@blamejs/core 0.6.69 → 0.7.0

package/lib/middleware/body-parser.js

@@ -114,11 +114,14 @@ var path = require("path");
 var nodeCrypto = require("node:crypto");
 var atomicFile = require("../atomic-file");
 var crypto = require("../crypto");
+var requestHelpers = require("../request-helpers");
+var safeBuffer = require("../safe-buffer");
 var safeJson = require("../safe-json");
 var validateOpts = require("../validate-opts");
 var C = require("../constants");
 var { defineClass } = require("../framework-error");
 
+var HTTP_STATUS = requestHelpers.HTTP_STATUS;
 var BodyParserError = defineClass("BodyParserError", { withStatusCode: true });
 
 // Mirrors safe-json.js + safe-schema.js. Field names that match these
@@ -167,6 +170,11 @@ var DEFAULTS = Object.freeze({
 
 var BODY_BEARING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
 
+// Headroom on top of arrayLimit before declaring a key-bomb. Sized so a
+// reasonable form (a few hundred fields with repeated names) fits without
+// tripping the cap.
+var URLENCODED_KEY_HEADROOM = C.BYTES.bytes(1000);
+
 // ---- helpers ----
 
 function _contentType(req) {
@@ -255,7 +263,7 @@ function _bufferBody(req, limit) {
         reject(new BodyParserError(
           "body-parser/bad-content-length",
           "Content-Length is not a sequence of decimal digits: " + JSON.stringify(cl),
-          true, 400
+          true, HTTP_STATUS.BAD_REQUEST
         ));
         return;
       }
@@ -263,31 +271,30 @@ function _bufferBody(req, limit) {
         reject(new BodyParserError(
           "body-parser/too-large",
           "request body exceeds limit (" + clNum + " > " + limit + ")",
-          true, 413
+          true, HTTP_STATUS.PAYLOAD_TOO_LARGE
         ));
         return;
       }
     }
-    var chunks = [];
-    var total = 0;
+    var collector = safeBuffer.boundedChunkCollector({
+      maxBytes:    limit,
+      errorClass:  BodyParserError,
+      sizeCode:    "body-parser/too-large",
+      sizeMessage: "request body exceeds limit",
+    });
     var done = false;
     req.on("data", function (chunk) {
       if (done) return;
-      total += chunk.length;
-      if (total > limit) {
+      try { collector.push(chunk); }
+      catch (e) {
         done = true;
         try { req.destroy(); } catch (_e) { /* socket already closed */ }
-        var err = new BodyParserError(
-          "body-parser/too-large",
-          "request body exceeds limit (streamed " + total + " > " + limit + ")",
-          true, 413
-        );
-        reject(err);
+        if (e && e.isBodyParserError) e.statusCode = HTTP_STATUS.PAYLOAD_TOO_LARGE;
+        reject(e);
         return;
       }
-      chunks.push(chunk);
     });
-    req.on("end", function () { if (!done) { done = true; resolve(Buffer.concat(chunks)); } });
+    req.on("end", function () { if (!done) { done = true; resolve(collector.result()); } });
     req.on("error", function (e) { if (!done) { done = true; reject(e); } });
   });
 }
@@ -304,7 +311,7 @@ async function _parseJson(req, opts) {
       throw new BodyParserError(
         "body-parser/json-strict",
         "JSON body must start with '{' or '[' (strict mode)",
-        true, 400
+        true, HTTP_STATUS.BAD_REQUEST
       );
     }
   }
@@ -316,7 +323,7 @@ async function _parseJson(req, opts) {
     throw new BodyParserError(
       "body-parser/json-malformed",
       "JSON parse failed: " + ((e && e.message) || String(e)),
-      true, 400
+      true, HTTP_STATUS.BAD_REQUEST
     );
   }
   if (typeof opts.parseHook === "function") {
@@ -325,7 +332,7 @@ async function _parseJson(req, opts) {
       throw new BodyParserError(
         "body-parser/json-hook",
         "JSON parseHook failed: " + ((e && e.message) || String(e)),
-        true, 400
+        true, HTTP_STATUS.BAD_REQUEST
       );
     }
   }
@@ -344,7 +351,7 @@ async function _parseUrlencoded(req, opts) {
     throw new BodyParserError(
       "body-parser/urlencoded-malformed",
       "urlencoded parse failed: " + ((e && e.message) || String(e)),
-      true, 400
+      true, HTTP_STATUS.BAD_REQUEST
     );
   }
   var out = {};
@@ -360,11 +367,11 @@ async function _parseUrlencoded(req, opts) {
       throw new BodyParserError(
         "body-parser/urlencoded-poisoned-key",
         "urlencoded body contains forbidden key '" + k + "' (prototype-pollution defense)",
-        true, 400
+        true, HTTP_STATUS.BAD_REQUEST
       );
     }
     keyCount++;
-    if (keyCount > opts.arrayLimit + 1000) { // soft cap on total keys
+    if (keyCount > opts.arrayLimit + URLENCODED_KEY_HEADROOM) { // soft cap on total keys
       throw new BodyParserError(
         "body-parser/urlencoded-too-many-fields",
         "urlencoded body has too many fields",
@@ -486,7 +493,7 @@ async function _parseMultipart(req, opts, ctParams) {
     throw new BodyParserError(
       "body-parser/multipart-no-boundary",
       "multipart Content-Type missing boundary parameter",
-      true, 400
+      true, HTTP_STATUS.BAD_REQUEST
     );
   }
   // Resolve tmpDir per-request so directory-creation failure surfaces as a
@@ -542,7 +549,7 @@ async function _parseMultipart(req, opts, ctParams) {
     currentFilename = null;
     currentMime = null;
     currentTmpPath = null;
-    if (currentFd !== null) { try { fs.closeSync(currentFd); } catch (_e) {} currentFd = null; }
+    if (currentFd !== null) { try { fs.closeSync(currentFd); } catch (_e) { /* fd already closed */ } currentFd = null; }
     currentSize = 0;
     currentHash = null;
     currentBuf = null;
@@ -571,10 +578,10 @@ async function _parseMultipart(req, opts, ctParams) {
   }
 
