@blamejs/core 0.14.0 → 0.14.2

package/lib/middleware/idempotency-key.js

@@ -69,8 +69,8 @@ var DEFAULT_METHODS = Object.freeze(["POST", "PUT", "PATCH", "DELETE"]);
 // control chars, length 1..255 (typical client implementations cap
 // at 36 for UUID + a few extra for vendor prefixes; 255 is the
 // upper bound that still fits a single HTTP header line).
-var KEY_RE = /^[\x21-\x7E]+$/;                                                                     // allow:raw-byte-literal — printable ASCII codepoint range
-var KEY_MAX_LEN = 255;                                                                             // allow:raw-byte-literal — draft §2 upper bound
+var KEY_RE = /^[\x21-\x7E]+$/;                                                                     // printable ASCII codepoint range
+var KEY_MAX_LEN = 255;                                                                             // draft §2 upper bound
 
 /**
  * @primitive b.middleware.idempotencyKey.memoryStore
@@ -101,7 +101,7 @@ function memoryStore(opts) {
   opts = opts || {};
   numericBounds.requirePositiveFiniteIntIfPresent(
     opts.maxEntries, "memoryStore.maxEntries", IdempotencyError, "idempotency/bad-max-entries");
-  var maxEntries = opts.maxEntries !== undefined ? opts.maxEntries : 10000;                       // allow:raw-byte-literal — default in-memory cap, not bytes
+  var maxEntries = opts.maxEntries !== undefined ? opts.maxEntries : 10000;                       // default in-memory cap, not bytes
   var data = new Map();
   return {
     get: function (key) {
@@ -705,7 +705,7 @@ function create(opts) {
       var missing = problemDetails().create({
         type:   problemDetails().getBase() + "/idempotency/missing-key",
         title:  "Idempotency-Key header required",
-        status: 400,                                                                               // allow:raw-byte-literal — HTTP status 400 Bad Request
+        status: 400,                                                                               // HTTP status 400 Bad Request
         detail: "This endpoint requires an Idempotency-Key header (draft-ietf-httpapi-idempotency-key).",
       });
       _emitAudit("idempotency.missing_key", { method: method, path: req.url }, "denied");
@@ -716,7 +716,7 @@ function create(opts) {
       var bad = problemDetails().create({
         type:   problemDetails().getBase() + "/idempotency/bad-key",
         title:  "Idempotency-Key malformed",
-        status: 400,                                                                               // allow:raw-byte-literal — HTTP status 400
+        status: 400,                                                                               // HTTP status 400
         detail: "Idempotency-Key must be ASCII printable, length 1.." + KEY_MAX_LEN + " (draft §2).",
       });
       _emitAudit("idempotency.bad_key", { method: method, keyLen: key.length }, "denied");
@@ -781,7 +781,7 @@ function create(opts) {
         var missingBody = problemDetails().create({
           type:   problemDetails().getBase() + "/idempotency/missing-body-fingerprint",
           title:  "Idempotency body fingerprint unavailable",
-          status: 400,                                                                               // allow:raw-byte-literal — HTTP status 400 Bad Request
+          status: 400,                                                                               // HTTP status 400 Bad Request
           detail: "The idempotency middleware could not derive a body fingerprint for this " +
                   "request. Mount body-parser BEFORE the idempotency middleware, OR provide an " +
                   "opts.bodyFingerprint(req) hook. To restore the pre-0.9.58 method+path-only " +
@@ -809,7 +809,7 @@ function create(opts) {
         var mismatch = problemDetails().create({
           type:   problemDetails().getBase() + "/idempotency/key-reuse-mismatch",
           title:  "Idempotency-Key reused with different request",
-          status: 422,                                                                             // allow:raw-byte-literal — HTTP status 422 Unprocessable Content (RFC 9110)
+          status: 422,                                                                             // HTTP status 422 Unprocessable Content (RFC 9110)
           detail: "The Idempotency-Key matches a prior request but the request body/method/path differs (draft §4.3).",
         });
         _emitAudit("idempotency.key_reuse_mismatch",
@@ -865,10 +865,10 @@ function create(opts) {
       if (!captured) {
         captured = true;
         _pushChunk(chunk, encoding);
-        var status = res.statusCode || 200;                                                        // allow:raw-byte-literal — default HTTP status 200
+        var status = res.statusCode || 200;                                                        // default HTTP status 200
         // Only persist 2xx-4xx responses; 5xx is transient infra
         // failure that should be retried fresh, not replayed.
-        if (!oversized && status >= 200 && status < 500) {                                         // allow:raw-byte-literal — HTTP status class boundaries
+        if (!oversized && status >= 200 && status < 500) {                                         // HTTP status class boundaries
           var headerMap = {};
           try {
             var allHeaders = typeof res.getHeaders === "function" ? res.getHeaders() : {};
@@ -913,13 +913,13 @@ function _hashKey(key) {
   // Hash before logging — operator's audit chain shouldn't carry raw
   // idempotency keys (clients sometimes inadvertently put PII / order
   // numbers in them).
-  return nodeCrypto.createHash("sha3-256").update(key, "utf8").digest("hex").slice(0, 16);         // allow:raw-byte-literal — log-truncation length, not bytes
+  return nodeCrypto.createHash("sha3-256").update(key, "utf8").digest("hex").slice(0, 16);         // log-truncation length, not bytes
 }
 
