@blamejs/blamejs-shop 0.4.56 → 0.4.58

package/lib/vendor/blamejs/lib/money.js

@@ -277,6 +277,32 @@ Money.prototype.multiply = function (factor, opts) {
   return new Money(quotient, this.currency);
 };
 
+/**
+ * @primitive  b.money.Money.roundToIncrement
+ * @signature  b.money.Money.roundToIncrement(step, opts?)
+ * @since      0.15.13
+ * @status     stable
+ * @related    b.money.roundMinor, b.money.Money
+ *
+ * Snap this amount to the nearest multiple of `step` minor units, returning a
+ * new `Money` in the same currency — the cash-rounding step a coarser
+ * denomination needs (CHF to the nearest 0.05, SEK to the nearest 0.10, a
+ * 100-unit price step) without leaving the type. Integer-only; immutable;
+ * negative amounts (refund previews) round on the correct side of the tie. See
+ * `b.money.roundMinor` for the raw-integer form and the mode semantics.
+ *
+ * @opts
+ *   mode:  "half-even" | "half-up" | "half-down" | "ceiling" | "floor",  // default: half-even
+ *
+ * @example
+ *   b.money.of("12.32", "CHF").roundToIncrement(5, { mode: "half-up" });  // → CHF 12.30
+ *   b.money.of("19.97", "SEK").roundToIncrement(10);                      // → SEK 20.00
+ */
+Money.prototype.roundToIncrement = function (step, opts) {
+  opts = opts || {};
+  return new Money(roundMinor(this._minor, step, opts.mode || "half-even"), this.currency);
+};
+
 // _rationalFromDecimalString -- `"1.085"` -> { num: 1085n, den: 1000n }.
 // Strict shape; same refusals as _parseDecimalString.
 function _rationalFromDecimalString(s) {
@@ -333,6 +359,84 @@ function _divRound(n, d, rounding) {
   return r < 0n ? q - 1n : q + 1n;
 }
 
