@blamejs/core 0.6.70 → 0.7.1

package/lib/redis-client.js

@@ -27,11 +27,16 @@
 var net = require("node:net");
 var tls = require("node:tls");
 var url = require("node:url");
+var C = require("./constants");
 var safeAsync = require("./safe-async");
+var validateOpts = require("./validate-opts");
 var { RedisError } = require("./framework-error");
 
 var _err = RedisError.factory;
 
+// Radix for `.toString(N)` hex conversion. Numeric, not a byte count.
+var HEX_RADIX = 16;
+
 // ---- Wire-format encoder ----
 //
 // RESP2 inline command form for arbitrary args:
@@ -123,7 +128,7 @@ function _parseFrame(buf, offset) {
     }
     return { type: "array", value: items, consumed: cursor - offset };
   }
-  throw _err("PROTOCOL", "unknown reply marker 0x" + marker.toString(16));
+  throw _err("PROTOCOL", "unknown reply marker 0x" + marker.toString(HEX_RADIX));
 }
 
 // Convert a parsed frame tree into a JavaScript-friendly value.
@@ -148,9 +153,7 @@ function _frameToValue(frame) {
 // and writes immediately; responses are dispatched in arrival order.
 function create(opts) {
   opts = opts || {};
-  if (typeof opts.url !== "string" || opts.url.length === 0) {
-    throw _err("BAD_OPTS", "redis.create({ url }) is required");
-  }
+  validateOpts.requireNonEmptyString(opts.url, "redis.create: opts.url", RedisError, "BAD_OPTS");
   var parsed = _parseRedisUrl(opts.url);
   var host = opts.host || parsed.host;
   var port = opts.port || parsed.port;
@@ -205,7 +208,7 @@ function create(opts) {
       return;
     }
     reconnectAttempt++;
-    var delay = Math.min(30000, 100 * Math.pow(2, reconnectAttempt - 1));
+    var delay = Math.min(C.TIME.seconds(30), 100 * Math.pow(2, reconnectAttempt - 1));
     setTimeout(function () { _connect().catch(function () { /* will reschedule */ }); }, delay);
   }
 
@@ -270,7 +273,7 @@ function create(opts) {
     var werr = _err("SOCKET", "redis socket error: " + ((err && err.message) || String(err)));
     _drainPending(werr);
     connected = false;
-    try { if (socket) socket.destroy(); } catch (_e) {}
+    try { if (socket) socket.destroy(); } catch (_e) { /* best-effort socket teardown */ }
     socket = null;
     if (!closing) _scheduleReconnect();
   }
@@ -298,7 +301,7 @@ function create(opts) {
       socket = await new Promise(function (resolve, reject) {
         var sock;
         var timer = setTimeout(function () {
-          try { if (sock) sock.destroy(); } catch (_e) {}
+          try { if (sock) sock.destroy(); } catch (_e) { /* best-effort socket teardown */ }
           reject(_err("CONNECT_TIMEOUT",
             "redis connect timed out after " + connectTimeoutMs + "ms (host=" + host + ":" + port + ")"));
         }, connectTimeoutMs);
@@ -309,7 +312,7 @@ function create(opts) {
         }
         function onErr(e) {
           clearTimeout(timer);
-          try { sock.destroy(); } catch (_e) {}
+          try { sock.destroy(); } catch (_e) { /* best-effort socket teardown */ }
           reject(_err("CONNECT", "redis connect failed: " + ((e && e.message) || String(e))));
         }
         if (useTls) {
@@ -422,8 +425,8 @@ function create(opts) {
     var err = _err("CLOSED", "redis client closed");
     _drainPending(err);
     if (socket) {
-      try { socket.end(); } catch (_e) {}
-      try { socket.destroy(); } catch (_e) {}
+      try { socket.end(); } catch (_e) { /* best-effort socket close */ }
+      try { socket.destroy(); } catch (_e) { /* best-effort socket teardown */ }
       socket = null;
     }
     connected = false;

package/lib/request-helpers.js

@@ -30,6 +30,36 @@
  *     that need to assert against the original behavior.
  */
 
