@blamejs/core 0.6.70 → 0.7.0

package/lib/object-store/sigv4-bucket-ops.js

@@ -49,20 +49,31 @@
  * with codes (BUCKET_INVALID_NAME, INVALID_LIFECYCLE, INVALID_CORS_RULE,
  * BUCKET_ALREADY_OWNED, BUCKET_NOT_EMPTY, etc.).
  */
-var { URL } = require("url");
 var nodeCrypto = require("crypto");
 var C = require("../constants");
 var requestHelpers = require("../request-helpers");
 var sigv4 = require("./sigv4");
+var sharedRequest = require("./http-request");
 var safeXml = require("../parsers/safe-xml");
 var safeUrl = require("../safe-url");
 var template = require("../template");
-var httpClient = require("../http-client");
 var validateOpts = require("../validate-opts");
 var { ObjectStoreError } = require("../framework-error");
 
 var _err = ObjectStoreError.factory;
 
+// Internal URL builder — endpoint + path string from validated config.
+// Routes through safeUrl.parse so the protocol allowlist + length cap
+// apply uniformly. Cap is generous since presigned-style URLs with many
+// query params can approach 8 KB.
+function _internalUrl(input, allowedProtocols) {
+  return safeUrl.parse(input, {
+    allowedProtocols: allowedProtocols || safeUrl.ALLOW_HTTP_TLS,
+    errorClass:       ObjectStoreError,
+    maxUrlLength:     C.BYTES.kib(32),
+  });
+}
+
 // S3 bucket-name rules (general purpose). Source: AWS docs
 // "Bucket naming rules". Lowercase letters, digits, hyphens; 3..63
 // chars; no consecutive dots; cannot end in -s3alias / -ol-s3 etc.
@@ -76,7 +87,9 @@ function _validateBucketName(name) {
       "bucket name must be a string of length 3..63, got " +
       (typeof name === "string" ? "length " + name.length : typeof name), true);
   }
-  if (!BUCKET_NAME_RE.test(name)) {
+  // Length is bounded above (3..63) before the regex runs so the
+  // pattern can't be driven against an unbounded input.
+  if (name.length > 63 || !BUCKET_NAME_RE.test(name)) {
     throw _err("BUCKET_INVALID_NAME",
       "bucket name '" + name + "' violates S3 naming rules " +
       "(lowercase, digits, hyphens, dots — no leading/trailing punct)", true);
@@ -116,9 +129,11 @@ function _buildLifecycleXml(rules) {
     throw _err("INVALID_LIFECYCLE",
       "setLifecycle: rules must be a non-empty array", true);
   }
-  if (rules.length > 1000) {
+  // S3 spec hard cap on lifecycle rules per bucket.
+  var MAX_LIFECYCLE_RULES = 1000;
+  if (rules.length > MAX_LIFECYCLE_RULES) {
     throw _err("INVALID_LIFECYCLE",
-      "setLifecycle: maximum 1000 rules per bucket (S3 spec)", true);
+      "setLifecycle: maximum " + MAX_LIFECYCLE_RULES + " rules per bucket (S3 spec)", true);
   }
   var body = '<?xml version="1.0" encoding="UTF-8"?>';
   body += '<LifecycleConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">';
@@ -388,7 +403,7 @@ function _validateObjectKey(key) {
   if (typeof key !== "string" || key.length === 0) {
     throw _err("INVALID_KEY", "object key must be a non-empty string", true);
   }
-  if (key.length > 1024) {
+  if (key.length > C.BYTES.kib(1)) {
     throw _err("INVALID_KEY", "object key exceeds 1024 bytes (S3 limit)", true);
   }
 }
@@ -442,17 +457,10 @@ function create(config) {
   var auditSuccess  = config.auditSuccess  !== false;
   var auditFailures = config.auditFailures !== false;
 
