@blamejs/core 0.18.41 → 0.18.43

package/CHANGELOG.md

@@ -8,6 +8,36 @@ upgrading across more than a few patches at a time.
 
 ## v0.18.x
 
+- v0.18.43 (2026-08-20) — **Three things the framework already knew how to do, reachable from outside it.** Each of these existed as working machinery with no public door: the largest-remainder split was locked behind a currency table that carries 43 of the ~180 ISO 4217 codes, the durable queue could only be driven by a resident consumer, and the MIME/extension table was reachable only through a test hook. In each case the predictable consequence downstream was a partial reimplementation of the part that is hardest to get right. **Added:** *`b.queue.tick(opts)` — drain what is due, then return* — Leases at most `max` available jobs, runs the handler over them, applies the same leasing, deterministic backoff and dead-letter transitions `b.queue.consume` applies, and settles. Nothing is left running when the promise resolves: no resident loop, no timer, no consumer for shutdown to wait on. Returns `{ leased, succeeded, failed, stale, unsettled, movedToDlq, mayHaveMore, queueDepth }`. Loop on `mayHaveMore` — the batch came back full, so more may be due right now. Not on `queueDepth`: that is the queue's total active depth and counts jobs whose `availableAt` is still in the future, so a caller looping on it spins through empty ticks waiting for a delayed job to come due. `queueDepth` is `null` when the backend could not be asked, because unknown is not empty. Two counts are not terminal states and mean different things. `unsettled` is the one to alert on: the backend REFUSED to record the outcome — complete or fail rejecting after its own retries — so the job is still inflight and the tick does not know whether the handler succeeded. A later sweep recovers it, and if the handler had already succeeded its side effects run again. `stale` is benign by comparison and counts jobs the tick ran but did not settle — the handler outlived the lease, the job was swept and re-leased, and the backend's attempt fence refused the completion. A non-zero `stale` means `leaseMs` is too short for the handler or the batch too large to finish inside it.
+
+Pair it with `b.queue.init({ sweepIntervalMs: 0 })`, new in this release. `init` otherwise starts a 30-second expired-lease sweep timer, and in a frozen isolate that timer either never fires or fires inside a LATER invocation, touching the backend outside any request the platform is accounting for. `tick` sweeps once per invocation itself, so the timer buys nothing there. The option also lets a resident deployment tune the period; the default is unchanged.
+
+It sweeps expired leases before taking a batch. A job whose holder died between leasing and settling stays `inflight` until something re-pends it, and the thing that normally does is the 30-second sweep timer started at `init` — a timer that never fires in the runtime this driver exists for. Without the sweep an invocation killed mid-lease would strand its job permanently, in exactly the deployment `tick` serves.
+
+This is the driver a scheduled invocation needs — a Cloudflare `scheduled()` handler, a Lambda on EventBridge, a Kubernetes CronJob. `consume` cannot serve those: it is a resident loop and it starts a background sweep, and such a runtime freezes between invocations, so the timer never fires and the consumer is either blocking the handler or killed mid-lease. Without a per-tick entry point the durable half gets reimplemented by the caller — attempt accounting, backoff schedule, DLQ transition — which is precisely the part that is hard to get right.
+
+`consume` and `tick` now run jobs through one shared path, so the retry schedule and the DLQ transition have exactly one implementation rather than two that can drift.
+
