@blamejs/blamejs-shop 0.5.20 → 0.5.22

package/lib/customer-surveys.js

@@ -69,6 +69,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 var C = b.constants;
 
 // ---- constants ----------------------------------------------------------
@@ -104,8 +105,6 @@ var MAX_EXPIRES_HOURS        = 24 * 365;  // 1 year
 var DEFAULT_LIMIT            = 50;
 var MAX_LIMIT                = 500;
 
-var CONTROL_BYTE_RE          = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var CONTROL_BYTE_STRICT_RE   = /[\x00-\x1f\x7f]/;
 
 // NPS / CSAT / CES enforce a primary-question shape so the rollup
 // math has something well-defined to bucket against. Custom surveys
@@ -143,9 +142,7 @@ function _title(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
     throw new TypeError("customerSurveys: title must be a non-empty string <= " + MAX_TITLE_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("customerSurveys: title must not contain control bytes");
-  }
+  textGuard.freeText(s, "customerSurveys: title", { bidiMarks: "allow" });
   return s;
 }
 
@@ -173,9 +170,7 @@ function _sourceEventId(s) {
   if (typeof s !== "string" || s.length > MAX_SOURCE_EVENT_LEN) {
     throw new TypeError("customerSurveys: source_event_id must be a string <= " + MAX_SOURCE_EVENT_LEN + " chars");
   }
-  if (CONTROL_BYTE_STRICT_RE.test(s)) {
-    throw new TypeError("customerSurveys: source_event_id must not contain control bytes");
-  }
+  textGuard.freeText(s, "customerSurveys: source_event_id", { singleLine: "reject" });
   return s;
 }
 
@@ -192,9 +187,7 @@ function _closeReason(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_CLOSE_REASON_LEN) {
     throw new TypeError("customerSurveys: reason must be a non-empty string <= " + MAX_CLOSE_REASON_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("customerSurveys: reason must not contain control bytes");
-  }
+  textGuard.freeText(s, "customerSurveys: reason", { bidiMarks: "allow" });
   return s;
 }
 
@@ -245,7 +238,7 @@ function _questions(arr, kind) {
     if (typeof q.label !== "string" || !q.label.length || q.label.length > MAX_LABEL_LEN) {
       throw new TypeError("customerSurveys: questions[" + i + "].label must be a non-empty string <= " + MAX_LABEL_LEN + " chars");
     }
-    if (CONTROL_BYTE_RE.test(q.label)) {
+    if (textGuard.hasCodepointThreat(q.label)) {
       throw new TypeError("customerSurveys: questions[" + i + "].label must not contain control bytes");
     }
     var required = q.required == null ? true : q.required;
@@ -284,7 +277,7 @@ function _questions(arr, kind) {
           throw new TypeError("customerSurveys: questions[" + i + "].options[" + k +
                               "] must be a non-empty string <= " + MAX_OPTION_LEN + " chars");
         }
-        if (CONTROL_BYTE_RE.test(opt)) {
+        if (textGuard.hasCodepointThreat(opt)) {
           throw new TypeError("customerSurveys: questions[" + i + "].options[" + k +
                               "] must not contain control bytes");
         }
@@ -392,7 +385,7 @@ function _validateAnswers(answers, questions) {
         throw new TypeError("customerSurveys: answer for " + JSON.stringify(q.id) +
                             " must be <= " + q.max + " chars");
       }
-      if (CONTROL_BYTE_RE.test(a)) {
+      if (textGuard.hasCodepointThreat(a)) {
         throw new TypeError("customerSurveys: answer for " + JSON.stringify(q.id) +
                             " must not contain control bytes");
       }

package/lib/customers.js

@@ -36,6 +36,7 @@
 var nodeCrypto = require("node:crypto");                                   // allow:non-shop-require — Apple mandates ES256/P1363; framework has no classical ES256 signer
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var EMAIL_NAMESPACE = "customer-email";
 // Federated identity providers the OIDC sign-in path accepts.
@@ -43,7 +44,6 @@ var OAUTH_PROVIDERS = ["google", "apple"];
 var MAX_DISPLAY_NAME_LEN  = 128;
 var MAX_CRED_FIELD_BYTES  = 4096;
 var TRANSPORTS_RE = /^[a-z]+(?:,[a-z]+)*$/;
-var CONTROL_BYTE_RE = /[\x00-\x1f\x7f]/;
 
