@blamejs/core 0.15.12 → 0.15.14

package/lib/parsers/safe-env.js

@@ -55,6 +55,8 @@
  */
 
 var C = require("../constants");
+var pick = require("../pick");
+var boundedMap = require("../bounded-map");
 var atomicFile = require("../atomic-file");
 var lazyRequire = require("../lazy-require");
 var numericBounds = require("../numeric-bounds");
@@ -96,7 +98,6 @@ var DEFAULTS = {
   audit:          true,
 };
 
-var POISONED_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 
 // ---- parse ----
 
@@ -153,7 +154,7 @@ function parse(input, opts) {
     if (key.length === 0) {
       throw new SafeEnvError("empty key", "env/empty-key", lineNumber);
     }
-    if (POISONED_KEYS.has(key)) {
+    if (pick.isPoisonedKey(key)) {
       throw new SafeEnvError("forbidden key '" + key + "'", "env/poisoned-key", lineNumber);
     }
     if (!keyShape.test(key)) {
@@ -162,9 +163,9 @@ function parse(input, opts) {
         "env/bad-key-shape", lineNumber
       );
     }
-    if (seen.has(key)) {
+    boundedMap.requireAbsentMember(seen, key, function () {
       throw new SafeEnvError("duplicate key '" + key + "'", "env/duplicate-key", lineNumber);
-    }
+    });
 
     // Tab at start of value is almost always a paste accident
     if (rest.charAt(0) === "\t") {

package/lib/parsers/safe-ini.js

@@ -36,6 +36,7 @@
  */
 
 var C = require("../constants");
+var pick = require("../pick");
 var numericBounds = require("../numeric-bounds");
 var safeBuffer = require("../safe-buffer");
 var { defineClass } = require("../framework-error");
@@ -51,7 +52,6 @@ var DEFAULT_MAX_SECTIONS      = 500;
 var DEFAULT_MAX_KEYS_SECTION  = 1_000;
 var DEFAULT_MAX_VALUE_BYTES   = C.BYTES.kib(64);
 
-var FORBIDDEN_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 
 var TRUE_VALUES  = new Set(["true", "yes", "on"]);
 var FALSE_VALUES = new Set(["false", "no", "off"]);
@@ -136,7 +136,7 @@ function _coerceValue(raw) {
 }
 
 function _validateKey(name) {
-  if (FORBIDDEN_KEYS.has(name)) {
+  if (pick.isPoisonedKey(name)) {
     throw _err("ini/forbidden-key", "key '" + name + "' is reserved (prototype pollution defense)");
   }
 }
@@ -155,7 +155,7 @@ function _ensureSection(root, sectionPath) {
       }
       node = existing;
     } else {
-      var child = {};
+      var child = Object.create(null);   // null-proto: see root (pollution-safe)
       node[seg] = child;
       node = child;
     }
@@ -218,7 +218,13 @@ function parse(input, opts) {
       "ini.parse: onDuplicate must be 'throw' | 'first' | 'last', got " + JSON.stringify(onDuplicate));
   }
 
-  var root = {};
+  // Defense-in-depth against prototype pollution: every parsed node is a
+  // null-prototype object, so a key like __proto__ / constructor / prototype
+  // (already REFUSED by _validateKey → pick.isPoisonedKey before any write)
+  // could only ever land as an own property here, never reach Object.prototype.
+  // safe-ini's own reads use Object.prototype.hasOwnProperty.call(node, ...),
+  // so a null-proto tree is fully compatible.
+  var root = Object.create(null);
   var currentSectionPath = [];
   var currentSection = root;
   var sectionCount = 0;

package/lib/parsers/safe-toml.js

@@ -45,6 +45,9 @@
  */
 
 var C = require("../constants");
+var pick = require("../pick");
+var boundedMap = require("../bounded-map");
+var codepointClass = require("../codepoint-class");
 var numericBounds = require("../numeric-bounds");
 var safeBuffer = require("../safe-buffer");
 var { FrameworkError } = require("../framework-error");
@@ -76,7 +79,6 @@ var DEFAULTS = {
   maxKeys:  50_000,
 };
 
