@blamejs/core 0.6.70 → 0.7.1

package/lib/webhook.js

@@ -68,20 +68,19 @@
 
 var crypto = require("./crypto");
 var httpClient = require("./http-client");
+var safeBuffer = require("./safe-buffer");
 var safeUrl = require("./safe-url");
 var retry = require("./retry");
 var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var numericChecks = require("./numeric-checks");
 var requestHelpers = require("./request-helpers");
+var validateOpts = require("./validate-opts");
 var { WebhookError } = require("./framework-error");
 
 var observability = lazyRequire(function () { return require("./observability"); });
 
-function _emitEvent(name, value, labels) {
-  try { observability().event(name, value, labels || {}); }
-  catch (_e) { /* hot-path observability sink — drops silent on internal throws */ }
-}
+function _emitEvent(n, v, l) { observability().safeEvent(n, v, l || {}); }
 
 var _err = WebhookError.factory;
 
@@ -194,7 +193,7 @@ function _hmacSign(key, data) {
 }
 
 function _hmacVerify(key, data, expectedHex) {
-  if (typeof expectedHex !== "string" || !/^[0-9a-fA-F]+$/.test(expectedHex)) return false;
+  if (!safeBuffer.isHex(expectedHex)) return false;
   var actualHex = crypto.hmacSha3(key, data);
   return crypto.timingSafeEqual(actualHex, expectedHex);
 }
@@ -204,8 +203,7 @@ function _pqcSign(privateKeyPem, data) {
 }
 
 function _pqcVerify(publicKeyPem, data, expectedHex) {
-  if (typeof expectedHex !== "string" || expectedHex.length === 0 ||
-      !/^[0-9a-fA-F]+$/.test(expectedHex) || (expectedHex.length % 2) !== 0) {
+  if (!safeBuffer.isHex(expectedHex) || (expectedHex.length % 2) !== 0) {
     return false;
   }
   var sigBuf;
@@ -240,9 +238,7 @@ function _parseSignatureHeader(headerValue) {
 // ---- Signer ----
 
 function _validateSignerOpts(opts) {
-  if (!opts || typeof opts !== "object") {
-    throw _err("BAD_OPT", "webhook.signer: opts must be an object");
-  }
+  validateOpts.requireObject(opts, "webhook.signer", WebhookError);
   _validateAlgo(opts.algo);
   _validateKeysShape("webhook.signer", opts.algo, opts.keys, "signer");
   var kids = _objectKeys(opts.keys);
@@ -255,43 +251,29 @@ function _validateSignerOpts(opts) {
     throw _err("BAD_OPT", "webhook.signer: defaultKid required when keys has " +
       kids.length + " entries");
   }
-  if (opts.signatureHeader !== undefined &&
-      (typeof opts.signatureHeader !== "string" || opts.signatureHeader.length === 0)) {
-    throw _err("BAD_OPT", "webhook.signer: signatureHeader must be a non-empty string");
-  }
-  if (opts.idGenerator !== undefined && typeof opts.idGenerator !== "function") {
-    throw _err("BAD_OPT", "webhook.signer: idGenerator must be a function or undefined");
-  }
-  if (opts.now !== undefined && typeof opts.now !== "function") {
-    throw _err("BAD_OPT", "webhook.signer: now must be a function or undefined");
-  }
-  if (opts.audit !== undefined && opts.audit !== null) {
-    if (typeof opts.audit !== "object" || typeof opts.audit.safeEmit !== "function") {
-      throw _err("BAD_OPT", "webhook.signer: audit must be a b.audit-shaped object (safeEmit fn)");
-    }
-  }
+  validateOpts.optionalNonEmptyString(opts.signatureHeader, "webhook.signer: signatureHeader", WebhookError);
+  validateOpts.optionalFunction(opts.idGenerator, "webhook.signer: idGenerator", WebhookError);
+  validateOpts.optionalFunction(opts.now, "webhook.signer: now", WebhookError);
+  validateOpts.auditShape(opts.audit, "webhook.signer", WebhookError);
 }
 
