@blamejs/blamejs-shop 0.0.44

package/lib/vendor/blamejs/lib/middleware/no-cache.js

@@ -0,0 +1,106 @@
+"use strict";
+/**
+ * @module     b.middleware.noCache
+ * @nav        Middleware
+ * @title      Cache-Control: no-store
+ * @order      410
+ *
+ * @intro
+ *   RFC 9111 §5.2.2.5 `Cache-Control: no-store` middleware for paths
+ *   that serve operator-individualized content (account pages,
+ *   transactional pages, API responses with PII, auth-gated routes).
+ *   Sets `Cache-Control: no-store` + `Pragma: no-cache` (HTTP/1.0
+ *   compatibility) + `Vary: Cookie, Authorization` so intermediate
+ *   caches don't store a personalized response keyed by URL alone.
+ *
+ *   Per the 2026-05-11 audit's web-browser hardening gap: many
+ *   primitives (`b.middleware.requireAuth` etc.) already set
+ *   no-store on the 401 refuse path, but operator routes serving
+ *   AUTHENTICATED content lacked a centralized no-store middleware.
+ *   This is it.
+ *
+ *   Compose with `b.middleware.requireAuth` for the standard
+ *   auth-gated shape:
+ *
+ *     app.use("/account", b.middleware.requireAuth());
+ *     app.use("/account", b.middleware.noCache());
+ *
+ *   Or use the predicate form to apply only when the route matches
+ *   an operator-supplied test:
+ *
+ *     app.use(b.middleware.noCache({
+ *       when: function (req) {
+ *         return req.url.indexOf("/api/private/") === 0;
+ *       },
+ *     }));
+ *
+ * @card
+ *   RFC 9111 §5.2.2.5 Cache-Control: no-store middleware for auth-gated / individualized response paths — sets no-store + Pragma + Vary headers so intermediate caches don't store personalized responses keyed by URL alone.
+ */
+
+var validateOpts = require("../validate-opts");
+var { defineClass } = require("../framework-error");
+
+var NoCacheError = defineClass("NoCacheError", { alwaysPermanent: true });
+
+var DEFAULT_VARY = "Cookie, Authorization";
+
+/**
+ * @primitive b.middleware.noCache
+ * @signature b.middleware.noCache(opts?)
+ * @since     0.8.86
+ * @status    stable
+ *
+ * Build the no-cache middleware. With no opts, applies to every
+ * request: sets `Cache-Control: no-store`, `Pragma: no-cache`,
+ * `Vary: Cookie, Authorization`. Pass `opts.when(req)` for a
+ * conditional path predicate.
+ *
+ * @opts
+ *   when:    function (req) → boolean,   // optional — only set headers when truthy
+ *   cacheControl: string,                 // override "no-store" (e.g. "no-store, private")
+ *   vary:    string,                      // override the Vary header (default "Cookie, Authorization")
+ *   skipExisting: boolean,                // default false — when true, skip when Cache-Control is already set
+ *
+ * @example
+ *   app.use("/account", b.middleware.requireAuth(), b.middleware.noCache());
+ *
+ *   // Conditional — only for the API subtree
+ *   app.use(b.middleware.noCache({
+ *     when: function (req) { return req.url.indexOf("/api/private/") === 0; },
+ *   }));
+ */
+function create(opts) {
+  opts = opts || {};
+  if (typeof opts !== "object" || Array.isArray(opts)) {
+    throw new NoCacheError("no-cache/bad-opts",
+      "middleware.noCache: opts must be an object when provided", true);
+  }
+  validateOpts.optionalFunction(
+    opts.when, "noCache.when", NoCacheError, "no-cache/bad-when");
+  validateOpts.optionalNonEmptyString(
+    opts.cacheControl, "noCache.cacheControl", NoCacheError, "no-cache/bad-cache-control");
+  validateOpts.optionalNonEmptyString(
+    opts.vary, "noCache.vary", NoCacheError, "no-cache/bad-vary");
+
+  var cacheControl = opts.cacheControl || "no-store";
+  var vary         = opts.vary || DEFAULT_VARY;
+  var skipExisting = opts.skipExisting === true;
+  var when         = opts.when;
+
+  return function noCacheMiddleware(req, res, next) {
+    if (when && !when(req)) return next();
+    if (skipExisting && typeof res.getHeader === "function" && res.getHeader("Cache-Control")) {
+      return next();
+    }
+    res.setHeader("Cache-Control", cacheControl);
+    res.setHeader("Pragma", "no-cache");
+    res.setHeader("Vary", vary);
+    next();
+  };
+}
+
+module.exports = create;
+module.exports.create        = create;
+module.exports.NoCacheError  = NoCacheError;
+module.exports.DEFAULT_VARY  = DEFAULT_VARY;

package/lib/vendor/blamejs/lib/middleware/openapi-serve.js

@@ -0,0 +1,177 @@
+"use strict";
+/**
+ * openapi-serve middleware — expose an OpenAPI 3.1 document as a
+ * request-time JSON / YAML resource at a single mount point.