-var POISONED_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 
 function parse(input, opts) {
   opts = opts || {};
@@ -222,7 +224,7 @@ function parse(input, opts) {
 
   function _parseDottedKey() {
     var segments = [_parseSingleKeySegment()];
-    if (POISONED_KEYS.has(segments[0])) {
+    if (pick.isPoisonedKey(segments[0])) {
       throw _err("forbidden key '" + segments[0] + "'", "toml/poisoned-key");
     }
     while (true) {
@@ -231,7 +233,7 @@ function parse(input, opts) {
       _advance();
       _skipSpacesAndTabs();
       var seg = _parseSingleKeySegment();
-      if (POISONED_KEYS.has(seg)) {
+      if (pick.isPoisonedKey(seg)) {
         throw _err("forbidden key '" + seg + "'", "toml/poisoned-key");
       }
       segments.push(seg);
@@ -305,7 +307,7 @@ function parse(input, opts) {
         continue;
       }
       var cc = _peekCode();
-      if ((cc < 0x20 && cc !== 0x09) || cc === 0x7F) {
+      if (codepointClass.isForbiddenControlChar(cc)) {                                                // C0 (except TAB) + DEL refusal
         throw _err("unescaped control char in string", "toml/bad-string");
       }
       _advance();
@@ -622,7 +624,7 @@ function parse(input, opts) {
     var t = table;
     for (var i = 0; i < segments.length - 1; i++) {
       var seg = segments[i];
-      if (POISONED_KEYS.has(seg)) throw _err("forbidden key segment", "toml/poisoned-key");
+      if (pick.isPoisonedKey(seg)) throw _err("forbidden key segment", "toml/poisoned-key");
       if (Object.prototype.hasOwnProperty.call(t, seg)) {
         var sub = t[seg];
         if (sub == null || typeof sub !== "object" || Array.isArray(sub)) {
@@ -639,7 +641,7 @@ function parse(input, opts) {
       }
     }
     var last = segments[segments.length - 1];
-    if (POISONED_KEYS.has(last)) throw _err("forbidden key segment", "toml/poisoned-key");
+    if (pick.isPoisonedKey(last)) throw _err("forbidden key segment", "toml/poisoned-key");
     if (Object.prototype.hasOwnProperty.call(t, last)) {
       throw _err("duplicate key '" + last + "'", "toml/duplicate-key");
     }
@@ -665,7 +667,7 @@ function parse(input, opts) {
     var t = root;
     for (var i = 0; i < segments.length; i++) {
       var seg = segments[i];
-      if (POISONED_KEYS.has(seg)) throw _err("forbidden key segment", "toml/poisoned-key");
+      if (pick.isPoisonedKey(seg)) throw _err("forbidden key segment", "toml/poisoned-key");
       var isLast = (i === segments.length - 1);
       if (Object.prototype.hasOwnProperty.call(t, seg)) {
         var sub = t[seg];
@@ -699,9 +701,9 @@ function parse(input, opts) {
         }
         if (isLast && !isAoT) {
           var fullPath = segments.slice(0, i + 1).join(".");
-          if (definedTables.has(fullPath)) {
+          boundedMap.requireAbsentMember(definedTables, fullPath, function () {
             throw _err("table '" + fullPath + "' defined twice", "toml/redefine");
-          }
+          });
           definedTables.add(fullPath);
           current = sub;
           return;

package/lib/parsers/safe-xml.js

@@ -48,6 +48,7 @@
  */
 
 var C = require("../constants");
+var pick = require("../pick");
 var numericBounds = require("../numeric-bounds");
 var safeBuffer = require("../safe-buffer");
 var { FrameworkError } = require("../framework-error");
@@ -93,7 +94,6 @@ var BUILT_IN_ENTITIES = { lt: "<", gt: ">", amp: "&", quot: "\"", apos: "'" };
 // the result is always a clean key→value map. Mirrors the
 // __proto__/constructor/prototype rejection the toml / yaml / ini
 // parsers in this family already apply.
-var FORBIDDEN_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 
 function _validateAndCap(name, value, defaultValue, ceiling) {
   if (value === undefined) return defaultValue;
@@ -174,7 +174,7 @@ function parse(input, opts) {
         }
         out += String.fromCodePoint(code);
         i = end + 1;
-      } else if (BUILT_IN_ENTITIES[name] !== undefined) {
+      } else if (Object.prototype.hasOwnProperty.call(BUILT_IN_ENTITIES, name)) {
         out += BUILT_IN_ENTITIES[name];
         i = end + 1;
       } else {
@@ -199,7 +199,7 @@ function parse(input, opts) {
     }
     if (pos === start) throw _err("expected name", "xml/bad-name");
     var parsed = input.substring(start, pos);
-    if (FORBIDDEN_KEYS.has(parsed)) {
+    if (pick.isPoisonedKey(parsed)) {
       throw _err("element/attribute name '" + parsed +
         "' is reserved (prototype-pollution defense)", "xml/forbidden-name");
     }

