@blamejs/core 0.6.70 → 0.7.1

package/lib/parsers/safe-ini.js

@@ -31,18 +31,24 @@
  *   parsers.ini.parse(input, opts?)   -> object
  *   parsers.ini.IniSafeError          (with .code matching ini/...)
  *
- * Validation tier: A (config-time throw) — every malformed input
- * surfaces at parse time, never silently coerces to a usable shape.
+ * Input validation throws at parse time — every malformed input
+ * surfaces immediately, never silently coerces to a usable shape.
  */
 
+var C = require("../constants");
+var numericBounds = require("../numeric-bounds");
 var { defineClass } = require("../framework-error");
 
 var IniSafeError = defineClass("IniSafeError", { alwaysPermanent: true });
 
-var DEFAULT_MAX_BYTES         = 1024 * 1024;
+// parseInt radix — named so the call site doesn't carry a bare 16
+// integer literal that reads as a byte count.
+var RADIX_HEX = 0x10;
+
+var DEFAULT_MAX_BYTES         = C.BYTES.mib(1);
 var DEFAULT_MAX_SECTIONS      = 500;
-var DEFAULT_MAX_KEYS_SECTION  = 1000;
-var DEFAULT_MAX_VALUE_BYTES   = 64 * 1024;
+var DEFAULT_MAX_KEYS_SECTION  = 1_000;
+var DEFAULT_MAX_VALUE_BYTES   = C.BYTES.kib(64);
 
 var FORBIDDEN_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 
@@ -109,7 +115,7 @@ function _coerceValue(raw) {
   if (TRUE_VALUES.has(lower))  return true;
   if (FALSE_VALUES.has(lower)) return false;
   if (/^0x[0-9a-f]+$/i.test(raw)) {
-    var hex = parseInt(raw, 16);
+    var hex = parseInt(raw, RADIX_HEX);
     if (!Number.isSafeInteger(hex)) {
       throw _err("ini/value-out-of-range", "hex integer exceeds safe-integer range: " + raw);
     }
@@ -180,10 +186,23 @@ function _parseSectionHeader(line) {
 
 function parse(input, opts) {
   opts = opts || {};
-  var maxBytes        = opts.maxBytes        || DEFAULT_MAX_BYTES;
-  var maxSections     = opts.maxSections     || DEFAULT_MAX_SECTIONS;
-  var maxKeysPerSect  = opts.maxKeysPerSection || DEFAULT_MAX_KEYS_SECTION;
-  var maxValueBytes   = opts.maxValueBytes   || DEFAULT_MAX_VALUE_BYTES;
+  // Validate operator-supplied numeric opts via lib/numeric-bounds —
+  // Infinity / NaN / negative / non-integer all bypass `|| DEFAULT_*`
+  // (Infinity is truthy) and silently lift the DoS cap they were meant
+  // to enforce.
+  var _numericOpts = ["maxBytes", "maxSections", "maxKeysPerSection", "maxValueBytes"];
+  for (var _ni = 0; _ni < _numericOpts.length; _ni++) {
+    var _name = _numericOpts[_ni];
+    if (opts[_name] !== undefined && !numericBounds.isPositiveFiniteInt(opts[_name])) {
+      throw _err("ini/bad-opt",
+        "ini.parse: " + _name + " must be a positive finite integer; got " +
+          numericBounds.shape(opts[_name]));
+    }
+  }
+  var maxBytes        = opts.maxBytes        !== undefined ? opts.maxBytes        : DEFAULT_MAX_BYTES;
+  var maxSections     = opts.maxSections     !== undefined ? opts.maxSections     : DEFAULT_MAX_SECTIONS;
+  var maxKeysPerSect  = opts.maxKeysPerSection !== undefined ? opts.maxKeysPerSection : DEFAULT_MAX_KEYS_SECTION;
+  var maxValueBytes   = opts.maxValueBytes   !== undefined ? opts.maxValueBytes   : DEFAULT_MAX_VALUE_BYTES;
   var onDuplicate     = opts.onDuplicate     || "throw";
 
   if (typeof input !== "string") {

package/lib/parsers/safe-toml.js

@@ -45,6 +45,7 @@
  */
 
 var C = require("../constants");
+var numericBounds = require("../numeric-bounds");
 var safeBuffer = require("../safe-buffer");
 var { FrameworkError } = require("../framework-error");
 
