@blamejs/core 0.5.15 → 0.5.17

package/lib/external-db.js

@@ -53,6 +53,7 @@
 var retryHelper = require("./retry");
 var C = require("./constants");
 var lazyRequire = require("./lazy-require");
+var safeAsync = require("./safe-async");
 var { ExternalDbError } = require("./framework-error");
 
 var audit = lazyRequire(function () { return require("./audit"); });
@@ -78,8 +79,8 @@ class Pool {
     this.idle = [];     // [{ client, lastUsedAt }]
     this.active = 0;    // count of in-use clients
     this.waiters = [];  // queued acquisitions when at max
-    this._reaper = setInterval(this._reapIdle.bind(this), C.TIME.seconds(10));
-    this._reaper.unref();
+    this._reaper = safeAsync.repeating(this._reapIdle.bind(this),
+      C.TIME.seconds(10), { name: "external-db-reaper" });
   }
 
   async acquire() {
@@ -141,7 +142,7 @@ class Pool {
   }
 
   async drain() {
-    if (this._reaper) { clearInterval(this._reaper); this._reaper = null; }
+    if (this._reaper) { this._reaper.stop(); this._reaper = null; }
     var idleClients = this.idle.map(function (e) { return e.client; });
     this.idle = [];
     var self = this;

package/lib/forms.js

@@ -35,7 +35,7 @@
  *   forms.escapeAttribute(value)       → string (double-quoted-attr context)
  *   forms.escapeHtml = template.escapeHtml (re-export for convenience)
  */
-var nodeCrypto = require("crypto");
+var crypto = require("./crypto");
 var safeSchema = require("./safe-schema");
 var safeUrl = require("./safe-url");
 var template = require("./template");
@@ -47,16 +47,13 @@ var template = require("./template");
 var CSRF_TOKEN_BYTES = 32;
 
 function generateCsrfToken() {
-  return nodeCrypto.randomBytes(CSRF_TOKEN_BYTES).toString("hex");
+  return crypto.generateToken(CSRF_TOKEN_BYTES);
 }
 
 function verifyCsrfToken(submitted, expected) {
   if (typeof submitted !== "string" || typeof expected !== "string") return false;
   if (submitted.length === 0 || submitted.length !== expected.length) return false;
-  var a = Buffer.from(submitted, "utf8");
-  var b = Buffer.from(expected, "utf8");
-  if (a.length !== b.length) return false;
-  return nodeCrypto.timingSafeEqual(a, b);
+  return crypto.timingSafeEqual(submitted, expected);
 }
 
 // ============================================================

package/lib/http-client.js

@@ -64,10 +64,10 @@
 var http  = require("http");
 var https = require("https");
 var http2 = require("http2");
-var nodeCrypto = require("node:crypto");
 var nodeStream = require("node:stream");
 var { URL } = require("url");
 var C = require("./constants");
+var crypto = require("./crypto");
 var pqcAgent = require("./pqc-agent");
 var safeAsync = require("./safe-async");
 var safeBuffer = require("./safe-buffer");
@@ -356,7 +356,7 @@ function _attachJarCookie(headers, jar, url) {
 // parser accepts so round-trip from one blamejs app's outbound to
 // another's inbound is exact.
 function _buildMultipartBody(spec) {
-  var boundary = "----blamejs-mp-" + nodeCrypto.randomBytes(16).toString("hex");
+  var boundary = "----blamejs-mp-" + crypto.generateToken(16);
   var CRLF = "\r\n";
   var parts = [];
 

package/lib/mail.js

@@ -63,8 +63,8 @@
  * diagnostic logs identify the provider that rejected the message.
  */
 var C = require("./constants");
+var crypto = require("./crypto");
 var lazyRequire = require("./lazy-require");
-var nodeCrypto = require("node:crypto");
 var audit = lazyRequire(function () { return require("./audit"); });
 var httpClient = lazyRequire(function () { return require("./http-client"); });
 var net = lazyRequire(function () { return require("net"); });
@@ -297,7 +297,7 @@ function _newBoundary(label) {
   // convention. RFC 5322 only requires uniqueness within a message,
   // but consistency with how every other identifier in lib/ is built
   // wins over premature differentiation.
-  return "blamejs-" + label + "-" + Date.now() + "-" + nodeCrypto.randomBytes(8).toString("hex");
+  return "blamejs-" + label + "-" + Date.now() + "-" + crypto.generateToken(8);
 }
 
