@blamejs/core 0.15.11 → 0.15.13

package/lib/guard-yaml.js

@@ -69,7 +69,6 @@ var codepointClass = require("./codepoint-class");
 var lazyRequire = require("./lazy-require");
 var gateContract = require("./gate-contract");
 var C = require("./constants");
-var numericBounds = require("./numeric-bounds");
 var safeYamlLazy = lazyRequire(function () { return require("./parsers/safe-yaml"); });
 var { GuardYamlError } = require("./framework-error");
 
@@ -120,10 +119,7 @@ var PROFILES = Object.freeze({
     leadingZeroPolicy:      "reject",
     duplicateKeyPolicy:     "reject",
     mergeKeyPolicy:         "reject",
-    bidiPolicy:             "reject",
-    controlPolicy:          "reject",
-    nullBytePolicy:         "reject",
-    zeroWidthPolicy:        "reject",
+    ...gateContract.CHAR_THREATS_REJECT_ALL,
     safeCoreTagsAllowed:    false,
     maxBytes:               C.BYTES.mib(2),
     maxDepth:               8,                                                   // recursion depth, not byte size
@@ -177,37 +173,13 @@ var PROFILES = Object.freeze({
   },
 });
 
-var DEFAULTS = Object.freeze(Object.assign({}, PROFILES["strict"], {
-  mode:          "enforce",
-  maxRuntimeMs:  C.TIME.seconds(10),
-}));
-
-var COMPLIANCE_POSTURES = Object.freeze({
-  "hipaa": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-  "pci-dss": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(256),
-  }),
-  "gdpr": Object.assign({}, PROFILES["balanced"], {
-    forensicSnippetBytes: C.BYTES.bytes(128),
-  }),
-  "soc2": Object.assign({}, PROFILES["strict"], {
-    forensicSnippetBytes: C.BYTES.bytes(512),
-  }),
+var DEFAULTS = gateContract.strictDefaults(PROFILES, {
+  maxRuntimeMs: C.TIME.seconds(10),
 });
 
-// ---- Helpers ----
+var COMPLIANCE_POSTURES = gateContract.compliancePostures(PROFILES, { base: 256 });
 
-function _resolveOpts(opts) {
-  return gateContract.resolveProfileAndPosture(opts, {
-    profiles:           PROFILES,
-    compliancePostures: COMPLIANCE_POSTURES,
-    defaults:           DEFAULTS,
-    errorClass:         GuardYamlError,
-    errCodePrefix:      "yaml",
-  });
-}
+// ---- Helpers ----
 
 function _isDangerousTag(tag) {
   for (var i = 0; i < DANGEROUS_TAG_PREFIXES.length; i += 1) {
@@ -237,16 +209,9 @@ function _scanTags(text) {
 }
 
 function _detectIssues(input, opts) {
-  var issues = [];
-  if (typeof input !== "string") {
-    return [{ kind: "bad-input", severity: "high",
-              snippet: "input is not a string" }];
-  }
-  if (input.length > opts.maxBytes) {
-    return [{ kind: "too-large", severity: "high", ruleId: "yaml.too-large",
-              snippet: "input " + input.length +
-                       " bytes exceeds maxBytes " + opts.maxBytes }];
-  }
+  var pre = gateContract.detectStringInput(input, opts, { name: "yaml", noun: "input", emptyMode: "skip", scanCodepoints: false, cap: { bytes: opts.maxBytes, kind: "too-large", snippet: function (byteLen, max) { return "input " + byteLen + " bytes exceeds maxBytes " + max; } } });
+  if (pre.done) return pre.issues;
+  var issues = pre.issues;
 
