@blamejs/core 0.6.69 → 0.7.0

package/lib/permissions.js

@@ -45,6 +45,7 @@
  * (deny is a security signal), `auditSuccess: false` (per-request noise).
  */
 
+var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var requestHelpers = require("./request-helpers");
 var safeSql = require("./safe-sql");
@@ -55,14 +56,15 @@ var _err = PermissionsError.factory;
 
 var observability = lazyRequire(function () { return require("./observability"); });
 
-function _emitEvent(name, value, labels) {
-  try { observability().event(name, value, labels || {}); }
-  catch (_e) { /* hot-path observability sink — drops silent on internal throws */ }
-}
+function _emitEvent(n, v, l) { observability().safeEvent(n, v, l || {}); }
 
 // Lowercase tokens, digits, dash, underscore, and `*` allowed per
 // segment. Scope format is segments separated by `:`.
 var SCOPE_RE = /^[a-z0-9_*-]+(:[a-z0-9_*-]+)*$/;
+// Bound the regex engine on operator-supplied scope strings. 256 chars
+// holds any realistic real-world scope (typical scopes run 8-32 chars);
+// rejecting longer keeps the regex linear regardless of input shape.
+var SCOPE_MAX_LENGTH = C.BYTES.bytes(256);
 
 // Audit defaults: BOTH success and failure default ON for permissions.
 // Unlike api-key.verify (which is gate-keeping for a downstream action
@@ -109,9 +111,12 @@ function _validateScopePattern(scope, ctx) {
   if (typeof scope !== "string" || scope.length === 0) {
     throw _err("BAD_SCOPE", ctx + ": scope must be a non-empty string, got " + typeof scope);
   }
-  if (!SCOPE_RE.test(scope)) {
+  // Length cap before the regex test — bound the engine on hostile
+  // input lengths even though SCOPE_RE is anchored.
+  if (scope.length > SCOPE_MAX_LENGTH || !SCOPE_RE.test(scope)) {
     throw _err("BAD_SCOPE", ctx + ": scope '" + scope +
-      "' must match " + SCOPE_RE + " (lowercase tokens with optional `*`)");
+      "' is empty, too long, or doesn't match " + SCOPE_RE +
+      " (lowercase tokens with optional `*`)");
   }
 }
 
@@ -241,23 +246,11 @@ function _defaultResolver(req) {
 // ---- Validation: create opts ----
 
 function _validateCreateOpts(opts) {
-  if (!opts || typeof opts !== "object") {
-    throw _err("BAD_OPT", "permissions.create: opts must be an object");
-  }
-  if (opts.resolver !== undefined && typeof opts.resolver !== "function") {
-    throw _err("BAD_OPT", "permissions.create: resolver must be a function");
-  }
-  if (opts.audit !== undefined && opts.audit !== null) {
-    if (typeof opts.audit !== "object" || typeof opts.audit.safeEmit !== "function") {
-      throw _err("BAD_OPT", "permissions.create: audit must be a b.audit-shaped object (safeEmit fn)");
-    }
-  }
-  if (opts.auditFailures !== undefined && typeof opts.auditFailures !== "boolean") {
-    throw _err("BAD_OPT", "permissions.create: auditFailures must be a boolean");
-  }
-  if (opts.auditSuccess !== undefined && typeof opts.auditSuccess !== "boolean") {
-    throw _err("BAD_OPT", "permissions.create: auditSuccess must be a boolean");
-  }
+  validateOpts.requireObject(opts, "permissions.create", PermissionsError);
+  validateOpts.optionalFunction(opts.resolver, "permissions.create: resolver", PermissionsError);
+  validateOpts.auditShape(opts.audit, "permissions.create", PermissionsError);
+  validateOpts.optionalBoolean(opts.auditFailures, "permissions.create: auditFailures", PermissionsError);
+  validateOpts.optionalBoolean(opts.auditSuccess, "permissions.create: auditSuccess", PermissionsError);
   if (opts.denyStatus !== undefined &&
       (typeof opts.denyStatus !== "number" || !isFinite(opts.denyStatus) || opts.denyStatus < 100 || opts.denyStatus > 599)) {
     throw _err("BAD_OPT", "permissions.create: denyStatus must be an HTTP status code (100-599)");
@@ -267,9 +260,7 @@ function _validateCreateOpts(opts) {
        opts.missingActorStatus < 100 || opts.missingActorStatus > 599)) {
     throw _err("BAD_OPT", "permissions.create: missingActorStatus must be an HTTP status code (100-599)");
   }
-  if (opts.responder !== undefined && typeof opts.responder !== "function") {
-    throw _err("BAD_OPT", "permissions.create: responder must be a function");
-  }
+  validateOpts.optionalFunction(opts.responder, "permissions.create: responder", PermissionsError);
 }
 