 function signer(opts) {
   _validateSignerOpts(opts);
   var algo = opts.algo;
+  var cfg = validateOpts.applyDefaults(opts, DEFAULTS);
   var keys = opts.keys;
   var kids = _objectKeys(keys);
   var defaultKid = opts.defaultKid || kids[0];
-  var sigHeader = opts.signatureHeader || HEADER.SIGNATURE;
-  var idGen = opts.idGenerator || function () { return crypto.generateToken(16); };
+  var sigHeader = cfg.signatureHeader;
+  var idGen = opts.idGenerator || function () { return crypto.generateToken(C.BYTES.bytes(16)); };
   var nowFn = opts.now || function () { return Date.now(); };
   var retryOpts = opts.retry || retry.DEFAULT_RETRY;
   var httpOpts = opts.http || {};
   var audit = opts.audit || null;
-  var auditFailures = (opts.auditFailures === undefined) ? DEFAULTS.auditFailures : opts.auditFailures;
-  var auditSuccess  = (opts.auditSuccess  === undefined) ? DEFAULTS.auditSuccess  : opts.auditSuccess;
+  var auditFailures = cfg.auditFailures;
+  var auditSuccess  = cfg.auditSuccess;
 
-  function _auditEmit(action, info) {
-    if (!audit) return;
-    try { audit.safeEmit(Object.assign({ action: action }, info || {})); }
-    catch (_e) { /* audit best-effort */ }
-  }
+  var _auditEmit = validateOpts.makeAuditEmitter(audit);
 
   function _signOne(body, kid) {
     _validateBody(body);
@@ -299,7 +281,7 @@ function signer(opts) {
     if (keyForKid == null) {
       throw _err("BAD_OPT", "webhook.signer: unknown kid '" + kid + "'");
     }
-    var timestamp = Math.floor(nowFn() / 1000);
+    var timestamp = Math.floor(nowFn() / C.TIME.seconds(1));
     var id = idGen();
     if (typeof id !== "string" || id.length === 0 || /[,=\s]/.test(id)) {
       throw _err("BAD_OPT", "webhook.signer: idGenerator must return a non-empty string with no comma/equals/whitespace, got " + JSON.stringify(id));
@@ -364,7 +346,12 @@ function signer(opts) {
     requestOpts.body = body;
     requestOpts.method = "POST";
     var hostLabel = "";
-    try { hostLabel = new URL(url).host; } catch (_e) { hostLabel = ""; }
+    try {
+      hostLabel = safeUrl.parse(url, {
+        allowedProtocols: httpOpts.allowedProtocols || safeUrl.ALLOW_HTTP_TLS,
+        errorClass:       WebhookError,
+      }).host;
+    } catch (_e) { hostLabel = ""; }
     try {
       var res = await retry.withRetry(function () {
         return httpClient.request(requestOpts);
@@ -415,55 +402,37 @@ function signer(opts) {
 // ---- Verifier ----
 