+It drives the `local` and `redis` protocols, the same boundary `consume` has. An `sqs` backend is refused with `TICK_UNSUPPORTED`: SQS completes and fails by `receiptHandle` and owns redelivery and the dead-letter queue through its own RedrivePolicy, so driving it here would complete without the receipt and let SQS redeliver messages the handler had already processed. Drive SQS directly — lease, handle, complete or fail. · *`b.money.splitUnits(total, weights)` — the largest-remainder split without a currency* — Splits an integer into parts proportional to `weights`, distributing every unit: floor each share, then hand the leftovers to the largest remainders, ties broken by index. The total is preserved by construction and no floating point is involved, so the result is identical across runtimes. Negative totals floor toward negative infinity, so the parts still sum to the total.
+
+A `Number` total or weight must be a SAFE integer. Past `Number.MAX_SAFE_INTEGER` the value has already been rounded before the function sees it — `9007199254740993` arrives as `...992` — so exact arithmetic there would faithfully split a total the caller never asked for. Those are refused with a message pointing at BigInt, which carries the value exactly.
+
+The algorithm was already there as `Money.allocate`, but reaching it required a `Money`, which requires a currency from `b.money.CURRENCIES` — a table carrying the codes the framework has minor-unit data for rather than all of ISO 4217. A caller holding a currency outside that set could not reach the split at all, and neither could a caller splitting something that is not money: seats, quota, shard weights, a rate limit across workers. `Money.allocate` now composes it, so both doors open onto one implementation. · *`b.fileType.extensionFor(mime)` and `b.fileType.mimeFor(extension)`* — Read-only accessors over the signature table `b.fileType.detect` already consults, in both directions. Unknown returns `null` rather than a guess — a caller minting an object-store key or a `Content-Disposition` filename needs to know when the framework does not recognise the type. Lookups are case-insensitive, `extensionFor` ignores content-type parameters so a `Content-Type` header value can be passed straight in, and `mimeFor` accepts a leading dot because that is what `path.extname` returns.
+
+`detect` answers what a file is; the next question is usually what to call it, and until now that had no answer, so consumers kept partial copies of a table the framework maintains — copies that drift the moment a signature is added.
+
+`mimeFor` answers a naming question, not a trust question: it reports what an extension claims. Only `detect` establishes what a file IS, by reading the bytes, because an attacker controls the name and never the magic. **References:** [RFC 2045 §5.1 — Content-Type is case-insensitive](https://www.rfc-editor.org/rfc/rfc2045#section-5.1)
+
+- v0.18.42 (2026-08-20) — **`b.middleware.botGuard` no longer refuses a request for omitting Accept-Language, which was returning 403 to every search-engine crawler.** `b.middleware.botGuard` treated a missing `Accept-Language` header as grounds for a 403 in its default blocking mode. Google documents that Googlebot sends requests without setting that header, and bingbot behaves the same, so every content page of a site running the default middleware chain answered 403 to a crawler while a browser was served normally. The header's absence is now an advisory signal, matching how the same middleware already treats a missing `Sec-Fetch-Mode`. **Changed:** *Vendored `@blamejs/pki` 0.5.16 to 0.5.17* — A failed integrity check now destroys the plaintext it had recovered rather than returning it, `AuthEnvelopedData` validates the attributes it is asked to authenticate, and the refusal for a content cipher in the wrong container cites the rule it actually applies — RFC 5083 §2 defines `AuthEnvelopedData` in terms of authenticated encryption and never names GCM, so the previous message sent operators to argue with a specification that says the opposite. **Fixed:** *A missing `Accept-Language` tags a request instead of refusing it* — The check was `if (!headers["accept-language"]) return "missing-accept-language"`, and `mode` defaults to `"block"`, so the request was answered 403. Whole client families omit the header — every major search-engine crawler, and with them uptime monitors, link previewers and feed readers — which made a site unreachable to all of them. On a deployment fronted by a cache this is easy to miss from the outside: the cached home page still answers 200, so the site looks partly indexed while every other URL is refused.