   // 1. Tag-injection scan.
   var tagHits = _scanTags(input);
@@ -496,21 +461,12 @@ function _detectDuplicateKeysYaml(text) {
  *   rv.ok;                                              // → false
  *   rv.issues.some(function (i) { return i.kind === "dangerous-tag"; });  // → true
  */
-function validate(input, opts) {
-  opts = _resolveOpts(opts);
-  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
-    ["maxBytes", "maxDepth", "maxAnchors", "maxAliasDepth",
-     "maxDocuments", "maxNodes", "maxScalarLength"],
-    "guardYaml.validate", GuardYamlError, "yaml.bad-opt");
-  if (typeof input !== "string") {
-    return {
-      ok: false,
-      issues: [{ kind: "bad-input", severity: "high",
-                 snippet: "input is not a string" }],
-    };
-  }
-  return gateContract.aggregateIssues(_detectIssues(input, opts));
-}
+// validate is assembled by gateContract.defineGuard from `detect`
+// (_detectIssues) below — `validate(input, opts) = aggregateIssues(detect(
+// input, resolveOpts(opts)))`, with the positive-finite-int opt caps declared
+// via `intOpts`. A non-string input refuses through `_detectIssues`'s own
+// bad-input branch, so the result shape is unchanged. The @primitive block
+// above documents the resulting public ABI.
 
 /**
  * @primitive  b.guardYaml.parse
@@ -548,7 +504,13 @@ function validate(input, opts) {
  *   safe.age;                                           // → 30
  */
 function parse(input, opts) {
-  opts = _resolveOpts(opts);
+  opts = gateContract.resolveProfileAndPosture(opts, {
+    profiles:           PROFILES,
+    compliancePostures: COMPLIANCE_POSTURES,
+    defaults:           DEFAULTS,
+    errorClass:         GuardYamlError,
+    errCodePrefix:      "yaml",
+  });
   if (typeof input !== "string") {
     throw _err("yaml.bad-input", "parse requires string input");
   }
@@ -605,7 +567,9 @@ module.exports = gateContract.defineGuard({
   mimeTypes:   ["application/yaml", "application/x-yaml", "text/yaml", "text/x-yaml"],
   extensions:  [".yml", ".yaml"],
   integrationFixtures: INTEGRATION_FIXTURES,
-  validate:    validate,
+  detect:      _detectIssues,
+  intOpts:     ["maxBytes", "maxDepth", "maxAnchors", "maxAliasDepth",
+                "maxDocuments", "maxNodes", "maxScalarLength"],
   extra: {
     parse:                  parse,
     DANGEROUS_TAG_PREFIXES: DANGEROUS_TAG_PREFIXES,

package/lib/http-client-cache.js

@@ -47,6 +47,7 @@ var canonicalJson    = require("./canonical-json");
 var safeUrl          = require("./safe-url");
 var structuredFields = require("./structured-fields");
 var validateOpts     = require("./validate-opts");
+var numericBounds    = require("./numeric-bounds");
 var { HttpClientError } = require("./framework-error");
 
 // ---- Tunables ----------------------------------------------------------
@@ -107,7 +108,9 @@ function _parseCacheControl(value) {
     else { k = p.slice(0, eq).trim(); v = p.slice(eq + 1).trim(); }
     // Strip surrounding quotes from value.
     if (v.length >= 2 && v.charAt(0) === '"' && v.charAt(v.length - 1) === '"') {
-      v = v.slice(1, v.length - 1).replace(/\\"/g, "\"").replace(/\\\\/g, "\\");
+      // Single-pass RFC 8941 unescape (chained .replace() mis-decodes
+      // an escaped backslash adjacent to another escape).
+      v = structuredFields.unescapeSfStringBody(v.slice(1, v.length - 1));
     }
     out[k.toLowerCase()] = v;
   }
@@ -391,18 +394,10 @@ function memoryStore(opts) {
   if (typeof opts !== "object") {
     throw _hcErr("httpclient/cache-bad-opts", "memoryStore: opts must be an object");
   }
-  if (opts.maxBytes !== undefined &&
-      (typeof opts.maxBytes !== "number" || !isFinite(opts.maxBytes) ||
-       opts.maxBytes <= 0 || Math.floor(opts.maxBytes) !== opts.maxBytes)) {
-    throw _hcErr("httpclient/cache-bad-opts",
-      "memoryStore: maxBytes must be a positive integer");
-  }
-  if (opts.maxEntries !== undefined &&
-      (typeof opts.maxEntries !== "number" || !isFinite(opts.maxEntries) ||
-       opts.maxEntries <= 0 || Math.floor(opts.maxEntries) !== opts.maxEntries)) {
-    throw _hcErr("httpclient/cache-bad-opts",
-      "memoryStore: maxEntries must be a positive integer");
-  }
+  numericBounds.requirePositiveFiniteIntIfPresent(opts.maxBytes,
+    "memoryStore: maxBytes", HttpClientError, "httpclient/cache-bad-opts", { permanent: true });
+  numericBounds.requirePositiveFiniteIntIfPresent(opts.maxEntries,
+    "memoryStore: maxEntries", HttpClientError, "httpclient/cache-bad-opts", { permanent: true });
   if (opts.evictionPolicy !== undefined && opts.evictionPolicy !== "lru") {
     throw _hcErr("httpclient/cache-bad-opts",
       "memoryStore: evictionPolicy must be 'lru' (got " + JSON.stringify(opts.evictionPolicy) + ")");