 // Pagination cursor for the operator-facing `list` — newest first by
 // (created_at, id), HMAC-tagged via b.pagination so an operator can't
@@ -105,9 +105,7 @@ function _displayName(s) {
   if (s.length > MAX_DISPLAY_NAME_LEN) {
     throw new TypeError("customers: display_name must be <= " + MAX_DISPLAY_NAME_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("customers: display_name contains control bytes");
-  }
+  textGuard.freeText(s, "customers: display_name", { singleLine: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/dispute-resolution.js

@@ -114,7 +114,6 @@ var PROCESSOR_RE    = /^[a-z0-9][a-z0-9_-]{0,63}$/;
 var REASON_CODE_RE  = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/;
 var CURRENCY_RE     = /^[A-Z]{3}$/;
 var OPERATOR_ID_RE  = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
-var CONTROL_BYTE_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 
 var KINDS = Object.freeze([
   "chargeback",
@@ -151,6 +150,7 @@ var STATUSES = Object.freeze([
 ]);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -249,9 +249,7 @@ function _narrative(s) {
       " exceeds cap " + MAX_NARRATIVE_LEN
     );
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("disputeResolution: narrative must not contain control bytes");
-  }
+  textGuard.freeText(s, "disputeResolution: narrative", { bidiMarks: "allow" });
   return s;
 }
 
@@ -265,9 +263,7 @@ function _blobRef(s) {
       " exceeds cap " + MAX_BLOB_REF_LEN
     );
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("disputeResolution: blob_ref must not contain control bytes");
-  }
+  textGuard.freeText(s, "disputeResolution: blob_ref");
   return s;
 }
 
@@ -281,9 +277,7 @@ function _notesOpt(s) {
       "disputeResolution: notes length " + s.length + " exceeds cap " + MAX_NOTES_LEN
     );
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("disputeResolution: notes must not contain control bytes");
-  }
+  textGuard.freeText(s, "disputeResolution: notes", { bidiMarks: "allow" });
   return s;
 }
 
@@ -307,9 +301,7 @@ function _writeoffReason(s) {
       " exceeds cap " + MAX_WRITEOFF_REASON_LEN
     );
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("disputeResolution: writeoff reason must not contain control bytes");
-  }
+  textGuard.freeText(s, "disputeResolution: writeoff reason", { bidiMarks: "allow" });
   return s;
 }
 

package/lib/dropship-forwarding.js

@@ -66,6 +66,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- constants ----------------------------------------------------------
 
@@ -81,7 +82,6 @@ var FORWARDING_STATUSES = Object.freeze([
 var SKU_RE          = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 var SLUG_RE         = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/;
 var CURRENCY_RE     = /^[A-Z]{3}$/;
-var CONTROL_BYTE_RE = /[\x00-\x1f\x7f]/;
 
 var MAX_RETURN_POLICY_LEN  = 4000;
 var MAX_VENDOR_REF_LEN     = 256;
@@ -183,9 +183,7 @@ function _returnPolicy(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_RETURN_POLICY_LEN) {
     throw new TypeError("dropship-forwarding: return_policy must be a non-empty string <= " + MAX_RETURN_POLICY_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("dropship-forwarding: return_policy must not contain control bytes");
-  }
+  textGuard.freeText(s, "dropship-forwarding: return_policy", { singleLine: "reject", bidiMarks: "allow" });
 }
 function _positiveInt(n, label) {
   if (!Number.isInteger(n) || n <= 0) {
@@ -214,7 +212,7 @@ function _shortText(s, label, max) {
   if (typeof s !== "string" || !s.length || s.length > max) {
     throw new TypeError("dropship-forwarding: " + label + " must be a non-empty string <= " + max + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError("dropship-forwarding: " + label + " must not contain control bytes");
   }
 }