+// Cash-rounding modes for roundMinor / Money.roundToIncrement. half-even
+// (banker's) is the default and matches the rest of the module; half-up rounds
+// a tie away from zero, half-down toward zero; ceiling/floor are directional
+// (toward +inf / -inf) regardless of distance.
+var INCREMENT_MODES = {
+  "half-even": true, "half-up": true, "half-down": true, "ceiling": true, "floor": true,
+};
+
+function _toIncrementBigInt(step) {
+  if (typeof step === "bigint") {
+    if (step <= 0n) throw new MoneyError("money/bad-increment",
+      "step must be a positive integer of minor units");
+    return step;
+  }
+  if (typeof step === "number" && Number.isInteger(step) && step > 0) return BigInt(step);
+  throw new MoneyError("money/bad-increment",
+    "step must be a positive integer (BigInt or safe integer Number) of minor units; got " +
+    (typeof step === "number" ? String(step) : typeof step));
+}
+
+/**
+ * @primitive  b.money.roundMinor
+ * @signature  b.money.roundMinor(minor, step, mode?)
+ * @since      0.15.13
+ * @status     stable
+ * @related    b.money.Money, b.money.fromMinorUnits
+ *
+ * Snap a raw minor-unit integer to the nearest multiple of `step` minor units —
+ * the cash-rounding step a coarser cash denomination needs even though the
+ * currency's ISO 4217 minor unit is finer (a CHF total to the nearest 5 rappen
+ * after the 1/2-rappen coins were retired, a SEK total to the nearest 10 öre, a
+ * JPY total to a 100-unit psychological-pricing step). Pure BigInt math — no
+ * `Number` in the value path — and the remainder sign is handled so a negative
+ * amount (a refund preview) rounds on the correct side of the tie.
+ *
+ * `minor` accepts a BigInt or a safe integer `Number`; the return is a BigInt.
+ *
+ * @opts
+ *   mode:  "half-even" | "half-up" | "half-down" | "ceiling" | "floor",  // default: half-even
+ *
+ * @example
+ *   b.money.roundMinor(1232n, 5n);              // CHF 12.32 → nearest 0.05 → 1230n (12.30)
+ *   b.money.roundMinor(25n, 10n, "half-even");  // tie → even multiple → 20n
+ *   b.money.roundMinor(25n, 10n, "half-up");    // tie away from zero → 30n
+ *   b.money.roundMinor(-25n, 10n, "half-up");   // refund tie away from zero → -30n
+ */
+function roundMinor(minor, step, mode) {
+  mode = mode || "half-even";
+  if (typeof minor === "number" && Number.isInteger(minor)) minor = BigInt(minor);
+  if (typeof minor !== "bigint") {
+    throw new MoneyError("money/bad-minor-units",
+      "minor must be an integer (BigInt or safe integer Number); got " + (typeof minor));
+  }
+  if (!INCREMENT_MODES[mode]) {
+    throw new MoneyError("money/bad-rounding-mode",
+      "mode must be one of half-even | half-up | half-down | ceiling | floor; got " + String(mode));
+  }
+  var stepBig = _toIncrementBigInt(step);
+  var q = minor / stepBig;
+  var r = minor - q * stepBig;
+  if (r === 0n) return minor;
+  // lower = the multiple toward -inf, upper = toward +inf. BigInt division
+  // truncates toward zero, so the bracket flips by sign of `minor`.
+  var lower, upper;
+  if (minor >= 0n) { lower = q * stepBig; upper = lower + stepBig; }
+  else { upper = q * stepBig; lower = upper - stepBig; }
+  if (mode === "floor") return lower;
+  if (mode === "ceiling") return upper;
+  var distLow = minor - lower;     // >= 0
+  var distHigh = upper - minor;    // >= 0
+  if (distLow < distHigh) return lower;
+  if (distHigh < distLow) return upper;
+  // Exactly on the tie.
+  if (mode === "half-up") return (minor >= 0n) ? upper : lower;     // away from zero
+  if (mode === "half-down") return (minor >= 0n) ? lower : upper;   // toward zero
+  return ((lower / stepBig) % 2n === 0n) ? lower : upper;           // half-even
+}
+
 // allocate -- split `this` into `weights.length` parts proportional to
 // the weights, distributing every minor unit. Largest-remainder
 // method: floor each share, then hand out the leftover units to the
@@ -693,6 +797,7 @@ module.exports = {
   parse:           parse,
   zero:            zero,
   convert:         convert,
+  roundMinor:      roundMinor,
   CURRENCIES:      CURRENCIES,
   Money:           Money,
   MoneyError:      MoneyError,

package/lib/vendor/blamejs/lib/mtls-ca.js

@@ -58,6 +58,9 @@ var nodeCrypto = require("node:crypto");
 var atomicFile = require("./atomic-file");
 var C = require("./constants");
 var lazyRequire = require("./lazy-require");
+// Lazy — the SHA3-512 fingerprint surfaced from issuance must match the one
+// the require-mtls gate pins (b.crypto.sha3Hash(certPem)).
+var bCrypto = lazyRequire(function () { return require("./crypto"); });
 var { boot } = require("./log");
 var safeBuffer = require("./safe-buffer");
 var safeJson = require("./safe-json");
@@ -193,7 +196,7 @@ function create(opts) {
   opts = opts || {};
   validateOpts(opts, [
     "dataDir", "paths", "vault",
-    "caKeySealedMode", "generation", "engine",
+    "caKeySealedMode", "generation", "engine", "revocationStore",
   ], "b.mtlsCa");
   validateOpts.requireNonEmptyString(opts.dataDir, "mtlsCa.create: opts.dataDir", MtlsCaError, "mtls-ca/no-datadir");
   // Auto-create the dataDir with restrictive perms (CA keys live here).
@@ -370,6 +373,29 @@ function create(opts) {
     return fresh;
   }
 
