@blamejs/core 0.6.37 → 0.6.58

package/lib/object-store/sigv4.js

@@ -496,10 +496,17 @@ function create(config) {
         "(S3 max " + MAX_PARTS + "); increase partSizeBytes", true);
     }
 
-    // 1. Initiate
+    // 1. Initiate — `?uploads` is the InitiateMultipartUpload subresource.
+    // Build the URL with the bare token (no trailing `=`) for consistency
+    // with sigv4-bucket-ops.js — strict S3 implementations route on the
+    // bare form; the `URLSearchParams.set("uploads", "")` idiom produces
+    // `?uploads=` which is accepted by AWS + MinIO for this specific
+    // subresource, but the framework's convention is the bare form
+    // everywhere. SigV4 canonicalization reads `url.searchParams` (which
+    // still presents `uploads=` per AWS spec) so the signature path is
+    // unchanged.
     var url = _keyToUrl(key);
-    var initiateUrl = new URL(url.href);
-    initiateUrl.searchParams.set("uploads", "");
+    var initiateUrl = new URL(url.href + (url.search ? "&" : "?") + "uploads");
     var initiateExtra = {
       "Content-Type":   contentType,
       "Content-Length": "0",

package/lib/protobuf-encoder.js

@@ -0,0 +1,184 @@
+"use strict";
+/**
+ * protobuf-encoder — minimal proto3 wire-format encoder.
+ *
+ * Write-only — there is no decoder. The framework emits OTLP gRPC log
+ * records (a fixed schema) and never reads protobuf back. A decoder
+ * would double the surface area + maintenance burden for no use case
+ * the framework owns end-to-end.
+ *
+ * Wire format reference:
+ *   https://protobuf.dev/programming-guides/encoding/
+ *
+ * Wire types used:
+ *   0  varint    — uint32 / uint64 / int32 / int64 / bool / enum
+ *   1  64-bit    — fixed64 / sfixed64 / double
+ *   2  length-delimited — string / bytes / embedded message / packed repeated
+ *   5  32-bit    — fixed32 / sfixed32 / float
+ *
+ * Each field on the wire:
+ *   tag = (fieldNumber << 3) | wireType   (encoded as varint)
+ *   value (per wire type)
+ *
+ * Operators reach for this primitive when constructing a protobuf
+ * message body for an external service that accepts proto over HTTP
+ * (gRPC, AWS sigv4-protobuf, GCP protobuf APIs, etc.). All buffer
+ * concatenation is deferred — every encoder function returns a Buffer
+ * the caller can splice in any order.
+ */
+
+var WIRE_VARINT  = 0;
+var WIRE_64BIT   = 1;
+var WIRE_LDELIM  = 2;
+// WIRE_32BIT (5) is unused — fixed32 / sfixed32 / float aren't on the
+// OTel logs schema. Reserved here as documentation; un-comment + add
+// helpers when a future caller (metrics histograms?) needs them.
+// var WIRE_32BIT = 5;
+
+function _writeVarint(value) {
+  // proto3 varints are unsigned for the integer types we use here;
+  // negative int32/int64 would need 10-byte two's-complement encoding,
+  // but OTel log severity numbers / unix nanos are all non-negative.
+  if (typeof value === "number") {
+    if (value < 0) {
+      throw new Error("protobuf-encoder: negative varint not supported (got " + value + ")");
+    }
+    if (!Number.isFinite(value)) {
+      throw new Error("protobuf-encoder: non-finite varint (got " + value + ")");
+    }
+  } else if (typeof value === "bigint") {
+    if (value < 0n) {
+      throw new Error("protobuf-encoder: negative varint not supported (got " + value + ")");
+    }
+  } else {
+    throw new Error("protobuf-encoder: varint must be number or bigint, got " + typeof value);
+  }
+  var bytes = [];
+  if (typeof value === "bigint") {
+    var v = value;
+    do {
+      var lower = Number(v & 0x7fn);
+      v = v >> 7n;
+      if (v !== 0n) lower |= 0x80;
+      bytes.push(lower);
+    } while (v !== 0n);
+  } else {
+    // Number path — JS numbers safely hold integers up to 2^53.
+    var n = value;
+    do {
+      var byte = n & 0x7f;
+      n = Math.floor(n / 128);
+      if (n > 0) byte |= 0x80;