package/lib/parsers/safe-yaml.js

@@ -53,6 +53,8 @@
  */
 
 var C = require("../constants");
+var pick = require("../pick");
+var boundedMap = require("../bounded-map");
 var numericBounds = require("../numeric-bounds");
 var safeBuffer = require("../safe-buffer");
 var { FrameworkError } = require("../framework-error");
@@ -85,7 +87,6 @@ var DEFAULTS = {
   maxKeys:  50_000,
 };
 
-var POISONED_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 
 // YAML 1.2 core-schema scalar resolution. Order matters: null first
 // (covers ~ and empty), then bool, then int (with base prefixes), then
@@ -333,7 +334,7 @@ function parse(input, opts) {
       return _decodeSingleQuoted(raw, lineNumber, col);
     }
     var trimmed = safeBuffer.stripTrailingHspace(raw);
-    if (POISONED_KEYS.has(trimmed)) {
+    if (pick.isPoisonedKey(trimmed)) {
       throw new SafeYamlError("forbidden key '" + trimmed + "'",
         "yaml/poisoned-key", lineNumber, col);
     }
@@ -368,7 +369,7 @@ function parse(input, opts) {
         throw new SafeYamlError("non-string mapping key not supported",
           "yaml/bad-key", ln.lineNumber, ln.indent + 1);
       }
-      if (POISONED_KEYS.has(key)) {
+      if (pick.isPoisonedKey(key)) {
         throw new SafeYamlError("forbidden key '" + key + "'",
           "yaml/poisoned-key", ln.lineNumber, ln.indent + 1);
       }
@@ -376,10 +377,10 @@ function parse(input, opts) {
         throw new SafeYamlError("merge key '<<' not supported (anchor-using feature)",
           "yaml/merge-key-banned", ln.lineNumber, ln.indent + 1);
       }
-      if (seen.has(key)) {
+      boundedMap.requireAbsentMember(seen, key, function () {
         throw new SafeYamlError("duplicate mapping key '" + key + "'",
           "yaml/duplicate-key", ln.lineNumber, ln.indent + 1);
-      }
+      });
       seen.add(key);
       _bumpKeys(ln.lineNumber);
 
@@ -563,7 +564,7 @@ function parse(input, opts) {
         throw new SafeYamlError("non-string flow-mapping key",
           "yaml/bad-key", lineNumber, col + p);
       }
-      if (POISONED_KEYS.has(key)) {
+      if (pick.isPoisonedKey(key)) {
         throw new SafeYamlError("forbidden key '" + key + "'",
           "yaml/poisoned-key", lineNumber, col + p);
       }
@@ -770,9 +771,27 @@ function parse(input, opts) {
   }
 
   function _stripEolComment(text) {
-    // Strip ` #...` comments (must be preceded by whitespace) at end of line.
-    var match = text.match(/^(.*?)(\s+#.*)?$/);
-    return safeBuffer.stripTrailingHspace(match && match[1] != null ? match[1] : text);
+    // Strip ` #...` comments (a YAML end-of-line comment must be preceded by
+    // whitespace) via a single linear scan. The previous /^(.*?)(\s+#.*)?$/
+    // backtracks polynomially on a long inline-whitespace run with no '#'
+    // (each position re-tries `\s+#`) — a ReDoS lever on attacker-supplied
+    // YAML. This finds the first whitespace-preceded '#' and cuts the
+    // preceding whitespace run, identical output without the catastrophic
+    // backtracking.
+    for (var i = 1; i < text.length; i++) {
+      if (text.charCodeAt(i) !== 0x23 /* # */) continue;
+      var prev = text.charCodeAt(i - 1);
+      // inline whitespace: space / tab / vtab / formfeed / CR
+      if (prev !== 0x20 && prev !== 0x09 && prev !== 0x0b && prev !== 0x0c && prev !== 0x0d) continue;
+      var end = i;
+      while (end > 0) {
+        var c = text.charCodeAt(end - 1);
+        if (c === 0x20 || c === 0x09 || c === 0x0b || c === 0x0c || c === 0x0d) end--;
+        else break;
+      }
+      return safeBuffer.stripTrailingHspace(text.slice(0, end));
+    }
+    return safeBuffer.stripTrailingHspace(text);
   }
 
