpenApiError("openapi/bad-webhook",
       "webhook.add: name must not be a reserved object key (" + JSON.stringify(name) + ")");
   }

package/lib/otel-export.js

@@ -40,6 +40,7 @@
  * hand-rolled wire format with no compelling benefit at this scope.
  */
 var C = require("./constants");
+var boundedMap = require("./bounded-map");
 var canonicalJson = require("./canonical-json");
 var httpClient = require("./http-client");
 var observability = require("./observability");
@@ -144,11 +145,9 @@ function create(opts) {
     if (typeof name !== "string" || name.length === 0) return;
     var v = typeof value === "number" && isFinite(value) ? value : 1;
     var key = _bucketKey(name, attrs);
-    var b = counters.get(key);
-    if (!b) {
-      b = { name: name, attrs: attrs || {}, value: 0, startUnixNano: startUnixNano };
-      counters.set(key, b);
-    }
+    var b = boundedMap.getOrInsert(counters, key, function () {
+      return { name: name, attrs: attrs || {}, value: 0, startUnixNano: startUnixNano };
+    });
     b.value += v;
   }
 
@@ -157,11 +156,9 @@ function create(opts) {
     if (typeof name !== "string" || name.length === 0) return;
     if (typeof value !== "number" || !isFinite(value)) return;
     var key = _bucketKey(name, attrs);
-    var b = observations.get(key);
-    if (!b) {
-      b = { name: name, attrs: attrs || {}, sum: 0, count: 0, min: value, max: value, startUnixNano: startUnixNano };
-      observations.set(key, b);
-    }
+    var b = boundedMap.getOrInsert(observations, key, function () {
+      return { name: name, attrs: attrs || {}, sum: 0, count: 0, min: value, max: value, startUnixNano: startUnixNano };
+    });
     b.sum   += value;
     b.count += 1;
     if (value < b.min) b.min = value;

package/lib/outbox.js

@@ -208,29 +208,47 @@ function create(opts) {
     "envelope", "connectorName", "connectorVersion", "dbName",
   ], "outbox.create");
 
-  if (!opts.externalDb || typeof opts.externalDb.transaction !== "function") {
-    throw new OutboxError("outbox/bad-externaldb",
-      "outbox.create: externalDb must be the b.externalDb namespace (with transaction/query)");
-  }
-  validateOpts.requireNonEmptyString(opts.table,
-    "outbox.create: table", OutboxError, "outbox/bad-table");
-  // Validate the table identifier at create-time so a bad name throws at
-  // boot, not at first query. b.sql re-quotes the name by construction on
-  // every emitted statement (the builder owns identifier quoting now).
-  _validateTableName(opts.table);
-
-  if (typeof opts.publisher !== "function") {
-    throw new OutboxError("outbox/bad-publisher",
-      "outbox.create: publisher must be an async function (event) → void");
-  }
-  validateOpts.optionalPositiveFinite(opts.pollIntervalMs,
-    "outbox.create: pollIntervalMs", OutboxError, "outbox/bad-opts");
-  validateOpts.optionalPositiveFinite(opts.batchSize,
-    "outbox.create: batchSize", OutboxError, "outbox/bad-opts");
-  validateOpts.optionalPositiveFinite(opts.maxAttempts,
-    "outbox.create: maxAttempts", OutboxError, "outbox/bad-opts");
-  validateOpts.optionalPositiveFinite(opts.claimReclaimMs,
-    "outbox.create: claimReclaimMs", OutboxError, "outbox/bad-opts");
+  validateOpts.shape(opts, {
+    externalDb: function (v) {
+      if (!v || typeof v.transaction !== "function") {
+        throw new OutboxError("outbox/bad-externaldb",
+          "outbox.create: externalDb must be the b.externalDb namespace (with transaction/query)");
+      }
+    },
+    table: function (v) {
+      validateOpts.requireNonEmptyString(v,
+        "outbox.create: table", OutboxError, "outbox/bad-table");
+      // Validate the table identifier at create-time so a bad name throws
+      // at boot, not at first query. b.sql re-quotes the name by
+      // construction on every emitted statement (the builder owns
+      // identifier quoting now).
+      _validateTableName(v);
+    },
+    publisher: function (v) {
+      if (typeof v !== "function") {
+        throw new OutboxError("outbox/bad-publisher",
+          "outbox.create: publisher must be an async function (event) → void");
+      }
+    },
+    pollIntervalMs: "optional-positive-finite",
+    batchSize:      "optional-positive-finite",
+    maxAttempts:    "optional-positive-finite",
+    claimReclaimMs: "optional-positive-finite",
+    retryBackoff: {
+      optional: true,
+      shape: {
+        initialMs: "optional-positive-finite",
+        maxMs:     "optional-positive-finite",
+        factor:    "optional-positive-finite",
+      },
+    },
+    audit:            "optional-boolean",
+    name:             "optional-string",
+    envelope:         "optional-string",
+    connectorName:    "optional-string",
+    connectorVersion: "optional-string",
+    dbName:           "optional-string",
+  }, "outbox.create", OutboxError, "outbox/bad-opts");
 
