@blamejs/core 0.15.12 → 0.15.14

package/lib/http-client.js

@@ -53,6 +53,7 @@ var safeBuffer = require("./safe-buffer");
 var safeUrl = require("./safe-url");
 var ssrfGuard = require("./ssrf-guard");
 var networkProxy = require("./network-proxy");
+var numericBounds = require("./numeric-bounds");
 var validateOpts = require("./validate-opts");
 var { FrameworkError, HttpClientError } = require("./framework-error");
 
@@ -165,15 +166,9 @@ function configurePool(opts) {
         "'. Allowed: " + allowed.join(", "));
     }
   }
-  function _requirePositiveInt(name, value) {
-    if (typeof value !== "number" || !isFinite(value) || value <= 0 || Math.floor(value) !== value) {
-      throw new Error("httpClient.configurePool: " + name +
-        " must be a positive integer, got " + JSON.stringify(value));
-    }
-  }
-  if (opts.maxSockets     !== undefined) _requirePositiveInt("maxSockets",     opts.maxSockets);
-  if (opts.maxFreeSockets !== undefined) _requirePositiveInt("maxFreeSockets", opts.maxFreeSockets);
-  if (opts.keepAliveMsecs !== undefined) _requirePositiveInt("keepAliveMsecs", opts.keepAliveMsecs);
+  numericBounds.requireAllPositiveFiniteIntIfPresent(opts,
+    ["maxSockets", "maxFreeSockets", "keepAliveMsecs"], "httpClient.configurePool",
+    HttpClientError, "httpclient/bad-opts", { permanent: true });
   if (opts.keepAlive      !== undefined && typeof opts.keepAlive !== "boolean") {
     throw new Error("httpClient.configurePool: keepAlive must be a boolean");
   }
@@ -721,6 +716,9 @@ function _stripCrossOriginAuth(headers) {
  *   responseMode:     "buffer",      // "buffer" | "stream" | "always-resolve"
  *   maxResponseBytes: undefined,     // 16 MiB control / 1 GiB GET defaults; ignored in "stream"
  *   onChunk:          undefined,     // (chunk: Buffer) => void — fires per response chunk
+ *   maxBytesPerSec:   undefined,     // token-bucket bandwidth cap (bytes/sec) — paces BOTH the download response and the upload body with backpressure
+ *   downloadTransform: undefined,    // Transform | () => Transform | array — interpose on the response stream (e.g. a hashing or progress Transform)
+ *   uploadTransform:  undefined,     // Transform | () => Transform | array — interpose on the request body before the wire
  *   signal:           undefined,     // AbortSignal — propagated to req / stream
  *   errorClass:       HttpClientError, // FrameworkError subclass for thrown errors
  *   observer:         undefined,     // (stage, info) => void — lifecycle hook
@@ -738,6 +736,132 @@ function _stripCrossOriginAuth(headers) {
  *   });
  *   // → { statusCode: 200, headers: { "content-type": "application/json", ... }, body: <Buffer> }
  */
+// Token-bucket bandwidth throttle as a Transform. Splits each chunk to the
+// credit available, releasing at most `bytesPerSec` per second (1s burst
+// capacity). Because `_transform`'s callback is not called until the whole
+// chunk has been released, backpressure propagates upstream — on a download
+// the socket pauses, on an upload the body source pauses. Wired into both the
+// response (download) and request-body (upload) pipelines so the helpers'
+// SSRF guard / DNS pinning / byte caps / atomic-rename are preserved.
+function _throttleStream(bytesPerSec) {
+  var capacity = bytesPerSec;          // allow at most 1s worth of burst
+  var tokens   = capacity;
+  var last     = Date.now();
+  function refill() {
+    var now = Date.now();
+    if (now > last) {
+      tokens = Math.min(capacity, tokens + ((now - last) / 1000) * bytesPerSec);
+      last = now;
+    }
+  }
+  return new nodeStream.Transform({
+    transform: function (chunk, _enc, cb) {
+      var self = this;
+      var offset = 0;
+      function pump() {
+        refill();
+        if (offset >= chunk.length) { cb(); return; }
+        var avail = Math.floor(tokens);
+        if (avail >= 1) {
+          var n = Math.min(chunk.length - offset, avail);
+          tokens -= n;
+          self.push(chunk.subarray(offset, offset + n));
+          offset += n;
+          if (offset >= chunk.length) { cb(); return; }
+          setImmediate(pump);          // more bytes, maybe more credit already
+        } else {
+          // ms to accrue one more byte of credit = (deficit / rate) seconds.
+          var waitMs = Math.ceil(C.TIME.seconds((1 - tokens) / bytesPerSec)) + 1;
+          var t = setTimeout(pump, waitMs);
+          if (t && typeof t.unref === "function") t.unref();
+        }
+      }
+      pump();
+    },
+  });
+}
+
+// Validate + normalize a transform opt into an array. Each entry may be a
+// Transform stream instance OR a `() => Transform` factory (the factory form is
+// retry/redirect-safe — a single Transform instance can only be piped once, so
+// a fresh one is built per attempt). Returns { ok: [...] } or { err: Error }.
+function _coerceTransforms(value, errorClass, name) {
+  if (value === undefined || value === null) return { ok: [] };