+
+It now sets `req.suspectedBot` in `mode: "tag"` and never blocks, which is exactly how the middleware already treats a missing `Sec-Fetch-Mode` — absent for Safari before 16.4 and for every plain-HTTP non-localhost origin — and how `b.middleware.fetchMetadata` already treats a missing `Sec-Fetch-Site` through its `allowMissing` default. A header a whole client family omits is not evidence of automation.
+
+Requests are still refused on positive evidence: the `User-Agent` deny-list (curl, wget, python-requests, axios, Go-http-client and the rest) is unchanged, and operators can extend it with `blockedAgents`. Separating a crawler from an abuser is a rate-limiting question rather than a header one, and `b.rateLimit` answers it.
+
+If you were relying on the old behaviour, `mode: "tag"` surfaces the same signal on `req.suspectedBot` for you to act on. **Detectors:** *No single absent header may block, asserted against the middleware* — `bot-guard.test.js` now starts from a complete browser request and removes one header at a time, asserting that no single omission refuses the request. It covers the headers the middleware inspects — `User-Agent`, `Accept`, `Accept-Language`, `Accept-Encoding` and the three `Sec-Fetch-*` — so the rule holds for whichever one a future change reaches for, not only the one that was wrong.
+
+It is a behavioural check rather than a source-pattern one deliberately. Written as a pattern check first, it was wrong six different ways: anchored to the first expression in the condition, bounded at the first `)`, bounded to a single line, defeated by a statement before the return, by a guard that was OR'd rather than AND'd, and by a `)` inside a string literal. Each fix was a step further into parsing JavaScript with text matching. Running the middleware decides all six, because it asks what the code does rather than how it is written. **References:** [How Google crawls locale-adaptive pages — Googlebot and Accept-Language](https://developers.google.com/search/docs/specialty/international/locale-adaptive-pages)
+
 - v0.18.41 (2026-08-20) — **Logout can now clear the session cookie on a plain-HTTP origin, and every Set-Cookie the framework writes goes through one validating writer.** `b.session.logout` built its expiry cookie by string concatenation with `Secure` hardcoded. A browser refuses a `Secure` cookie that arrives over plain HTTP, so on a cleartext deployment the header was discarded and the session cookie the logout existed to clear stayed in the jar. `b.middleware.csrfProtect` had its own cookie formatter with the same shape and a different consequence: it interpolated the configured `cookie.path` into the response header with no CRLF scrub. Both now compose `b.cookies`, which is the framework's single Set-Cookie writer. **Added:** *`b.cookies.assertAppendable(res)`* — Throws unless a response can carry an appended `Set-Cookie` — the same check `appendSetCookie` performs, exposed so a caller can run it before doing something it cannot undo. A response has to be readable as well as writable to be appended to: without `appendHeader` the merge happens in the framework and needs to see what is already queued, and a response carrying only `setHeader` would have its existing cookies silently replaced. `b.session.logout` calls it up front, because it revokes the session row before queueing the expiry cookie — a refusal at queue time would leave the session destroyed, the browser still holding its cookie, and the request failing. · *`b.cookies.appendSetCookie(res, header)`* — Queues one `Set-Cookie` header without discarding the ones already queued. `res.setHeader("Set-Cookie", value)` replaces the header, so a route that issues a session cookie and then a CSRF cookie sends only the second; `Set-Cookie` is the one response header that is legitimately repeated. The appender uses `res.appendHeader` where the runtime offers it and array-merges where it does not.
 