 function _redactKey(key) {
   if (typeof key !== "string") return "<non-string>";
-  if (key.length <= 8) return "<short:" + key.length + ">";                                        // allow:raw-byte-literal — log-redaction length threshold
-  return key.slice(0, 4) + "..." + key.slice(-2) + " (len=" + key.length + ")";                    // allow:raw-byte-literal — log-redaction prefix/suffix lengths
+  if (key.length <= 8) return "<short:" + key.length + ">";                                        // log-redaction length threshold
+  return key.slice(0, 4) + "..." + key.slice(-2) + " (len=" + key.length + ")";                    // log-redaction prefix/suffix lengths
 }
 
 /**

package/lib/middleware/nel.js

@@ -149,7 +149,7 @@ function create(opts) {
   // honor secure-origin report endpoints. Refusing at config-time so
   // an operator typo (`http://`) surfaces at boot, not as silent
   // never-fires-in-production.
-  if (opts.collectorUrl.slice(0, 8) !== "https://") {                                       // allow:raw-byte-literal — string-prefix length, not bytes
+  if (opts.collectorUrl.slice(0, 8) !== "https://") {                                       // string-prefix length, not bytes
     throw new TypeError(
       "middleware.nel: opts.collectorUrl must be https:// (browsers " +
       "ignore non-secure NEL collectors); got " + opts.collectorUrl);

package/lib/middleware/openapi-serve.js

@@ -113,7 +113,7 @@ function create(opts) {
   function _writeBody(req, res, body, etag, contentType) {
     var requestEtag = (req.headers && req.headers["if-none-match"]) || null;
     if (requestEtag && requestEtag === etag) {
-      res.writeHead(304, { "ETag": etag, "Cache-Control": cacheControl });          // allow:raw-byte-literal — HTTP 304
+      res.writeHead(304, { "ETag": etag, "Cache-Control": cacheControl });          // HTTP 304
       res.end();
       return;
     }
@@ -126,7 +126,7 @@ function create(opts) {
     if (accessControl === "public") {
       headers["Access-Control-Allow-Origin"] = "*";
     }
-    res.writeHead(200, headers);                                                    // allow:raw-byte-literal — HTTP 200
+    res.writeHead(200, headers);                                                    // HTTP 200
     res.end(body);
   }
 

package/lib/middleware/protected-resource-metadata.js

@@ -214,8 +214,8 @@ function create(opts) {
     var signAlgo   = null;
     if (sm.alg === "ES256") { signAlgo = "sha256"; signParams.dsaEncoding = "ieee-p1363"; }
     else if (sm.alg === "ES384") { signAlgo = "sha384"; signParams.dsaEncoding = "ieee-p1363"; }
-    else if (sm.alg === "PS256") { signAlgo = "sha256"; signParams.padding = nodeCrypto.constants.RSA_PKCS1_PSS_PADDING; signParams.saltLength = 32; }   // allow:raw-byte-literal — RFC 7518 PS256 salt
-    else if (sm.alg === "PS384") { signAlgo = "sha384"; signParams.padding = nodeCrypto.constants.RSA_PKCS1_PSS_PADDING; signParams.saltLength = 48; }   // allow:raw-byte-literal — RFC 7518 PS384 salt
+    else if (sm.alg === "PS256") { signAlgo = "sha256"; signParams.padding = nodeCrypto.constants.RSA_PKCS1_PSS_PADDING; signParams.saltLength = 32; }   // RFC 7518 PS256 salt
+    else if (sm.alg === "PS384") { signAlgo = "sha384"; signParams.padding = nodeCrypto.constants.RSA_PKCS1_PSS_PADDING; signParams.saltLength = 48; }   // RFC 7518 PS384 salt
     var sig = nodeCrypto.sign(signAlgo, Buffer.from(input, "ascii"), signParams);
     signedJwt = input + "." + _b64url(sig);
   }