+  var list = Array.isArray(value) ? value : [value];
+  for (var i = 0; i < list.length; i++) {
+    var t = list[i];
+    var isFactory   = typeof t === "function";
+    var isTransform = t && typeof t.pipe === "function" && typeof t.write === "function";
+    if (!isFactory && !isTransform) {
+      return { err: _makeError(errorClass, "BAD_ARG",
+        name + " must be a Transform stream or a () => Transform factory (or an array of them)", true) };
+    }
+  }
+  return { ok: list };
+}
+
+// Resolve a transform entry to a fresh stream instance (call the factory form).
+function _resolveStage(t) { return typeof t === "function" ? t() : t; }
+
+// Compose the response (download) stream: source → [throttle?] → [transforms…]
+// → observe(progress + onChunk). Every stage is a Transform so backpressure
+// flows from the consumer back to the socket (the throttle paces it). Returns
+// `source` unchanged when nothing is interposed (preserves the bare-stream
+// contract). A stage error propagates downstream so the returned body emits it.
+function _buildDownloadStream(source, emitDownload, onChunk, throttleBps, transforms) {
+  var stages = [];
+  if (throttleBps) stages.push(_throttleStream(throttleBps));
+  for (var i = 0; i < transforms.length; i++) stages.push(_resolveStage(transforms[i]));
+  if (stages.length === 0 && !emitDownload && !onChunk) return source;
+  var observe = new nodeStream.Transform({
+    transform: function (chunk, _enc, cb) {
+      if (emitDownload) emitDownload(chunk.length);
+      if (onChunk) { try { onChunk(chunk); } catch (_e) { /* operator hook — drop-silent */ } }
+      cb(null, chunk);
+    },
+  });
+  var chain = [source].concat(stages).concat([observe]);
+  for (var c = 0; c < chain.length - 1; c++) {
+    var src = chain[c], dst = chain[c + 1];
+    src.on("error", (function (d) { return function (e) { d.destroy(e); }; })(dst));
+    src.pipe(dst);
+  }
+  return observe;
+}
+
+// Build the upload throttle/transform stages (parallel to the download side).
+function _uploadStages(throttleBps, transforms) {
+  var stages = [];
+  if (throttleBps) stages.push(_throttleStream(throttleBps));
+  for (var i = 0; i < transforms.length; i++) stages.push(_resolveStage(transforms[i]));
+  return stages;
+}
+
+// Pipe a body (stream | Buffer | string) through throttle/transform stages into
+// the request sink, pacing the upload and emitting progress on bytes delivered
+// to the sink. Used only when a throttle/transform is configured; the plain
+// no-stages path keeps its original direct write. A stage/source error tears
+// down the request via onBodyError.
+function _pipeThrottledUpload(body, sink, stages, emitUpload, onBodyError) {
+  var source = (body && typeof body.pipe === "function")
+    ? body
+    : nodeStream.Readable.from(Buffer.isBuffer(body) ? body : Buffer.from(String(body), "utf8"));
+  var observe = new nodeStream.Transform({
+    transform: function (chunk, _enc, cb) {
+      if (emitUpload) emitUpload(chunk.length);
+      cb(null, chunk);
+    },
+  });
+  var chain = [source].concat(stages).concat([observe]);
+  for (var c = 0; c < chain.length - 1; c++) {
+    var s = chain[c], d = chain[c + 1];
+    s.on("error", (function (dd) { return function (e) { dd.destroy(e); }; })(d));
+    s.pipe(d);
+  }
+  observe.on("error", onBodyError);
+  observe.pipe(sink);
+}
+
 function request(opts) {
   if (!opts || !opts.url) {
     return Promise.reject(_makeError(opts && opts.errorClass, "BAD_ARG", "url is required", true));
@@ -770,6 +894,20 @@ function request(opts) {
     return Promise.reject(_makeError(opts.errorClass, "BAD_ARG",
       "onChunk must be a function (chunk: Buffer) -> void", true));
   }
+  // Bandwidth cap + transform interpose (download response + upload request
+  // body) — validated here, derived per-attempt in _requestSingle. maxBytesPerSec
+  // paces BOTH legs; downloadTransform / uploadTransform interpose custom
+  // Transform(s) (instance or () => Transform factory) on the respective leg.
+  if (opts.maxBytesPerSec !== undefined && opts.maxBytesPerSec !== null) {
+    if (typeof opts.maxBytesPerSec !== "number" || !isFinite(opts.maxBytesPerSec) || opts.maxBytesPerSec <= 0) {
+      return Promise.reject(_makeError(opts.errorClass, "BAD_ARG",
+        "maxBytesPerSec must be a positive finite number (bytes/sec)", true));
+    }
+  }
+  var _dlChk = _coerceTransforms(opts.downloadTransform, opts.errorClass, "downloadTransform");
+  if (_dlChk.err) return Promise.reject(_dlChk.err);
+  var _ulChk = _coerceTransforms(opts.uploadTransform, opts.errorClass, "uploadTransform");
+  if (_ulChk.err) return Promise.reject(_ulChk.err);
   if (opts.jar !== undefined && opts.jar !== null) {
     if (typeof opts.jar !== "object" ||
         typeof opts.jar.cookieHeaderFor !== "function" ||
@@ -1384,6 +1522,12 @@ function _requestSingle(opts) {
 // ---- _requestH1: existing node:http(s) path ----
 
