@blamejs/blamejs-shop 0.4.55 → 0.4.57

package/lib/vendor/blamejs/lib/mail-auth.js

@@ -46,7 +46,10 @@ var zlib = require("node:zlib");
 var net = require("node:net");
 var nodeCrypto = require("node:crypto");
 var lazyRequire = require("./lazy-require");
+var safeBuffer = require("./safe-buffer");
 var validateOpts = require("./validate-opts");
+var structuredFields = require("./structured-fields");
+var markupEscape = require("./markup-escape").markupEscape;
 var bCrypto = require("./crypto");
 var C = require("./constants");
 var dkim = require("./mail-dkim");
@@ -109,22 +112,11 @@ function _getDefaultResolver() {
   return _defaultResolver;
 }
 
+// TXT resolution reuses the shared reshape in networkDnsResolver.resolveTxt,
+// passing this module's own resolver so TXT shares the resolver (and cache)
+// used for A / MX / PTR below.
 async function _safeResolveTxt(qname, operatorLookup) {
-  if (operatorLookup) return operatorLookup(qname, "TXT");
-  var r = await _getDefaultResolver().queryTxt(qname);
-  var out = [];
-  for (var i = 0; i < r.rrs.length; i += 1) {
-    var rr = r.rrs[i];
-    if (rr && rr.type === 16) {                                                  // IANA DNS qtype TXT
-      out.push(Array.isArray(rr.decoded) ? rr.decoded : [String(rr.decoded)]);
-    }
-  }
-  if (out.length === 0) {
-    var err = new Error("no TXT records for " + qname);
-    err.code = "ENODATA";
-    throw err;
-  }
-  return out;
+  return networkDnsResolver().resolveTxt(qname, operatorLookup, _getDefaultResolver());
 }
 
 async function _safeResolveA(qname, family /* 4|6 */, operatorLookup) {
@@ -1082,15 +1074,11 @@ async function _spfEvaluateDomain(domain, ip, dnsLookup, lookups, ctx) {
 
