@blamejs/core 0.6.70 → 0.7.0

package/lib/pqc-gate.js

@@ -37,14 +37,16 @@
  * connection lifecycle deterministically.
  */
 var net = require("node:net");
+var C = require("./constants");
 var { PQC_GROUPS } = require("./constants");
+var nb = require("./numeric-bounds");
 var validateOpts = require("./validate-opts");
 var { boot } = require("./log");
 
 var DEFAULT_LOG = boot("pqc-gate");
 var DEFAULT_BYPASS = Object.freeze(["127.0.0.1", "::1", "::ffff:127.0.0.1"]);
-var DEFAULT_CLIENTHELLO_TIMEOUT_MS = 5000;
-var DEFAULT_MAX_CLIENTHELLO_BYTES = 16384;
+var DEFAULT_CLIENTHELLO_TIMEOUT_MS = C.TIME.seconds(5);
+var DEFAULT_MAX_CLIENTHELLO_BYTES = C.BYTES.kib(16);
 
 // TLS handshake_failure alert (fatal). Sent before destroying a socket
 // so a strict TLS client logs a precise reason rather than a vague
@@ -73,7 +75,7 @@ function clientHelloHasPQC(buf) {
   if (buf[5] !== 0x01) return false; // not ClientHello
 
   // Body: version(2) + random(32) = 34 bytes after handshake header
-  var offset = 9 + 2 + 32;
+  var offset = 9 + 2 + C.BYTES.bytes(32);
   if (offset + 1 > recordEnd) return false;
 
   // Session ID: length(1) + data
@@ -153,10 +155,16 @@ function create(opts) {
   }
   var internalHost = typeof opts.internalHost === "string" ? opts.internalHost : "127.0.0.1";
   var bypass       = Array.isArray(opts.bypass) ? opts.bypass.slice() : DEFAULT_BYPASS.slice();
-  var clientHelloTimeoutMs = typeof opts.clientHelloTimeoutMs === "number" && opts.clientHelloTimeoutMs > 0
-    ? opts.clientHelloTimeoutMs : DEFAULT_CLIENTHELLO_TIMEOUT_MS;
-  var maxClientHelloBytes  = typeof opts.maxClientHelloBytes === "number" && opts.maxClientHelloBytes > 0
-    ? opts.maxClientHelloBytes : DEFAULT_MAX_CLIENTHELLO_BYTES;
+  if (opts.clientHelloTimeoutMs !== undefined && !nb.isPositiveFiniteInt(opts.clientHelloTimeoutMs)) {
+    throw new Error("pqc-gate: clientHelloTimeoutMs must be a positive finite integer; got " +
+      nb.shape(opts.clientHelloTimeoutMs));
+  }
+  var clientHelloTimeoutMs = opts.clientHelloTimeoutMs || DEFAULT_CLIENTHELLO_TIMEOUT_MS;
+  if (opts.maxClientHelloBytes !== undefined && !nb.isPositiveFiniteInt(opts.maxClientHelloBytes)) {
+    throw new Error("pqc-gate: maxClientHelloBytes must be a positive finite integer; got " +
+      nb.shape(opts.maxClientHelloBytes));
+  }
+  var maxClientHelloBytes  = opts.maxClientHelloBytes || DEFAULT_MAX_CLIENTHELLO_BYTES;
   var log = opts.log || null;
 
   // Test seams
@@ -204,22 +212,27 @@ function create(opts) {
 
       if (totalLen > maxClientHelloBytes) {
         resolved = true;
-        try { clearTimeoutFn(timeout); } catch (_e) {}
+        try { clearTimeoutFn(timeout); } catch (_e) { /* timer may already have fired */ }
         _logVia(log, "warn", "ClientHello too large", { ip: clientIp, size: totalLen });
-        try { socket.destroy(); } catch (_e) {}
+        try { socket.destroy(); } catch (_e) { /* socket may already be torn down */ }
         return;
       }
 