 function _requestH1(transport, u, opts) {
+  // Bandwidth/transform interpose — opts validated in request(); derived fresh
+  // per attempt (each builds its own throttle + resolves transform factories, so
+  // a retry / redirect never reuses a consumed Transform).
+  var throttleBps = opts.maxBytesPerSec || null;   // validated in request(); positive number or absent
+  var downloadTransforms = _coerceTransforms(opts.downloadTransform, opts.errorClass, "downloadTransform").ok;
+  var uploadTransforms = _coerceTransforms(opts.uploadTransform, opts.errorClass, "uploadTransform").ok;
   return new Promise(function (resolve, reject) {
     var method = (opts.method || "GET").toUpperCase();
     var headers = Object.assign({}, opts.headers || {});
@@ -1402,7 +1546,12 @@ function _requestH1(transport, u, opts) {
       return;
     }
 
-    if (Buffer.isBuffer(opts.body)) {
+    if (Buffer.isBuffer(opts.body) && uploadTransforms.length === 0) {
+      // A size-changing uploadTransform (gzip / encrypt / frame) makes the
+      // original buffer length wrong, so the server would truncate extra bytes
+      // or wait for bytes that never arrive. Omit Content-Length in that case
+      // and let the body be chunked, framed on the actual transformed bytes. A
+      // throttle alone preserves size, so Content-Length stays valid then.
       headers["Content-Length"] = opts.body.length;
     }
     // CVE-2026-22036 mitigation — refuse compressed responses by
@@ -1470,35 +1619,30 @@ function _requestH1(transport, u, opts) {
           _rejectStreamHttpError(res, opts.errorClass, res.statusCode, res.statusMessage || "", _reject);
           return;
         }
-        if (onDownloadProgress || onChunk) {
-          // Wrap the stream so chunks emit progress + onChunk to the
-          // operator. The framework's contract is to hand back the
-          // response stream unmodified; fix-up via a passthrough keeps
-          // that contract while observing the chunk sizes. onChunk
-          // gets the buffer itself (for hash-as-you-go); a throw from
-          // it is caught and dropped so a hash-mismatch detector can
-          // raise without breaking the response stream — caller
-          // surfaces the error through their own pipe handler.
-          var passthrough = new nodeStream.PassThrough();
-          res.on("data", function (chunk) {
-            _emitDownload(chunk.length);
-            if (onChunk) {
-              try { onChunk(chunk); }
-              catch (_e) { /* operator-supplied hook — drop-silent */ }
-            }
-            passthrough.write(chunk);
-          });
-          res.on("end",  function () { passthrough.end(); });
-          res.on("error", function (e) { passthrough.destroy(e); });
-          return _resolve({ statusCode: res.statusCode, headers: res.headers, body: passthrough });
-        }
-        return _resolve({ statusCode: res.statusCode, headers: res.headers, body: res });
+        // Compose the response stream with the optional bandwidth throttle +
+        // custom transforms + progress/onChunk observation. Each is a Transform
+        // so backpressure reaches the socket; onChunk sees the bytes in order
+        // (for hash-as-you-go) and a throw from it is dropped. Returns `res`
+        // unchanged when nothing is interposed (bare-stream contract).
+        var body = _buildDownloadStream(
+          res, onDownloadProgress ? _emitDownload : null, onChunk, throttleBps, downloadTransforms);
+        return _resolve({ statusCode: res.statusCode, headers: res.headers, body: body });
       }
 