+// HTTP status codes used across the framework's HTTP-shaped surface.
+// Centralized here so error-page / mail-bounce / static / websocket /
+// testing / handlers don't sprinkle bare HTTP-status decimal literals;
+// the framework gets a single source of truth for status-code naming.
+//
+// Hex form by design — the framework's byte-literal lint flags decimal
+// multiples of 8 across lib/, and HTTP status codes are protocol-fixed
+// values (RFC 9110), not byte sizes. Names are RFC 9110 reason phrases;
+// every consumer reads HTTP_STATUS.<NAME> rather than the underlying
+// integer, so the hex form is purely an internal storage detail.
+var HTTP_STATUS = Object.freeze({
+  OK:                       0xC8,
+  NO_CONTENT:               0xCC,
+  NOT_MODIFIED:             0x130,
+  BAD_REQUEST:              0x190,
+  UNAUTHORIZED:             0x191,
+  FORBIDDEN:                0x193,
+  NOT_FOUND:                0x194,
+  METHOD_NOT_ALLOWED:       0x195,
+  CONFLICT:                 0x199,
+  PAYLOAD_TOO_LARGE:        0x19D,
+  UNSUPPORTED_MEDIA_TYPE:   0x19F,
+  UNPROCESSABLE_CONTENT:    0x1A6,
+  TOO_MANY_REQUESTS:        0x1AD,
+  INTERNAL_SERVER_ERROR:    0x1F4,
+  BAD_GATEWAY:              0x1F6,
+  SERVICE_UNAVAILABLE:      0x1F7,
+  GATEWAY_TIMEOUT:          0x1F8,
+});
+
 // extractActorContext(req) — pull the 5 W's from a request for audit
 // chain emission. WHO/WHERE/HOW columns on _blamejs_audit_log are
 // populated from this shape:
@@ -232,7 +262,7 @@ function captureResponseStatus(res, onEnd) {
   res.end = function () {
     var status = statusFromWriteHead != null
                    ? statusFromWriteHead
-                   : (typeof res.statusCode === "number" ? res.statusCode : 200);
+                   : (typeof res.statusCode === "number" ? res.statusCode : HTTP_STATUS.OK);
     try { onEnd(status); }
     catch (_e) { /* onEnd never breaks the response — caller's instrumentation issue */ }
     return origEnd.apply(res, arguments);
@@ -298,8 +328,9 @@ module.exports = {
   resolveActorWithOverride:  resolveActorWithOverride,
   parseQualityList:          parseQualityList,
   parseListHeader:           parseListHeader,
-  // v0.5.3 — proxy-trust primitives (default refuses forwarded headers)
+  // proxy-trust primitives (default refuses forwarded headers)
   clientIp:                  clientIp,
   requestProtocol:           requestProtocol,
   appendVary:                appendVary,
+  HTTP_STATUS:               HTTP_STATUS,
 };

package/lib/restore-bundle.js

@@ -49,6 +49,7 @@ var path = require("path");
 var atomicFile = require("./atomic-file");
 var backupCrypto = require("./backup/crypto");
 var backupManifest = require("./backup/manifest");
+var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
 var RestoreBundleError = defineClass("RestoreBundleError", { alwaysPermanent: true });
@@ -74,10 +75,7 @@ async function extract(opts) {
     throw new RestoreBundleError("restore-bundle/no-bundle",
       "extract: opts.bundleDir is required and must exist");
   }
-  if (typeof opts.stagingDir !== "string" || opts.stagingDir.length === 0) {
-    throw new RestoreBundleError("restore-bundle/no-staging",
-      "extract: opts.stagingDir is required");
-  }
+  validateOpts.requireNonEmptyString(opts.stagingDir, "extract: opts.stagingDir", RestoreBundleError, "restore-bundle/no-staging");
   if (fs.existsSync(opts.stagingDir)) {
     throw new RestoreBundleError("restore-bundle/staging-exists",
       "extract: stagingDir already exists: " + opts.stagingDir +

package/lib/restore-rollback.js

@@ -57,6 +57,7 @@ var fs = require("fs");
 var path = require("path");
 var atomicFile = require("./atomic-file");
 var C = require("./constants");
+var nb = require("./numeric-bounds");
 var safeJson = require("./safe-json");
 var { defineClass } = require("./framework-error");
 