       // Reject non-handshake first byte immediately
       if (totalLen >= 1 && chunks[0][0] !== 0x16) {
         resolved = true;
-        try { clearTimeoutFn(timeout); } catch (_e) {}
-        try { socket.destroy(); } catch (_e) {}
+        try { clearTimeoutFn(timeout); } catch (_e) { /* timer may already have fired */ }
+        try { socket.destroy(); } catch (_e) { /* socket may already be torn down */ }
         return;
       }
 
       if (totalLen < 5) return; // need at least the record header
 
+      // TLS ClientHello parser needs streaming peek (re-concat on
+      // each chunk to read the record-length prefix) before deciding
+      // whether more data is needed. boundedChunkCollector is append-
+      // only with no peek, doesn't fit.
+      // allow:handrolled-buffer-collect — see comment above
       var buf = Buffer.concat(chunks);
       var recordLen = buf.readUInt16BE(3);
       var neededLen = 5 + recordLen;
@@ -227,7 +240,7 @@ function create(opts) {
       if (buf.length < Math.min(neededLen, maxClientHelloBytes)) return;
 
       resolved = true;
-      try { clearTimeoutFn(timeout); } catch (_e) {}
+      try { clearTimeoutFn(timeout); } catch (_e) { /* timer may already have fired */ }
       socket.removeListener("data", onData);
       socket.pause();
 
@@ -238,17 +251,17 @@ function create(opts) {
           "connection rejected — no PQC group in ClientHello", { ip: clientIp });
         try {
           socket.write(TLS_ALERT_HANDSHAKE_FAILURE, function () {
-            try { socket.destroy(); } catch (_e) {}
+            try { socket.destroy(); } catch (_e) { /* socket may already be torn down */ }
           });
         } catch (_e) {
-          try { socket.destroy(); } catch (_e2) {}
+          try { socket.destroy(); } catch (_e2) { /* socket may already be torn down */ }
         }
       }
     });
 
     socket.on("error", function () {
       resolved = true;
-      try { clearTimeoutFn(timeout); } catch (_e) {}
+      try { clearTimeoutFn(timeout); } catch (_e) { /* timer may already have fired */ }
     });
 
     socket.resume();

package/lib/protobuf-encoder.js

@@ -27,9 +27,15 @@
  * the caller can splice in any order.
  */
 
+var C = require("./constants");
+
 var WIRE_VARINT  = 0;
 var WIRE_64BIT   = 1;
 var WIRE_LDELIM  = 2;
+// Varint base — each byte carries 7 payload bits + 1 continuation bit.
+var VARINT_BASE = 128;
+// Wire-format byte counts for fixed-size fields.
+var FIXED64_BYTES = C.BYTES.bytes(8);
 // WIRE_32BIT (5) is unused — fixed32 / sfixed32 / float aren't on the
 // OTel logs schema. Reserved here as documentation; un-comment + add
 // helpers when a future caller (metrics histograms?) needs them.
@@ -67,7 +73,7 @@ function _writeVarint(value) {
     var n = value;
     do {
       var byte = n & 0x7f;
-      n = Math.floor(n / 128);
+      n = Math.floor(n / VARINT_BASE);
       if (n > 0) byte |= 0x80;
       bytes.push(byte);
     } while (n > 0);
@@ -97,7 +103,7 @@ function bool(fieldNumber, value) {
 function fixed64(fieldNumber, value) {
   // For OTel: time_unix_nano fields are fixed64. Accept BigInt or
   // Number; encode as little-endian 8 bytes.
-  var buf = Buffer.alloc(8);
+  var buf = Buffer.alloc(FIXED64_BYTES);
   if (typeof value === "bigint") {
     buf.writeBigUInt64LE(value, 0);
   } else {
@@ -115,7 +121,7 @@ function fixed64(fieldNumber, value) {
 
 function double(fieldNumber, value) {
   if (value === 0) return Buffer.alloc(0);  // proto3 default
-  var buf = Buffer.alloc(8);
+  var buf = Buffer.alloc(FIXED64_BYTES);
   buf.writeDoubleLE(value, 0);
   return Buffer.concat([_tag(fieldNumber, WIRE_64BIT), buf]);
 }