   function _cleanup() {
-    if (currentFd !== null) { try { fs.closeSync(currentFd); } catch (_e) {} currentFd = null; }
-    if (currentTmpPath) { try { fs.unlinkSync(currentTmpPath); } catch (_e) {} }
+    if (currentFd !== null) { try { fs.closeSync(currentFd); } catch (_e) { /* fd already closed */ } currentFd = null; }
+    if (currentTmpPath) { try { fs.unlinkSync(currentTmpPath); } catch (_e) { /* tmp file already removed */ } }
     for (var i = 0; i < files.length; i++) {
-      try { fs.unlinkSync(files[i].path); } catch (_e) {}
+      try { fs.unlinkSync(files[i].path); } catch (_e) { /* tmp file already removed */ }
     }
   }
 
@@ -632,14 +639,14 @@ async function _parseMultipart(req, opts, ctParams) {
               continue;
             }
             done(new BodyParserError("body-parser/multipart-malformed",
-              "expected --, \\r\\n, or \\n after boundary", true, 400));
+              "expected --, \\r\\n, or \\n after boundary", true, HTTP_STATUS.BAD_REQUEST));
             return;
           }
           if (state === MP_HEADERS) {
             // Read until \r\n\r\n.
             var headEnd = pending.indexOf("\r\n\r\n");
             if (headEnd === -1) {
-              if (pending.length > 16384) {
+              if (pending.length > C.BYTES.kib(16)) {
                 done(new BodyParserError("body-parser/multipart-headers-too-large",
                   "multipart part headers exceed 16KB", true, 413));
                 return;
@@ -652,13 +659,13 @@ async function _parseMultipart(req, opts, ctParams) {
             var cd = _parseHeaderParams(currentHeaders["content-disposition"]);
             if (cd._value !== "form-data" || typeof cd.name !== "string" || cd.name.length === 0) {
               done(new BodyParserError("body-parser/multipart-bad-disposition",
-                "multipart part missing form-data Content-Disposition", true, 400));
+                "multipart part missing form-data Content-Disposition", true, HTTP_STATUS.BAD_REQUEST));
               return;
             }
             if (POISONED_KEYS.has(cd.name)) {
               done(new BodyParserError("body-parser/multipart-poisoned-field",
                 "multipart field '" + cd.name + "' is forbidden (prototype-pollution defense)",
-                true, 400));
+                true, HTTP_STATUS.BAD_REQUEST));
               return;
             }
             currentField = cd.name;
@@ -667,7 +674,7 @@ async function _parseMultipart(req, opts, ctParams) {
               if (!currentFilename) {
                 done(new BodyParserError("body-parser/multipart-bad-filename",
                   "multipart part filename did not survive sanitization (path traversal or empty)",
-                  true, 400));
+                  true, HTTP_STATUS.BAD_REQUEST));
                 return;
               }
               currentMime = currentHeaders["content-type"] || "application/octet-stream";
@@ -736,7 +743,7 @@ async function _parseMultipart(req, opts, ctParams) {
 
               // Generate the tmp path — never derived from the
               // operator-supplied filename.
-              var unique = crypto.generateToken(16);
+              var unique = crypto.generateToken(C.BYTES.bytes(16));
               currentTmpPath = path.join(tmpDir, "blamejs-up-" + unique);
               try {
