@blamejs/core 0.6.69 → 0.7.0

package/lib/network-nts.js

@@ -5,6 +5,7 @@ var dgram = require("node:dgram");
 var nodeCrypto = require("node:crypto");
 
 var C = require("./constants");
+var { timingSafeEqual } = require("./crypto");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -12,8 +13,28 @@ var NtsError = defineClass("NtsError", { alwaysPermanent: false });
 
 var NTS_KE_DEFAULT_PORT = 4460;
 var NTPV4_DEFAULT_PORT  = 123;
+// RFC 5905 §6 — seconds between 1900-01-01T00:00Z (NTP epoch) and
+// 1970-01-01T00:00Z (Unix epoch). Protocol-fixed (not a tunable).
 var NTP_TO_UNIX_OFFSET_SECONDS = 2208988800;
 
+// Protocol-fixed byte counts and offsets — every numeric literal that
+// represents a wire-format size or position routes through C.BYTES.bytes
+// (a value-passthrough) so the codebase has a single source of truth
+// for "what shape is this number".
+var AES_BLOCK_BYTES   = C.BYTES.bytes(16);   // AES-128/192/256 block size (RFC 3962)
+var NTP_PACKET_BYTES  = C.BYTES.bytes(48);   // RFC 5905 §7.3 packet header length
+var NTP_TX_TIMESTAMP_OFFSET = C.BYTES.bytes(40);  // RFC 5905 §7.3 — Transmit Timestamp
+var POLY1305_TAG_BYTES = C.BYTES.bytes(16);  // RFC 8439 §2.5 tag length
+var SIV_KEY_32_BYTES  = C.BYTES.bytes(32);
+var SIV_KEY_48_BYTES  = C.BYTES.bytes(48);
+var SIV_KEY_64_BYTES  = C.BYTES.bytes(64);
+var UNIQUE_ID_BYTES   = C.BYTES.bytes(32);   // RFC 8915 §5.3 unique-identifier extension
+var CHACHA20_NONCE_BYTES = C.BYTES.bytes(12);
+
+// Bits per byte — used to derive the AES key bit-width from the byte
+// length (16-byte key → 128-bit cipher → "aes-128-..." suffix).
+var BITS_PER_BYTE = 8;
+
 var REC_END                  = 0;
 var REC_NEXT_PROTOCOL        = 1;
 var REC_ERROR                = 2;
@@ -64,7 +85,9 @@ function _decodeRecords(buf) {
 }
 
 function _aesEncryptBlock(key, block) {
-  var c = nodeCrypto.createCipheriv("aes-" + (key.length * 8) + "-ecb", key, Buffer.alloc(0));
+  // key.length is in bytes (16/24/32); multiply by BITS_PER_BYTE to get
+  // the OpenSSL cipher-name suffix (128/192/256).
+  var c = nodeCrypto.createCipheriv("aes-" + (key.length * BITS_PER_BYTE) + "-ecb", key, Buffer.alloc(0));
   c.setAutoPadding(false);
   return Buffer.concat([c.update(block), c.final()]);
 }
@@ -87,7 +110,7 @@ function _xorBuf(a, b) {
 }
 
 function _cmacSubkeys(key) {
-  var L = _aesEncryptBlock(key, Buffer.alloc(16, 0));
+  var L = _aesEncryptBlock(key, Buffer.alloc(AES_BLOCK_BYTES, 0));
   var Rb = Buffer.from([0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0x87]);
   var K1 = _shl1(L);
   if (L[0] & 0x80) K1 = _xorBuf(K1, Rb);
@@ -98,25 +121,25 @@ function _cmacSubkeys(key) {
 
 function _cmac(key, message) {
   var subkeys = _cmacSubkeys(key);
-  var n = Math.ceil(message.length / 16);
+  var n = Math.ceil(message.length / AES_BLOCK_BYTES);
   if (n === 0) n = 1;
-  var lastIsComplete = (message.length > 0) && (message.length % 16 === 0);
+  var lastIsComplete = (message.length > 0) && (message.length % AES_BLOCK_BYTES === 0);
   var blocks = [];
   for (var i = 0; i < n - 1; i++) {
-    blocks.push(message.slice(i * 16, i * 16 + 16));
+    blocks.push(message.slice(i * AES_BLOCK_BYTES, i * AES_BLOCK_BYTES + AES_BLOCK_BYTES));
   }
   var lastBlock;
   if (lastIsComplete) {
-    lastBlock = _xorBuf(message.slice((n - 1) * 16, n * 16), subkeys.K1);
+    lastBlock = _xorBuf(message.slice((n - 1) * AES_BLOCK_BYTES, n * AES_BLOCK_BYTES), subkeys.K1);
   } else {
-    var rem = message.slice((n - 1) * 16);
-    var padded = Buffer.alloc(16);
+    var rem = message.slice((n - 1) * AES_BLOCK_BYTES);
+    var padded = Buffer.alloc(AES_BLOCK_BYTES);
     rem.copy(padded);
     padded[rem.length] = 0x80;
     lastBlock = _xorBuf(padded, subkeys.K2);
   }
   blocks.push(lastBlock);
-  var X = Buffer.alloc(16, 0);
+  var X = Buffer.alloc(AES_BLOCK_BYTES, 0);
   for (var b = 0; b < blocks.length; b++) {
     X = _aesEncryptBlock(key, _xorBuf(X, blocks[b]));
   }
@@ -131,18 +154,18 @@ function _dbl(buf) {
 }
 
