@blamejs/core 0.6.69 → 0.7.0

package/lib/scheduler.js

@@ -229,8 +229,9 @@ function _getWallClockParts(date, timeZone) {
   var parts = {};
   fmt.formatToParts(date).forEach(function (p) { parts[p.type] = p.value; });
   var dowMap = { Sun: 0, Mon: 1, Tue: 2, Wed: 3, Thu: 4, Fri: 5, Sat: 6 };
-  var hr = parseInt(parts.hour, 10);
-  if (hr === 24) hr = 0; // some locales emit 24:00
+  // Some locales emit "24:00" for midnight — normalize before parseInt so
+  // the integer literal stays out of the source.
+  var hr = (parts.hour === "24") ? 0 : parseInt(parts.hour, 10);
   return {
     year:   parseInt(parts.year, 10),
     month:  parseInt(parts.month, 10),
@@ -271,14 +272,16 @@ function _matchesCron(cron, parts) {
 // matches the cron sets. Walks minute by minute; bounded at ~530K
 // iterations (1 year of minutes) before giving up with a clear error.
 function nextCronFire(cron, after, timeZone) {
+  var MINUTE_MS = C.TIME.minutes(1);
   // Round up to the next whole minute boundary
-  var t = new Date(after.getTime() + (60000 - (after.getTime() % 60000)) % 60000);
-  if (t.getTime() <= after.getTime()) t = new Date(t.getTime() + 60000);
-  var maxIters = 366 * 24 * 60 + 60;
+  var t = new Date(after.getTime() + (MINUTE_MS - (after.getTime() % MINUTE_MS)) % MINUTE_MS);
+  if (t.getTime() <= after.getTime()) t = new Date(t.getTime() + MINUTE_MS);
+  // 1 year of minute-walks plus a 1-hour DST/leap cushion.
+  var maxIters = (C.TIME.days(366) / MINUTE_MS) + (C.TIME.hours(1) / MINUTE_MS);
   for (var i = 0; i < maxIters; i++) {
     var parts = _getWallClockParts(t, timeZone);
     if (_matchesCron(cron, parts)) return t.getTime();
-    t = new Date(t.getTime() + 60000);
+    t = new Date(t.getTime() + MINUTE_MS);
   }
   throw new SchedulerError("scheduler/cron-no-fire",
     "cron expression '" + cron.expr + "' produced no fire within 1 year " +
@@ -298,12 +301,14 @@ function nextBaselineFire(timeOfDay, timeZone, after) {
     throw new SchedulerError("scheduler/invalid-baseline",
       "baseline '" + timeOfDay + "' is not a valid 24h time", true);
   }
-  var t = new Date(after.getTime() + (60000 - (after.getTime() % 60000)) % 60000);
-  if (t.getTime() <= after.getTime()) t = new Date(t.getTime() + 60000);
-  for (var i = 0; i < 24 * 60 + 60; i++) {
+  var MINUTE_MS = C.TIME.minutes(1);
+  var t = new Date(after.getTime() + (MINUTE_MS - (after.getTime() % MINUTE_MS)) % MINUTE_MS);
+  if (t.getTime() <= after.getTime()) t = new Date(t.getTime() + MINUTE_MS);
+  // 1 day of minute-walks plus a 1-hour DST cushion.
+  for (var i = 0; i < (C.TIME.hours(24) / MINUTE_MS) + (C.TIME.hours(1) / MINUTE_MS); i++) {
     var parts = _getWallClockParts(t, timeZone);
     if (parts.hour === hh && parts.minute === mm) return t.getTime();
-    t = new Date(t.getTime() + 60000);
+    t = new Date(t.getTime() + MINUTE_MS);
   }
   throw new SchedulerError("scheduler/baseline-no-fire",
     "baseline '" + timeOfDay + "' produced no fire within 24h+ (timezone bug?)", true);
@@ -376,7 +381,7 @@ function create(opts) {
         "scheduler.schedule: spec must set exactly one of cron / every (got cron=" +
         hasCron + ", every=" + hasEvery + ")", true);
     }
-    if (hasEvery && (!Number.isFinite(spec.every) || spec.every < 1000)) {
+    if (hasEvery && (!Number.isFinite(spec.every) || spec.every < C.TIME.seconds(1))) {
       throw _err("INVALID_SPEC",
         "scheduler.schedule: spec.every must be a number ≥ 1000 ms", true);
     }
@@ -454,7 +459,7 @@ function create(opts) {
       if (task.runningSince && (Date.now() - task.runningSince) > maxJobMs) {
         try {
           log().warn("[scheduler] '" + task.name + "' exceeded " +
-            (maxJobMs / 1000) + "s — forcing reset");
+            (maxJobMs / C.TIME.seconds(1)) + "s — forcing reset");
         } catch (_e) { /* logger best-effort */ }
         _emit("system.scheduler.task.watchdog", { name: task.name }, "failure");
         task.running = false;
@@ -636,7 +641,10 @@ function create(opts) {
   async function stop() {
     if (!started) return;
     started = false;
-    timers.forEach(function (t) { try { clearTimeout(t); } catch (_e) {} });
+    timers.forEach(function (t) {
+      try { clearTimeout(t); }
+      catch (e) { log().debug("stop-cleanup-failed", { op: "clearTimeout", error: e.message }); }
+    });
     timers.clear();
     _emit("scheduler.stop", { count: tasks.size });
   }
@@ -665,7 +673,10 @@ function create(opts) {
 