package/lib/http-client-cookie-jar.js

@@ -170,10 +170,8 @@ function create(opts) {
   }
   var vault = opts.vault || null;
   if (persist === "vault") {
-    if (!vault || typeof vault.seal !== "function" || typeof vault.unseal !== "function") {
-      throw _err("BAD_OPT",
-        "cookieJar.create: persist: 'vault' requires opts.vault with seal/unseal (pass b.vault)");
-    }
+    validateOpts.requireMethods(vault, ["seal", "unseal"],
+      "cookieJar.create: persist: 'vault' opts.vault (pass b.vault)", CookieJarError, "BAD_OPT");
   }
   var filePath = null;
   if (persist === "file") {

package/lib/http-client.js

@@ -53,6 +53,7 @@ var safeBuffer = require("./safe-buffer");
 var safeUrl = require("./safe-url");
 var ssrfGuard = require("./ssrf-guard");
 var networkProxy = require("./network-proxy");
+var numericBounds = require("./numeric-bounds");
 var validateOpts = require("./validate-opts");
 var { FrameworkError, HttpClientError } = require("./framework-error");
 
@@ -165,15 +166,9 @@ function configurePool(opts) {
         "'. Allowed: " + allowed.join(", "));
     }
   }
-  function _requirePositiveInt(name, value) {
-    if (typeof value !== "number" || !isFinite(value) || value <= 0 || Math.floor(value) !== value) {
-      throw new Error("httpClient.configurePool: " + name +
-        " must be a positive integer, got " + JSON.stringify(value));
-    }
-  }
-  if (opts.maxSockets     !== undefined) _requirePositiveInt("maxSockets",     opts.maxSockets);
-  if (opts.maxFreeSockets !== undefined) _requirePositiveInt("maxFreeSockets", opts.maxFreeSockets);
-  if (opts.keepAliveMsecs !== undefined) _requirePositiveInt("keepAliveMsecs", opts.keepAliveMsecs);
+  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
+    ["maxSockets", "maxFreeSockets", "keepAliveMsecs"], "httpClient.configurePool",
+    HttpClientError, "httpclient/bad-opts", { permanent: true });
   if (opts.keepAlive      !== undefined && typeof opts.keepAlive !== "boolean") {
     throw new Error("httpClient.configurePool: keepAlive must be a boolean");
   }
@@ -1825,12 +1820,8 @@ function _validateDownloadOpts(opts) {
   }
   validateOpts.optionalPositiveFinite(opts.timeoutMs, "downloadStream: timeoutMs",
     HttpClientError, "httpclient/bad-opts");
-  if (opts.maxBytes !== undefined &&
-      (typeof opts.maxBytes !== "number" || !isFinite(opts.maxBytes) || opts.maxBytes <= 0 ||
-       Math.floor(opts.maxBytes) !== opts.maxBytes)) {
-    throw _hcErr("httpclient/bad-opts",
-      "downloadStream: maxBytes must be a positive finite integer");
-  }
+  numericBounds.requirePositiveFiniteIntIfPresent(opts.maxBytes,
+    "downloadStream: maxBytes", HttpClientError, "httpclient/bad-opts", { permanent: true });
 }
 