-  function _emit(action, info) {
-    if (!audit) return;
-    try {
-      audit.safeEmit(Object.assign({ action: action }, info));
-    } catch (_e) { /* audit best-effort — never break the call */ }
-  }
+  var _emit = validateOpts.makeAuditEmitter(audit);
 
   function _emitEvent(name, value, labels) {
-    if (!observability || typeof observability.event !== "function") return;
-    try { observability.event(name, value, labels || {}); }
-    catch (_e) { /* observability best-effort */ }
+    if (observability) observability.safeEvent(name, value, labels || {});
   }
 
   function _actor(callerOpts) {
@@ -483,17 +491,15 @@ function create(config) {
   }
 
   function _bucketUrl(name, query) {
-    var base;
+    var ub = _internalUrl(endpoint, allowedProtocols);
     if (pathStyle) {
-      base = endpoint + "/" + name + "/";
+      ub.pathname = "/" + name + "/";
     } else {
-      var ub = new URL(endpoint);
       ub.hostname = name + "." + ub.hostname;
       ub.pathname = "/";
-      base = ub.toString();
-      if (base.endsWith("/")) base = base.slice(0, -1) + "/";
     }
-    return new URL(_appendQuery(base, query));
+    var base = ub.toString();
+    return _internalUrl(_appendQuery(base, query), allowedProtocols);
   }
 
   function _objectUrl(name, key, query) {
@@ -501,21 +507,20 @@ function create(config) {
     // separators in the key are preserved (S3 treats keys with slashes
     // as flat names, not directories).
     var encKey = key.split("/").map(encodeURIComponent).join("/");
-    var base;
+    var uo = _internalUrl(endpoint, allowedProtocols);
     if (pathStyle) {
-      base = endpoint + "/" + name + "/" + encKey;
+      uo.pathname = "/" + name + "/" + encKey;
     } else {
-      var uo = new URL(endpoint);
       uo.hostname = name + "." + uo.hostname;
       uo.pathname = "/" + encKey;
-      base = uo.toString();
     }
-    return new URL(_appendQuery(base, query));
+    var base = uo.toString();
+    return _internalUrl(_appendQuery(base, query), allowedProtocols);
   }
 
   function _serviceUrl(query) {
     // ListBuckets — service-level, no bucket prefix.
-    var u = new URL(endpoint);
+    var u = _internalUrl(endpoint, allowedProtocols);
     u.pathname = "/";
     if (query) {
       Object.keys(query).forEach(function (k) { u.searchParams.set(k, query[k]); });
@@ -538,16 +543,7 @@ function create(config) {
   }
 
   function _request(method, url, headers, body) {
-    return httpClient.request({
-      method:           method,
-      url:              url,
-      headers:          headers,
-      body:             body,
-      idleTimeoutMs:    reqOpts.timeoutMs,
-      errorClass:       ObjectStoreError,
-      allowedProtocols: reqOpts.allowedProtocols,
-    ...((reqOpts.allowInternal !== undefined) ? { allowInternal: reqOpts.allowInternal } : {}),
-    });
+    return sharedRequest(method, url, headers, body, reqOpts);
   }
 
   // ---- create ----

package/lib/object-store/sigv4.js

@@ -27,17 +27,31 @@ var nodeCrypto = require("crypto");
 var { URL } = require("url");
 var { Readable } = require("stream");
 var safeXml = require("../parsers/safe-xml");
+var sharedRequest = require("./http-request");
 var C = require("../constants");
+var nb = require("../numeric-bounds");
 var { ObjectStoreError } = require("../framework-error");
-var httpClient = require("../http-client");
 var safeUrl = require("../safe-url");
 
+// Internal URL builder — endpoint + path string from validated config /
+// framework-encoded keys. Routes through safeUrl.parse so the protocol
+// allowlist + length cap apply uniformly. Presigned URLs with many
+// query params can approach the 8 KB default; raise the cap to 32 KB
+// so a worst-case multipart UploadPart URL still fits.
+function _internalUrl(input, allowedProtocols) {
+  return safeUrl.parse(input, {
+    allowedProtocols: allowedProtocols || safeUrl.ALLOW_HTTP_TLS,
+    errorClass:       ObjectStoreError,
+    maxUrlLength:     C.BYTES.kib(32),
+  });
+}
+
 // S3 list responses are commonly 1000-key paginated payloads — well above
 // the parser's default 1 MiB / 10K element ceilings. These overrides
 // give headroom for normal responses without uncapping the parser.
 var LIST_PARSE_OPTS = {
   maxBytes:    C.BYTES.mib(8),
-  maxElements: 50000,
+  maxElements: C.BYTES.bytes(50000),
 };
 
 function _arrayify(value) {
@@ -53,8 +67,8 @@ var ALGORITHM = "AWS4-HMAC-SHA256";
 