   // ---- Block scalars (| literal, > folded) ----

package/lib/pick.js

@@ -28,7 +28,59 @@
  *   ]);
  */
 
-var POISONED_KEYS = ["__proto__", "constructor", "prototype"];
+// CORE_POISONED_KEYS — the JavaScript-language prototype-pollution VECTORS: the
+// property names that, used as an assignment target on a plain object, reach
+// Object.prototype ("__proto__" directly; "constructor"."prototype"
+// transitively). This is a LANGUAGE INVARIANT, not an operator policy and not
+// an app-specific name like a table/column — "which keys pollute the JS
+// prototype" is fixed by the runtime, so the core is a fixed list by design.
+// It is also add-ONLY (below): removing any one would open a pollution hole, so
+// the safe default can only ever get stricter, never weaker.
+var CORE_POISONED_KEYS = ["__proto__", "constructor", "prototype"];
+var POISONED_KEY_SET = new Set(CORE_POISONED_KEYS);
+
+// registerPoisonedKeys(keys) — defense-in-depth EXTENSION hook (CWE-1321). An
+// operator at boot, or a framework module, may ADD further dangerous property
+// names to block everywhere isPoisonedKey is consulted — the accessor methods
+// "__defineGetter__" / "__defineSetter__" / "__lookupGetter__" /
+// "__lookupSetter__", or an app's own reserved keys. Add-ONLY by design: the
+// core vectors can never be removed, so this knob can only tighten the
+// framework-wide pollution defense, never weaken it.
+function registerPoisonedKeys(keys) {
+  if (!Array.isArray(keys)) {
+    throw new TypeError("pick.registerPoisonedKeys: keys must be an array of strings, got " + (typeof keys));
+  }
+  for (var i = 0; i < keys.length; i += 1) {
+    if (typeof keys[i] !== "string" || keys[i].length === 0) {
+      throw new TypeError("pick.registerPoisonedKeys: every key must be a non-empty string");
+    }
+    POISONED_KEY_SET.add(keys[i]);
+  }
+}
+
+// isPoisonedKey(key) — the framework's single prototype-pollution key predicate.
+// Every parser, decoder, and middleware that builds an object from untrusted
+// keys routes its guard through this, so the dangerous-key set lives in ONE
+// place rather than being re-declared (a Set per file) or re-spelled (a literal
+// `k === "__proto__" || k === "constructor" || k === "prototype"`) at each
+// site — where one stale copy is a pollution hole. Consults the core vectors
+// plus any operator-registered extensions. Non-string keys are never poisoned
+// (a Map/Symbol key can't name an Object.prototype slot via assignment).
+function isPoisonedKey(key) {
+  return typeof key === "string" && POISONED_KEY_SET.has(key);
+}
+
+// assertSafeKey(key, onPoisoned) — throw-guard form for callers that REJECT a
+// poisoned key (strict parsers, schema validators) rather than silently skip
+// it. When key is poisoned, invokes onPoisoned(key) (the caller throws its own
+// typed error from it) and returns the result; otherwise returns undefined.
+function assertSafeKey(key, onPoisoned) {
+  if (typeof onPoisoned !== "function") {
+    throw new TypeError("pick.assertSafeKey: onPoisoned must be a function, got " + (typeof onPoisoned));
+  }
+  if (isPoisonedKey(key)) return onPoisoned(key);
+  return undefined;
+}
 
 function _isPlainObject(o) {
   return o !== null && typeof o === "object" && !Array.isArray(o) &&
@@ -43,11 +95,11 @@ function _normalizeAllowList(list) {
   for (var i = 0; i < list.length; i += 1) {
     var entry = list[i];
     if (typeof entry === "string") {
-      if (POISONED_KEYS.indexOf(entry) !== -1) continue;
+      if (isPoisonedKey(entry)) continue;
       out[entry] = true;
     } else if (Array.isArray(entry) && entry.length === 2 &&
                typeof entry[0] === "string" && Array.isArray(entry[1])) {
-      if (POISONED_KEYS.indexOf(entry[0]) !== -1) continue;
+      if (isPoisonedKey(entry[0])) continue;
       out[entry[0]] = _normalizeAllowList(entry[1]);
     } else {
       throw new TypeError(
@@ -66,7 +118,7 @@ function _pickInner(input, normalized, onUnknown, path) {
   var keys = Object.keys(input);
   for (var i = 0; i < keys.length; i += 1) {
     var k = keys[i];
-    if (POISONED_KEYS.indexOf(k) !== -1) continue;
+    if (isPoisonedKey(k)) continue;
     if (!Object.prototype.hasOwnProperty.call(normalized, k)) {
       if (onUnknown === "throw") {
         throw new TypeError(
@@ -102,4 +154,10 @@ function pick(input, allowList, opts) {
 