                 currentFd = fs.openSync(currentTmpPath, "wx", 0o600);
@@ -859,7 +866,7 @@ async function _parseMultipart(req, opts, ctParams) {
               // fileFilter rejected — already recorded in filesRejected; no
               // tmp file was opened, nothing to clean up here.
             } else if (currentFd !== null) {
-              try { fs.closeSync(currentFd); } catch (_e) {}
+              try { fs.closeSync(currentFd); } catch (_e) { /* fd already closed */ }
               currentFd = null;
               files.push({
                 field:    currentField,
@@ -912,14 +919,14 @@ async function _parseMultipart(req, opts, ctParams) {
         if (resolved) return;
         if (state !== MP_DONE) {
           done(new BodyParserError("body-parser/multipart-truncated",
-            "multipart stream ended before final boundary", true, 400));
+            "multipart stream ended before final boundary", true, HTTP_STATUS.BAD_REQUEST));
           return;
         }
       });
       req.on("error", function (e) {
         if (resolved) return;
         done(new BodyParserError("body-parser/multipart-stream",
-          "multipart stream error: " + ((e && e.message) || String(e)), true, 400));
+          "multipart stream error: " + ((e && e.message) || String(e)), true, HTTP_STATUS.BAD_REQUEST));
       });
     });
   } catch (e) {
@@ -981,7 +988,7 @@ function create(opts) {
           if (cleanedUp) return;
           cleanedUp = true;
           for (var i = 0; i < mpResult.files.length; i++) {
-            try { fs.unlinkSync(mpResult.files[i].path); } catch (_e) {}
+            try { fs.unlinkSync(mpResult.files[i].path); } catch (_e) { /* tmp file already removed */ }
           }
         }
         res.on("finish", cleanup);
@@ -1006,7 +1013,7 @@ function create(opts) {
         "body-parser/unsupported-content-type"
       );
     } catch (e) {
-      var status = (e && typeof e.statusCode === "number") ? e.statusCode : 400;
+      var status = (e && typeof e.statusCode === "number") ? e.statusCode : HTTP_STATUS.BAD_REQUEST;
       var code   = (e && typeof e.code === "string") ? e.code : "body-parser/error";
       var message = (e && e.message) ? e.message : String(e);
       _writeError(res, status, message, code);
@@ -1022,20 +1029,20 @@ async function _parseJsonFromBuf(buf, opts) {
     var head = text.replace(/^[\s\u00A0\uFEFF]+/, "")[0];
     if (head !== "{" && head !== "[") {
       throw new BodyParserError("body-parser/json-strict",
-        "JSON body must start with '{' or '[' (strict mode)", true, 400);
+        "JSON body must start with '{' or '[' (strict mode)", true, HTTP_STATUS.BAD_REQUEST);
     }
   }
   var parsed;
   try { parsed = safeJson.parse(text, { maxBytes: opts.limit }); }
   catch (e) {
     throw new BodyParserError("body-parser/json-malformed",
-      "JSON parse failed: " + ((e && e.message) || String(e)), true, 400);
+      "JSON parse failed: " + ((e && e.message) || String(e)), true, HTTP_STATUS.BAD_REQUEST);
   }
   if (typeof opts.parseHook === "function") {
     try { parsed = opts.parseHook(parsed); }
     catch (e) {
       throw new BodyParserError("body-parser/json-hook",
-        "JSON parseHook failed: " + ((e && e.message) || String(e)), true, 400);
+        "JSON parseHook failed: " + ((e && e.message) || String(e)), true, HTTP_STATUS.BAD_REQUEST);
     }
   }
   return parsed;