 // Presigned-URL expiry bounds. The SigV4 spec caps query-string-signed
 // URLs at 7 days; below 1 second is effectively unsignable.
-var PRESIGN_DEFAULT_EXPIRES_SECONDS = 15 * 60;        // 15 minutes
-var PRESIGN_MAX_EXPIRES_SECONDS     = 7 * 24 * 60 * 60; // 7 days (SigV4 hard cap)
+var PRESIGN_DEFAULT_EXPIRES_SECONDS = C.TIME.minutes(15) / C.TIME.seconds(1); // 15 minutes
+var PRESIGN_MAX_EXPIRES_SECONDS     = C.TIME.days(7)     / C.TIME.seconds(1); // 7 days (SigV4 hard cap)
 var PRESIGN_MIN_EXPIRES_SECONDS     = 1;
 
 var _err = ObjectStoreError.factory;
@@ -152,9 +166,11 @@ function deriveSigningKey(secretAccessKey, dateStamp, region, service) {
   return hmacSha256(kService, "aws4_request");
 }
 
+// SigV4 ISO compact format: YYYYMMDDTHHMMSSZ — slice indices fixed
+// by AWS spec.
 function _formatAmzDate(d) {
   var iso = d.toISOString().replace(/[-:]/g, "");
-  return iso.slice(0, 8) + "T" + iso.slice(9, 15) + "Z";
+  return iso.slice(0, C.BYTES.bytes(8)) + "T" + iso.slice(9, 15) + "Z";
 }
 function _formatDateStamp(d) {
   return d.toISOString().slice(0, 10).replace(/-/g, "");
@@ -164,7 +180,12 @@ function signRequest(opts) {
   var date = opts.date || new Date();
   var amzDate = _formatAmzDate(date);
   var dateStamp = _formatDateStamp(date);
-  var url = opts.url instanceof URL ? opts.url : new URL(opts.url);
+  // signRequest is called by callers signing requests to operator-
+  // configured endpoints (cloudwatch, sqs, sns, custom S3-API stores).
+  // Honor opts.allowedProtocols so a test-fixture http:// endpoint still
+  // signs correctly while production https:// stays the default.
+  var url = opts.url instanceof URL ? opts.url
+                                    : _internalUrl(opts.url, opts.allowedProtocols);
   // service defaults to s3 for back-compat — every call site predating
   // v0.6.25 was object-store / S3. Other AWS services (logs, sqs, sns,
   // kinesis, etc.) pass opts.service explicitly. The credentialScope
@@ -200,19 +221,7 @@ function signRequest(opts) {
 
 // ---- HTTP request helper ----
 
-function _request(method, url, headers, body, opts) {
-  return httpClient.request({
-    method:           method,
-    url:              url,
-    headers:          headers,
-    body:             body,
-    idleTimeoutMs:    opts && opts.timeoutMs,
-    maxResponseBytes: opts && opts.maxResponseBytes,
-    errorClass:       ObjectStoreError,
-    allowedProtocols: opts && opts.allowedProtocols,
-  ...((opts && opts.allowInternal !== undefined) ? { allowInternal: opts.allowInternal } : {}),
-  });
-}
+var _request = sharedRequest;
 