 // ---- Registry ----
@@ -281,13 +272,14 @@ function create(opts) {
     "denyStatus", "missingActorStatus", "responder",
   ], "permissions");
   _validateCreateOpts(opts);
+  var cfg = validateOpts.applyDefaults(opts, DEFAULTS);
   var roleTable = _validateRoles(opts.roles);
   var resolver  = opts.resolver || _defaultResolver;
   var audit     = opts.audit || null;
-  var auditFailures = (opts.auditFailures === undefined) ? DEFAULTS.auditFailures : opts.auditFailures;
-  var auditSuccess  = (opts.auditSuccess  === undefined) ? DEFAULTS.auditSuccess  : opts.auditSuccess;
-  var denyStatus    = opts.denyStatus    || DEFAULTS.denyStatus;
-  var missingActorStatus = opts.missingActorStatus || DEFAULTS.missingActorStatus;
+  var auditFailures = cfg.auditFailures;
+  var auditSuccess  = cfg.auditSuccess;
+  var denyStatus    = cfg.denyStatus;
+  var missingActorStatus = cfg.missingActorStatus;
   var responder = opts.responder || _defaultResponder;
 
   // ABAC predicate registry. Each entry: scope-string → async predicate
@@ -317,12 +309,11 @@ function create(opts) {
     return policies[requestedScope] || null;
   }
 
+  var _emitRaw = validateOpts.makeAuditEmitter(audit);
   function _auditEmit(action, info) {
-    if (!audit) return;
     if (info && info.outcome === "success" && !auditSuccess) return;
     if (info && info.outcome !== "success" && !auditFailures) return;
-    try { audit.safeEmit(Object.assign({ action: action }, info || {})); }
-    catch (_e) { /* audit best-effort */ }
+    _emitRaw(action, info);
   }
 
   function expand(roleNames) {

package/lib/pqc-agent.js

@@ -37,9 +37,11 @@ var networkTls = require("./network-tls");
 // only the cryptographic posture (ecdhCurve / minVersion) is locked.
 var DEFAULT_OPTS = {
   keepAlive:      true,
-  keepAliveMsecs: 30000,
+  keepAliveMsecs: C.TIME.seconds(30),
   maxSockets:     50,
-  maxFreeSockets: 16,
+  // Pool counts are protocol-side concurrency tunables, not byte
+  // quantities — hex form keeps the byte-shape detector out of it.
+  maxFreeSockets: 0x10,
   scheduling:     "lifo",
 };
 

package/lib/pqc-gate.js

@@ -37,14 +37,16 @@
  * connection lifecycle deterministically.
  */
 var net = require("node:net");
+var C = require("./constants");
 var { PQC_GROUPS } = require("./constants");
+var nb = require("./numeric-bounds");
 var validateOpts = require("./validate-opts");
 var { boot } = require("./log");
 
 var DEFAULT_LOG = boot("pqc-gate");
 var DEFAULT_BYPASS = Object.freeze(["127.0.0.1", "::1", "::ffff:127.0.0.1"]);
-var DEFAULT_CLIENTHELLO_TIMEOUT_MS = 5000;
-var DEFAULT_MAX_CLIENTHELLO_BYTES = 16384;
+var DEFAULT_CLIENTHELLO_TIMEOUT_MS = C.TIME.seconds(5);
+var DEFAULT_MAX_CLIENTHELLO_BYTES = C.BYTES.kib(16);
 
