@blamejs/blamejs-shop 0.3.5 → 0.3.7

package/lib/vendor/blamejs/lib/middleware/body-parser.js

@@ -574,7 +574,7 @@ function _parseMultipartHeaders(rawHeaders) {
     var line = lines[i];
     if (!line) continue;
     var first = line.charCodeAt(0);
-    if (first === 32 || first === 9) {                                            // allow:raw-byte-literal — SP/HTAB obs-fold sentinels
+    if (first === 32 || first === 9) {                                            // SP/HTAB obs-fold sentinels
       throw new BodyParserError(
         "body-parser/multipart-obs-fold",
         "multipart part header uses obsolete line folding (RFC 9112 §5.2)",
@@ -587,7 +587,7 @@ function _parseMultipartHeaders(rawHeaders) {
     var v = line.slice(idx + 1).trim();
     for (var j = 0; j < v.length; j++) {
       var c = v.charCodeAt(j);
-      if (c === 0 || c === 10 || c === 13) {                                      // allow:raw-byte-literal — NUL/LF/CR forbidden in field-value (RFC 9110 §5.5)
+      if (c === 0 || c === 10 || c === 13) {                                      // NUL/LF/CR forbidden in field-value (RFC 9110 §5.5)
         throw new BodyParserError(
           "body-parser/multipart-bad-header-value",
           "multipart part header `" + k + "` contains CR/LF/NUL (RFC 9110 §5.5)",
@@ -674,8 +674,8 @@ async function _parseMultipart(req, opts, ctParams) {
   // newlines) drive quadratic match cost in scanners. Refuse at
   // the parse boundary so the rest of the engine doesn't have to
   // defend against them.
-  if (boundary.length > 70 ||                                                                  // allow:raw-byte-literal — RFC 2046 §5.1.1 boundary length cap
-      !/^[A-Za-z0-9'()+_,\-./:=?]{1,70}$/.test(boundary)) {                                   // allow:raw-byte-literal — RFC 2046 §5.1.1 bchars + cap
+  if (boundary.length > 70 ||                                                                  // RFC 2046 §5.1.1 boundary length cap
+      !/^[A-Za-z0-9'()+_,\-./:=?]{1,70}$/.test(boundary)) {                                   // RFC 2046 §5.1.1 bchars + cap
     throw new BodyParserError(
       "body-parser/multipart-bad-boundary",
       "multipart boundary violates RFC 2046 §5.1.1 (1-70 chars, bcharsnospace grammar)",
@@ -1353,7 +1353,7 @@ function create(opts) {
             outcome: "denied",
             metadata: {
               code:    e.code || null,
-              message: (e && e.message) ? String(e.message).slice(0, 256) : "",                                  // allow:raw-byte-literal — diagnostic-message clamp characters, not bytes
+              message: (e && e.message) ? String(e.message).slice(0, 256) : "",                                  // diagnostic-message clamp characters, not bytes
             },
           });
         } catch (_e) { /* audit best-effort */ }