+  // Recover the issued certificate's identity from its PEM so issuance and
+  // any later revocation/indexing share identifiers without a round-trip back
+  // through an X.509 parser. serialNumber is normalized to the same hex form
+  // revoke() stores; fingerprint is the SHA3-512 the require-mtls gate pins.
+  function _certIdentity(certPem) {
+    // serialNumber comes from an X.509 parse, which is best-effort: a custom
+    // engine (or a test double) may return a cert in a shape this Node build
+    // cannot parse as X.509. The fingerprint is a hash of the returned bytes,
+    // so it is always available and is what the require-mtls gate pins —
+    // revoke()/isRevoked() by fingerprint keep working even when the serial
+    // can't be recovered. Never let optional identity enrichment crash issuance.
+    var serialNumber = null;
+    try {
+      serialNumber = _normalizeSerial(new nodeCrypto.X509Certificate(certPem).serialNumber);
+    } catch (_e) {
+      serialNumber = null;
+    }
+    return {
+      serialNumber: serialNumber,
+      fingerprint:  bCrypto().sha3Hash(certPem),
+    };
+  }
+
   async function generateClientCert(opts2) {
     opts2 = opts2 || {};
     var ca = await initCA();
@@ -379,7 +405,10 @@ function create(opts) {
       throw new MtlsCaError("mtls-ca/bad-engine-output",
         "engine.signClientCert must return { cert, key, ca?, issuedAt?, expiresAt? }");
     }
-    return result;
+    // Surface the issued serial + fingerprint so the caller can track/revoke
+    // the cert by the same identifiers without re-parsing the PEM.
+    var id = _certIdentity(result.cert);
+    return Object.assign({}, result, { serialNumber: id.serialNumber, fingerprint: id.fingerprint });
   }
 
   async function generateClientP12(opts2) {
@@ -395,32 +424,63 @@ function create(opts) {
       throw new MtlsCaError("mtls-ca/bad-engine-output",
         "engine.packageP12 must return { p12: Buffer, certPem, issuedAt, expiresAt }");
     }
+    if (typeof result.certPem === "string") {
+      var id12 = _certIdentity(result.certPem);
+      return Object.assign({}, result, { serialNumber: id12.serialNumber, fingerprint: id12.fingerprint });
+    }
     return result;
   }
 
   // ---- Revocation registry + CRL ----
 
-  function _loadRevocations() {
-    if (!nodeFs.existsSync(paths.revocations)) return { revocations: [] };
-    try {
-      // safeJson.parse caps depth + size + protects against
-      // proto-pollution; the revocation file is under the operator's
-      // dataDir but a tampered or truncated file shouldn't be able to
-      // corrupt the rotator process.
-      var json = safeJson.parse(nodeFs.readFileSync(paths.revocations, "utf8"),
-        { maxBytes: C.BYTES.mib(16) });
-      if (!json || !Array.isArray(json.revocations)) return { revocations: [] };
-      return json;
-    } catch (e) {
-      throw new MtlsCaError("mtls-ca/revocation-corrupt",
-        "could not parse " + paths.revocations + ": " +
-        ((e && e.message) || String(e)));
+  // Revocation entries are read + written through a store so the registry can
+  // live somewhere other than the default plaintext revocations.json — e.g. an
+  // operator-supplied encrypted / clustered store (the bring-your-own-store
+  // precedent b.queue's config.db set). Contract (sync):
+  //   list()     -> array of revocation entries
+  //   add(entry) -> append one entry (the caller has already deduped)
+  function _defaultFileStore() {
+    function _list() {
+      if (!nodeFs.existsSync(paths.revocations)) return [];
+      try {
+        // safeJson.parse caps depth + size + protects against
+        // proto-pollution; a tampered or truncated file shouldn't be able to
+        // corrupt the rotator process.
+        var json = safeJson.parse(nodeFs.readFileSync(paths.revocations, "utf8"),
+          { maxBytes: C.BYTES.mib(16) });
+        return (json && Array.isArray(json.revocations)) ? json.revocations : [];
+      } catch (e) {
+        throw new MtlsCaError("mtls-ca/revocation-corrupt",
+          "could not parse " + paths.revocations + ": " + ((e && e.message) || String(e)));
+      }
     }
+    return {
+      list: _list,
+      add:  function (entry) {
+        var entries = _list();
+        entries.push(entry);
+        atomicFile.writeSync(paths.revocations,
+          JSON.stringify({ revocations: entries }, null, 2) + "\n", { mode: 0o600 });
+      },
+    };
   }
+  var revocationStore = opts.revocationStore || _defaultFileStore();
+  validateOpts.requireMethods(revocationStore, ["list", "add"],
+    "opts.revocationStore", MtlsCaError, "mtls-ca/bad-revocation-store");
 