       var collector = safeBuffer.boundedChunkCollector({ maxBytes: maxResponseBytes });
       var capExceeded = false;
 
-      res.on("data", function (chunk) {
+      // Route the buffered read through the SAME throttle + transform pipeline
+      // as stream mode, so maxBytesPerSec and downloadTransform apply in buffer
+      // and always-resolve modes too (both documented to pace / transform the
+      // download regardless of how the body is consumed). With nothing
+      // interposed this returns `res` unchanged, so the plain path is identical.
+      // The cap now bounds post-transform bytes — strictly safer for a
+      // decompressing transform. Progress + onChunk fire inside the pipeline.
+      var dlSource = _buildDownloadStream(
+        res, onDownloadProgress ? _emitDownload : null, onChunk, throttleBps, downloadTransforms);
+
+      dlSource.on("data", function (chunk) {
         if (capExceeded) return;
         try { collector.push(chunk); }
         catch (_e) {
@@ -1508,13 +1652,8 @@ function _requestH1(transport, u, opts) {
             "response body exceeds " + maxResponseBytes + " bytes", true));
           return;
         }
-        _emitDownload(chunk.length);
-        if (onChunk) {
-          try { onChunk(chunk); }
-          catch (_e) { /* operator-supplied hook — drop-silent */ }
-        }
       });
-      res.on("end", function () {
+      dlSource.on("end", function () {
         if (capExceeded) return;
         var buf = collector.result();
         if (observer) observer("response:end", {
@@ -1544,7 +1683,7 @@ function _requestH1(transport, u, opts) {
             _isPermanentStatus(res.statusCode), res.statusCode));
         }
       });
-      res.on("error", function (e) {
+      dlSource.on("error", function (e) {
         if (capExceeded) return;
         if (observer) observer("error", { phase: "response", message: e.message });
         _reject(_makeError(opts.errorClass, e.code || "RES_ERROR", e.message, false));
@@ -1588,7 +1727,17 @@ function _requestH1(transport, u, opts) {
       catch (_e) { /* progress hooks are best-effort */ }
     }
 
-    if (opts.body && typeof opts.body.pipe === "function") {
+    var ulStages = _uploadStages(throttleBps, uploadTransforms);
+    if (opts.body != null && opts.body !== "" && ulStages.length > 0) {
+      // Pace / transform the upload body through the stages, into req.
+      _pipeThrottledUpload(opts.body, req, ulStages,
+        onUploadProgress ? _emitUpload : null,
+        function (e) {
+          try { req.destroy(); } catch (_) { /* best-effort req teardown */ }
+          _reject(_makeError(opts.errorClass, "REQ_BODY_ERROR",
+            "request body stream error: " + e.message, false));
+        });
+    } else if (opts.body && typeof opts.body.pipe === "function") {
       if (onUploadProgress) {
         opts.body.on("data", function (c) { _emitUpload(c.length); });
       }
@@ -1623,6 +1772,10 @@ function _requestH1(transport, u, opts) {
 // ---- _requestH2: node:http2 path ----
 
 function _requestH2(transport, u, opts) {
+  // Bandwidth/transform interpose — see _requestH1; derived fresh per attempt.
+  var throttleBps = opts.maxBytesPerSec || null;   // validated in request(); positive number or absent
+  var downloadTransforms = _coerceTransforms(opts.downloadTransform, opts.errorClass, "downloadTransform").ok;
+  var uploadTransforms = _coerceTransforms(opts.uploadTransform, opts.errorClass, "uploadTransform").ok;
   return new Promise(function (resolve, reject) {
     var method = (opts.method || "GET").toUpperCase();
     var responseMode = opts.responseMode || "buffer";
@@ -1642,7 +1795,13 @@ function _requestH2(transport, u, opts) {
     }
 