package/lib/dunning.js

@@ -105,6 +105,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 // Framework constants (C.TIME duration helpers). Safe at module-eval —
 // the index entry point exposes `framework` before the require cascade.
 var C = b.constants;
@@ -130,10 +131,6 @@ var DEFAULT_LIST_LIMIT    = 100;
 var MS_PER_HOUR           = C.TIME.hours(1);
 
 var SLUG_RE          = /^[a-z](?:[a-z0-9-]*[a-z0-9])?$/;
-var CONTROL_BYTE_RE  = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
-var ZERO_WIDTH_RE    = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 // ---- validators ---------------------------------------------------------
 
@@ -205,9 +202,7 @@ function _reason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("dunning: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("dunning: reason contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "dunning: reason", { zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/email-ab-tests.js

@@ -105,6 +105,7 @@
  */
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- constants ----------------------------------------------------------
 
@@ -133,7 +134,6 @@ var DEFAULT_LIST_LIMIT       = 50;
 // but 1.96 is the de-facto convention for shipped dashboards.
 var WILSON_Z                 = 1.96;
 
-var CONTROL_BYTE_RE          = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 
 // ---- monotonic clock ----------------------------------------------------
 //
@@ -165,9 +165,7 @@ function _title(s) {
   if (typeof s !== "string" || !s.length || s.length > MAX_TITLE_LEN) {
     throw new TypeError("emailABTests: title must be a non-empty string <= " + MAX_TITLE_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("emailABTests: title must not contain control bytes");
-  }
+  textGuard.freeText(s, "emailABTests: title", { bidiMarks: "allow" });
   return s;
 }
 
@@ -184,7 +182,7 @@ function _label(s, idx) {
     throw new TypeError("emailABTests: variants[" + idx + "].label must be a non-empty string <= " +
                         MAX_LABEL_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("emailABTests: variants[" + idx + "].label must not contain control bytes");
   }
   return s;
@@ -223,9 +221,7 @@ function _recipientId(s) {
     throw new TypeError("emailABTests: recipient_id must be a non-empty string <= " +
                         MAX_RECIPIENT_ID_LEN + " chars");
   }
-  if (CONTROL_BYTE_RE.test(s)) {
-    throw new TypeError("emailABTests: recipient_id must not contain control bytes");
-  }
+  textGuard.freeText(s, "emailABTests: recipient_id");
   return s;
 }
 

package/lib/email-campaigns.js

@@ -146,6 +146,7 @@ var DEFAULT_BATCH_SIZE   = 100;
 var RESOLVE_PAGE_LIMIT   = 500;          // matches mailingAudiences MAX_LIST_LIMIT
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 // Framework duration constants (C.TIME.minutes(n) etc.). The index entry
 // point exposes `framework` before the require cascade, so resolving this
 // at module-eval is safe — same pattern lib/admin.js / lib/cart.js use.
@@ -164,8 +165,29 @@ var SEND_RATE_WINDOW_MS       = C.TIME.minutes(1);
 // Per-recipient broadcast outcomes recorded in email_campaign_sends.
 var SEND_OUTCOMES = ["sent", "failed", "skipped_unsubscribed", "skipped_suppressed"];
 