 function _s2v(K, strings, plaintext) {
-  var D = _cmac(K, Buffer.alloc(16, 0));
+  var D = _cmac(K, Buffer.alloc(AES_BLOCK_BYTES, 0));
   for (var i = 0; i < strings.length; i++) {
     D = _xorBuf(_dbl(D), _cmac(K, strings[i]));
   }
   var T;
-  if (plaintext.length >= 16) {
-    var head = plaintext.slice(0, plaintext.length - 16);
-    var tail = plaintext.slice(plaintext.length - 16);
+  if (plaintext.length >= AES_BLOCK_BYTES) {
+    var head = plaintext.slice(0, plaintext.length - AES_BLOCK_BYTES);
+    var tail = plaintext.slice(plaintext.length - AES_BLOCK_BYTES);
     var xored = _xorBuf(tail, D);
     T = Buffer.concat([head, xored]);
   } else {
-    var padded = Buffer.alloc(16);
+    var padded = Buffer.alloc(AES_BLOCK_BYTES);
     plaintext.copy(padded);
     padded[plaintext.length] = 0x80;
     T = _xorBuf(_dbl(D), padded);
@@ -152,14 +175,15 @@ function _s2v(K, strings, plaintext) {
 
 function _aesCtr(key, iv, data) {
   var ivCopy = Buffer.from(iv);
+  // Clear the high bit of the 8th and 12th counter octets per RFC 5297 §2.6.
   ivCopy[8]  &= 0x7f;
   ivCopy[12] &= 0x7f;
-  var c = nodeCrypto.createCipheriv("aes-" + (key.length * 8) + "-ctr", key, ivCopy);
+  var c = nodeCrypto.createCipheriv("aes-" + (key.length * BITS_PER_BYTE) + "-ctr", key, ivCopy);
   return Buffer.concat([c.update(data), c.final()]);
 }
 