 module.exports = pick;
 module.exports.pick = pick;
-module.exports.POISONED_KEYS = Object.freeze(POISONED_KEYS.slice());
+// POISONED_KEYS — the frozen CORE vectors (a stable snapshot for callers that
+// need the canonical list). The live predicate isPoisonedKey() also honors
+// operator-registered extensions; this export is the immutable language core.
+module.exports.POISONED_KEYS = Object.freeze(CORE_POISONED_KEYS.slice());
+module.exports.isPoisonedKey = isPoisonedKey;
+module.exports.assertSafeKey = assertSafeKey;
+module.exports.registerPoisonedKeys = registerPoisonedKeys;

package/lib/pipl-cn.js

@@ -159,43 +159,50 @@ function _requireRecordedAt(value, label) {
 function sccFilingAssessment(opts) {
   validateOpts.requireObject(opts, "b.pipl.sccFilingAssessment: opts", PiplError, "pipl/bad-opts");
   validateOpts(opts, SCC_ASSESSMENT_ALLOWED_KEYS, "b.pipl.sccFilingAssessment");
-  validateOpts.requireNonEmptyString(opts.assessmentId,
-    "b.pipl.sccFilingAssessment: opts.assessmentId", PiplError, "pipl/bad-assessment-id");
-  validateOpts.requireNonEmptyString(opts.transferType,
-    "b.pipl.sccFilingAssessment: opts.transferType", PiplError, "pipl/bad-transfer-type");
-  validateOpts.requireNonEmptyString(opts.recipientJurisdiction,
-    "b.pipl.sccFilingAssessment: opts.recipientJurisdiction", PiplError, "pipl/bad-recipient");
+  validateOpts.shape(opts, {
+    assessmentId:          { rule: "required-string", code: "pipl/bad-assessment-id", label: "b.pipl.sccFilingAssessment: opts.assessmentId" },
+    transferType:          { rule: "required-string", code: "pipl/bad-transfer-type", label: "b.pipl.sccFilingAssessment: opts.transferType" },
+    recipientJurisdiction: { rule: "required-string", code: "pipl/bad-recipient", label: "b.pipl.sccFilingAssessment: opts.recipientJurisdiction" },
+    dataCategories: function (value) {
+      if (!Array.isArray(value) || value.length === 0) {
+        throw new PiplError("pipl/bad-data-categories",
+          "b.pipl.sccFilingAssessment: opts.dataCategories must be a non-empty array of strings");
+      }
+      validateOpts.optionalNonEmptyStringArray(value,
+        "b.pipl.sccFilingAssessment: opts.dataCategories", PiplError, "pipl/bad-data-categories");
+    },
+    legalBasis: function (value) {
+      if (LEGAL_BASES.indexOf(value) === -1) {
+        throw new PiplError("pipl/bad-legal-basis",
+          "b.pipl.sccFilingAssessment: opts.legalBasis must be one of " +
+          LEGAL_BASES.join(" | ") + " (PIPL Art. 38(1)) — got " + JSON.stringify(value));
+      }
+    },
+    volume: function (value) {
+      if (typeof value !== "number" || !isFinite(value) || value < 0) {
+        throw new PiplError("pipl/bad-volume",
+          "b.pipl.sccFilingAssessment: opts.volume must be a non-negative finite number (data-subject count)");
+      }
+    },
+    sensitivePI: function (value) {
+      if (typeof value !== "boolean") {
+        throw new PiplError("pipl/bad-sensitive-pi",
+          "b.pipl.sccFilingAssessment: opts.sensitivePI must be a boolean");
+      }
+    },
+    ciio:                  { rule: "optional-boolean", code: "pipl/bad-ciio", label: "b.pipl.sccFilingAssessment: opts.ciio" },
+    importantData:         { rule: "optional-boolean", code: "pipl/bad-important-data", label: "b.pipl.sccFilingAssessment: opts.importantData" },
+    cumulativePI:          { rule: "optional-non-negative", code: "pipl/bad-cumulative-pi", label: "b.pipl.sccFilingAssessment: opts.cumulativePI" },
+    cumulativeSensitivePI: { rule: "optional-non-negative", code: "pipl/bad-cumulative-sensitive-pi", label: "b.pipl.sccFilingAssessment: opts.cumulativeSensitivePI" },
+    recordedAt: function (value) {
+      _requireRecordedAt(value, "b.pipl.sccFilingAssessment: opts.recordedAt");
+    },
+  }, "b.pipl.sccFilingAssessment: opts", PiplError, "pipl/bad-opts", { allow: ["audit"] });
 
