@blamejs/core 0.6.70 → 0.7.0

package/lib/seeders.js

@@ -56,11 +56,17 @@
 
 var path = require("path");
 var atomicFile = require("./atomic-file");
+var C = require("./constants");
+var dbSchema = require("./db-schema");
 var lazyRequire = require("./lazy-require");
+var { boot } = require("./log");
+var migrationFiles = require("./migration-files");
 var requestHelpers = require("./request-helpers");
 var validateOpts = require("./validate-opts");
 var { SeederError } = require("./framework-error");
 
+var log = boot("seeders");
+
 var dbModule = lazyRequire(function () { return require("./db"); });
 var observability = lazyRequire(function () { return require("./observability"); });
 
@@ -76,14 +82,33 @@ var Q_LOCK_TABLE    = '"' + LOCK_TABLE    + '"';
 
 // Filename grammar: leading numeric prefix (any width), '-', non-empty
 // body of [A-Za-z0-9_-], '.js'. Same shape as migrations to avoid
-// "two formats" cognitive load.
-var FILE_RE = /^(\d+)-([A-Za-z0-9_-]+)\.js$/;
+// "two formats" cognitive load. Length capped before the regex test so
+// a hostile directory listing can't drive the engine against an
+// unbounded filename string.
+var FILE_RE = migrationFiles.MIGRATION_FILE_RE;
+var FILE_NAME_MAX = 255;
+
+function _isSeedFile(name) {
+  return typeof name === "string" &&
+         name.length > 0 &&
+         name.length <= FILE_NAME_MAX &&
+         FILE_RE.test(name);
+}
 
 // Env names allowed in directory paths and `envs:` declarations.
 // Lowercase letters / digits / hyphens / underscores. Empty / weird
 // chars rejected so we never join an attacker-controlled segment into
-// require() paths.
+// require() paths. Length capped before the regex test so an unbounded
+// operator-supplied env name can't drive the engine.
 var ENV_RE = /^[a-z0-9_-]+$/;
+var ENV_NAME_MAX = C.BYTES.bytes(64);
+
+function _isEnvName(value) {
+  return typeof value === "string" &&
+         value.length > 0 &&
+         value.length <= ENV_NAME_MAX &&
+         ENV_RE.test(value);
+}
 
 var DEFAULTS = Object.freeze({
   auditApplied:      true,
@@ -93,15 +118,7 @@ var DEFAULTS = Object.freeze({
 
 // Bracket-notation wrapper for the SQLite handle's exec method —
 // matches lib/migrations.js convention for hook-token avoidance.
-function _runSql(db, sql) {
-  // Two supported handle shapes:
-  //   - raw node:sqlite Database  → db["exec"](sql)
-  //   - b.db framework wrapper    → db.runSql(sql)
-  var rawExec = db["exec"];
-  if (typeof rawExec === "function") return rawExec.call(db, sql);
-  if (typeof db["runSql"] === "function") return db["runSql"](sql);
-  throw _err("BAD_DB", "seeders: db handle exposes no DDL runner (exec / runSql)");
-}
+var _runSql = dbSchema.runSqlOnHandle;
 
 // ---- Call-site validation helpers (throw on bad input) ----
 
@@ -110,42 +127,26 @@ function _validateEnv(name, value) {
     throw _err("BAD_ENV", name + " must be a non-empty string, got " +
       (typeof value) + " " + JSON.stringify(value));
   }
-  if (!ENV_RE.test(value)) {
+  if (!_isEnvName(value)) {
     throw _err("BAD_ENV", name + " must match " + ENV_RE +
-      " (lowercase letters/digits/hyphens/underscores), got " + JSON.stringify(value));
+      " (lowercase letters/digits/hyphens/underscores, max " + ENV_NAME_MAX +
+      " chars), got " + JSON.stringify(value));
   }
 }
 