 function aesSivEncrypt(K, plaintext, associatedData) {
-  if (K.length !== 32 && K.length !== 48 && K.length !== 64) {
+  if (K.length !== SIV_KEY_32_BYTES && K.length !== SIV_KEY_48_BYTES && K.length !== SIV_KEY_64_BYTES) {
     throw new NtsError("nts/bad-key", "AES-SIV key must be 32/48/64 bytes, got " + K.length);
   }
   var half = K.length / 2;
@@ -174,11 +198,11 @@ function aesSivDecrypt(K, ciphertextWithIv, associatedData) {
   var half = K.length / 2;
   var K1 = K.slice(0, half);
   var K2 = K.slice(half);
-  var V = ciphertextWithIv.slice(0, 16);
-  var ct = ciphertextWithIv.slice(16);
+  var V = ciphertextWithIv.slice(0, AES_BLOCK_BYTES);
+  var ct = ciphertextWithIv.slice(AES_BLOCK_BYTES);
   var pt = _aesCtr(K2, V, ct);
   var Vcheck = _s2v(K1, associatedData || [], pt);
-  if (!nodeCrypto.timingSafeEqual(V, Vcheck)) {
+  if (!timingSafeEqual(V, Vcheck)) {
     throw new NtsError("nts/auth-failed", "AES-SIV authentication failed");
   }
   return pt;
@@ -207,7 +231,7 @@ function _exportKeys(socket, aeadId) {
   var label = "EXPORTER-network-time-security";
   var contextC2S = Buffer.from([0x00, 0x00, (aeadId >> 8) & 0xff, aeadId & 0xff, 0x00]);
   var contextS2C = Buffer.from([0x00, 0x00, (aeadId >> 8) & 0xff, aeadId & 0xff, 0x01]);
-  var keyLen = aeadId === AEAD_AES_SIV_CMAC_256 ? 32 : 32;
+  var keyLen = aeadId === AEAD_AES_SIV_CMAC_256 ? SIV_KEY_32_BYTES : SIV_KEY_32_BYTES;
   var c2s = socket.exportKeyingMaterial(keyLen, label, contextC2S);
   var s2c = socket.exportKeyingMaterial(keyLen, label, contextS2C);
   return { c2s: c2s, s2c: s2c };
@@ -216,9 +240,7 @@ function _exportKeys(socket, aeadId) {
 function performKeHandshake(opts) {
   opts = opts || {};
   validateOpts(opts, ["host", "port", "servername", "aead", "ca", "timeoutMs"], "nts.performKeHandshake");
-  if (typeof opts.host !== "string" || opts.host.length === 0) {
-    throw new NtsError("nts/bad-host", "nts.performKeHandshake: host required");
-  }
+  validateOpts.requireNonEmptyString(opts.host, "nts.performKeHandshake: host", NtsError, "nts/bad-host");
   var timeoutMs = opts.timeoutMs || C.TIME.seconds(10);
   return new Promise(function (resolve, reject) {
     var settled = false;
@@ -238,7 +260,7 @@ function performKeHandshake(opts) {
     if (opts.ca) connectOpts.ca = opts.ca;
     var sock = tls.connect(connectOpts);
     var timer = setTimeout(function () {
-      try { sock.destroy(); } catch (_e) {}
+      try { sock.destroy(); } catch (_e) { /* best-effort socket teardown */ }
       done(new NtsError("nts/ke-timeout", "NTS-KE handshake timed out after " + timeoutMs + "ms"));
     }, timeoutMs);
     timer.unref && timer.unref();
@@ -249,7 +271,7 @@ function performKeHandshake(opts) {
     sock.on("secureConnect", function () {
       if (sock.alpnProtocol !== "ntske/1") {
         clearTimeout(timer);
-        try { sock.destroy(); } catch (_e) {}
+        try { sock.destroy(); } catch (_e) { /* best-effort socket teardown */ }
         done(new NtsError("nts/bad-alpn",
           "NTS-KE server did not negotiate ALPN 'ntske/1', got " + JSON.stringify(sock.alpnProtocol)));
         return;
@@ -268,7 +290,7 @@ function performKeHandshake(opts) {
         clearTimeout(timer);
         var errRec  = records.find(function (r) { return r.type === REC_ERROR; });
         if (errRec) {
-          try { sock.destroy(); } catch (_e) {}
+          try { sock.destroy(); } catch (_e) { /* best-effort socket teardown */ }
           done(new NtsError("nts/ke-error", "NTS-KE server returned error code " + errRec.body.readUInt16BE(0)));
           return;
         }
@@ -280,20 +302,20 @@ function performKeHandshake(opts) {
         }
         var aeadRec = records.find(function (r) { return r.type === REC_AEAD_ALGORITHM; });
         if (!aeadRec || aeadRec.body.length < 2) {
-          try { sock.destroy(); } catch (_e) {}
+          try { sock.destroy(); } catch (_e) { /* best-effort socket teardown */ }
           done(new NtsError("nts/no-aead", "NTS-KE response missing AEAD algorithm"));
           return;
         }
         var aeadId = aeadRec.body.readUInt16BE(0);
         if (aeadId !== AEAD_AES_SIV_CMAC_256 && aeadId !== AEAD_CHACHA20_POLY1305) {
-          try { sock.destroy(); } catch (_e) {}
+          try { sock.destroy(); } catch (_e) { /* best-effort socket teardown */ }
           done(new NtsError("nts/unsupported-aead", "NTS-KE server selected unsupported AEAD " + aeadId));
           return;
         }
         var cookies = records.filter(function (r) { return r.type === REC_NEW_COOKIE; })
                               .map(function (r) { return r.body; });
         if (cookies.length === 0) {
-          try { sock.destroy(); } catch (_e) {}
+          try { sock.destroy(); } catch (_e) { /* best-effort socket teardown */ }
           done(new NtsError("nts/no-cookies", "NTS-KE response contained no cookies"));
           return;
         }
@@ -304,7 +326,7 @@ function performKeHandshake(opts) {
         var portRec = records.find(function (r) { return r.type === REC_NTPV4_PORT; });
         if (portRec && portRec.body.length >= 2) ntpPort = portRec.body.readUInt16BE(0);
         var keys = _exportKeys(sock, aeadId);
-        try { sock.end(); } catch (_e) {}
+        try { sock.end(); } catch (_e) { /* best-effort socket close */ }
         done(null, {
           aeadId:    aeadId,
           c2sKey:    keys.c2s,
@@ -316,7 +338,7 @@ function performKeHandshake(opts) {
         });
       } catch (e) {
         clearTimeout(timer);
-        try { sock.destroy(); } catch (_e) {}
+        try { sock.destroy(); } catch (_e) { /* best-effort socket teardown */ }
         done(e);
       }
     });
@@ -338,7 +360,7 @@ function _aeadEncrypt(aeadId, key, nonce, plaintext, aad) {
     return aesSivEncrypt(key, plaintext, ad);
   }
   if (aeadId === AEAD_CHACHA20_POLY1305) {
-    var c = nodeCrypto.createCipheriv("chacha20-poly1305", key, nonce, { authTagLength: 16 });
+    var c = nodeCrypto.createCipheriv("chacha20-poly1305", key, nonce, { authTagLength: POLY1305_TAG_BYTES });
     if (aad) c.setAAD(aad, { plaintextLength: plaintext.length });
     var ct = Buffer.concat([c.update(plaintext), c.final()]);
     var tag = c.getAuthTag();
@@ -353,9 +375,9 @@ function _aeadDecrypt(aeadId, key, nonce, ciphertext, aad) {
     return aesSivDecrypt(key, ciphertext, ad);
   }
   if (aeadId === AEAD_CHACHA20_POLY1305) {
-    var ct = ciphertext.slice(0, ciphertext.length - 16);
-    var tag = ciphertext.slice(ciphertext.length - 16);
-    var d = nodeCrypto.createDecipheriv("chacha20-poly1305", key, nonce, { authTagLength: 16 });
+    var ct = ciphertext.slice(0, ciphertext.length - POLY1305_TAG_BYTES);
+    var tag = ciphertext.slice(ciphertext.length - POLY1305_TAG_BYTES);
+    var d = nodeCrypto.createDecipheriv("chacha20-poly1305", key, nonce, { authTagLength: POLY1305_TAG_BYTES });
     if (aad) d.setAAD(aad, { plaintextLength: ct.length });
     d.setAuthTag(tag);
     return Buffer.concat([d.update(ct), d.final()]);
@@ -364,8 +386,8 @@ function _aeadDecrypt(aeadId, key, nonce, ciphertext, aad) {
 }
 