 It pairs with `b.cookies.serialize`, which validates and builds the header string. `b.cookies.create().write()` and `.clear()` compose both; reach for the two separately when you need to build the header at one point in a flow and queue it at another — validating early, emitting only once the side effect it accompanies has succeeded, which is what `b.session.logout` does with the session row. **Changed:** *`b.session.logout` queues its expiry cookie rather than overwriting the header* — It called `res.setHeader("Set-Cookie", ...)`, which discarded any cookie the route had already queued — a rotated CSRF token, a locale. It now appends. Code reading `res.getHeader("Set-Cookie")` after a logout sees an array of header strings rather than a single string; Node accepts either form on the way out.

package/NOTICE

@@ -68,7 +68,7 @@ Used for:    FIPS 203 ML-KEM (ml_kem_512 / ml_kem_768 / ml_kem_1024),
              reference implementation.
 --------------------------------------------------------------------------------
 Component:   @blamejs/pki
-Version:     0.5.16
+Version:     0.5.17
 Source:      https://github.com/blamejs/pki
 License:     Apache-2.0
 Copyright:   Copyright (c) blamejs contributors

package/README.md

@@ -67,7 +67,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 - **DB lifecycle** — in-memory encrypted snapshot via `b.db.snapshot()`; standalone encrypted-DB-file lifecycle (`b.db.fileLifecycle({ dataDir, vault })` — decrypt-to-tmpfs, periodic re-encrypt flush, graceful shutdown — same envelope as `b.db`, no schema/audit-chain coupling); `db.init` opt-outs `frameworkTables: false` / `auditSigning: false` and path overrides `encryptedDbPath` / `encryptedDbName` / `dbKeyPath`
 - **External RDBMS** — bring-your-own Postgres / MySQL with pool tuning + role-aware connect + read-replica routing (`b.externalDb`); declarative role-narrowed views and Postgres row-level-security migrations (`b.db.declareView`, `b.db.declareRowPolicy`); an opt-in `requireTls` transport posture refuses a non-TLS backend at boot, and query / transaction / read traces carry OpenTelemetry `db.*` attributes. The framework's own data layer — the signed audit chain, cluster leadership and lease fencing, sessions, break-glass, and the local queue / cache / scheduler — is composed through the dialect-aware `b.sql` builder (every identifier quoted by construction, every value bound as a placeholder, dialect-correct SQLite / Postgres / MySQL output), so the framework's tables run on a Postgres or MySQL backend, not only local SQLite; `b.guardSql` validates result rows against NUL bytes, quote-jump sequences, and per-column / total-size boundaries
 - **Object store** — S3 / R2 / B2 / GCS / Azure with multipart upload + SSE + bucket-ops (create / delete / list / lifecycle / CORS); S3 Object Lock + per-object retention + legal hold for write-once-read-many compliance workloads, with versioned delete + `listVersions` for right-to-erasure / crypto-shred against an Object-Lock bucket (`b.storage`, `b.objectStore`)
-- **Queues + cache** — durable queue with priority + cron + flows on local SQLite, shared Redis, OR AWS SQS via SigV4 + AWSJsonProtocol_1.0 (`b.queue`, `b.jobs`) — the local backend can target an operator-supplied database / table / schema; cluster-shared cache (`b.cache`)
+- **Queues + cache** — durable queue with priority + cron + flows on local SQLite, shared Redis, OR AWS SQS via SigV4 + AWSJsonProtocol_1.0 (`b.queue`, `b.jobs`) — the local backend can target an operator-supplied database / table / schema; driven either by a resident consumer (`b.queue.consume`) or one batch at a time for a scheduled runtime that cannot host one (`b.queue.tick`); cluster-shared cache (`b.cache`)
 ### Identity & access
 
 - **Passwords** — Argon2id + policy primitive (`b.auth.password`); NIST 800-63B / PCI-DSS 4.0 / HIPAA-AAL2 profiles; HaveIBeenPwned k-anonymity breach check; length / context / dictionary / complexity rules; rotation + history
@@ -156,7 +156,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 - **Mobile credentials (mDL)** — `b.mdoc` ISO/IEC 18013-5 verification: `verifyIssuerSigned` checks the COSE_Sign1 IssuerAuth (issuer cert from the `x5chain` header), the MSO validity window, and every disclosed element's digest against the MSO `valueDigests` (selective-disclosure integrity), with optional issuer-chain verification; `verifyDeviceAuth` proves holder binding (§9.1.3 signature variant) — the device COSE_Sign1 over the `DeviceAuthentication` structure with the MSO device key + protocol `sessionTranscript`. The ISO credential ecosystem alongside `b.vc` and `b.auth.sdJwtVc`. Composes `b.cose` + `b.cbor`
 - **Decentralized Identifiers** — `b.did` W3C DID resolution (DID Core 1.0): `resolve` a `did:key` / `did:jwk` (deterministic, offline — Ed25519 / P-256 / P-384 / secp256k1) or `did:web` (operator-fetched document) to `node:crypto` verification keys, so a credential's issuer DID resolves to the key that verifies it (`b.vc` / `b.mdoc` / `b.scitt`). `keyToDid` names a key as a `did:key` or `did:jwk`; document/JWK keys are kty/crv-allowlisted before import
 - **Document parsers** — `b.parsers` (XML / TOML / YAML / .env); `b.config` (schema-validated env)
-- **File-type detection** — `b.fileType` magic-byte content classification with deny-on-upload categories (image / document / archive / executable / etc.)
+- **File-type detection** — `b.fileType` magic-byte content classification with deny-on-upload categories (image / document / archive / executable / etc.); `extensionFor` / `mimeFor` read the same table in both directions, so naming a detected file does not need a second copy of it
 ### Content-safety gates
 