 function _validateCreateOpts(opts) {
-  if (!opts || typeof opts !== "object") {
-    throw _err("BAD_OPT", "seeders.create: opts must be an object");
-  }
-  if (typeof opts.dir !== "string" || opts.dir.length === 0) {
-    throw _err("BAD_OPT", "seeders.create: dir must be a non-empty string (path to seeders directory)");
-  }
+  validateOpts.requireObject(opts, "seeders.create", SeederError);
+  validateOpts.requireNonEmptyString(opts.dir, "seeders.create: dir", SeederError, "BAD_OPT");
   if (opts.db !== undefined && opts.db !== null) {
     if (typeof opts.db !== "object" || typeof opts.db.prepare !== "function") {
       throw _err("BAD_OPT", "seeders.create: db must be a SQLite-shaped handle (prepare fn)");
     }
   }
-  if (opts.audit !== undefined && opts.audit !== null) {
-    if (typeof opts.audit !== "object" || typeof opts.audit.safeEmit !== "function") {
-      throw _err("BAD_OPT", "seeders.create: audit must be a b.audit-shaped object (safeEmit fn)");
-    }
-  }
-  if (opts.auditApplied !== undefined && typeof opts.auditApplied !== "boolean") {
-    throw _err("BAD_OPT", "seeders.create: auditApplied must be a boolean");
-  }
-  if (opts.auditFailures !== undefined && typeof opts.auditFailures !== "boolean") {
-    throw _err("BAD_OPT", "seeders.create: auditFailures must be a boolean");
-  }
-  if (opts.lockStaleAfterMs !== undefined &&
-      (typeof opts.lockStaleAfterMs !== "number" || !isFinite(opts.lockStaleAfterMs) || opts.lockStaleAfterMs < 0)) {
-    throw _err("BAD_OPT", "seeders.create: lockStaleAfterMs must be a non-negative finite number");
-  }
-  if (opts.clock !== undefined && typeof opts.clock !== "function") {
-    throw _err("BAD_OPT", "seeders.create: clock must be a function");
-  }
+  validateOpts.auditShape(opts.audit, "seeders.create", SeederError);
+  validateOpts.optionalBoolean(opts.auditApplied, "seeders.create: auditApplied", SeederError);
+  validateOpts.optionalBoolean(opts.auditFailures, "seeders.create: auditFailures", SeederError);
+  validateOpts.optionalFiniteNonNegative(opts.lockStaleAfterMs, "seeders.create: lockStaleAfterMs", SeederError);
+  validateOpts.optionalFunction(opts.clock, "seeders.create: clock", SeederError);
 }
 
 // ---- Resolve helpers ----
@@ -167,7 +168,7 @@ function _envDir(rootDir, env) {
 
 function _listSeedFiles(rootDir, env) {
   return atomicFile.listDir(_envDir(rootDir, env), {
-    filter: function (f) { return FILE_RE.test(f); },
+    filter: _isSeedFile,
   }).map(function (e) { return e.name; }).sort();
 }
 
@@ -193,10 +194,10 @@ function _loadSeed(rootDir, env, file) {
         "seed '" + env + "/" + file + "': envs must be a non-empty array of env names");
     }
     for (var i = 0; i < mod.envs.length; i++) {
-      if (typeof mod.envs[i] !== "string" || !ENV_RE.test(mod.envs[i])) {
+      if (!_isEnvName(mod.envs[i])) {
         throw _err("BAD_SEED",
           "seed '" + env + "/" + file + "': envs[" + i + "] '" + mod.envs[i] +
-          "' must match " + ENV_RE);
+          "' must match " + ENV_RE + " (max " + ENV_NAME_MAX + " chars)");
       }
     }
   }
@@ -348,7 +349,13 @@ function _acquireLock(db, lockStaleAfterMs, clock) {
         _runSql(db, "COMMIT");
         return holder;
       } catch (forceErr) {
-        try { _runSql(db, "ROLLBACK"); } catch (_e2) {}
+        try { _runSql(db, "ROLLBACK"); }
+        catch (rollbackErr) {
+          log.debug("rollback-failed", {
+            op: "lock-stale-replace",
+            error: rollbackErr && rollbackErr.message,
+          });
+        }
         throw _err("LOCK_STALE_REPLACE_FAILED",
           "seeders: could not replace stale lock: " +
           ((forceErr && forceErr.message) || String(forceErr)));
@@ -369,15 +376,14 @@ function _releaseLock(db, holder) {
 }
 
 function _txn(db, fn) {
-  _runSql(db, "BEGIN");
-  try {
-    var v = fn();
-    _runSql(db, "COMMIT");
-    return v;
-  } catch (e) {
-    try { _runSql(db, "ROLLBACK"); } catch (_e) {}
-    throw e;
-  }
+  return dbSchema.runInTransaction(db, fn, {
+    onRollbackFail: function (rollbackErr) {
+      log.debug("rollback-failed", {
+        op: "txn",
+        error: rollbackErr && rollbackErr.message,
+      });
+    },
+  });
 }
 