package/lib/middleware/bot-guard.js

@@ -47,8 +47,25 @@ var DEFAULT_BLOCKED_AGENTS = [
 var lazyRequire = require("../lazy-require");
 var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
+var { defineClass } = require("../framework-error");
 var audit = lazyRequire(function () { return require("../audit"); });
 
+var BotGuardError = defineClass("BotGuardError", { alwaysPermanent: true });
+
+// allowedAgents / blockedAgents are operator-supplied at create() time
+// (NOT request bytes). The framework requires RegExp instances rather
+// than strings — string-to-regex compilation from an operator-supplied
+// value is an avoidable ReDoS vector at framework boot. Operators
+// constructing patterns dynamically compile at their own call site so
+// the pattern source is visible in their code.
+function _coerceAgentPattern(r, where) {
+  if (r instanceof RegExp) return r;
+  throw new BotGuardError("bot-guard/bad-pattern",
+    where + " must be a RegExp instance; got " + (typeof r) +
+    " (compile the pattern at the call site so the source is visible " +
+    "in operator code)");
+}
+
 // Bot-guard's "trust the proxy header" semantics for actor.ip — the
 // audit event records the apparent source even when behind a CDN, but
 // only when the operator opts in to trustProxy. Without the opt, we
@@ -71,8 +88,12 @@ function create(opts) {
   var _xffIp = _xffIpFor(trustProxy);
   var mode = opts.mode || "block";
   var onlyForHtml = opts.onlyForHtml !== false;
-  var allowedAgents = (opts.allowedAgents || []).map(function (r) { return r instanceof RegExp ? r : new RegExp(r); });
-  var blockedAgents = DEFAULT_BLOCKED_AGENTS.concat((opts.blockedAgents || []).map(function (r) { return r instanceof RegExp ? r : new RegExp(r); }));
+  var allowedAgents = (opts.allowedAgents || []).map(function (r, i) {
+    return _coerceAgentPattern(r, "middleware.botGuard: allowedAgents[" + i + "]");
+  });
+  var blockedAgents = DEFAULT_BLOCKED_AGENTS.concat((opts.blockedAgents || []).map(function (r, i) {
+    return _coerceAgentPattern(r, "middleware.botGuard: blockedAgents[" + i + "]");
+  }));
   var skipPaths = opts.skipPaths || [];
   var statusOnBlock = opts.statusOnBlock || 403;
   var bodyOnBlock = opts.bodyOnBlock !== undefined ? opts.bodyOnBlock : "Forbidden";
@@ -127,7 +148,7 @@ function create(opts) {
           metadata: { method: req.method, path: req.pathname || req.url, requestId: req.requestId },
           requestId: req.requestId,
         });
-      } catch (_e) {}
+      } catch (_e) { /* audit best-effort */ }
       return next();
     }
 