 // base64-encode the buffer with line wrapping at 76 chars (RFC 2045

package/lib/middleware/body-parser.js

@@ -113,6 +113,7 @@ var os = require("os");
 var path = require("path");
 var nodeCrypto = require("node:crypto");
 var atomicFile = require("../atomic-file");
+var crypto = require("../crypto");
 var safeJson = require("../safe-json");
 var validateOpts = require("../validate-opts");
 var C = require("../constants");
@@ -708,7 +709,7 @@ async function _parseMultipart(req, opts, ctParams) {
 
               // Generate the tmp path — never derived from the
               // operator-supplied filename.
-              var unique = nodeCrypto.randomBytes(16).toString("hex");
+              var unique = crypto.generateToken(16);
               currentTmpPath = path.join(tmpDir, "blamejs-up-" + unique);
               try {
                 currentFd = fs.openSync(currentTmpPath, "wx", 0o600);

package/lib/middleware/compression.js

@@ -209,9 +209,10 @@ function _appendVary(existing, token) {
   if (!existing) return token;
   var lc = String(existing).toLowerCase();
   if (lc === "*") return "*"; // Vary: * already stops caches; don't dilute.
-  var parts = String(existing).split(",").map(function (p) { return p.trim(); });
+  var parts = requestHelpers.parseListHeader(existing);
+  var lcToken = token.toLowerCase();
   for (var i = 0; i < parts.length; i++) {
-    if (parts[i].toLowerCase() === token.toLowerCase()) return String(existing);
+    if (parts[i].toLowerCase() === lcToken) return String(existing);
   }
   parts.push(token);
   return parts.join(", ");

package/lib/middleware/cors.js

@@ -236,7 +236,7 @@ function create(opts) {
       if (refuseUnknown) {
         var requestedHdrs = req.headers["access-control-request-headers"];
         if (requestedHdrs) {
-          var asked = String(requestedHdrs).toLowerCase().split(",").map(function (s) { return s.trim(); }).filter(Boolean);
+          var asked = requestHelpers.parseListHeader(requestedHdrs, { lowercase: true });
           for (var ah = 0; ah < asked.length; ah++) {
             if (allowedHeadersSet.indexOf(asked[ah]) === -1) {
               if (typeof res.writeHead === "function") {

package/lib/middleware/rate-limit.js

@@ -46,6 +46,7 @@
 var C = require("../constants");
 var lazyRequire = require("../lazy-require");
 var requestHelpers = require("../request-helpers");
+var safeAsync = require("../safe-async");
 var validateOpts = require("../validate-opts");
 var clusterStorage = require("../cluster-storage");
 
@@ -71,13 +72,12 @@ function _memoryBackend(opts) {
   var buckets = new Map();
 
   // Periodic GC of stale buckets so the map doesn't grow unbounded.
-  var gcInterval = setInterval(function () {
+  var gcInterval = safeAsync.repeating(function () {
     var cutoff = Date.now() - C.TIME.hours(1);
     for (var k of buckets.keys()) {
       if (buckets.get(k).lastRefillAt < cutoff) buckets.delete(k);
     }
-  }, C.TIME.minutes(5));
-  if (typeof gcInterval.unref === "function") gcInterval.unref();
+  }, C.TIME.minutes(5), { name: "rate-limit-gc" });
 