   var pollIntervalMs = opts.pollIntervalMs || DEFAULT_POLL_MS;
   var batchSize      = opts.batchSize      || DEFAULT_BATCH_SIZE;
@@ -268,20 +286,8 @@ function create(opts) {
     return Math.floor(ms);
   }
 
-  function _emitMetric(verb, n) {
-    try { observability().safeEvent("outbox." + verb, n || 1, {}); }
-    catch (_e) { /* drop-silent */ }
-  }
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({
-        action:   action,
-        outcome:  outcome,
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent */ }
-  }
+  var _emitMetric = observability().namespaced("outbox");
+  var _emitAudit = audit().namespaced(null, { audit: auditOn });
 
   async function enqueue(event, txn) {
     if (!txn || typeof txn.query !== "function") {

package/lib/pagination.js

@@ -50,6 +50,7 @@ var nodeCrypto = require("node:crypto");
 var C = require("./constants");
 var canonicalJson = require("./canonical-json");
 var bCrypto = require("./crypto");
+var validateOpts = require("./validate-opts");
 var numericBounds = require("./numeric-bounds");
 var safeJson = require("./safe-json");
 var safeSql = require("./safe-sql");
@@ -85,11 +86,12 @@ function _toBuf(secret) {
 
 function _b64urlEncode(buf) { return bCrypto.toBase64Url(buf); }
 
-function _b64urlDecode(s) {
-  if (typeof s !== "string") throw new PaginationError("pagination/bad-cursor", "cursor must be a string");
-  try { return bCrypto.fromBase64Url(s); }
-  catch (_e) { throw new PaginationError("pagination/bad-cursor", "cursor is not valid base64url"); }
-}
+var _b64urlDecode = bCrypto.makeBase64UrlDecoder({
+  errorClass:  PaginationError,
+  code:        "pagination/bad-cursor",
+  typeMessage: "cursor must be a string",
+  badMessage:  "cursor is not valid base64url",
+});
 
 function _tag(secretBuf, stateJson) {
   var h = nodeCrypto.createHash("sha3-512");
@@ -345,11 +347,8 @@ function _buildKeysetWhere(orderEntries, cursorVals, forward) {
  *   });
  */
 async function cursor(query, opts) {
-  if (!query || typeof query.where !== "function" || typeof query.orderBy !== "function" ||
-      typeof query.limit !== "function" || typeof query.all !== "function") {
-    throw new PaginationError("pagination/bad-query",
-      "cursor: first arg must be a db Query (must support where, orderBy, limit, all)");
-  }
+  validateOpts.requireMethods(query, ["where", "orderBy", "limit", "all"],
+    "cursor: first arg (db Query)", PaginationError, "pagination/bad-query");
   opts = opts || {};
   if (opts.secret == null) {
     throw new PaginationError("pagination/no-secret",
@@ -484,11 +483,8 @@ async function cursor(query, opts) {
  *   page.hasMore;      // → true when page < totalPages
  */
 async function offset(query, opts) {
-  if (!query || typeof query.limit !== "function" || typeof query.offset !== "function" ||
-      typeof query.all !== "function" || typeof query.count !== "function") {
-    throw new PaginationError("pagination/bad-query",
-      "offset: first arg must be a db Query (must support limit, offset, all, count)");
-  }
+  validateOpts.requireMethods(query, ["limit", "offset", "all", "count"],
+    "offset: first arg (db Query)", PaginationError, "pagination/bad-query");
   opts = opts || {};
   var perPage = _resolveLimit({ limit: opts.perPage, max: opts.max, default: opts.default });
   var page = parseInt(opts.page, 10);