 - **Composition contract** — `b.gateContract` uniform mode posture / hooks / forensic snapshot / decision cache / runtime cap
@@ -322,7 +322,7 @@ All runtime dependencies are committed to the repo — no transitive npm install
 | [`@noble/hashes`](https://github.com/paulmillr/noble-hashes) | 2.3.0 | [Paul Miller](https://github.com/paulmillr) | Browser (ESM) build only — SHAKE256 / SHA-3 / SHA-2 / HMAC / HKDF for the client half of a hybrid exchange. The server side reaches all of these through `node:crypto`, so there is no server bundle |
 | [`@noble/curves`](https://github.com/paulmillr/noble-curves) | 2.3.0 (bundles @noble/hashes 2.3.0) | [Paul Miller](https://github.com/paulmillr) | RFC 9497 Oblivious Pseudo-Random Function (OPRF / VOPRF / POPRF) over ristretto255 / P-256 / P-384 / P-521, behind `b.crypto.oprf` |
 | [`@noble/post-quantum`](https://github.com/paulmillr/noble-post-quantum) | 0.7.0 (bundles @noble/hashes, @noble/curves, @noble/ciphers 2.3.0) | [Paul Miller](https://github.com/paulmillr) | Pure-JS FIPS 203 ML-KEM (`ml_kem_512` / `ml_kem_768` / `ml_kem_1024`), FIPS 204 ML-DSA (`ml_dsa_44/65/87`), FIPS 205 SLH-DSA (`slh_dsa_*`). First-class on both server-side and client-side via `b.pqcSoftware` — security-first defaults pin to the highest cat-5 levels (ML-KEM-1024, ML-DSA-87, SLH-DSA-SHAKE-256f); interoperable with Node's built-in WebCrypto ML-KEM that `b.crypto.encrypt` / `b.middleware.apiEncrypt` use. A browser (ESM) build ships beside it carrying the KEM suites only — a client half encapsulates and does not sign |
-| [`@blamejs/pki`](https://github.com/blamejs/pki) | 0.5.16 | [blamejs](https://github.com/blamejs) | Zero-dependency pure-JS X.509 / CRL / PKCS#12 / CSR / CMS toolkit backing `b.mtlsCa` — ML-DSA-87 (FIPS 204) post-quantum + ECDSA-P384 cert signing, PBMAC1 PKCS#12 packaging, chain validation (no openssl CLI) — and the WebAuthn attestation / assertion verification behind `b.auth.passkey` |
+| [`@blamejs/pki`](https://github.com/blamejs/pki) | 0.5.17 | [blamejs](https://github.com/blamejs) | Zero-dependency pure-JS X.509 / CRL / PKCS#12 / CSR / CMS toolkit backing `b.mtlsCa` — ML-DSA-87 (FIPS 204) post-quantum + ECDSA-P384 cert signing, PBMAC1 PKCS#12 packaging, chain validation (no openssl CLI) — and the WebAuthn attestation / assertion verification behind `b.auth.passkey` |
 | [`SecLists` 10k-most-common.txt](https://github.com/danielmiessler/SecLists/blob/master/Passwords/Common-Credentials/10k-most-common.txt) | master snapshot | [Daniel Miessler / SecLists contributors](https://github.com/danielmiessler/SecLists) (CC-BY-3.0) | Top-10000 common-password dictionary read by `b.auth.password.policy()` for the NIST 800-63B §5.1.1.2 "previously breached" check |
 | [`prismjs`](https://prismjs.com/) | 1.30.0 | [Lea Verou + contributors](https://github.com/PrismJS/prism) | Syntax highlighting in the example wiki's code blocks (browser-side) |
 

package/lib/file-type.js

@@ -353,9 +353,89 @@ function assertOneOf(buf, allowlist, opts) {
   return detected;
 }
 