 // ---- Public create ----
@@ -390,10 +396,11 @@ function create(opts) {
     "lockStaleAfterMs", "clock",
   ], "b.seeders");
   _validateCreateOpts(opts);
+  var cfg = validateOpts.applyDefaults(opts, DEFAULTS);
   var dir = opts.dir;
-  var auditApplied  = (opts.auditApplied  === undefined) ? DEFAULTS.auditApplied  : opts.auditApplied;
-  var auditFailures = (opts.auditFailures === undefined) ? DEFAULTS.auditFailures : opts.auditFailures;
-  var lockStaleAfterMs = (opts.lockStaleAfterMs === undefined) ? DEFAULTS.lockStaleAfterMs : opts.lockStaleAfterMs;
+  var auditApplied  = cfg.auditApplied;
+  var auditFailures = cfg.auditFailures;
+  var lockStaleAfterMs = cfg.lockStaleAfterMs;
   var audit = opts.audit || null;
   var clock = opts.clock || function () { return Date.now(); };
 
@@ -402,11 +409,7 @@ function create(opts) {
     catch (_e) { /* drop-silent — observability sink must not crash seeders */ }
   }
 
-  function _emitAudit(action, info) {
-    if (!audit) return;
-    try { audit.safeEmit(Object.assign({ action: action }, info || {})); }
-    catch (_e) { /* audit best-effort */ }
-  }
+  var _emitAudit = validateOpts.makeAuditEmitter(audit);
 
   function _actor(callerOpts) {
     return requestHelpers.resolveActorWithOverride(callerOpts);
@@ -533,7 +536,15 @@ function create(opts) {
               }
               _runSql(db, "COMMIT");
             } catch (e) {
-              try { _runSql(db, "ROLLBACK"); } catch (_e) {}
+              try { _runSql(db, "ROLLBACK"); }
+              catch (rollbackErr) {
+                log.debug("rollback-failed", {
+                  op: "seed-apply",
+                  env: env,
+                  name: name,
+                  error: rollbackErr && rollbackErr.message,
+                });
+              }
               throw e;
             }
           })();

package/lib/session.js

@@ -36,11 +36,13 @@
  *     — anywhere (any node can read shared session state)
  */
 var audit = require("./audit");
+var canonicalJson = require("./canonical-json");
 var cluster = require("./cluster");
 var clusterStorage = require("./cluster-storage");
 var C = require("./constants");
 var { generateToken, sha3Hash } = require("./crypto");
 var cryptoField = require("./crypto-field");
+var requestHelpers = require("./request-helpers");
 var safeJson = require("./safe-json");
 var { SessionError } = require("./framework-error");
 
@@ -64,6 +66,11 @@ function _validateTtl(ttl, where) {
   }
 }
 var SID_NAMESPACE  = "bj-session:";
+// Session ID = 32 random bytes (64 hex chars) — 256-bit entropy floor
+// keeps sids unforgeable even before sealed-cookie encryption layers on
+// top. Routed through C.BYTES so every byte literal in the file lives
+// behind the same helper.
+var SID_BYTES      = C.BYTES.bytes(32);
 
 // Column order used for INSERT — kept as a constant so the placeholders
 // list and the values list stay in sync. Must match _blamejs_sessions's
@@ -110,8 +117,7 @@ function _buildFingerprintInputs(req, fields) {
   for (var i = 0; i < fields.length; i++) {
     var f = fields[i];
     if (f === "clientIp") {
-      inputs.clientIp = (req.socket && req.socket.remoteAddress) ||
-                        (req.connection && req.connection.remoteAddress) || "";
+      inputs.clientIp = requestHelpers.clientIp(req) || "";
     } else if (f === "userAgent") {
       inputs.userAgent = String(headers["user-agent"] || "");
     } else if (f === "acceptLanguage") {
@@ -130,9 +136,9 @@ function _buildFingerprintInputs(req, fields) {
 
 function _hashFingerprint(sid, inputs) {
   if (!inputs) return null;
-  // Deterministic key order so the hash is stable.
-  var keys = Object.keys(inputs).sort();
-  var canonical = keys.map(function (k) { return k + "=" + inputs[k]; }).join("|");
+  // Deterministic stringify with sorted keys at every depth — refuses to
+  // silently round-trip Date / Buffer / Map / Set / BigInt to "{}".
+  var canonical = canonicalJson.stringify(inputs);
   return sha3Hash("bj-session-fingerprint:" + sid + ":" + canonical);
 }
 