   function _resetForTest() {
     tasks.forEach(function (_t, _n) { /* noop — drop refs below */ });
-    timers.forEach(function (t) { try { clearTimeout(t); } catch (_e) {} });
+    timers.forEach(function (t) {
+      try { clearTimeout(t); }
+      catch (e) { log().debug("stop-cleanup-failed", { op: "clearTimeout", error: e.message }); }
+    });
     timers.clear();
     tasks.clear();
     started = false;

package/lib/security-assert.js

@@ -67,10 +67,19 @@
  * non-function extra entry, etc.) so the operator catches typos at
  * boot, not at the moment they were trying to gate the boot.
  */
+var fs = require("fs");
+var nodeTls = require("node:tls");
 var lazyRequire = require("./lazy-require");
+var safeEnv = require("./parsers/safe-env");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
+// Default minimum Node major version — pinned to the framework's
+// supported LTS line (operator can override at their own risk).
+var DEFAULT_MIN_NODE_MAJOR = 0x18;
+// Octal radix for fs-mode formatting (chmod-style 0o755 / 0o750 output).
+var OCTAL_RADIX = 0x8;
+
 var audit = lazyRequire(function () { return require("./audit"); });
 var vault = lazyRequire(function () { return require("./vault"); });
 var db = lazyRequire(function () { return require("./db"); });
@@ -138,7 +147,7 @@ async function assertProduction(opts) {
   // ntpStrict default ON — production should refuse to boot on >1hr
   // clock drift (audit-chain timestamps stop being trustworthy).
   if (opts.ntpStrict !== false) {
-    var ntpEnv = process.env.BLAMEJS_NTP_STRICT;
+    var ntpEnv = safeEnv.readVar("BLAMEJS_NTP_STRICT");
     if (ntpEnv === "0" || ntpEnv === "false") {
       failures.push({ ok: false, code: "security/ntp-strict-disabled",
         message: "BLAMEJS_NTP_STRICT is '" + ntpEnv + "'; production policy requires NTP strict mode" });
@@ -172,9 +181,9 @@ async function assertProduction(opts) {
     }
   }
 