package/lib/middleware/require-aal.js

@@ -36,7 +36,7 @@ function _writeUnauthorized(res, requiredBand, actualBand, realm) {
   });
   var realmStr = realm ? ' realm="' + realm + '"' : "";
   var challenge = "AAL-StepUp" + realmStr + ', required="' + requiredBand + '"';
-  res.writeHead(401, {                                                             // allow:raw-byte-literal — HTTP 401 status
+  res.writeHead(401, {                                                             // HTTP 401 status
     "Content-Type":     "application/json; charset=utf-8",
     "Content-Length":   Buffer.byteLength(body),
     "WWW-Authenticate": challenge,

package/lib/middleware/require-bound-key.js

@@ -215,12 +215,12 @@ function create(opts) {
       var presented;
       try { presented = getter(req); }
       catch (e) {
-        return _refuse(res, 400, "bound-field-getter-threw", {                            // allow:raw-byte-literal — HTTP 400
+        return _refuse(res, 400, "bound-field-getter-threw", {                            // HTTP 400
           field: fieldName, error: (e && e.message) || String(e),
         });
       }
       if (typeof presented !== "string" || presented.length === 0) {
-        return _refuse(res, 400, "bound-field-missing", {                                 // allow:raw-byte-literal — HTTP 400
+        return _refuse(res, 400, "bound-field-missing", {                                 // HTTP 400
           field: fieldName, keyId: record.id || null,
         });
       }

package/lib/middleware/require-content-type.js

@@ -91,7 +91,7 @@ function create(allowed, opts) {
     if (bare.length > 0 && normalized.indexOf(bare) !== -1) return next();
     if (!res.headersSent) {
       var body = "Unsupported Media Type";
-      res.writeHead(415, {                                                       // allow:raw-byte-literal — HTTP 415 status
+      res.writeHead(415, {                                                       // HTTP 415 status
         "Accept":         normalized.join(", "),
         "Content-Type":   "text/plain; charset=utf-8",
         "Content-Length": Buffer.byteLength(body),

package/lib/middleware/require-methods.js

@@ -75,7 +75,7 @@ function create(allowed, opts) {
     if (normalized.indexOf(m) !== -1) return next();
     if (!res.headersSent) {
       var body = "Method Not Allowed";
-      res.writeHead(405, {                                                       // allow:raw-byte-literal — HTTP 405 status
+      res.writeHead(405, {                                                       // HTTP 405 status
         "Allow":          allowHeader,
         "Content-Type":   "text/plain; charset=utf-8",
         "Content-Length": Buffer.byteLength(body),

package/lib/middleware/require-step-up.js

@@ -67,7 +67,7 @@ function _defaultGetClaims(req) {
 function _writeChallenge(res, challenge, body, statusCode) {
   if (res.headersSent) return;
   var json = JSON.stringify(body);
-  res.writeHead(statusCode, {                                                      // allow:raw-byte-literal — HTTP status passthrough
+  res.writeHead(statusCode, {                                                      // HTTP status passthrough
     "Content-Type":     "application/json; charset=utf-8",
     "Content-Length":   Buffer.byteLength(json),
     "WWW-Authenticate": challenge,
@@ -218,7 +218,7 @@ function create(opts) {
         error:             stepUp().INSUFFICIENT_USER_AUTHENTICATION,
         error_description: errorDesc || "A higher level of authentication is required",
       },
-      401                                                                                  // allow:raw-byte-literal — HTTP 401
+      401                                                                                  // HTTP 401
     );
   };
 }

package/lib/middleware/scim-server.js

@@ -61,7 +61,7 @@ function create(opts) {
   if (opts.groups) _validateResourceImpl(opts.groups, "groups");
 