+      bytes.push(byte);
+    } while (n > 0);
+  }
+  return Buffer.from(bytes);
+}
+
+function _tag(fieldNumber, wireType) {
+  return _writeVarint((fieldNumber << 3) | wireType);
+}
+
+function uint32(fieldNumber, value) {
+  if (value === 0) return Buffer.alloc(0);  // proto3 default — skip
+  return Buffer.concat([_tag(fieldNumber, WIRE_VARINT), _writeVarint(value)]);
+}
+
+function uint64(fieldNumber, value) {
+  if (value === 0 || value === 0n) return Buffer.alloc(0);
+  return Buffer.concat([_tag(fieldNumber, WIRE_VARINT), _writeVarint(value)]);
+}
+
+function bool(fieldNumber, value) {
+  if (!value) return Buffer.alloc(0);  // proto3 default
+  return Buffer.concat([_tag(fieldNumber, WIRE_VARINT), Buffer.from([1])]);
+}
+
+function fixed64(fieldNumber, value) {
+  // For OTel: time_unix_nano fields are fixed64. Accept BigInt or
+  // Number; encode as little-endian 8 bytes.
+  var buf = Buffer.alloc(8);
+  if (typeof value === "bigint") {
+    buf.writeBigUInt64LE(value, 0);
+  } else {
+    if (value < 0 || !Number.isFinite(value)) {
+      throw new Error("protobuf-encoder: fixed64 must be non-negative finite (got " + value + ")");
+    }
+    // Number path — split into low/high 32-bit halves.
+    var low  = value % 0x100000000;
+    var high = Math.floor(value / 0x100000000);
+    buf.writeUInt32LE(low,  0);
+    buf.writeUInt32LE(high, 4);
+  }
+  return Buffer.concat([_tag(fieldNumber, WIRE_64BIT), buf]);
+}
+
+function double(fieldNumber, value) {
+  if (value === 0) return Buffer.alloc(0);  // proto3 default
+  var buf = Buffer.alloc(8);
+  buf.writeDoubleLE(value, 0);
+  return Buffer.concat([_tag(fieldNumber, WIRE_64BIT), buf]);
+}
+
+function string(fieldNumber, value) {
+  if (value === "" || value == null) return Buffer.alloc(0);
+  var bodyBuf = Buffer.from(String(value), "utf8");
+  return Buffer.concat([
+    _tag(fieldNumber, WIRE_LDELIM),
+    _writeVarint(bodyBuf.length),
+    bodyBuf,
+  ]);
+}
+
+function bytes(fieldNumber, value) {
+  if (!value || value.length === 0) return Buffer.alloc(0);
+  var buf = Buffer.isBuffer(value) ? value : Buffer.from(value);
+  return Buffer.concat([
+    _tag(fieldNumber, WIRE_LDELIM),
+    _writeVarint(buf.length),
+    buf,
+  ]);
+}
+
+function embeddedMessage(fieldNumber, bodyBuf) {
+  // bodyBuf is the already-encoded inner message body (a Buffer).
+  // Caller can pass an empty buffer to encode an empty message;
+  // proto3 default-skips messages whose every field is at default,
+  // but we allow the caller to choose: we always emit the tag +
+  // length-delimited body, which lets the operator force-include an
+  // empty Resource{} when needed.
+  return Buffer.concat([
+    _tag(fieldNumber, WIRE_LDELIM),
+    _writeVarint(bodyBuf.length),
+    bodyBuf,
+  ]);
+}
+
+// Repeated unpacked: each entry encoded with its own tag+value. This
+// is the proto3 default for non-scalar repeated fields (messages,
+// strings) — packed encoding only applies to scalar varint/fixed
+// types. The caller passes an array and per-entry encoder.
+function repeatedMessage(fieldNumber, items, perItemBodyEncoder) {
+  if (!items || items.length === 0) return Buffer.alloc(0);
+  var pieces = new Array(items.length);
+  for (var i = 0; i < items.length; i++) {
+    var inner = perItemBodyEncoder(items[i]);
+    pieces[i] = embeddedMessage(fieldNumber, inner);
+  }
+  return Buffer.concat(pieces);
+}
+
+module.exports = {
+  uint32:           uint32,
+  uint64:           uint64,
+  bool:             bool,
+  fixed64:          fixed64,
+  double:           double,
+  string:           string,
+  bytes:            bytes,
+  embeddedMessage:  embeddedMessage,
+  repeatedMessage:  repeatedMessage,
+  // Exposed for tests — verify varint encoding directly.
+  _writeVarint:     _writeVarint,
+  _tag:             _tag,
+};