 async function _fetchDmarcRecord(domain, dnsLookup) {
   var qname = "_dmarc." + domain.toLowerCase();
-  var records;
-  try {
-    records = await _safeResolveTxt(qname, dnsLookup);
-  } catch (e) {
-    if (e && (e.code === "ENOTFOUND" || e.code === "ENODATA")) return null;
-    throw new MailAuthError("mail-auth/dmarc-lookup-failed",
-      "DMARC TXT lookup for " + qname + " failed: " +
-      ((e && e.message) || String(e)));
-  }
+  var records = await networkDnsResolver().safeResolveTxt(qname, {
+    dnsLookup:    dnsLookup,
+    errorFactory: function (code, msg) { return new MailAuthError(code, msg); },
+    code:         "mail-auth/dmarc-lookup-failed",
+  });
   if (!Array.isArray(records)) return null;
   var matches = [];
   for (var i = 0; i < records.length; i += 1) {
@@ -1120,14 +1108,12 @@ var DMARCBIS_VALID_PSD = { y: 1, n: 1, u: 1 };
 function _parseDmarcRecord(text) {
   var policy = { v: null, p: null, sp: null, np: null, psd: null,
                  pct: 100, adkim: "r", aspf: "r" };                              // RFC 7489 default pct
-  var pairs = text.split(";");                                                              // allow:bare-split-on-quoted-header — RFC 7489 §6.4 DMARC tag-list grammar: `tag-spec *( ";" tag-spec )` with tag-value = 0*( tval *( WSP / FWS ) ); NO quoted-string allowed
+  // RFC 7489 §6.4 DMARC tag-list grammar: `tag-spec *( ";" tag-spec )`,
+  // tag-value carries NO quoted-string — the naive split is correct.
+  var pairs = structuredFields.parseTagList(text);
   for (var i = 0; i < pairs.length; i += 1) {
-    var kv = pairs[i].trim();
-    if (kv.length === 0) continue;
-    var eq = kv.indexOf("=");
-    if (eq === -1) continue;
-    var key = kv.slice(0, eq).trim().toLowerCase();
-    var val = kv.slice(eq + 1).trim();
+    var key = pairs[i][0];
+    var val = pairs[i][1];
     if (key === "v")     policy.v = val;
     else if (key === "p")     policy.p = val.toLowerCase();
     else if (key === "sp")    policy.sp = val.toLowerCase();
@@ -1417,10 +1403,10 @@ async function arcVerify(rfc822, opts) {
   var orderTrail = [];                       // [{ inst, name, idx }]
   for (var i = 0; i < headers.length; i += 1) {
     var line = headers[i];
-    var colonAt = line.indexOf(":");
-    if (colonAt === -1) continue;
-    var name = line.slice(0, colonAt).trim().toLowerCase();
-    var value = line.slice(colonAt + 1).trim();
+    var khv = structuredFields.parseKeyValuePiece(line, ":");
+    if (khv.value === null) continue;
+    var name = khv.key;
+    var value = khv.value.trim();
     if (name !== "arc-seal" && name !== "arc-message-signature" &&
         name !== "arc-authentication-results") continue;
     // ARC hop instance per RFC 8617 §4.2.1 — bounded to 3 digits; the
@@ -1734,9 +1720,9 @@ async function _verifyAmsViaDkim(rfc822, hop, sigValue, tags, dkim, dnsLookup) {
   var rebuilt = [];
   for (var i = 0; i < headerLines.length; i += 1) {
     var line = headerLines[i];
-    var colonAt = line.indexOf(":");
-    if (colonAt === -1) { rebuilt.push(line); continue; }
-    var name = line.slice(0, colonAt).trim().toLowerCase();
+    var khv = structuredFields.parseKeyValuePiece(line, ":");
+    if (khv.value === null) { rebuilt.push(line); continue; }
+    var name = khv.key;
     if (name === "arc-message-signature" ||
         name === "arc-seal" ||
         name === "dkim-signature") {
@@ -1747,7 +1733,7 @@ async function _verifyAmsViaDkim(rfc822, hop, sigValue, tags, dkim, dnsLookup) {
       // canonicalizes it via h=). Pre-v0.8.17 stripped every AAR
       // unconditionally, breaking verification on chains that
       // included AAR in h= (Microsoft + Google interop).
-      var instMatch = /\bi\s*=\s*(\d+)/.exec(line.slice(colonAt + 1));
+      var instMatch = /\bi\s*=\s*(\d+)/.exec(khv.value);
       if (!instMatch || parseInt(instMatch[1], 10) !== hop.instance) continue;
     }
     rebuilt.push(line);
@@ -1763,16 +1749,11 @@ async function _verifyAmsViaDkim(rfc822, hop, sigValue, tags, dkim, dnsLookup) {
 }
 
 function _parseArcTagList(value) {
+  // RFC 8617 §4 ARC tag-list grammar (same as DKIM's): `tag-spec *( ";"
+  // tag-spec )`, tag-value contains no DQUOTE, FWS inside a value ignored.
+  var pairs = structuredFields.parseTagList(value, { stripValueWs: true });
   var tags = {};
-  var parts = String(value).split(";");                                                          // allow:bare-split-on-quoted-header — RFC 8617 §4 ARC tag-list grammar (same as the DKIM RFC's): `tag-spec *( ";" tag-spec )`, tag-value contains no DQUOTE
-
-  for (var i = 0; i < parts.length; i += 1) {
-    var p = parts[i].trim();
-    if (p.length === 0) continue;
-    var eq = p.indexOf("=");
-    if (eq === -1) continue;
-    tags[p.slice(0, eq).trim().toLowerCase()] = p.slice(eq + 1).trim().replace(/\s+/g, "");
-  }
+  for (var i = 0; i < pairs.length; i += 1) tags[pairs[i][0]] = pairs[i][1];
   return tags;
 }
 
@@ -1791,11 +1772,9 @@ function _parseDkimKeyRecord(records) {
 }
 
 function _canonRelaxedHeader(name, value) {
-  // RFC 6376 §3.4.2 — relaxed header canon: lowercase name, unfold,
-  // collapse internal WSP runs, strip trailing WSP.
-  var unfolded = String(value).replace(/\r?\n[ \t]+/g, " ");
-  var trimmed = unfolded.replace(/[ \t]+/g, " ").replace(/^[ \t]+|[ \t]+$/g, "");
-  return name.toLowerCase() + ":" + trimmed + "\r\n";
+  // RFC 6376 §3.4.2 relaxed header canon — shared with the DKIM signer/verifier
+  // so the DMARC/ARC paths reach a byte-identical canon (RFC 8617 §5.1.1).
+  return dkim.canonHeaderRelaxed(name, value);
 }
 