 function _emitAudit(opts, action, outcome, metadata) {
@@ -2050,12 +2041,8 @@ function _validateUploadOpts(opts) {
   }
   validateOpts.optionalPositiveFinite(opts.timeoutMs, "uploadMultipartStream: timeoutMs",
     HttpClientError, "httpclient/bad-opts");
-  if (opts.maxBytes !== undefined &&
-      (typeof opts.maxBytes !== "number" || !isFinite(opts.maxBytes) || opts.maxBytes <= 0 ||
-       Math.floor(opts.maxBytes) !== opts.maxBytes)) {
-    throw _hcErr("httpclient/bad-opts",
-      "uploadMultipartStream: maxBytes must be a positive finite integer");
-  }
+  numericBounds.requirePositiveFiniteIntIfPresent(opts.maxBytes,
+    "uploadMultipartStream: maxBytes", HttpClientError, "httpclient/bad-opts", { permanent: true });
 }
 
 /**

package/lib/http-message-signature.js

@@ -60,6 +60,7 @@
  */
 
 var nodeCrypto       = require("node:crypto");
+var bCrypto          = require("./crypto");
 var safeUrl          = require("./safe-url");
 var safeBuffer       = require("./safe-buffer");
 var C                = require("./constants");
@@ -406,7 +407,9 @@ function _parseSignatureInput(headerValue) {
       throw _err("BAD_HEADER",
         "httpSig: Signature-Input: unterminated quoted token");
     }
-    var bareName = coveredRaw.slice(qStart, qEnd).replace(/\\\\/g, "\\").replace(/\\"/g, "\"");
+    // Single-pass RFC 8941 §3.3.3 unescape — NOT two chained .replace() passes,
+    // which mis-decode an escaped backslash adjacent to another escape.
+    var bareName = structuredFields.unescapeSfStringBody(coveredRaw.slice(qStart, qEnd));
     i2 = qEnd + 1;
     // Optional ;param=value;param=... suffix immediately following.
     var suffixStart = i2;
@@ -525,13 +528,28 @@ function verify(msg, opts) {
     if (!presented) {
       return { valid: false, reason: "content-digest-header-missing" };
     }
-    var actual = contentDigest(m.body);
-    // RFC 9530 allows multiple algorithms in one header (sha-512=...,
-    // sha-256=...). For SHA3-512 specifically — exact substring match
-    // against the presented header. For peer-supplied SHA-512 / SHA-256
-    // identifiers the operator is responsible for re-validating; this
-    // primitive only auto-checks SHA3-512.
-    if (presented.indexOf(actual.replace(/^sha3-512=/, "sha3-512=")) === -1) {
+    // contentDigest() returns the canonical structured-field form
+    // `sha3-512=:<base64>:`. RFC 9530 permits a multi-member header
+    // (e.g. `sha-256=:...:, sha3-512=:...:`); split on top-level commas and
+    // match the sha3-512 member EXACTLY, in constant time, rather than by an
+    // unanchored substring scan that could spuriously match the digest text
+    // buried inside another member's value or parameters. Peer-supplied
+    // sha-512 / sha-256 identifiers stay the operator's responsibility.
+    var expectedDigest = contentDigest(m.body);           // "sha3-512=:<b64>:"
+    var matchedDigest  = false;
+    var digestMembers  = structuredFields.splitTopLevel(presented, ",");
+    for (var di = 0; di < digestMembers.length; di++) {
+      var member = digestMembers[di].trim();
+      var deq = member.indexOf("=");
+      if (deq < 1) continue;
+      var dkv = structuredFields.parseKeyValuePiece(member);
+      if (dkv.key !== "sha3-512") continue;
+      var memberCanonical = "sha3-512=" + dkv.value.trim();
+      // crypto.timingSafeEqual is the length-tolerant constant-time wrapper
+      // (returns false for unequal lengths without leaking via a length branch).
+      if (bCrypto.timingSafeEqual(memberCanonical, expectedDigest)) { matchedDigest = true; break; }
+    }
+    if (!matchedDigest) {
       return { valid: false, reason: "content-digest-mismatch" };
     }
   }