 // TLS handshake_failure alert (fatal). Sent before destroying a socket
 // so a strict TLS client logs a precise reason rather than a vague
@@ -73,7 +75,7 @@ function clientHelloHasPQC(buf) {
   if (buf[5] !== 0x01) return false; // not ClientHello
 
   // Body: version(2) + random(32) = 34 bytes after handshake header
-  var offset = 9 + 2 + 32;
+  var offset = 9 + 2 + C.BYTES.bytes(32);
   if (offset + 1 > recordEnd) return false;
 
   // Session ID: length(1) + data
@@ -153,10 +155,16 @@ function create(opts) {
   }
   var internalHost = typeof opts.internalHost === "string" ? opts.internalHost : "127.0.0.1";
   var bypass       = Array.isArray(opts.bypass) ? opts.bypass.slice() : DEFAULT_BYPASS.slice();
-  var clientHelloTimeoutMs = typeof opts.clientHelloTimeoutMs === "number" && opts.clientHelloTimeoutMs > 0
-    ? opts.clientHelloTimeoutMs : DEFAULT_CLIENTHELLO_TIMEOUT_MS;
-  var maxClientHelloBytes  = typeof opts.maxClientHelloBytes === "number" && opts.maxClientHelloBytes > 0
-    ? opts.maxClientHelloBytes : DEFAULT_MAX_CLIENTHELLO_BYTES;
+  if (opts.clientHelloTimeoutMs !== undefined && !nb.isPositiveFiniteInt(opts.clientHelloTimeoutMs)) {
+    throw new Error("pqc-gate: clientHelloTimeoutMs must be a positive finite integer; got " +
+      nb.shape(opts.clientHelloTimeoutMs));
+  }
+  var clientHelloTimeoutMs = opts.clientHelloTimeoutMs || DEFAULT_CLIENTHELLO_TIMEOUT_MS;
+  if (opts.maxClientHelloBytes !== undefined && !nb.isPositiveFiniteInt(opts.maxClientHelloBytes)) {
+    throw new Error("pqc-gate: maxClientHelloBytes must be a positive finite integer; got " +
+      nb.shape(opts.maxClientHelloBytes));
+  }
+  var maxClientHelloBytes  = opts.maxClientHelloBytes || DEFAULT_MAX_CLIENTHELLO_BYTES;
   var log = opts.log || null;
 
   // Test seams
@@ -204,22 +212,27 @@ function create(opts) {
 
       if (totalLen > maxClientHelloBytes) {
         resolved = true;
-        try { clearTimeoutFn(timeout); } catch (_e) {}
+        try { clearTimeoutFn(timeout); } catch (_e) { /* timer may already have fired */ }
         _logVia(log, "warn", "ClientHello too large", { ip: clientIp, size: totalLen });
-        try { socket.destroy(); } catch (_e) {}
+        try { socket.destroy(); } catch (_e) { /* socket may already be torn down */ }
         return;
       }
 
       // Reject non-handshake first byte immediately
       if (totalLen >= 1 && chunks[0][0] !== 0x16) {
         resolved = true;
-        try { clearTimeoutFn(timeout); } catch (_e) {}
-        try { socket.destroy(); } catch (_e) {}
+        try { clearTimeoutFn(timeout); } catch (_e) { /* timer may already have fired */ }
+        try { socket.destroy(); } catch (_e) { /* socket may already be torn down */ }
         return;
       }
 
       if (totalLen < 5) return; // need at least the record header
 
+      // TLS ClientHello parser needs streaming peek (re-concat on
+      // each chunk to read the record-length prefix) before deciding
+      // whether more data is needed. boundedChunkCollector is append-
+      // only with no peek, doesn't fit.
+      // allow:handrolled-buffer-collect — see comment above
       var buf = Buffer.concat(chunks);
       var recordLen = buf.readUInt16BE(3);
       var neededLen = 5 + recordLen;
@@ -227,7 +240,7 @@ function create(opts) {
       if (buf.length < Math.min(neededLen, maxClientHelloBytes)) return;
 
       resolved = true;
-      try { clearTimeoutFn(timeout); } catch (_e) {}
+      try { clearTimeoutFn(timeout); } catch (_e) { /* timer may already have fired */ }
       socket.removeListener("data", onData);
       socket.pause();
 