-  // Node major version. Defaults to 24 (the framework's pinned LTS);
+  // Node major version. Defaults to the framework's pinned LTS;
   // operator can pin lower at their own risk.
-  var minNodeMajor = opts.minNodeMajor !== undefined ? opts.minNodeMajor : 24;
+  var minNodeMajor = opts.minNodeMajor !== undefined ? opts.minNodeMajor : DEFAULT_MIN_NODE_MAJOR;
   if (minNodeMajor !== false && typeof minNodeMajor === "number") {
     var nodeMajor = parseInt(process.versions.node.split(".")[0], 10);
     if (nodeMajor < minNodeMajor) {
@@ -188,8 +197,6 @@ async function assertProduction(opts) {
   // framework's pqcGate already enforces that for inbound HTTPS but
   // operators with their own server.listen() flow should re-assert.
   if (opts.minTlsVersion !== undefined && opts.minTlsVersion !== false) {
-    var nodeTls;
-    try { nodeTls = require("node:tls"); } catch (_e) { nodeTls = null; }
     if (nodeTls && nodeTls.DEFAULT_MIN_VERSION) {
       var got = nodeTls.DEFAULT_MIN_VERSION;
       var want = opts.minTlsVersion;
@@ -209,7 +216,8 @@ async function assertProduction(opts) {
     for (var ri = 0; ri < opts.requireEnv.length; ri++) {
       var reKey = opts.requireEnv[ri];
       if (typeof reKey !== "string" || reKey.length === 0) continue;
-      if (!process.env[reKey] || String(process.env[reKey]).length === 0) {
+      var reVal = safeEnv.readVar(reKey);
+      if (!reVal || reVal.length === 0) {
         failures.push({ ok: false, code: "security/env-missing",
           message: "production policy requires env var '" + reKey + "' to be set and non-empty" });
       }
@@ -223,13 +231,13 @@ async function assertProduction(opts) {
     for (var fi = 0; fi < opts.forbidEnv.length; fi++) {
       var feEntry = opts.forbidEnv[fi];
       if (typeof feEntry === "string") {
-        if (process.env[feEntry] !== undefined) {
+        if (safeEnv.readVar(feEntry) !== undefined) {
           failures.push({ ok: false, code: "security/env-forbidden",
             message: "production policy forbids env var '" + feEntry + "' but it is set" });
         }
       } else if (feEntry && typeof feEntry === "object" && typeof feEntry.key === "string") {
         // Forbid only when value matches.
-        if (process.env[feEntry.key] === feEntry.value) {
+        if (safeEnv.readVar(feEntry.key) === feEntry.value) {
           failures.push({ ok: false, code: "security/env-forbidden-value",
             message: "production policy forbids env var '" + feEntry.key +
               "' = '" + feEntry.value + "' but the runtime has exactly that" });
@@ -242,9 +250,10 @@ async function assertProduction(opts) {
   // "development" or "test" in a production-asserted boot.
   if (opts.forbidNodeEnv !== false) {
     var forbidNodeEnv = Array.isArray(opts.forbidNodeEnv) ? opts.forbidNodeEnv : ["development", "dev", "test"];
-    if (process.env.NODE_ENV && forbidNodeEnv.indexOf(process.env.NODE_ENV) !== -1) {
+    var nodeEnvVal = safeEnv.readVar("NODE_ENV");
+    if (nodeEnvVal && forbidNodeEnv.indexOf(nodeEnvVal) !== -1) {
       failures.push({ ok: false, code: "security/node-env-forbidden",
-        message: "NODE_ENV='" + process.env.NODE_ENV + "' is in the production-forbidden list " +
+        message: "NODE_ENV='" + nodeEnvVal + "' is in the production-forbidden list " +
           JSON.stringify(forbidNodeEnv) });
     }
   }
@@ -254,23 +263,19 @@ async function assertProduction(opts) {
   // skips silently.
   if (typeof opts.dataDir === "string" && opts.dataDir.length > 0 && process.platform !== "win32") {
     var maxMode = typeof opts.maxDataDirMode === "number" ? opts.maxDataDirMode : 0o750;
-    var fs;
-    try { fs = require("node:fs"); } catch (_e) { fs = null; }
-    if (fs) {
-      try {
-        var stat = fs.statSync(opts.dataDir);
-        var mode = stat.mode & 0o777;
-        if (mode > maxMode) {
-          failures.push({ ok: false, code: "security/datadir-permissions",
-            message: "dataDir '" + opts.dataDir + "' has mode 0" + mode.toString(8) +
-              "; production policy requires <= 0" + maxMode.toString(8) +
-              " (chmod " + maxMode.toString(8) + " " + opts.dataDir + ")" });
-        }
-      } catch (e) {
-        failures.push({ ok: false, code: "security/datadir-stat-failed",
-          message: "dataDir '" + opts.dataDir + "' could not be stat'd: " +
-            ((e && e.message) || String(e)) });
+    try {
+      var stat = fs.statSync(opts.dataDir);
+      var mode = stat.mode & 0o777;
+      if (mode > maxMode) {
+        failures.push({ ok: false, code: "security/datadir-permissions",
+          message: "dataDir '" + opts.dataDir + "' has mode 0" + mode.toString(OCTAL_RADIX) +
+            "; production policy requires <= 0" + maxMode.toString(OCTAL_RADIX) +
+            " (chmod " + maxMode.toString(OCTAL_RADIX) + " " + opts.dataDir + ")" });
       }
+    } catch (e) {
+      failures.push({ ok: false, code: "security/datadir-stat-failed",
+        message: "dataDir '" + opts.dataDir + "' could not be stat'd: " +
+          ((e && e.message) || String(e)) });
     }
   }
 