package/lib/vendor/blamejs/lib/middleware/compose-pipeline.js

@@ -85,20 +85,20 @@ var ComposePipelineError = defineClass("ComposePipelineError", { alwaysPermanent
 //   60-89 : application handlers
 //   >= 90 : error-handler (must be last; trailing catch)
 var CANONICAL_POSITIONS = Object.freeze({
-  requestId:     5,                                                                                       // allow:raw-byte-literal — canonical position bucket
-  apiEncrypt:    10,                                                                                      // allow:raw-byte-literal — canonical position bucket
-  bodyParser:    20,                                                                                      // allow:raw-byte-literal — canonical position bucket
-  cspNonce:      22,                                                                                      // allow:raw-byte-literal — canonical position bucket
-  securityHeaders: 25,                                                                                    // allow:raw-byte-literal — canonical position bucket
-  csrf:          30,                                                                                      // allow:raw-byte-literal — canonical position bucket
-  idempotency:   30,                                                                                      // allow:raw-byte-literal — canonical position bucket (same as csrf)
-  fetchMetadata: 32,                                                                                      // allow:raw-byte-literal — canonical position bucket
-  rateLimit:     40,                                                                                      // allow:raw-byte-literal — canonical position bucket
-  botGuard:      42,                                                                                      // allow:raw-byte-literal — canonical position bucket
-  requireAuth:   50,                                                                                      // allow:raw-byte-literal — canonical position bucket
-  attachUser:    52,                                                                                      // allow:raw-byte-literal — canonical position bucket
-  handler:       60,                                                                                      // allow:raw-byte-literal — canonical position bucket // allow:raw-time-literal — pipeline position int, not seconds
-  errorHandler:  90,                                                                                      // allow:raw-byte-literal — canonical position bucket
+  requestId:     5,                                                                                       // canonical position bucket
+  apiEncrypt:    10,                                                                                      // canonical position bucket
+  bodyParser:    20,                                                                                      // canonical position bucket
+  cspNonce:      22,                                                                                      // canonical position bucket
+  securityHeaders: 25,                                                                                    // canonical position bucket
+  csrf:          30,                                                                                      // canonical position bucket
+  idempotency:   30,                                                                                      // canonical position bucket (same as csrf)
+  fetchMetadata: 32,                                                                                      // canonical position bucket
+  rateLimit:     40,                                                                                      // canonical position bucket
+  botGuard:      42,                                                                                      // canonical position bucket
+  requireAuth:   50,                                                                                      // canonical position bucket
+  attachUser:    52,                                                                                      // canonical position bucket
+  handler:       60,                                                                                      // allow:raw-time-literal — pipeline position int, not seconds
+  errorHandler:  90,                                                                                      // canonical position bucket
 });
 
 /**
@@ -154,7 +154,7 @@ function composePipeline(entries, opts) {
       throw new ComposePipelineError("compose-pipeline/bad-entry",
         "composePipeline: entry at index " + i + " must be an object");
     }
-    if (typeof e.name !== "string" || e.name.length === 0 || e.name.length > 64) {                       // allow:raw-byte-literal — middleware-name cap
+    if (typeof e.name !== "string" || e.name.length === 0 || e.name.length > 64) {                       // middleware-name cap
       throw new ComposePipelineError("compose-pipeline/bad-entry",
         "composePipeline: entries[" + i + "].name must be a non-empty string ≤ 64 bytes");
     }
@@ -187,7 +187,7 @@ function composePipeline(entries, opts) {
       // natural sequential flow. Use 100 so canonical positions
       // (5..90) can interleave without colliding when an operator
       // mixes named + unnamed entries.
-      position = (i + 1) * 100;                                                                          // allow:raw-byte-literal — index→position scale; canonical-pos ceiling is 90
+      position = (i + 1) * 100;                                                                          // index→position scale; canonical-pos ceiling is 90
     }
 
     if (Object.prototype.hasOwnProperty.call(seenPositions, position)) {

package/lib/vendor/blamejs/lib/middleware/csp-report.js

@@ -125,7 +125,7 @@ function create(opts) {
 
   return async function cspReport(req, res, _next) {
     if (req.method !== "POST") {
-      res.writeHead(405, { "Allow": "POST" });                                     // allow:raw-byte-literal — HTTP 405 status
+      res.writeHead(405, { "Allow": "POST" });                                     // HTTP 405 status
       res.end();
       return;
     }
@@ -133,14 +133,14 @@ function create(opts) {
     try {
       body = await safeBuffer.boundedChunkCollector(req, { maxBytes: maxBytes });
     } catch (_e) {
-      res.writeHead(413);                                                         // allow:raw-byte-literal — HTTP 413 status
+      res.writeHead(413);                                                         // HTTP 413 status
       res.end();
       return;
     }
     var parsed;
     try { parsed = safeJson.parse(body.toString("utf8")); }
     catch (_e) {
-      res.writeHead(400);                                                         // allow:raw-byte-literal — HTTP 400 status
+      res.writeHead(400);                                                         // HTTP 400 status
       res.end();
       return;
     }
@@ -159,7 +159,7 @@ function create(opts) {
         try { onReport(normalized); } catch (_e) { /* hook best-effort */ }
       }
     }
-    res.writeHead(204);                                                           // allow:raw-byte-literal — HTTP 204 status
+    res.writeHead(204);                                                           // HTTP 204 status
     res.end();
   };
 }