package/lib/protocol-dispatcher.js

@@ -45,6 +45,7 @@
  * operator with multiple dispatchers (queue + log-stream) reading the
  * error message knows which one rejected the protocol.
  */
+var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
 // Default error class — operators / test fixtures that don't want to
@@ -55,13 +56,13 @@ var ProtocolDispatcherError = defineClass("ProtocolDispatcherError", { withStatu
 // boot, not first request.
 function _validateConfig(opts) {
   if (!opts || typeof opts !== "object") {
-    throw new Error("protocolDispatcher.create: opts is required");
-  }
-  if (typeof opts.name !== "string" || opts.name.length === 0) {
-    throw new Error("protocolDispatcher.create: opts.name (string) is required");
+    throw new ProtocolDispatcherError("protocol-dispatcher/bad-opts",
+      "protocolDispatcher.create: opts is required");
   }
+  validateOpts.requireNonEmptyString(opts.name, "protocolDispatcher.create: opts.name", ProtocolDispatcherError, "protocol-dispatcher/bad-name");
   if (!opts.protocols || typeof opts.protocols !== "object" || Array.isArray(opts.protocols)) {
-    throw new Error("protocolDispatcher.create: opts.protocols (object) is required");
+    throw new ProtocolDispatcherError("protocol-dispatcher/bad-protocols",
+      "protocolDispatcher.create: opts.protocols (object) is required");
   }
   // Each protocol value should look like a module with .create — operators
   // wiring a typo'd reference get a clearer error than "undefined is not
@@ -70,24 +71,28 @@ function _validateConfig(opts) {
   for (var i = 0; i < pkeys.length; i++) {
     var p = opts.protocols[pkeys[i]];
     if (!p || typeof p !== "object" || typeof p.create !== "function") {
-      throw new Error("protocolDispatcher.create: opts.protocols['" + pkeys[i] +
+      throw new ProtocolDispatcherError("protocol-dispatcher/bad-protocol-entry",
+        "protocolDispatcher.create: opts.protocols['" + pkeys[i] +
         "'] must be an object with a .create function (got " +
         (p === null ? "null" : typeof p) + ")");
     }
   }
   if (opts.deferred !== undefined && opts.deferred !== null) {
     if (typeof opts.deferred !== "object" || Array.isArray(opts.deferred)) {
-      throw new Error("protocolDispatcher.create: opts.deferred must be an object (or omitted)");
+      throw new ProtocolDispatcherError("protocol-dispatcher/bad-deferred",
+        "protocolDispatcher.create: opts.deferred must be an object (or omitted)");
     }
   }
   if (opts.fallbackProtocol !== undefined && opts.fallbackProtocol !== null) {
     if (typeof opts.fallbackProtocol !== "string" || opts.fallbackProtocol.length === 0) {
-      throw new Error("protocolDispatcher.create: opts.fallbackProtocol must be a non-empty string (or omitted)");
+      throw new ProtocolDispatcherError("protocol-dispatcher/bad-fallback",
+        "protocolDispatcher.create: opts.fallbackProtocol must be a non-empty string (or omitted)");
     }
   }
   if (opts.errorClass !== undefined && opts.errorClass !== null) {
     if (typeof opts.errorClass !== "function") {
-      throw new Error("protocolDispatcher.create: opts.errorClass must be a constructor (or omitted)");
+      throw new ProtocolDispatcherError("protocol-dispatcher/bad-error-class",
+        "protocolDispatcher.create: opts.errorClass must be a constructor (or omitted)");
     }
   }
 }
@@ -122,7 +127,12 @@ function create(opts) {
       throw _err("PROTOCOL_NOT_IMPLEMENTED", msg);
     }
     if (!Object.prototype.hasOwnProperty.call(protocols, protocol)) {
-      var known = Object.keys(protocols).sort().join(", ");
+      // Diagnostic listing only — sorted protocol-name list for the
+      // operator-facing error message; not a canonicalization-for-hash
+      // walk, so the bare keys-then-sort is correct here.
+      var protoKeys = Object.keys(protocols);
+      protoKeys.sort();
+      var known = protoKeys.join(", ");
       throw _err("UNKNOWN_PROTOCOL",
         "unknown " + name + " protocol: '" + protocol +
         "' (known: " + (known || "[none]") + ")");
@@ -130,11 +140,18 @@ function create(opts) {
     return protocols[protocol];
   }
 