-  function _saveRevocations(state) {
-    atomicFile.writeSync(paths.revocations,
-      JSON.stringify(state, null, 2) + "\n", { mode: 0o600 });
+  // A fingerprint is the SHA3-512 hex the require-mtls gate pins. Normalize it
+  // like a serial (strip 0x / separators / whitespace, lowercase, hex-validate)
+  // so a consumer can revoke by the same value the gate compares against.
+  function _normalizeFingerprint(fp) {
+    if (!fp || typeof fp !== "string") {
+      throw new MtlsCaError("mtls-ca/bad-fingerprint", "fingerprint must be a non-empty string");
+    }
+    var stripped = fp.replace(/^0x/i, "").replace(/[:\-\s]/g, "");
+    if (!safeBuffer.isHex(stripped)) {
+      throw new MtlsCaError("mtls-ca/bad-fingerprint",
+        "fingerprint contains non-hex characters: " + JSON.stringify(fp));
+    }
+    return stripped.toLowerCase();
   }
 
   function _normalizeSerial(s) {
@@ -466,46 +526,66 @@ function create(opts) {
     "aACompromise":         10,
   };
 
-  function revoke(serialNumber, opts3) {
-    var serial = _normalizeSerial(serialNumber);
+  function revoke(idOrOpts, opts3) {
+    // Accept either revoke(serialString, { reason, fingerprint }) — the
+    // backward-compatible serial-keyed form — or revoke({ serial?,
+    // fingerprint?, reason? }). The require-mtls gate denies by fingerprint,
+    // so a fingerprint-indexed consumer can revoke by the same value it pins
+    // on; serial-keyed behavior stays the default. At least one key required.
+    var spec = (idOrOpts && typeof idOrOpts === "object") ? idOrOpts : null;
     opts3 = opts3 || {};
-    var reasonName = opts3.reason || "unspecified";
+    var serialIn      = spec ? spec.serial      : idOrOpts;
+    var fingerprintIn = spec ? spec.fingerprint : opts3.fingerprint;
+    var reasonName    = (spec ? spec.reason : opts3.reason) || "unspecified";
+
+    var serial = (serialIn !== undefined && serialIn !== null) ? _normalizeSerial(serialIn) : null;
+    var fingerprint = (fingerprintIn !== undefined && fingerprintIn !== null)
+      ? _normalizeFingerprint(fingerprintIn) : null;
+    if (!serial && !fingerprint) {
+      throw new MtlsCaError("mtls-ca/no-revocation-key",
+        "revoke requires a serial number or a fingerprint " +
+        "(revoke(serial, opts) or revoke({ serial, fingerprint }))");
+    }
     var reasonCode = CRL_REASON_BY_NAME[reasonName];
     if (reasonCode === undefined) {
       throw new MtlsCaError("mtls-ca/bad-reason",
         "revoke: unknown reason '" + reasonName + "' (valid: " +
         Object.keys(CRL_REASON_BY_NAME).join(", ") + ")");
     }
-    var state = _loadRevocations();
-    var existing = state.revocations.find(function (r) {
-      return r.serialNumber === serial;
+    var existing = revocationStore.list().find(function (r) {
+      return (serial && r.serialNumber === serial) || (fingerprint && r.fingerprint === fingerprint);
     });
     if (existing) {
-      // Idempotent — repeated revoke() of the same serial doesn't
+      // Idempotent — repeated revoke() of the same serial/fingerprint doesn't
       // shift the revokedAt timestamp.
       return existing;
     }
     var entry = {
       serialNumber: serial,
+      fingerprint:  fingerprint,
       reason:       reasonName,
       reasonCode:   reasonCode,
       revokedAt:    Date.now(),
     };
-    state.revocations.push(entry);
-    _saveRevocations(state);
+    revocationStore.add(entry);
     return entry;
   }
 