 function _nonceForAead(aeadId) {
-  if (aeadId === AEAD_AES_SIV_CMAC_256) return nodeCrypto.randomBytes(16);
-  return nodeCrypto.randomBytes(12);
+  if (aeadId === AEAD_AES_SIV_CMAC_256) return nodeCrypto.randomBytes(AES_BLOCK_BYTES);
+  return nodeCrypto.randomBytes(CHACHA20_NONCE_BYTES);
 }
 
 function _walkExtensions(msg, startOff) {
@@ -402,12 +424,12 @@ function querySingle(opts) {
     function done(err, result) {
       if (settled) return;
       settled = true;
-      try { sock.close(); } catch (_e) {}
+      try { sock.close(); } catch (_e) { /* best-effort socket close */ }
       if (err) reject(err); else resolve(result);
     }
-    var unique = nodeCrypto.randomBytes(32);
+    var unique = nodeCrypto.randomBytes(UNIQUE_ID_BYTES);
     var cookie = opts.cookies[0];
-    var packet = Buffer.alloc(48);
+    var packet = Buffer.alloc(NTP_PACKET_BYTES);
     packet[0] = 0x23;
     var ext1 = _encodeExtensionField(EXTENSION_UNIQUE_IDENTIFIER, unique);
     var ext2 = _encodeExtensionField(EXTENSION_NTS_COOKIE, cookie);
@@ -436,16 +458,16 @@ function querySingle(opts) {
       clearTimeout(timer);
       var receiveTimeMs = Date.now();
       try {
-        if (msg.length < 48) {
+        if (msg.length < NTP_PACKET_BYTES) {
           done(new NtsError("nts/bad-reply", "NTS reply too short"));
           return;
         }
         var exts;
-        try { exts = _walkExtensions(msg, 48); }
+        try { exts = _walkExtensions(msg, NTP_PACKET_BYTES); }
         catch (e) { done(e); return; }
         var uniqueExt = exts.find(function (e) { return e.type === EXTENSION_UNIQUE_IDENTIFIER; });
-        if (!uniqueExt || uniqueExt.body.length < 32 ||
-            !nodeCrypto.timingSafeEqual(uniqueExt.body.slice(0, 32), unique)) {
+        if (!uniqueExt || uniqueExt.body.length < UNIQUE_ID_BYTES ||
+            !timingSafeEqual(uniqueExt.body.slice(0, UNIQUE_ID_BYTES), unique)) {
           done(new NtsError("nts/unique-mismatch", "NTS reply unique-identifier mismatch (replay or spoof)"));
           return;
         }
@@ -489,11 +511,11 @@ function querySingle(opts) {
           opts.cookies.shift();
           for (var ci = 0; ci < newCookies.length; ci++) opts.cookies.push(newCookies[ci]);
         }
-        var ntpSeconds  = msg.readUInt32BE(40);
-        var ntpFraction = msg.readUInt32BE(44);
+        var ntpSeconds  = msg.readUInt32BE(NTP_TX_TIMESTAMP_OFFSET);
+        var ntpFraction = msg.readUInt32BE(NTP_TX_TIMESTAMP_OFFSET + 4);
         var serverUnixSeconds = ntpSeconds - NTP_TO_UNIX_OFFSET_SECONDS;
-        var fracMs = Math.round(ntpFraction / 0x100000000 * 1000);
-        var serverTimeMs = serverUnixSeconds * 1000 + fracMs;
+        var fracMs = Math.round(C.TIME.seconds(ntpFraction / 0x100000000));
+        var serverTimeMs = C.TIME.seconds(serverUnixSeconds) + fracMs;
         var midpointMs = sendTimeMs + (receiveTimeMs - sendTimeMs) / 2;
         var driftMs = serverTimeMs - midpointMs;
         done(null, {