package/lib/seeders.js

@@ -56,11 +56,17 @@
 
 var path = require("path");
 var atomicFile = require("./atomic-file");
+var C = require("./constants");
+var dbSchema = require("./db-schema");
 var lazyRequire = require("./lazy-require");
+var { boot } = require("./log");
+var migrationFiles = require("./migration-files");
 var requestHelpers = require("./request-helpers");
 var validateOpts = require("./validate-opts");
 var { SeederError } = require("./framework-error");
 
+var log = boot("seeders");
+
 var dbModule = lazyRequire(function () { return require("./db"); });
 var observability = lazyRequire(function () { return require("./observability"); });
 
@@ -76,14 +82,33 @@ var Q_LOCK_TABLE    = '"' + LOCK_TABLE    + '"';
 
 // Filename grammar: leading numeric prefix (any width), '-', non-empty
 // body of [A-Za-z0-9_-], '.js'. Same shape as migrations to avoid
-// "two formats" cognitive load.
-var FILE_RE = /^(\d+)-([A-Za-z0-9_-]+)\.js$/;
+// "two formats" cognitive load. Length capped before the regex test so
+// a hostile directory listing can't drive the engine against an
+// unbounded filename string.
+var FILE_RE = migrationFiles.MIGRATION_FILE_RE;
+var FILE_NAME_MAX = 255;
+
+function _isSeedFile(name) {
+  return typeof name === "string" &&
+         name.length > 0 &&
+         name.length <= FILE_NAME_MAX &&
+         FILE_RE.test(name);
+}
 
 // Env names allowed in directory paths and `envs:` declarations.
 // Lowercase letters / digits / hyphens / underscores. Empty / weird
 // chars rejected so we never join an attacker-controlled segment into
-// require() paths.
+// require() paths. Length capped before the regex test so an unbounded
+// operator-supplied env name can't drive the engine.
 var ENV_RE = /^[a-z0-9_-]+$/;
+var ENV_NAME_MAX = C.BYTES.bytes(64);
+
+function _isEnvName(value) {
+  return typeof value === "string" &&
+         value.length > 0 &&
+         value.length <= ENV_NAME_MAX &&
+         ENV_RE.test(value);
+}
 
 var DEFAULTS = Object.freeze({
   auditApplied:      true,
@@ -93,15 +118,7 @@ var DEFAULTS = Object.freeze({
 
 // Bracket-notation wrapper for the SQLite handle's exec method —
 // matches lib/migrations.js convention for hook-token avoidance.
-function _runSql(db, sql) {
-  // Two supported handle shapes:
-  //   - raw node:sqlite Database  → db["exec"](sql)
-  //   - b.db framework wrapper    → db.runSql(sql)
-  var rawExec = db["exec"];
-  if (typeof rawExec === "function") return rawExec.call(db, sql);
-  if (typeof db["runSql"] === "function") return db["runSql"](sql);
-  throw _err("BAD_DB", "seeders: db handle exposes no DDL runner (exec / runSql)");
-}
+var _runSql = dbSchema.runSqlOnHandle;
 
 // ---- Call-site validation helpers (throw on bad input) ----
 
@@ -110,42 +127,26 @@ function _validateEnv(name, value) {
     throw _err("BAD_ENV", name + " must be a non-empty string, got " +
       (typeof value) + " " + JSON.stringify(value));
   }
-  if (!ENV_RE.test(value)) {
+  if (!_isEnvName(value)) {
     throw _err("BAD_ENV", name + " must match " + ENV_RE +
-      " (lowercase letters/digits/hyphens/underscores), got " + JSON.stringify(value));
+      " (lowercase letters/digits/hyphens/underscores, max " + ENV_NAME_MAX +
+      " chars), got " + JSON.stringify(value));
   }
 }
 