package/lib/queue-sqs.js

@@ -0,0 +1,314 @@
+"use strict";
+/**
+ * AWS SQS queue adapter — backs `b.queue` with Amazon SQS so multi-replica
+ * apps share a managed queue without each needing to be cluster leader.
+ *
+ * Wire protocol — AWSJsonProtocol_1.0 over HTTPS, SigV4-signed via
+ * `lib/object-store/sigv4.js`'s service-agnostic `signRequest` helper:
+ *
+ *   POST https://sqs.{region}.amazonaws.com/
+ *   Content-Type: application/x-amz-json-1.0
+ *   X-Amz-Target: AmazonSQS.<Action>
+ *   Authorization: AWS4-HMAC-SHA256 ...
+ *
+ *   Action          → SQS API
+ *   enqueue         → SendMessage
+ *   lease           → ReceiveMessage (long-poll up to WaitTimeSeconds)
+ *   extendLease     → ChangeMessageVisibility
+ *   complete        → DeleteMessage
+ *   fail            → ChangeMessageVisibility (VisibilityTimeout=0 → re-deliver
+ *                     immediately) — DLQ routing happens server-side via the
+ *                     queue's RedrivePolicy attribute, configured at queue
+ *                     creation time outside the framework
+ *   size            → GetQueueAttributes(ApproximateNumberOfMessages)
+ *   purge           → PurgeQueue
+ *
+ * Queue-name → URL: SQS queues live at
+ *   https://sqs.{region}.amazonaws.com/{accountId}/{queueName}
+ * Operators pass `accountId` + `region` and the adapter constructs URLs
+ * from the framework's logical queue names. Operators with cross-account
+ * queues / FIFO queues / VPCE endpoints pass an explicit
+ * `queueUrlByName(name) → url` resolver instead.
+ *
+ * What this adapter does NOT support (operator wiring required):
+ *
+ *   - DLQ inspection (dlqList / dlqRetry / dlqSize) — SQS DLQs are
+ *     separate queues; operators using one wire it as a second framework
+ *     backend and inspect via that backend's `lease()`.
+ *   - Flow / cron / parent-child dependencies — SQS has no native flow
+ *     primitives; those stay on queue-local or queue-redis.
+ *   - sweepExpired — SQS handles visibility-timeout expiry server-side.
+ *
+ * Sealing: payloads pass through `cryptoField.sealRow("_blamejs_jobs",
+ * row)` before SendMessage so the SQS message body is a sealed envelope
+ * (operator's vault-key + framework crypto stack), same posture as the
+ * local + redis backends.
+ */
+var sigv4 = require("./object-store/sigv4");
+var httpClient = require("./http-client");
+var cryptoField = require("./crypto-field");
+var safeJson = require("./safe-json");
+var safeUrl = require("./safe-url");
+var { generateToken } = require("./crypto");
+var { QueueError } = require("./framework-error");
+
+var _err = QueueError.factory;
+
+var DEFAULT_VISIBILITY_TIMEOUT_SEC = 30;
+var DEFAULT_WAIT_TIME_SEC          = 0;       // SQS supports up to 20s
+var DEFAULT_MAX_MESSAGES_PER_LEASE = 10;       // SQS hard cap
+
+function _resolveEndpoint(opts) {
+  if (opts.endpoint) return opts.endpoint.replace(/\/+$/, "") + "/";
+  return "https://sqs." + opts.region + ".amazonaws.com/";
+}
+
+function _payloadHash(buf) {
+  // Empty body's payload hash is the SHA256 of the empty string —
+  // sigv4 requires the actual hash, not "UNSIGNED-PAYLOAD".
+  var nodeCrypto = require("node:crypto");