     var headers = _toH2Headers(method, u, opts.headers || {});
-    if (Buffer.isBuffer(opts.body)) headers["content-length"] = String(opts.body.length);
+    // Omit content-length when a size-changing uploadTransform is interposed —
+    // the original buffer length no longer frames the transformed body (HTTP/2
+    // frames via DATA + END_STREAM, so no header is required). A throttle alone
+    // keeps the size, so the length stays valid then.
+    if (Buffer.isBuffer(opts.body) && uploadTransforms.length === 0) {
+      headers["content-length"] = String(opts.body.length);
+    }
 
     if (observer) observer("request:start", { method: method, url: String(opts.url), protocol: "h2" });
 
@@ -1686,24 +1845,29 @@ function _requestH2(transport, u, opts) {
           _rejectStreamHttpError(stream, opts.errorClass, statusCode, "", _reject);
           return;
         }
-        if (onChunkH2) {
-          var passthroughH2 = new nodeStream.PassThrough();
-          stream.on("data", function (chunk) {
-            try { onChunkH2(chunk); }
-            catch (_e) { /* operator-supplied hook — drop-silent */ }
-            passthroughH2.write(chunk);
-          });
-          stream.on("end",  function () { passthroughH2.end(); });
-          stream.on("error", function (e) { passthroughH2.destroy(e); });
-          return _resolve({ statusCode: statusCode, headers: responseHeaders, body: passthroughH2 });
-        }
-        return _resolve({ statusCode: statusCode, headers: responseHeaders, body: stream });
+        var bodyH2 = _buildDownloadStream(stream, null, onChunkH2, throttleBps, downloadTransforms);
+        return _resolve({ statusCode: statusCode, headers: responseHeaders, body: bodyH2 });
       }
 
       var collector = safeBuffer.boundedChunkCollector({ maxBytes: maxResponseBytes });
       var capExceeded = false;
 
-      stream.on("data", function (chunk) {
+      // Apply the throttle + transform pipeline in buffer / always-resolve mode
+      // too (matches H1 + the documented contract); returns `stream` unchanged
+      // when nothing is interposed. onChunk fires inside the pipeline.
+      var dlH2 = _buildDownloadStream(stream, null, onChunkH2, throttleBps, downloadTransforms);
+      // When a stage is interposed, a transform error surfaces on the pipeline
+      // tail, not the raw h2 stream — reject on it. The plain path (dlH2 ===
+      // stream) is already covered by the stream-level error handler below.
+      if (dlH2 !== stream) {
+        dlH2.on("error", function (e) {
+          if (capExceeded) return;
+          if (observer) observer("error", { phase: "stream", message: e.message });
+          _reject(_makeError(opts.errorClass, e.code || "H2_STREAM_ERROR", e.message, false));
+        });
+      }
+
+      dlH2.on("data", function (chunk) {
         if (capExceeded) return;
         try { collector.push(chunk); }
         catch (_e) {
@@ -1713,12 +1877,8 @@ function _requestH2(transport, u, opts) {
             "response body exceeds " + maxResponseBytes + " bytes", true));
           return;
         }
-        if (onChunkH2) {
-          try { onChunkH2(chunk); }
-          catch (_e) { /* operator-supplied hook — drop-silent */ }
-        }
       });
-      stream.on("end", function () {
+      dlH2.on("end", function () {
         if (capExceeded) return;
         var buf = collector.result();
         if (observer) observer("response:end", {
@@ -1756,7 +1916,14 @@ function _requestH2(transport, u, opts) {
       signal.addEventListener("abort", onAbort, { once: true });
     }
 