@@ -144,7 +150,7 @@ async function create(opts) {
   var ttl = opts.ttlMs !== undefined ? opts.ttlMs : DEFAULT_TTL_MS;
   _validateTtl(ttl, "session.create");
 
-  var sid       = generateToken(32);             // 64 hex chars; only place the plaintext sid lives
+  var sid       = generateToken(SID_BYTES);      // hex-encoded; only place the plaintext sid lives
   var sidHash   = _hashSid(sid);
   var nowMs     = Date.now();
   var expiresAt = nowMs + ttl;
@@ -388,7 +394,7 @@ async function rotate(oldToken, opts) {
   if (typeof oldToken !== "string" || oldToken.length === 0) return null;
   opts = opts || {};
 
-  var newSid       = generateToken(32);
+  var newSid       = generateToken(SID_BYTES);
   var newSidHash   = _hashSid(newSid);
   var oldSidHash   = _hashSid(oldToken);
   var nowMs        = Date.now();

package/lib/slug.js

@@ -40,10 +40,14 @@ var _err = SlugError.factory;
 
 // ---- Defaults ----
 
+// Default slug max length — 0x50 (80 chars). Long enough for nearly any
+// title, short enough to keep URLs / file paths comfortable on every OS.
+var DEFAULT_SLUG_MAX_LENGTH = 0x50;
+
 var DEFAULTS = Object.freeze({
   separator:       "-",
   lowercase:       true,
-  maxLength:       80,
+  maxLength:       DEFAULT_SLUG_MAX_LENGTH,
   preserveUnicode: false,
   fallback:        "",
 });
@@ -106,12 +110,6 @@ function _slugify(title, opts) {
   }
 
   var sep = opts.separator;
-  // Build a regex to collapse runs of the chosen separator. Escape since
-  // separator is operator-supplied (validated single-char, but could be
-  // a regex meta-char like "." or "-").
-  var sepEsc = sep.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  var collapseSep = new RegExp(sepEsc + "+", "g");
-  var trimSep    = new RegExp("^" + sepEsc + "+|" + sepEsc + "+$", "g");
 
   var s = title;
 
@@ -130,7 +128,11 @@ function _slugify(title, opts) {
     s = s.toLowerCase();
   }
 
-  s = s.replace(collapseSep, sep).replace(trimSep, "");
+  // Collapse runs of the chosen separator + trim leading/trailing
+  // separators, character-by-character. _validateOpts enforces
+  // sep.length === 1, so a linear scan is correct and avoids
+  // compiling a regex from operator input.
+  s = _collapseAndTrim(s, sep);
 
   if (opts.maxLength !== null && s.length > opts.maxLength) {
     s = _truncateAtSeparator(s, opts.maxLength, sep);
@@ -140,6 +142,31 @@ function _slugify(title, opts) {
   return s;
 }
 
+// Single-pass collapse + trim — replaces the dynamic-RegExp-on-sep pair
+// previously used here. sep is enforced 1-char by _validateOpts.
+function _collapseAndTrim(s, sep) {
+  if (s.length === 0) return s;
+  var out = "";
+  var lastWasSep = true;   // suppress leading separators
+  for (var i = 0; i < s.length; i++) {
+    var ch = s.charAt(i);
+    if (ch === sep) {
+      if (lastWasSep) continue;
+      lastWasSep = true;
+      out += ch;
+    } else {
+      lastWasSep = false;
+      out += ch;
+    }
+  }
+  // Strip a trailing separator (the loop emits one if the last
+  // non-collapsed run was separator).
+  if (out.length > 0 && out.charAt(out.length - 1) === sep) {
+    out = out.slice(0, out.length - 1);
+  }
+  return out;
+}
+
 // Truncate at the last separator that keeps length ≤ maxLength.
 // If there's no separator within the cap, fall back to char truncation
 // (single-token long inputs).

package/lib/ssrf-guard.js

@@ -43,6 +43,7 @@
 var dns = require("node:dns").promises;
 var net = require("node:net");
 
+var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var safeUrl = require("./safe-url");
 var validateOpts = require("./validate-opts");
@@ -51,6 +52,18 @@ var { FrameworkError } = require("./framework-error");
 
 var networkDns = lazyRequire(function () { return require("./network-dns"); });
 