 // ---- Multipart-upload constants ----
 
@@ -223,7 +232,7 @@ function _request(method, url, headers, body, opts) {
 var MIN_PART_SIZE_BYTES = C.BYTES.mib(5);
 // S3 spec ceiling on part count. CompleteMultipartUpload rejects
 // uploads with more than 10000 parts.
-var MAX_PARTS = 10000;
+var MAX_PARTS = C.BYTES.bytes(10000);
 // Auto-multipart trigger: buffered bodies under this stay single-PUT.
 // Streams always go multipart since size isn't known up-front.
 var DEFAULT_MULTIPART_THRESHOLD_BYTES = C.BYTES.mib(64);
@@ -395,9 +404,9 @@ function create(config) {
     if (key.indexOf("\0") !== -1) throw _err("INVALID_KEY", "null byte in key", true);
     var encoded = key.split("/").map(function (s) { return awsUriEncode(s, true); }).join("/");
     if (pathStyle) {
-      return new URL(endpoint + "/" + config.bucket + "/" + encoded);
+      return _internalUrl(endpoint + "/" + config.bucket + "/" + encoded, allowedProtocols);
     }
-    var u = new URL(endpoint);
+    var u = _internalUrl(endpoint, allowedProtocols);
     u.hostname = config.bucket + "." + u.hostname;
     u.pathname = "/" + encoded;
     return u;
@@ -406,9 +415,9 @@ function create(config) {
   function _bucketUrl(searchParams) {
     var u;
     if (pathStyle) {
-      u = new URL(endpoint + "/" + config.bucket + "/");
+      u = _internalUrl(endpoint + "/" + config.bucket + "/", allowedProtocols);
     } else {
-      u = new URL(endpoint);
+      u = _internalUrl(endpoint, allowedProtocols);
       u.hostname = config.bucket + "." + u.hostname;
       u.pathname = "/";
     }
@@ -506,7 +515,7 @@ function create(config) {
     // still presents `uploads=` per AWS spec) so the signature path is
     // unchanged.
     var url = _keyToUrl(key);
-    var initiateUrl = new URL(url.href + (url.search ? "&" : "?") + "uploads");
+    var initiateUrl = _internalUrl(url.href + (url.search ? "&" : "?") + "uploads", allowedProtocols);
     var initiateExtra = {
       "Content-Type":   contentType,
       "Content-Length": "0",
@@ -530,7 +539,7 @@ function create(config) {
       // 2. Upload parts (concurrency-bounded)
       uploadedEtags = await _bounded(parts, partConcurrency, async function (partBuf, idx) {
         var partNumber = idx + 1;
-        var partUrl = new URL(url.href);
+        var partUrl = _internalUrl(url.href, allowedProtocols);
         partUrl.searchParams.set("partNumber", String(partNumber));
         partUrl.searchParams.set("uploadId", uploadId);
         var partHeaders = _makeSigned("PUT", partUrl, sha256Hex(partBuf), {
@@ -546,7 +555,7 @@ function create(config) {
       });
 
       // 3. Complete
-      var completeUrl = new URL(url.href);
+      var completeUrl = _internalUrl(url.href, allowedProtocols);
       completeUrl.searchParams.set("uploadId", uploadId);
       var completeBody = Buffer.from(_buildCompleteMultipartXml(uploadedEtags), "utf8");
       var completeHeaders = _makeSigned("POST", completeUrl, sha256Hex(completeBody), {
@@ -575,7 +584,7 @@ function create(config) {
       // Failures here are silently swallowed — the caller's original
       // error is what they need to see, not a secondary cleanup error.
       try {
-        var abortUrl = new URL(url.href);
+        var abortUrl = _internalUrl(url.href, allowedProtocols);
         abortUrl.searchParams.set("uploadId", uploadId);
         var abortHeaders = _makeSigned("DELETE", abortUrl, sha256Hex(Buffer.alloc(0)));
         await _request("DELETE", abortUrl, abortHeaders, null, reqOpts);
@@ -648,7 +657,11 @@ function create(config) {
     // hint into real server-side enforcement.
     var headers = { host: url.host };
     if (opts.contentType) headers["content-type"] = opts.contentType;
-    var signedHeadersStr = Object.keys(headers).sort().join(";");
+    // SigV4 SignedHeaders: lowercase, semicolon-joined, AWS-spec order.
+    var signedHeaderKeys = [];
+    for (var hk in headers) signedHeaderKeys.push(hk);
+    signedHeaderKeys.sort();
+    var signedHeadersStr = signedHeaderKeys.join(";");
 