   // Memory backend returns verdicts SYNCHRONOUSLY — no awaitable.
   // The middleware checks `.then` to decide whether to chain. Keeping
@@ -118,7 +118,7 @@ function _memoryBackend(opts) {
   }
 
   function close() {
-    try { clearInterval(gcInterval); } catch (_e) {}
+    try { gcInterval.stop(); } catch (_e) {}
     buckets.clear();
   }
 

package/lib/mtls-engine-default.js

@@ -32,6 +32,7 @@ var nodeCrypto = require("node:crypto");
 var pki = require("./vendor/pki.cjs");
 
 var C = require("./constants");
+var crypto = require("./crypto");
 var { FrameworkError } = require("./framework-error");
 
 var x509 = pki.x509;
@@ -108,7 +109,7 @@ async function generateCa(opts) {
   var keys = await webcrypto.subtle.generateKey(CA_KEY_ALG, true, CA_KEY_USAGES);
   var now  = new Date();
   var ca = await x509.X509CertificateGenerator.createSelfSigned({
-    serialNumber: nodeCrypto.randomBytes(16).toString("hex"),
+    serialNumber: crypto.generateToken(16),
     name: "CN=" + caName + ",OU=CAv" + generation,
     notBefore: now,
     notAfter: new Date(now.getTime() + C.TIME.days(CA_VALIDITY_DAYS)),
@@ -143,7 +144,7 @@ async function signClientCert(opts) {
   var now      = new Date();
   var notAfter = new Date(now.getTime() + C.TIME.days(validityDays));
   var clientCert = await x509.X509CertificateGenerator.create({
-    serialNumber: nodeCrypto.randomBytes(16).toString("hex"),
+    serialNumber: crypto.generateToken(16),
     subject: "CN=" + cn,
     issuer: caCert.subject,
     notBefore: now,

package/lib/nonce-store.js

@@ -43,6 +43,7 @@
 
 var clusterStorage = require("./cluster-storage");
 var C = require("./constants");
+var safeAsync = require("./safe-async");
 var { defineClass } = require("./framework-error");
 
 var NonceStoreError = defineClass("NonceStoreError");
@@ -59,13 +60,12 @@ function _memoryBackend(opts) {
   var sweepIntervalMs = opts.sweepIntervalMs || DEFAULT_SWEEP_INTERVAL_MS;
   var seen = new Map();   // nonce -> expireAt
 
-  var sweepTimer = setInterval(function () {
+  var sweepTimer = safeAsync.repeating(function () {
     var now = Date.now();
     for (var entry of seen) {
       if (entry[1] <= now) seen.delete(entry[0]);
     }
-  }, sweepIntervalMs);
-  if (typeof sweepTimer.unref === "function") sweepTimer.unref();
+  }, sweepIntervalMs, { name: "nonce-sweep" });
 
   function checkAndInsert(nonce, expireAt) {
     if (typeof nonce !== "string" || nonce.length === 0) {
@@ -92,7 +92,7 @@ function _memoryBackend(opts) {
   }
 
   function close() {
-    if (sweepTimer) { clearInterval(sweepTimer); sweepTimer = null; }
+    if (sweepTimer) { sweepTimer.stop(); sweepTimer = null; }
     seen.clear();
   }
 