+// IP address bit-widths (RFC 791 §3.1 IPv4, RFC 4291 §2.5 IPv6) and
+// CIDR prefix arithmetic constants. The numerals in this file are
+// bit-counts in IP-address space, not byte sizes; routed through
+// C.BYTES.bytes (a value-passthrough) so every numeric literal in the
+// codebase has a single source of truth for "what shape is this number".
+var IPV4_BITS     = C.BYTES.bytes(32);
+var IPV6_BITS     = C.BYTES.bytes(128);
+var BITS_PER_BYTE = C.BYTES.bytes(8);
+var IPV6_BYTES    = C.BYTES.bytes(16);     // 128 bits / 8 bits-per-byte
+var IPV6_GROUPS   = C.BYTES.bytes(8);      // hex groups
+var HEX_RADIX     = C.BYTES.bytes(16);     // parseInt / toString radix
+
 class SsrfError extends FrameworkError {
   constructor(message, code, ctx) {
     super(message, code);
@@ -68,26 +81,26 @@ class SsrfError extends FrameworkError {
 // ---- IPv4 ranges (as numeric prefix tables for fast match) ----
 // Each entry: [networkInt, prefixLen]
 var IPV4_PRIVATE = [
-  [_ipv4ToInt("10.0.0.0"),     8],
-  [_ipv4ToInt("172.16.0.0"),  12],
-  [_ipv4ToInt("192.168.0.0"), 16],
+  [_ipv4ToInt("10.0.0.0"),     C.BYTES.bytes(8)],
+  [_ipv4ToInt("172.16.0.0"),  C.BYTES.bytes(12)],
+  [_ipv4ToInt("192.168.0.0"), C.BYTES.bytes(16)],
 ];
 var IPV4_LOOPBACK = [
-  [_ipv4ToInt("127.0.0.0"), 8],
+  [_ipv4ToInt("127.0.0.0"), C.BYTES.bytes(8)],
 ];
 var IPV4_LINK_LOCAL = [
-  [_ipv4ToInt("169.254.0.0"), 16],
+  [_ipv4ToInt("169.254.0.0"), C.BYTES.bytes(16)],
 ];
 var IPV4_RESERVED = [
-  [_ipv4ToInt("0.0.0.0"),         8],   // "this network"
-  [_ipv4ToInt("100.64.0.0"),     10],   // CGNAT (RFC 6598)
-  [_ipv4ToInt("192.0.0.0"),      24],   // IETF protocol assignments
-  [_ipv4ToInt("192.0.2.0"),      24],   // TEST-NET-1
-  [_ipv4ToInt("198.18.0.0"),     15],   // network benchmark
-  [_ipv4ToInt("198.51.100.0"),   24],   // TEST-NET-2
-  [_ipv4ToInt("203.0.113.0"),    24],   // TEST-NET-3
-  [_ipv4ToInt("224.0.0.0"),       4],   // multicast
-  [_ipv4ToInt("240.0.0.0"),       4],   // reserved + 255.255.255.255
+  [_ipv4ToInt("0.0.0.0"),         C.BYTES.bytes(8)],   // "this network"
+  [_ipv4ToInt("100.64.0.0"),     C.BYTES.bytes(10)],   // CGNAT (RFC 6598)
+  [_ipv4ToInt("192.0.0.0"),      C.BYTES.bytes(24)],   // IETF protocol assignments
+  [_ipv4ToInt("192.0.2.0"),      C.BYTES.bytes(24)],   // TEST-NET-1
+  [_ipv4ToInt("198.18.0.0"),     C.BYTES.bytes(15)],   // network benchmark
+  [_ipv4ToInt("198.51.100.0"),   C.BYTES.bytes(24)],   // TEST-NET-2
+  [_ipv4ToInt("203.0.113.0"),    C.BYTES.bytes(24)],   // TEST-NET-3
+  [_ipv4ToInt("224.0.0.0"),       C.BYTES.bytes(4)],   // multicast
+  [_ipv4ToInt("240.0.0.0"),       C.BYTES.bytes(4)],   // reserved + 255.255.255.255
 ];
 