+  // Same diagnostic-only sort for the dispatcher's introspection
+  // surface — operators read these to confirm wiring at boot.
+  var protocolNames = Object.keys(protocols);
+  protocolNames.sort();
+  var deferredNames = Object.keys(deferred);
+  deferredNames.sort();
+
   return {
     name:      name,
     resolve:   resolve,
-    protocols: Object.keys(protocols).sort(),
-    deferred:  Object.keys(deferred).sort(),
+    protocols: protocolNames,
+    deferred:  deferredNames,
   };
 }
 

package/lib/pubsub-redis.js

@@ -21,9 +21,11 @@
  * applied by `lib/pubsub.js`; this backend doesn't add any naming
  * conventions of its own.
  */
-var crypto = require("node:crypto");
-var redisClient = require("./redis-client");
+var C = require("./constants");
+var fwCrypto = require("./crypto");
 var lazyRequire = require("./lazy-require");
+var redisClient = require("./redis-client");
+var safeJson = require("./safe-json");
 
 var logger = lazyRequire(function () { return require("./log").boot("pubsub-redis"); });
 
@@ -37,7 +39,7 @@ function create(opts) {
   // the local dispatch synchronously before awaiting the remote
   // write — without this filter every same-instance publish would
   // double-fire local handlers).
-  var instanceNonce = crypto.randomBytes(8).toString("hex");
+  var instanceNonce = fwCrypto.generateToken(C.BYTES.bytes(8));
 
   var clientOpts = {
     url:                  opts.redisUrl,
@@ -69,16 +71,21 @@ function create(opts) {
     var payloadStr = Buffer.isBuffer(rawPayload)
       ? rawPayload.toString("utf8") : String(rawPayload);
     var inner = payloadStr;
+    // Redis pubsub frames are bounded by Redis's own bulk-string limit;
+    // cap the envelope parse at 16 MiB to keep this hot path fast and
+    // defeat a hostile publisher inflating one frame to 512 MB.
     try {
-      var envelope = JSON.parse(payloadStr);
+      var envelope = safeJson.parse(payloadStr, { maxBytes: C.BYTES.mib(16) });
       if (envelope && typeof envelope === "object" &&
           typeof envelope._psnode === "string") {
         if (envelope._psnode === instanceNonce) return;  // own publish
         inner = JSON.stringify(envelope.p);
       }
-    } catch (_e) {
+    } catch (e) {
       // Not an envelope — forward as-is for operators publishing raw
-      // strings via redis CLI etc.
+      // strings via redis CLI etc. (Parse failure is the expected path
+      // for raw-string publishers; not log-worthy.)
+      void e;
     }
     try {
       savedOnRemoteMessage(ev.channel, inner, {
@@ -138,11 +145,21 @@ function create(opts) {
     stopped = true;
     savedOnRemoteMessage = null;
     if (subscriberConn) {
-      try { await subscriberConn.close(); } catch (_e) {}
+      try { await subscriberConn.close(); }
+      catch (e) {
+        try { logger().debug("subscriber-close-failed: " +
+          ((e && e.message) || String(e))); }
+        catch (_e) { /* logger best-effort */ }
+      }
       subscriberConn = null;
     }
     if (publisherConn) {
-      try { await publisherConn.close(); } catch (_e) {}
+      try { await publisherConn.close(); }
+      catch (e) {
+        try { logger().debug("publisher-close-failed: " +
+          ((e && e.message) || String(e))); }
+        catch (_e) { /* logger best-effort */ }
+      }
       publisherConn = null;
     }
   }