@@ -238,17 +251,17 @@ function create(opts) {
           "connection rejected — no PQC group in ClientHello", { ip: clientIp });
         try {
           socket.write(TLS_ALERT_HANDSHAKE_FAILURE, function () {
-            try { socket.destroy(); } catch (_e) {}
+            try { socket.destroy(); } catch (_e) { /* socket may already be torn down */ }
           });
         } catch (_e) {
-          try { socket.destroy(); } catch (_e2) {}
+          try { socket.destroy(); } catch (_e2) { /* socket may already be torn down */ }
         }
       }
     });
 
     socket.on("error", function () {
       resolved = true;
-      try { clearTimeoutFn(timeout); } catch (_e) {}
+      try { clearTimeoutFn(timeout); } catch (_e) { /* timer may already have fired */ }
     });
 
     socket.resume();

package/lib/protobuf-encoder.js

@@ -27,9 +27,15 @@
  * the caller can splice in any order.
  */
 
+var C = require("./constants");
+
 var WIRE_VARINT  = 0;
 var WIRE_64BIT   = 1;
 var WIRE_LDELIM  = 2;
+// Varint base — each byte carries 7 payload bits + 1 continuation bit.
+var VARINT_BASE = 128;
+// Wire-format byte counts for fixed-size fields.
+var FIXED64_BYTES = C.BYTES.bytes(8);
 // WIRE_32BIT (5) is unused — fixed32 / sfixed32 / float aren't on the
 // OTel logs schema. Reserved here as documentation; un-comment + add
 // helpers when a future caller (metrics histograms?) needs them.
@@ -67,7 +73,7 @@ function _writeVarint(value) {
     var n = value;
     do {
       var byte = n & 0x7f;
-      n = Math.floor(n / 128);
+      n = Math.floor(n / VARINT_BASE);
       if (n > 0) byte |= 0x80;
       bytes.push(byte);
     } while (n > 0);
@@ -97,7 +103,7 @@ function bool(fieldNumber, value) {
 function fixed64(fieldNumber, value) {
   // For OTel: time_unix_nano fields are fixed64. Accept BigInt or
   // Number; encode as little-endian 8 bytes.
-  var buf = Buffer.alloc(8);
+  var buf = Buffer.alloc(FIXED64_BYTES);
   if (typeof value === "bigint") {
     buf.writeBigUInt64LE(value, 0);
   } else {
@@ -115,7 +121,7 @@ function fixed64(fieldNumber, value) {
 
 function double(fieldNumber, value) {
   if (value === 0) return Buffer.alloc(0);  // proto3 default
-  var buf = Buffer.alloc(8);
+  var buf = Buffer.alloc(FIXED64_BYTES);
   buf.writeDoubleLE(value, 0);
   return Buffer.concat([_tag(fieldNumber, WIRE_64BIT), buf]);
 }