+ *
+ *   var openapi = b.openapi.create({ ... });
+ *   ...add paths / schemas / security...
+ *
+ *   var serve = b.middleware.openapiServe({
+ *     document: openapi,
+ *     pathJson: "/openapi.json",
+ *     pathYaml: "/openapi.yaml",
+ *     pretty:   true,
+ *     cacheControl: "public, max-age=300",
+ *   });
+ *   router.use(serve);
+ *
+ * The middleware ONLY responds to GET requests for the configured
+ * paths; everything else passes to next() unchanged. ETag is computed
+ * from the JSON-string SHA3-512 to allow conditional GET.
+ *
+ * If `accessControl: "public"` (the default), the middleware emits
+ * `Access-Control-Allow-Origin: *` so external doc tooling can fetch.
+ * For internal-only docs operators set `accessControl: "same-origin"`
+ * which omits the CORS header.
+ */
+
+var nodeCrypto    = require("node:crypto");
+var validateOpts  = require("../validate-opts");
+var lazyRequire   = require("../lazy-require");
+var { defineClass } = require("../framework-error");
+var OpenApiError = defineClass("OpenApiError", { alwaysPermanent: true });
+
+var openapiYaml   = lazyRequire(function () { return require("../openapi-yaml"); });
+var audit         = lazyRequire(function () { return require("../audit"); });
+
+/**
+ * @primitive b.middleware.openapiServe
+ * @signature b.middleware.openapiServe(opts)
+ * @since     0.1.0
+ * @related   b.middleware.asyncapiServe, b.openapi.create
+ *
+ * Serves an OpenAPI 3.1 document built via `b.openapi.create` at a
+ * configurable JSON + YAML mount point. GET/HEAD only; everything
+ * else falls through. SHA3-512 ETag enables conditional 304. With
+ * `accessControl: "public"` (default) emits
+ * `Access-Control-Allow-Origin: *` so external doc tooling can
+ * fetch; `same-origin` omits the CORS header for internal-only docs.