     // Query-string SigV4: presigning carries auth in the URL itself.
     // The set order doesn't matter — canonicalQueryString sorts the
@@ -707,7 +720,12 @@ function create(config) {
         "POST-form policy enforces body size via the content-length-range condition; " +
         "use presignedUploadUrl if size enforcement is not needed", true);
     }
-    var minBytes = (typeof opts.minBytes === "number" && opts.minBytes >= 0) ? opts.minBytes : 0;
+    if (opts.minBytes !== undefined && !nb.isNonNegativeFiniteInt(opts.minBytes)) {
+      throw _err("INVALID_MIN_BYTES",
+        "presignedUploadPolicy: minBytes must be a non-negative finite integer; got " +
+        nb.shape(opts.minBytes), true);
+    }
+    var minBytes = opts.minBytes !== undefined ? opts.minBytes : 0;
     var expiresIn = opts.expiresIn != null ? opts.expiresIn : PRESIGN_DEFAULT_EXPIRES_SECONDS;
     if (typeof expiresIn !== "number" ||
         expiresIn < PRESIGN_MIN_EXPIRES_SECONDS ||
@@ -830,6 +848,8 @@ module.exports = {
   canonicalHeaders:     canonicalHeaders,
   awsUriEncode:         awsUriEncode,
   sha256Hex:            sha256Hex,
+  formatAmzDate:        _formatAmzDate,
+  formatDateStamp:      _formatDateStamp,
   SERVICE:              SERVICE,
   ALGORITHM:            ALGORITHM,
 };

package/lib/observability.js

@@ -133,8 +133,19 @@ function event(name, value, labels) {
   _safeMetricsTap(name, value, labels);
 }
 
+// safeEvent — wraps `event` in a try/catch so callers on hot paths
+// (per-request observability emits) can't crash the request that
+// triggered them when the metrics registry has a misconfigured
+// counter or label name. Replaces the per-file `_emitEvent` helper
+// that 7+ modules previously duplicated.
+function safeEvent(name, value, labels) {
+  try { event(name, value, labels); }
+  catch (_e) { /* hot-path observability sink — drops silent on internal throws */ }
+}
+
 module.exports = {
-  tap:    tap,
-  event:  event,
-  setTap: setTap,
+  tap:        tap,
+  event:      event,
+  safeEvent:  safeEvent,
+  setTap:     setTap,
 };

package/lib/otel-export.js

@@ -40,6 +40,8 @@
  * hand-rolled wire format with no compelling benefit at this scope.
  */
 var C = require("./constants");
+var canonicalJson = require("./canonical-json");
+var defaultHttpClient = require("./http-client");
 var safeAsync = require("./safe-async");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
@@ -77,13 +79,19 @@ function _attrsToOtlp(attrs) {
   return out;
 }
 
-// Stable key per (name, attrs) so tap calls aggregate.
+// Stable key per (name, attrs) so tap calls aggregate. Routes the
+// sort through canonical-json so the framework has one canonical-sort
+// source of truth for hash-input-shaped keys (the OTLP attribute
+// encoding _attrsToOtlp emits the wire-format separately).
 function _bucketKey(name, attrs) {
   if (!attrs) return name + "|";
-  var ks = Object.keys(attrs).sort();
-  var parts = [name];
-  for (var i = 0; i < ks.length; i++) parts.push(ks[i] + "=" + String(attrs[ks[i]]));
-  return parts.join("|");
+  // Coerce to strings so canonical-json doesn't reject odd value types.
+  var coerced = {};
+  var rawKeys = Object.keys(attrs);
+  for (var i = 0; i < rawKeys.length; i++) {
+    coerced[rawKeys[i]] = String(attrs[rawKeys[i]]);
+  }
+  return name + "|" + canonicalJson.stringify(coerced);
 }
 
 function create(opts) {
@@ -92,14 +100,8 @@ function create(opts) {
     "endpoint", "headers", "serviceName", "intervalMs",
     "httpClient", "resourceAttributes", "scope",
   ], "otelExport.create");
-  if (typeof opts.endpoint !== "string" || opts.endpoint.length === 0) {
-    throw new OtelExportError("otel-export/bad-endpoint",
-      "create: endpoint must be a non-empty URL");
-  }
-  if (typeof opts.serviceName !== "string" || opts.serviceName.length === 0) {
-    throw new OtelExportError("otel-export/bad-service-name",
-      "create: serviceName must be a non-empty string");
-  }
+  validateOpts.requireNonEmptyString(opts.endpoint, "create: endpoint", OtelExportError, "otel-export/bad-endpoint");
+  validateOpts.requireNonEmptyString(opts.serviceName, "create: serviceName", OtelExportError, "otel-export/bad-service-name");
   var endpoint = opts.endpoint;
   var serviceName = opts.serviceName;
   var headers = opts.headers || {};
@@ -108,7 +110,7 @@ function create(opts) {
     throw new OtelExportError("otel-export/bad-interval",
       "create: intervalMs must be a non-negative finite number");
   }
-  var httpClient = opts.httpClient || require("./http-client");
+  var httpClient = opts.httpClient || defaultHttpClient;
   var scopeName = (opts.scope && opts.scope.name) || "blamejs";
   var scopeVersion = (opts.scope && opts.scope.version) || "0.5.x";
   var resourceAttrs = Object.assign({ "service.name": serviceName },