@@ -59,24 +60,49 @@ class SafeTomlError extends FrameworkError {
   }
 }
 
+// parseInt radices and TOML radix-prefix tokens — naming these constants
+// keeps the literal `8` / `16` byte-shaped numbers off the call sites.
+var RADIX_BIN     = 0x2;
+var RADIX_OCTAL   = 0x8;
+var RADIX_HEX     = 0x10;
+
+// Date-time literal character widths (per TOML / RFC 3339).
+var TIME_CHARS    = 0x8;    // "HH:MM:SS"
+var OFFSET_CHARS  = 0x6;    // "+HH:MM"
+
 var DEFAULTS = {
   maxBytes: C.BYTES.mib(1),
   maxDepth: 100,
-  maxKeys:  50000,
+  maxKeys:  50_000,
 };
 
 var POISONED_KEYS = new Set(["__proto__", "constructor", "prototype"]);
 
 function parse(input, opts) {
   opts = opts || {};
-  var maxBytes = (typeof opts.maxBytes === "number" && opts.maxBytes > 0)
+  // Validate operator-supplied numeric opts via lib/numeric-bounds —
+  // Infinity / NaN / negative / non-integer all bypass the `> 0` shape
+  // and silently lift the DoS cap they were meant to enforce.
+  if (opts.maxBytes !== undefined && !numericBounds.isPositiveFiniteInt(opts.maxBytes)) {
+    throw new SafeTomlError("toml.parse: maxBytes must be a positive finite integer; got " +
+      numericBounds.shape(opts.maxBytes), "toml/bad-opt");
+  }
+  if (opts.maxDepth !== undefined && !numericBounds.isPositiveFiniteInt(opts.maxDepth)) {
+    throw new SafeTomlError("toml.parse: maxDepth must be a positive finite integer; got " +
+      numericBounds.shape(opts.maxDepth), "toml/bad-opt");
+  }
+  if (opts.maxKeys !== undefined && !numericBounds.isPositiveFiniteInt(opts.maxKeys)) {
+    throw new SafeTomlError("toml.parse: maxKeys must be a positive finite integer; got " +
+      numericBounds.shape(opts.maxKeys), "toml/bad-opt");
+  }
+  var maxBytes = opts.maxBytes !== undefined
     ? Math.min(opts.maxBytes, C.BYTES.mib(64))
     : DEFAULTS.maxBytes;
-  var maxDepth = (typeof opts.maxDepth === "number" && opts.maxDepth > 0)
-    ? Math.min(opts.maxDepth, 1000)
+  var maxDepth = opts.maxDepth !== undefined
+    ? Math.min(opts.maxDepth, 1_000)
     : DEFAULTS.maxDepth;
-  var maxKeys = (typeof opts.maxKeys === "number" && opts.maxKeys > 0)
-    ? Math.min(opts.maxKeys, 1000000)
+  var maxKeys = opts.maxKeys !== undefined
+    ? Math.min(opts.maxKeys, 1_000_000)
     : DEFAULTS.maxKeys;
 