+ *
+ * @opts
+ *   {
+ *     document:      object,    // builder from b.openapi.create()
+ *     pathJson:      string,    // default "/openapi.json"
+ *     pathYaml:      string,    // default "/openapi.yaml"
+ *     pretty:        boolean,
+ *     cacheControl:  string,    // default "public, max-age=300"
+ *     accessControl: "public"|"same-origin"|{ allowOrigin: string },
+ *     audit:         boolean,
+ *   }
+ *
+ * @example
+ *   var b = require("@blamejs/core");
+ *   var app = b.router.create();
+ *   var doc = b.openapi.create({ title: "api", version: "1.0.0" });
+ *   app.use(b.middleware.openapiServe({
+ *     document:     doc,
+ *     pretty:       true,
+ *     cacheControl: "public, max-age=300",
+ *   }));
+ */
+function create(opts) {
+  opts = opts || {};
+  validateOpts(opts, [
+    "document", "pathJson", "pathYaml", "pretty",
+    "cacheControl", "accessControl", "audit",
+  ], "middleware.openapiServe");
+  if (!opts.document || typeof opts.document.toJson !== "function") {
+    throw new OpenApiError("openapi/bad-document",
+      "openapiServe: document must be a builder created via b.openapi.create()");
+  }
+  var pathJson      = opts.pathJson || "/openapi.json";
+  var pathYaml      = opts.pathYaml || "/openapi.yaml";
+  var pretty        = opts.pretty === true ? 2 : 0;
+  var cacheControl  = (typeof opts.cacheControl === "string" && opts.cacheControl.length > 0)
+    ? opts.cacheControl : "public, max-age=300";
+  var accessControl = opts.accessControl || "public";
+  var auditOn       = opts.audit !== false;
+
+  if (typeof pathJson !== "string" || pathJson.charAt(0) !== "/") {
+    throw new OpenApiError("openapi/bad-path",
+      "openapiServe: pathJson must start with '/' - got " + JSON.stringify(pathJson));
+  }
+  if (typeof pathYaml !== "string" || pathYaml.charAt(0) !== "/") {
+    throw new OpenApiError("openapi/bad-path",
+      "openapiServe: pathYaml must start with '/' - got " + JSON.stringify(pathYaml));
+  }
+
+  var cachedDoc       = null;
+  var cachedJsonStr   = null;
+  var cachedYamlStr   = null;
+  var cachedJsonEtag  = null;
+  var cachedYamlEtag  = null;
+
+  function _rebuild() {
+    cachedDoc      = opts.document.toJson();
+    cachedJsonStr  = JSON.stringify(cachedDoc, null, pretty);
+    cachedYamlStr  = openapiYaml().toYaml(cachedDoc);
+    cachedJsonEtag = '"' + nodeCrypto.createHash("sha3-512").update(cachedJsonStr).digest("base64url").slice(0, 24) + '"';
+    cachedYamlEtag = '"' + nodeCrypto.createHash("sha3-512").update(cachedYamlStr).digest("base64url").slice(0, 24) + '"';
+  }
+  _rebuild();
+
+  function _writeBody(req, res, body, etag, contentType) {
+    var requestEtag = (req.headers && req.headers["if-none-match"]) || null;
+    if (requestEtag && requestEtag === etag) {
+      res.writeHead(304, { "ETag": etag, "Cache-Control": cacheControl });          // allow:raw-byte-literal — HTTP 304
+      res.end();
+      return;
+    }
+    var headers = {
+      "Content-Type":   contentType,
+      "Content-Length": Buffer.byteLength(body),
+      "Cache-Control":  cacheControl,
+      "ETag":           etag,
+    };
+    if (accessControl === "public") {
+      headers["Access-Control-Allow-Origin"] = "*";
+    }
+    res.writeHead(200, headers);                                                    // allow:raw-byte-literal — HTTP 200
+    res.end(body);
+  }
+
+  var mw = function (req, res, next) {
+    if (typeof res.writeHead !== "function") return next();
+    var method = (req.method || "GET").toUpperCase();
+    if (method !== "GET" && method !== "HEAD") return next();
+    var pathname = req.pathname;
+    if (typeof pathname !== "string") {
+      var url = req.url || "";