-    if (opts.body && typeof opts.body.pipe === "function") {
+    var ulStagesH2 = _uploadStages(throttleBps, uploadTransforms);
+    if (opts.body != null && opts.body !== "" && ulStagesH2.length > 0) {
+      _pipeThrottledUpload(opts.body, stream, ulStagesH2, null, function (e) {
+        try { stream.close(http2.constants.NGHTTP2_INTERNAL_ERROR); } catch (_) { /* best-effort h2 stream cancel */ }
+        _reject(_makeError(opts.errorClass, "REQ_BODY_ERROR",
+          "request body stream error: " + e.message, false));
+      });
+    } else if (opts.body && typeof opts.body.pipe === "function") {
       opts.body.on("error", function (e) {
         try { stream.close(http2.constants.NGHTTP2_INTERNAL_ERROR); } catch (_) { /* best-effort h2 stream cancel */ }
         _reject(_makeError(opts.errorClass, "REQ_BODY_ERROR",
@@ -1825,12 +1992,8 @@ function _validateDownloadOpts(opts) {
   }
   validateOpts.optionalPositiveFinite(opts.timeoutMs, "downloadStream: timeoutMs",
     HttpClientError, "httpclient/bad-opts");
-  if (opts.maxBytes !== undefined &&
-      (typeof opts.maxBytes !== "number" || !isFinite(opts.maxBytes) || opts.maxBytes <= 0 ||
-       Math.floor(opts.maxBytes) !== opts.maxBytes)) {
-    throw _hcErr("httpclient/bad-opts",
-      "downloadStream: maxBytes must be a positive finite integer");
-  }
+  numericBounds.requirePositiveFiniteIntIfPresent(opts.maxBytes,
+    "downloadStream: maxBytes", HttpClientError, "httpclient/bad-opts", { permanent: true });
 }
 
 function _emitAudit(opts, action, outcome, metadata) {
@@ -2050,12 +2213,8 @@ function _validateUploadOpts(opts) {
   }
   validateOpts.optionalPositiveFinite(opts.timeoutMs, "uploadMultipartStream: timeoutMs",
     HttpClientError, "httpclient/bad-opts");
-  if (opts.maxBytes !== undefined &&
-      (typeof opts.maxBytes !== "number" || !isFinite(opts.maxBytes) || opts.maxBytes <= 0 ||
-       Math.floor(opts.maxBytes) !== opts.maxBytes)) {
-    throw _hcErr("httpclient/bad-opts",
-      "uploadMultipartStream: maxBytes must be a positive finite integer");
-  }
+  numericBounds.requirePositiveFiniteIntIfPresent(opts.maxBytes,
+    "uploadMultipartStream: maxBytes", HttpClientError, "httpclient/bad-opts", { permanent: true });
 }
 
 /**

package/lib/http-message-signature.js

@@ -542,8 +542,9 @@ function verify(msg, opts) {
       var member = digestMembers[di].trim();
       var deq = member.indexOf("=");
       if (deq < 1) continue;
-      if (member.slice(0, deq).trim().toLowerCase() !== "sha3-512") continue;
-      var memberCanonical = "sha3-512=" + member.slice(deq + 1).trim();
+      var dkv = structuredFields.parseKeyValuePiece(member);
+      if (dkv.key !== "sha3-512") continue;
+      var memberCanonical = "sha3-512=" + dkv.value.trim();
       // crypto.timingSafeEqual is the length-tolerant constant-time wrapper
       // (returns false for unequal lengths without leaking via a length branch).
       if (bCrypto.timingSafeEqual(memberCanonical, expectedDigest)) { matchedDigest = true; break; }

package/lib/i18n-messageformat.js

@@ -45,6 +45,7 @@
  * shaped JSON entries continue to work unchanged.
  */
 var lazyRequire = require("./lazy-require");
+var boundedMap = require("./bounded-map");
 var { defineClass } = require("./framework-error");
 
 var I18nMessageFormatError = defineClass("I18nMessageFormatError",
@@ -314,12 +315,9 @@ function _skipWs(state) {
 var _pluralRulesCache = new Map();
 function _pluralRules(locale, type) {
   var key = locale + "\x1f" + type;
-  var pr = _pluralRulesCache.get(key);
-  if (!pr) {
-    pr = new Intl.PluralRules(locale, { type: type });
-    _pluralRulesCache.set(key, pr);
-  }
-  return pr;
+  return boundedMap.getOrInsert(_pluralRulesCache, key, function () {
+    return new Intl.PluralRules(locale, { type: type });
+  });
 }
 
 function format(template, vars, locale) {
@@ -382,7 +380,7 @@ function looksLikeMessageFormat(template) {
   if (typeof template !== "string") return false;
   // Cheap structural check — full-syntax detection comes from parse()
   // throwing if it isn't valid MessageFormat.
-  return /\{[^}]+,\s*(plural|select|selectordinal)\b/.test(template);
+  return /\{[^{}]+,\s*(plural|select|selectordinal)\b/.test(template);
 }
 
 module.exports = {

package/lib/i18n.js

@@ -64,7 +64,7 @@ var requestHelpers = require("./request-helpers");
 var safeJson = require("./safe-json");
 var validateOpts = require("./validate-opts");
 var { I18nError } = require("./framework-error");
-var { boundedMap } = require("./bounded-map");
+var { boundedMap, getOrInsert } = require("./bounded-map");
 