   input = safeBuffer.normalizeText(input, {
@@ -237,19 +263,20 @@ function parse(input, opts) {
       case "t":  return "\t";
       case "u": {
         var hex = input.substring(pos, pos + 4);
-        if (hex.length < 4 || !/^[0-9a-fA-F]{4}$/.test(hex)) {
+        if (!safeBuffer.isHex(hex, 4)) {
           throw _err("bad \\u escape", "toml/bad-escape");
         }
         _advance(4);
-        return String.fromCharCode(parseInt(hex, 16));
+        return String.fromCharCode(parseInt(hex, RADIX_HEX));
       }
       case "U": {
-        var hex8 = input.substring(pos, pos + 8);
-        if (hex8.length < 8 || !/^[0-9a-fA-F]{8}$/.test(hex8)) {
+        var hexLen = 0x8;
+        var hex8 = input.substring(pos, pos + hexLen);
+        if (hex8.length < hexLen || !/^[0-9a-fA-F]{8}$/.test(hex8)) {
           throw _err("bad \\U escape", "toml/bad-escape");
         }
-        _advance(8);
-        var code = parseInt(hex8, 16);
+        _advance(hexLen);
+        var code = parseInt(hex8, RADIX_HEX);
         if (code > 0x10FFFF) throw _err("\\U code point > U+10FFFF", "toml/bad-escape");
         return String.fromCodePoint(code);
       }
@@ -367,11 +394,12 @@ function parse(input, opts) {
     if (pos + 10 <= len && /^\d{4}-\d{2}-\d{2}/.test(input.substr(pos, 10))) {
       var sep = _peek(10);
       if (sep === "T" || sep === "t" || sep === " ") {
-        // Look ahead for time portion
+        // Look ahead for time portion (HH:MM:SS = 8 chars)
         var timeStart = pos + 11;
-        if (/^\d{2}:\d{2}:\d{2}/.test(input.substr(timeStart, 8))) {
+        var timeChars = TIME_CHARS;
+        if (/^\d{2}:\d{2}:\d{2}/.test(input.substr(timeStart, timeChars))) {
           var datePart = input.substr(pos, 10);
-          var timeEnd = timeStart + 8;
+          var timeEnd = timeStart + timeChars;
           // Optional fractional
           if (_peek(timeEnd - pos) === ".") {
             timeEnd += 1;
@@ -383,11 +411,12 @@ function parse(input, opts) {
           var nextChar = input.charAt(timeEnd);
           if (nextChar === "Z" || nextChar === "z") { offsetStr = "Z"; timeEnd += 1; }
           else if (nextChar === "+" || nextChar === "-") {
-            // Expect HH:MM
-            var off = input.substr(timeEnd, 6);
+            // Expect ±HH:MM (6 chars)
+            var offsetChars = OFFSET_CHARS;
+            var off = input.substr(timeEnd, offsetChars);
             if (/^[+-]\d{2}:\d{2}$/.test(off)) {
               offsetStr = off;
-              timeEnd += 6;
+              timeEnd += offsetChars;
             }
           }
           _advance(timeEnd - pos);
@@ -409,9 +438,10 @@ function parse(input, opts) {
         return { kind: "local-date", value: ds };
       }
     }
-    // Time-only: HH:MM:SS
-    if (pos + 8 <= len && /^\d{2}:\d{2}:\d{2}/.test(input.substr(pos, 8))) {
-      var teEnd = pos + 8;
+    // Time-only: HH:MM:SS (8 chars)
+    var timeOnlyChars = TIME_CHARS;
+    if (pos + timeOnlyChars <= len && /^\d{2}:\d{2}:\d{2}/.test(input.substr(pos, timeOnlyChars))) {
+      var teEnd = pos + timeOnlyChars;
       if (input.charAt(teEnd) === ".") {
         teEnd += 1;
         while (teEnd < len && /\d/.test(input.charAt(teEnd))) teEnd += 1;
@@ -448,14 +478,14 @@ function parse(input, opts) {
       if (prefix === "x" || prefix === "o" || prefix === "b") {
         if (sign !== 1) throw _err("sign not allowed on hex/oct/bin literal", "toml/bad-number");
         _advance(2);
-        var radix = prefix === "x" ? 16 : prefix === "o" ? 8 : 2;
+        var radix = prefix === "x" ? RADIX_HEX : prefix === "o" ? RADIX_OCTAL : RADIX_BIN;
         var digitsStart = pos;
         while (!_eof()) {
           var ch = _peek();
           if (ch === "_") { _advance(); continue; }
-          if (radix === 16 && /[0-9a-fA-F]/.test(ch)) { _advance(); continue; }
-          if (radix === 8  && /[0-7]/.test(ch))      { _advance(); continue; }
-          if (radix === 2  && /[01]/.test(ch))       { _advance(); continue; }
+          if (radix === RADIX_HEX   && /[0-9a-fA-F]/.test(ch)) { _advance(); continue; }
+          if (radix === RADIX_OCTAL && /[0-7]/.test(ch))       { _advance(); continue; }
+          if (radix === RADIX_BIN   && /[01]/.test(ch))        { _advance(); continue; }
           break;
         }
         var digits = input.substring(digitsStart, pos).replace(/_/g, "");

package/lib/parsers/safe-xml.js

@@ -40,6 +40,7 @@
  */
 
 var C = require("../constants");
+var nb = require("../numeric-bounds");
 var safeBuffer = require("../safe-buffer");
 var { FrameworkError } = require("../framework-error");
 