+// Both directions of the signature table, built once at load. Every row is
+// 1:1 in both directions, so neither map loses an entry; a row added with a
+// duplicate mime or extension would silently shadow, which the test asserts
+// against by round-tripping every row.
+var _MIME_TO_EXT = Object.create(null);
+var _EXT_TO_MIME = Object.create(null);
+SIGNATURES.forEach(function (row) {
+  if (row.mime && !(row.mime.toLowerCase() in _MIME_TO_EXT)) {
+    _MIME_TO_EXT[row.mime.toLowerCase()] = row.extension;
+  }
+  if (row.extension && !(row.extension.toLowerCase() in _EXT_TO_MIME)) {
+    _EXT_TO_MIME[row.extension.toLowerCase()] = row.mime;
+  }
+});
+
+/**
+ * @primitive b.fileType.extensionFor
+ * @signature b.fileType.extensionFor(mime)
+ * @since     0.18.43
+ * @status    stable
+ * @related   b.fileType.detect, b.fileType.mimeFor
+ *
+ * The canonical file extension for a MIME type, with no leading dot, or `null`
+ * when the framework does not recognise the type. Never a guess: a caller
+ * minting an object-store key or a `Content-Disposition` filename needs to
+ * know when the answer is unknown rather than receive a plausible-looking one.
+ *
+ * `detect` answers "what is this"; the next question is usually "what should I
+ * call it", and the table that answers it is the same one. Reading it here
+ * rather than keeping a private copy is what stops the two drifting when a
+ * signature is added.
+ *
+ * The lookup is case-insensitive and ignores content-type parameters, so the
+ * `Content-Type` header value a request arrived with can be passed straight in.
+ *
+ * @example
+ *   b.fileType.extensionFor("image/png");
+ *   // → "png"
+ */
+function extensionFor(mime) {
+  if (typeof mime !== "string" || mime.length === 0) return null;
+  // MIME types are case-insensitive (RFC 2045 §5.1) and may carry parameters.
+  var bare = mime.split(";")[0].trim().toLowerCase();
+  if (bare.length === 0) return null;
+  return Object.prototype.hasOwnProperty.call(_MIME_TO_EXT, bare) ? _MIME_TO_EXT[bare] : null;
+}
+
+/**
+ * @primitive b.fileType.mimeFor
+ * @signature b.fileType.mimeFor(extension)
+ * @since     0.18.43
+ * @status    stable
+ * @related   b.fileType.detect, b.fileType.extensionFor
+ *
+ * The MIME type for a file extension, or `null` when the framework does not
+ * recognise it. The inverse of `b.fileType.extensionFor`, over the same table.
+ *
+ * A leading dot is accepted, because that is the form `path.extname` returns
+ * and therefore the form a caller usually has in hand. The lookup is
+ * case-insensitive.
+ *
+ * This answers a naming question, not a trust question. It reports what an
+ * extension claims; it does not establish what a file IS. Only
+ * `b.fileType.detect` does that, by reading the bytes — an attacker controls
+ * the name, never the magic.
+ *
+ * @example
+ *   b.fileType.mimeFor(".png");
+ *   // → "image/png"
+ */
+function mimeFor(extension) {
+  if (typeof extension !== "string" || extension.length === 0) return null;
+  var ext = extension.charAt(0) === "." ? extension.slice(1) : extension;
+  ext = ext.trim().toLowerCase();
+  if (ext.length === 0) return null;
+  return Object.prototype.hasOwnProperty.call(_EXT_TO_MIME, ext) ? _EXT_TO_MIME[ext] : null;
+}
+
 module.exports = {
   detect:        detect,
   assertOneOf:   assertOneOf,
+  extensionFor:  extensionFor,
+  mimeFor:       mimeFor,
   FileTypeError: FileTypeError,
   // Internal — exposed so tests can introspect the registry shape.
   _SIGNATURES:   SIGNATURES,