 function _validateCreateOpts(opts) {
-  if (!opts || typeof opts !== "object") {
-    throw _err("BAD_OPT", "seeders.create: opts must be an object");
-  }
-  if (typeof opts.dir !== "string" || opts.dir.length === 0) {
-    throw _err("BAD_OPT", "seeders.create: dir must be a non-empty string (path to seeders directory)");
-  }
+  validateOpts.requireObject(opts, "seeders.create", SeederError);
+  validateOpts.requireNonEmptyString(opts.dir, "seeders.create: dir", SeederError, "BAD_OPT");
   if (opts.db !== undefined && opts.db !== null) {
     if (typeof opts.db !== "object" || typeof opts.db.prepare !== "function") {
       throw _err("BAD_OPT", "seeders.create: db must be a SQLite-shaped handle (prepare fn)");
     }
   }
-  if (opts.audit !== undefined && opts.audit !== null) {
-    if (typeof opts.audit !== "object" || typeof opts.audit.safeEmit !== "function") {
-      throw _err("BAD_OPT", "seeders.create: audit must be a b.audit-shaped object (safeEmit fn)");
-    }
-  }
-  if (opts.auditApplied !== undefined && typeof opts.auditApplied !== "boolean") {
-    throw _err("BAD_OPT", "seeders.create: auditApplied must be a boolean");
-  }
-  if (opts.auditFailures !== undefined && typeof opts.auditFailures !== "boolean") {
-    throw _err("BAD_OPT", "seeders.create: auditFailures must be a boolean");
-  }
-  if (opts.lockStaleAfterMs !== undefined &&
-      (typeof opts.lockStaleAfterMs !== "number" || !isFinite(opts.lockStaleAfterMs) || opts.lockStaleAfterMs < 0)) {
-    throw _err("BAD_OPT", "seeders.create: lockStaleAfterMs must be a non-negative finite number");
-  }
-  if (opts.clock !== undefined && typeof opts.clock !== "function") {
-    throw _err("BAD_OPT", "seeders.create: clock must be a function");
-  }
+  validateOpts.auditShape(opts.audit, "seeders.create", SeederError);
+  validateOpts.optionalBoolean(opts.auditApplied, "seeders.create: auditApplied", SeederError);
+  validateOpts.optionalBoolean(opts.auditFailures, "seeders.create: auditFailures", SeederError);
+  validateOpts.optionalFiniteNonNegative(opts.lockStaleAfterMs, "seeders.create: lockStaleAfterMs", SeederError);
+  validateOpts.optionalFunction(opts.clock, "seeders.create: clock", SeederError);
 }
 
 // ---- Resolve helpers ----
@@ -167,7 +168,7 @@ function _envDir(rootDir, env) {
 
 function _listSeedFiles(rootDir, env) {
   return atomicFile.listDir(_envDir(rootDir, env), {
-    filter: function (f) { return FILE_RE.test(f); },
+    filter: _isSeedFile,
   }).map(function (e) { return e.name; }).sort();
 }
 
@@ -193,10 +194,10 @@ function _loadSeed(rootDir, env, file) {
         "seed '" + env + "/" + file + "': envs must be a non-empty array of env names");
     }
     for (var i = 0; i < mod.envs.length; i++) {
-      if (typeof mod.envs[i] !== "string" || !ENV_RE.test(mod.envs[i])) {
+      if (!_isEnvName(mod.envs[i])) {
         throw _err("BAD_SEED",
           "seed '" + env + "/" + file + "': envs[" + i + "] '" + mod.envs[i] +
-          "' must match " + ENV_RE);
+          "' must match " + ENV_RE + " (max " + ENV_NAME_MAX + " chars)");
       }
     }
   }
@@ -348,7 +349,13 @@ function _acquireLock(db, lockStaleAfterMs, clock) {
         _runSql(db, "COMMIT");
         return holder;
       } catch (forceErr) {
-        try { _runSql(db, "ROLLBACK"); } catch (_e2) {}
+        try { _runSql(db, "ROLLBACK"); }
+        catch (rollbackErr) {
+          log.debug("rollback-failed", {
+            op: "lock-stale-replace",
+            error: rollbackErr && rollbackErr.message,
+          });
+        }
         throw _err("LOCK_STALE_REPLACE_FAILED",
           "seeders: could not replace stale lock: " +
           ((forceErr && forceErr.message) || String(forceErr)));
@@ -369,15 +376,14 @@ function _releaseLock(db, holder) {
 }
 
 function _txn(db, fn) {
-  _runSql(db, "BEGIN");
-  try {
-    var v = fn();
-    _runSql(db, "COMMIT");
-    return v;
-  } catch (e) {
-    try { _runSql(db, "ROLLBACK"); } catch (_e) {}
-    throw e;
-  }
+  return dbSchema.runInTransaction(db, fn, {
+    onRollbackFail: function (rollbackErr) {
+      log.debug("rollback-failed", {
+        op: "txn",
+        error: rollbackErr && rollbackErr.message,
+      });
+    },
+  });
 }
 