package/lib/i18n-messageformat.js

@@ -45,6 +45,7 @@
  * shaped JSON entries continue to work unchanged.
  */
 var lazyRequire = require("./lazy-require");
+var boundedMap = require("./bounded-map");
 var { defineClass } = require("./framework-error");
 
 var I18nMessageFormatError = defineClass("I18nMessageFormatError",
@@ -314,12 +315,9 @@ function _skipWs(state) {
 var _pluralRulesCache = new Map();
 function _pluralRules(locale, type) {
   var key = locale + "\x1f" + type;
-  var pr = _pluralRulesCache.get(key);
-  if (!pr) {
-    pr = new Intl.PluralRules(locale, { type: type });
-    _pluralRulesCache.set(key, pr);
-  }
-  return pr;
+  return boundedMap.getOrInsert(_pluralRulesCache, key, function () {
+    return new Intl.PluralRules(locale, { type: type });
+  });
 }
 
 function format(template, vars, locale) {
@@ -382,7 +380,7 @@ function looksLikeMessageFormat(template) {
   if (typeof template !== "string") return false;
   // Cheap structural check — full-syntax detection comes from parse()
   // throwing if it isn't valid MessageFormat.
-  return /\{[^}]+,\s*(plural|select|selectordinal)\b/.test(template);
+  return /\{[^{}]+,\s*(plural|select|selectordinal)\b/.test(template);
 }
 
 module.exports = {

package/lib/i18n.js

@@ -64,7 +64,7 @@ var requestHelpers = require("./request-helpers");
 var safeJson = require("./safe-json");
 var validateOpts = require("./validate-opts");
 var { I18nError } = require("./framework-error");
-var { boundedMap } = require("./bounded-map");
+var { boundedMap, getOrInsert } = require("./bounded-map");
 
 // Per-instance formatter caches are keyed on (locale, JSON.stringify
 // formatOpts). A fixed `locales` set bounds the locale axis, but operators
@@ -133,6 +133,80 @@ function _validateLocaleArray(name, value) {
   }
 }
 