package/lib/otel-export.js

@@ -0,0 +1,267 @@
+"use strict";
+/**
+ * otel-export — OTLP/HTTP-JSON exporter for `b.observability` events.
+ *
+ * Bridges the framework's `observability.event(name, value, attrs)`
+ * surface to any OTel-compatible backend (Honeycomb, Datadog, Jaeger
+ * Collector, AWS Distro, Grafana, NewRelic — anything that speaks
+ * OTLP/HTTP). Spec: opentelemetry.io/docs/specs/otlp.
+ *
+ *   var otel = b.otelExport.create({
+ *     endpoint:     "https://otel.honeycomb.io/v1/metrics",
+ *     headers:      { "X-Honeycomb-Team": env("HONEYCOMB_API_KEY") },
+ *     serviceName:  "wiki",
+ *     intervalMs:   b.constants.TIME.seconds(15),  // auto-flush cadence
+ *     httpClient:   b.httpClient,                  // for testing
+ *   });
+ *
+ *   // Counter — accumulates per (name, attrs) tuple, flushed in batches.
+ *   otel.recordCounter("http.requests", 1, { method: "GET", status: 200 });
+ *
+ *   // Histogram — operator-bucketed observation. Less common; operators
+ *   // wanting full histogram support build on top.
+ *   otel.recordObservation("http.duration_ms", 142, { route: "/api/x" });
+ *
+ *   await otel.flush();   // manual flush
+ *   otel.close();         // cancels interval, final flush
+ *
+ * Wiring with `b.observability`:
+ *
+ *   // Option A: replace the metrics tap entirely
+ *   b.observability._setTap(otel.tapHandler);
+ *
+ *   // Option B: alongside b.metrics — operators write their own
+ *   // multi-tap fan-out (or pick one or the other for v1).
+ *
+ * Endpoint must accept OTLP/HTTP with Content-Type: application/json
+ * (the JSON variant of the OTLP protobuf — every modern collector
+ * supports it). The framework refuses to ship the binary protobuf
+ * encoding because it requires either a vendored proto runtime or
+ * hand-rolled wire format with no compelling benefit at this scope.
+ */
+var C = require("./constants");
+var safeAsync = require("./safe-async");
+var validateOpts = require("./validate-opts");
+var { defineClass } = require("./framework-error");
+
+var OtelExportError = defineClass("OtelExportError", { alwaysPermanent: false });
+
+var DEFAULT_INTERVAL_MS = C.TIME.seconds(15);
+
+// OTLP aggregation temporality:
+//   1 = DELTA      — counters report deltas since last export
+//   2 = CUMULATIVE — counters report running totals
+// DELTA is what most exporters do for short-lived processes; the
+// receiving backend handles the running sum.
+var TEMPORALITY_DELTA = 1;
+
+// ---- attribute encoding ----
+// OTLP attributes are KeyValue with typed `value` fields:
+//   { key, value: { stringValue | intValue | doubleValue | boolValue } }
+function _attrsToOtlp(attrs) {
+  if (!attrs || typeof attrs !== "object") return [];
+  var out = [];
+  for (var k in attrs) {
+    if (!Object.prototype.hasOwnProperty.call(attrs, k)) continue;
+    var v = attrs[k];
+    var kv;
+    if (typeof v === "string")  kv = { stringValue: v };
+    else if (typeof v === "number") {
+      kv = Number.isInteger(v) ? { intValue: String(v) } : { doubleValue: v };
+    }
+    else if (typeof v === "boolean") kv = { boolValue: v };
+    else if (v == null) continue;
+    else kv = { stringValue: String(v) };
+    out.push({ key: k, value: kv });
+  }
+  return out;
+}
+
+// Stable key per (name, attrs) so tap calls aggregate.
+function _bucketKey(name, attrs) {
+  if (!attrs) return name + "|";
+  var ks = Object.keys(attrs).sort();
+  var parts = [name];
+  for (var i = 0; i < ks.length; i++) parts.push(ks[i] + "=" + String(attrs[ks[i]]));
+  return parts.join("|");
+}
+
+function create(opts) {
+  opts = opts || {};
+  validateOpts(opts, [
+    "endpoint", "headers", "serviceName", "intervalMs",
+    "httpClient", "resourceAttributes", "scope",
+  ], "otelExport.create");
+  if (typeof opts.endpoint !== "string" || opts.endpoint.length === 0) {
+    throw new OtelExportError("otel-export/bad-endpoint",
+      "create: endpoint must be a non-empty URL");
+  }
+  if (typeof opts.serviceName !== "string" || opts.serviceName.length === 0) {
+    throw new OtelExportError("otel-export/bad-service-name",
+      "create: serviceName must be a non-empty string");
+  }
+  var endpoint = opts.endpoint;
+  var serviceName = opts.serviceName;
+  var headers = opts.headers || {};
+  var intervalMs = opts.intervalMs != null ? opts.intervalMs : DEFAULT_INTERVAL_MS;
+  if (typeof intervalMs !== "number" || !isFinite(intervalMs) || intervalMs < 0) {
+    throw new OtelExportError("otel-export/bad-interval",
+      "create: intervalMs must be a non-negative finite number");
+  }
+  var httpClient = opts.httpClient || require("./http-client");
+  var scopeName = (opts.scope && opts.scope.name) || "blamejs";
+  var scopeVersion = (opts.scope && opts.scope.version) || "0.5.x";
+  var resourceAttrs = Object.assign({ "service.name": serviceName },
+    opts.resourceAttributes || {});
+
+  // Buckets: counters and observations keyed by (name, sorted-attrs).