+// A link URL is rendered on one line and, in the plain-text part, is shown
+// to the recipient verbatim — so it is screened against the shared codepoint
+// policy rather than a local class. The class this replaced covered the
+// zero-width family but not the bidi overrides, which let a campaign body
+// carry a URL that displays as one host and resolves to another.
+// `bidiMarks` too: prose legitimately carries a direction mark (an Arabic
+// street name, a Hebrew review) and the shared screen permits them by default,
+// but a URL is machine-plain — a mark inside one is only ever there to make the
+// host read as something it is not.
+var LINK_URL_POLICY = Object.freeze({
+  singleLine: "reject",
+  zeroWidth:  "reject",
+  bidiMarks:  "reject",
+});
+
+// Free-form text folded into one ledger line. Stripped rather than refused —
+// this runs on an error path that must not itself fail.
 var CONTROL_BYTE_LINE_RE = /[\u0000-\u001f\u007f]/;
-var ZERO_WIDTH_RE        = /[\u200b-\u200f\u2028\u2029\ufeff]/;
+
+// Global twin, derived so the class is written once. `.replace` with an
+// unglobbed regex rewrites only the FIRST match, and a mailer's error message
+// can carry several control bytes — the rest would reach the stored ledger row.
+var CONTROL_BYTE_LINE_RE_G = new RegExp(CONTROL_BYTE_LINE_RE.source, "g");
 
 var STATUSES   = ["draft", "scheduled", "sending", "sent", "paused", "cancelled"];
 var EVENT_TYPES = ["delivered", "opened", "clicked", "bounced", "unsubscribed"];
@@ -190,7 +212,7 @@ function _esc(s) {
 
 function _mdSafeLinkUrl(url) {
   if (typeof url !== "string" || !url.length || url.length > 2048) return null;
-  if (CONTROL_BYTE_LINE_RE.test(url) || ZERO_WIDTH_RE.test(url)) return null;
+  if (textGuard.hasCodepointThreat(url, LINK_URL_POLICY)) return null;
   if (url.charCodeAt(0) === 47 /* "/" */) {
     if (url.length > 1 && url.charCodeAt(1) === 47) return null;
     if (url.indexOf("..") !== -1) return null;
@@ -389,10 +411,13 @@ function _validateSubject(s) {
   if (s.length > MAX_SUBJECT_LEN) {
     throw new TypeError("emailCampaigns: subject must be <= " + MAX_SUBJECT_LEN + " characters");
   }
-  if (/[\r\n\0]/.test(s)) {
-    throw new TypeError("emailCampaigns: subject must not contain CR / LF / NUL");
-  }
-  return s;
+  // A subject becomes a `Subject:` header, so a CR or LF in it is a header
+  // injection — the bytes after the break are read as another header. NUL goes
+  // with them: it truncates the field in some agents, which hides whatever
+  // follows. b.safeBuffer.assertHeaderSafe is the framework's check for a
+  // value destined for a `Name: value` field, and it refuses exactly that set.
+  return b.safeBuffer.assertHeaderSafe(
+    s, "subject", TypeError, "emailCampaigns: subject must not contain CR / LF / NUL");
 }
 
 function _validateBody(s, label) {
@@ -433,10 +458,9 @@ function _validateFromName(s) {
   if (s.length > MAX_FROM_NAME_LEN) {
     throw new TypeError("emailCampaigns: from_name must be <= " + MAX_FROM_NAME_LEN + " characters");
   }
-  if (/[\r\n\0]/.test(s)) {
-    throw new TypeError("emailCampaigns: from_name must not contain CR / LF / NUL");
-  }
-  return s;
+  // Lands in the `From:` header — same header-injection surface as the subject.
+  return b.safeBuffer.assertHeaderSafe(
+    s, "from_name", TypeError, "emailCampaigns: from_name must not contain CR / LF / NUL");
 }
 
 function _validateTs(ts, label) {
@@ -481,10 +505,10 @@ function _validateReason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("emailCampaigns: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (/[\r\n\0]/.test(s)) {
-    throw new TypeError("emailCampaigns: reason must not contain CR / LF / NUL");
-  }
-  return s;
+  // Operator-authored and surfaced in logs and the console rather than a mail
+  // header, but held to the same rule: a newline here forges a log line.
+  return b.safeBuffer.assertHeaderSafe(
+    s, "reason", TypeError, "emailCampaigns: reason must not contain CR / LF / NUL");
 }
 