+      var qIdx = url.indexOf("?");
+      pathname = qIdx === -1 ? url : url.slice(0, qIdx);
+    }
+    if (pathname === pathJson) {
+      _writeBody(req, res, cachedJsonStr, cachedJsonEtag, "application/json; charset=utf-8");
+      if (auditOn) {
+        try {
+          audit().safeEmit({
+            action:  "openapi.document.served",
+            outcome: "success",
+            actor:   null,
+            metadata: { format: "json", path: pathname, bytes: cachedJsonStr.length },
+          });
+        } catch (_e) { /* drop-silent */ }
+      }
+      return;
+    }
+    if (pathname === pathYaml) {
+      _writeBody(req, res, cachedYamlStr, cachedYamlEtag, "application/yaml; charset=utf-8");
+      if (auditOn) {
+        try {
+          audit().safeEmit({
+            action:  "openapi.document.served",
+            outcome: "success",
+            actor:   null,
+            metadata: { format: "yaml", path: pathname, bytes: cachedYamlStr.length },
+          });
+        } catch (_e) { /* drop-silent */ }
+      }
+      return;
+    }
+    return next();
+  };
+  mw.forceRebuild = _rebuild;
+  return mw;
+}
+
+module.exports = { create: create };

package/lib/vendor/blamejs/lib/middleware/protected-resource-metadata.js

@@ -0,0 +1,277 @@
+"use strict";
+/**
+ * @module     b.middleware.protectedResourceMetadata
+ * @nav        Identity
+ * @title      Protected Resource Metadata
+ * @order      210
+ * @slug       protected-resource-metadata
+ *
+ * @intro
+ *   draft-ietf-oauth-resource-metadata: serves the
+ *   `/.well-known/oauth-protected-resource` document so RFC 9728
+ *   clients can auto-discover which authorization servers issue
+ *   tokens for this resource, what scopes the resource accepts,
+ *   what dpop algorithms the resource verifies, and which bearer-
+ *   method binding (DPoP / mTLS cnf claim) is required. Pairs with
+ *   b.middleware.bearerAuth so a 401 from the protected resource
+ *   includes `WWW-Authenticate: Bearer resource_metadata=<url>` and
+ *   the client can self-rediscover.
+ *
+ * @card
+ *   `.well-known/oauth-protected-resource` discovery endpoint per
+ *   draft-ietf-oauth-resource-metadata. Closes the gap that previously
+ *   forced operators to hand-write the JSON.
+ */
+
+var framework_error = require("../framework-error");
+var validateOpts    = require("../validate-opts");
+var requestHelpers  = require("../request-helpers");
+var safeUrl         = require("../safe-url");
+var nodeCrypto      = require("node:crypto");
+
+var H = requestHelpers.HTTP_STATUS;
+
+var ProtectedResourceMetadataError = framework_error.defineClass(
+  "ProtectedResourceMetadataError",
+  "middleware/protected-resource-metadata"
+);
+
+var ALLOWED_BEARER_METHODS  = ["header", "body", "query"];
+var ALLOWED_DPOP_ALGS       = ["ES256", "ES384", "RS256", "PS256", "EdDSA", "ML-DSA-65", "ML-DSA-87"];
+// RFC 9728 §3.2 — signed_metadata signing algs. PQC-first per the
+// framework's hard rule §2 (ML-DSA-* preferred); classical algs
+// available for backwards-interop with relying parties without PQC
+// libraries on hand.
+var ALLOWED_SIGNED_METADATA_ALGS = ["ML-DSA-87", "ML-DSA-65", "EdDSA", "ES256", "ES384", "PS256", "PS384"];
+
+function _b64url(buf) {
+  return Buffer.from(buf).toString("base64url");
+}
+
+/**
+ * @primitive b.middleware.protectedResourceMetadata
+ * @signature b.middleware.protectedResourceMetadata(opts)
+ * @since     0.8.77
+ * @related   b.auth.oauth.introspectToken, b.middleware.bearerAuth
+ *
+ * Returns a request middleware that serves the protected-resource
+ * metadata JSON document at `/.well-known/oauth-protected-resource`
+ * (or operator-overridden path).