package/lib/vendor/blamejs/lib/middleware/daily-byte-quota.js

@@ -199,7 +199,7 @@ function create(opts) {
       var keys = Object.keys(req.headers);
       for (var hi = 0; hi < keys.length; hi++) {
         var v = req.headers[keys[hi]];
-        inboundBytes += keys[hi].length + 2 + (typeof v === "string" ? v.length : 0) + 2;        // allow:raw-byte-literal — ": " + "\r\n" overhead
+        inboundBytes += keys[hi].length + 2 + (typeof v === "string" ? v.length : 0) + 2;        // ": " + "\r\n" overhead
       }
     }
     if (req.headers && req.headers["content-length"]) {

package/lib/vendor/blamejs/lib/middleware/dpop.js

@@ -55,7 +55,7 @@ function _writeUnauthorized(res, errorCode, description, freshNonce) {
   // RFC 9449 §7 — error code is invalid_dpop_proof OR use_dpop_nonce.
   var challenge = 'DPoP error="' + errorCode + '", error_description="' +
                   description.replace(/"/g, "'") + '"';
-  var headers = {                                                                  // allow:raw-byte-literal — HTTP 401 status
+  var headers = {                                                                  // HTTP 401 status
     "Content-Type":     "application/json; charset=utf-8",
     "Content-Length":   Buffer.byteLength(body),
     "WWW-Authenticate": challenge,

package/lib/vendor/blamejs/lib/middleware/headers.js

@@ -104,7 +104,7 @@ function _detectIssues(headers, opts) {
       }
       for (var ci = 0; ci < v.length; ci += 1) {
         var cc = v.charCodeAt(ci);
-        if (cc === 0x0D || cc === 0x0A || cc === 0x00) {                         // allow:raw-byte-literal — CR / LF / NUL forbidden in header value
+        if (cc === 0x0D || cc === 0x0A || cc === 0x00) {                         // CR / LF / NUL forbidden in header value
           issues.push({
             kind: "header-value-control-byte", severity: "high", header: name,
             snippet: "header `" + name + "` value contains CR / LF / NUL " +
@@ -200,7 +200,7 @@ function create(opts) {
   var refuseOnHigh = opts.refuseOnHigh !== false && mode === "enforce";
   var audit = opts.audit || null;
   var resolved = {
-    maxHeaderCount: opts.maxHeaderCount || 100,                                  // allow:raw-byte-literal — header count ceiling
+    maxHeaderCount: opts.maxHeaderCount || 100,                                  // header count ceiling
     maxValueBytes:  opts.maxValueBytes  || 8 * 1024,                             // allow:raw-byte-literal — header value cap (8 KiB)
     trustProxy:     !!opts.trustProxy,
   };

package/lib/vendor/blamejs/lib/middleware/host-allowlist.js

@@ -131,7 +131,7 @@ function create(opts) {
     hosts.push(n);
   }
 
-  var denyStatus = (typeof opts.denyStatus === "number") ? opts.denyStatus : 421;  // allow:raw-byte-literal — HTTP 421 status
+  var denyStatus = (typeof opts.denyStatus === "number") ? opts.denyStatus : 421;  // HTTP 421 status
   var denyBody = typeof opts.denyBody === "string" ? opts.denyBody : "Misdirected Request";
   var auditOn = opts.audit !== false;
 

package/lib/vendor/blamejs/lib/middleware/idempotency-key.js

@@ -69,8 +69,8 @@ var DEFAULT_METHODS = Object.freeze(["POST", "PUT", "PATCH", "DELETE"]);
 // control chars, length 1..255 (typical client implementations cap
 // at 36 for UUID + a few extra for vendor prefixes; 255 is the
 // upper bound that still fits a single HTTP header line).
-var KEY_RE = /^[\x21-\x7E]+$/;                                                                     // allow:raw-byte-literal — printable ASCII codepoint range
-var KEY_MAX_LEN = 255;                                                                             // allow:raw-byte-literal — draft §2 upper bound
+var KEY_RE = /^[\x21-\x7E]+$/;                                                                     // printable ASCII codepoint range
+var KEY_MAX_LEN = 255;                                                                             // draft §2 upper bound
 