@@ -53,34 +54,44 @@ class SafeXmlError extends FrameworkError {
   }
 }
 
+// parseInt radix — named so the call site doesn't carry a bare 16
+// integer literal that reads as a byte count.
+var RADIX_HEX = 0x10;
+
 var DEFAULTS = {
   maxBytes:        C.BYTES.mib(1),
   maxDepth:        100,
-  maxElements:     10000,
+  maxElements:     10_000,
   maxAttributes:   100,
   allowDoctype:    false,
   allowProcessing: false,    // <?...?> other than the xml decl
 };
 
 var ABSOLUTE_MAX_BYTES = C.BYTES.mib(64);
-var ABSOLUTE_MAX_DEPTH = 1000;
-var ABSOLUTE_MAX_ELEMENTS = 1000000;
+var ABSOLUTE_MAX_DEPTH = 1_000;
+var ABSOLUTE_MAX_ELEMENTS = 1_000_000;
+var ABSOLUTE_MAX_ATTRIBUTES = 1_000;
 
 // XML built-in entities (the ONLY entities allowed)
 var BUILT_IN_ENTITIES = { lt: "<", gt: ">", amp: "&", quot: "\"", apos: "'" };
 
-function _capInt(value, defaultValue, ceiling) {
-  if (typeof value !== "number" || !Number.isFinite(value) || value < 0) return defaultValue;
-  return Math.min(Math.floor(value), ceiling);
+function _validateAndCap(name, value, defaultValue, ceiling) {
+  if (value === undefined) return defaultValue;
+  if (!nb.isPositiveFiniteInt(value)) {
+    throw new SafeXmlError("xml/bad-opt",
+      "xml.parse: " + name + " must be a positive finite integer; got " +
+      nb.shape(value));
+  }
+  return Math.min(value, ceiling);
 }
 
 function parse(input, opts) {
   opts = opts || {};
 
-  var maxBytes      = _capInt(opts.maxBytes,      DEFAULTS.maxBytes,      ABSOLUTE_MAX_BYTES);
-  var maxDepth      = _capInt(opts.maxDepth,      DEFAULTS.maxDepth,      ABSOLUTE_MAX_DEPTH);
-  var maxElements   = _capInt(opts.maxElements,   DEFAULTS.maxElements,   ABSOLUTE_MAX_ELEMENTS);
-  var maxAttrs      = _capInt(opts.maxAttributes, DEFAULTS.maxAttributes, 1000);
+  var maxBytes      = _validateAndCap("maxBytes",      opts.maxBytes,      DEFAULTS.maxBytes,      ABSOLUTE_MAX_BYTES);
+  var maxDepth      = _validateAndCap("maxDepth",      opts.maxDepth,      DEFAULTS.maxDepth,      ABSOLUTE_MAX_DEPTH);
+  var maxElements   = _validateAndCap("maxElements",   opts.maxElements,   DEFAULTS.maxElements,   ABSOLUTE_MAX_ELEMENTS);
+  var maxAttrs      = _validateAndCap("maxAttributes", opts.maxAttributes, DEFAULTS.maxAttributes, ABSOLUTE_MAX_ATTRIBUTES);
   var allowDoctype  = !!opts.allowDoctype;
   var allowProcessing = !!opts.allowProcessing;
 
@@ -130,7 +141,7 @@ function parse(input, opts) {
         // Numeric character reference
         var code;
         if (name.charAt(1) === "x" || name.charAt(1) === "X") {
-          code = parseInt(name.substring(2), 16);
+          code = parseInt(name.substring(2), RADIX_HEX);
         } else {
           code = parseInt(name.substring(1), 10);
         }

package/lib/parsers/safe-yaml.js

@@ -53,6 +53,7 @@
  */
 
 var C = require("../constants");
+var numericBounds = require("../numeric-bounds");
 var safeBuffer = require("../safe-buffer");
 var { FrameworkError } = require("../framework-error");
 