 function _pemFromB64KeyMaterial(b64) {
@@ -1897,10 +1876,10 @@ async function arcEvaluate(rfc822, opts) {
   var hopAr = {};
   for (var hi = 0; hi < headers.length; hi += 1) {
     var line = headers[hi];
-    var colonAt = line.indexOf(":");
-    if (colonAt === -1) continue;
-    var name = line.slice(0, colonAt).trim().toLowerCase();
-    var value = line.slice(colonAt + 1).trim();
+    var khv = structuredFields.parseKeyValuePiece(line, ":");
+    if (khv.value === null) continue;
+    var name = khv.key;
+    var value = khv.value.trim();
     if (name === "arc-seal") {
       var iMatch = value.match(/(?:^|[;,\s])i=(\d+)/);                            // allow:regex-no-length-cap — header bounded by RFC 5322 998
       var dMatch = value.match(/(?:^|[;,\s])d=([^\s;]+)/);                        // allow:regex-no-length-cap — header bounded by RFC 5322 998
@@ -2167,7 +2146,7 @@ function _countFromAuthors(value) {
 // (RFC 7489 §6.6.1 — a multi-author From is the header-duplication
 // spoofing shape and must not have "one" author picked from it).
 function _extractFromHeaders(headerBlock) {
-  var unfolded = headerBlock.replace(/\r?\n[ \t]+/g, " ");
+  var unfolded = structuredFields.unfoldHeaderContinuations(headerBlock);
   var lines = unfolded.split(/\r?\n/);
   var fromValues = [];
   for (var i = 0; i < lines.length; i += 1) {
@@ -2552,12 +2531,7 @@ function _shapeAggregateReport(parsed) {
 // before they reach here, but escaping is applied uniformly so a future
 // caller can't bypass it.
 function _xmlEscapeText(value) {
-  return String(value)
-    .replace(/&/g, "&amp;")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;")
-    .replace(/'/g, "&apos;");
+  return markupEscape(value, { apos: "&apos;" });
 }
 
 // Emit `<tag>escaped-text</tag>` when value is non-null/defined; emit
@@ -2984,9 +2958,9 @@ function dmarcParseForensicReport(input, opts) {
   var maxBytes = (typeof opts.maxBytes === "number" && isFinite(opts.maxBytes) && opts.maxBytes > 0)
     ? opts.maxBytes
     : DMARC_RUF_MAX_REPORT_BYTES;
-  if (asString.length > maxBytes) {
+  if (safeBuffer.byteLengthOf(asString) > maxBytes) {
     return _rufError("mail-auth/dmarc-ruf-too-large",
-      "dmarc.parseForensicReport: report exceeds " + maxBytes + " bytes (got " + asString.length + ")");
+      "dmarc.parseForensicReport: report exceeds " + maxBytes + " bytes (got " + safeBuffer.byteLengthOf(asString) + ")");
   }
 
   // ---- Bisect top-level headers / body; require multipart/report ----

package/lib/vendor/blamejs/lib/mail-bimi.js

@@ -48,15 +48,16 @@
  *   RFC 9091 BIMI policy lookup, VMC + CMC fetch + chain validation, and Tiny-PS SVG profile enforcement for inbox brand-mark rendering.
  */
 
-var dns = require("node:dns");
 var nodeCrypto = require("node:crypto");
-var dnsPromises = dns.promises;
 