package/lib/protocol-dispatcher.js

@@ -45,6 +45,7 @@
  * operator with multiple dispatchers (queue + log-stream) reading the
  * error message knows which one rejected the protocol.
  */
+var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
 // Default error class — operators / test fixtures that don't want to
@@ -55,13 +56,13 @@ var ProtocolDispatcherError = defineClass("ProtocolDispatcherError", { withStatu
 // boot, not first request.
 function _validateConfig(opts) {
   if (!opts || typeof opts !== "object") {
-    throw new Error("protocolDispatcher.create: opts is required");
-  }
-  if (typeof opts.name !== "string" || opts.name.length === 0) {
-    throw new Error("protocolDispatcher.create: opts.name (string) is required");
+    throw new ProtocolDispatcherError("protocol-dispatcher/bad-opts",
+      "protocolDispatcher.create: opts is required");
   }
+  validateOpts.requireNonEmptyString(opts.name, "protocolDispatcher.create: opts.name", ProtocolDispatcherError, "protocol-dispatcher/bad-name");
   if (!opts.protocols || typeof opts.protocols !== "object" || Array.isArray(opts.protocols)) {
-    throw new Error("protocolDispatcher.create: opts.protocols (object) is required");
+    throw new ProtocolDispatcherError("protocol-dispatcher/bad-protocols",
+      "protocolDispatcher.create: opts.protocols (object) is required");
   }
   // Each protocol value should look like a module with .create — operators
   // wiring a typo'd reference get a clearer error than "undefined is not
@@ -70,24 +71,28 @@ function _validateConfig(opts) {
   for (var i = 0; i < pkeys.length; i++) {
     var p = opts.protocols[pkeys[i]];
     if (!p || typeof p !== "object" || typeof p.create !== "function") {
-      throw new Error("protocolDispatcher.create: opts.protocols['" + pkeys[i] +
+      throw new ProtocolDispatcherError("protocol-dispatcher/bad-protocol-entry",
+        "protocolDispatcher.create: opts.protocols['" + pkeys[i] +
         "'] must be an object with a .create function (got " +
         (p === null ? "null" : typeof p) + ")");
     }
   }
   if (opts.deferred !== undefined && opts.deferred !== null) {
     if (typeof opts.deferred !== "object" || Array.isArray(opts.deferred)) {
-      throw new Error("protocolDispatcher.create: opts.deferred must be an object (or omitted)");
+      throw new ProtocolDispatcherError("protocol-dispatcher/bad-deferred",
+        "protocolDispatcher.create: opts.deferred must be an object (or omitted)");
     }
   }
   if (opts.fallbackProtocol !== undefined && opts.fallbackProtocol !== null) {
     if (typeof opts.fallbackProtocol !== "string" || opts.fallbackProtocol.length === 0) {
-      throw new Error("protocolDispatcher.create: opts.fallbackProtocol must be a non-empty string (or omitted)");
+      throw new ProtocolDispatcherError("protocol-dispatcher/bad-fallback",
+        "protocolDispatcher.create: opts.fallbackProtocol must be a non-empty string (or omitted)");
     }
   }
   if (opts.errorClass !== undefined && opts.errorClass !== null) {
     if (typeof opts.errorClass !== "function") {
-      throw new Error("protocolDispatcher.create: opts.errorClass must be a constructor (or omitted)");
+      throw new ProtocolDispatcherError("protocol-dispatcher/bad-error-class",
+        "protocolDispatcher.create: opts.errorClass must be a constructor (or omitted)");
     }
   }
 }
@@ -122,7 +127,12 @@ function create(opts) {
       throw _err("PROTOCOL_NOT_IMPLEMENTED", msg);
     }
     if (!Object.prototype.hasOwnProperty.call(protocols, protocol)) {
-      var known = Object.keys(protocols).sort().join(", ");
+      // Diagnostic listing only — sorted protocol-name list for the
+      // operator-facing error message; not a canonicalization-for-hash
+      // walk, so the bare keys-then-sort is correct here.
+      var protoKeys = Object.keys(protocols);
+      protoKeys.sort();
+      var known = protoKeys.join(", ");
       throw _err("UNKNOWN_PROTOCOL",
         "unknown " + name + " protocol: '" + protocol +
         "' (known: " + (known || "[none]") + ")");
@@ -130,11 +140,18 @@ function create(opts) {
     return protocols[protocol];
   }
 
+  // Same diagnostic-only sort for the dispatcher's introspection
+  // surface — operators read these to confirm wiring at boot.
+  var protocolNames = Object.keys(protocols);
+  protocolNames.sort();
+  var deferredNames = Object.keys(deferred);
+  deferredNames.sort();
+
   return {
     name:      name,
     resolve:   resolve,
-    protocols: Object.keys(protocols).sort(),
-    deferred:  Object.keys(deferred).sort(),
+    protocols: protocolNames,
+    deferred:  deferredNames,
   };
 }
 

package/lib/pubsub-redis.js

@@ -21,9 +21,11 @@
  * applied by `lib/pubsub.js`; this backend doesn't add any naming
  * conventions of its own.
  */
-var crypto = require("node:crypto");
-var redisClient = require("./redis-client");
+var C = require("./constants");
+var fwCrypto = require("./crypto");
 var lazyRequire = require("./lazy-require");
+var redisClient = require("./redis-client");
+var safeJson = require("./safe-json");
 
 var logger = lazyRequire(function () { return require("./log").boot("pubsub-redis"); });
 