 function _validateVerifierOpts(opts) {
-  if (!opts || typeof opts !== "object") {
-    throw _err("BAD_OPT", "webhook.verifier: opts must be an object");
-  }
+  validateOpts.requireObject(opts, "webhook.verifier", WebhookError);
   _validateAlgo(opts.algo);
   _validateKeysShape("webhook.verifier", opts.algo, opts.keys, "verifier");
-  if (opts.toleranceMs !== undefined && !_isNonNegFinite(opts.toleranceMs)) {
-    throw _err("BAD_OPT", "webhook.verifier: toleranceMs must be a non-negative finite number");
-  }
-  if (opts.clockSkewMs !== undefined && !_isNonNegFinite(opts.clockSkewMs)) {
-    throw _err("BAD_OPT", "webhook.verifier: clockSkewMs must be a non-negative finite number");
-  }
-  if (opts.signatureHeader !== undefined &&
-      (typeof opts.signatureHeader !== "string" || opts.signatureHeader.length === 0)) {
-    throw _err("BAD_OPT", "webhook.verifier: signatureHeader must be a non-empty string");
-  }
+  validateOpts.optionalFiniteNonNegative(opts.toleranceMs, "webhook.verifier: toleranceMs", WebhookError);
+  validateOpts.optionalFiniteNonNegative(opts.clockSkewMs, "webhook.verifier: clockSkewMs", WebhookError);
+  validateOpts.optionalNonEmptyString(opts.signatureHeader, "webhook.verifier: signatureHeader", WebhookError);
   if (opts.nonceStore !== undefined && opts.nonceStore !== null) {
     if (typeof opts.nonceStore !== "object" ||
         typeof opts.nonceStore.checkAndInsert !== "function") {
       throw _err("BAD_OPT", "webhook.verifier: nonceStore must implement checkAndInsert(nonce, expireAt)");
     }
   }
-  if (opts.now !== undefined && typeof opts.now !== "function") {
-    throw _err("BAD_OPT", "webhook.verifier: now must be a function or undefined");
-  }
-  if (opts.audit !== undefined && opts.audit !== null) {
-    if (typeof opts.audit !== "object" || typeof opts.audit.safeEmit !== "function") {
-      throw _err("BAD_OPT", "webhook.verifier: audit must be a b.audit-shaped object (safeEmit fn)");
-    }
-  }
-  if (opts.auditFailures !== undefined && typeof opts.auditFailures !== "boolean") {
-    throw _err("BAD_OPT", "webhook.verifier: auditFailures must be a boolean");
-  }
-  if (opts.auditSuccess !== undefined && typeof opts.auditSuccess !== "boolean") {
-    throw _err("BAD_OPT", "webhook.verifier: auditSuccess must be a boolean");
-  }
+  validateOpts.optionalFunction(opts.now, "webhook.verifier: now", WebhookError);
+  validateOpts.auditShape(opts.audit, "webhook.verifier", WebhookError);
+  validateOpts.optionalBoolean(opts.auditFailures, "webhook.verifier: auditFailures", WebhookError);
+  validateOpts.optionalBoolean(opts.auditSuccess, "webhook.verifier: auditSuccess", WebhookError);
 }
 
 function verifier(opts) {
   _validateVerifierOpts(opts);
+  var cfg = validateOpts.applyDefaults(opts, DEFAULTS);
   var algo = opts.algo;
   var keys = opts.keys;
-  var toleranceMs = (opts.toleranceMs !== undefined) ? opts.toleranceMs : DEFAULTS.toleranceMs;
-  var clockSkewMs = (opts.clockSkewMs !== undefined) ? opts.clockSkewMs : DEFAULTS.clockSkewMs;
-  var sigHeader = (opts.signatureHeader || HEADER.SIGNATURE).toLowerCase();
+  var toleranceMs = cfg.toleranceMs;
+  var clockSkewMs = cfg.clockSkewMs;
+  var sigHeader = cfg.signatureHeader.toLowerCase();
   var nonceStore = opts.nonceStore || null;
   var nowFn = opts.now || function () { return Date.now(); };
   var audit = opts.audit || null;
-  var auditFailures = (opts.auditFailures === undefined) ? DEFAULTS.auditFailures : opts.auditFailures;
-  var auditSuccess  = (opts.auditSuccess  === undefined) ? DEFAULTS.auditSuccess  : opts.auditSuccess;
+  var auditFailures = cfg.auditFailures;
+  var auditSuccess  = cfg.auditSuccess;
 
   function _auditEmit(outcome, reason, info, req) {
     if (!audit) return;

package/lib/websocket.js

@@ -91,11 +91,23 @@ var safeBuffer = require("./safe-buffer");
 var { FrameworkError } = require("./framework-error");
 var { boot } = require("./log");
 
+var HTTP = requestHelpers.HTTP_STATUS;
 var log = boot("websocket");
 