package/lib/middleware/bot-guard.js

@@ -7,7 +7,13 @@
  * authentication, but catches drive-by scrapers and most low-effort bots.
  *
  * Heuristics (all combined):
- *   - Missing Accept-Language header (real browsers always send one)
+ *   - Missing Accept-Language header — ADVISORY ONLY (never blocks). Tagged
+ *     in mode:"tag". It cannot block because the header is absent for entire
+ *     client families: every major search-engine crawler omits it (Google
+ *     documents that Googlebot "sends HTTP requests without setting
+ *     Accept-Language"), as do uptime monitors, link previewers and feed
+ *     readers — a 403 on it alone made a site's every page unreachable to
+ *     Googlebot while a browser sailed through.
  *   - Missing Sec-Fetch-Mode header — ADVISORY ONLY (never blocks). Tagged
  *     in mode:"tag" on secure-context HTML GETs where a modern browser
  *     would have sent it. It cannot block because the header is absent for
@@ -90,13 +96,15 @@ function _coerceAgentPattern(r, where) {
  * Cheap fingerprint-based detection of obviously-non-browser requests.
  * Constructed via `b.middleware.botGuard(opts)`; the resulting
  * middleware has the `(req, res, next)` shape shown above.
- * Two blocking heuristics — missing `Accept-Language` and a User-Agent
- * regex match against a default list (curl / wget / python-requests /
- * axios / etc.) — plus one advisory signal: a missing `Sec-Fetch-Mode`
- * on a secure-context HTML GET sets `req.suspectedBot` in `mode: "tag"`
- * but NEVER blocks (the header is absent for Safari < 16.4 and every
- * plain-HTTP non-localhost origin, so blocking on it refuses real
- * users). Not
+ * One blocking heuristic — a User-Agent regex match against a default
+ * list (curl / wget / python-requests / axios / etc.) — plus two
+ * advisory signals that set `req.suspectedBot` in `mode: "tag"` and
+ * NEVER block: a missing `Accept-Language` (absent from every major
+ * search-engine crawler, so blocking on it makes a site unreachable to
+ * them) and a missing `Sec-Fetch-Mode` on a secure-context HTML GET
+ * (absent for Safari < 16.4 and every plain-HTTP non-localhost origin).
+ * A header a whole client family omits is not evidence of automation.
+ * Not
  * a substitute for proper authentication — catches drive-by scrapers
  * and low-effort bots. In `mode: "block"` (default) the request is
  * refused; in `mode: "tag"` `req.suspectedBot = true` is set and the
@@ -206,14 +214,29 @@ function create(opts) {
       // Skip browser-fingerprint checks for API routes
       return null;
     }
-    if (!headers["accept-language"]) return "missing-accept-language";
+    // Missing Accept-Language NEVER blocks, for the reason the Sec-Fetch-Mode
+    // check below does not either: the header is absent for entire CLIENT
+    // families, so a 403 on it alone refuses them wholesale. Every major
+    // search-engine crawler omits it — Google documents that Googlebot "sends
+    // HTTP requests without setting Accept-Language in the request header",
+    // and bingbot behaves the same — so blocking on it made every content page
+    // of a blamejs site answer 403 to a crawler while a browser sailed
+    // through. Measured on a live deployment: a 337-URL sitemap of which only
+    // the cached homepage was reachable. Uptime monitors, link previewers and
+    // feed readers are refused the same way.
+    //
+    // It survives as an advisory TAG, so an operator can still rate-limit or
+    // log on it. Automation libraries remain blocked by the User-Agent
+    // deny-list, which is what actually distinguishes them; separating a
+    // crawler from an abuser is a rate-limiting question, not a header one.
+    if (mode === "tag" && !headers["accept-language"]) return "missing-accept-language";
     // Missing Sec-Fetch-Mode NEVER blocks: the header is absent for entire
     // browser families (Safari < 16.4 omits Fetch Metadata even over HTTPS)
     // and for every plain-HTTP non-localhost origin (Umbrel, LAN / *.local
     // reverse proxies), so a 403 on it alone refuses real users. It survives
     // only as an advisory TAG in mode:"tag", and even then only in a secure
     // context where a modern browser would have sent it. Drive-by bots are
-    // still blocked by missing Accept-Language + the User-Agent deny-list.
+    // still blocked by the User-Agent deny-list.
     if (mode === "tag" && req.method === "GET" && _isSecureContext(req) && !headers["sec-fetch-mode"]) return "missing-sec-fetch-mode";
     return null;
   }