+  return nodeCrypto.createHash("sha256").update(buf || Buffer.alloc(0)).digest("hex");
+}
+
+function create(opts) {
+  opts = opts || {};
+  if (typeof opts.region !== "string" || opts.region.length === 0) {
+    throw _err("INVALID_CONFIG", "queue-sqs: opts.region is required", true);
+  }
+  if (typeof opts.accessKeyId !== "string" || opts.accessKeyId.length === 0) {
+    throw _err("INVALID_CONFIG", "queue-sqs: opts.accessKeyId is required", true);
+  }
+  if (typeof opts.secretAccessKey !== "string" || opts.secretAccessKey.length === 0) {
+    throw _err("INVALID_CONFIG", "queue-sqs: opts.secretAccessKey is required", true);
+  }
+  if (!opts.queueUrlByName && (!opts.accountId ||
+      (typeof opts.accountId !== "string" && typeof opts.accountId !== "number"))) {
+    throw _err("INVALID_CONFIG",
+      "queue-sqs: opts.accountId is required (12-digit AWS account ID) " +
+      "or pass opts.queueUrlByName(name) → url for cross-account / VPCE queues", true);
+  }
+
+  var region          = opts.region;
+  var endpoint        = _resolveEndpoint(opts);
+  var endpointUrl     = new URL(endpoint);
+  var accessKeyId     = opts.accessKeyId;
+  var secretAccessKey = opts.secretAccessKey;
+  var sessionToken    = opts.sessionToken || null;
+  var accountId       = opts.accountId ? String(opts.accountId) : null;
+  var timeoutMs       = opts.timeoutMs;
+  var allowedProtocols = opts.allowedProtocols || safeUrl.ALLOW_HTTP_TLS;
+  var allowInternal   = opts.allowInternal != null ? opts.allowInternal : null;
+  var visibilityTimeoutSec = Number(opts.visibilityTimeoutSec) || DEFAULT_VISIBILITY_TIMEOUT_SEC;
+  var waitTimeSec     = Number(opts.waitTimeSec) || DEFAULT_WAIT_TIME_SEC;
+
+  var queueUrlResolver = typeof opts.queueUrlByName === "function"
+    ? opts.queueUrlByName
+    : function (name) {
+        return endpoint + accountId + "/" + name;
+      };
+
+  function _post(action, body) {
+    var bodyBuf = Buffer.from(JSON.stringify(body || {}), "utf8");
+    var headers = {
+      "Content-Type":  "application/x-amz-json-1.0",
+      "X-Amz-Target":  "AmazonSQS." + action,
+      "Content-Length": String(bodyBuf.length),
+    };
+    var signed = sigv4.signRequest({
+      method:          "POST",
+      url:             endpointUrl,
+      headers:         headers,
+      payloadHash:     _payloadHash(bodyBuf),
+      region:          region,
+      service:         "sqs",
+      accessKeyId:     accessKeyId,
+      secretAccessKey: secretAccessKey,
+      sessionToken:    sessionToken,
+    });
+    var reqOpts = {
+      method:           "POST",
+      url:              endpointUrl,
+      headers:          signed.headers,
+      body:             bodyBuf,
+      idleTimeoutMs:    timeoutMs,
+      allowedProtocols: allowedProtocols,
+      errorClass:       QueueError,
+    };
+    if (allowInternal !== null) reqOpts.allowInternal = allowInternal;
+    return httpClient.request(reqOpts).then(function (res) {
+      var text = Buffer.isBuffer(res.body) ? res.body.toString("utf8")
+              : (res.body || "").toString();
+      if (text.length === 0) return null;
+      try { return safeJson.parse(text); }