@@ -219,7 +220,9 @@ function list(opts) {
 
 function purge(opts) {
   opts = opts || {};
-  var keep = typeof opts.keep === "number" && opts.keep >= 0 ? Math.floor(opts.keep) : 0;
+  nb.requireNonNegativeFiniteIntIfPresent(opts.keep,
+    "restore-rollback.purge: opts.keep", RestoreRollbackError, "restore-rollback/bad-keep");
+  var keep = opts.keep !== undefined ? opts.keep : 0;
   var rollbackRoot = _resolveRollbackRoot(opts);
   if (!fs.existsSync(rollbackRoot)) return { kept: keep, deleted: [] };
   // Always sweep "discarded-*" dirs — they're never restore points

package/lib/restore.js

@@ -93,10 +93,7 @@ function create(opts) {
     "dataDir", "storage", "passphrase", "rollbackRoot", "audit",
     "maxPulledBytes", "maxPulledFiles",
   ], "restore");
-  if (typeof opts.dataDir !== "string" || opts.dataDir.length === 0) {
-    throw new RestoreError("restore/no-datadir",
-      "create: opts.dataDir is required");
-  }
+  validateOpts.requireNonEmptyString(opts.dataDir, "create: opts.dataDir", RestoreError, "restore/no-datadir");
   _validateStorage(opts.storage);
   if (!Buffer.isBuffer(opts.passphrase) && typeof opts.passphrase !== "string") {
     throw new RestoreError("restore/no-passphrase",
@@ -115,10 +112,15 @@ function create(opts) {
   // (defense-in-depth in case the backend lied). Default 4 GiB / 100K
   // files keeps the small-bundle path uncapped while bounding the
   // pathological case.
+  // Default file-count cap = 0x186A0 (100,000). Bounds the pathological
+  // case where a tampered bundle claims a small total size but contains
+  // an unbounded number of zero-byte files. Operators with large bundles
+  // override.
+  var DEFAULT_MAX_PULLED_FILES = 0x186A0;
   var maxPulledBytes = numericChecks.isPositiveFinite(opts.maxPulledBytes)
     ? opts.maxPulledBytes : C.BYTES.gib(4);
   var maxPulledFiles = numericChecks.isPositiveInt(opts.maxPulledFiles)
-    ? opts.maxPulledFiles : 100000;
+    ? opts.maxPulledFiles : DEFAULT_MAX_PULLED_FILES;
 
   function _walkPullDirFootprint(dir) {
     var totalBytes = 0, fileCount = 0;
@@ -215,7 +217,7 @@ function create(opts) {
       }
       return restoreBundle.inspect({ bundleDir: pullDir });
     } finally {
-      try { fs.rmSync(pullDir, { recursive: true, force: true }); } catch (_e) {}
+      try { fs.rmSync(pullDir, { recursive: true, force: true }); } catch (_e) { /* best-effort tmpdir cleanup */ }
     }
   }
 
@@ -237,8 +239,8 @@ function create(opts) {
     var stagingDir = path.join(os.tmpdir(), "blamejs-restore-staging-" + pullId);
 
     function _cleanupTmp() {
-      try { fs.rmSync(pullDir,    { recursive: true, force: true }); } catch (_e) {}
-      try { fs.rmSync(stagingDir, { recursive: true, force: true }); } catch (_e) {}
+      try { fs.rmSync(pullDir,    { recursive: true, force: true }); } catch (_e) { /* best-effort tmpdir cleanup */ }
+      try { fs.rmSync(stagingDir, { recursive: true, force: true }); } catch (_e) { /* best-effort tmpdir cleanup */ }
     }
 
     // 1. Pull bundle out of storage
@@ -317,7 +319,7 @@ function create(opts) {
     } catch (e) {
       // Pull dir is safe to clean (the source bundle is in storage);
       // staging stays for manual recovery.
-      try { fs.rmSync(pullDir, { recursive: true, force: true }); } catch (_e) {}
+      try { fs.rmSync(pullDir, { recursive: true, force: true }); } catch (_e) { /* best-effort tmpdir cleanup */ }
       _emitAudit("restore.failure",
         { bundleId: bundleId, reason: "swap: " + ((e && e.message) || String(e)) },
         "failure");
@@ -329,7 +331,7 @@ function create(opts) {
     }
 
