fix(upload): accept onUploadInit in option validator

The `onUploadInit` callback was added to `UploadOptions` and wired
through to `cryptify.upload`, but `validateUploadOptions`'s top-level
whitelist was missed. Passing `{ onUploadInit: fn }` therefore threw
`TypeError: sealed.upload(opts): unknown option "onUploadInit"` —
breaking any consumer who tried to capture the uuid as soon as
`upload_init` resolved (e.g. postguard-website's staging email-preview
modal needs it to render the /download link before chunks finish).

Adds `onUploadInit` to `VALID_UPLOAD_KEYS`, plus a value-type check
that the callback is a function (consistent with the other "fail loud"
checks in this validator).

Tests:
- accepts a top-level `onUploadInit` function
- rejects a non-function value with a clear error

Author: rubenhensen

src/sealed.ts

@@ -169,7 +169,7 @@ export function resolveFiles(options: EncryptInput): File[] {
 }
 
 const VALID_NOTIFY_KEYS = new Set(['recipients', 'sender', 'message', 'language']);
-const VALID_UPLOAD_KEYS = new Set(['notify']);
+const VALID_UPLOAD_KEYS = new Set(['notify', 'onUploadInit']);
 const VALID_LANGUAGES: ReadonlySet<string> = new Set(['EN', 'NL']);
 
 /** Tracks which PostGuard configs have already seen the silent-default
@@ -194,11 +194,18 @@ function validateUploadOptions(opts: UploadOptions | undefined): void {
       throw new TypeError(
         `sealed.upload(opts): unknown option "${key}". ` +
         `Did you mean to nest it under "notify"? Expected shape: ` +
-        `{ notify: { recipients?: boolean, sender?: boolean, message?: string, language?: 'EN' | 'NL' } }`
+        `{ notify: { recipients?: boolean, sender?: boolean, message?: string, language?: 'EN' | 'NL' }, onUploadInit?: (info) => void }`
       );
     }
   }
 
+  if (opts.onUploadInit !== undefined && typeof opts.onUploadInit !== 'function') {
+    throw new TypeError(
+      `sealed.upload({ onUploadInit }) must be a function (info: { uuid, recoveryToken }) => void, ` +
+      `got ${describeValue(opts.onUploadInit)}.`
+    );
+  }
+
   const { notify } = opts;
   if (notify === undefined) return;
   if (notify === null || typeof notify !== 'object' || Array.isArray(notify)) {

tests/postguard.test.ts

@@ -227,6 +227,24 @@ describe('PostGuard', () => {
       );
     });
 
+    it('accepts onUploadInit callback at top level', async () => {
+      const sealed = newSealed();
+      // Validator must not flag `onUploadInit` — it sits at top level
+      // alongside `notify`, not under it. Pre-fix this threw
+      // `unknown option "onUploadInit"` and broke the upload flow.
+      await expect(
+        sealed.upload({ onUploadInit: () => {} })
+      ).rejects.not.toThrow(/unknown option "onUploadInit"/);
+    });
+
+    it('rejects non-function onUploadInit', async () => {
+      const sealed = newSealed();
+      // @ts-expect-error — intentionally wrong type
+      await expect(sealed.upload({ onUploadInit: 'cb' })).rejects.toThrow(
+        /onUploadInit[^]*must be a function/
+      );
+    });
+
     it('refuses to upload a ReadableStream payload', async () => {
       const sealed = pg.encrypt({
         data: new ReadableStream<Uint8Array>(),