-  if (!Array.isArray(opts.dataCategories) || opts.dataCategories.length === 0) {
-    throw new PiplError("pipl/bad-data-categories",
-      "b.pipl.sccFilingAssessment: opts.dataCategories must be a non-empty array of strings");
-  }
-  validateOpts.optionalNonEmptyStringArray(opts.dataCategories,
-    "b.pipl.sccFilingAssessment: opts.dataCategories", PiplError, "pipl/bad-data-categories");
-
-  if (LEGAL_BASES.indexOf(opts.legalBasis) === -1) {
-    throw new PiplError("pipl/bad-legal-basis",
-      "b.pipl.sccFilingAssessment: opts.legalBasis must be one of " +
-      LEGAL_BASES.join(" | ") + " (PIPL Art. 38(1)) — got " + JSON.stringify(opts.legalBasis));
-  }
-
-  if (typeof opts.volume !== "number" || !isFinite(opts.volume) || opts.volume < 0) {
-    throw new PiplError("pipl/bad-volume",
-      "b.pipl.sccFilingAssessment: opts.volume must be a non-negative finite number (data-subject count)");
-  }
-  if (typeof opts.sensitivePI !== "boolean") {
-    throw new PiplError("pipl/bad-sensitive-pi",
-      "b.pipl.sccFilingAssessment: opts.sensitivePI must be a boolean");
-  }
-
-  var ciio = opts.ciio === undefined ? false
-    : validateOpts.optionalBoolean(opts.ciio, "b.pipl.sccFilingAssessment: opts.ciio", PiplError, "pipl/bad-ciio");
-  var importantData = opts.importantData === undefined ? false
-    : validateOpts.optionalBoolean(opts.importantData, "b.pipl.sccFilingAssessment: opts.importantData", PiplError, "pipl/bad-important-data");
-  var cumulativePI = opts.cumulativePI === undefined ? 0
-    : validateOpts.optionalFiniteNonNegative(opts.cumulativePI, "b.pipl.sccFilingAssessment: opts.cumulativePI", PiplError, "pipl/bad-cumulative-pi");
-  var cumulativeSensitivePI = opts.cumulativeSensitivePI === undefined ? 0
-    : validateOpts.optionalFiniteNonNegative(opts.cumulativeSensitivePI, "b.pipl.sccFilingAssessment: opts.cumulativeSensitivePI", PiplError, "pipl/bad-cumulative-sensitive-pi");
+  var ciio = opts.ciio === undefined ? false : opts.ciio;
+  var importantData = opts.importantData === undefined ? false : opts.importantData;
+  var cumulativePI = opts.cumulativePI === undefined ? 0 : opts.cumulativePI;
+  var cumulativeSensitivePI = opts.cumulativeSensitivePI === undefined ? 0 : opts.cumulativeSensitivePI;
 