 /**
  * @primitive b.middleware.idempotencyKey.memoryStore
@@ -101,7 +101,7 @@ function memoryStore(opts) {
   opts = opts || {};
   numericBounds.requirePositiveFiniteIntIfPresent(
     opts.maxEntries, "memoryStore.maxEntries", IdempotencyError, "idempotency/bad-max-entries");
-  var maxEntries = opts.maxEntries !== undefined ? opts.maxEntries : 10000;                       // allow:raw-byte-literal — default in-memory cap, not bytes
+  var maxEntries = opts.maxEntries !== undefined ? opts.maxEntries : 10000;                       // default in-memory cap, not bytes
   var data = new Map();
   return {
     get: function (key) {
@@ -705,7 +705,7 @@ function create(opts) {
       var missing = problemDetails().create({
         type:   problemDetails().getBase() + "/idempotency/missing-key",
         title:  "Idempotency-Key header required",
-        status: 400,                                                                               // allow:raw-byte-literal — HTTP status 400 Bad Request
+        status: 400,                                                                               // HTTP status 400 Bad Request
         detail: "This endpoint requires an Idempotency-Key header (draft-ietf-httpapi-idempotency-key).",
       });
       _emitAudit("idempotency.missing_key", { method: method, path: req.url }, "denied");
@@ -716,7 +716,7 @@ function create(opts) {
       var bad = problemDetails().create({
         type:   problemDetails().getBase() + "/idempotency/bad-key",
         title:  "Idempotency-Key malformed",
-        status: 400,                                                                               // allow:raw-byte-literal — HTTP status 400
+        status: 400,                                                                               // HTTP status 400
         detail: "Idempotency-Key must be ASCII printable, length 1.." + KEY_MAX_LEN + " (draft §2).",
       });
       _emitAudit("idempotency.bad_key", { method: method, keyLen: key.length }, "denied");
@@ -781,7 +781,7 @@ function create(opts) {
         var missingBody = problemDetails().create({
           type:   problemDetails().getBase() + "/idempotency/missing-body-fingerprint",
           title:  "Idempotency body fingerprint unavailable",
-          status: 400,                                                                               // allow:raw-byte-literal — HTTP status 400 Bad Request
+          status: 400,                                                                               // HTTP status 400 Bad Request
           detail: "The idempotency middleware could not derive a body fingerprint for this " +
                   "request. Mount body-parser BEFORE the idempotency middleware, OR provide an " +
                   "opts.bodyFingerprint(req) hook. To restore the pre-0.9.58 method+path-only " +
@@ -809,7 +809,7 @@ function create(opts) {
         var mismatch = problemDetails().create({
           type:   problemDetails().getBase() + "/idempotency/key-reuse-mismatch",
           title:  "Idempotency-Key reused with different request",
-          status: 422,                                                                             // allow:raw-byte-literal — HTTP status 422 Unprocessable Content (RFC 9110)
+          status: 422,                                                                             // HTTP status 422 Unprocessable Content (RFC 9110)
           detail: "The Idempotency-Key matches a prior request but the request body/method/path differs (draft §4.3).",
         });
         _emitAudit("idempotency.key_reuse_mismatch",
@@ -865,10 +865,10 @@ function create(opts) {
       if (!captured) {
         captured = true;
         _pushChunk(chunk, encoding);
-        var status = res.statusCode || 200;                                                        // allow:raw-byte-literal — default HTTP status 200
+        var status = res.statusCode || 200;                                                        // default HTTP status 200
         // Only persist 2xx-4xx responses; 5xx is transient infra
         // failure that should be retried fresh, not replayed.
-        if (!oversized && status >= 200 && status < 500) {                                         // allow:raw-byte-literal — HTTP status class boundaries
+        if (!oversized && status >= 200 && status < 500) {                                         // HTTP status class boundaries
           var headerMap = {};
           try {
             var allHeaders = typeof res.getHeaders === "function" ? res.getHeaders() : {};
@@ -913,13 +913,13 @@ function _hashKey(key) {
   // Hash before logging — operator's audit chain shouldn't carry raw
   // idempotency keys (clients sometimes inadvertently put PII / order
   // numbers in them).
-  return nodeCrypto.createHash("sha3-256").update(key, "utf8").digest("hex").slice(0, 16);         // allow:raw-byte-literal — log-truncation length, not bytes
+  return nodeCrypto.createHash("sha3-256").update(key, "utf8").digest("hex").slice(0, 16);         // log-truncation length, not bytes
 }
 