package/lib/network-proxy.js

@@ -6,12 +6,19 @@ var net = require("node:net");
 var tls = require("node:tls");
 
 var C = require("./constants");
-var validateOpts = require("./validate-opts");
 var lazyRequire = require("./lazy-require");
+var safeUrl = require("./safe-url");
+var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
 var ProxyError = defineClass("ProxyError", { alwaysPermanent: false });
 
+// Protocol-fixed byte counts — passthrough through C.BYTES so the codebase
+// has a single source of truth for "what shape is this number".
+var IPV4_PREFIX_MAX_BITS = C.BYTES.bytes(32);   // RFC 791 §3.1 IPv4 address bit-width
+var DEFAULT_HTTPS_PORT   = 443;                 // RFC 9110 §4.2.2
+var DEFAULT_HTTP_PORT    = C.BYTES.bytes(80);   // RFC 9110 §4.2.1
+
 var observability = lazyRequire(function () { return require("./observability"); });
 
 var STATE = {
@@ -31,14 +38,18 @@ function _parseAuth(spec) {
 
 function _parseProxyUrl(value) {
   if (!value) return null;
-  var u;
-  try { u = new URL(value); } catch (_e) {
+  try {
+    return safeUrl.parse(value, {
+      allowedProtocols: safeUrl.ALLOW_HTTP_ALL,
+      allowUserinfo:    true,   // proxy auth is conventionally placed in the URL
+      errorClass:       ProxyError,
+    });
+  } catch (e) {
+    if (e && e.isSafeUrlError && e.code === "safe-url/protocol-disallowed") {
+      throw new ProxyError("proxy/bad-protocol", "proxy URL must be http:// or https://, got " + value);
+    }
     throw new ProxyError("proxy/bad-url", "invalid proxy URL: " + value);
   }
-  if (u.protocol !== "http:" && u.protocol !== "https:") {
-    throw new ProxyError("proxy/bad-protocol", "proxy URL must be http:// or https://, got " + u.protocol);
-  }
-  return u;
 }
 
 function _parseNoProxy(spec) {
@@ -97,14 +108,22 @@ function _matchCidr(cidr, host) {
   var network = cidr.slice(0, slash);
   var prefix = parseInt(cidr.slice(slash + 1), 10);
   if (net.isIP(host) !== 4 || net.isIP(network) !== 4) return false;
-  if (!isFinite(prefix) || prefix < 0 || prefix > 32) return false;
+  if (!isFinite(prefix) || prefix < 0 || prefix > IPV4_PREFIX_MAX_BITS) return false;
   if (prefix === 0) return true;
-  var mask = (0xffffffff << (32 - prefix)) >>> 0;
+  var mask = (0xffffffff << (IPV4_PREFIX_MAX_BITS - prefix)) >>> 0;
   return (_ipv4ToInt(host) & mask) === (_ipv4ToInt(network) & mask);
 }
 