+// Pure resolution-chain builder — the subtag-strip walk shared by the
+// instance lookup and the public localeChain primitive. Start at the requested
+// locale and strip subtag suffixes right-to-left ("pt-BR" -> "pt"); subtag
+// stripping always applies (same language, less specific). Cross-locale
+// fallback (to fallbackLocale, then defaultLocale) fires only when
+// fallbackLocale is non-null — fallbackLocale: null is strict "this locale or
+// miss". No duplicate baseline.
+function _buildLocaleChain(locale, fallbackLocale, defaultLocale) {
+  var chain = [];
+  var current = locale;
+  while (current && chain.indexOf(current) === -1) {
+    chain.push(current);
+    var dash = current.lastIndexOf("-");
+    if (dash === -1) break;
+    current = current.slice(0, dash);
+  }
+  if (fallbackLocale === null) return chain;
+  if (chain.indexOf(fallbackLocale) === -1) chain.push(fallbackLocale);
+  if (chain.indexOf(defaultLocale) === -1) chain.push(defaultLocale);
+  return chain;
+}
+
+/**
+ * @primitive  b.i18n.localeChain
+ * @signature  b.i18n.localeChain(locale, opts)
+ * @since      0.15.13
+ * @status     stable
+ * @related    b.i18n.create
+ *
+ * Resolve a requested BCP 47 locale to its ordered fallback chain — the same
+ * subtag-strip logic the file-backed `t()` lookup uses, surfaced as a pure,
+ * instance-independent function so a data-backed consumer (translations in a
+ * database row, a CMS page, a CDN-cached asset) can drive its own per-`(resource,
+ * locale, field)` lookups on the framework's BCP 47 fallback instead of
+ * re-deriving subtag stripping by hand.
+ *
+ * Pure: no file loading, no message lookup. The chain is the requested locale,
+ * then each subtag-stripped parent ("fr-CA" -> "fr"), then `fallbackLocale`,
+ * then `defaultLocale`, de-duplicated. `fallbackLocale: null` gives strict
+ * "this locale or its parents only" (no cross-locale jump).
+ *
+ * @opts
+ *   defaultLocale:  string,          // BCP 47; required; the final baseline
+ *   fallbackLocale: string | null,   // null = strict; omitted = defaultLocale
+ *   locales:        string[],        // optional configured set; when given, defaultLocale + fallbackLocale must be members
+ *
+ * @example
+ *   b.i18n.localeChain("fr-CA", { defaultLocale: "en", fallbackLocale: "en" });
+ *   // → ["fr-CA", "fr", "en"]
+ *   b.i18n.localeChain("zh-Hant-TW", { defaultLocale: "en", fallbackLocale: null });
+ *   // → ["zh-Hant-TW", "zh-Hant", "zh"]   (strict — no jump to en)
+ */
+function localeChain(locale, opts) {
+  opts = opts || {};
+  _validateLocale("i18n.localeChain: locale", locale);
+  _validateLocale("i18n.localeChain: defaultLocale", opts.defaultLocale);
+  var defaultLocale = opts.defaultLocale;
+  var fallbackLocale = (opts.fallbackLocale === null) ? null
+    : ((opts.fallbackLocale === undefined) ? defaultLocale : opts.fallbackLocale);
+  if (fallbackLocale !== null) _validateLocale("i18n.localeChain: fallbackLocale", fallbackLocale);
+  if (opts.locales !== undefined) {
+    _validateLocaleArray("i18n.localeChain: locales", opts.locales);
+    if (opts.locales.indexOf(defaultLocale) === -1) {
+      throw _err("BAD_OPT", "i18n.localeChain: defaultLocale '" + defaultLocale +
+        "' must be one of the configured locales");
+    }
+    if (fallbackLocale !== null && opts.locales.indexOf(fallbackLocale) === -1) {
+      throw _err("BAD_OPT", "i18n.localeChain: fallbackLocale '" + fallbackLocale +
+        "' must be one of the configured locales");
+    }
+  }
+  return _buildLocaleChain(locale, fallbackLocale, defaultLocale);
+}
+
 function _validateInterpolation(value) {
   if (value === undefined) return DEFAULTS.interpolation;
   if (typeof value !== "object" || value === null) {
@@ -366,13 +440,11 @@ function _makeFormatterCache(make, kind, emitObs) {
   return function getFormatter(locale, formatOpts) {
     var optsKey = formatOpts ? JSON.stringify(formatOpts) : "";
     var cacheKey = locale + "\x1f" + optsKey;
-    var f = cache.get(cacheKey);
-    if (!f) {
-      f = make(locale, formatOpts);
-      cache.set(cacheKey, f);
+    return getOrInsert(cache, cacheKey, function () {
+      var f = make(locale, formatOpts);
       emitObs("i18n.format.created", { kind: kind, locale: locale });
-    }
-    return f;
+      return f;
+    });
   };
 }
 
@@ -572,25 +644,9 @@ function create(opts) {
   }
 
   function _localeChain(locale) {
-    // Build the resolution chain. Start with the requested locale and
-    // strip subtag suffixes (`pt-BR` → `pt`); subtag stripping always
-    // applies because it's "same language, less specific" rather than a
-    // cross-locale jump. Cross-locale fallback (to fallbackLocale, then
-    // defaultLocale) only fires when fallbackLocale is non-null —
-    // operators who set fallbackLocale: null get strict "this locale or
-    // miss" semantics.
-    var chain = [];
-    var current = locale;
-    while (current && chain.indexOf(current) === -1) {
-      chain.push(current);
-      var dash = current.lastIndexOf("-");
-      if (dash === -1) break;
-      current = current.slice(0, dash);
-    }
-    if (fallbackLocale === null) return chain;
-    if (chain.indexOf(fallbackLocale) === -1) chain.push(fallbackLocale);
-    if (chain.indexOf(defaultLocale) === -1) chain.push(defaultLocale);
-    return chain;
+    // Delegates to the module-level pure builder; fallbackLocale /
+    // defaultLocale are this instance's resolved config.
+    return _buildLocaleChain(locale, fallbackLocale, defaultLocale);
   }
 