 // Per-instance formatter caches are keyed on (locale, JSON.stringify
 // formatOpts). A fixed `locales` set bounds the locale axis, but operators
@@ -133,6 +133,80 @@ function _validateLocaleArray(name, value) {
   }
 }
 
+// Pure resolution-chain builder — the subtag-strip walk shared by the
+// instance lookup and the public localeChain primitive. Start at the requested
+// locale and strip subtag suffixes right-to-left ("pt-BR" -> "pt"); subtag
+// stripping always applies (same language, less specific). Cross-locale
+// fallback (to fallbackLocale, then defaultLocale) fires only when
+// fallbackLocale is non-null — fallbackLocale: null is strict "this locale or
+// miss". No duplicate baseline.
+function _buildLocaleChain(locale, fallbackLocale, defaultLocale) {
+  var chain = [];
+  var current = locale;
+  while (current && chain.indexOf(current) === -1) {
+    chain.push(current);
+    var dash = current.lastIndexOf("-");
+    if (dash === -1) break;
+    current = current.slice(0, dash);
+  }
+  if (fallbackLocale === null) return chain;
+  if (chain.indexOf(fallbackLocale) === -1) chain.push(fallbackLocale);
+  if (chain.indexOf(defaultLocale) === -1) chain.push(defaultLocale);
+  return chain;
+}
+
+/**
+ * @primitive  b.i18n.localeChain
+ * @signature  b.i18n.localeChain(locale, opts)
+ * @since      0.15.13
+ * @status     stable
+ * @related    b.i18n.create
+ *
+ * Resolve a requested BCP 47 locale to its ordered fallback chain — the same
+ * subtag-strip logic the file-backed `t()` lookup uses, surfaced as a pure,
+ * instance-independent function so a data-backed consumer (translations in a
+ * database row, a CMS page, a CDN-cached asset) can drive its own per-`(resource,
+ * locale, field)` lookups on the framework's BCP 47 fallback instead of
+ * re-deriving subtag stripping by hand.
+ *
+ * Pure: no file loading, no message lookup. The chain is the requested locale,
+ * then each subtag-stripped parent ("fr-CA" -> "fr"), then `fallbackLocale`,
+ * then `defaultLocale`, de-duplicated. `fallbackLocale: null` gives strict
+ * "this locale or its parents only" (no cross-locale jump).
+ *
+ * @opts
+ *   defaultLocale:  string,          // BCP 47; required; the final baseline
+ *   fallbackLocale: string | null,   // null = strict; omitted = defaultLocale
+ *   locales:        string[],        // optional configured set; when given, defaultLocale + fallbackLocale must be members
+ *
+ * @example
+ *   b.i18n.localeChain("fr-CA", { defaultLocale: "en", fallbackLocale: "en" });
+ *   // → ["fr-CA", "fr", "en"]
+ *   b.i18n.localeChain("zh-Hant-TW", { defaultLocale: "en", fallbackLocale: null });
+ *   // → ["zh-Hant-TW", "zh-Hant", "zh"]   (strict — no jump to en)
+ */
+function localeChain(locale, opts) {
+  opts = opts || {};
+  _validateLocale("i18n.localeChain: locale", locale);
+  _validateLocale("i18n.localeChain: defaultLocale", opts.defaultLocale);
+  var defaultLocale = opts.defaultLocale;
+  var fallbackLocale = (opts.fallbackLocale === null) ? null
+    : ((opts.fallbackLocale === undefined) ? defaultLocale : opts.fallbackLocale);
+  if (fallbackLocale !== null) _validateLocale("i18n.localeChain: fallbackLocale", fallbackLocale);
+  if (opts.locales !== undefined) {
+    _validateLocaleArray("i18n.localeChain: locales", opts.locales);
+    if (opts.locales.indexOf(defaultLocale) === -1) {
+      throw _err("BAD_OPT", "i18n.localeChain: defaultLocale '" + defaultLocale +
+        "' must be one of the configured locales");
+    }
+    if (fallbackLocale !== null && opts.locales.indexOf(fallbackLocale) === -1) {
+      throw _err("BAD_OPT", "i18n.localeChain: fallbackLocale '" + fallbackLocale +
+        "' must be one of the configured locales");
+    }
+  }
+  return _buildLocaleChain(locale, fallbackLocale, defaultLocale);
+}
+
 function _validateInterpolation(value) {
   if (value === undefined) return DEFAULTS.interpolation;
   if (typeof value !== "object" || value === null) {
@@ -366,13 +440,11 @@ function _makeFormatterCache(make, kind, emitObs) {
   return function getFormatter(locale, formatOpts) {
     var optsKey = formatOpts ? JSON.stringify(formatOpts) : "";
     var cacheKey = locale + "\x1f" + optsKey;
-    var f = cache.get(cacheKey);
-    if (!f) {
-      f = make(locale, formatOpts);
-      cache.set(cacheKey, f);
+    return getOrInsert(cache, cacheKey, function () {
+      var f = make(locale, formatOpts);
       emitObs("i18n.format.created", { kind: kind, locale: locale });
-    }
-    return f;
+      return f;
+    });
   };
 }
 