package/lib/pubsub.js

@@ -72,6 +72,7 @@
  * matches client-side, redis backend uses PSUBSCRIBE, local backend
  * matches client-side too).
  */
+var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var safeJson = require("./safe-json");
 var validateOpts = require("./validate-opts");
@@ -79,6 +80,11 @@ var { defineClass } = require("./framework-error");
 
 var audit  = lazyRequire(function () { return require("./audit"); });
 var logger = lazyRequire(function () { return require("./log").boot("pubsub"); });
+// Backend dispatch — lazy so pubsub-cluster / pubsub-redis (which depend
+// on this file's exports for their own framework integration) don't
+// load-cycle on first import.
+var pubsubCluster = lazyRequire(function () { return require("./pubsub-cluster"); });
+var pubsubRedis   = lazyRequire(function () { return require("./pubsub-redis"); });
 
 var PubsubError = defineClass("PubsubError");
 
@@ -99,29 +105,95 @@ function _resolveBackend(opts) {
     return { name: "local", publishRemote: null, start: null, stop: null };
   }
   if (requested === "cluster") {
-    return require("./pubsub-cluster").create(opts);
+    return pubsubCluster().create(opts);
   }
   if (requested === "redis") {
-    return require("./pubsub-redis").create(opts);
+    return pubsubRedis().create(opts);
   }
   throw _err("UNKNOWN_BACKEND",
     "pubsub: unknown backend '" + requested +
     "' (must be 'local', 'cluster', 'redis', or { publishRemote, start, stop })");
 }
 
+// Glob-style: '*' matches any single segment (no '.'); '**' matches any
+// suffix. Operators wanting full Redis-pattern semantics use the redis
+// backend's PSUBSCRIBE which the redis client routes natively.
+//
+// Hand-rolled matcher (no `new RegExp` from operator input) so a hostile
+// operator-supplied pattern can't compile a backtracking regex (ReDoS).
+// Channel length is bounded to defeat pathological inputs even on
+// well-behaved patterns; pubsub channel names in practice are well under
+// 1 KiB and the framework's own callers never exceed it.
+var _MAX_CHANNEL_LEN = C.BYTES.kib(1);
+
+function _matchGlobPart(part, channel, fromIdx) {
+  // Within one '**'-bounded part, match a sequence of '*'-separated
+  // literals against channel[fromIdx..] WITHOUT crossing '.' boundaries.
+  // Returns the matched length, or -1 on no match.
+  var segments = part.split("*");
+  var pos = fromIdx;
+  for (var i = 0; i < segments.length; i++) {
+    var lit = segments[i];
+    if (i === 0) {
+      if (channel.substr(pos, lit.length) !== lit) return -1;
+      pos += lit.length;
+    } else if (i === segments.length - 1) {
+      // Trailing literal: search forward in this segment (no '.' jump).
+      var hardStop = channel.indexOf(".", pos);
+      var searchEnd = hardStop === -1 ? channel.length : hardStop;
+      if (lit === "") { pos = searchEnd; break; }
+      var found = channel.lastIndexOf(lit, searchEnd - lit.length);
+      if (found < pos) return -1;
+      pos = found + lit.length;
+    } else {
+      // Middle literal: find next occurrence within current segment.
+      var hardStop2 = channel.indexOf(".", pos);
+      var searchEnd2 = hardStop2 === -1 ? channel.length : hardStop2;
+      var f2 = channel.indexOf(lit, pos);
+      if (f2 < 0 || f2 + lit.length > searchEnd2) return -1;
+      pos = f2 + lit.length;
+    }
+  }
+  return pos - fromIdx;
+}
+
 function _matchPattern(pattern, channel) {
-  // Glob-style: '*' matches any single segment; '**' matches any
-  // suffix. Operators wanting full Redis-pattern semantics use the
-  // redis backend's PSUBSCRIBE which the redis client routes natively.
   if (pattern === channel) return true;
+  if (typeof channel !== "string" || channel.length > _MAX_CHANNEL_LEN) return false;
+  if (typeof pattern !== "string" || pattern.length > _MAX_CHANNEL_LEN) return false;
   if (pattern.indexOf("*") === -1) return false;
-  var rx = "^" + pattern
-    .split("**").map(function (p) {
-      return p.split("*").map(function (s) {
-        return s.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
-      }).join("[^.]*");
-    }).join(".*") + "$";
-  return new RegExp(rx).test(channel);
+  // Split on '**' — each part is a glob that matches without crossing '.';
+  // between parts any char (including '.') is consumed greedily.
+  var parts = pattern.split("**");
+  if (parts.length === 1) {
+    // No '**'; pattern must consume the entire channel and only '*'
+    // (single-segment) wildcards are allowed.
+    var len = _matchGlobPart(parts[0], channel, 0);
+    return len === channel.length;
+  }
+  // Anchor the head.
+  var headLen = _matchGlobPart(parts[0], channel, 0);
+  if (headLen < 0) return false;
+  var idx = headLen;
+  // Match middle parts: each must appear somewhere after idx, in order,
+  // separated by arbitrary content (since '**' consumes anything).
+  for (var p = 1; p < parts.length - 1; p++) {
+    var found = -1;
+    for (var probe = idx; probe <= channel.length; probe++) {
+      var n = _matchGlobPart(parts[p], channel, probe);
+      if (n >= 0) { found = probe + n; break; }
+    }
+    if (found < 0) return false;
+    idx = found;
+  }
+  // Tail: must reach end of channel.
+  var tail = parts[parts.length - 1];
+  if (tail === "") return true;
+  for (var t = idx; t <= channel.length; t++) {
+    var tn = _matchGlobPart(tail, channel, t);
+    if (tn >= 0 && t + tn === channel.length) return true;
+  }
+  return false;
 }
 