package/lib/pagination.js

@@ -96,16 +96,21 @@
  */
 
 var nodeCrypto = require("node:crypto");
+var C = require("./constants");
 var canonicalJson = require("./canonical-json");
 var crypto = require("./crypto");
+var nb = require("./numeric-bounds");
+var safeJson = require("./safe-json");
+var safeSql = require("./safe-sql");
 var { defineClass } = require("./framework-error");
 
 var PaginationError = defineClass("PaginationError", { alwaysPermanent: true });
 
 var CURSOR_VERSION = 1;
-var TAG_BYTES = 16;            // 128-bit HMAC tag truncated from SHA3-512
+var TAG_BYTES = C.BYTES.bytes(16);  // 128-bit HMAC tag truncated from SHA3-512
 var DEFAULT_LIMIT = 25;
 var DEFAULT_MAX_LIMIT = 100;
+var MAX_CURSOR_BYTES = C.BYTES.kib(8);
 
 // Canonical JSON via the shared lib/canonical-json walker with
 // bufferAs: "reject" — cursor state must contain only plain data, so
@@ -185,7 +190,7 @@ function decodeCursor(token, secret) {
       "cursor HMAC verification failed (tampered or wrong secret)");
   }
   var state;
-  try { state = JSON.parse(json); }
+  try { state = safeJson.parse(json, { maxBytes: MAX_CURSOR_BYTES }); }
   catch (_e) {
     throw new PaginationError("pagination/bad-cursor", "cursor state JSON malformed");
   }
@@ -200,8 +205,12 @@ function decodeCursor(token, secret) {
 }
 
 function _resolveLimit(opts) {
-  var max = (typeof opts.max === "number" && opts.max > 0) ? opts.max : DEFAULT_MAX_LIMIT;
-  var def = (typeof opts.default === "number" && opts.default > 0) ? opts.default : DEFAULT_LIMIT;
+  nb.requirePositiveFiniteIntIfPresent(opts.max,
+    "max", PaginationError, "pagination/bad-opt");
+  nb.requirePositiveFiniteIntIfPresent(opts.default,
+    "default", PaginationError, "pagination/bad-opt");
+  var max = opts.max || DEFAULT_MAX_LIMIT;
+  var def = opts.default || DEFAULT_LIMIT;
   var requested = parseInt(opts.limit, 10);
   if (isNaN(requested) || requested < 1) requested = def;
   if (requested > max) requested = max;
@@ -247,9 +256,13 @@ function _normalizeOrderBy(opts) {
       "orderBy must be a string, array, or omitted; got " + typeof raw);
   }
   for (var i = 0; i < entries.length; i++) {
-    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(entries[i].column)) {
+    if (typeof entries[i].column !== "string" ||
+        entries[i].column.length === 0 ||
+        entries[i].column.length > safeSql.MAX_IDENTIFIER_LENGTH ||
+        !safeSql.DEFAULT_IDENTIFIER_RE.test(entries[i].column)) {
       throw new PaginationError("pagination/bad-orderby",
-        "orderBy column must match /^[A-Za-z_][A-Za-z0-9_]*$/ (identifier-safe), got " +
+        "orderBy column must match " + safeSql.DEFAULT_IDENTIFIER_RE +
+        " and be 1.." + safeSql.MAX_IDENTIFIER_LENGTH + " chars, got " +
         JSON.stringify(entries[i].column));
     }
   }
@@ -405,9 +418,11 @@ async function offset(query, opts) {
   var orderBy = typeof opts.orderBy === "string" && opts.orderBy.length > 0 ? opts.orderBy : "_id";
   // Same identifier-only check on offset() as cursor() — orderBy passes
   // through to the db Query; throw at call site to prevent SQL injection.
-  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(orderBy)) {
+  if (orderBy.length > safeSql.MAX_IDENTIFIER_LENGTH ||
+      !safeSql.DEFAULT_IDENTIFIER_RE.test(orderBy)) {
     throw new PaginationError("pagination/bad-orderby",
-      "offset: orderBy must match /^[A-Za-z_][A-Za-z0-9_]*$/ (identifier-safe), got " +
+      "offset: orderBy must match " + safeSql.DEFAULT_IDENTIFIER_RE +
+      " and be 1.." + safeSql.MAX_IDENTIFIER_LENGTH + " chars, got " +
       JSON.stringify(orderBy));
   }
   var direction = (opts.direction === "desc") ? "desc" : "asc";