   var basePath    = opts.basePath || "/scim/v2";
-  var maxPageSize = opts.maxPageSize || 200;                                                                  // allow:raw-byte-literal — page-size count, not bytes
+  var maxPageSize = opts.maxPageSize || 200;                                                                  // page-size count, not bytes
   var bearer      = opts.bearer || null;
 
   function middleware(req, res, next) {

package/lib/middleware/security-txt.js

@@ -144,15 +144,15 @@ function create(opts) {
                   (alsoAtRoot && path === "/security.txt");
     if (!matches) return next();
     if (req.method !== "GET" && req.method !== "HEAD") {
-      res.writeHead(405, {                                                       // allow:raw-byte-literal — HTTP 405 status
+      res.writeHead(405, {                                                       // HTTP 405 status
         "Allow":          "GET, HEAD",
         "Content-Type":   "text/plain; charset=utf-8",
-        "Content-Length": 18,                                                    // allow:raw-byte-literal — len of "Method Not Allowed"
+        "Content-Length": 18,                                                    // len of "Method Not Allowed"
       });
       res.end("Method Not Allowed");
       return;
     }
-    res.writeHead(200, {                                                         // allow:raw-byte-literal — HTTP 200 status
+    res.writeHead(200, {                                                         // HTTP 200 status
       "Content-Type":     "text/plain; charset=utf-8",
       "Content-Length":   bodyBuf.length,
       "Cache-Control":    "public, max-age=86400",

package/lib/middleware/tus-upload.js

@@ -59,18 +59,18 @@ var TUS_ID_BYTES = C.BYTES.bytes(18);
 
 // HTTP status codes used by TUS — hoisted to named constants so the
 // raw-byte-literal detector doesn't fire on every status path.
-var STATUS_OK                = 200;                                                // allow:raw-byte-literal — HTTP status
-var STATUS_CREATED           = 201;                                                // allow:raw-byte-literal — HTTP status
-var STATUS_NO_CONTENT        = 204;                                                // allow:raw-byte-literal — HTTP status
-var STATUS_BAD_REQUEST       = 400;                                                // allow:raw-byte-literal — HTTP status
-var STATUS_NOT_FOUND         = 404;                                                // allow:raw-byte-literal — HTTP status
-var STATUS_METHOD_NOT_ALLOWED = 405;                                               // allow:raw-byte-literal — HTTP status
-var STATUS_CONFLICT          = 409;                                                // allow:raw-byte-literal — HTTP status
-var STATUS_PRECONDITION_FAILED = 412;                                              // allow:raw-byte-literal — HTTP status
-var STATUS_PAYLOAD_TOO_LARGE = 413;                                                // allow:raw-byte-literal — HTTP status
-var STATUS_UNSUPPORTED_MEDIA = 415;                                                // allow:raw-byte-literal — HTTP status
-var STATUS_CHECKSUM_MISMATCH = 460;                                                // allow:raw-byte-literal — TUS-specific status (§3.5)
-var STATUS_INTERNAL_ERROR    = 500;                                                // allow:raw-byte-literal — HTTP status
+var STATUS_OK                = 200;                                                // HTTP status
+var STATUS_CREATED           = 201;                                                // HTTP status
+var STATUS_NO_CONTENT        = 204;                                                // HTTP status
+var STATUS_BAD_REQUEST       = 400;                                                // HTTP status
+var STATUS_NOT_FOUND         = 404;                                                // HTTP status
+var STATUS_METHOD_NOT_ALLOWED = 405;                                               // HTTP status
+var STATUS_CONFLICT          = 409;                                                // HTTP status
+var STATUS_PRECONDITION_FAILED = 412;                                              // HTTP status
+var STATUS_PAYLOAD_TOO_LARGE = 413;                                                // HTTP status
+var STATUS_UNSUPPORTED_MEDIA = 415;                                                // HTTP status
+var STATUS_CHECKSUM_MISMATCH = 460;                                                // TUS-specific status (§3.5)
+var STATUS_INTERNAL_ERROR    = 500;                                                // HTTP status
 
 var TusError = defineClass("TusError", { alwaysPermanent: true });
 