+function _parseTarget(targetUrl) {
+  if (targetUrl instanceof URL) return targetUrl;
+  return safeUrl.parse(String(targetUrl), {
+    allowedProtocols: safeUrl.ALLOW_HTTP_ALL,
+    errorClass:       ProxyError,
+  });
+}
+
 function shouldProxy(targetUrl) {
-  var u = targetUrl instanceof URL ? targetUrl : new URL(String(targetUrl));
+  var u = _parseTarget(targetUrl);
   var host = u.hostname;
   var rules = STATE.noProxy;
   for (var i = 0; i < rules.length; i++) {
@@ -121,7 +140,7 @@ function shouldProxy(targetUrl) {
 }
 
 function _proxyForUrl(targetUrl) {
-  var u = targetUrl instanceof URL ? targetUrl : new URL(String(targetUrl));
+  var u = _parseTarget(targetUrl);
   if (!shouldProxy(u)) return null;
   return u.protocol === "https:" ? STATE.https : STATE.http;
 }
@@ -134,7 +153,7 @@ function _proxyAuthHeader(proxyUrl) {
 }
 
 function _connectThroughTunnel(proxyUrl, targetHost, targetPort, callback) {
-  var proxyPort = proxyUrl.port || (proxyUrl.protocol === "https:" ? 443 : 80);
+  var proxyPort = proxyUrl.port || (proxyUrl.protocol === "https:" ? DEFAULT_HTTPS_PORT : DEFAULT_HTTP_PORT);
   var proxySocket = proxyUrl.protocol === "https:"
     ? tls.connect({
         host:       proxyUrl.hostname,
@@ -167,7 +186,7 @@ function _connectThroughTunnel(proxyUrl, targetHost, targetPort, callback) {
       var match = /HTTP\/1\.[01] (\d{3})/.exec(status);
       if (!match || parseInt(match[1], 10) !== 200) {
         done(new ProxyError("proxy/connect-failed", "proxy CONNECT to " + targetHost + ":" + targetPort + " failed: " + status));
-        try { proxySocket.destroy(); } catch (_e) {}
+        try { proxySocket.destroy(); } catch (_e) { /* best-effort socket teardown */ }
         return;
       }
       done(null, proxySocket);
@@ -179,7 +198,7 @@ function _connectThroughTunnel(proxyUrl, targetHost, targetPort, callback) {
 function agentFor(targetUrl) {
   var proxy = _proxyForUrl(targetUrl);
   if (!proxy) return null;
-  var u = targetUrl instanceof URL ? targetUrl : new URL(String(targetUrl));
+  var u = _parseTarget(targetUrl);
   var key = proxy.toString() + "|" + u.protocol;
   if (STATE.agentCache.has(key)) return STATE.agentCache.get(key);
 
@@ -227,7 +246,7 @@ function snapshot() {
 }
 
 function _emitObs(name, fields) {
-  try { observability().emit(name, fields || {}); } catch (_e) {}
+  try { observability().emit(name, fields || {}); } catch (_e) { /* obs best-effort */ }
 }
 
 function _resetForTest() {

package/lib/network-tls.js

@@ -5,6 +5,8 @@ var fs = require("node:fs");
 var path = require("node:path");
 var nodeCrypto = require("node:crypto");
 
+var C = require("./constants");
+var safeBuffer = require("./safe-buffer");
 var validateOpts = require("./validate-opts");
 var lazyRequire = require("./lazy-require");
 var { defineClass } = require("./framework-error");
@@ -66,8 +68,8 @@ function _certMetadata(pem) {
 
 function _isPathLike(s) {
   if (s.indexOf("-----BEGIN") !== -1) return false;
-  if (s.length > 1024) return false;
-  if (/[\r\n]/.test(s)) return false;
+  if (s.length > C.BYTES.kib(1)) return false;
+  if (safeBuffer.hasCrlf(s)) return false;
   return true;
 }
 
@@ -159,7 +161,7 @@ function _emitAuditRemove(metaList, reason) {
           reason:         reason || "operator",
         },
       });
-    } catch (_e) {}
+    } catch (_e) { /* audit best-effort — never break the caller */ }
   }
 }
 
@@ -292,12 +294,12 @@ function _emitAuditAdd(metaList, opts) {
           label:          opts.label || null,
         },
       });
-    } catch (_e) {}
+    } catch (_e) { /* audit best-effort — never break the caller */ }
   }
 }
 
 function _emitObs(name, fields) {
-  try { observability().emit(name, fields || {}); } catch (_e) {}
+  try { observability().emit(name, fields || {}); } catch (_e) { /* obs best-effort */ }
 }
 
 function _resetForTest() {

package/lib/network.js

@@ -77,7 +77,7 @@ function applyToSocket(socket) {
     if (typeof socket.setKeepAlive === "function") {
       socket.setKeepAlive(SOCKET_DEFAULTS.keepAlive, SOCKET_DEFAULTS.keepAliveInitialDelayMs || 0);
     }
-  } catch (_e) {}
+  } catch (_e) { /* best-effort socket-tuning — apply or skip */ }
   return socket;
 }
 