   var recordedAt = _requireRecordedAt(opts.recordedAt, "b.pipl.sccFilingAssessment: opts.recordedAt");
   // Resolve + shape-validate the audit sink at the entry-point tier (THROWS
@@ -306,30 +313,33 @@ function sccFilingAssessment(opts) {
 function securityAssessmentCertificate(opts) {
   validateOpts.requireObject(opts, "b.pipl.securityAssessmentCertificate: opts", PiplError, "pipl/bad-opts");
   validateOpts(opts, SECURITY_CERT_ALLOWED_KEYS, "b.pipl.securityAssessmentCertificate");
-  validateOpts.requireNonEmptyString(opts.certId,
-    "b.pipl.securityAssessmentCertificate: opts.certId", PiplError, "pipl/bad-cert-id");
-  validateOpts.requireNonEmptyString(opts.assessmentScope,
-    "b.pipl.securityAssessmentCertificate: opts.assessmentScope", PiplError, "pipl/bad-scope");
-  validateOpts.requireNonEmptyString(opts.dataExporter,
-    "b.pipl.securityAssessmentCertificate: opts.dataExporter", PiplError, "pipl/bad-exporter");
-  validateOpts.requireNonEmptyString(opts.overseasRecipient,
-    "b.pipl.securityAssessmentCertificate: opts.overseasRecipient", PiplError, "pipl/bad-recipient");
-
-  if (RISK_RATINGS.indexOf(opts.riskRating) === -1) {
-    throw new PiplError("pipl/bad-risk-rating",
-      "b.pipl.securityAssessmentCertificate: opts.riskRating must be one of " +
-      RISK_RATINGS.join(" | ") + " — got " + JSON.stringify(opts.riskRating));
-  }
-
-  if (!Array.isArray(opts.safeguards) || opts.safeguards.length === 0) {
-    throw new PiplError("pipl/bad-safeguards",
-      "b.pipl.securityAssessmentCertificate: opts.safeguards must be a non-empty array of strings");
-  }
-  validateOpts.optionalNonEmptyStringArray(opts.safeguards,
-    "b.pipl.securityAssessmentCertificate: opts.safeguards", PiplError, "pipl/bad-safeguards");
+  validateOpts.shape(opts, {
+    certId:            { rule: "required-string", code: "pipl/bad-cert-id", label: "b.pipl.securityAssessmentCertificate: opts.certId" },
+    assessmentScope:   { rule: "required-string", code: "pipl/bad-scope", label: "b.pipl.securityAssessmentCertificate: opts.assessmentScope" },
+    dataExporter:      { rule: "required-string", code: "pipl/bad-exporter", label: "b.pipl.securityAssessmentCertificate: opts.dataExporter" },
+    overseasRecipient: { rule: "required-string", code: "pipl/bad-recipient", label: "b.pipl.securityAssessmentCertificate: opts.overseasRecipient" },
+    riskRating: function (value) {
+      if (RISK_RATINGS.indexOf(value) === -1) {
+        throw new PiplError("pipl/bad-risk-rating",
+          "b.pipl.securityAssessmentCertificate: opts.riskRating must be one of " +
+          RISK_RATINGS.join(" | ") + " — got " + JSON.stringify(value));
+      }
+    },
+    safeguards: function (value) {
+      if (!Array.isArray(value) || value.length === 0) {
+        throw new PiplError("pipl/bad-safeguards",
+          "b.pipl.securityAssessmentCertificate: opts.safeguards must be a non-empty array of strings");
+      }
+      validateOpts.optionalNonEmptyStringArray(value,
+        "b.pipl.securityAssessmentCertificate: opts.safeguards", PiplError, "pipl/bad-safeguards");
+    },
+    filingRef:         { rule: "optional-string", code: "pipl/bad-filing-ref", label: "b.pipl.securityAssessmentCertificate: opts.filingRef" },
+    recordedAt: function (value) {
+      _requireRecordedAt(value, "b.pipl.securityAssessmentCertificate: opts.recordedAt");
+    },
+  }, "b.pipl.securityAssessmentCertificate: opts", PiplError, "pipl/bad-opts", { allow: ["audit"] });
 
-  var filingRef = validateOpts.optionalNonEmptyString(opts.filingRef,
-    "b.pipl.securityAssessmentCertificate: opts.filingRef", PiplError, "pipl/bad-filing-ref");
+  var filingRef = opts.filingRef;
 
   var recordedAt = _requireRecordedAt(opts.recordedAt, "b.pipl.securityAssessmentCertificate: opts.recordedAt");
   // Entry-point shape-validate the audit sink (THROWS) before the drop-silent

package/lib/privacy-pass.js

@@ -36,6 +36,7 @@
 
 var nodeCrypto = require("node:crypto");
 var bCrypto = require("./crypto");
+var safeBuffer = require("./safe-buffer");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -58,12 +59,13 @@ function _b64urlPadded(buf) {
   return s;
 }
 
-function _bytes(x, what) {
-  if (Buffer.isBuffer(x)) return x;
-  if (x instanceof Uint8Array) return Buffer.from(x);
-  if (typeof x === "string") return Buffer.from(x, "base64");
-  throw new PrivacyPassError("privacy-pass/bad-bytes", "privacyPass: " + what + " must be a Buffer / Uint8Array / base64 string");
-}
+var _bytes = safeBuffer.makeByteCoercer({
+  errorClass:    PrivacyPassError,
+  typeCode:      "privacy-pass/bad-bytes",
+  messagePrefix: "privacyPass: ",
+  messageSuffix: " must be a Buffer / Uint8Array / base64 string",
+  encoding:      "base64",
+});
 