package/lib/parsers/index.js

@@ -65,10 +65,16 @@
  * Error types: each parser exports its own *SafeError class with .code
  * matching the format (xml/..., toml/..., ini/..., yaml/..., env/...).
  */
+var safeEnv  = require("./safe-env");
+var safeIni  = require("./safe-ini");
+var safeToml = require("./safe-toml");
+var safeXml  = require("./safe-xml");
+var safeYaml = require("./safe-yaml");
+
 module.exports = {
-  xml:  require("./safe-xml"),
-  toml: require("./safe-toml"),
-  yaml: require("./safe-yaml"),
-  env:  require("./safe-env"),
-  ini:  require("./safe-ini"),
+  xml:  safeXml,
+  toml: safeToml,
+  yaml: safeYaml,
+  env:  safeEnv,
+  ini:  safeIni,
 };

package/lib/parsers/safe-env.js

@@ -56,13 +56,26 @@
 
 var C = require("../constants");
 var atomicFile = require("../atomic-file");
+var lazyRequire = require("../lazy-require");
+var numericBounds = require("../numeric-bounds");
 var safeBuffer = require("../safe-buffer");
 var safeJson = require("../safe-json");
 var { FrameworkError } = require("../framework-error");
 var { boot } = require("../log");
 
+// Lazy require for audit — eager-loading audit at top of file forms a
+// load cycle: vault.init → passphrase-source → safe-env → audit →
+// (transitively) vault, which leaves safe-env's module.exports
+// half-built when vault first reaches readVar. Defer audit resolution
+// until the first emit-driven call.
+var auditModule = lazyRequire(function () { return require("../audit"); });
+
 var log = boot("env");
 
+// parseInt radix — named so the call site doesn't carry a bare 16
+// integer literal that reads as a byte count.
+var RADIX_HEX = 0x10;
+
 class SafeEnvError extends FrameworkError {
   constructor(message, code, line) {
     super(line != null ? message + " at line " + line : message);
@@ -75,7 +88,7 @@ class SafeEnvError extends FrameworkError {
 
 var DEFAULTS = {
   maxBytes:       C.BYTES.kib(64),
-  maxKeys:        1000,
+  maxKeys:        1_000,
   keyShape:       /^[A-Z_][A-Z0-9_]*$/,
   applyToProcess: false,
   allowOverwrite: false,
@@ -89,10 +102,21 @@ var POISONED_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 
 function parse(input, opts) {
   opts = opts || {};
-  var maxBytes = (typeof opts.maxBytes === "number" && opts.maxBytes > 0)
+  // Validate operator-supplied numeric opts via lib/numeric-bounds —
+  // Infinity / NaN / negative / non-integer all bypass the `> 0` shape
+  // and silently lift the DoS cap they were meant to enforce.
+  if (opts.maxBytes !== undefined && !numericBounds.isPositiveFiniteInt(opts.maxBytes)) {
+    throw new SafeEnvError("env.parse: maxBytes must be a positive finite integer; got " +
+      numericBounds.shape(opts.maxBytes), "env/bad-opt");
+  }
+  if (opts.maxKeys !== undefined && !numericBounds.isPositiveFiniteInt(opts.maxKeys)) {
+    throw new SafeEnvError("env.parse: maxKeys must be a positive finite integer; got " +
+      numericBounds.shape(opts.maxKeys), "env/bad-opt");
+  }
+  var maxBytes = opts.maxBytes !== undefined
     ? Math.min(opts.maxBytes, C.BYTES.mib(1)) : DEFAULTS.maxBytes;
-  var maxKeys = (typeof opts.maxKeys === "number" && opts.maxKeys > 0)
-    ? Math.min(opts.maxKeys, 100000) : DEFAULTS.maxKeys;
+  var maxKeys = opts.maxKeys !== undefined
+    ? Math.min(opts.maxKeys, 100_000) : DEFAULTS.maxKeys;
   var keyShape = opts.keyShape instanceof RegExp ? opts.keyShape : DEFAULTS.keyShape;
 