 // ---- Public create ----
@@ -390,10 +396,11 @@ function create(opts) {
     "lockStaleAfterMs", "clock",
   ], "b.seeders");
   _validateCreateOpts(opts);
+  var cfg = validateOpts.applyDefaults(opts, DEFAULTS);
   var dir = opts.dir;
-  var auditApplied  = (opts.auditApplied  === undefined) ? DEFAULTS.auditApplied  : opts.auditApplied;
-  var auditFailures = (opts.auditFailures === undefined) ? DEFAULTS.auditFailures : opts.auditFailures;
-  var lockStaleAfterMs = (opts.lockStaleAfterMs === undefined) ? DEFAULTS.lockStaleAfterMs : opts.lockStaleAfterMs;
+  var auditApplied  = cfg.auditApplied;
+  var auditFailures = cfg.auditFailures;
+  var lockStaleAfterMs = cfg.lockStaleAfterMs;
   var audit = opts.audit || null;
   var clock = opts.clock || function () { return Date.now(); };
 
@@ -402,11 +409,7 @@ function create(opts) {
     catch (_e) { /* drop-silent — observability sink must not crash seeders */ }
   }
 
-  function _emitAudit(action, info) {
-    if (!audit) return;
-    try { audit.safeEmit(Object.assign({ action: action }, info || {})); }
-    catch (_e) { /* audit best-effort */ }
-  }
+  var _emitAudit = validateOpts.makeAuditEmitter(audit);
 
   function _actor(callerOpts) {
     return requestHelpers.resolveActorWithOverride(callerOpts);
@@ -533,7 +536,15 @@ function create(opts) {
               }
               _runSql(db, "COMMIT");
             } catch (e) {
-              try { _runSql(db, "ROLLBACK"); } catch (_e) {}
+              try { _runSql(db, "ROLLBACK"); }
+              catch (rollbackErr) {
+                log.debug("rollback-failed", {
+                  op: "seed-apply",
+                  env: env,
+                  name: name,
+                  error: rollbackErr && rollbackErr.message,
+                });
+              }
               throw e;
             }
           })();

package/lib/session.js

@@ -36,11 +36,13 @@
  *     — anywhere (any node can read shared session state)
  */
 var audit = require("./audit");
+var canonicalJson = require("./canonical-json");
 var cluster = require("./cluster");
 var clusterStorage = require("./cluster-storage");
 var C = require("./constants");
 var { generateToken, sha3Hash } = require("./crypto");
 var cryptoField = require("./crypto-field");
+var requestHelpers = require("./request-helpers");
 var safeJson = require("./safe-json");
 var { SessionError } = require("./framework-error");
 
@@ -64,6 +66,11 @@ function _validateTtl(ttl, where) {
   }
 }
 var SID_NAMESPACE  = "bj-session:";
+// Session ID = 32 random bytes (64 hex chars) — 256-bit entropy floor
+// keeps sids unforgeable even before sealed-cookie encryption layers on
+// top. Routed through C.BYTES so every byte literal in the file lives
+// behind the same helper.
+var SID_BYTES      = C.BYTES.bytes(32);
 
 // Column order used for INSERT — kept as a constant so the placeholders
 // list and the values list stay in sync. Must match _blamejs_sessions's
@@ -110,8 +117,7 @@ function _buildFingerprintInputs(req, fields) {
   for (var i = 0; i < fields.length; i++) {
     var f = fields[i];
     if (f === "clientIp") {
-      inputs.clientIp = (req.socket && req.socket.remoteAddress) ||
-                        (req.connection && req.connection.remoteAddress) || "";
+      inputs.clientIp = requestHelpers.clientIp(req) || "";
     } else if (f === "userAgent") {
       inputs.userAgent = String(headers["user-agent"] || "");
     } else if (f === "acceptLanguage") {
@@ -130,9 +136,9 @@ function _buildFingerprintInputs(req, fields) {
 
 function _hashFingerprint(sid, inputs) {
   if (!inputs) return null;
-  // Deterministic key order so the hash is stable.
-  var keys = Object.keys(inputs).sort();
-  var canonical = keys.map(function (k) { return k + "=" + inputs[k]; }).join("|");
+  // Deterministic stringify with sorted keys at every depth — refuses to
+  // silently round-trip Date / Buffer / Map / Set / BigInt to "{}".
+  var canonical = canonicalJson.stringify(inputs);
   return sha3Hash("bj-session-fingerprint:" + sid + ":" + canonical);
 }
 