-  function isRevoked(serialNumber) {
-    var serial = _normalizeSerial(serialNumber);
-    var state = _loadRevocations();
-    return state.revocations.some(function (r) {
-      return r.serialNumber === serial;
+  function isRevoked(serialOrFingerprint) {
+    // Accept a serial number OR a SHA3-512 fingerprint — both are hex, so one
+    // normalized form is matched against either key each entry carries.
+    if (!serialOrFingerprint || typeof serialOrFingerprint !== "string") {
+      throw new MtlsCaError("mtls-ca/bad-revocation-key",
+        "isRevoked requires a serial number or a fingerprint (hex string)");
+    }
+    var norm = _normalizeFingerprint(serialOrFingerprint);
+    return revocationStore.list().some(function (r) {
+      return r.serialNumber === norm || r.fingerprint === norm;
     });
   }
 
   function getRevocations() {
-    return _loadRevocations().revocations.slice();
+    return revocationStore.list().slice();
   }
 
   // Generate a signed X.509 CRL covering every entry in the registry.
@@ -521,7 +601,7 @@ function create(opts) {
         "framework's bundled CA engine, which supports it");
     }
     var ca = await initCA();
-    var revocations = _loadRevocations().revocations;
+    var revocations = revocationStore.list();
     var nowMs = Date.now();
     var thisUpdate = opts3.thisUpdate || new Date(nowMs);
     var nextUpdate = opts3.nextUpdate ||

package/lib/vendor/blamejs/lib/network-byte-quota.js

@@ -39,6 +39,7 @@
  */
 
 var C = require("./constants");
+var boundedMap = require("./bounded-map");
 var defineClass = require("./framework-error").defineClass;
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
@@ -79,9 +80,7 @@ function _slideAndSum(entry, nowHour) {
 function _memoryBackend() {
   var store = new Map();
   function _get(key) {
-    var entry = store.get(key);
-    if (!entry) { entry = _newEntry(); store.set(key, entry); }
-    return entry;
+    return boundedMap.getOrInsert(store, key, function () { return _newEntry(); });
   }
   return {
     async total(key, nowMs) {
@@ -172,27 +171,14 @@ function create(opts) {
   validateOpts(opts, ["bytesPerDay", "cache", "audit", "now"], "network.byteQuota");
   _requirePositiveBytes("bytesPerDay", opts.bytesPerDay);
   var bytesPerDay = opts.bytesPerDay;
-  var auditOn = opts.audit !== false;
   var now = typeof opts.now === "function" ? opts.now : function () { return Date.now(); };
   var backend = opts.cache && typeof opts.cache.get === "function"
     ? _cacheBackend(opts.cache)
     : _memoryBackend();
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({
-        action:   "network.byte_quota." + action,
-        outcome:  outcome,
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent — audit is best-effort */ }
-  }
+  var _emitAudit = audit().namespaced("network.byte_quota", opts.audit);
 
-  function _emitMetric(verb, n, labels) {
-    try { observability().safeEvent("network.byte_quota." + verb, n || 1, labels || {}); }
-    catch (_e) { /* drop-silent */ }
-  }
+  var _emitMetric = observability().namespaced("network.byte_quota");
 