@@ -572,25 +644,9 @@ function create(opts) {
   }
 
   function _localeChain(locale) {
-    // Build the resolution chain. Start with the requested locale and
-    // strip subtag suffixes (`pt-BR` → `pt`); subtag stripping always
-    // applies because it's "same language, less specific" rather than a
-    // cross-locale jump. Cross-locale fallback (to fallbackLocale, then
-    // defaultLocale) only fires when fallbackLocale is non-null —
-    // operators who set fallbackLocale: null get strict "this locale or
-    // miss" semantics.
-    var chain = [];
-    var current = locale;
-    while (current && chain.indexOf(current) === -1) {
-      chain.push(current);
-      var dash = current.lastIndexOf("-");
-      if (dash === -1) break;
-      current = current.slice(0, dash);
-    }
-    if (fallbackLocale === null) return chain;
-    if (chain.indexOf(fallbackLocale) === -1) chain.push(fallbackLocale);
-    if (chain.indexOf(defaultLocale) === -1) chain.push(defaultLocale);
-    return chain;
+    // Delegates to the module-level pure builder; fallbackLocale /
+    // defaultLocale are this instance's resolved config.
+    return _buildLocaleChain(locale, fallbackLocale, defaultLocale);
   }
 
   function _lookupRaw(key, locale) {
@@ -932,6 +988,7 @@ var messageFormat = require("./i18n-messageformat");
 
 module.exports = {
   create:            create,
+  localeChain:       localeChain,
   messageFormat:     messageFormat,
   I18nError:         I18nError,
   DEFAULTS:          DEFAULTS,

package/lib/iab-tcf.js

@@ -96,6 +96,7 @@
 
 var audit = require("./audit");
 var bCrypto = require("./crypto");
+var numericBounds = require("./numeric-bounds");
 var { defineClass } = require("./framework-error");
 var IabTcfError = defineClass("IabTcfError", { alwaysPermanent: true });
 
@@ -521,7 +522,7 @@ function _idArray(x) {
   var seen = Object.create(null);
   var out = [];
   list.forEach(function (id) {
-    if (typeof id !== "number" || !isFinite(id) || id < 1 || Math.floor(id) !== id) {
+    if (!numericBounds.isPositiveFiniteInt(id)) {
       throw IabTcfError.factory("iab-tcf/bad-value", "iabTcf.encode: vendor/purpose ids must be positive integers, got " + id);
     }
     if (!seen[id]) { seen[id] = 1; out.push(id); }
@@ -554,7 +555,7 @@ function _decisec(t) {
 function _bitWriter() {
   var bits = "";
   function writeInt(v, n) {
-    if (typeof v !== "number" || !isFinite(v) || v < 0 || Math.floor(v) !== v) throw IabTcfError.factory("iab-tcf/bad-value", "iabTcf.encode: expected a non-negative integer, got " + v);
+    if (!numericBounds.isNonNegativeFiniteInt(v)) throw IabTcfError.factory("iab-tcf/bad-value", "iabTcf.encode: expected a non-negative integer, got " + v);
     if (v >= Math.pow(2, n)) throw IabTcfError.factory("iab-tcf/value-overflow", "iabTcf.encode: " + v + " does not fit in " + n + " bits");
     bits += v.toString(2).padStart(n, "0");
   }