package/lib/middleware/web-app-manifest.js

@@ -136,7 +136,7 @@ function create(opts) {
     if (!matches) return next();
     if (req.method !== "GET" && req.method !== "HEAD") {
       var bodyMsg = "Method Not Allowed";
-      res.writeHead(405, {                                                       // allow:raw-byte-literal — HTTP 405 status
+      res.writeHead(405, {                                                       // HTTP 405 status
         "Allow":          "GET, HEAD",
         "Content-Type":   "text/plain; charset=utf-8",
         "Content-Length": Buffer.byteLength(bodyMsg),
@@ -144,7 +144,7 @@ function create(opts) {
       res.end(bodyMsg);
       return;
     }
-    res.writeHead(200, {                                                         // allow:raw-byte-literal — HTTP 200 status
+    res.writeHead(200, {                                                         // HTTP 200 status
       "Content-Type":     "application/manifest+json",
       "Content-Length":   bodyBuf.length,
       "Cache-Control":    "public, max-age=86400",

package/lib/network-byte-quota.js

@@ -48,7 +48,7 @@ var observability = lazyRequire(function () { return require("./observability");
 
 var ByteQuotaError = defineClass("ByteQuotaError", { alwaysPermanent: true });
 
-var BINS_PER_DAY = 24;                                                                  // allow:raw-byte-literal — 24 hours in a day
+var BINS_PER_DAY = 24;                                                                  // 24 hours in a day
 var BIN_MS = C.TIME.hours(1);
 
 function _hourBin(nowMs) { return Math.floor(nowMs / BIN_MS); }

package/lib/network-dns-resolver.js

@@ -132,23 +132,23 @@ var DEFAULT_PROFILE       = "strict";
 // OOM. Default 5000 entries: a parsed-response object ~100 bytes ×
 // 5000 ≈ 500 KiB, several orders below operator-relevant memory
 // pressure. LRU eviction picks the oldest accessed entry on overflow.
-var DEFAULT_MAX_CACHE_ENTRIES = 5000;                                                                  // allow:raw-byte-literal — cache-entry count, not a byte/time value
+var DEFAULT_MAX_CACHE_ENTRIES = 5000;                                                                  // cache-entry count, not a byte/time value
 
 var QTYPE_BY_NAME = Object.freeze({
   A:      1,
   NS:     2,
-  CNAME:  5,                                                                                            // allow:raw-byte-literal — IANA DNS qtype code
-  SOA:    6,                                                                                            // allow:raw-byte-literal — IANA DNS qtype code
-  PTR:    12,                                                                                           // allow:raw-byte-literal — IANA DNS qtype code
-  MX:     15,                                                                                           // allow:raw-byte-literal — IANA DNS qtype code
-  TXT:    16,                                                                                           // allow:raw-byte-literal — IANA DNS qtype code
-  AAAA:   28,                                                                                           // allow:raw-byte-literal — IANA DNS qtype code
-  SRV:    33,                                                                                           // allow:raw-byte-literal — IANA DNS qtype code
-  DS:     43,                                                                                           // allow:raw-byte-literal — IANA DNS qtype code
-  DNSKEY: 48,                                                                                           // allow:raw-byte-literal — IANA DNS qtype code
-  TLSA:   52,                                                                                           // allow:raw-byte-literal — IANA DNS qtype code
-  SVCB:   64,                                                                                           // allow:raw-byte-literal — IANA DNS qtype code
-  HTTPS:  65,                                                                                           // allow:raw-byte-literal — IANA DNS qtype code
+  CNAME:  5,                                                                                            // IANA DNS qtype code
+  SOA:    6,                                                                                            // IANA DNS qtype code
+  PTR:    12,                                                                                           // IANA DNS qtype code
+  MX:     15,                                                                                           // IANA DNS qtype code
+  TXT:    16,                                                                                           // IANA DNS qtype code
+  AAAA:   28,                                                                                           // IANA DNS qtype code
+  SRV:    33,                                                                                           // IANA DNS qtype code
+  DS:     43,                                                                                           // IANA DNS qtype code
+  DNSKEY: 48,                                                                                           // IANA DNS qtype code
+  TLSA:   52,                                                                                           // IANA DNS qtype code
+  SVCB:   64,                                                                                           // IANA DNS qtype code
+  HTTPS:  65,                                                                                           // IANA DNS qtype code
 });
 