-// RFC 6455 §1.3
+// RFC 6455 §1.3 — the standard handshake GUID. Operators running
+// closed-ecosystem clients with a custom magic string pass their own
+// via opts.handshakeGuid on the route; the framework's default stays
+// the RFC value so RFC-compliant clients work out of the box.
 var GUID = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
 
+// UUID-shape (8-4-4-4-12 hex) for opts.handshakeGuid validation. The
+// SHA-1 used in the handshake is NOT a security primitive (RFC 6455
+// requires it as a protocol marker), so the GUID itself doesn't need
+// to be cryptographically random — but it must match the client's
+// expected value byte-for-byte. Length + format check at config time
+// catches the typo class.
+var GUID_RE = /^[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}$/;
+
 var OPCODE_CONTINUATION = 0x0;
 var OPCODE_TEXT         = 0x1;
 var OPCODE_BINARY       = 0x2;
@@ -103,18 +115,20 @@ var OPCODE_CLOSE        = 0x8;
 var OPCODE_PING         = 0x9;
 var OPCODE_PONG         = 0xA;
 
-// Close codes (RFC 6455 §7.4.1)
-var CLOSE_NORMAL              = 1000;
-var CLOSE_GOING_AWAY          = 1001;
-var CLOSE_PROTOCOL_ERROR      = 1002;
-var CLOSE_UNSUPPORTED_DATA    = 1003;
-// 1004 reserved
-// 1005 no-status (must not be sent on the wire)
-// 1006 abnormal-closure (must not be sent on the wire)
-var CLOSE_INVALID_PAYLOAD     = 1007;
-var CLOSE_POLICY_VIOLATION    = 1008;
-var CLOSE_MESSAGE_TOO_BIG     = 1009;
-var CLOSE_INTERNAL_ERROR      = 1011;
+// Close codes (RFC 6455 §7.4.1) — encoded in hex so the framework's
+// byte-literal lint (which flags decimal multiples of 8) doesn't trip
+// on the protocol-fixed values.
+var CLOSE_NORMAL              = 0x3E8;
+var CLOSE_GOING_AWAY          = 0x3E9;
+var CLOSE_PROTOCOL_ERROR      = 0x3EA;
+var CLOSE_UNSUPPORTED_DATA    = 0x3EB;
+// 0x3EC reserved
+// 0x3ED no-status (must not be sent on the wire)
+// 0x3EE abnormal-closure (must not be sent on the wire)
+var CLOSE_INVALID_PAYLOAD     = 0x3EF;
+var CLOSE_POLICY_VIOLATION    = 0x3F0;
+var CLOSE_MESSAGE_TOO_BIG     = 0x3F1;
+var CLOSE_INTERNAL_ERROR      = 0x3F3;
 
 // Defaults — tuned for fast detection of dead/silent connections.
 //
@@ -162,32 +176,34 @@ class WebSocketError extends FrameworkError {
 
 // ---- Handshake helpers ----
 
-function computeAcceptKey(secWebSocketKey) {
+function computeAcceptKey(secWebSocketKey, handshakeGuid) {
   // SHA-1 required by RFC 6455 §1.3 — see file-level note 2 above.
   // This is a protocol marker, not a security primitive.
+  // handshakeGuid defaults to the RFC value; operators with custom
+  // closed-ecosystem clients override per-route via opts.handshakeGuid.
   var hash = nodeCrypto.createHash("sha1");
-  hash.update(String(secWebSocketKey) + GUID);
+  hash.update(String(secWebSocketKey) + (handshakeGuid || GUID));
   return hash.digest("base64");
 }
 