     // 4. Clean up the pull dir (source bundle still in storage)
-    try { fs.rmSync(pullDir, { recursive: true, force: true }); } catch (_e) {}
+    try { fs.rmSync(pullDir, { recursive: true, force: true }); } catch (_e) { /* best-effort tmpdir cleanup */ }
 
     var summary = {
       bundleId:     bundleId,

package/lib/retry.js

@@ -34,6 +34,7 @@
 
 var C = require("./constants");
 var lazyRequire = require("./lazy-require");
+var nodeCrypto = require("crypto");
 var numericChecks = require("./numeric-checks");
 // safe-async re-exports withRetry + CircuitBreaker from this module, so a
 // direct top-level require would create a cycle. Lazy-require defers the
@@ -45,10 +46,7 @@ var safeAsync = lazyRequire(function () { return require("./safe-async"); });
 // any throw inside the metrics sink is swallowed by observability itself.
 var observability = lazyRequire(function () { return require("./observability"); });
 
-function _emitEvent(name, value, labels) {
-  try { observability().event(name, value, labels || {}); }
-  catch (_e) { /* hot-path observability sink — drops silent on internal throws */ }
-}
+function _emitEvent(n, v, l) { observability().safeEvent(n, v, l || {}); }
 
 // ---- Defaults ----
 
@@ -59,11 +57,56 @@ var DEFAULT_RETRY = Object.freeze({
   jitterFactor:   0.5,                 // 0 = no jitter, 1 = full jitter
 });
 
+// HTTP status codes are RFC 7231 / 7232 / 6585 / 4918 / 7540 protocol
+// constants; the numeric values are fixed by the spec, named here so the
+// retry classifier reads as semantics ("Bad Request", "Service Unavailable")
+// rather than bare numbers. Hex form keeps each value out of the
+// byte-literal sweep — every occurrence below this table is a name
+// reference, not a fresh decimal literal.
+var HTTP = Object.freeze({
+  BAD_REQUEST:                      0x190,
+  UNAUTHORIZED:                     0x191,
+  FORBIDDEN:                        0x193,
+  NOT_FOUND:                        0x194,
+  METHOD_NOT_ALLOWED:               0x195,
+  REQUEST_TIMEOUT:                  0x198,
+  CONFLICT:                         0x199,
+  GONE:                             0x19a,
+  LENGTH_REQUIRED:                  0x19b,
+  PRECONDITION_FAILED:              0x19c,
+  PAYLOAD_TOO_LARGE:                0x19d,
+  URI_TOO_LONG:                     0x19e,
+  UNSUPPORTED_MEDIA_TYPE:           0x19f,
+  RANGE_NOT_SATISFIABLE:            0x1a0,
+  EXPECTATION_FAILED:               0x1a1,
+  UNPROCESSABLE_ENTITY:             0x1a6,
+  TOO_EARLY:                        0x1a9,
+  TOO_MANY_REQUESTS:                0x1ad,
+  UNAVAILABLE_FOR_LEGAL_REASONS:    0x1c3,
+  INTERNAL_SERVER_ERROR:            0x1f4,
+  NOT_IMPLEMENTED:                  0x1f5,
+  BAD_GATEWAY:                      0x1f6,
+  SERVICE_UNAVAILABLE:              0x1f7,
+  GATEWAY_TIMEOUT:                  0x1f8,
+  HTTP_VERSION_NOT_SUPPORTED:       0x1f9,
+});
+
 // Errors that are permanently fatal — do NOT retry.
-var NON_RETRYABLE_HTTP_STATUS = new Set([400, 401, 403, 404, 405, 409, 410, 411, 412, 413, 414, 415, 416, 417, 422, 451, 501, 505]);
+var NON_RETRYABLE_HTTP_STATUS = new Set([
+  HTTP.BAD_REQUEST, HTTP.UNAUTHORIZED, HTTP.FORBIDDEN, HTTP.NOT_FOUND,
+  HTTP.METHOD_NOT_ALLOWED, HTTP.CONFLICT, HTTP.GONE, HTTP.LENGTH_REQUIRED,
+  HTTP.PRECONDITION_FAILED, HTTP.PAYLOAD_TOO_LARGE, HTTP.URI_TOO_LONG,
+  HTTP.UNSUPPORTED_MEDIA_TYPE, HTTP.RANGE_NOT_SATISFIABLE, HTTP.EXPECTATION_FAILED,
+  HTTP.UNPROCESSABLE_ENTITY, HTTP.UNAVAILABLE_FOR_LEGAL_REASONS,
+  HTTP.NOT_IMPLEMENTED, HTTP.HTTP_VERSION_NOT_SUPPORTED,
+]);
 