package/lib/parsers/safe-env.js

@@ -55,6 +55,8 @@
  */
 
 var C = require("../constants");
+var pick = require("../pick");
+var boundedMap = require("../bounded-map");
 var atomicFile = require("../atomic-file");
 var lazyRequire = require("../lazy-require");
 var numericBounds = require("../numeric-bounds");
@@ -96,7 +98,6 @@ var DEFAULTS = {
   audit:          true,
 };
 
-var POISONED_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 
 // ---- parse ----
 
@@ -153,7 +154,7 @@ function parse(input, opts) {
     if (key.length === 0) {
       throw new SafeEnvError("empty key", "env/empty-key", lineNumber);
     }
-    if (POISONED_KEYS.has(key)) {
+    if (pick.isPoisonedKey(key)) {
       throw new SafeEnvError("forbidden key '" + key + "'", "env/poisoned-key", lineNumber);
     }
     if (!keyShape.test(key)) {
@@ -162,9 +163,9 @@ function parse(input, opts) {
         "env/bad-key-shape", lineNumber
       );
     }
-    if (seen.has(key)) {
+    boundedMap.requireAbsentMember(seen, key, function () {
       throw new SafeEnvError("duplicate key '" + key + "'", "env/duplicate-key", lineNumber);
-    }
+    });
 
     // Tab at start of value is almost always a paste accident
     if (rest.charAt(0) === "\t") {

package/lib/parsers/safe-ini.js

@@ -36,6 +36,7 @@
  */
 
 var C = require("../constants");
+var pick = require("../pick");
 var numericBounds = require("../numeric-bounds");
 var safeBuffer = require("../safe-buffer");
 var { defineClass } = require("../framework-error");
@@ -51,7 +52,6 @@ var DEFAULT_MAX_SECTIONS      = 500;
 var DEFAULT_MAX_KEYS_SECTION  = 1_000;
 var DEFAULT_MAX_VALUE_BYTES   = C.BYTES.kib(64);
 
-var FORBIDDEN_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 
 var TRUE_VALUES  = new Set(["true", "yes", "on"]);
 var FALSE_VALUES = new Set(["false", "no", "off"]);
@@ -136,7 +136,7 @@ function _coerceValue(raw) {
 }
 
 function _validateKey(name) {
-  if (FORBIDDEN_KEYS.has(name)) {
+  if (pick.isPoisonedKey(name)) {
     throw _err("ini/forbidden-key", "key '" + name + "' is reserved (prototype pollution defense)");
   }
 }
@@ -155,7 +155,7 @@ function _ensureSection(root, sectionPath) {
       }
       node = existing;
     } else {
-      var child = {};
+      var child = Object.create(null);   // null-proto: see root (pollution-safe)
       node[seg] = child;
       node = child;
     }
@@ -218,7 +218,13 @@ function parse(input, opts) {
       "ini.parse: onDuplicate must be 'throw' | 'first' | 'last', got " + JSON.stringify(onDuplicate));
   }
 