+  var counters = new Map();          // bucketKey → { name, attrs, value, startUnixNano }
+  var observations = new Map();      // bucketKey → { name, attrs, sum, count, min, max, startUnixNano }
+  var startUnixNano = String(Date.now() * 1e6);
+  var loop = null;
+  var closed = false;
+
+  function recordCounter(name, value, attrs) {
+    if (closed) return;
+    if (typeof name !== "string" || name.length === 0) return;
+    var v = typeof value === "number" && isFinite(value) ? value : 1;
+    var key = _bucketKey(name, attrs);
+    var b = counters.get(key);
+    if (!b) {
+      b = { name: name, attrs: attrs || {}, value: 0, startUnixNano: startUnixNano };
+      counters.set(key, b);
+    }
+    b.value += v;
+  }
+
+  function recordObservation(name, value, attrs) {
+    if (closed) return;
+    if (typeof name !== "string" || name.length === 0) return;
+    if (typeof value !== "number" || !isFinite(value)) return;
+    var key = _bucketKey(name, attrs);
+    var b = observations.get(key);
+    if (!b) {
+      b = { name: name, attrs: attrs || {}, sum: 0, count: 0, min: value, max: value, startUnixNano: startUnixNano };
+      observations.set(key, b);
+    }
+    b.sum   += value;
+    b.count += 1;
+    if (value < b.min) b.min = value;
+    if (value > b.max) b.max = value;
+  }
+
+  // Operators wire this as the observability tap. event(name, value, labels)
+  // → recordCounter for value=1 fire-and-forget shapes.
+  function tapHandler(name, value, labels) {
+    recordCounter(name, value, labels);
+  }
+
+  function _drainAndEncode() {
+    var nowUnixNano = String(Date.now() * 1e6);
+    var metrics = [];
+    var c, o;
+
+    counters.forEach(function (entry) {
+      metrics.push({
+        name: entry.name,
+        sum: {
+          dataPoints: [{
+            attributes:        _attrsToOtlp(entry.attrs),
+            startTimeUnixNano: entry.startUnixNano,
+            timeUnixNano:      nowUnixNano,
+            asDouble:          entry.value,
+          }],
+          aggregationTemporality: TEMPORALITY_DELTA,
+          isMonotonic:            true,
+        },
+      });
+    });
+    void c;
+    observations.forEach(function (entry) {
+      metrics.push({
+        name: entry.name,
+        summary: {
+          dataPoints: [{
+            attributes:        _attrsToOtlp(entry.attrs),
+            startTimeUnixNano: entry.startUnixNano,
+            timeUnixNano:      nowUnixNano,
+            count:             String(entry.count),
+            sum:               entry.sum,
+            quantileValues: [
+              { quantile: 0,   value: entry.min },
+              { quantile: 1,   value: entry.max },
+            ],
+          }],
+        },
+      });
+    });
+    void o;
+
+    // Reset buckets (DELTA temporality — each export is the delta).
+    counters.clear();
+    observations.clear();
+    startUnixNano = nowUnixNano;
+    if (metrics.length === 0) return null;
+    return {
+      resourceMetrics: [{
+        resource: { attributes: _attrsToOtlp(resourceAttrs) },
+        scopeMetrics: [{
+          scope:   { name: scopeName, version: scopeVersion },
+          metrics: metrics,
+        }],
+      }],
+    };
+  }
+
+  async function flush() {
+    var payload = _drainAndEncode();
+    if (!payload) return { sent: false, reason: "no-data" };
+    var body = JSON.stringify(payload);
+    try {
+      var res = await httpClient.request({
+        method:  "POST",
+        url:     endpoint,
+        headers: Object.assign({ "Content-Type": "application/json" }, headers),
+        body:    body,
+      });
+      if (res.statusCode < 200 || res.statusCode >= 300) {
+        throw new OtelExportError("otel-export/upstream-rejected",
+          "OTLP endpoint returned " + res.statusCode);
+      }
+      return { sent: true, statusCode: res.statusCode, bodyLength: body.length };
+    } catch (e) {
+      if (e && e.isOtelExportError) throw e;
+      throw new OtelExportError("otel-export/send-failed",
+        "OTLP send failed: " + ((e && e.message) || String(e)));
+    }
+  }
+
+  if (intervalMs > 0) {
+    loop = safeAsync.flushLoop(flush, intervalMs, { name: "otel-flush" });
+  }
+
+  function close() {
+    if (closed) return;
+    closed = true;
+    if (loop) { loop.stop(); loop = null; }
+    return flush().catch(function (_e) { /* close path swallows final-flush errors */ });
+  }
+
+  return {
+    recordCounter:     recordCounter,
+    recordObservation: recordObservation,
+    tapHandler:        tapHandler,
+    flush:             flush,
+    close:             close,
+    get bufferedCounters()     { return counters.size; },
+    get bufferedObservations() { return observations.size; },
+  };
+}
+
+module.exports = {
+  create:           create,
+  OtelExportError:  OtelExportError,
+  // Test-only encoders for unit-testing the OTLP shape without an HTTP client.
+  _attrsToOtlpForTest: _attrsToOtlp,
+  _bucketKeyForTest:   _bucketKey,
+};