package/lib/money.js

@@ -444,22 +444,77 @@ function roundMinor(minor, step, mode) {
 // method: floor each share, then hand out the leftover units to the
 // shares with the largest fractional remainder. Total preserved by
 // construction; deterministic across runtimes.
-Money.prototype.allocate = function (weights) {
+/**
+ * @primitive b.money.splitUnits
+ * @signature b.money.splitUnits(total, weights)
+ * @since     0.18.43
+ * @status    stable
+ * @related   b.money.fromMinorUnits, b.money.roundMinor
+ *
+ * Split an integer into parts proportional to `weights`, distributing every
+ * unit. Largest-remainder method: floor each share, then hand the leftover
+ * units to the shares with the largest fractional remainder, ties broken by
+ * index. The total is preserved by construction and the result is identical
+ * across runtimes — no floating point is involved at any step.
+ *
+ * This is the algorithm behind `Money.allocate`, reachable without a Money.
+ * `Money` requires a currency from `b.money.CURRENCIES`, which carries the
+ * codes the framework has minor-unit data for rather than all of ISO 4217, so
+ * a caller holding a currency outside that set could not reach the split at
+ * all. Nor could a caller splitting something that is not money — seats,
+ * quota, shard weights, a rate limit across workers — which is the same
+ * arithmetic with the same requirement that nothing be lost to rounding.
+ *
+ * `total` may be negative: shares floor toward negative infinity so the
+ * leftover pass stays positive and the parts still sum to `total`.
+ *
+ * @example
+ *   b.money.splitUnits(100n, [1, 1, 1]);
+ *   // → [34n, 33n, 33n]
+ */
+function splitUnits(total, weights) {
+  return _largestRemainder(_toBigIntUnits(total, "total"), weights, "splitUnits");
+}
+
+// Coerce a BigInt or SAFE integer Number; anything else is a caller error.
+//
+// Number.isInteger is not enough. Beyond Number.MAX_SAFE_INTEGER a literal has
+// already been rounded to a representable neighbour before this function ever
+// sees it — 9007199254740993 arrives as 9007199254740992, isInteger says yes,
+// and BigInt() faithfully preserves the wrong value. The split would then be
+// exact arithmetic over a total the caller never asked for, which breaks the
+// one guarantee this function makes. Above that range the caller has to pass a
+// BigInt, which carries the value exactly.
+function _toBigIntUnits(v, label) {
+  if (typeof v === "bigint") return v;
+  if (typeof v === "number" && Number.isSafeInteger(v)) return BigInt(v);
+  throw new MoneyError("money/bad-units",
+    label + " must be a BigInt or a safe integer Number (beyond " +
+    "Number.MAX_SAFE_INTEGER a Number has already lost the value — pass a BigInt); got " +
+    (typeof v === "number" ? String(v) : typeof v));
+}
+
+// The shared largest-remainder split. `label` names the caller in refusals so
+// an operator sees the API they actually invoked.
+function _largestRemainder(total, weights, label) {
   if (!Array.isArray(weights) || weights.length === 0) {
     throw new MoneyError("money/bad-weights",
-      "allocate requires a non-empty array of weights");
+      label + " requires a non-empty array of weights");
   }
   var sum = 0n;
   var w = new Array(weights.length);
   for (var i = 0; i < weights.length; i++) {
     var wi = weights[i];
     var wBig;
+    // Safe-integer, not merely integer — see _toBigIntUnits. A weight past the
+    // safe range has already been rounded, and the shares would be exact
+    // arithmetic over proportions the caller did not give.
     if (typeof wi === "bigint") wBig = wi;
-    else if (typeof wi === "number" && Number.isInteger(wi)) wBig = BigInt(wi);
+    else if (typeof wi === "number" && Number.isSafeInteger(wi)) wBig = BigInt(wi);
     else {
       throw new MoneyError("money/bad-weight",
-        "weight[" + i + "] must be BigInt or integer Number; got " +
-        (typeof wi));
+        "weight[" + i + "] must be a BigInt or a safe integer Number; got " +
+        (typeof wi === "number" ? String(wi) : typeof wi));
     }
     if (wBig < 0n) {
       throw new MoneyError("money/bad-weight",
@@ -470,9 +525,8 @@ Money.prototype.allocate = function (weights) {
   }
   if (sum === 0n) {
     throw new MoneyError("money/bad-weights",
-      "allocate weights sum to zero");
+      label + " weights sum to zero");
   }
-  var total = this._minor;
   var shares = new Array(weights.length);
   var remainders = new Array(weights.length);
   var allocated = 0n;
@@ -508,6 +562,14 @@ Money.prototype.allocate = function (weights) {
     leftover = leftover - 1n;
     k = k + 1;
   }
+  return shares;
+}
+
+// allocate -- split `this` into `weights.length` parts proportional to the
+// weights, distributing every minor unit. The arithmetic is b.money.splitUnits;
+// this wraps each share back into a Money of the same currency.
+Money.prototype.allocate = function (weights) {
+  var shares = _largestRemainder(this._minor, weights, "allocate");
   var out = new Array(shares.length);
   for (var s2 = 0; s2 < shares.length; s2++) {
     out[s2] = new Money(shares[s2], this.currency);
@@ -800,6 +862,7 @@ module.exports = {
   zero:            zero,
   convert:         convert,
   roundMinor:      roundMinor,
+  splitUnits:      splitUnits,
   CURRENCIES:      CURRENCIES,
   Money:           Money,
   MoneyError:      MoneyError,