   input = safeBuffer.normalizeText(input, {
@@ -123,7 +147,7 @@ function parse(input, opts) {
     if (eqIdx < 0) {
       throw new SafeEnvError("missing '=' separator", "env/bad-line", lineNumber);
     }
-    var key = trimmed.substring(0, eqIdx).replace(/[ \t]+$/, "");
+    var key = trimmed.substring(0, eqIdx).replace(safeBuffer.TRAILING_HSPACE_RE, "");
     var rest = trimmed.substring(eqIdx + 1);
 
     if (key.length === 0) {
@@ -163,9 +187,9 @@ function parse(input, opts) {
       // (so a value like `KEY=color#red` keeps the literal `#`).
       var commentMatch = rest.match(/^([^\s#]*(?:[ \t]+[^#\s]+)*)\s+#.*$/);
       if (commentMatch) {
-        value = commentMatch[1].replace(/[ \t]+$/, "");
+        value = commentMatch[1].replace(safeBuffer.TRAILING_HSPACE_RE, "");
       } else {
-        value = rest.replace(/[ \t]+$/, "");
+        value = rest.replace(safeBuffer.TRAILING_HSPACE_RE, "");
       }
       // Reject `$VAR` style references — explicit error so operators
       // see the policy rather than silently getting unexpanded text.
@@ -209,10 +233,10 @@ function _decodeDoubleQuoted(rest, lineNumber) {
         case "$":  out += "$";  i += 2; continue;  // literal $ escape
         case "u": {
           var hex = rest.substring(i + 2, i + 6);
-          if (!/^[0-9a-fA-F]{4}$/.test(hex)) {
+          if (!safeBuffer.isHex(hex, 4)) {
             throw new SafeEnvError("bad \\u escape", "env/bad-escape", lineNumber);
           }
-          out += String.fromCharCode(parseInt(hex, 16));
+          out += String.fromCharCode(parseInt(hex, RADIX_HEX));
           i += 6;
           continue;
         }
@@ -493,11 +517,9 @@ function _hasNonEmptyDiff(d) {
 function _writeAuditRows(filepath, diff) {
   // Both audit.record and cluster.requireLeader sit downstream — if
   // we're a follower, audit.record will throw NotLeaderError. Catch
-  // silently: a follower's local config-load shouldn't crash because
+  // explicitly: a follower's local config-load shouldn't crash because
   // the cluster's audit chain belongs to the leader.
-  var audit;
-  try { audit = require("./../audit"); }
-  catch (_e) { return; /* audit module not loadable in this context */ }
+  var audit = auditModule();   // resolve the lazy-required audit module
 
   function _safeRecord(action, metadata) {
     try {
@@ -559,7 +581,14 @@ function readVar(name, schema) {
   var type     = schema.type || "string";
   var required = schema.required === true;
   var hasDefault = "default" in schema;
-  var maxBytes = (typeof schema.maxBytes === "number" && schema.maxBytes > 0)
+  if (schema.maxBytes !== undefined && !numericBounds.isPositiveFiniteInt(schema.maxBytes)) {
+    throw new SafeEnvError(
+      "readVar: maxBytes must be a positive finite integer; got " +
+        numericBounds.shape(schema.maxBytes),
+      "env/bad-opt"
+    );
+  }
+  var maxBytes = (schema.maxBytes !== undefined)
     ? schema.maxBytes : READVAR_DEFAULT_MAX_BYTES;
   var strip    = schema.strip === true;