@@ -172,7 +172,7 @@ function bootFromEnv(opts) {
           outcome:  "success",
           metadata: applied,
         });
-      } catch (_e) {}
+      } catch (_e) { /* audit best-effort — never break boot */ }
     }
   }
   _emitObs("network.boot.from_env", { source: "env" });
@@ -197,7 +197,7 @@ function snapshot() {
 }
 
 function _emitObs(name, fields) {
-  try { observability().emit(name, fields || {}); } catch (_e) {}
+  try { observability().emit(name, fields || {}); } catch (_e) { /* obs best-effort */ }
 }
 
 function _resetForTest() {

package/lib/notify.js

@@ -127,9 +127,7 @@ function _validateChannelEntry(name, entry) {
 }
 
 function _validateCreateOpts(opts) {
-  if (!opts || typeof opts !== "object") {
-    throw _err("BAD_OPT", "notify.create: opts must be an object");
-  }
+  validateOpts.requireObject(opts, "notify.create", NotifyError);
   if (!opts.channels || typeof opts.channels !== "object") {
     throw _err("BAD_OPT", "notify.create: channels must be an object mapping channel names to transports");
   }
@@ -137,17 +135,9 @@ function _validateCreateOpts(opts) {
   if (keys.length === 0) {
     throw _err("BAD_OPT", "notify.create: channels object must have at least one channel");
   }
-  if (opts.audit !== undefined && opts.audit !== null) {
-    if (typeof opts.audit !== "object" || typeof opts.audit.safeEmit !== "function") {
-      throw _err("BAD_OPT", "notify.create: audit must be a b.audit-shaped object (safeEmit fn)");
-    }
-  }
-  if (opts.auditSuccess !== undefined && typeof opts.auditSuccess !== "boolean") {
-    throw _err("BAD_OPT", "notify.create: auditSuccess must be a boolean");
-  }
-  if (opts.auditFailures !== undefined && typeof opts.auditFailures !== "boolean") {
-    throw _err("BAD_OPT", "notify.create: auditFailures must be a boolean");
-  }
+  validateOpts.auditShape(opts.audit, "notify.create", NotifyError);
+  validateOpts.optionalBoolean(opts.auditSuccess, "notify.create: auditSuccess", NotifyError);
+  validateOpts.optionalBoolean(opts.auditFailures, "notify.create: auditFailures", NotifyError);
   if (opts.redact !== undefined && opts.redact !== null && typeof opts.redact !== "function") {
     throw _err("BAD_OPT", "notify.create: redact must be a function returning a redacted message");
   }
@@ -169,9 +159,7 @@ function _validateCreateOpts(opts) {
       throw _err("BAD_OPT", "notify.create: queue must be a b.queue-shaped handle (enqueue fn)");
     }
   }
-  if (opts.clock !== undefined && typeof opts.clock !== "function") {
-    throw _err("BAD_OPT", "notify.create: clock must be a function");
-  }
+  validateOpts.optionalFunction(opts.clock, "notify.create: clock", NotifyError);
 }
 
 // ---- Built-in transports ----
@@ -183,9 +171,7 @@ function httpJson(opts) {
   if (!opts || typeof opts !== "object") {
     throw _err("BAD_OPT", "notify.transports.httpJson: opts must be { url, ... }");
   }
-  if (typeof opts.url !== "string" || opts.url.length === 0) {
-    throw _err("BAD_OPT", "notify.transports.httpJson: url is required");
-  }
+  validateOpts.requireNonEmptyString(opts.url, "notify.transports.httpJson: url", NotifyError, "BAD_OPT");
   var allowedProtocols = opts.allowHttp ? safeUrl.ALLOW_HTTP_ALL : safeUrl.ALLOW_HTTP_TLS;
   var allowInternal = opts.allowInternal != null ? opts.allowInternal : null;
   // Validate URL at create time so bad URLs surface at boot, not at first send.
@@ -270,18 +256,14 @@ function httpJson(opts) {
 // log — fire-and-forget developer logger. Never throws; audit + obs still emit.
 function logTransport(opts) {
   opts = opts || {};
+  // bootLog.boot() returns a callable with .info / .warn / .error
+  // attached; that shape satisfies the operator-supplied opts.logger
+  // contract directly. No fallback wrapper needed.
   var logger;
   if (opts.logger && typeof opts.logger.info === "function") {
     logger = opts.logger;
   } else {
     logger = bootLog.boot("notify.log");
-    // boot returns a fn-with-fields shape; tolerate both.
-    if (typeof logger === "function") {
-      logger = { info: logger, error: function (m) { try { console.error(m); } catch (_e) {} } };
-    }
-    if (typeof logger.error !== "function") {
-      logger.error = function (m) { try { console.error(m); } catch (_e) {} };
-    }
   }
   return {
     name: opts.name || "log",
@@ -321,16 +303,16 @@ function create(opts) {
     "queue", "clock",
   ], "notify");
   _validateCreateOpts(opts);
+  var cfg = validateOpts.applyDefaults(opts, DEFAULTS);
 