+ *
+ * @opts
+ *   {
+ *     resource:                       string,        // canonical resource URI (required)
+ *     authorizationServers:           string[],      // issuer URLs that mint tokens for this resource (required, ≥1)
+ *     scopesSupported?:               string[],
+ *     bearerMethodsSupported?:        ("header"|"body"|"query")[],   // default ["header"]
+ *     resourceSigningAlgValuesSupported?: string[], // for signed introspection / jwt-secured responses
+ *     resourceDocumentation?:         string,        // URL to operator docs
+ *     resourcePolicyUri?:             string,
+ *     resourceTosUri?:                string,
+ *     dpopSigningAlgValuesSupported?: string[],
+ *     dpopBoundAccessTokensRequired?: boolean,
+ *     mtlsBoundAccessTokensRequired?: boolean,
+ *     path?:                          string,        // default "/.well-known/oauth-protected-resource"
+ *   }
+ *
+ * @example
+ *   var mw = b.middleware.protectedResourceMetadata({
+ *     resource:             "https://api.example.com",
+ *     authorizationServers: ["https://idp.example.com"],
+ *     scopesSupported:      ["read", "write"],
+ *     dpopBoundAccessTokensRequired: true,
+ *   });
+ *   app.use(mw);
+ */
+function create(opts) {
+  validateOpts.requireObject(opts, "middleware.protectedResourceMetadata",
+    ProtectedResourceMetadataError, "middleware/protected-resource-metadata/bad-opts");
+  validateOpts.requireNonEmptyString(opts.resource, "resource",
+    ProtectedResourceMetadataError, "middleware/protected-resource-metadata/no-resource");
+
+  if (!Array.isArray(opts.authorizationServers) || opts.authorizationServers.length === 0) {
+    throw new ProtectedResourceMetadataError(
+      "middleware/protected-resource-metadata/no-as",
+      "authorizationServers must be a non-empty array of issuer URLs");
+  }
+  // AUTH-17 — RFC 9728 §3 + RFC 8414 §3.1: authorizationServers entries
+  // are issuer URLs and MUST be https://. Pre-v0.9.x only required
+  // non-empty string, so an operator typo could ship `http://idp.test`
+  // (or, worse, `javascript:` / `data:`) to clients via the well-known
+  // document. allowHttp opts.allowHttp passes the framework's
+  // safe-url loopback exception through (matches b.auth.oauth's
+  // _validateUrl shape).
+  var allowHttp = opts.allowHttp === true;
+  opts.authorizationServers.forEach(function (u, i) {
+    if (typeof u !== "string" || u.length === 0) {
+      throw new ProtectedResourceMetadataError(
+        "middleware/protected-resource-metadata/bad-as",
+        "authorizationServers[" + i + "] must be a non-empty string");
+    }
+    try {
+      safeUrl.parse(u, {
+        allowedProtocols: allowHttp ? safeUrl.ALLOW_HTTP_ALL : safeUrl.ALLOW_HTTP_TLS,
+      });
+    } catch (_e) {
+      throw new ProtectedResourceMetadataError(
+        "middleware/protected-resource-metadata/bad-as-url",
+        "authorizationServers[" + i + "] = '" + u + "' is not a valid " +
+        (allowHttp ? "http(s)" : "https") + " URL (RFC 9728 §3 / RFC 8414 §3.1)");
+    }
+  });
+
+  var bearerMethods = opts.bearerMethodsSupported || ["header"];
+  bearerMethods.forEach(function (m, i) {
+    if (ALLOWED_BEARER_METHODS.indexOf(m) === -1) {
+      throw new ProtectedResourceMetadataError(
+        "middleware/protected-resource-metadata/bad-bearer-method",
+        "bearerMethodsSupported[" + i + "] must be one of: " + ALLOWED_BEARER_METHODS.join(", "));
+    }
+  });
+
+  if (opts.dpopSigningAlgValuesSupported) {
+    opts.dpopSigningAlgValuesSupported.forEach(function (a, i) {
+      if (ALLOWED_DPOP_ALGS.indexOf(a) === -1) {