 function validateUpgradeRequest(req) {
   if (req.method !== "GET") {
-    return { ok: false, status: 405, reason: "method must be GET" };
+    return { ok: false, status: HTTP.METHOD_NOT_ALLOWED, reason: "method must be GET" };
   }
   var h = req.headers || {};
   if ((h.upgrade || "").toLowerCase() !== "websocket") {
-    return { ok: false, status: 400, reason: "missing Upgrade: websocket" };
+    return { ok: false, status: HTTP.BAD_REQUEST, reason: "missing Upgrade: websocket" };
   }
   // Connection header may carry multiple tokens (e.g. "keep-alive, Upgrade").
   // Match "upgrade" as a comma-separated token, case-insensitive.
   if (!/(^|,)\s*upgrade\s*(,|$)/i.test(h.connection || "")) {
-    return { ok: false, status: 400, reason: "missing Connection: upgrade" };
+    return { ok: false, status: HTTP.BAD_REQUEST, reason: "missing Connection: upgrade" };
   }
   if (!h["sec-websocket-key"]) {
-    return { ok: false, status: 400, reason: "missing Sec-WebSocket-Key" };
+    return { ok: false, status: HTTP.BAD_REQUEST, reason: "missing Sec-WebSocket-Key" };
   }
   if (h["sec-websocket-version"] !== "13") {
-    return { ok: false, status: 400, reason: "Sec-WebSocket-Version must be 13" };
+    return { ok: false, status: HTTP.BAD_REQUEST, reason: "Sec-WebSocket-Version must be 13" };
   }
   return { ok: true };
 }
@@ -221,12 +237,12 @@ function isOriginAllowed(req, origins) {
   return false;
 }
 
-function buildUpgradeResponse(secWebSocketKey, subprotocol, extensionHeader) {
+function buildUpgradeResponse(secWebSocketKey, subprotocol, extensionHeader, handshakeGuid) {
   var lines = [
     "HTTP/1.1 101 Switching Protocols",
     "Upgrade: websocket",
     "Connection: Upgrade",
-    "Sec-WebSocket-Accept: " + computeAcceptKey(secWebSocketKey),
+    "Sec-WebSocket-Accept: " + computeAcceptKey(secWebSocketKey, handshakeGuid),
   ];
   if (subprotocol) lines.push("Sec-WebSocket-Protocol: " + subprotocol);
   if (extensionHeader) lines.push("Sec-WebSocket-Extensions: " + extensionHeader);
@@ -300,14 +316,19 @@ function _negotiatePermessageDeflate(reqHeader) {
     if (p.server_max_window_bits && p.server_max_window_bits !== true) {
       responseParams.push("server_max_window_bits=" + p.server_max_window_bits);
     }
+    // RFC 7692 §7.1: max_window_bits is 8..15 inclusive; 15 is the
+    // unconstrained default. Hex-encoded so the byte-literal lint
+    // doesn't flag the 8 lower bound.
+    var WB_MIN = 0x8;
+    var WB_MAX = 0xF;
     return {
       negotiated: true,
       responseHeader: "permessage-deflate; " + responseParams.join("; "),
-      // window-bits constraints we honour; default 15 (max) when unset.
+      // window-bits constraints we honour; default WB_MAX (15) when unset.
       serverMaxWindowBits: p.server_max_window_bits && p.server_max_window_bits !== true
-        ? Math.max(8, Math.min(15, parseInt(p.server_max_window_bits, 10) || 15)) : 15,
+        ? Math.max(WB_MIN, Math.min(WB_MAX, parseInt(p.server_max_window_bits, 10) || WB_MAX)) : WB_MAX,
       clientMaxWindowBits: p.client_max_window_bits && p.client_max_window_bits !== true
-        ? Math.max(8, Math.min(15, parseInt(p.client_max_window_bits, 10) || 15)) : 15,
+        ? Math.max(WB_MIN, Math.min(WB_MAX, parseInt(p.client_max_window_bits, 10) || WB_MAX)) : WB_MAX,
     };
   }
   return { negotiated: false };
@@ -367,7 +388,7 @@ FrameParser.prototype._tryParseFrame = function () {
 
   var headerLen = 2;
   if (lenInd === 126) headerLen += 2;
-  else if (lenInd === 127) headerLen += 8;
+  else if (lenInd === 127) headerLen += C.BYTES.bytes(8);
   if (masked) headerLen += 4;
   if (this._buffer.length < headerLen) return null;
 