package/lib/parsers/index.js

@@ -7,9 +7,6 @@
  *   xml  — RFC-compliant subset; XXE / DOCTYPE / billion-laughs blocked
  *           by default; depth + element + attribute count limits;
  *           numeric-character-ref bounds checked
- *   csv  — RFC 4180 parsing + writer with formula-injection prevention
- *           (cells starting with =/+/-/@/tab/CR get a single-quote
- *           prefix on stringify so Excel doesn't execute them)
  *   toml — TOML 1.0 parsing with depth + size limits;
  *           prototype-pollution rejection on dotted-key path segments;
  *           strict same-key redefinition (silent overwrite would mask
@@ -49,15 +46,14 @@
  *
  * Public API:
  *   parsers.xml.parse(input, opts?)              → object
- *   parsers.csv.parse(input, opts?)              → array
- *   parsers.csv.stringify(rows, opts?)           → string
+ *
+ * (CSV moved to top-level `b.csv` in v0.5.17 — same surface unified.)
  *
  * Error types: each parser exports its own *SafeError class with .code
- * matching the format (xml/..., csv/...).
+ * matching the format (xml/..., toml/...).
  */
 module.exports = {
   xml:  require("./safe-xml"),
-  csv:  require("./safe-csv"),
   toml: require("./safe-toml"),
   yaml: require("./safe-yaml"),
   env:  require("./safe-env"),

package/lib/queue.js

@@ -31,8 +31,8 @@
  *                                       failed (status='failed')
  */
 var C = require("./constants");
+var crypto = require("./crypto");
 var lazyRequire = require("./lazy-require");
-var nodeCrypto = require("node:crypto");
 var observability = require("./observability");
 var protocolDispatcher = require("./protocol-dispatcher");
 var localProto = require("./queue-local");
@@ -125,14 +125,13 @@ function init(opts) {
 
   // Sweep expired leases periodically (every 30s) so crashed-handler jobs
   // get re-pended.
-  sweepTimer = setInterval(function () {
+  sweepTimer = safeAsync.repeating(function () {
     Object.keys(backends).forEach(function (n) {
       if (backends[n].sweepExpired) {
         backends[n].sweepExpired().catch(function () { /* best effort */ });
       }
     });
-  }, 30000);
-  sweepTimer.unref();
+  }, C.TIME.seconds(30), { name: "queue-sweep" });
 
   initialized = true;
 }
@@ -466,7 +465,7 @@ async function shutdown(opts) {
     await safeAsync.sleep(50);
   }
   consumers = [];
-  if (sweepTimer) { clearInterval(sweepTimer); sweepTimer = null; }
+  if (sweepTimer) { sweepTimer.stop(); sweepTimer = null; }
 }
 
 function listBackends() {
@@ -485,7 +484,7 @@ function _requireInit() {
 }
 
 function _resetForTest() {
-  if (sweepTimer) { clearInterval(sweepTimer); sweepTimer = null; }
+  if (sweepTimer) { sweepTimer.stop(); sweepTimer = null; }
   consumers.forEach(function (c) { c.cancel(); });
   consumers = [];
   backends = {};
@@ -571,7 +570,7 @@ function enqueueFlow(spec) {
     return Promise.reject(e);
   }
 