   // check(key, bytes) — preflight without mutation. Returns
   //   { allowed, total, remaining, quota, retryAfterSec, degraded }

package/lib/vendor/blamejs/lib/network-dane.js

@@ -31,6 +31,7 @@
 
 var nodeCrypto = require("node:crypto");
 var bCrypto = require("./crypto");
+var safeBuffer = require("./safe-buffer");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -44,12 +45,13 @@ var SELECTORS = { 0: "Cert", 1: "SPKI" };
 // refused rather than guessed.
 var MATCHING = { 0: null, 1: "sha256", 2: "sha512" };
 
-function _bytes(x, what) {
-  if (Buffer.isBuffer(x)) return x;
-  if (x instanceof Uint8Array) return Buffer.from(x);
-  if (typeof x === "string") return Buffer.from(x, "hex");
-  throw new DaneError("dane/bad-bytes", "dane: " + what + " must be a Buffer / Uint8Array / hex string");
-}
+var _bytes = safeBuffer.makeByteCoercer({
+  errorClass:    DaneError,
+  typeCode:      "dane/bad-bytes",
+  messagePrefix: "dane: ",
+  messageSuffix: " must be a Buffer / Uint8Array / hex string",
+  encoding:      "hex",
+});
 
 function _selectedData(x509, selector) {
   if (selector === 0) return Buffer.from(x509.raw);                                   // full certificate DER

package/lib/vendor/blamejs/lib/network-dns-resolver.js

@@ -188,7 +188,9 @@ function create(opts) {
   var serveStale  = opts.serveStale === false ? 0 :
                     typeof opts.serveStale === "number" ? opts.serveStale : DEFAULT_STALE_WINDOW;
   var transport   = opts.transport || _defaultTransport();
-  var auditImpl   = opts.audit || audit();
+  // Audit goes to the operator-supplied sink (opts.audit) when present, else the
+  // framework chain — b.audit.namespaced no-ops if the sink has no safeEmit.
+  var _baseAudit  = audit().namespaced("network.dns.resolver", { sink: opts.audit });
 
   if (typeof transport.lookup !== "function") {
     throw new ResolverError("resolver/bad-transport",
@@ -238,11 +240,7 @@ function create(opts) {
   }
 
   function _safeEmit(action, metadata) {
-    try {
-      if (auditImpl && typeof auditImpl.safeEmit === "function") {
-        auditImpl.safeEmit({ action: "network.dns.resolver." + action, outcome: "success", metadata: metadata });
-      }
-    } catch (_e) { /* audit drop-silent per validation tier policy */ }
+    _baseAudit(action, "success", metadata);
   }
 
   async function query(name, type, qopts) {
@@ -526,8 +524,101 @@ function _minTtl(rrs) {
   return min === Infinity ? 0 : min;
 }
 