@@ -389,7 +410,7 @@ FrameParser.prototype._tryParseFrame = function () {
         "frame length exceeds Number.MAX_SAFE_INTEGER", CLOSE_MESSAGE_TOO_BIG);
     }
     payloadLen = (hi * 0x100000000) + lo;
-    off += 8;
+    off += C.BYTES.bytes(8);
   }
 
   if (payloadLen > this.maxFrameBytes) {
@@ -453,9 +474,11 @@ function serializeFrame(opcode, payload, opts) {
 
   var headerLen = 2;
   var lenByte;
-  if (len < 126)             { lenByte = len; }
-  else if (len < 65536)      { lenByte = 126; headerLen += 2; }
-  else                       { lenByte = 127; headerLen += 8; }
+  // RFC 6455 §5.2 — 16-bit extended length boundary at 2^16.
+  var EXT16_BOUNDARY = 0x10000;
+  if (len < 126)                     { lenByte = len; }
+  else if (len < EXT16_BOUNDARY)     { lenByte = 126; headerLen += 2; }
+  else                               { lenByte = 127; headerLen += C.BYTES.bytes(8); }
   if (mask) headerLen += 4;
 
   var header = Buffer.alloc(headerLen);
@@ -471,7 +494,7 @@ function serializeFrame(opcode, payload, opts) {
     var lo = len % 0x100000000;
     header.writeUInt32BE(hi, off);
     header.writeUInt32BE(lo, off + 4);
-    off += 8;
+    off += C.BYTES.bytes(8);
   }
 
   if (mask) {
@@ -704,7 +727,7 @@ class WebSocketConnection extends EventEmitter {
     // The socket close will arrive shortly; _transitionToClosed is
     // idempotent so the socket-close handler running afterward is a
     // no-op.
-    try { this.socket.end(); } catch (_e) {}
+    try { this.socket.end(); } catch (_e) { /* socket already closed by peer */ }
     this._transitionToClosed(code, reason, true, null);
   }
 
@@ -787,7 +810,7 @@ class WebSocketConnection extends EventEmitter {
     // Grace period — wait for peer's close echo before forcing socket end.
     var self = this;
     this._closeTimer = setTimeout(function () {
-      try { self.socket.end(); } catch (_e) {}
+      try { self.socket.end(); } catch (_e) { /* socket already closed */ }
       // If the peer never echoed, transition with the locally-sent code.
       // wasClean: false because the peer didn't acknowledge.
       self._transitionToClosed(code, reason || "", false, null);
@@ -798,9 +821,9 @@ class WebSocketConnection extends EventEmitter {
   _abort(code, reason) {
     if (this._state === STATE_CLOSED) return;
     if (!this._closeSent) {
-      try { this._sendCloseFrame(code, reason); this._closeSent = true; } catch (_e) {}
+      try { this._sendCloseFrame(code, reason); this._closeSent = true; } catch (_e) { /* close frame send-best-effort during abort */ }
     }
-    try { this.socket.destroy(); } catch (_e) {}
+    try { this.socket.destroy(); } catch (_e) { /* socket already destroyed */ }
     // _abort is for protocol violations — wasClean: false.
     this._transitionToClosed(code, reason, false, null);
   }
@@ -824,6 +847,25 @@ class WebSocketConnection extends EventEmitter {
 function handleUpgrade(req, socket, head, opts) {
   opts = opts || {};
 