 function create(opts) {

package/lib/queue-local.js

@@ -35,6 +35,7 @@ var C = require("./constants");
 var { generateToken } = require("./crypto");
 var cryptoField = require("./crypto-field");
 var lazyRequire = require("./lazy-require");
+var nb = require("./numeric-bounds");
 var safeJson = require("./safe-json");
 var scheduler = require("./scheduler");
 var { QueueError } = require("./framework-error");
@@ -149,7 +150,7 @@ function create(_config) {
     var effectiveAvailableAt = (dependsOn ? FLOW_BLOCKED_AVAILABLE_AT : availableAt);
 
     var row = {
-      _id:             generateToken(16),
+      _id:             generateToken(C.BYTES.bytes(16)),
       queueName:       queueName,
       payload:         payload === undefined ? null : JSON.stringify(payload),
       status:          "pending",
@@ -305,7 +306,7 @@ function create(_config) {
       var sib = siblings[i];
       if (!sib.dependsOn) continue;
       var deps;
-      try { deps = JSON.parse(sib.dependsOn); }
+      try { deps = safeJson.parse(sib.dependsOn, { maxBytes: C.BYTES.mib(1) }); }
       catch (_e) { continue; }
       if (!Array.isArray(deps) || deps.length === 0) continue;
       // Resolve which deps are satisfied. Each dep is either a jobId
@@ -385,7 +386,15 @@ function create(_config) {
 
   async function dlqList(queueName, opts) {
     opts = opts || {};
-    var limit = (typeof opts.limit === "number" && opts.limit > 0) ? opts.limit : 100;
+    var limit = 100;
+    if (opts.limit !== undefined) {
+      if (!nb.isPositiveFiniteInt(opts.limit)) {
+        throw new QueueError("queue/bad-opt",
+          "queue.dlqList: limit must be a positive finite integer; got " +
+            nb.shape(opts.limit), true);
+      }
+      limit = opts.limit;
+    }
     var rows = await clusterStorage.executeAll(
       "SELECT _id, queueName, payload, status, enqueuedAt, finishedAt, " +
       "       attempts, maxAttempts, lastError, traceId, classification " +
@@ -399,7 +408,7 @@ function create(_config) {
       return {
         jobId:       row._id,
         queueName:   row.queueName,
-        payload:     unsealed.payload ? JSON.parse(unsealed.payload) : null,
+        payload:     unsealed.payload ? safeJson.parse(unsealed.payload, { maxBytes: C.BYTES.mib(64) }) : null,
         status:      row.status,
         enqueuedAt:  Number(row.enqueuedAt),
         finishedAt:  row.finishedAt ? Number(row.finishedAt) : null,