 var asn1 = require("./asn1-der");
 var C = require("./constants");
 var httpClient = require("./http-client");
 var lazyRequire = require("./lazy-require");
+var networkDnsResolver = lazyRequire(function () { return require("./network-dns-resolver"); });
 var safeBuffer = require("./safe-buffer");
+var markupTokenizer = require("./markup-tokenizer");
+var structuredFields = require("./structured-fields");
 var safeUrl = require("./safe-url");
 var validateOpts = require("./validate-opts");
 var { defineClass, MailBimiError } = require("./framework-error");
@@ -211,17 +212,12 @@ function recordShape(opts) {
 function parseRecord(text) {
   if (typeof text !== "string" || text.length === 0) return null;
   if (text.length > BIMI_RECORD_MAX_BYTES) return null;
-  // RFC 9091 4 - semicolon-separated, key=value, leading "v=BIMI1".
-  var parts = text.split(";");
+  // RFC 9091 §4 — semicolon-separated key=value (no DQUOTE), leading "v=BIMI1".
+  var pairs = structuredFields.parseTagList(text);
   var rv = { v: null, l: null, a: null };
-  for (var i = 0; i < parts.length; i += 1) {
-    var p = parts[i].trim();
-    if (p.length === 0) continue;
-    var eq = p.indexOf("=");
-    if (eq === -1) continue;
-    var k = p.slice(0, eq).trim().toLowerCase();
-    var v = p.slice(eq + 1).trim();
-    if (k === "v" || k === "l" || k === "a") rv[k] = v;
+  for (var i = 0; i < pairs.length; i += 1) {
+    var k = pairs[i][0];
+    if (k === "v" || k === "l" || k === "a") rv[k] = pairs[i][1];
   }
   if (rv.v !== BIMI_VERSION || !rv.l) return null;
   return rv;
@@ -264,16 +260,13 @@ async function fetchPolicy(domain, opts) {
   opts = opts || {};
   var selector = opts.selector || BIMI_DEFAULT_SELECTOR;
   var qname = selector + "._bimi." + domain;
-  var records;
-  try {
-    if (opts.dnsLookup) records = await opts.dnsLookup(qname, "TXT");
-    else records = await dnsPromises.resolveTxt(qname);
-  } catch (e) {
-    if (e && (e.code === "ENOTFOUND" || e.code === "ENODATA")) return null;
-    throw new BimiError("mail-bimi/lookup-failed",
-      "bimi.fetchPolicy: TXT lookup for " + qname + " failed: " +
-      ((e && e.message) || String(e)));
-  }
+  // Secure DNS path (DoH/DNSSEC via the framework resolver) — not plaintext
+  // dnsPromises, which a spoofed BIMI TXT could exploit to mislead VMC discovery.
+  var records = await networkDnsResolver().safeResolveTxt(qname, {
+    dnsLookup:    opts.dnsLookup,
+    errorFactory: function (code, msg) { return new BimiError(code, msg); },
+    code:         "mail-bimi/lookup-failed",
+  });
   // RFC 9091 4.1 - a TXT lookup may return multiple chunks; pick
   // the first record that begins with v=BIMI1.
   for (var i = 0; i < (records || []).length; i += 1) {
@@ -542,32 +535,19 @@ function _tokenizeTinyPsSvg(s) {
       continue;
     }
 
-    var pp = lt + 1;
-    var inQuote = "";
-    while (pp < len) {
-      var ch = s.charAt(pp);
-      if (inQuote) {
-        if (ch === inQuote) inQuote = "";
-      } else {
-        if (ch === '"' || ch === "'") inQuote = ch;
-        else if (ch === ">") break;
-      }
-      pp += 1;
-    }
+    var pp = markupTokenizer.scanToTagEnd(s, lt + 1, len);
     if (pp >= len) throw new Error("unterminated start tag");   // allow:bare-error-throw — caught by outer try/catch and re-thrown as MailBimiError("bimi/svg-tiny-ps-violation")
     var raw = s.slice(lt, pp + 1);
     var inner = raw.slice(1, raw.length - 1);
     var selfClosing = inner.endsWith("/");
     if (selfClosing) inner = inner.slice(0, inner.length - 1);
 
-    var nameMatch = inner.match(/^([A-Za-z][A-Za-z0-9:_-]*)/);
-    var tagName = nameMatch ? nameMatch[1].toLowerCase() : "";
-    var attrSrc = nameMatch ? inner.slice(nameMatch[0].length) : "";
+    var bimiParts = markupTokenizer.splitTagNameAttrs(inner, /^([A-Za-z][A-Za-z0-9:_-]*)/);
 
     tokens.push({
       type:        "tag",
-      name:        tagName,
-      attrs:       _parseTinyPsAttrs(attrSrc),
+      name:        bimiParts.tagName,
+      attrs:       _parseTinyPsAttrs(bimiParts.attrSrc),
       raw:         raw,
       selfClosing: selfClosing,
     });