@@ -140,7 +161,7 @@ function create(opts) {
         metadata: { method: req.method, path: req.pathname || req.url, requestId: req.requestId },
         requestId: req.requestId,
       });
-    } catch (_e) {}
+    } catch (_e) { /* audit best-effort */ }
 
     if (res.writableEnded) return;
     if (typeof res.writeHead === "function") {

package/lib/middleware/compression.js

@@ -89,6 +89,8 @@
  */
 
 var zlib = require("node:zlib");
+var C = require("../constants");
+var nb = require("../numeric-bounds");
 var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
 var { defineClass } = require("../framework-error");
@@ -96,7 +98,7 @@ var { defineClass } = require("../framework-error");
 var CompressionError = defineClass("CompressionError", { alwaysPermanent: true });
 
 var DEFAULT_OPTS = Object.freeze({
-  threshold:    1024,
+  threshold:    C.BYTES.kib(1),
   encodings:    ["br", "gzip"],
   contentTypes: [
     "text/*",
@@ -116,8 +118,13 @@ var DEFAULT_OPTS = Object.freeze({
 // the encodings default.
 var SUPPORTED_ENCODINGS = new Set(["br", "gzip"]);
 
+var HTTP_STATUS = requestHelpers.HTTP_STATUS;
+// 205 Reset Content is rarely-used — local hex constant rather than
+// expanding the framework's HTTP_STATUS table for a single call site.
+var HTTP_RESET_CONTENT = 0xCD;
+
 // Status codes that NEVER carry a body — RFC 7230 §3.3.3.
-var NO_BODY_STATUS = new Set([204, 205, 304]);
+var NO_BODY_STATUS = new Set([HTTP_STATUS.NO_CONTENT, HTTP_RESET_CONTENT, HTTP_STATUS.NOT_MODIFIED]);
 
 // Parse Accept-Encoding into [{ encoding, q }] sorted by q descending.
 // Built on the shared `requestHelpers.parseQualityList` (RFC 9110
@@ -224,8 +231,16 @@ function create(opts) {
     "threshold", "encodings", "contentTypes",
     "gzipLevel", "brotliQuality", "filter",
   ], "middleware.compression");
-  var threshold     = typeof opts.threshold === "number" && opts.threshold >= 0
-                        ? opts.threshold : DEFAULT_OPTS.threshold;
+  var threshold;
+  if (opts.threshold === undefined) {
+    threshold = DEFAULT_OPTS.threshold;
+  } else if (nb.isNonNegativeFiniteInt(opts.threshold)) {
+    threshold = opts.threshold;
+  } else {
+    throw new CompressionError("compression/bad-opt",
+      "middleware.compression: threshold must be a non-negative finite integer; got " +
+        nb.shape(opts.threshold));
+  }
   var encodings     = Array.isArray(opts.encodings) && opts.encodings.length > 0
                         ? opts.encodings.slice() : DEFAULT_OPTS.encodings.slice();
   var contentTypes  = Array.isArray(opts.contentTypes) && opts.contentTypes.length > 0
@@ -245,7 +260,7 @@ function create(opts) {
   return function compression(req, res, next) {
     if (filter) {
       try { if (!filter(req, res)) return next(); }
-      catch (_e) { return next(); }
+      catch (_e) { /* operator filter threw — fall through and skip compression */ return next(); }
     }
 