+// _sharedTxtResolver — one process-wide validating resolver (with its TTL
+// cache) shared by every email-auth policy TXT lookup, instead of each module
+// constructing its own (or reaching for plaintext system DNS).
+var _sharedResolver = null;
+function _sharedTxtResolver() {
+  if (!_sharedResolver) _sharedResolver = create();
+  return _sharedResolver;
+}
+
+/**
+ * @primitive  b.network.dns.resolver.resolveTxt
+ * @signature  b.network.dns.resolver.resolveTxt(qname, dnsLookup?, resolver?)
+ * @since      0.15.13
+ * @status     stable
+ * @related    b.network.dns.resolver.safeResolveTxt, b.network.dns.resolver.create
+ *
+ * Resolve TXT records for `qname` via the operator's `dnsLookup(qname, "TXT")`
+ * override when supplied, otherwise the framework's shared validating
+ * (DoH / DoT / system, DNSSEC-checked) resolver — normalized to the
+ * `string[][]` shape `dnsPromises.resolveTxt` returns. Throws an `ENODATA`
+ * Error when no TXT records exist.
+ *
+ * This is the secure DNS path for every email-auth policy lookup (DMARC / DKIM /
+ * ARC / BIMI / MTA-STS / TLS-RPT). Plaintext system DNS (`dnsPromises.resolveTxt`)
+ * is spoofable — DNS cache-poisoning / Kaminsky-class — and must NOT be used for
+ * records a downgrade or redirect would exploit.
+ *
+ * Pass `resolver` (a `b.network.dns.resolver.create()` instance) to reshape TXT
+ * records off a caller-owned resolver instead of the shared one — the mail-auth
+ * and mail-dkim modules use this so their TXT lookups share the same resolver
+ * (and cache) they use for A / MX / PTR, instead of each re-rolling the reshape.
+ *
+ * @example
+ *   var rrs = await b.network.dns.resolver.resolveTxt("_dmarc.example.com");
+ *   // → [ ["v=DMARC1; p=reject"] ]
+ */
+async function resolveTxt(qname, dnsLookup, resolver) {
+  if (dnsLookup) return dnsLookup(qname, "TXT");
+  var r = await (resolver || _sharedTxtResolver()).queryTxt(qname);
+  var out = [];
+  for (var i = 0; i < r.rrs.length; i += 1) {
+    var rr = r.rrs[i];
+    if (rr && rr.type === 16) {                                          // IANA DNS qtype TXT
+      out.push(Array.isArray(rr.decoded) ? rr.decoded : [String(rr.decoded)]);
+    }
+  }
+  if (out.length === 0) {
+    var err = new Error("no TXT records for " + qname);
+    err.code = "ENODATA";
+    throw err;
+  }
+  return out;
+}
+
+/**
+ * @primitive  b.network.dns.resolver.safeResolveTxt
+ * @signature  b.network.dns.resolver.safeResolveTxt(qname, opts?)
+ * @since      0.15.13
+ * @status     stable
+ * @related    b.network.dns.resolver.resolveTxt
+ *
+ * `resolveTxt` wrapped with the email-auth policy-fetch convention: a domain
+ * with no record (ENOTFOUND / ENODATA) returns `null` (absence is not an
+ * error); any other failure throws the caller's typed error via
+ * `errorFactory(code, message)` so each protocol keeps its own error class.
+ * The same secure resolver path as `resolveTxt` — never plaintext system DNS.
+ *
+ * @opts
+ *   dnsLookup:    function,   // operator override (qname, "TXT") => string[][]
+ *   errorFactory: function,   // (code, message) => Error, thrown on non-absence failures
+ *   code:         string,     // error code passed to errorFactory
+ *
+ * @example
+ *   var rrs = await b.network.dns.resolver.safeResolveTxt("_mta-sts.example.com", {
+ *     errorFactory: function (code, msg) { return new SmtpPolicyError(code, msg); },
+ *     code: "smtp/mta-sts-txt-lookup-failed",
+ *   });
+ *   if (rrs === null) return null;   // no MTA-STS record published
+ */
+async function safeResolveTxt(qname, opts) {
+  opts = opts || {};
+  try {
+    return await resolveTxt(qname, opts.dnsLookup);
+  } catch (e) {
+    if (e && (e.code === "ENOTFOUND" || e.code === "ENODATA")) return null;
+    var msg = "TXT lookup for " + qname + " failed: " + ((e && e.message) || String(e));
+    if (typeof opts.errorFactory === "function") throw opts.errorFactory(opts.code, msg);
+    throw e;
+  }
+}
+
 module.exports = {
   create:         create,
+  resolveTxt:     resolveTxt,
+  safeResolveTxt: safeResolveTxt,
   ResolverError:  ResolverError,
   QTYPE_BY_NAME:  QTYPE_BY_NAME,
 };

package/lib/vendor/blamejs/lib/network-dnssec.js

@@ -46,6 +46,7 @@
 
 var nodeCrypto = require("node:crypto");
 var bCrypto = require("./crypto");
+var safeBuffer = require("./safe-buffer");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -79,11 +80,14 @@ var TYPE_NUM = {
   SMIMEA: 53, CDS: 59, CDNSKEY: 60, OPENPGPKEY: 61, CAA: 257, HINFO: 13,
 };
 