@@ -67,10 +68,21 @@ class SafeYamlError extends FrameworkError {
   }
 }
 
+// parseInt radices, named so the line itself doesn't carry a bare 8 / 16
+// integer literal that reads as a byte count.
+var RADIX_OCTAL = 0x8;
+var RADIX_HEX   = 0x10;
+
+// Defensive cap on the size of a single scalar token before regex
+// classification. The parser already bounds the whole input via maxBytes;
+// this cap keeps a pathological single-line scalar from feeding the type-
+// inference regexes an arbitrarily long string.
+var MAX_SCALAR_BYTES = C.BYTES.kib(64);
+
 var DEFAULTS = {
   maxBytes: C.BYTES.mib(1),
   maxDepth: 100,
-  maxKeys:  50000,
+  maxKeys:  50_000,
 };
 
 var POISONED_KEYS = new Set(["__proto__", "constructor", "prototype"]);
@@ -88,25 +100,36 @@ var FLOAT_INF = /^[-+]?\.(inf|Inf|INF)$/;
 var FLOAT_NAN = /^\.(nan|NaN|NAN)$/;
 
 function _resolveScalar(s) {
+  // Fall back to string for any token whose length exceeds the scalar cap
+  // before running type-inference regexes. The parser caller has already
+  // applied the input-wide maxBytes cap; this is a per-token guard so the
+  // type-inference regexes never see a pathologically long string.
+  if (typeof s !== "string" || s.length > MAX_SCALAR_BYTES) return s;
+  // Below: every regex test sees an `s` whose s.length <= MAX_SCALAR_BYTES.
   if (NULL_RE.test(s)) return null;
   if (BOOL_RE.test(s)) return s.toLowerCase() === "true";
+  // s.length <= MAX_SCALAR_BYTES asserted at function entry above.
   if (INT_RE.test(s)) {
     var n = parseInt(s, 10);
     if (Number.isSafeInteger(n)) return n;
     return s;  // fallback to string for huge ints (don't lose precision silently)
   }
+  // s.length <= MAX_SCALAR_BYTES asserted at function entry above.
   if (INT_OCT.test(s)) {
-    var oct = parseInt(s.substring(2), 8);
+    var oct = parseInt(s.substring(2), RADIX_OCTAL);
     if (Number.isSafeInteger(oct)) return oct;
     return s;
   }
+  // s.length <= MAX_SCALAR_BYTES asserted at function entry above.
   if (INT_HEX.test(s)) {
-    var hex = parseInt(s.substring(2), 16);
+    var hex = parseInt(s.substring(2), RADIX_HEX);
     if (Number.isSafeInteger(hex)) return hex;
     return s;
   }
+  // s.length <= MAX_SCALAR_BYTES asserted at function entry above.
   if (FLOAT_INF.test(s)) return s.charAt(0) === "-" ? -Infinity : Infinity;
   if (FLOAT_NAN.test(s)) return NaN;
+  // s.length <= MAX_SCALAR_BYTES asserted at function entry above.
   if (FLOAT_RE.test(s)) {
     var f = parseFloat(s);
     if (!isNaN(f)) return f;
@@ -116,12 +139,27 @@ function _resolveScalar(s) {
 