package/lib/vendor/blamejs/lib/mail-crypto-pgp.js

@@ -113,6 +113,7 @@
  *     band fingerprint pinning is the operator's responsibility)
  */
 var lazyRequire  = require("./lazy-require");
+var safeBuffer   = require("./safe-buffer");
 var audit        = lazyRequire(function () { return require("./audit"); });
 var nodeCrypto   = require("node:crypto");
 var validateOpts = require("./validate-opts");
@@ -1168,7 +1169,7 @@ function wkdFetch(email, opts) {
   var urls = wkdComputeUrl(email, { advancedHost: opts.advancedHost });
   return Promise.resolve(opts.httpsGet(urls.direct)).then(function (resp) {
     if (resp && resp.status === 200 && Buffer.isBuffer(resp.body) && resp.body.length > 0) {          // HTTP 200
-      if (resp.body.length > maxBytes) {
+      if (safeBuffer.byteLengthOf(resp.body) > maxBytes) {
         throw new MailCryptoError("mail-crypto/pgp/wkd-too-large",
           "wkd.fetch: key bytes " + resp.body.length + " exceed maxKeyBytes=" + maxBytes);
       }
@@ -1176,7 +1177,7 @@ function wkdFetch(email, opts) {
     }
     return Promise.resolve(opts.httpsGet(urls.advanced)).then(function (resp2) {
       if (resp2 && resp2.status === 200 && Buffer.isBuffer(resp2.body) && resp2.body.length > 0) {    // HTTP 200
-        if (resp2.body.length > maxBytes) {
+        if (safeBuffer.byteLengthOf(resp2.body) > maxBytes) {
           throw new MailCryptoError("mail-crypto/pgp/wkd-too-large",
             "wkd.fetch: key bytes " + resp2.body.length + " exceed maxKeyBytes=" + maxBytes);
         }

package/lib/vendor/blamejs/lib/mail-dav.js

@@ -129,8 +129,8 @@
  *   backend. Defends the RRULE-recursion expansion-DoS class at the PUT boundary.
  */
 
-var lazyRequire = require("./lazy-require");
 var C = require("./constants");
+var markupEscape = require("./markup-escape").markupEscape;
 var safeIcal = require("./safe-ical");
 var safeVcard = require("./safe-vcard");
 var safeBuffer = require("./safe-buffer");
@@ -138,7 +138,7 @@ var validateOpts = require("./validate-opts");
 var xmlC14n = require("./xml-c14n");
 var { defineClass } = require("./framework-error");
 
-var audit = lazyRequire(function () { return require("./audit"); });
+var auditEmit = require("./audit-emit");
 
 var MailDavError = defineClass("MailDavError", { alwaysPermanent: true });
 
@@ -221,15 +221,7 @@ function create(opts) {
   var calStorage  = opts.storage.calendar || null;
   var cardStorage = opts.storage.addressbook || null;
 
-  function _emit(action, metadata, outcome) {
-    try {
-      audit().safeEmit({
-        action:   action,
-        outcome:  outcome || "success",
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent — audit best-effort */ }
-  }
+  var _emit = auditEmit.emit;
 
   // ---- URL parsing (per-tenant principal isolation) ----------------------
   //
@@ -299,28 +291,14 @@ function create(opts) {
         resolve(Buffer.from(JSON.stringify(req.body), "utf8"));
         return;
       }
-      // safeBuffer.boundedChunkCollector enforces maxBytes inside
-       // push(); any chunk that would overflow throws + we reject the
-       // promise. The body is bounded BEFORE the cap is reached so the
-       // single allocation in result() is bounded by maxBytes.
-      var collector = safeBuffer.boundedChunkCollector({
+      // collectStream's boundedChunkCollector enforces maxBytes inside push()
+      // (overflow throws → reject) and destroys the stream on cap/error.
+      safeBuffer.collectStream(req, {
         maxBytes:    maxBody,
         errorClass:  MailDavError,
         sizeCode:    "mail-dav/oversize-body",
         sizeMessage: "request body exceeds " + maxBody + " bytes",
-      });
-      req.on("data", function (chunk) {
-        try { collector.push(chunk); }
-        catch (e) {
-          req.destroy();
-          reject(e);
-        }
-      });
-      req.on("end", function () {
-        try { resolve(collector.result()); }
-        catch (e) { reject(e); }
-      });
-      req.on("error", function (e) { reject(e); });
+      }).then(resolve, reject);
     });
   }
 
@@ -370,12 +348,7 @@ function create(opts) {
 
   function _xmlEscape(s) {
     if (s === null || s === undefined) return "";
-    return String(s)
-      .replace(/&/g, "&")
-      .replace(/</g, "&lt;")
-      .replace(/>/g, "&gt;")
-      .replace(/"/g, "&quot;")
-      .replace(/'/g, "&apos;");
+    return markupEscape(s, { apos: "&apos;" });
   }
 