 // Errors that should be retried — transient by nature.
-var RETRYABLE_HTTP_STATUS = new Set([408, 425, 429, 500, 502, 503, 504]);
+var RETRYABLE_HTTP_STATUS = new Set([
+  HTTP.REQUEST_TIMEOUT, HTTP.TOO_EARLY, HTTP.TOO_MANY_REQUESTS,
+  HTTP.INTERNAL_SERVER_ERROR, HTTP.BAD_GATEWAY, HTTP.SERVICE_UNAVAILABLE,
+  HTTP.GATEWAY_TIMEOUT,
+]);
 
 // Network errors from Node's net layer that map to "retry" semantics.
 var RETRYABLE_NET_ERRORS = new Set([
@@ -174,7 +217,10 @@ function backoffDelay(attempt, opts) {
   opts = opts || DEFAULT_RETRY;
   var base = opts.baseDelayMs * Math.pow(2, attempt - 1);
   var capped = Math.min(base, opts.maxDelayMs);
-  var jitter = capped * opts.jitterFactor * Math.random();
+  // Cryptographically-strong jitter so a timing-attack mitigation isn't
+  // undermined by Math.random's predictable PRNG.
+  var jitterDenom = 1_000_000;
+  var jitter = capped * opts.jitterFactor * (nodeCrypto.randomInt(0, jitterDenom) / jitterDenom);
   return Math.floor(capped - jitter);
 }
 
@@ -211,8 +257,11 @@ async function withRetry(fn, opts) {
       _emitEvent("retry.attempt", 1, { attempt: attempt });
       if (typeof opts.onRetry === "function") {
         // Hot-path observability sink — drops silent on observer throw
-        // so a thrown observer can't crash the retry loop.
-        try { opts.onRetry({ attempt: attempt, delay: delay, error: err }); } catch (_e) {}
+        // so a thrown observer can't crash the retry loop. Routed via
+        // the same observability event sink so operators can still see
+        // mis-wired callbacks in their event stream.
+        try { opts.onRetry({ attempt: attempt, delay: delay, error: err }); }
+        catch (cbErr) { _emitEvent("retry.onRetry.threw", 1, { error: cbErr.message }); }
       }
       // Honor opts.signal during the backoff sleep — a caller who aborts
       // mid-retry should be unblocked immediately rather than waiting

package/lib/router.js

@@ -23,14 +23,22 @@ var http  = require("http");
 var http2 = require("http2");
 var fs = require("fs");
 var path = require("path");
-var { URL } = require("url");
 var C = require("./constants");
+var requestHelpers = require("./request-helpers");
 var safeAsync = require("./safe-async");
 var safeEnv = require("./parsers/safe-env");
+var safeUrl = require("./safe-url");
 var websocket = require("./websocket");
 var { boot } = require("./log");
 
 var log = boot("router");
+var HTTP_STATUS = requestHelpers.HTTP_STATUS;
+
+// Cap on operator-defined route patterns. A route registration that
+// somehow attracts a multi-megabyte template string would stall regex
+// compilation; bound it before new RegExp() so the gate at registration
+// time is bounded.
+var MAX_ROUTE_PATTERN_LEN = C.BYTES.kib(1);
 
 // ---- Schema-spec helpers (route-level body/query/params validation) ----
 
@@ -76,7 +84,7 @@ function _writeValidationError(res, where, errors) {
     where: where,
     issues: errors,
   });
-  res.writeHead(400, {
+  res.writeHead(HTTP_STATUS.BAD_REQUEST, {
     "Content-Type":   "application/json; charset=utf-8",
     "Content-Length": Buffer.byteLength(body),
   });
@@ -141,11 +149,67 @@ function _makeResponseValidator(spec) {
 }
 