 /**
@@ -314,7 +314,7 @@ function create(opts) {
     // Bit 5 of byte 3 of header; parsed.flags is the full 16-bit flags
     // field at offset 2..3. AD is bit 5 within byte 3 = bit 5 of the
     // low byte of the 16-bit flags value.
-    var ad = (parsed.flags & 0x0020) !== 0;                                                              // allow:raw-byte-literal — RFC 4035 §3.2.3 AD-bit mask within DNS header flags
+    var ad = (parsed.flags & 0x0020) !== 0;                                                              // RFC 4035 §3.2.3 AD-bit mask within DNS header flags
     if (validate && !ad) {
       throw new ResolverError("resolver/validate-failed",
         "query: validate: true but upstream returned AD=0 for " + name + "/" + qtype);
@@ -455,7 +455,7 @@ async function _wireLookup(name, qtype) {
     // parse (httpClient assumes JSON/text shapes).
     var req = https.request({                                                                            // allow:raw-outbound-http — DoH wire-format response bytes; b.httpClient envelopes assume text/JSON, and httpClient → ssrfGuard → DNS → DoH would form a cycle
       hostname:   u.hostname,
-      port:       u.port || 443,                                                                        // allow:raw-byte-literal — HTTPS port
+      port:       u.port || 443,                                                                        // HTTPS port
       path:       u.pathname + u.search,
       method:     "GET",
       headers:    { "accept": "application/dns-message" },
@@ -473,7 +473,7 @@ async function _wireLookup(name, qtype) {
       res.on("end", function () {
         try {
           if (pushFailed) { reject(pushFailed); return; }
-          if (res.statusCode !== 200) {                                                                  // allow:raw-byte-literal — HTTP 200 OK
+          if (res.statusCode !== 200) {                                                                  // HTTP 200 OK
             reject(new ResolverError("resolver/upstream-http",
               "DoH HTTP " + res.statusCode + " for " + name));
             return;
@@ -497,12 +497,12 @@ function _encodeWireQuery(name, qtype) {
   var parts = name.split(".").filter(Boolean);
   var nameLen = 1;
   for (var i = 0; i < parts.length; i += 1) nameLen += 1 + Buffer.byteLength(parts[i], "ascii");
-  var buf = Buffer.alloc(12 + nameLen + 4);                                                              // allow:raw-byte-literal — RFC 1035 §4.1.1 header (12) + question tail (4) + name
-  var id = bCrypto.randomInt(0, 0x10000);                                                              // allow:raw-byte-literal — RFC 1035 §4.1.1 16-bit query ID space
+  var buf = Buffer.alloc(12 + nameLen + 4);                                                              // RFC 1035 §4.1.1 header (12) + question tail (4) + name
+  var id = bCrypto.randomInt(0, 0x10000);                                                              // RFC 1035 §4.1.1 16-bit query ID space
   buf.writeUInt16BE(id, 0);
-  buf.writeUInt16BE(0x0100, 2);                                                                          // allow:raw-byte-literal — RFC 1035 §4.1.1 RD=1 flags
-  buf.writeUInt16BE(1, 4);                                                                               // allow:raw-byte-literal — RFC 1035 §4.1.1 qdcount
-  var off = 12;                                                                                          // allow:raw-byte-literal — RFC 1035 §4.1.1 header end / question start
+  buf.writeUInt16BE(0x0100, 2);                                                                          // RFC 1035 §4.1.1 RD=1 flags
+  buf.writeUInt16BE(1, 4);                                                                               // RFC 1035 §4.1.1 qdcount
+  var off = 12;                                                                                          // RFC 1035 §4.1.1 header end / question start
   for (var p = 0; p < parts.length; p += 1) {
     var s = parts[p];
     buf.writeUInt8(Buffer.byteLength(s, "ascii"), off);
@@ -512,8 +512,8 @@ function _encodeWireQuery(name, qtype) {
   buf.writeUInt8(0, off);
   off += 1;
   buf.writeUInt16BE(qtype, off);
-  off += 2;                                                                                              // allow:raw-byte-literal — RFC 1035 §4.1.2 QTYPE width
-  buf.writeUInt16BE(1, off);                                                                             // allow:raw-byte-literal — RFC 1035 §4.1.2 QCLASS=IN
+  off += 2;                                                                                              // RFC 1035 §4.1.2 QTYPE width
+  buf.writeUInt16BE(1, off);                                                                             // RFC 1035 §4.1.2 QCLASS=IN
   return buf;
 }