 function parse(input, opts) {
   opts = opts || {};
-  var maxBytes = (typeof opts.maxBytes === "number" && opts.maxBytes > 0)
+  // Validate operator-supplied numeric opts via lib/numeric-bounds —
+  // Infinity / NaN / negative / non-integer all bypass the
+  // `> 0` shape and silently lift the DoS cap they were meant to enforce.
+  if (opts.maxBytes !== undefined && !numericBounds.isPositiveFiniteInt(opts.maxBytes)) {
+    throw new SafeYamlError("yaml.parse: maxBytes must be a positive finite integer; got " +
+      numericBounds.shape(opts.maxBytes), "yaml/bad-opt");
+  }
+  if (opts.maxDepth !== undefined && !numericBounds.isPositiveFiniteInt(opts.maxDepth)) {
+    throw new SafeYamlError("yaml.parse: maxDepth must be a positive finite integer; got " +
+      numericBounds.shape(opts.maxDepth), "yaml/bad-opt");
+  }
+  if (opts.maxKeys !== undefined && !numericBounds.isPositiveFiniteInt(opts.maxKeys)) {
+    throw new SafeYamlError("yaml.parse: maxKeys must be a positive finite integer; got " +
+      numericBounds.shape(opts.maxKeys), "yaml/bad-opt");
+  }
+  var maxBytes = opts.maxBytes !== undefined
     ? Math.min(opts.maxBytes, C.BYTES.mib(64)) : DEFAULTS.maxBytes;
-  var maxDepth = (typeof opts.maxDepth === "number" && opts.maxDepth > 0)
-    ? Math.min(opts.maxDepth, 1000) : DEFAULTS.maxDepth;
-  var maxKeys = (typeof opts.maxKeys === "number" && opts.maxKeys > 0)
-    ? Math.min(opts.maxKeys, 1000000) : DEFAULTS.maxKeys;
+  var maxDepth = opts.maxDepth !== undefined
+    ? Math.min(opts.maxDepth, 1_000) : DEFAULTS.maxDepth;
+  var maxKeys = opts.maxKeys !== undefined
+    ? Math.min(opts.maxKeys, 1_000_000) : DEFAULTS.maxKeys;
 
   input = safeBuffer.normalizeText(input, {
     maxBytes:   maxBytes,
@@ -147,7 +185,7 @@ function parse(input, opts) {
     var raw = rawLines[i];
     // Strip trailing whitespace from the line for analysis (block-scalar
     // content paths preserve their own internal spacing separately).
-    var trimmed = raw.replace(/[ \t]+$/, "");
+    var trimmed = raw.replace(safeBuffer.TRAILING_HSPACE_RE, "");
     var indent = 0;
     while (indent < raw.length && raw.charAt(indent) === " ") indent += 1;
     if (indent < raw.length && raw.charAt(indent) === "\t") {
@@ -294,7 +332,7 @@ function parse(input, opts) {
     if (raw.charAt(0) === "'") {
       return _decodeSingleQuoted(raw, lineNumber, col);
     }
-    var trimmed = raw.replace(/[ \t]+$/, "");
+    var trimmed = raw.replace(safeBuffer.TRAILING_HSPACE_RE, "");
     if (POISONED_KEYS.has(trimmed)) {
       throw new SafeYamlError("forbidden key '" + trimmed + "'",
         "yaml/poisoned-key", lineNumber, col);
@@ -468,7 +506,7 @@ function parse(input, opts) {
       return sq;
     }
     // Plain scalar — strip trailing space, resolve type.
-    return _resolveScalar(t.replace(/[ \t]+$/, ""));
+    return _resolveScalar(t.replace(safeBuffer.TRAILING_HSPACE_RE, ""));
   }
 
   // For quoted-string termination check on a single-line value.
@@ -584,7 +622,7 @@ function parse(input, opts) {
       if (c === "," || c === "}" || c === "]") break;
       p += 1;
     }
-    var raw = text.substring(start, p).replace(/[ \t]+$/, "");
+    var raw = text.substring(start, p).replace(safeBuffer.TRAILING_HSPACE_RE, "");
     return { value: _resolveScalar(raw), nextPos: p };
   }
 
@@ -607,7 +645,7 @@ function parse(input, opts) {
       if (c === ":" || c === "," || c === "}" || c === "]") break;
       p += 1;
     }
-    return { key: text.substring(start, p).replace(/[ \t]+$/, ""), nextPos: p };
+    return { key: text.substring(start, p).replace(safeBuffer.TRAILING_HSPACE_RE, ""), nextPos: p };
   }
 