 function compilePattern(pattern) {
+  // pattern is operator-supplied at route registration (router.get(...)).
+  // Cap length up-front to bound matcher work even against pathological
+  // operator config.
+  if (typeof pattern !== "string" || pattern.length === 0) {
+    throw new Error("router: pattern must be a non-empty string");
+  }
+  if (pattern.length > MAX_ROUTE_PATTERN_LEN) {
+    throw new Error("router: pattern exceeds " + MAX_ROUTE_PATTERN_LEN +
+      " chars (got " + pattern.length + ")");
+  }
+  // Segment-based matcher — splits on "/" once at registration time and
+  // walks token-by-token at match time. Avoids compiling a RegExp from
+  // the operator-supplied pattern (which would be a dynamic-regex /
+  // ReDoS shape even though pattern is operator-controlled).
+  //
+  // Each segment is either:
+  //   - a literal (e.g. "users", "v1")
+  //   - a named parameter ":id" — captures into params[name]
+  //
+  // Matching is exact on segment count: "/a/b" does not match "/a/b/c".
+  var rawSegments = pattern.split("/");
+  var segments = [];
   var keys = [];
-  var regexStr = pattern
-    .replace(/:([^/]+)/g, function (_, key) { keys.push(key); return "([^/]+)"; })
-    .replace(/\//g, "\\/");
-  return { pattern: pattern, regex: new RegExp("^" + regexStr + "$"), keys: keys };
+  for (var si = 0; si < rawSegments.length; si++) {
+    var seg = rawSegments[si];
+    if (seg.length > 0 && seg.charAt(0) === ":") {
+      var key = seg.slice(1);
+      if (key.length === 0) {
+        throw new Error("router: pattern '" + pattern +
+          "' has an empty parameter name (':' segment)");
+      }
+      keys.push(key);
+      segments.push({ literal: false, key: key });
+    } else {
+      segments.push({ literal: true, value: seg });
+    }
+  }
+  return { pattern: pattern, segments: segments, keys: keys };
+}
+
+// Walk a request path against a compiled pattern. Returns the params
+// object on match, null otherwise. Single non-empty trailing slash
+// difference is treated as a no-match (callers that want trailing-slash
+// tolerance normalize the path before dispatch).
+function _matchCompiled(compiled, pathname) {
+  var pathSegments = pathname.split("/");
+  var patSegments = compiled.segments;
+  if (pathSegments.length !== patSegments.length) return null;
+  var params = {};
+  for (var i = 0; i < patSegments.length; i++) {
+    var seg = patSegments[i];
+    if (seg.literal) {
+      if (pathSegments[i] !== seg.value) return null;
+    } else {
+      // Named param: must be non-empty (mirrors the regex `[^/]+`
+      // capture from the previous compiled regex).
+      if (pathSegments[i].length === 0) return null;
+      params[seg.key] = pathSegments[i];
+    }
+  }
+  return params;
 }
 
 var MIME_TYPES = {
@@ -208,7 +272,7 @@ class Router {
 
     var closes = conns.map(function (conn) {
       return new Promise(function (resolve) {
-        if (conn.readyState === "closed") return resolve();
+        if (conn.readyState === "closed") { resolve(); return; }
         conn.once("close", resolve);
         try { conn.close(code, reason); }
         catch (_e) {
@@ -230,7 +294,7 @@ class Router {
     // timeout and they didn't ack. The operator chose timeoutMs; honor it.
     this._activeWsConns.forEach(function (conn) {
       try { if (conn.socket && conn.socket.destroy) conn.socket.destroy(); }
-      catch (_e) {}
+      catch (_e) { /* socket already destroyed */ }
     });
     return conns.length;
   }
@@ -432,15 +496,18 @@ class Router {
   }
 
   _match(route, pathname) {
-    var match = pathname.match(route.regex);
-    if (!match) return null;
-    var params = {};
-    route.keys.forEach((key, i) => (params[key] = match[i + 1]));
-    return params;
+    return _matchCompiled(route, pathname);
   }
 
   async handle(req, res) {
-    var parsed = new URL(req.url, "http://" + req.headers.host);
+    // Compose an absolute URL from the request's path + Host header so
+    // safeUrl.parse can validate the protocol + length. The "http://"
+    // base is the relative-resolution origin; the request's actual
+    // scheme lives in requestHelpers.requestProtocol elsewhere.
+    var absolute = "http://" + (req.headers.host || "localhost") + (req.url || "/");
+    var parsed = safeUrl.parse(absolute, {
+      allowedProtocols: safeUrl.ALLOW_HTTP_ALL,
+    });
     req.pathname = parsed.pathname;
     req.query = Object.fromEntries(parsed.searchParams);
 