-function _bytes(x, what) {
-  if (Buffer.isBuffer(x)) return x;
-  if (x instanceof Uint8Array) return Buffer.from(x);
-  throw new DnssecError("dnssec/bad-bytes", "dnssec: " + what + " must be a Buffer");
-}
+// DNSSEC wire data is bytes, never text (allowString:false).
+var _bytes = safeBuffer.makeByteCoercer({
+  errorClass:    DnssecError,
+  typeCode:      "dnssec/bad-bytes",
+  messagePrefix: "dnssec: ",
+  messageSuffix: " must be a Buffer",
+  allowString:   false,
+});
 
 // Canonical wire form of a domain name (RFC 4034 §6.2): each label
 // length-prefixed, ASCII lowercased, terminated by the root label.
@@ -157,8 +161,11 @@ function _dnskeyToKey(algId, publicKey) {
   return _jwkKey({ kty: "OKP", crv: "Ed25519", x: pk.toString("base64url") });
 }
 function _jwkKey(jwk) {
-  try { return nodeCrypto.createPublicKey({ key: jwk, format: "jwk" }); }
-  catch (e) { throw new DnssecError("dnssec/bad-key", "dnssec: could not import DNSKEY: " + ((e && e.message) || e)); }
+  return bCrypto.importPublicJwk(jwk, {
+    errorClass:    DnssecError,
+    code:          "dnssec/bad-key",
+    messagePrefix: "dnssec: could not import DNSKEY: ",
+  });
 }
 
 /**
@@ -284,15 +291,8 @@ function verifyRrset(opts) {
   }
 
   // Validity window (fail closed on a bad opts.at).
-  var atMs;
-  if (opts.at !== undefined && opts.at !== null) {
-    if (!(opts.at instanceof Date) || !isFinite(opts.at.getTime())) {
-      throw new DnssecError("dnssec/bad-at", "dnssec.verifyRrset: opts.at must be a valid Date");
-    }
-    atMs = opts.at.getTime();
-  } else {
-    atMs = Date.now();
-  }
+  validateOpts.optionalDate(opts.at, "dnssec.verifyRrset: opts.at", DnssecError, "dnssec/bad-at");
+  var atMs = (opts.at !== undefined && opts.at !== null) ? opts.at.getTime() : Date.now();
   var nowSec = Math.floor(atMs / 1000);
   if (nowSec < (rrsig.inception >>> 0)) throw new DnssecError("dnssec/not-yet-valid", "dnssec.verifyRrset: RRSIG inception is in the future");
   if (nowSec > (rrsig.expiration >>> 0)) throw new DnssecError("dnssec/expired", "dnssec.verifyRrset: RRSIG has expired");

package/lib/vendor/blamejs/lib/network-heartbeat.js

@@ -5,6 +5,7 @@ var net = require("node:net");
 var C = require("./constants");
 var validateOpts = require("./validate-opts");
 var lazyRequire = require("./lazy-require");
+var boundedMap = require("./bounded-map");
 var { defineClass } = require("./framework-error");
 
 var HeartbeatError = defineClass("HeartbeatError", { alwaysPermanent: true });
@@ -198,9 +199,9 @@ function start(opts) {
   var started = [];
   for (var j = 0; j < opts.targets.length; j++) {
     var t = opts.targets[j];
-    if (TARGETS.has(t.name)) {
+    boundedMap.requireAbsent(TARGETS, t.name, function () {
       throw new HeartbeatError("heartbeat/duplicate", "heartbeat target '" + t.name + "' already started");
-    }
+    });
     var entry = {
       target:              t,
       intervalMs:          t.intervalMs || DEFAULT_INTERVAL_MS,