     // Negotiate encoding up-front from Accept-Encoding. If the client
@@ -313,7 +328,7 @@ function create(opts) {
         // On compressor error the response is already half-written;
         // there's not much we can do beyond closing the underlying
         // socket. Best-effort end the response.
-        try { originalEnd.call(res); } catch (_e) {}
+        try { originalEnd.call(res); } catch (_e) { /* response already ended */ }
       });
       // Forward drain. Without this, source streams piped into our
       // wrapped res (e.g. fs.createReadStream from staticServe) stall:
@@ -353,12 +368,12 @@ function create(opts) {
         headersObj["Vary"] = _appendVary(existingVary, "Accept-Encoding");
       } else {
         if (originalRemoveHdr) {
-          try { originalRemoveHdr("Content-Length"); } catch (_e) {}
+          try { originalRemoveHdr("Content-Length"); } catch (_e) { /* header may not be set */ }
         }
         if (originalSetHeader) {
-          try { originalSetHeader("Content-Encoding", encoding); } catch (_e) {}
+          try { originalSetHeader("Content-Encoding", encoding); } catch (_e) { /* headers already sent */ }
           var existing = originalGetHeader && originalGetHeader("Vary");
-          try { originalSetHeader("Vary", _appendVary(existing, "Accept-Encoding")); } catch (_e) {}
+          try { originalSetHeader("Vary", _appendVary(existing, "Accept-Encoding")); } catch (_e) { /* headers already sent */ }
         }
       }
     }
@@ -383,7 +398,7 @@ function create(opts) {
         // res.writeHead(). Use the implicit Content-Type from setHeader
         // (or absence) to decide. Default Node behavior triggers
         // writeHead with statusCode=200 here; we mirror that.
-        _decide(200, null);
+        _decide(HTTP_STATUS.OK, null);
         if (compress) _applyCompressedHeaders(null);
       }
       if (!compress) return originalWrite.call(res, chunk, encArg, cbArg);
@@ -403,7 +418,7 @@ function create(opts) {
 
     res.end = function (chunk, encArg, cbArg) {
       if (!decided) {
-        _decide(200, null);
+        _decide(HTTP_STATUS.OK, null);
         if (compress) _applyCompressedHeaders(null);
       }
       if (!compress) return originalEnd.call(res, chunk, encArg, cbArg);

package/lib/middleware/cors.js

@@ -49,6 +49,7 @@
  * opts.origins entries must be strings or RegExp. Bad config surfaces at
  * create() not at first cross-origin request.
  */
+var C = require("../constants");
 var lazyRequire = require("../lazy-require");
 var audit = lazyRequire(function () { return require("../audit"); });
 var requestHelpers = require("../request-helpers");
@@ -221,7 +222,7 @@ function create(opts) {
   var allowedHeadersSet = headersList.map(function (h) { return String(h).trim().toLowerCase(); });
   var exposeHeaders = (opts.exposeHeaders || ["X-Request-Id"]).join(", ");
   var credentials = !!opts.credentials;
-  var maxAge = String(opts.maxAgeSeconds || 600);
+  var maxAge = String(opts.maxAgeSeconds || (C.TIME.minutes(10) / C.TIME.seconds(1)));
   var refuseUnknown = opts.refuseUnknown !== false;
   // strictNullOrigin defaults true: refuse Origin: null even with
   // Sec-Fetch-Site: same-origin (non-browser callers can forge that
@@ -250,9 +251,9 @@ function create(opts) {
             metadata: { origin: origin, method: req.method, path: req.pathname || req.url, requestId: req.requestId },
             requestId: req.requestId,
           });
-        } catch (_e) {}
+        } catch (_e) { /* audit best-effort */ }
         if (typeof res.writeHead === "function") {
-          res.writeHead(403, { "Content-Type": "text/plain" });
+          res.writeHead(requestHelpers.HTTP_STATUS.FORBIDDEN, { "Content-Type": "text/plain" });
           res.end("CORS: origin not allowed");
           return;
         }
@@ -283,7 +284,7 @@ function create(opts) {
           for (var ah = 0; ah < asked.length; ah++) {
             if (allowedHeadersSet.indexOf(asked[ah]) === -1) {
               if (typeof res.writeHead === "function") {
-                res.writeHead(403, { "Content-Type": "text/plain" });
+                res.writeHead(requestHelpers.HTTP_STATUS.FORBIDDEN, { "Content-Type": "text/plain" });
                 res.end("CORS: requested header '" + asked[ah] + "' not in allow-list");
               }
               return;
@@ -297,7 +298,7 @@ function create(opts) {
         res.setHeader("Access-Control-Max-Age", maxAge);
       }
       if (typeof res.writeHead === "function") {
-        res.writeHead(204);
+        res.writeHead(requestHelpers.HTTP_STATUS.NO_CONTENT);
         res.end();
       }
       return;