+      catch (_e) {
+        throw _err("BAD_RESPONSE", "queue-sqs: " + action +
+          " returned non-JSON body: " + text.slice(0, 500));
+      }
+    });
+  }
+
+  // ---- enqueue ----
+  async function enqueue(queueName, payload, enqueueOpts) {
+    enqueueOpts = enqueueOpts || {};
+    var queueUrl = queueUrlResolver(queueName);
+    var jobId = generateToken(16);
+    var sealed = cryptoField.sealRow("_blamejs_jobs", {
+      _id:           jobId,
+      queueName:     queueName,
+      payload:       JSON.stringify(payload == null ? null : payload),
+      enqueuedAt:    Date.now(),
+      attempts:      0,
+    });
+    // SQS message body: serialize the sealed row as JSON. Receive
+    // replays the same shape — sealed.payload stays sealed in transit.
+    var bodyJson = JSON.stringify(sealed);
+    var sqsBody = {
+      QueueUrl:    queueUrl,
+      MessageBody: bodyJson,
+    };
+    var delaySeconds = enqueueOpts.delaySeconds;
+    if (typeof delaySeconds === "number" && delaySeconds > 0) {
+      // SQS hard cap is 900s.
+      sqsBody.DelaySeconds = Math.min(900, Math.floor(delaySeconds));
+    }
+    var rv = await _post("SendMessage", sqsBody);
+    return rv && (rv.MessageId || jobId);
+  }
+
+  // ---- lease ----
+  async function lease(queueName, leaseOpts) {
+    leaseOpts = leaseOpts || {};
+    var queueUrl = queueUrlResolver(queueName);
+    var maxMessages = Math.min(
+      DEFAULT_MAX_MESSAGES_PER_LEASE,
+      Math.max(1, Number(leaseOpts.maxRows) || 1)
+    );
+    var visTimeout = Number(leaseOpts.visibilityTimeoutSec) || visibilityTimeoutSec;
+    var waitSec    = Number(leaseOpts.waitTimeSec) ||
+                     (waitTimeSec > 0 ? waitTimeSec : DEFAULT_WAIT_TIME_SEC);
+    var rv = await _post("ReceiveMessage", {
+      QueueUrl:               queueUrl,
+      MaxNumberOfMessages:    maxMessages,
+      VisibilityTimeout:      visTimeout,
+      WaitTimeSeconds:        waitSec,
+    });
+    var messages = (rv && rv.Messages) || [];
+    var out = [];
+    for (var i = 0; i < messages.length; i++) {
+      var m = messages[i];
+      var sealed;
+      try { sealed = safeJson.parse(m.Body); }
+      catch (_e) { continue; }
+      var unsealed = cryptoField.unsealRow("_blamejs_jobs", sealed);
+      var payload;
+      try {
+        payload = unsealed.payload != null
+          ? JSON.parse(unsealed.payload) : null;
+      } catch (_e) { payload = unsealed.payload; }
+      out.push({
+        jobId:         unsealed._id,
+        queueName:     unsealed.queueName || queueName,
+        payload:       payload,
+        attempts:      Number(unsealed.attempts) || 0,
+        enqueuedAt:    Number(unsealed.enqueuedAt) || null,
+        leaseExpiresAt: Date.now() + (visTimeout * 1000),
+        // SQS-specific: receipt handle is the only way to delete /
+        // change visibility / extend — surface it for the framework
+        // wrapper.
+        receiptHandle: m.ReceiptHandle,
+        sqsMessageId:  m.MessageId,
+      });
+    }
+    return out;
+  }
+
+  // ---- extendLease ----
+  async function extendLease(queueName, jobId, extendOpts) {