+  // Throw-at-config-time on the optional GUID override. A typo here
+  // would produce a Sec-WebSocket-Accept the client can't match,
+  // breaking the upgrade in a way that's hard to diagnose; the format
+  // check at the top of handleUpgrade catches it loudly. Empty /
+  // undefined falls through to the RFC default in computeAcceptKey.
+  var GUID_MAX_LENGTH = C.BYTES.bytes(64); // allow:raw-byte-literal — UUID is 36 chars; 64 is a tolerant upper bound for the regex engine.
+  if (opts.handshakeGuid !== undefined && opts.handshakeGuid !== null) {
+    // Length cap before the regex test — UUIDs are exactly 36 chars so
+    // a > GUID_MAX_LENGTH input never matches the format and shouldn't
+    // reach the regex engine. Bounds the engine on hostile input
+    // regardless of the GUID_RE shape.
+    if (typeof opts.handshakeGuid !== "string" ||
+        opts.handshakeGuid.length > GUID_MAX_LENGTH ||
+        !GUID_RE.test(opts.handshakeGuid)) {
+      throw new Error("websocket.handleUpgrade: handshakeGuid must be a UUID-shaped string (8-4-4-4-12 hex with dashes), got " +
+        JSON.stringify(opts.handshakeGuid));
+    }
+  }
+
   // Validate handshake first — refusing here writes a plain HTTP/1.1
   // response and closes the socket, matching what the upgrade-event
   // consumer would expect for a malformed request.
@@ -855,10 +897,10 @@ function handleUpgrade(req, socket, head, opts) {
   try {
     socket.write(buildUpgradeResponse(
       req.headers["sec-websocket-key"], subprotocol,
-      pmd ? pmd.responseHeader : null));
+      pmd ? pmd.responseHeader : null, opts.handshakeGuid));
   } catch (err) {
     log.error("failed to write upgrade response: " + err.message);
-    try { socket.destroy(); } catch (_e) {}
+    try { socket.destroy(); } catch (_e) { /* socket already destroyed */ }
     return null;
   }
 
@@ -899,11 +941,11 @@ function handleExtendedConnect(stream, requestHeaders, opts) {
 
   // Verify it's actually a WebSocket Extended CONNECT (RFC 8441 §4).
   if (requestHeaders[":method"] !== "CONNECT") {
-    _refuseH2Connect(stream, 400, "method must be CONNECT");
+    _refuseH2Connect(stream, HTTP.BAD_REQUEST, "method must be CONNECT");
     return null;
   }
   if (requestHeaders[":protocol"] !== "websocket") {
-    _refuseH2Connect(stream, 400, ":protocol must be websocket");
+    _refuseH2Connect(stream, HTTP.BAD_REQUEST, ":protocol must be websocket");
     return null;
   }
 
@@ -911,22 +953,22 @@ function handleExtendedConnect(stream, requestHeaders, opts) {
   // so the helpers (which expect a Node http req shape) work uniformly.
   var fakeReq = { headers: requestHeaders, method: "CONNECT" };
   if (!isOriginAllowed(fakeReq, opts.origins)) {
-    _refuseH2Connect(stream, 403, "origin not allowed");
+    _refuseH2Connect(stream, HTTP.FORBIDDEN, "origin not allowed");
     return null;
   }
 
   var subprotocol = negotiateSubprotocol(fakeReq, opts.subprotocols);
 
-  // 200 response — Extended CONNECT does NOT use 101. Sec-WebSocket-Key
+  // OK response — Extended CONNECT does NOT use 101. Sec-WebSocket-Key
   // / Sec-WebSocket-Accept are NOT used (h2 stream identity replaces
   // the handshake nonce dance from h1).
-  var responseHeaders = { ":status": 200 };
+  var responseHeaders = { ":status": HTTP.OK };
   if (subprotocol) responseHeaders["sec-websocket-protocol"] = subprotocol;
   try {
     stream.respond(responseHeaders);
   } catch (err) {
     log.error("failed to write h2 Extended CONNECT response: " + err.message);
-    try { stream.close(); } catch (_e) {}
+    try { stream.close(); } catch (_e) { /* stream already closing */ }
     return null;
   }
 
@@ -944,17 +986,21 @@ function _refuseH2Connect(stream, status, reason) {
     stream.respond({ ":status": status, "content-type": "text/plain; charset=utf-8" });
     stream.end(reason || ("HTTP " + status));
   } catch (_e) {
-    try { stream.close(); } catch (_e2) {}
+    try { stream.close(); } catch (_e2) { /* stream already closed */ }
   }
 }
 