-  var root = {};
+  // Defense-in-depth against prototype pollution: every parsed node is a
+  // null-prototype object, so a key like __proto__ / constructor / prototype
+  // (already REFUSED by _validateKey → pick.isPoisonedKey before any write)
+  // could only ever land as an own property here, never reach Object.prototype.
+  // safe-ini's own reads use Object.prototype.hasOwnProperty.call(node, ...),
+  // so a null-proto tree is fully compatible.
+  var root = Object.create(null);
   var currentSectionPath = [];
   var currentSection = root;
   var sectionCount = 0;

package/lib/parsers/safe-toml.js

@@ -45,6 +45,9 @@
  */
 
 var C = require("../constants");
+var pick = require("../pick");
+var boundedMap = require("../bounded-map");
+var codepointClass = require("../codepoint-class");
 var numericBounds = require("../numeric-bounds");
 var safeBuffer = require("../safe-buffer");
 var { FrameworkError } = require("../framework-error");
@@ -76,7 +79,6 @@ var DEFAULTS = {
   maxKeys:  50_000,
 };
 
-var POISONED_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 
 function parse(input, opts) {
   opts = opts || {};
@@ -222,7 +224,7 @@ function parse(input, opts) {
 
   function _parseDottedKey() {
     var segments = [_parseSingleKeySegment()];
-    if (POISONED_KEYS.has(segments[0])) {
+    if (pick.isPoisonedKey(segments[0])) {
       throw _err("forbidden key '" + segments[0] + "'", "toml/poisoned-key");
     }
     while (true) {
@@ -231,7 +233,7 @@ function parse(input, opts) {
       _advance();
       _skipSpacesAndTabs();
       var seg = _parseSingleKeySegment();
-      if (POISONED_KEYS.has(seg)) {
+      if (pick.isPoisonedKey(seg)) {
         throw _err("forbidden key '" + seg + "'", "toml/poisoned-key");
       }
       segments.push(seg);
@@ -305,7 +307,7 @@ function parse(input, opts) {
         continue;
       }
       var cc = _peekCode();
-      if ((cc < 0x20 && cc !== 0x09) || cc === 0x7F) {
+      if (codepointClass.isForbiddenControlChar(cc)) {                                                // C0 (except TAB) + DEL refusal
         throw _err("unescaped control char in string", "toml/bad-string");
       }
       _advance();
@@ -622,7 +624,7 @@ function parse(input, opts) {
     var t = table;
     for (var i = 0; i < segments.length - 1; i++) {
       var seg = segments[i];
-      if (POISONED_KEYS.has(seg)) throw _err("forbidden key segment", "toml/poisoned-key");
+      if (pick.isPoisonedKey(seg)) throw _err("forbidden key segment", "toml/poisoned-key");
       if (Object.prototype.hasOwnProperty.call(t, seg)) {
         var sub = t[seg];
         if (sub == null || typeof sub !== "object" || Array.isArray(sub)) {
@@ -639,7 +641,7 @@ function parse(input, opts) {
       }
     }
     var last = segments[segments.length - 1];
-    if (POISONED_KEYS.has(last)) throw _err("forbidden key segment", "toml/poisoned-key");
+    if (pick.isPoisonedKey(last)) throw _err("forbidden key segment", "toml/poisoned-key");
     if (Object.prototype.hasOwnProperty.call(t, last)) {
       throw _err("duplicate key '" + last + "'", "toml/duplicate-key");
     }
@@ -665,7 +667,7 @@ function parse(input, opts) {
     var t = root;
     for (var i = 0; i < segments.length; i++) {
       var seg = segments[i];
-      if (POISONED_KEYS.has(seg)) throw _err("forbidden key segment", "toml/poisoned-key");
+      if (pick.isPoisonedKey(seg)) throw _err("forbidden key segment", "toml/poisoned-key");
       var isLast = (i === segments.length - 1);
       if (Object.prototype.hasOwnProperty.call(t, seg)) {
         var sub = t[seg];
@@ -699,9 +701,9 @@ function parse(input, opts) {
         }
         if (isLast && !isAoT) {
           var fullPath = segments.slice(0, i + 1).join(".");
-          if (definedTables.has(fullPath)) {
+          boundedMap.requireAbsentMember(definedTables, fullPath, function () {
             throw _err("table '" + fullPath + "' defined twice", "toml/redefine");
-          }
+          });
           definedTables.add(fullPath);
           current = sub;
           return;