+    extendOpts = extendOpts || {};
+    if (!extendOpts.receiptHandle) {
+      throw _err("MISSING_RECEIPT",
+        "queue-sqs: extendLease requires opts.receiptHandle (returned by lease())", true);
+    }
+    var queueUrl = queueUrlResolver(queueName);
+    var visTimeout = Number(extendOpts.visibilityTimeoutSec) || visibilityTimeoutSec;
+    await _post("ChangeMessageVisibility", {
+      QueueUrl:          queueUrl,
+      ReceiptHandle:     extendOpts.receiptHandle,
+      VisibilityTimeout: visTimeout,
+    });
+    return true;
+  }
+
+  // ---- complete ----
+  async function complete(queueName, jobId, completeOpts) {
+    completeOpts = completeOpts || {};
+    if (!completeOpts.receiptHandle) {
+      throw _err("MISSING_RECEIPT",
+        "queue-sqs: complete requires opts.receiptHandle", true);
+    }
+    var queueUrl = queueUrlResolver(queueName);
+    await _post("DeleteMessage", {
+      QueueUrl:      queueUrl,
+      ReceiptHandle: completeOpts.receiptHandle,
+    });
+    return true;
+  }
+
+  // ---- fail (request re-delivery; SQS server-side DLQ routing decides
+  //          if it goes back to the main queue or to the DLQ) ----
+  async function fail(queueName, jobId, failOpts) {
+    failOpts = failOpts || {};
+    if (!failOpts.receiptHandle) {
+      throw _err("MISSING_RECEIPT",
+        "queue-sqs: fail requires opts.receiptHandle", true);
+    }
+    var queueUrl = queueUrlResolver(queueName);
+    // VisibilityTimeout=0 → message becomes visible to other consumers
+    // immediately. SQS's RedrivePolicy on the queue (configured at
+    // queue creation) tracks ApproximateReceiveCount and routes to
+    // the DLQ once maxReceiveCount is exceeded.
+    await _post("ChangeMessageVisibility", {
+      QueueUrl:          queueUrl,
+      ReceiptHandle:     failOpts.receiptHandle,
+      VisibilityTimeout: 0,
+    });
+    return true;
+  }
+
+  // ---- size (visible messages only — in-flight and delayed are
+  //           reported separately by GetQueueAttributes) ----
+  async function size(queueName) {
+    var queueUrl = queueUrlResolver(queueName);
+    var rv = await _post("GetQueueAttributes", {
+      QueueUrl:        queueUrl,
+      AttributeNames:  ["ApproximateNumberOfMessages"],
+    });
+    var attrs = (rv && rv.Attributes) || {};
+    return Number(attrs.ApproximateNumberOfMessages) || 0;
+  }
+
+  // ---- purge (60s server-side rate-limited; SQS rejects a second
+  //            purge within the cooldown window) ----
+  async function purge(queueName) {
+    var queueUrl = queueUrlResolver(queueName);
+    await _post("PurgeQueue", { QueueUrl: queueUrl });
+    return 0;   // SQS doesn't return a count
+  }
+
+  return {
+    enqueue:       enqueue,
+    lease:         lease,
+    extendLease:   extendLease,
+    complete:      complete,
+    fail:          fail,
+    size:          size,
+    purge:         purge,
+    // Test hook — exposes the signed-request builder for assertion-
+    // only verification of wire shape without standing up a mock SQS
+    // server.
+    _post:         _post,
+    _queueUrl:     queueUrlResolver,
+  };
+}
+
+module.exports = { create: create };