+        throw new ProtectedResourceMetadataError(
+          "middleware/protected-resource-metadata/bad-dpop-alg",
+          "dpopSigningAlgValuesSupported[" + i + "] = '" + a +
+          "' not in allowlist: " + ALLOWED_DPOP_ALGS.join(", "));
+      }
+    });
+  }
+
+  var path = opts.path || "/.well-known/oauth-protected-resource";
+
+  var doc = {
+    resource:                opts.resource,
+    authorization_servers:   opts.authorizationServers,
+    bearer_methods_supported: bearerMethods,
+  };
+  if (opts.scopesSupported)                       doc.scopes_supported = opts.scopesSupported;
+  if (opts.resourceSigningAlgValuesSupported)     doc.resource_signing_alg_values_supported = opts.resourceSigningAlgValuesSupported;
+  if (opts.resourceDocumentation)                 doc.resource_documentation = opts.resourceDocumentation;
+  if (opts.resourcePolicyUri)                     doc.resource_policy_uri = opts.resourcePolicyUri;
+  if (opts.resourceTosUri)                        doc.resource_tos_uri = opts.resourceTosUri;
+  if (opts.dpopSigningAlgValuesSupported)         doc.dpop_signing_alg_values_supported = opts.dpopSigningAlgValuesSupported;
+  if (opts.dpopBoundAccessTokensRequired === true) doc.dpop_bound_access_tokens_required = true;
+  if (opts.mtlsBoundAccessTokensRequired === true) doc.tls_client_certificate_bound_access_tokens = true;
+
+  // AUTH-18 — RFC 9728 §3.2 signed_metadata. Operators with an
+  // anti-tamper requirement pass `signMetadata: { key, alg, kid }`;
+  // the middleware emits `application/jwt` carrying the JWS-signed
+  // metadata. Default output remains cleartext `application/json`.
+  var signedJwt = null;
+  var signedDoc = null;
+  if (opts.signMetadata) {
+    var sm = opts.signMetadata;
+    if (!sm || typeof sm !== "object") {
+      throw new ProtectedResourceMetadataError(
+        "middleware/protected-resource-metadata/bad-sign",
+        "signMetadata must be an object { key, alg, kid? }");
+    }
+    if (!sm.alg || ALLOWED_SIGNED_METADATA_ALGS.indexOf(sm.alg) === -1) {
+      throw new ProtectedResourceMetadataError(
+        "middleware/protected-resource-metadata/bad-sign-alg",
+        "signMetadata.alg '" + sm.alg + "' not in allowlist: " +
+        ALLOWED_SIGNED_METADATA_ALGS.join(", "));
+    }
+    if (!sm.key) {
+      throw new ProtectedResourceMetadataError(
+        "middleware/protected-resource-metadata/bad-sign-key",
+        "signMetadata.key is required (KeyObject, PEM string/Buffer, or JWK object)");
+    }
+    var signingKey;
+    try {
+      if (sm.key instanceof nodeCrypto.KeyObject) {
+        signingKey = sm.key;
+      } else if (typeof sm.key === "string" || Buffer.isBuffer(sm.key)) {
+        signingKey = nodeCrypto.createPrivateKey({ key: sm.key, format: "pem" });
+      } else if (typeof sm.key === "object") {
+        signingKey = nodeCrypto.createPrivateKey({ key: sm.key, format: "jwk" });
+      } else {
+        throw new ProtectedResourceMetadataError(
+          "middleware/protected-resource-metadata/bad-sign-key",
+          "signMetadata.key must be KeyObject, PEM string/Buffer, or JWK object");
+      }
+    } catch (e) {
+      if (e instanceof ProtectedResourceMetadataError) throw e;
+      throw new ProtectedResourceMetadataError(
+        "middleware/protected-resource-metadata/bad-sign-key",
+        "signMetadata.key parse failed: " + ((e && e.message) || String(e)));
+    }
+    // RFC 9728 §3.2 — signed_metadata is a JWS carrying the same
+    // metadata claims as the cleartext document plus iss + sub
+    // (resource URI) for identification at consume-side.