 function _validateStatus(s, label) {
@@ -971,7 +995,7 @@ function create(opts) {
           // strip control bytes (no CRLF / NUL into the stored row) and
           // cap length. The recipient address is never echoed into the
           // reason — only the mailer's own message.
-          var reason = String(sendErr && sendErr.message || sendErr).replace(CONTROL_BYTE_LINE_RE, " ").slice(0, 280);
+          var reason = String(sendErr && sendErr.message || sendErr).replace(CONTROL_BYTE_LINE_RE_G, " ").slice(0, 280);
           await _finalizeSend(row.slug, consentHash || emailHash, "failed", reason);
           continue;
         }

package/lib/email-warmup.js

@@ -93,6 +93,7 @@
 // ---- constants ----------------------------------------------------------
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 var C = b.constants;
 
@@ -118,10 +119,6 @@ var IPV4_RE          = /^(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)(\.(25[0-5]|2[0-4
 var IPV6_RE          = /^[0-9a-f:]+$/;
 var ISO_DATE_RE      = /^\d{4}-\d{2}-\d{2}$/;
 
-var CONTROL_BYTE_RE  = /[\x00-\x1f\x7f]/;
-var ZERO_WIDTH_RE    = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var ALLOWED_STATUSES = Object.freeze(["active", "paused", "archived"]);
 
@@ -234,9 +231,7 @@ function _reason(s) {
   if (s.length > MAX_REASON_LEN) {
     throw new TypeError("emailWarmup: reason must be <= " + MAX_REASON_LEN + " characters");
   }
-  if (CONTROL_BYTE_RE.test(s) || ZERO_WIDTH_RE.test(s)) {
-    throw new TypeError("emailWarmup: reason contains control / zero-width bytes");
-  }
+  textGuard.freeText(s, "emailWarmup: reason", { singleLine: "reject", zeroWidth: "reject", bidiMarks: "allow" });
   return s;
 }
 

package/lib/experiments.js

@@ -116,15 +116,10 @@ var SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/;
 // title + hypothesis fields land into the operator dashboard, not the
 // storefront, but the discipline is the same — strings reach the
 // operator UI as inert text, never as live markup.
-var CONTROL_BYTE_LINE_RE  = /[\x00-\x1f\x7f]/;
-var CONTROL_BYTE_BLOCK_RE = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/;
 
 // Zero-width / direction-override family — mirrors the promo-banners
 // + gift-options catalogues. Spelled with \u-escapes so ESLint's
 // no-irregular-whitespace stays happy.
-var ZERO_WIDTH_RE = new RegExp(
-  "[\\u200B-\\u200F\\u202A-\\u202E\\u2060-\\u2064\\u2066-\\u2069\\uFEFF\\u061C]"
-);
 
 var ALLOWED_PATCH_COLUMNS = Object.freeze([
   "title",
@@ -134,6 +129,7 @@ var ALLOWED_PATCH_COLUMNS = Object.freeze([
 ]);
 
 var b = require("./vendor/blamejs");
+var textGuard = require("./text-guard");
 