package/lib/queue.js

@@ -39,6 +39,7 @@ var observability = require("./observability");
 var protocolDispatcher = require("./protocol-dispatcher");
 var localProto = require("./queue-local");
 var redisProto = require("./queue-redis");
+var sqsProto   = require("./queue-sqs");
 var retryHelper = require("./retry");
 var safeAsync = require("./safe-async");
 var { QueueError } = require("./framework-error");
@@ -46,9 +47,8 @@ var { QueueError } = require("./framework-error");
 var dispatcher = protocolDispatcher.create({
   name:       "queue",
   errorClass: QueueError,
-  protocols:  { "local": localProto, "redis": redisProto },
+  protocols:  { "local": localProto, "redis": redisProto, "sqs": sqsProto },
   deferred:   {
-    "sqs":    { description: "AWS SQS (and S3-compatible queue endpoints) via SigV4" },
     "amqp":   { description: "AMQP 0-9-1 (RabbitMQ etc.)" },
     "nats":   { description: "NATS JetStream" },
   },

package/lib/safe-buffer.js

@@ -112,9 +112,22 @@ function toBuffer(data, opts) {
 
 function boundedChunkCollector(opts) {
   opts = opts || {};
-  var maxBytes = (typeof opts.maxBytes === "number" && opts.maxBytes > 0) ? opts.maxBytes : null;
+  // maxBytes must be a positive finite integer. Accepting `Infinity`
+  // would defeat the entire point of the bounded collector (a hostile
+  // 10-GB upstream would accumulate fully); accepting `3.5` would set
+  // a non-sensical fractional cap that confuses downstream `total +
+  // chunk.length > maxBytes` arithmetic. NaN, negative, zero, non-
+  // numbers all reject with the same `buffer/bad-arg` so operators
+  // see one consistent error at boot from a typo or misconfiguration.
+  var maxBytes = (typeof opts.maxBytes === "number" &&
+                  Number.isFinite(opts.maxBytes) &&
+                  Number.isInteger(opts.maxBytes) &&
+                  opts.maxBytes > 0) ? opts.maxBytes : null;
   if (maxBytes === null) {
-    throw new SafeBufferError("boundedChunkCollector requires maxBytes", "buffer/bad-arg");
+    throw new SafeBufferError(
+      "boundedChunkCollector requires maxBytes (positive finite integer); got " +
+      JSON.stringify(opts.maxBytes),
+      "buffer/bad-arg");
   }
   var errClass = opts.errorClass;
   var sizeCode = opts.sizeCode  || "buffer/too-large";

package/lib/totp.js

@@ -203,9 +203,17 @@ function verify(secret, code, opts) {
   var nowMs = (opts && opts.now) || Date.now();
   var currentStep = Math.floor(nowMs / 1000 / resolved.stepSeconds);
   var lastUsedStep = (opts && typeof opts.lastUsedStep === "number") ? opts.lastUsedStep : null;
-  // Pad incoming to the configured digit count so timingSafeEqual gets
-  // equal-length buffers regardless of how the caller stringified.
-  var userCode = String(code).padStart(resolved.digits, "0");
+  // Strip the whitespace + common separators that every authenticator UI
+  // and clipboard paste introduces ("123 456", "123-456", "123.456").
+  // RFC 6238 / NIST 800-63B don't mandate normalization, but Google
+  // Authenticator, Authy, Duo, and every other consumer-facing TOTP
+  // implementation strips these before comparison; not doing so is a
+  // silent operator footgun where users mash a code from their phone
+  // into a login form and the verifier rejects it because of one space.
+  // After stripping, padStart pads the configured digit count so
+  // timingSafeEqual gets equal-length buffers regardless of how the
+  // caller stringified.
+  var userCode = String(code).replace(/[\s.\-_]/g, "").padStart(resolved.digits, "0");
   var userBuf = Buffer.from(userCode);
 
   for (var d = -resolved.driftSteps; d <= resolved.driftSteps; d++) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.6.37",
+  "version": "0.6.58",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cyclonedx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:a13cf9c3-cc15-4fc1-bff7-03071923ae8d",
+  "serialNumber": "urn:uuid:246b27c1-6c5e-4ffc-9840-0275a3ed556a",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-02T21:50:09.461Z",
+    "timestamp": "2026-05-03T13:19:55.918Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.6.37",
+      "bom-ref": "@blamejs/core@0.6.58",
       "type": "library",
       "name": "blamejs",
-      "version": "0.6.37",
+      "version": "0.6.58",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.6.37",
+      "purl": "pkg:npm/%40blamejs/core@0.6.58",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.6.37",
+      "ref": "@blamejs/core@0.6.58",
       "dependsOn": []
     }
   ]