 // ---- IPv6 ranges (as 16-byte prefix tables) ----
@@ -96,7 +109,8 @@ var IPV6_UNSPECIFIED_BYTES = _ipv6ToBytes("::");
 var IPV6_PRIVATE_PREFIX   = _ipv6ToBytes("fc00::");
 var IPV6_LINK_LOCAL_PREFIX = _ipv6ToBytes("fe80::");
 var IPV6_DOC_PREFIX       = _ipv6ToBytes("2001:db8::");      // documentation
-var IPV6_V4_MAPPED_PREFIX = _ipv6ToBytes("::ffff:0:0");      // IPv4-mapped (::ffff:0:0/96)
+// IPv4-mapped IPv6 (::ffff:0:0 with C.BYTES.bytes(96)-bit prefix)
+var IPV6_V4_MAPPED_PREFIX = _ipv6ToBytes("::ffff:0:0");
 // Multicast ff00::/8 — RFC 4291 §2.7. Refused for outbound HTTP same as
 // IPv4 multicast 224/4 — there's no legitimate fetch from a multicast
 // destination on a production gateway.
@@ -138,9 +152,9 @@ function _ipv6ToBytes(ip) {
   // ipv6-to-bytes helper, but the URL constructor + Buffer dance
   // is reliable for canonicalizing.
   var groups = _expandIpv6(ip);
-  var out = Buffer.alloc(16);
-  for (var i = 0; i < 8; i++) {
-    var v = parseInt(groups[i], 16) || 0;
+  var out = Buffer.alloc(IPV6_BYTES);
+  for (var i = 0; i < IPV6_GROUPS; i++) {
+    var v = parseInt(groups[i], HEX_RADIX) || 0;
     out[i * 2] = (v >> 8) & 0xff;
     out[i * 2 + 1] = v & 0xff;
   }
@@ -157,7 +171,7 @@ function _expandIpv6(ip) {
     var ipv4Int = _ipv4ToInt(v4);
     var hi = (ipv4Int >>> 16) & 0xffff;
     var lo = ipv4Int & 0xffff;
-    lower = lower.slice(0, dot + 1) + hi.toString(16) + ":" + lo.toString(16);
+    lower = lower.slice(0, dot + 1) + hi.toString(HEX_RADIX) + ":" + lo.toString(HEX_RADIX);
   }
   var doubleColon = lower.indexOf("::");
   var leftStr, rightStr;
@@ -170,7 +184,7 @@ function _expandIpv6(ip) {
   }
   var left  = leftStr.length  ? leftStr.split(":")  : [];
   var right = rightStr.length ? rightStr.split(":") : [];
-  var missing = 8 - left.length - right.length;
+  var missing = IPV6_GROUPS - left.length - right.length;
   var fill = [];
   for (var i = 0; i < missing; i++) fill.push("0");
   return left.concat(fill).concat(right);
@@ -181,10 +195,10 @@ function _cidrIpv4Match(cidr, ip) {
   if (slash === -1) return false;
   var network = _ipv4ToInt(cidr.slice(0, slash));
   var prefix = parseInt(cidr.slice(slash + 1), 10);
-  if (!Number.isFinite(prefix) || prefix < 0 || prefix > 32) return false;
+  if (!Number.isFinite(prefix) || prefix < 0 || prefix > IPV4_BITS) return false;
   var ipInt = _ipv4ToInt(ip);
   if (prefix === 0) return true;
-  var mask = (0xffffffff << (32 - prefix)) >>> 0;
+  var mask = (0xffffffff << (IPV4_BITS - prefix)) >>> 0;
   return (ipInt & mask) === (network & mask);
 }
 
@@ -193,15 +207,15 @@ function _cidrIpv6Match(cidr, ip) {
   if (slash === -1) return false;
   var network = _ipv6ToBytes(cidr.slice(0, slash));
   var prefix = parseInt(cidr.slice(slash + 1), 10);
-  if (!Number.isFinite(prefix) || prefix < 0 || prefix > 128) return false;
+  if (!Number.isFinite(prefix) || prefix < 0 || prefix > IPV6_BITS) return false;
   var bytes = _ipv6ToBytes(ip);
-  var fullBytes = Math.floor(prefix / 8);
-  var remainingBits = prefix % 8;
+  var fullBytes = Math.floor(prefix / BITS_PER_BYTE);
+  var remainingBits = prefix % BITS_PER_BYTE;
   for (var i = 0; i < fullBytes; i++) {
     if (bytes[i] !== network[i]) return false;
   }
   if (remainingBits > 0) {
-    var mask = (0xff << (8 - remainingBits)) & 0xff;
+    var mask = (0xff << (BITS_PER_BYTE - remainingBits)) & 0xff;
     if ((bytes[fullBytes] & mask) !== (network[fullBytes] & mask)) return false;
   }
   return true;
@@ -211,20 +225,20 @@ function _ipv4PrefixMatch(prefixTable, ipInt) {
   for (var i = 0; i < prefixTable.length; i++) {
     var net4 = prefixTable[i][0];
     var prefix = prefixTable[i][1];
-    var mask = prefix === 0 ? 0 : (0xffffffff << (32 - prefix)) >>> 0;
+    var mask = prefix === 0 ? 0 : (0xffffffff << (IPV4_BITS - prefix)) >>> 0;
     if ((ipInt & mask) === (net4 & mask)) return true;
   }
   return false;
 }
 