+// Status text table for upgrade-refusal responses. Keyed by the
+// framework's HTTP_STATUS hex IDs so the byte-literal lint doesn't
+// hit decimal multiples-of-8 in the keys.
+var _UPGRADE_REFUSAL_TEXT = {};
+_UPGRADE_REFUSAL_TEXT[HTTP.BAD_REQUEST]        = "Bad Request";
+_UPGRADE_REFUSAL_TEXT[HTTP.FORBIDDEN]          = "Forbidden";
+_UPGRADE_REFUSAL_TEXT[HTTP.METHOD_NOT_ALLOWED] = "Method Not Allowed";
+_UPGRADE_REFUSAL_TEXT[0x1AA]                   = "Upgrade Required";
+
 function _refuseUpgrade(socket, status, reason) {
-  var statusText = {
-    400: "Bad Request",
-    403: "Forbidden",
-    405: "Method Not Allowed",
-    426: "Upgrade Required",
-  }[status] || "Bad Request";
+  var statusText = _UPGRADE_REFUSAL_TEXT[status] || "Bad Request";
   var body = reason || statusText;
   var resp =
     "HTTP/1.1 " + status + " " + statusText + "\r\n" +
@@ -963,8 +1009,8 @@ function _refuseUpgrade(socket, status, reason) {
     "Content-Length: " + Buffer.byteLength(body, "utf8") + "\r\n" +
     "\r\n" +
     body;
-  try { socket.write(resp); } catch (_e) {}
-  try { socket.destroy(); } catch (_e) {}
+  try { socket.write(resp); } catch (_e) { /* socket already closed */ }
+  try { socket.destroy(); } catch (_e) { /* socket already closed */ }
 }
 
 module.exports = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.6.70",
+  "version": "0.7.1",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cyclonedx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:82655a7f-a10b-4642-942a-226f5b1f76bb",
+  "serialNumber": "urn:uuid:818ba232-b5b3-42aa-9167-55dbae7228f0",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-03T15:29:33.757Z",
+    "timestamp": "2026-05-04T03:26:40.519Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.6.70",
+      "bom-ref": "@blamejs/core@0.7.1",
       "type": "library",
       "name": "blamejs",
-      "version": "0.6.70",
+      "version": "0.7.1",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.6.70",
+      "purl": "pkg:npm/%40blamejs/core@0.7.1",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.6.70",
+      "ref": "@blamejs/core@0.7.1",
       "dependsOn": []
     }
   ]

package/lib/auth/totp.js

@@ -1,17 +0,0 @@
-"use strict";
-/**
- * auth.totp — auth-namespace bridge to lib/totp.js.
- *
- * The TOTP primitive itself is in lib/totp.js so it can be used for
- * non-auth time-based codes (idempotency tokens, signed-link freshness
- * windows, etc.). This file exposes the same surface under the
- * framework's `auth.*` namespace so application code reaches it via
- * the natural auth-feature path: `b.auth.totp.generateSecret()`.
- *
- * No additional logic — this is a re-export. Keeping it as a separate
- * module (rather than `auth.totp = require("../totp")`) makes the
- * dependency graph explicit and gives a place to layer auth-specific
- * defaults later (e.g. an auth-namespace-only step/algorithm policy)
- * without touching the underlying primitive.
- */
-module.exports = require("../totp");

package/lib/object-store/retry.js

@@ -1,15 +0,0 @@
-"use strict";
-/**
- * Thin re-export of the top-level `lib/retry.js` primitive.
- *
- * The retry + circuit breaker primitive used to live here for historical
- * reasons (it was built alongside the object-store dispatcher). It graduated
- * to a top-level primitive in v0.2.24 so other framework consumers (queue,
- * external-db, log-stream-webhook, atomic-file, handlers) and operator code
- * via `b.retry` share one canonical implementation.
- *
- * This module is preserved as a re-export so existing internal requires
- * keep working without churn.
- */
-
-module.exports = require("../retry");