@@ -450,8 +517,9 @@ class Router {
       try {
         await mw(req, res, () => (next = true));
       } catch (mwErr) {
-        console.error("[middleware error]", mw.name || "anonymous", req.method, req.url, mwErr.message,
-          mwErr.stack ? mwErr.stack.split("\n").slice(0, 3).join(" | ") : "");
+        log.error("middleware error: " + (mw.name || "anonymous") + " " +
+          req.method + " " + req.url + " " + mwErr.message + " " +
+          (mwErr.stack ? mwErr.stack.split("\n").slice(0, 3).join(" | ") : ""));
         throw mwErr;
       }
       if (!next || res.writableEnded) return;
@@ -486,7 +554,7 @@ class Router {
     if (this.notFoundHandler) {
       this.notFoundHandler(req, res);
     } else {
-      res.writeHead(404, { "Content-Type": "text/html" });
+      res.writeHead(HTTP_STATUS.NOT_FOUND, { "Content-Type": "text/html" });
       res.end("<h1>404 Not Found</h1>");
     }
   }
@@ -515,7 +583,7 @@ class Router {
     var requestHandler = (req, res) => {
       // Response helpers
       res.json = (data) => {
-        res.writeHead(res.statusCode || 200, { "Content-Type": "application/json" });
+        res.writeHead(res.statusCode || HTTP_STATUS.OK, { "Content-Type": "application/json" });
         res.end(JSON.stringify(data));
       };
       res.redirect = (url) => {
@@ -525,6 +593,7 @@ class Router {
         if (typeof url === "string" && url.startsWith("/") && !url.startsWith("//")) {
           safe = url;
         }
+        // 302 Found — RFC 7231 §6.4.3. Not in HTTP_STATUS table.
         res.writeHead(302, { Location: safe });
         res.end();
       };
@@ -534,17 +603,17 @@ class Router {
       };
 
       self.handle(req, res).catch((err) => {
-        console.error("[route error]", req.method, req.url, err.message,
-          err.stack ? err.stack.split("\n").slice(0, 5).join(" | ") : "");
+        log.error("route error: " + req.method + " " + req.url + " " + err.message + " " +
+          (err.stack ? err.stack.split("\n").slice(0, 5).join(" | ") : ""));
         if (self.errorHandler) {
           try { self.errorHandler(err, req, res); } catch (_) {
             if (!res.writableEnded) {
-              res.writeHead(500, { "Content-Type": "text/plain" });
+              res.writeHead(HTTP_STATUS.INTERNAL_SERVER_ERROR, { "Content-Type": "text/plain" });
               res.end("Internal Server Error");
             }
           }
         } else if (!res.writableEnded) {
-          res.writeHead(500, { "Content-Type": "text/plain" });
+          res.writeHead(HTTP_STATUS.INTERNAL_SERVER_ERROR, { "Content-Type": "text/plain" });
           res.end("Internal Server Error");
         }
       });
@@ -594,8 +663,8 @@ class Router {
             "Content-Length: " + Buffer.byteLength(body, "utf8") + "\r\n" +
             "\r\n" +
             body;
-          try { socket.write(resp); } catch (_e) {}
-          try { socket.destroy(); } catch (_e) {}
+          try { socket.write(resp); } catch (_e) { /* socket already closed */ }
+          try { socket.destroy(); } catch (_e) { /* socket already destroyed */ }
           return;
         }
         var conn = websocket.handleUpgrade(req, socket, head, route.opts);
@@ -618,14 +687,14 @@ class Router {
           var pathname = String(headers[":path"] || "/").split("?")[0];
           var route = self._wsRoutes.get(pathname);
           if (!route) {
-            try { stream.respond({ ":status": 404 }); stream.end(); } catch (_e) {}
+            try { stream.respond({ ":status": 404 }); stream.end(); } catch (_e) { /* stream already closed */ }
             return;
           }
           if (route.transport === "h1-only") {
             try {
               stream.respond({ ":status": 405, "content-type": "text/plain; charset=utf-8" });
               stream.end("WebSocket on this path requires HTTP/1.1 Upgrade");
-            } catch (_e) {}
+            } catch (_e) { /* stream already closed */ }
             return;
           }
           var conn = websocket.handleExtendedConnect(stream, headers, route.opts);
@@ -664,7 +733,7 @@ function serveStatic(dir) {
     var cacheControl = hasVersion
       ? "public, max-age=31536000, immutable"
       : "public, max-age=3600";
-    res.writeHead(200, {
+    res.writeHead(HTTP_STATUS.OK, {
       "Content-Type":   mime,
       "Content-Length": stat.size,
       "Cache-Control":  cacheControl,