-  var flowId = "flow-" + nodeCrypto.randomBytes(8).toString("hex");
+  var flowId = "flow-" + crypto.generateToken(8);
 
   return observability.tap("queue.enqueueFlow",
     { queueName: spec.queueName, flowId: flowId, childCount: spec.children.length },

package/lib/request-helpers.js

@@ -136,7 +136,7 @@ function clientIp(req, opts) {
   if (trust && req.headers) {
     var xff = req.headers["x-forwarded-for"];
     if (xff) {
-      var hops = String(xff).split(",").map(function (s) { return s.trim(); });
+      var hops = parseListHeader(xff);
       if (trust === true) return hops[0];
       if (typeof trust === "number" && trust >= 1 && hops.length >= trust) {
         return hops[hops.length - trust];
@@ -154,7 +154,8 @@ function requestProtocol(req, opts) {
   if (trust && req.headers) {
     var fwd = req.headers["x-forwarded-proto"];
     if (typeof fwd === "string" && fwd.length > 0) {
-      return String(fwd).split(",")[0].trim().toLowerCase();
+      var hops = parseListHeader(fwd, { lowercase: true });
+      if (hops.length > 0) return hops[0];
     }
   }
   if (req.socket && req.socket.encrypted) return "https";
@@ -162,6 +163,36 @@ function requestProtocol(req, opts) {
   return "http";
 }
 
+// parseListHeader — split a comma-separated header / opt value into a
+// list of trimmed non-empty tokens. Replaces the
+// `String(x).split(",").map(s => s.trim()).filter(Boolean)` chain that
+// was duplicated across cors / compression / scheduler / webhook /
+// websocket / db-schema / cli before v0.5.17.
+//
+//   parseListHeader("a, b , ,c")           → ["a", "b", "c"]
+//   parseListHeader("Foo, Bar", { lowercase: true })
+//                                          → ["foo", "bar"]
+//   parseListHeader(undefined)             → []
+//   parseListHeader("")                    → []
+//
+// Tier-C: tolerant of non-string input (returns []) — these are read
+// from request headers that the network might omit. Callers needing
+// stricter checks layer their own validation on the result.
+function parseListHeader(value, opts) {
+  if (value == null) return [];
+  opts = opts || {};
+  var s = typeof value === "string" ? value : String(value);
+  if (s.length === 0) return [];
+  var parts = s.split(",");
+  var out = [];
+  for (var i = 0; i < parts.length; i++) {
+    var t = parts[i].trim();
+    if (t.length === 0) continue;
+    out.push(opts.lowercase ? t.toLowerCase() : t);
+  }
+  return out;
+}
+
 // Append a token to a `Vary` response header without dropping prior
 // values (compression middleware sets `Vary: Accept-Encoding`, an
 // auth helper might set `Vary: Authorization`, etc.). Idempotent —
@@ -170,7 +201,7 @@ function appendVary(res, value) {
   if (!res || typeof res.getHeader !== "function" || typeof res.setHeader !== "function") return;
   var existing = res.getHeader("Vary");
   if (existing == null || existing === "") { res.setHeader("Vary", value); return; }
-  var tokens = String(existing).split(",").map(function (s) { return s.trim(); }).filter(Boolean);
+  var tokens = parseListHeader(existing);
   var lower = value.toLowerCase();
   for (var i = 0; i < tokens.length; i++) if (tokens[i].toLowerCase() === lower) return;
   tokens.push(value);
@@ -266,6 +297,7 @@ module.exports = {
   extractActorContext:       extractActorContext,
   resolveActorWithOverride:  resolveActorWithOverride,
   parseQualityList:          parseQualityList,
+  parseListHeader:           parseListHeader,
   // v0.5.3 — proxy-trust primitives (default refuses forwarded headers)
   clientIp:                  clientIp,
   requestProtocol:           requestProtocol,