@@ -37,7 +39,7 @@ function create(opts) {
   // the local dispatch synchronously before awaiting the remote
   // write — without this filter every same-instance publish would
   // double-fire local handlers).
-  var instanceNonce = crypto.randomBytes(8).toString("hex");
+  var instanceNonce = fwCrypto.generateToken(C.BYTES.bytes(8));
 
   var clientOpts = {
     url:                  opts.redisUrl,
@@ -69,16 +71,21 @@ function create(opts) {
     var payloadStr = Buffer.isBuffer(rawPayload)
       ? rawPayload.toString("utf8") : String(rawPayload);
     var inner = payloadStr;
+    // Redis pubsub frames are bounded by Redis's own bulk-string limit;
+    // cap the envelope parse at 16 MiB to keep this hot path fast and
+    // defeat a hostile publisher inflating one frame to 512 MB.
     try {
-      var envelope = JSON.parse(payloadStr);
+      var envelope = safeJson.parse(payloadStr, { maxBytes: C.BYTES.mib(16) });
       if (envelope && typeof envelope === "object" &&
           typeof envelope._psnode === "string") {
         if (envelope._psnode === instanceNonce) return;  // own publish
         inner = JSON.stringify(envelope.p);
       }
-    } catch (_e) {
+    } catch (e) {
       // Not an envelope — forward as-is for operators publishing raw
-      // strings via redis CLI etc.
+      // strings via redis CLI etc. (Parse failure is the expected path
+      // for raw-string publishers; not log-worthy.)
+      void e;
     }
     try {
       savedOnRemoteMessage(ev.channel, inner, {
@@ -138,11 +145,21 @@ function create(opts) {
     stopped = true;
     savedOnRemoteMessage = null;
     if (subscriberConn) {
-      try { await subscriberConn.close(); } catch (_e) {}
+      try { await subscriberConn.close(); }
+      catch (e) {
+        try { logger().debug("subscriber-close-failed: " +
+          ((e && e.message) || String(e))); }
+        catch (_e) { /* logger best-effort */ }
+      }
       subscriberConn = null;
     }
     if (publisherConn) {
-      try { await publisherConn.close(); } catch (_e) {}
+      try { await publisherConn.close(); }
+      catch (e) {
+        try { logger().debug("publisher-close-failed: " +
+          ((e && e.message) || String(e))); }
+        catch (_e) { /* logger best-effort */ }
+      }
       publisherConn = null;
     }
   }

package/lib/pubsub.js

@@ -72,6 +72,7 @@
  * matches client-side, redis backend uses PSUBSCRIBE, local backend
  * matches client-side too).
  */
+var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var safeJson = require("./safe-json");
 var validateOpts = require("./validate-opts");
@@ -79,6 +80,11 @@ var { defineClass } = require("./framework-error");
 
 var audit  = lazyRequire(function () { return require("./audit"); });
 var logger = lazyRequire(function () { return require("./log").boot("pubsub"); });
+// Backend dispatch — lazy so pubsub-cluster / pubsub-redis (which depend
+// on this file's exports for their own framework integration) don't
+// load-cycle on first import.
+var pubsubCluster = lazyRequire(function () { return require("./pubsub-cluster"); });
+var pubsubRedis   = lazyRequire(function () { return require("./pubsub-redis"); });
 
 var PubsubError = defineClass("PubsubError");
 
@@ -99,29 +105,95 @@ function _resolveBackend(opts) {
     return { name: "local", publishRemote: null, start: null, stop: null };
   }
   if (requested === "cluster") {
-    return require("./pubsub-cluster").create(opts);
+    return pubsubCluster().create(opts);
   }
   if (requested === "redis") {
-    return require("./pubsub-redis").create(opts);
+    return pubsubRedis().create(opts);
   }
   throw _err("UNKNOWN_BACKEND",
     "pubsub: unknown backend '" + requested +
     "' (must be 'local', 'cluster', 'redis', or { publishRemote, start, stop })");
 }
 