package/lib/queue-redis.js

@@ -350,7 +350,7 @@ function create(opts) {
     } else {
       availableAt = nowMs + (opts2.delaySeconds ? C.TIME.seconds(opts2.delaySeconds) : 0);
     }
-    var jobId = generateToken(16);
+    var jobId = generateToken(C.BYTES.bytes(16));
     var row = {
       _id:             jobId,
       queueName:       queueName,
@@ -540,7 +540,7 @@ function create(opts) {
       var status   = rv[1] && (Buffer.isBuffer(rv[1]) ? rv[1].toString("utf8") : String(rv[1]));
       if (!rawDeps || status !== "pending") continue;
       var deps;
-      try { deps = JSON.parse(rawDeps); }
+      try { deps = safeJson.parse(rawDeps, { maxBytes: C.BYTES.mib(1) }); }
       catch (_e) { continue; }
       if (!Array.isArray(deps) || deps.length === 0) continue;
 

package/lib/queue-sqs.js

@@ -45,6 +45,7 @@
  * local + redis backends.
  */
 var sigv4 = require("./object-store/sigv4");
+var C = require("./constants");
 var httpClient = require("./http-client");
 var cryptoField = require("./crypto-field");
 var safeJson = require("./safe-json");
@@ -90,13 +91,16 @@ function create(opts) {
 
   var region          = opts.region;
   var endpoint        = _resolveEndpoint(opts);
-  var endpointUrl     = new URL(endpoint);
+  var allowedProtocols = opts.allowedProtocols || safeUrl.ALLOW_HTTP_TLS;
+  var endpointUrl     = safeUrl.parse(endpoint, {
+    errorClass:       QueueError,
+    allowedProtocols: allowedProtocols,
+  });
   var accessKeyId     = opts.accessKeyId;
   var secretAccessKey = opts.secretAccessKey;
   var sessionToken    = opts.sessionToken || null;
   var accountId       = opts.accountId ? String(opts.accountId) : null;
   var timeoutMs       = opts.timeoutMs;
-  var allowedProtocols = opts.allowedProtocols || safeUrl.ALLOW_HTTP_TLS;
   var allowInternal   = opts.allowInternal != null ? opts.allowInternal : null;
   var visibilityTimeoutSec = Number(opts.visibilityTimeoutSec) || DEFAULT_VISIBILITY_TIMEOUT_SEC;
   var waitTimeSec     = Number(opts.waitTimeSec) || DEFAULT_WAIT_TIME_SEC;
@@ -115,15 +119,16 @@ function create(opts) {
       "Content-Length": String(bodyBuf.length),
     };
     var signed = sigv4.signRequest({
-      method:          "POST",
-      url:             endpointUrl,
-      headers:         headers,
-      payloadHash:     _payloadHash(bodyBuf),
-      region:          region,
-      service:         "sqs",
-      accessKeyId:     accessKeyId,
-      secretAccessKey: secretAccessKey,
-      sessionToken:    sessionToken,
+      method:           "POST",
+      url:              endpointUrl,
+      headers:          headers,
+      payloadHash:      _payloadHash(bodyBuf),
+      region:           region,
+      service:          "sqs",
+      accessKeyId:      accessKeyId,
+      secretAccessKey:  secretAccessKey,
+      sessionToken:     sessionToken,
+      allowedProtocols: allowedProtocols,
     });
     var reqOpts = {
       method:           "POST",
@@ -151,7 +156,7 @@ function create(opts) {
   async function enqueue(queueName, payload, enqueueOpts) {
     enqueueOpts = enqueueOpts || {};
     var queueUrl = queueUrlResolver(queueName);
-    var jobId = generateToken(16);
+    var jobId = generateToken(C.BYTES.bytes(16));
     var sealed = cryptoField.sealRow("_blamejs_jobs", {
       _id:           jobId,
       queueName:     queueName,
@@ -168,8 +173,8 @@ function create(opts) {
     };
     var delaySeconds = enqueueOpts.delaySeconds;
     if (typeof delaySeconds === "number" && delaySeconds > 0) {
-      // SQS hard cap is 900s.
-      sqsBody.DelaySeconds = Math.min(900, Math.floor(delaySeconds));
+      // SQS hard cap is 900s (15 min).
+      sqsBody.DelaySeconds = Math.min(C.TIME.minutes(15) / C.TIME.seconds(1), Math.floor(delaySeconds));
     }
     var rv = await _post("SendMessage", sqsBody);
     return rv && (rv.MessageId || jobId);
@@ -203,7 +208,7 @@ function create(opts) {
       var payload;
       try {
         payload = unsealed.payload != null
-          ? JSON.parse(unsealed.payload) : null;
+          ? safeJson.parse(unsealed.payload, { maxBytes: C.BYTES.mib(64) }) : null;
       } catch (_e) { payload = unsealed.payload; }
       out.push({
         jobId:         unsealed._id,
@@ -211,7 +216,7 @@ function create(opts) {
         payload:       payload,
         attempts:      Number(unsealed.attempts) || 0,
         enqueuedAt:    Number(unsealed.enqueuedAt) || null,
-        leaseExpiresAt: Date.now() + (visTimeout * 1000),
+        leaseExpiresAt: Date.now() + C.TIME.seconds(visTimeout),
         // SQS-specific: receipt handle is the only way to delete /
         // change visibility / extend — surface it for the framework
         // wrapper.