package/lib/parsers/safe-xml.js

@@ -48,6 +48,7 @@
  */
 
 var C = require("../constants");
+var pick = require("../pick");
 var numericBounds = require("../numeric-bounds");
 var safeBuffer = require("../safe-buffer");
 var { FrameworkError } = require("../framework-error");
@@ -93,7 +94,6 @@ var BUILT_IN_ENTITIES = { lt: "<", gt: ">", amp: "&", quot: "\"", apos: "'" };
 // the result is always a clean key→value map. Mirrors the
 // __proto__/constructor/prototype rejection the toml / yaml / ini
 // parsers in this family already apply.
-var FORBIDDEN_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 
 function _validateAndCap(name, value, defaultValue, ceiling) {
   if (value === undefined) return defaultValue;
@@ -199,7 +199,7 @@ function parse(input, opts) {
     }
     if (pos === start) throw _err("expected name", "xml/bad-name");
     var parsed = input.substring(start, pos);
-    if (FORBIDDEN_KEYS.has(parsed)) {
+    if (pick.isPoisonedKey(parsed)) {
       throw _err("element/attribute name '" + parsed +
         "' is reserved (prototype-pollution defense)", "xml/forbidden-name");
     }

package/lib/parsers/safe-yaml.js

@@ -53,6 +53,8 @@
  */
 
 var C = require("../constants");
+var pick = require("../pick");
+var boundedMap = require("../bounded-map");
 var numericBounds = require("../numeric-bounds");
 var safeBuffer = require("../safe-buffer");
 var { FrameworkError } = require("../framework-error");
@@ -85,7 +87,6 @@ var DEFAULTS = {
   maxKeys:  50_000,
 };
 
-var POISONED_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 
 // YAML 1.2 core-schema scalar resolution. Order matters: null first
 // (covers ~ and empty), then bool, then int (with base prefixes), then
@@ -333,7 +334,7 @@ function parse(input, opts) {
       return _decodeSingleQuoted(raw, lineNumber, col);
     }
     var trimmed = safeBuffer.stripTrailingHspace(raw);
-    if (POISONED_KEYS.has(trimmed)) {
+    if (pick.isPoisonedKey(trimmed)) {
       throw new SafeYamlError("forbidden key '" + trimmed + "'",
         "yaml/poisoned-key", lineNumber, col);
     }
@@ -368,7 +369,7 @@ function parse(input, opts) {
         throw new SafeYamlError("non-string mapping key not supported",
           "yaml/bad-key", ln.lineNumber, ln.indent + 1);
       }
-      if (POISONED_KEYS.has(key)) {
+      if (pick.isPoisonedKey(key)) {
         throw new SafeYamlError("forbidden key '" + key + "'",
           "yaml/poisoned-key", ln.lineNumber, ln.indent + 1);
       }
@@ -376,10 +377,10 @@ function parse(input, opts) {
         throw new SafeYamlError("merge key '<<' not supported (anchor-using feature)",
           "yaml/merge-key-banned", ln.lineNumber, ln.indent + 1);
       }
-      if (seen.has(key)) {
+      boundedMap.requireAbsentMember(seen, key, function () {
         throw new SafeYamlError("duplicate mapping key '" + key + "'",
           "yaml/duplicate-key", ln.lineNumber, ln.indent + 1);
-      }
+      });
       seen.add(key);
       _bumpKeys(ln.lineNumber);
 
@@ -563,7 +564,7 @@ function parse(input, opts) {
         throw new SafeYamlError("non-string flow-mapping key",
           "yaml/bad-key", lineNumber, col + p);
       }
-      if (POISONED_KEYS.has(key)) {
+      if (pick.isPoisonedKey(key)) {
         throw new SafeYamlError("forbidden key '" + key + "'",
           "yaml/poisoned-key", lineNumber, col + p);
       }