+    signedDoc = Object.assign({}, doc, { iss: opts.resource, sub: opts.resource });
+    var jwsHeader = { alg: sm.alg, typ: "oauth-protected-resource+jwt" };
+    if (sm.kid) jwsHeader.kid = sm.kid;
+    var headerEnc  = _b64url(JSON.stringify(jwsHeader));
+    var payloadEnc = _b64url(JSON.stringify(signedDoc));
+    var input      = headerEnc + "." + payloadEnc;
+    // PQC algs (ML-DSA-*) + EdDSA pass null hash; ES* / PS* / RS* use
+    // their RFC 7518 hash + dsaEncoding shape.
+    var signParams = { key: signingKey };
+    var signAlgo   = null;
+    if (sm.alg === "ES256") { signAlgo = "sha256"; signParams.dsaEncoding = "ieee-p1363"; }
+    else if (sm.alg === "ES384") { signAlgo = "sha384"; signParams.dsaEncoding = "ieee-p1363"; }
+    else if (sm.alg === "PS256") { signAlgo = "sha256"; signParams.padding = nodeCrypto.constants.RSA_PKCS1_PSS_PADDING; signParams.saltLength = 32; }   // allow:raw-byte-literal — RFC 7518 PS256 salt
+    else if (sm.alg === "PS384") { signAlgo = "sha384"; signParams.padding = nodeCrypto.constants.RSA_PKCS1_PSS_PADDING; signParams.saltLength = 48; }   // allow:raw-byte-literal — RFC 7518 PS384 salt
+    var sig = nodeCrypto.sign(signAlgo, Buffer.from(input, "ascii"), signParams);
+    signedJwt = input + "." + _b64url(sig);
+  }
+
+  var bodyText  = JSON.stringify(doc);
+  var bodyBytes = Buffer.byteLength(bodyText, "utf8");
+  var signedBytes = signedJwt ? Buffer.byteLength(signedJwt, "utf8") : 0;
+
+  function middleware(req, res, next) {
+    if (req.url !== path && req.url.split("?")[0] !== path) {
+      next();
+      return;
+    }
+    if (req.method !== "GET" && req.method !== "HEAD") {
+      res.writeHead(H.METHOD_NOT_ALLOWED, {
+        "Allow":         "GET, HEAD",
+        "Cache-Control": "no-store",
+      });
+      res.end();
+      return;
+    }
+    // RFC 9728 §3.2 — operators that wired signMetadata serve the JWS
+    // form when the client advertises Accept: application/jwt (or via
+    // the *.jwt path suffix). The cleartext document is still served
+    // on the default path / Accept: application/json.
+    var accept = (req.headers && req.headers.accept) || "";
+    var wantsSigned = signedJwt && (accept.indexOf("application/jwt") !== -1);
+    if (wantsSigned) {
+      res.writeHead(H.OK, {
+        "Content-Type":   "application/jwt",
+        "Content-Length": String(signedBytes),
+        "Cache-Control":  "public, max-age=3600",
+      });
+      if (req.method === "HEAD") { res.end(); return; }
+      res.end(signedJwt);
+      return;
+    }
+    res.writeHead(H.OK, {
+      "Content-Type":   "application/json",
+      "Content-Length": String(bodyBytes),
+      "Cache-Control":  "public, max-age=3600",
+    });
+    if (req.method === "HEAD") { res.end(); return; }
+    res.end(bodyText);
+  }
+
+  middleware.document      = doc;
+  middleware.signedMetadata = signedJwt;
+  middleware.path          = path;
+  return middleware;
+}
+
+module.exports = {
+  create:                        create,
+  ProtectedResourceMetadataError: ProtectedResourceMetadataError,
+  ALLOWED_BEARER_METHODS:        ALLOWED_BEARER_METHODS,
+  ALLOWED_DPOP_ALGS:             ALLOWED_DPOP_ALGS,
+  ALLOWED_SIGNED_METADATA_ALGS:  ALLOWED_SIGNED_METADATA_ALGS,
+};