   function _findMatchingBracket(text, start, open, close, lineNumber, col) {
@@ -678,10 +716,10 @@ function parse(input, opts) {
           case "0":  out += "\0"; i += 2; break;
           case "u": {
             var hex = raw.substring(i + 2, i + 6);
-            if (!/^[0-9a-fA-F]{4}$/.test(hex)) {
+            if (!safeBuffer.isHex(hex, 4)) {
               throw new SafeYamlError("bad \\u escape", "yaml/bad-escape", lineNumber, col + i);
             }
-            out += String.fromCharCode(parseInt(hex, 16));
+            out += String.fromCharCode(parseInt(hex, RADIX_HEX));
             i += 6;
             break;
           }
@@ -690,7 +728,7 @@ function parse(input, opts) {
             if (!/^[0-9a-fA-F]{8}$/.test(hex8)) {
               throw new SafeYamlError("bad \\U escape", "yaml/bad-escape", lineNumber, col + i);
             }
-            var code = parseInt(hex8, 16);
+            var code = parseInt(hex8, RADIX_HEX);
             if (code > 0x10FFFF) {
               throw new SafeYamlError("\\U code point > U+10FFFF",
                 "yaml/bad-escape", lineNumber, col + i);
@@ -734,7 +772,7 @@ function parse(input, opts) {
   function _stripEolComment(text) {
     // Strip ` #...` comments (must be preceded by whitespace) at end of line.
     var match = text.match(/^(.*?)(\s+#.*)?$/);
-    return (match && match[1] != null ? match[1] : text).replace(/[ \t]+$/, "");
+    return (match && match[1] != null ? match[1] : text).replace(safeBuffer.TRAILING_HSPACE_RE, "");
   }
 
   // ---- Block scalars (| literal, > folded) ----

package/lib/permissions.js

@@ -45,6 +45,7 @@
  * (deny is a security signal), `auditSuccess: false` (per-request noise).
  */
 
+var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var requestHelpers = require("./request-helpers");
 var safeSql = require("./safe-sql");
@@ -55,14 +56,15 @@ var _err = PermissionsError.factory;
 
 var observability = lazyRequire(function () { return require("./observability"); });
 
-function _emitEvent(name, value, labels) {
-  try { observability().event(name, value, labels || {}); }
-  catch (_e) { /* hot-path observability sink — drops silent on internal throws */ }
-}
+function _emitEvent(n, v, l) { observability().safeEvent(n, v, l || {}); }
 
 // Lowercase tokens, digits, dash, underscore, and `*` allowed per
 // segment. Scope format is segments separated by `:`.
 var SCOPE_RE = /^[a-z0-9_*-]+(:[a-z0-9_*-]+)*$/;
+// Bound the regex engine on operator-supplied scope strings. 256 chars
+// holds any realistic real-world scope (typical scopes run 8-32 chars);
+// rejecting longer keeps the regex linear regardless of input shape.
+var SCOPE_MAX_LENGTH = C.BYTES.bytes(256);
 
 // Audit defaults: BOTH success and failure default ON for permissions.
 // Unlike api-key.verify (which is gate-keeping for a downstream action
@@ -109,9 +111,12 @@ function _validateScopePattern(scope, ctx) {
   if (typeof scope !== "string" || scope.length === 0) {
     throw _err("BAD_SCOPE", ctx + ": scope must be a non-empty string, got " + typeof scope);
   }
-  if (!SCOPE_RE.test(scope)) {
+  // Length cap before the regex test — bound the engine on hostile
+  // input lengths even though SCOPE_RE is anchored.
+  if (scope.length > SCOPE_MAX_LENGTH || !SCOPE_RE.test(scope)) {
     throw _err("BAD_SCOPE", ctx + ": scope '" + scope +
-      "' must match " + SCOPE_RE + " (lowercase tokens with optional `*`)");
+      "' is empty, too long, or doesn't match " + SCOPE_RE +
+      " (lowercase tokens with optional `*`)");
   }
 }
 
@@ -241,23 +246,11 @@ function _defaultResolver(req) {
 // ---- Validation: create opts ----
 