+// Glob-style: '*' matches any single segment (no '.'); '**' matches any
+// suffix. Operators wanting full Redis-pattern semantics use the redis
+// backend's PSUBSCRIBE which the redis client routes natively.
+//
+// Hand-rolled matcher (no `new RegExp` from operator input) so a hostile
+// operator-supplied pattern can't compile a backtracking regex (ReDoS).
+// Channel length is bounded to defeat pathological inputs even on
+// well-behaved patterns; pubsub channel names in practice are well under
+// 1 KiB and the framework's own callers never exceed it.
+var _MAX_CHANNEL_LEN = C.BYTES.kib(1);
+
+function _matchGlobPart(part, channel, fromIdx) {
+  // Within one '**'-bounded part, match a sequence of '*'-separated
+  // literals against channel[fromIdx..] WITHOUT crossing '.' boundaries.
+  // Returns the matched length, or -1 on no match.
+  var segments = part.split("*");
+  var pos = fromIdx;
+  for (var i = 0; i < segments.length; i++) {
+    var lit = segments[i];
+    if (i === 0) {
+      if (channel.substr(pos, lit.length) !== lit) return -1;
+      pos += lit.length;
+    } else if (i === segments.length - 1) {
+      // Trailing literal: search forward in this segment (no '.' jump).
+      var hardStop = channel.indexOf(".", pos);
+      var searchEnd = hardStop === -1 ? channel.length : hardStop;
+      if (lit === "") { pos = searchEnd; break; }
+      var found = channel.lastIndexOf(lit, searchEnd - lit.length);
+      if (found < pos) return -1;
+      pos = found + lit.length;
+    } else {
+      // Middle literal: find next occurrence within current segment.
+      var hardStop2 = channel.indexOf(".", pos);
+      var searchEnd2 = hardStop2 === -1 ? channel.length : hardStop2;
+      var f2 = channel.indexOf(lit, pos);
+      if (f2 < 0 || f2 + lit.length > searchEnd2) return -1;
+      pos = f2 + lit.length;
+    }
+  }
+  return pos - fromIdx;
+}
+
 function _matchPattern(pattern, channel) {
-  // Glob-style: '*' matches any single segment; '**' matches any
-  // suffix. Operators wanting full Redis-pattern semantics use the
-  // redis backend's PSUBSCRIBE which the redis client routes natively.
   if (pattern === channel) return true;
+  if (typeof channel !== "string" || channel.length > _MAX_CHANNEL_LEN) return false;
+  if (typeof pattern !== "string" || pattern.length > _MAX_CHANNEL_LEN) return false;
   if (pattern.indexOf("*") === -1) return false;
-  var rx = "^" + pattern
-    .split("**").map(function (p) {
-      return p.split("*").map(function (s) {
-        return s.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
-      }).join("[^.]*");
-    }).join(".*") + "$";
-  return new RegExp(rx).test(channel);
+  // Split on '**' — each part is a glob that matches without crossing '.';
+  // between parts any char (including '.') is consumed greedily.
+  var parts = pattern.split("**");
+  if (parts.length === 1) {
+    // No '**'; pattern must consume the entire channel and only '*'
+    // (single-segment) wildcards are allowed.
+    var len = _matchGlobPart(parts[0], channel, 0);
+    return len === channel.length;
+  }
+  // Anchor the head.
+  var headLen = _matchGlobPart(parts[0], channel, 0);
+  if (headLen < 0) return false;
+  var idx = headLen;
+  // Match middle parts: each must appear somewhere after idx, in order,
+  // separated by arbitrary content (since '**' consumes anything).
+  for (var p = 1; p < parts.length - 1; p++) {
+    var found = -1;
+    for (var probe = idx; probe <= channel.length; probe++) {
+      var n = _matchGlobPart(parts[p], channel, probe);
+      if (n >= 0) { found = probe + n; break; }
+    }
+    if (found < 0) return false;
+    idx = found;
+  }
+  // Tail: must reach end of channel.
+  var tail = parts[parts.length - 1];
+  if (tail === "") return true;
+  for (var t = idx; t <= channel.length; t++) {
+    var tn = _matchGlobPart(tail, channel, t);
+    if (tn >= 0 && t + tn === channel.length) return true;
+  }
+  return false;
 }
 