package/lib/middleware/csp-nonce.js

@@ -112,20 +112,22 @@
  *     pass `always: true`.
  */
 
+var C = require("../constants");
 var crypto = require("../crypto");
+var numericBounds = require("../numeric-bounds");
 var validateOpts = require("../validate-opts");
 var { defineClass } = require("../framework-error");
 
 var CspNonceError = defineClass("CspNonceError", { alwaysPermanent: true });
 
 var DEFAULT_DIRECTIVES = Object.freeze(["script-src", "style-src"]);
-var DEFAULT_NONCE_BYTES = 16;
-var MIN_NONCE_BYTES = 16;
+var DEFAULT_NONCE_BYTES = C.BYTES.bytes(16);
+var MIN_NONCE_BYTES = C.BYTES.bytes(16);
 var PLACEHOLDER_PREFIX = "__BLAMEJS_CSP_NONCE_";
 var PLACEHOLDER_SUFFIX = "__";
 // 16 bytes / 128 bits — matches the default nonce strength so the
 // placeholder is no weaker than the value it stands in for.
-var PLACEHOLDER_RAND_BYTES = 16;
+var PLACEHOLDER_RAND_BYTES = C.BYTES.bytes(16);
 
 // Build the substitute helper for a specific placeholder + property.
 // Each cspNonce instance has its own placeholder (random by default,
@@ -237,7 +239,18 @@ function create(opts) {
     }
     directives[i] = directives[i].toLowerCase();
   }
-  var nonceBytes = typeof opts.nonceBytes === "number" ? opts.nonceBytes : DEFAULT_NONCE_BYTES;
+  var nonceBytes = opts.nonceBytes !== undefined ? opts.nonceBytes : DEFAULT_NONCE_BYTES;
+  // Pre-fix the typeof-only check accepted Infinity / NaN — both
+  // bypassed the `< MIN_NONCE_BYTES` guard (NaN < N is always false,
+  // Infinity < N is always false), then crashed per-request when
+  // `crypto.generateBytes(Infinity)` hit ERR_OUT_OF_RANGE. Route through
+  // shared numeric-bounds (positive finite int) before the lower-bound
+  // check so the typo / coercion is caught at create() time.
+  if (!numericBounds.isPositiveFiniteInt(nonceBytes)) {
+    throw new CspNonceError("csp-nonce/bad-nonce-bytes",
+      "nonceBytes must be a positive finite integer; got " +
+        numericBounds.shape(nonceBytes));
+  }
   if (nonceBytes < MIN_NONCE_BYTES) {
     throw new CspNonceError("csp-nonce/bad-nonce-bytes",
       "nonceBytes must be >= " + MIN_NONCE_BYTES + " (got " + nonceBytes + "). " +

package/lib/middleware/csrf-protect.js

@@ -158,7 +158,7 @@ function _appendSetCookie(res, value) {
 function _writeReject(res, message) {
   if (typeof res.writeHead === "function") {
     var body = JSON.stringify({ error: message });
-    res.writeHead(403, {
+    res.writeHead(requestHelpers.HTTP_STATUS.FORBIDDEN, {
       "Content-Type":   "application/json; charset=utf-8",
       "Content-Length": Buffer.byteLength(body),
     });

package/lib/middleware/db-role-for.js

@@ -90,10 +90,7 @@ var ALLOWED_OPTS = [
   "audit", "auditFailures", "auditSuccess",
 ];
 