   // Render a small subset of well-known DAV / CalDAV / CardDAV

package/lib/vendor/blamejs/lib/mail-deploy.js

@@ -51,8 +51,10 @@ var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
 var numericBounds = require("./numeric-bounds");
 var C = require("./constants");
+var markupEscape = require("./markup-escape").markupEscape;
 var safeJson = require("./safe-json");
 var safeBuffer = require("./safe-buffer");
+var codepointClass = require("./codepoint-class");
 var guardJson = lazyRequire(function () { return require("./guard-json"); });
 var audit = lazyRequire(function () { return require("./audit"); });
 var { defineClass } = require("./framework-error");
@@ -73,18 +75,13 @@ function _domainOk(d) {
   // header-injection class + XML-attribute-injection class.
   for (var i = 0; i < d.length; i++) {
     var c = d.charCodeAt(i);
-    if (c < 0x20 || c === 0x7F || c === 0x22) return false;                                           // refuse C0 / DEL / "
+    if (codepointClass.isForbiddenControlChar(c, { forbidTab: true }) || c === 0x22) return false;    // refuse C0 / DEL / "
   }
   return true;
 }
 
 function _xmlEscape(s) {
-  return String(s)
-    .replace(/&/g, "&amp;")
-    .replace(/</g, "&lt;")
-    .replace(/>/g, "&gt;")
-    .replace(/"/g, "&quot;")
-    .replace(/'/g, "&apos;");
+  return markupEscape(s, { apos: "&apos;" });
 }
 
 /**
@@ -375,7 +372,7 @@ function autoConfigXml(opts) {
     // Refuse control bytes / quote in the URL.
     for (var k = 0; k < cfg.url.length; k++) {
       var c = cfg.url.charCodeAt(k);
-      if (c < 0x20 || c === 0x7F || c === 0x22) {                                                     // C0 / DEL / "
+      if (codepointClass.isForbiddenControlChar(c, { forbidTab: true }) || c === 0x22) {                                                     // C0 / DEL / "
         throw new MailDeployError("mail-deploy/bad-jmap-url",
           "autoConfigXml: opts.jmap.url contains control byte");
       }
@@ -444,7 +441,7 @@ function autoDiscoverXml(opts) {
   // Refuse CR / LF / NUL / control bytes in email (XML injection class).
   for (var i = 0; i < opts.email.length; i++) {
     var c = opts.email.charCodeAt(i);
-    if (c < 0x20 || c === 0x7F) {                                                                     // C0 / DEL
+    if (codepointClass.isForbiddenControlChar(c, { forbidTab: true })) {                                                                     // C0 / DEL
       throw new MailDeployError("mail-deploy/bad-email",
         "autoDiscoverXml: opts.email contains control byte");
     }

package/lib/vendor/blamejs/lib/mail-dkim.js

@@ -40,6 +40,7 @@
  */
 var lazyRequire = require("./lazy-require");
 var audit       = lazyRequire(function () { return require("./audit"); });
+var structuredFields = require("./structured-fields");
 var nodeCrypto  = require("node:crypto");
 var safeBuffer  = require("./safe-buffer");
 var validateOpts = require("./validate-opts");
@@ -85,7 +86,7 @@ var RSA_LEGACY_MIN_BITS = 1024;
 function _canonHeaderRelaxed(name, value) {
   // Lowercase name, unfold continuations, collapse internal WSP runs to
   // single SP, strip leading/trailing WSP from value.
-  var unfolded = String(value).replace(/\r?\n[ \t]+/g, " ");
+  var unfolded = structuredFields.unfoldHeaderContinuations(value);
   var trimmed = unfolded.replace(/[ \t]+/g, " ").replace(/^[ \t]+|[ \t]+$/g, "");
   return name.toLowerCase() + ":" + trimmed + "\r\n";
 }
@@ -460,26 +461,13 @@ function create(opts) {
 // hard dependency on it. When omitted, falls back to node:dns.
 