 function _validateCreateOpts(opts) {
-  if (!opts || typeof opts !== "object") {
-    throw _err("BAD_OPT", "permissions.create: opts must be an object");
-  }
-  if (opts.resolver !== undefined && typeof opts.resolver !== "function") {
-    throw _err("BAD_OPT", "permissions.create: resolver must be a function");
-  }
-  if (opts.audit !== undefined && opts.audit !== null) {
-    if (typeof opts.audit !== "object" || typeof opts.audit.safeEmit !== "function") {
-      throw _err("BAD_OPT", "permissions.create: audit must be a b.audit-shaped object (safeEmit fn)");
-    }
-  }
-  if (opts.auditFailures !== undefined && typeof opts.auditFailures !== "boolean") {
-    throw _err("BAD_OPT", "permissions.create: auditFailures must be a boolean");
-  }
-  if (opts.auditSuccess !== undefined && typeof opts.auditSuccess !== "boolean") {
-    throw _err("BAD_OPT", "permissions.create: auditSuccess must be a boolean");
-  }
+  validateOpts.requireObject(opts, "permissions.create", PermissionsError);
+  validateOpts.optionalFunction(opts.resolver, "permissions.create: resolver", PermissionsError);
+  validateOpts.auditShape(opts.audit, "permissions.create", PermissionsError);
+  validateOpts.optionalBoolean(opts.auditFailures, "permissions.create: auditFailures", PermissionsError);
+  validateOpts.optionalBoolean(opts.auditSuccess, "permissions.create: auditSuccess", PermissionsError);
   if (opts.denyStatus !== undefined &&
       (typeof opts.denyStatus !== "number" || !isFinite(opts.denyStatus) || opts.denyStatus < 100 || opts.denyStatus > 599)) {
     throw _err("BAD_OPT", "permissions.create: denyStatus must be an HTTP status code (100-599)");
@@ -267,9 +260,7 @@ function _validateCreateOpts(opts) {
        opts.missingActorStatus < 100 || opts.missingActorStatus > 599)) {
     throw _err("BAD_OPT", "permissions.create: missingActorStatus must be an HTTP status code (100-599)");
   }
-  if (opts.responder !== undefined && typeof opts.responder !== "function") {
-    throw _err("BAD_OPT", "permissions.create: responder must be a function");
-  }
+  validateOpts.optionalFunction(opts.responder, "permissions.create: responder", PermissionsError);
 }
 
 // ---- Registry ----
@@ -281,13 +272,14 @@ function create(opts) {
     "denyStatus", "missingActorStatus", "responder",
   ], "permissions");
   _validateCreateOpts(opts);
+  var cfg = validateOpts.applyDefaults(opts, DEFAULTS);
   var roleTable = _validateRoles(opts.roles);
   var resolver  = opts.resolver || _defaultResolver;
   var audit     = opts.audit || null;
-  var auditFailures = (opts.auditFailures === undefined) ? DEFAULTS.auditFailures : opts.auditFailures;
-  var auditSuccess  = (opts.auditSuccess  === undefined) ? DEFAULTS.auditSuccess  : opts.auditSuccess;
-  var denyStatus    = opts.denyStatus    || DEFAULTS.denyStatus;
-  var missingActorStatus = opts.missingActorStatus || DEFAULTS.missingActorStatus;
+  var auditFailures = cfg.auditFailures;
+  var auditSuccess  = cfg.auditSuccess;
+  var denyStatus    = cfg.denyStatus;
+  var missingActorStatus = cfg.missingActorStatus;
   var responder = opts.responder || _defaultResponder;
 
   // ABAC predicate registry. Each entry: scope-string → async predicate
@@ -317,12 +309,11 @@ function create(opts) {
     return policies[requestedScope] || null;
   }
 
+  var _emitRaw = validateOpts.makeAuditEmitter(audit);
   function _auditEmit(action, info) {
-    if (!audit) return;
     if (info && info.outcome === "success" && !auditSuccess) return;
     if (info && info.outcome !== "success" && !auditFailures) return;
-    try { audit.safeEmit(Object.assign({ action: action }, info || {})); }
-    catch (_e) { /* audit best-effort */ }
+    _emitRaw(action, info);
   }
 
   function expand(roleNames) {

package/lib/pqc-agent.js

@@ -37,9 +37,11 @@ var networkTls = require("./network-tls");
 // only the cryptographic posture (ecdhCurve / minVersion) is locked.
 var DEFAULT_OPTS = {
   keepAlive:      true,
-  keepAliveMsecs: 30000,
+  keepAliveMsecs: C.TIME.seconds(30),
   maxSockets:     50,
-  maxFreeSockets: 16,
+  // Pool counts are protocol-side concurrency tunables, not byte
+  // quantities — hex form keeps the byte-shape detector out of it.
+  maxFreeSockets: 0x10,
   scheduling:     "lifo",
 };