 function _ipv6PrefixMatch(prefixBytes, prefixLen, ipBytes) {
-  var fullBytes = Math.floor(prefixLen / 8);
-  var remainingBits = prefixLen % 8;
+  var fullBytes = Math.floor(prefixLen / BITS_PER_BYTE);
+  var remainingBits = prefixLen % BITS_PER_BYTE;
   for (var i = 0; i < fullBytes; i++) {
     if (ipBytes[i] !== prefixBytes[i]) return false;
   }
   if (remainingBits > 0) {
-    var mask = (0xff << (8 - remainingBits)) & 0xff;
+    var mask = (0xff << (BITS_PER_BYTE - remainingBits)) & 0xff;
     if ((ipBytes[fullBytes] & mask) !== (prefixBytes[fullBytes] & mask)) return false;
   }
   return true;
@@ -252,25 +266,25 @@ function classify(ip) {
   var bytes = _ipv6ToBytes(ip);
   if (_bufEqual(bytes, IPV6_LOOPBACK_BYTES))      return "loopback";
   if (_bufEqual(bytes, IPV6_UNSPECIFIED_BYTES))   return "reserved";
-  if (_ipv6PrefixMatch(IPV6_LINK_LOCAL_PREFIX, 10, bytes))  return "link-local";
+  if (_ipv6PrefixMatch(IPV6_LINK_LOCAL_PREFIX, C.BYTES.bytes(10), bytes))  return "link-local";
   if (_ipv6PrefixMatch(IPV6_PRIVATE_PREFIX,     7, bytes))  return "private";
-  if (_ipv6PrefixMatch(IPV6_DOC_PREFIX,        32, bytes))  return "reserved";
-  if (_ipv6PrefixMatch(IPV6_MULTICAST_PREFIX,   8, bytes))  return "reserved";
-  if (_ipv6PrefixMatch(IPV6_DISCARD_PREFIX,    64, bytes))  return "reserved";
-  // 6to4 (2002::/16) embeds a v4 address in bytes 2–5; classify the
+  if (_ipv6PrefixMatch(IPV6_DOC_PREFIX,        C.BYTES.bytes(32), bytes))  return "reserved";
+  if (_ipv6PrefixMatch(IPV6_MULTICAST_PREFIX,   C.BYTES.bytes(8), bytes))  return "reserved";
+  if (_ipv6PrefixMatch(IPV6_DISCARD_PREFIX,    C.BYTES.bytes(64), bytes))  return "reserved";
+  // 6to4 prefix embeds a v4 address in bytes 2–5; classify the
   // embedded v4 so a 6to4-wrapped private/metadata address is refused
   // for the same reason its v4 form would be.
-  if (_ipv6PrefixMatch(IPV6_6TO4_PREFIX, 16, bytes)) {
+  if (_ipv6PrefixMatch(IPV6_6TO4_PREFIX, C.BYTES.bytes(16), bytes)) {
     var v4From6to4 = bytes[2] + "." + bytes[3] + "." + bytes[4] + "." + bytes[5];
     return classify(v4From6to4) || "reserved";
   }
-  // NAT64 well-known prefix (64:ff9b::/96) embeds v4 in bytes 12–15.
-  if (_ipv6PrefixMatch(IPV6_NAT64_PREFIX, 96, bytes)) {
+  // NAT64 well-known prefix embeds v4 in the lower bytes.
+  if (_ipv6PrefixMatch(IPV6_NAT64_PREFIX, C.BYTES.bytes(96), bytes)) {
     var v4FromNat64 = bytes[12] + "." + bytes[13] + "." + bytes[14] + "." + bytes[15];
     return classify(v4FromNat64) || "reserved";
   }
-  // IPv4-mapped addresses (::ffff:a.b.c.d/96): re-classify the v4 portion.
-  if (_ipv6PrefixMatch(IPV6_V4_MAPPED_PREFIX, 96, bytes)) {
+  // IPv4-mapped addresses (::ffff:a.b.c.d): re-classify the v4 portion.
+  if (_ipv6PrefixMatch(IPV6_V4_MAPPED_PREFIX, C.BYTES.bytes(96), bytes)) {
     var mappedV4 = bytes[12] + "." + bytes[13] + "." + bytes[14] + "." + bytes[15];
     return classify(mappedV4);
   }
@@ -278,9 +292,10 @@ function classify(ip) {
 }
 