 function _parseDkimTagList(value) {
-  // RFC 6376 §3.2 — tags are `key=value` separated by `;`. Whitespace
-  // around `=` and `;` is allowed and stripped. The signer folds the
-  // DKIM-Signature header across CRLF + WSP; unfold first so tag
-  // boundaries land in the right place.
-  var unfolded = String(value).replace(/\r?\n[ \t]+/g, " ");
+  // RFC 6376 §3.2 — tags are `key=value` separated by `;`, no DQUOTE in
+  // the grammar. Whitespace around `=` and `;` is stripped; the signer
+  // folds the DKIM-Signature across CRLF + WSP, so unfold first, and FWS
+  // inside a tag value is ignored, so strip all value whitespace.
+  var pairs = structuredFields.parseTagList(value, { unfold: true, stripValueWs: true });
   var tags = {};
-  var parts = unfolded.split(";");
-  for (var i = 0; i < parts.length; i += 1) {
-    var p = parts[i].trim();
-    if (p.length === 0) continue;
-    var eq = p.indexOf("=");
-    if (eq === -1) continue;
-    var key = p.slice(0, eq).trim().toLowerCase();
-    var val = p.slice(eq + 1).trim();
-    // Whitespace inside values is unfolded — RFC 6376 §3.2 says FWS
-    // (folding whitespace) is ignored within a tag value. Strip
-    // newlines + tabs while preserving the meaningful tokens.
-    val = val.replace(/\s+/g, "");
-    tags[key] = val;
-  }
+  for (var i = 0; i < pairs.length; i += 1) tags[pairs[i][0]] = pairs[i][1];
   return tags;
 }
 
@@ -570,25 +558,10 @@ function _getDefaultResolver() {
   return _defaultResolver;
 }
 
+// Reshape TXT records off this module's own resolver via the shared
+// networkDnsResolver.resolveTxt (the legacy `[[chunk1, chunk2], ...]` shape).
 async function _safeResolveTxt(qname, operatorLookup) {
-  if (operatorLookup) return operatorLookup(qname, "TXT");
-  var r = await _getDefaultResolver().queryTxt(qname);
-  // Resolver returns parsed RRs; reshape to the legacy
-  // `[[chunk1, chunk2], ...]` shape so callers downstream don't care
-  // which path produced the bytes.
-  var out = [];
-  for (var i = 0; i < r.rrs.length; i += 1) {
-    var rr = r.rrs[i];
-    if (rr && rr.type === 16) {                                                  // IANA DNS qtype TXT
-      out.push(Array.isArray(rr.decoded) ? rr.decoded : [String(rr.decoded)]);
-    }
-  }
-  if (out.length === 0) {
-    var err = new Error("no TXT records for " + qname);
-    err.code = "ENODATA";
-    throw err;
-  }
-  return out;
+  return networkDnsResolver().resolveTxt(qname, operatorLookup, _getDefaultResolver());
 }
 
 function _resetDkimKeyCacheForTest() { DKIM_KEY_CACHE.clear(); }
@@ -1244,8 +1217,16 @@ module.exports = {
   DKIM_MAX_SIGNATURES_PER_MESSAGE: DKIM_MAX_SIGNATURES_PER_MESSAGE,
   DKIM_MAX_SIGNATURES_PER_MESSAGE_CEILING: DKIM_MAX_SIGNATURES_PER_MESSAGE_CEILING,
   DKIM_CLOCK_SKEW_MS_MAX:     DKIM_CLOCK_SKEW_MS_MAX,
+  canonHeaderRelaxed:         _canonHeaderRelaxed,   // RFC 6376 §3.4.2 — shared by the ARC signer + DMARC/ARC verifier
   _canonHeaderRelaxedForTest: _canonHeaderRelaxed,
   _canonBodyRelaxedForTest:   _canonBodyRelaxed,
   _canonBodySimpleForTest:    _canonBodySimple,
   _stripBTagValueForTest:     _stripBTagValue,
+  // The header-block parser that produces the { name, value } pairs fed to the
+  // canonicalizers. Exposed so a golden-vector test can pin its byte-exact
+  // extraction (folding, exact name, leading-SP-preserved value) — the
+  // sign->verify round-trip cannot, since both sides share this parser, so a
+  // parser byte-error is self-consistent and would only surface as a signature
+  // rejection at a real external verifier.
+  _parseHeadersForTest:       _parseHeaders,
 };

package/lib/vendor/blamejs/lib/mail-greylist.js

@@ -103,6 +103,7 @@ var bCrypto            = require("./crypto");
 var lazyRequire        = require("./lazy-require");
 var ipUtils            = require("./ip-utils");
 var gateContract       = require("./gate-contract");
+var { boundedMap }     = require("./bounded-map");
 
 var audit              = lazyRequire(function () { return require("./audit"); });
 