package/lib/queue.js

@@ -34,6 +34,7 @@ var C = require("./constants");
 var clusterStorage = require("./cluster-storage");
 var crypto = require("./crypto");
 var lazyRequire = require("./lazy-require");
+var { boot } = require("./log");
 var numericChecks = require("./numeric-checks");
 var observability = require("./observability");
 var protocolDispatcher = require("./protocol-dispatcher");
@@ -44,6 +45,8 @@ var retryHelper = require("./retry");
 var safeAsync = require("./safe-async");
 var { QueueError } = require("./framework-error");
 
+var log = boot("queue");
+
 var dispatcher = protocolDispatcher.create({
   name:       "queue",
   errorClass: QueueError,
@@ -180,8 +183,8 @@ function consume(queueName, handler, opts) {
   opts = opts || {};
   var b = _backendFor(opts);
   var concurrency      = opts.concurrency      || 1;
-  var leaseDurationMs  = opts.leaseDurationMs  || 30000;
-  var pollIntervalMs   = opts.pollIntervalMs   || 1000;
+  var leaseDurationMs  = opts.leaseDurationMs  || C.TIME.seconds(30);
+  var pollIntervalMs   = opts.pollIntervalMs   || C.TIME.seconds(1);
   var fastPollMs       = opts.fastPollMs       || 50;
 
   // Rate-limit: { max, perSeconds } caps how many handler INVOCATIONS
@@ -235,7 +238,8 @@ function consume(queueName, handler, opts) {
     abortCtrl:    abortCtrl,
     cancel:       function () {
       state.cancelled = true;
-      try { abortCtrl.abort(); } catch (_e) {}
+      try { abortCtrl.abort(); }
+      catch (e) { log.debug("cancel-cleanup-failed", { op: "abortCtrl.abort", error: e.message }); }
     },
   };
   consumers.push(state);
@@ -575,7 +579,7 @@ function enqueueFlow(spec) {
     return Promise.reject(e);
   }
 
-  var flowId = "flow-" + crypto.generateToken(8);
+  var flowId = "flow-" + crypto.generateToken(C.BYTES.bytes(8));
 
   return observability.tap("queue.enqueueFlow",
     { queueName: spec.queueName, flowId: flowId, childCount: spec.children.length },