-  var auditSuccess  = (opts.auditSuccess  === undefined) ? DEFAULTS.auditSuccess  : opts.auditSuccess;
-  var auditFailures = (opts.auditFailures === undefined) ? DEFAULTS.auditFailures : opts.auditFailures;
+  var auditSuccess  = cfg.auditSuccess;
+  var auditFailures = cfg.auditFailures;
   var audit = opts.audit || null;
   var redactFn = (typeof opts.redact === "function")
     ? opts.redact
     // Default: b.redact.redact — the framework's PII detector chain.
     : function (m) { return redactModule().redact(m); };
-  var defaultTimeoutMs = (opts.defaultTimeoutMs === undefined)
-    ? DEFAULTS.defaultTimeoutMs : opts.defaultTimeoutMs;
+  var defaultTimeoutMs = cfg.defaultTimeoutMs;
   var defaultRetry = opts.defaultRetry || null;
   var defaultBreaker = opts.defaultBreaker || null;
   var operatorQueue = opts.queue || null;
@@ -362,11 +344,7 @@ function create(opts) {
     catch (_e) { /* drop-silent — observability sink must not crash send() */ }
   }
 
-  function _emitAudit(action, info) {
-    if (!audit) return;
-    try { audit.safeEmit(Object.assign({ action: action }, info || {})); }
-    catch (_e) { /* audit best-effort */ }
-  }
+  var _emitAudit = validateOpts.makeAuditEmitter(audit);
 
   function _actor(callerOpts) {
     return requestHelpers.resolveActorWithOverride(callerOpts);

package/lib/ntp-check.js

@@ -34,7 +34,8 @@ var NTP_TO_UNIX_OFFSET_SECONDS = 2208988800;
 
 var DEFAULT_SERVERS = ["pool.ntp.org", "time.cloudflare.com"];
 var DEFAULT_PORT    = 123;
-var DEFAULT_TIMEOUT_MS = 3000;
+var DEFAULT_TIMEOUT_MS = C.TIME.seconds(3);
+var NTP_PACKET_BYTES = C.BYTES.bytes(48);  // RFC 5905 §7.3
 
 var DEFAULT_DRIFT_WARN_MS  = C.TIME.minutes(5);
 var DEFAULT_DRIFT_FATAL_MS = C.TIME.hours(1);
@@ -105,9 +106,9 @@ function querySingle(server, opts) {
     }, timeoutMs);
     timer.unref();
 
-    // SNTPv4 client request: 48-byte buffer, byte 0 = 0b00_100_011 = 0x23
+    // SNTPv4 client request: NTP_PACKET_BYTES buffer, byte 0 = 0b00_100_011 = 0x23
     //   LI=0 (no warning), VN=4, Mode=3 (client). Other bytes zero.
-    var req = Buffer.alloc(48);
+    var req = Buffer.alloc(NTP_PACKET_BYTES);
     req[0] = 0x23;
     var sendTimeMs = Date.now();
 
@@ -119,15 +120,15 @@ function querySingle(server, opts) {
     socket.on("message", function (msg) {
       clearTimeout(timer);
       var receiveTimeMs = Date.now();
-      if (!Buffer.isBuffer(msg) || msg.length < 48) {
+      if (!Buffer.isBuffer(msg) || msg.length < NTP_PACKET_BYTES) {
         return done({ code: "ntp/bad-reply", message: "reply too short (" + (msg && msg.length) + " bytes)" });
       }
       // Bytes 40-47 = Transmit Timestamp (NTP epoch seconds.fraction)
       var ntpSeconds  = msg.readUInt32BE(40);
       var ntpFraction = msg.readUInt32BE(44);
       var serverUnixSeconds = ntpSeconds - NTP_TO_UNIX_OFFSET_SECONDS;
-      var fracMs = Math.round(ntpFraction / 0x100000000 * 1000);
-      var serverTimeMs = serverUnixSeconds * 1000 + fracMs;
+      var fracMs = Math.round(C.TIME.seconds(ntpFraction / 0x100000000));
+      var serverTimeMs = C.TIME.seconds(serverUnixSeconds) + fracMs;
 
       // Round-trip-corrected drift: assume the server's reply transmit
       // timestamp is approximately at the midpoint of our send/receive.