-function _emitEvent(name, value, labels) {
-  try { observability().event(name, value, labels || {}); }
-  catch (_e) { /* hot-path observability sink — drop silent by design */ }
-}
+function _emitEvent(n, v, l) { observability().safeEvent(n, v, l || {}); }
 
 function _validateRoleIdentifier(role, where) {
   try {
@@ -114,14 +111,8 @@ function create(opts) {
   opts = opts || {};
   validateOpts(opts, ALLOWED_OPTS, "middleware.dbRoleFor");
 
-  if (opts.resolve !== undefined && typeof opts.resolve !== "function") {
-    throw _err("db-role-for/bad-opt",
-      "middleware.dbRoleFor: resolve must be a function");
-  }
-  if (opts.responder !== undefined && typeof opts.responder !== "function") {
-    throw _err("db-role-for/bad-opt",
-      "middleware.dbRoleFor: responder must be a function");
-  }
+  validateOpts.optionalFunction(opts.resolve, "middleware.dbRoleFor: resolve", DbRoleForError, "db-role-for/bad-opt");
+  validateOpts.optionalFunction(opts.responder, "middleware.dbRoleFor: responder", DbRoleForError, "db-role-for/bad-opt");
   if (opts.permissions !== undefined && opts.permissions !== null) {
     if (typeof opts.permissions !== "object" ||
         typeof opts.permissions.dbRoleFor !== "function") {
@@ -137,10 +128,7 @@ function create(opts) {
     }
     _validateRoleIdentifier(opts.defaultRole, "middleware.dbRoleFor: defaultRole");
   }
-  if (opts.requireRole !== undefined && typeof opts.requireRole !== "boolean") {
-    throw _err("db-role-for/bad-opt",
-      "middleware.dbRoleFor: requireRole must be a boolean");
-  }
+  validateOpts.optionalBoolean(opts.requireRole, "middleware.dbRoleFor: requireRole", DbRoleForError, "db-role-for/bad-opt");
   if (opts.missingRoleStatus !== undefined) {
     if (typeof opts.missingRoleStatus !== "number" ||
         !isFinite(opts.missingRoleStatus) ||
@@ -149,20 +137,9 @@ function create(opts) {
         "middleware.dbRoleFor: missingRoleStatus must be an HTTP status code (100-599)");
     }
   }
-  if (opts.audit !== undefined && opts.audit !== null) {
-    if (typeof opts.audit !== "object" || typeof opts.audit.safeEmit !== "function") {
-      throw _err("db-role-for/bad-opt",
-        "middleware.dbRoleFor: audit must be a b.audit-shaped object (safeEmit fn)");
-    }
-  }
-  if (opts.auditFailures !== undefined && typeof opts.auditFailures !== "boolean") {
-    throw _err("db-role-for/bad-opt",
-      "middleware.dbRoleFor: auditFailures must be a boolean");
-  }
-  if (opts.auditSuccess !== undefined && typeof opts.auditSuccess !== "boolean") {
-    throw _err("db-role-for/bad-opt",
-      "middleware.dbRoleFor: auditSuccess must be a boolean");
-  }
+  validateOpts.auditShape(opts.audit, "middleware.dbRoleFor", DbRoleForError, "db-role-for/bad-opt");
+  validateOpts.optionalBoolean(opts.auditFailures, "middleware.dbRoleFor: auditFailures", DbRoleForError, "db-role-for/bad-opt");
+  validateOpts.optionalBoolean(opts.auditSuccess, "middleware.dbRoleFor: auditSuccess", DbRoleForError, "db-role-for/bad-opt");
 
   var resolveFn         = opts.resolve || null;
   var perms             = opts.permissions || null;