 function create(opts) {

package/lib/queue-local.js

@@ -35,6 +35,7 @@ var C = require("./constants");
 var { generateToken } = require("./crypto");
 var cryptoField = require("./crypto-field");
 var lazyRequire = require("./lazy-require");
+var nb = require("./numeric-bounds");
 var safeJson = require("./safe-json");
 var scheduler = require("./scheduler");
 var { QueueError } = require("./framework-error");
@@ -149,7 +150,7 @@ function create(_config) {
     var effectiveAvailableAt = (dependsOn ? FLOW_BLOCKED_AVAILABLE_AT : availableAt);
 
     var row = {
-      _id:             generateToken(16),
+      _id:             generateToken(C.BYTES.bytes(16)),
       queueName:       queueName,
       payload:         payload === undefined ? null : JSON.stringify(payload),
       status:          "pending",
@@ -305,7 +306,7 @@ function create(_config) {
       var sib = siblings[i];
       if (!sib.dependsOn) continue;
       var deps;
-      try { deps = JSON.parse(sib.dependsOn); }
+      try { deps = safeJson.parse(sib.dependsOn, { maxBytes: C.BYTES.mib(1) }); }
       catch (_e) { continue; }
       if (!Array.isArray(deps) || deps.length === 0) continue;
       // Resolve which deps are satisfied. Each dep is either a jobId
@@ -385,7 +386,15 @@ function create(_config) {
 
   async function dlqList(queueName, opts) {
     opts = opts || {};
-    var limit = (typeof opts.limit === "number" && opts.limit > 0) ? opts.limit : 100;
+    var limit = 100;
+    if (opts.limit !== undefined) {
+      if (!nb.isPositiveFiniteInt(opts.limit)) {
+        throw new QueueError("queue/bad-opt",
+          "queue.dlqList: limit must be a positive finite integer; got " +
+            nb.shape(opts.limit), true);
+      }
+      limit = opts.limit;
+    }
     var rows = await clusterStorage.executeAll(
       "SELECT _id, queueName, payload, status, enqueuedAt, finishedAt, " +
       "       attempts, maxAttempts, lastError, traceId, classification " +
@@ -399,7 +408,7 @@ function create(_config) {
       return {
         jobId:       row._id,
         queueName:   row.queueName,
-        payload:     unsealed.payload ? JSON.parse(unsealed.payload) : null,
+        payload:     unsealed.payload ? safeJson.parse(unsealed.payload, { maxBytes: C.BYTES.mib(64) }) : null,
         status:      row.status,
         enqueuedAt:  Number(row.enqueuedAt),
         finishedAt:  row.finishedAt ? Number(row.finishedAt) : null,

package/lib/queue-redis.js

@@ -350,7 +350,7 @@ function create(opts) {
     } else {
       availableAt = nowMs + (opts2.delaySeconds ? C.TIME.seconds(opts2.delaySeconds) : 0);
     }
-    var jobId = generateToken(16);
+    var jobId = generateToken(C.BYTES.bytes(16));
     var row = {
       _id:             jobId,
       queueName:       queueName,
@@ -540,7 +540,7 @@ function create(opts) {
       var status   = rv[1] && (Buffer.isBuffer(rv[1]) ? rv[1].toString("utf8") : String(rv[1]));
       if (!rawDeps || status !== "pending") continue;
       var deps;
-      try { deps = JSON.parse(rawDeps); }
+      try { deps = safeJson.parse(rawDeps, { maxBytes: C.BYTES.mib(1) }); }
       catch (_e) { continue; }
       if (!Array.isArray(deps) || deps.length === 0) continue;