 // ---- validators ---------------------------------------------------------
 
@@ -149,10 +145,10 @@ function _line(s, label, maxLen) {
   if (typeof s !== "string" || !s.length || s.length > maxLen) {
     throw new TypeError("experiments: " + label + " must be a non-empty string ≤ " + maxLen + " chars");
   }
-  if (CONTROL_BYTE_LINE_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { singleLine: "reject" })) {
     throw new TypeError("experiments: " + label + " contains control bytes (incl. CR/LF)");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("experiments: " + label + " contains zero-width / direction-override characters");
   }
   return s;
@@ -162,10 +158,10 @@ function _block(s, label, maxLen) {
   if (typeof s !== "string" || !s.length || s.length > maxLen) {
     throw new TypeError("experiments: " + label + " must be a non-empty string ≤ " + maxLen + " chars");
   }
-  if (CONTROL_BYTE_BLOCK_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s)) {
     throw new TypeError("experiments: " + label + " contains control bytes");
   }
-  if (ZERO_WIDTH_RE.test(s)) {
+  if (textGuard.hasCodepointThreat(s, { zeroWidth: "reject" })) {
     throw new TypeError("experiments: " + label + " contains zero-width / direction-override characters");
   }
   return s;
@@ -437,7 +433,7 @@ function create(opts) {
     if (typeof input.metric !== "string" || !input.metric.length || input.metric.length > MAX_METRIC_LEN) {
       return { recorded: false };
     }
-    if (CONTROL_BYTE_LINE_RE.test(input.metric) || ZERO_WIDTH_RE.test(input.metric)) {
+    if (textGuard.hasCodepointThreat(input.metric, { singleLine: "reject", zeroWidth: "reject" })) {
       return { recorded: false };
     }
     var value = 1;

package/lib/externaldb-d1.js

@@ -125,46 +125,62 @@ function _timeoutErr(ms, label) {
   return e;
 }
 
+// The attempt loop is b.retry.withRetry — exponential backoff, jitter, and
+// the final rethrow — with two things this adapter has to supply.
+//
+// The classifier is ours. The framework's default reads `err.code` and
+// `err.statusCode` off the error itself, and undici does not put them there:
+// a transport failure arrives as TypeError("fetch failed") carrying the real
+// code on `.cause`. Its retryable set also omits EAI_AGAIN and UND_ERR_SOCKET,
+// which are precisely the DNS and socket failures this adapter exists to ride
+// out. Handing it the default classifier would leave the loop in place and
+// silently stop retrying anything that matters.
+//
+// The HTTP arm has to throw to be seen at all. b.httpClient and fetch both
+// resolve a 5xx as an ordinary response, so a retryable status is raised
+// inside the attempt and the response handed back at the boundary once the
+// retries are spent — the caller still inspects `res.status` itself.
 async function _retryingFetch(fetchImpl, url, init, attempts, label) {
-  var lastErr;
-  for (var i = 0; i <= attempts; i += 1) {
-    try {
-      var res = await fetchImpl(url, init);
-      // Retry only on 5xx / 429; 4xx is a permanent client error.
-      if (res.status >= 500 || res.status === 429) {
-        lastErr = _httpErr(res.status, label);
-        if (i < attempts) {
-          await _backoff(i);
-          continue;
-        }
-      }
-      return res;
-    } catch (e) {
-      lastErr = e;
-      if (i < attempts && _isTransient(e)) {
-        await _backoff(i);
-        continue;
-      }
-      throw e;
-    }
-  }
-  throw lastErr;
+  var received = null;
+  return b.retry.withRetry(async function () {
+    var res = await fetchImpl(url, init);
+    received = res;
+    // Retry only on 5xx / 429; a 4xx is the request's own fault.
+    if (res.status >= 500 || res.status === 429) throw _httpErr(res.status, label);
+    return res;
+  }, {
+    maxAttempts: attempts + 1,          // `attempts` counts RETRIES, not tries
+    baseDelayMs: RETRY_BACKOFF_MS,
+    isRetryable: _isTransient,
+  }).catch(function (e) {
+    // Retries exhausted on a status we did receive: give the caller the
+    // response so it reports the upstream's own error, exactly as the previous
+    // loop did. A transport failure has no response and propagates.
+    if (received && e && e.status === received.status) return received;
+    throw e;
+  });
 }
 