   function _lookupRaw(key, locale) {
@@ -932,6 +988,7 @@ var messageFormat = require("./i18n-messageformat");
 
 module.exports = {
   create:            create,
+  localeChain:       localeChain,
   messageFormat:     messageFormat,
   I18nError:         I18nError,
   DEFAULTS:          DEFAULTS,

package/lib/inbox.js

@@ -43,9 +43,11 @@
  */
 
 var C = require("./constants");
+var codepointClass = require("./codepoint-class");
 var lazyRequire = require("./lazy-require");
 var safeJson = require("./safe-json");
 var safeSql = require("./safe-sql");
+var safeBuffer = require("./safe-buffer");
 var sql = require("./sql");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
@@ -204,13 +206,11 @@ function create(opts) {
   }
 
   function _rejectControlChars(value, label, field) {
-    for (var i = 0; i < value.length; i += 1) {
-      var code = value.charCodeAt(i);
-      if (code === 0 || (code < 32 && code !== 9) || code === 127) {     // ASCII control codepoints (NUL + C0 + DEL); allow tab
-        throw new InboxError("inbox/bad-receive",
-          label + ": " + field + " contains control character at index " + i +
-          " (codepoint " + code + ")");
-      }
+    var _off = codepointClass.firstControlCharOffset(value);                // allow tab (RFC 5322 folding WS)
+    if (_off !== -1) {
+      throw new InboxError("inbox/bad-receive",
+        label + ": " + field + " contains control character at index " + _off +
+        " (codepoint " + value.charCodeAt(_off) + ")");
     }
   }
 
@@ -223,7 +223,7 @@ function create(opts) {
     var metaJson = null;
     if (receiveOpts.metadata != null) {
       var serialized = safeJson.stringify(receiveOpts.metadata);
-      if (serialized.length > maxPayloadBytes) {
+      if (safeBuffer.byteLengthOf(serialized) > maxPayloadBytes) {
         throw new InboxError("inbox/bad-receive",
           "recordReceive: metadata serialized exceeds maxPayloadBytes (" +
           maxPayloadBytes + " bytes)");

package/lib/incident-report.js

@@ -138,7 +138,6 @@ function create(opts) {
     "audit", "persist", "onStage", "deadlines", "now",
   ], "incident.report");
 
-  var auditOn = opts.audit !== false;
   var persist = typeof opts.persist === "function" ? opts.persist : null;
   var onStage = typeof opts.onStage === "function" ? opts.onStage : null;
   var deadlinesOverride = opts.deadlines || null;
@@ -150,20 +149,8 @@ function create(opts) {
   var incidents = new Map();
   var seq = 0;
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({
-        action:   "incident.report." + action,
-        outcome:  outcome,
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent */ }
-  }
-  function _emitMetric(verb, n, labels) {
-    try { observability().safeEvent("incident.report." + verb, n || 1, labels || {}); }
-    catch (_e) { /* drop-silent */ }
-  }
+  var _emitAudit = audit().namespaced("incident.report", opts.audit);
+  var _emitMetric = observability().namespaced("incident.report");
 
   function _genIncidentId(regime, detectedAt) {
     seq += 1;
@@ -339,12 +326,7 @@ function createDeadlineClock(opts) {
   var tracked = new Map();   // incidentId -> { detectedAt, dueBy, regime, acked, fired }
   var timer = null;
 
-  function _emit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({ action: "incident.report.clock." + action, outcome: outcome, metadata: metadata || {} });
-    } catch (_e) { /* drop-silent — by design */ }
-  }
+  var _emit = audit().namespaced("incident.report.clock", auditOn);
   function _notify(payload) {
     if (!notify) return;
     try {

package/lib/ip-utils.js

@@ -82,9 +82,9 @@ function expandIpv6Groups(ip) {
 // Loose IPv4 textual-form check — for primitives that need to
 // classify a string as "looks like dotted-quad IPv4" but don't need
 // the strict per-octet bound check (callers that DO need octet
-// bounds use the strict form in `mail-rbl.js` etc.). Shared so
-// `lib/mail.js`, `lib/mail-helo.js`, and `lib/redis-client.js`
-// don't drift on the same shape.
+// bounds use `isIPv4` below). Shared so `lib/mail.js`,
+// `lib/mail-helo.js`, and `lib/redis-client.js` don't drift on the
+// same shape.
 //
 //   isIPv4Shape("1.2.3.4")     → true
 //   isIPv4Shape("999.0.0.0")   → true (shape only; octets unbounded)
@@ -95,8 +95,51 @@ function isIPv4Shape(s) {
   return typeof s === "string" && IPV4_SHAPE_RE.test(s);
 }
 