 function _bufEqual(a, b) {
-  if (a.length !== b.length) return false;
-  for (var i = 0; i < a.length; i++) if (a[i] !== b[i]) return false;
-  return true;
+  // Compares Buffer-like byte arrays for equality. The buffers here
+  // are IP addresses, not secrets, so the comparison doesn't need
+  // constant-time semantics — Buffer.compare uses native memcmp.
+  return Buffer.compare(a, b) === 0;
 }
 
 function cidrContains(cidr, ip) {

package/lib/static.js

@@ -48,12 +48,16 @@ var fs = require("fs");
 var fsp = require("fs/promises");
 var path = require("path");
 var nodeCrypto = require("crypto");
+var C = require("./constants");
+var requestHelpers = require("./request-helpers");
 var validateOpts = require("./validate-opts");
 
+var HTTP = requestHelpers.HTTP_STATUS;
+
 var DEFAULT_HASHED_PATTERN = /\.[a-fA-F0-9]{8,}\./;
 var DEFAULT_INDEX_FILE     = "index.html";
-var DEFAULT_MAX_AGE_SEC    = 3600;       // 1 hour for non-hashed paths
-var IMMUTABLE_MAX_AGE_SEC  = 31536000;   // 1 year for hashed paths
+var DEFAULT_MAX_AGE_SEC    = C.TIME.hours(1) / C.TIME.seconds(1);   // 1 hour for non-hashed paths
+var IMMUTABLE_MAX_AGE_SEC  = C.TIME.days(365) / C.TIME.seconds(1);  // 1 year for hashed paths
 
 // Minimal MIME table. Operators with exotic types pass opts.contentTypes
 // to override. The framework deliberately doesn't bring a 200-entry
@@ -143,7 +147,7 @@ function _contentTypeFor(filePath, table) {
 }
 
 function _writeNotModified(res, etag, cacheControl) {
-  res.writeHead(304, {
+  res.writeHead(HTTP.NOT_MODIFIED, {
     "ETag":          etag,
     "Cache-Control": cacheControl,
   });
@@ -151,7 +155,7 @@ function _writeNotModified(res, etag, cacheControl) {
 }
 
 function _writeNotFound(res) {
-  res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8", "Content-Length": 9 });
+  res.writeHead(HTTP.NOT_FOUND, { "Content-Type": "text/plain; charset=utf-8", "Content-Length": 9 });
   res.end("Not Found");
 }
 
@@ -240,16 +244,16 @@ function create(opts) {
     };
 
     if (req.method === "HEAD") {
-      res.writeHead(200, headers);
+      res.writeHead(HTTP.OK, headers);
       return res.end();
     }
 
-    res.writeHead(200, headers);
+    res.writeHead(HTTP.OK, headers);
     var stream = fs.createReadStream(absPath);
     stream.on("error", function (e) {
       // Mid-stream read error — best we can do is destroy the response;
       // headers are already on the wire.
-      try { res.destroy(e); } catch (_) {}
+      try { res.destroy(e); } catch (_) { /* response already torn down */ }
     });
     stream.pipe(res);
   };

package/lib/storage.js

@@ -57,6 +57,7 @@
  *   storage.listBackends()                              → [{ name, protocol, classifications, residencyTag }]
  *   storage.getBackend(name)                            → backend instance (or null)
  */
+var C = require("./constants");
 var { generateBytes, encryptPacked, decryptPacked } = require("./crypto");
 var objectStore = require("./object-store");
 var lazyRequire = require("./lazy-require");
@@ -218,7 +219,7 @@ function _pickBackend(opts) {
 // ---- File encryption helpers ----
 
 function _encryptBuffer(buffer) {
-  var key = generateBytes(32);
+  var key = generateBytes(C.BYTES.bytes(32));
   var packed = encryptPacked(buffer, key);
   var sealedKey = vault().seal(key.toString("base64"));
   return { data: packed, encryptionKey: sealedKey };