+// Which failures are worth another attempt. Both arms matter and neither is
+// what the framework's default classifier looks at.
+//
+// Transport: undici reports a network failure as TypeError("fetch failed")
+// with the real code nested on `.cause`, so the code is read from either
+// place. EAI_AGAIN (transient DNS) and UND_ERR_SOCKET (socket torn down
+// mid-request) are the two this adapter most needs and the two the framework's
+// set leaves out.
+//
+// HTTP: a 5xx or 429 is raised as an error inside the attempt so the loop can
+// see it at all — fetch resolves those as ordinary responses. `_httpErr`
+// records the status on `.status`, so that is what is read here. A 4xx is the
+// request's own fault and is never retried.
 function _isTransient(err) {
   if (!err) return false;
+  if (typeof err.status === "number") return err.status >= 500 || err.status === 429;
   var c = err.code || (err.cause && err.cause.code);
   return c === "ECONNRESET" || c === "ETIMEDOUT" || c === "ENOTFOUND" || c === "EAI_AGAIN" || c === "UND_ERR_SOCKET";
 }
 
-function _backoff(attempt) {
-  // Jittered exponential — 200ms, 400ms, ... with ±25% jitter so
-  // retries from many container replicas don't synchronize.
-  var base = RETRY_BACKOFF_MS * Math.pow(2, attempt);
-  var jitter = base * (0.75 + (b.crypto.randomInt(0, 50) / 100));
-  return new Promise(function (r) { setTimeout(r, jitter); });
-}
-
 function _httpErr(status, label) {
   var e = new Error("externaldbD1: " + label + " failed with HTTP " + status);
   e.code = "D1_HTTP_" + status;

package/lib/geolocation.js

@@ -254,34 +254,24 @@ function _now() { return Date.now(); }
 // through to the country's default_locale.
 function _parseAcceptLanguage(raw) {
   if (typeof raw !== "string" || !raw.length) return [];
-  var entries = raw.split(",");
-  var parsed = [];
-  for (var i = 0; i < entries.length; i += 1) {
-    var part = entries[i].trim();
-    if (!part) continue;
-    var semi = part.indexOf(";");
-    var tag = (semi === -1 ? part : part.slice(0, semi)).trim();
-    var q = 1.0;
-    if (semi !== -1) {
-      var attrs = part.slice(semi + 1).split(";");
-      for (var j = 0; j < attrs.length; j += 1) {
-        var a = attrs[j].trim();
-        if (a.slice(0, 2).toLowerCase() === "q=") {
-          var n = parseFloat(a.slice(2));
-          if (isFinite(n) && n >= 0 && n <= 1) q = n;
-        }
-      }
-    }
-    if (tag === "*") continue;
-    if (!LOCALE_RE.test(tag)) continue;
-    parsed.push({ tag: tag, q: q, order: i });
-  }
-  // Stable q-desc sort (preserve original order on ties).
-  parsed.sort(function (a, b) {
-    if (a.q !== b.q) return b.q - a.q;
-    return a.order - b.order;
-  });
-  return parsed;
+  // b.requestHelpers.parseQualityList is the RFC 9110 §12.5 parser, and the
+  // edge bypass check reads the same header through it — which is what keeps
+  // the two agreeing on which tag wins. They had drifted: a header spelling
+  // the parameter `Q=0.9` was read correctly here and ignored at the edge, so
+  // a visitor sending it got one locale decided at the edge and another here.
+  //
+  // `caseSensitive` because these are BCP 47 tags and the chosen one is
+  // returned to the caller — a browser asking for `de-AT` should get `de-AT`
+  // back, not `de-at`. Matching lowercases separately in _primarySubtag.
+  //
+  // A tag carrying `q=0` is dropped rather than ranked last: q=0 means "not
+  // acceptable", and keeping it meant a locale the visitor had explicitly
+  // ruled out could still be selected when nothing else matched.
+  return b.requestHelpers.parseQualityList(raw, { caseSensitive: true })
+    .filter(function (e) {
+      return e.value !== "*" && e.q > 0 && LOCALE_RE.test(e.value);
+    })
+    .map(function (e) { return { tag: e.value, q: e.q }; });
 }
 
 function _primarySubtag(tag) {