@@ -129,9 +130,6 @@ var PROFILES = Object.freeze({
 
 var COMPLIANCE_POSTURES = gateContract.ALL_STRICT_POSTURES;
 
-var IPV4_RE = /^(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}$/;       // allow:regex-no-length-cap — anchored + per-octet repeat-cap
-var IPV6_RE = /^[0-9a-fA-F:]+$/;                                                                          // allow:regex-no-length-cap — length-checked separately
-
 /**
  * @primitive b.mail.greylist.create
  * @signature b.mail.greylist.create(opts?)
@@ -163,7 +161,7 @@ var IPV6_RE = /^[0-9a-fA-F:]+$/;
  */
 function create(opts) {
   opts = opts || {};
-  var profile = opts.profile || (opts.posture && COMPLIANCE_POSTURES[opts.posture]) || DEFAULT_PROFILE;
+  var profile = gateContract.resolveProfileName(opts, COMPLIANCE_POSTURES, DEFAULT_PROFILE);
   if (!PROFILES[profile]) {
     throw new MailGreylistError("mail-greylist/bad-profile",
       "create: unknown profile '" + profile + "'");
@@ -341,7 +339,7 @@ function _hashFingerprint(cidr, mailFrom, rcptTo) {
 }
 
 function _cidrKey(ip, ipv4Prefix, ipv6Prefix) {
-  if (IPV4_RE.test(ip)) {
+  if (ipUtils.isIPv4(ip)) {
     var octets = ip.split(".").map(function (s) { return parseInt(s, 10); });
     var prefix = Math.min(32, Math.max(0, ipv4Prefix));                                                  // IPv4 address bit width
     // Apply prefix: zero out the host bits.
@@ -355,7 +353,7 @@ function _cidrKey(ip, ipv4Prefix, ipv6Prefix) {
       masked & 0xff,
     ].join(".") + "/" + prefix;
   }
-  if (IPV6_RE.test(ip)) {
+  if (ipUtils.looksLikeIPv6Hex(ip)) {
     // Expand IPv6, then mask. Reuse the expansion approach from
     // mail-rbl by inlining since this is a different prefix shape.
     var expanded = ipUtils.expandIpv6Hex(ip);
@@ -390,41 +388,32 @@ function _emitAudit(auditImpl, action, metadata) {
 }
 
 function _memoryStore(maxEntries) {
-  var data = new Map();
-  var insertionOrder = [];
+  // The in-memory backend is exactly the bounded-map ceiling primitive: cap
+  // the entry count and drop the oldest on insert at capacity. boundedMap owns
+  // the insertion-order tracking and eviction; this store layers greylist TTL
+  // semantics (putAt/ttlMs) on top.
+  var data = boundedMap({ maxEntries: maxEntries, policy: "evict-oldest" });
   return {
     get: async function (key) {
       var entry = data.get(key);
       return entry ? entry.value : null;
     },
     put: async function (key, value, ttlMs) {
-      if (!data.has(key)) {
-        if (data.size >= maxEntries) {
-          // Evict oldest.
-          var oldest = insertionOrder.shift();
-          if (oldest) data.delete(oldest);
-        }
-        insertionOrder.push(key);
-      }
+      // boundedMap evicts the oldest entry when a NEW key arrives at capacity;
+      // updating an existing key neither grows the map nor evicts.
       data.set(key, { value: value, putAt: Date.now(), ttlMs: ttlMs });
     },
     delete: async function (key) {
       data.delete(key);
-      var i = insertionOrder.indexOf(key);
-      if (i !== -1) insertionOrder.splice(i, 1);
     },
     gc: async function (olderThanMs) {
       var now = Date.now();
-      var removed = 0;
+      var expired = [];
       data.forEach(function (entry, key) {
-        if (now - entry.putAt > olderThanMs) {
-          data.delete(key);
-          var i = insertionOrder.indexOf(key);
-          if (i !== -1) insertionOrder.splice(i, 1);
-          removed += 1;
-        }
+        if (now - entry.putAt > olderThanMs) expired.push(key);
       });
-      return removed;
+      expired.forEach(function (key) { data.delete(key); });
+      return expired.length;
     },
   };
 }