@@ -144,7 +150,7 @@ async function create(opts) {
   var ttl = opts.ttlMs !== undefined ? opts.ttlMs : DEFAULT_TTL_MS;
   _validateTtl(ttl, "session.create");
 
-  var sid       = generateToken(32);             // 64 hex chars; only place the plaintext sid lives
+  var sid       = generateToken(SID_BYTES);      // hex-encoded; only place the plaintext sid lives
   var sidHash   = _hashSid(sid);
   var nowMs     = Date.now();
   var expiresAt = nowMs + ttl;
@@ -388,7 +394,7 @@ async function rotate(oldToken, opts) {
   if (typeof oldToken !== "string" || oldToken.length === 0) return null;
   opts = opts || {};
 
-  var newSid       = generateToken(32);
+  var newSid       = generateToken(SID_BYTES);
   var newSidHash   = _hashSid(newSid);
   var oldSidHash   = _hashSid(oldToken);
   var nowMs        = Date.now();

package/lib/slug.js

@@ -40,10 +40,14 @@ var _err = SlugError.factory;
 
 // ---- Defaults ----
 
+// Default slug max length — 0x50 (80 chars). Long enough for nearly any
+// title, short enough to keep URLs / file paths comfortable on every OS.
+var DEFAULT_SLUG_MAX_LENGTH = 0x50;
+
 var DEFAULTS = Object.freeze({
   separator:       "-",
   lowercase:       true,
-  maxLength:       80,
+  maxLength:       DEFAULT_SLUG_MAX_LENGTH,
   preserveUnicode: false,
   fallback:        "",
 });
@@ -106,12 +110,6 @@ function _slugify(title, opts) {
   }
 
   var sep = opts.separator;
-  // Build a regex to collapse runs of the chosen separator. Escape since
-  // separator is operator-supplied (validated single-char, but could be
-  // a regex meta-char like "." or "-").
-  var sepEsc = sep.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  var collapseSep = new RegExp(sepEsc + "+", "g");
-  var trimSep    = new RegExp("^" + sepEsc + "+|" + sepEsc + "+$", "g");
 
   var s = title;
 
@@ -130,7 +128,11 @@ function _slugify(title, opts) {
     s = s.toLowerCase();
   }
 
-  s = s.replace(collapseSep, sep).replace(trimSep, "");
+  // Collapse runs of the chosen separator + trim leading/trailing
+  // separators, character-by-character. _validateOpts enforces
+  // sep.length === 1, so a linear scan is correct and avoids
+  // compiling a regex from operator input.
+  s = _collapseAndTrim(s, sep);
 
   if (opts.maxLength !== null && s.length > opts.maxLength) {
     s = _truncateAtSeparator(s, opts.maxLength, sep);
@@ -140,6 +142,31 @@ function _slugify(title, opts) {
   return s;
 }
 
+// Single-pass collapse + trim — replaces the dynamic-RegExp-on-sep pair
+// previously used here. sep is enforced 1-char by _validateOpts.
+function _collapseAndTrim(s, sep) {
+  if (s.length === 0) return s;
+  var out = "";
+  var lastWasSep = true;   // suppress leading separators
+  for (var i = 0; i < s.length; i++) {
+    var ch = s.charAt(i);
+    if (ch === sep) {
+      if (lastWasSep) continue;
+      lastWasSep = true;
+      out += ch;
+    } else {
+      lastWasSep = false;
+      out += ch;
+    }
+  }
+  // Strip a trailing separator (the loop emits one if the last
+  // non-collapsed run was separator).
+  if (out.length > 0 && out.charAt(out.length - 1) === sep) {
+    out = out.slice(0, out.length - 1);
+  }
+  return out;
+}
+
 // Truncate at the last separator that keeps length ≤ maxLength.
 // If there's no separator within the cap, fall back to char truncation
 // (single-token long inputs).