 // Import the issuer public key and capture the SubjectPublicKeyInfo
 // bytes used to derive token_key_id. When the caller supplies the

package/lib/problem-details.js

@@ -378,11 +378,8 @@ function fromError(err, opts2) {
  *   // res.statusCode: 400
  */
 function respond(res, problem, req) {
-  if (!res || typeof res !== "object" || typeof res.setHeader !== "function" ||
-      typeof res.end !== "function") {
-    throw new ProblemDetailsError("problem-details/bad-res",
-      "respond: res must be an HTTP response object (setHeader + end)", true);
-  }
+  validateOpts.requireMethods(res, ["setHeader", "end"],
+    "respond: res (HTTP response object)", ProblemDetailsError, "problem-details/bad-res", true);
   if (!problem || typeof problem !== "object" || Array.isArray(problem)) {
     throw new ProblemDetailsError("problem-details/bad-problem",
       "respond: problem must be a non-null object", true);

package/lib/pubsub.js

@@ -41,6 +41,7 @@ var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var safeJson = require("./safe-json");
 var validateOpts = require("./validate-opts");
+var boundedMap = require("./bounded-map");
 var { defineClass } = require("./framework-error");
 
 var audit  = lazyRequire(function () { return require("./audit"); });
@@ -58,12 +59,8 @@ function _err(code, message) { return new PubsubError(code, message, true); }
 function _resolveBackend(opts) {
   var requested = opts.backend;
   if (requested && typeof requested === "object") {
-    if (typeof requested.publishRemote !== "function" ||
-        typeof requested.start !== "function" ||
-        typeof requested.stop !== "function") {
-      throw _err("BAD_BACKEND",
-        "pubsub: custom backend must implement { publishRemote, start, stop }");
-    }
+    validateOpts.requireMethods(requested, ["publishRemote", "start", "stop"],
+      "pubsub: custom backend", PubsubError, "BAD_BACKEND", true);
     return Object.assign({ name: "custom" }, requested);
   }
   if (!requested || requested === "local") {
@@ -347,8 +344,7 @@ function create(opts) {
       throw _err("BAD_OPT", "pubsub.subscribe: handler must be a function");
     }
     var rec = { channel: channel, handler: handler, isPattern: false };
-    var set = exactSubs.get(channel);
-    if (!set) { set = new Set(); exactSubs.set(channel, set); }
+    var set = boundedMap.getOrInsert(exactSubs, channel, function () { return new Set(); });
     set.add(rec);
     // Remote subscribe is fire-and-forget from the caller's perspective;
     // the redis backend awaits the SUBSCRIBE ack internally before its

package/lib/queue-local.js

@@ -406,7 +406,13 @@ function create(config) {
       .where("_id", jobId)
       .where("status", "inflight")
       .toSql();
-    await store.execute(doneBuilt.sql, doneBuilt.params);
+    var doneRes = await store.execute(doneBuilt.sql, doneBuilt.params);
+    // Only run the post-completion side effects if THIS call actually flipped
+    // the row inflight→done. If the status guard matched 0 rows the job was
+    // already completed or re-leased to another worker (its lease expired and
+    // sweepExpired re-queued it) — a stale completer must NOT re-enqueue the
+    // cron repeat (duplicate firing) or release flow children twice.
+    if ((doneRes.rowCount || 0) === 0) return false;
 
     // Repeat-in-queue: cron-recurring job re-enqueues itself for the
     // next firing time. Failures (which take the fail() path) don't
@@ -513,9 +519,10 @@ function create(config) {
               [nowMs + retryDelayMs])
       .setRaw("finishedAt", "CASE WHEN " + attemptsLt + " THEN NULL ELSE ? END", [nowMs])
       .where("_id", jobId)
+      .where("status", "inflight")          // lease-ownership guard — a stale fail() must not clobber a job re-leased to another worker after this one's lease expired (mirrors complete()/extendLease)
       .toSql();
-    await store.execute(failBuilt.sql, failBuilt.params);
-    return true;
+    var failRes = await store.execute(failBuilt.sql, failBuilt.params);
+    return (failRes.rowCount || 0) > 0;
   }
 
   async function sweepExpired() {