+// Strict RFC 791 dotted-quad IPv4: four 0-255 octets separated by `.`.
+// The single source for textual IPv4 validation across the framework
+// — `b.mail.greylist` / `b.mail.rbl` CIDR fingerprinting, `b.mail.helo`
+// RFC 5321 §4.1.3 address-literals, `b.guardDomain` IPv4-as-domain
+// detection, and `b.safeSchema` `.ip()`. Hand-rolling the per-octet
+// alternation had drifted into several spellings; this is canonical.
+//
+//   isIPv4("203.0.113.42")  → true
+//   isIPv4("256.0.0.1")     → false (octet > 255)
+//   isIPv4("1.2.3")         → false (three octets)
+var IPV4_RE = /^(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}$/;       // allow:regex-no-length-cap — anchored + per-octet repeat-cap
+function isIPv4(s) {
+  return typeof s === "string" && IPV4_RE.test(s);
+}
+
+// RFC 5321 §4.1.3 IPv4 address-literal `[1.2.3.4]`. Capture group 1 is
+// the inner dotted-quad; `b.mail.helo` matches a claimed literal
+// against the connection IP. Same per-octet bound as `IPV4_RE`.
+var IPV4_ADDR_LITERAL_RE = /^\[((?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3})\]$/;  // allow:regex-no-length-cap — anchored + per-octet repeat-cap
+
+// Loose IPv6 textual pre-filter: hex digits + colons only, bounded to
+// the RFC 4291 §2.2 max no-IPv4-tail textual length (8 groups × 4 hex
+// + 7 colons = 39). A cheap fail-fast before the full `expandIpv6Hex`
+// parse — NOT a complete validator; callers follow with
+// `expandIpv6Hex`. A hex-colon string longer than 39 chars is never a
+// valid IPv6 textual form, so the bound only rejects garbage.
+//
+//   looksLikeIPv6Hex("2001:db8::1")  → true
+//   looksLikeIPv6Hex("::1")          → true
+//   looksLikeIPv6Hex("::ffff:1.2.3.4")→ false (dotted tail — use expandIpv6Hex)
+//   looksLikeIPv6Hex("nothex")       → false
+var IPV6_TEXT_MAX_LEN = 39;                                                                              // RFC 4291 §2.2 max no-IPv4-tail textual length
+var IPV6_HEX_RE = /^[0-9a-fA-F:]+$/;                                                                     // allow:regex-no-length-cap — length-bounded by IPV6_TEXT_MAX_LEN in looksLikeIPv6Hex
+function looksLikeIPv6Hex(s) {
+  return typeof s === "string" && s.length <= IPV6_TEXT_MAX_LEN && IPV6_HEX_RE.test(s);
+}
+
 module.exports = {
-  expandIpv6Hex:    expandIpv6Hex,
-  expandIpv6Groups: expandIpv6Groups,
-  isIPv4Shape:      isIPv4Shape,
+  expandIpv6Hex:        expandIpv6Hex,
+  expandIpv6Groups:     expandIpv6Groups,
+  isIPv4Shape:          isIPv4Shape,
+  isIPv4:               isIPv4,
+  IPV4_RE:              IPV4_RE,
+  IPV4_ADDR_LITERAL_RE: IPV4_ADDR_LITERAL_RE,
+  looksLikeIPv6Hex:     looksLikeIPv6Hex,
+  IPV6_HEX_RE:          IPV6_HEX_RE,
+  IPV6_TEXT_MAX_LEN:    IPV6_TEXT_MAX_LEN,
 };