 function _redactKey(key) {
   if (typeof key !== "string") return "<non-string>";
-  if (key.length <= 8) return "<short:" + key.length + ">";                                        // allow:raw-byte-literal — log-redaction length threshold
-  return key.slice(0, 4) + "..." + key.slice(-2) + " (len=" + key.length + ")";                    // allow:raw-byte-literal — log-redaction prefix/suffix lengths
+  if (key.length <= 8) return "<short:" + key.length + ">";                                        // log-redaction length threshold
+  return key.slice(0, 4) + "..." + key.slice(-2) + " (len=" + key.length + ")";                    // log-redaction prefix/suffix lengths
 }
 
 /**

package/lib/vendor/blamejs/lib/middleware/nel.js

@@ -149,7 +149,7 @@ function create(opts) {
   // honor secure-origin report endpoints. Refusing at config-time so
   // an operator typo (`http://`) surfaces at boot, not as silent
   // never-fires-in-production.
-  if (opts.collectorUrl.slice(0, 8) !== "https://") {                                       // allow:raw-byte-literal — string-prefix length, not bytes
+  if (opts.collectorUrl.slice(0, 8) !== "https://") {                                       // string-prefix length, not bytes
     throw new TypeError(
       "middleware.nel: opts.collectorUrl must be https:// (browsers " +
       "ignore non-secure NEL collectors); got " + opts.collectorUrl);

package/lib/vendor/blamejs/lib/middleware/openapi-serve.js

@@ -113,7 +113,7 @@ function create(opts) {
   function _writeBody(req, res, body, etag, contentType) {
     var requestEtag = (req.headers && req.headers["if-none-match"]) || null;
     if (requestEtag && requestEtag === etag) {
-      res.writeHead(304, { "ETag": etag, "Cache-Control": cacheControl });          // allow:raw-byte-literal — HTTP 304
+      res.writeHead(304, { "ETag": etag, "Cache-Control": cacheControl });          // HTTP 304
       res.end();
       return;
     }
@@ -126,7 +126,7 @@ function create(opts) {
     if (accessControl === "public") {
       headers["Access-Control-Allow-Origin"] = "*";
     }
-    res.writeHead(200, headers);                                                    // allow:raw-byte-literal — HTTP 200
+    res.writeHead(200, headers);                                                    // HTTP 200
     res.end(body);
   }
 

package/lib/vendor/blamejs/lib/middleware/protected-resource-metadata.js

@@ -214,8 +214,8 @@ function create(opts) {
     var signAlgo   = null;
     if (sm.alg === "ES256") { signAlgo = "sha256"; signParams.dsaEncoding = "ieee-p1363"; }
     else if (sm.alg === "ES384") { signAlgo = "sha384"; signParams.dsaEncoding = "ieee-p1363"; }
-    else if (sm.alg === "PS256") { signAlgo = "sha256"; signParams.padding = nodeCrypto.constants.RSA_PKCS1_PSS_PADDING; signParams.saltLength = 32; }   // allow:raw-byte-literal — RFC 7518 PS256 salt
-    else if (sm.alg === "PS384") { signAlgo = "sha384"; signParams.padding = nodeCrypto.constants.RSA_PKCS1_PSS_PADDING; signParams.saltLength = 48; }   // allow:raw-byte-literal — RFC 7518 PS384 salt
+    else if (sm.alg === "PS256") { signAlgo = "sha256"; signParams.padding = nodeCrypto.constants.RSA_PKCS1_PSS_PADDING; signParams.saltLength = 32; }   // RFC 7518 PS256 salt
+    else if (sm.alg === "PS384") { signAlgo = "sha384"; signParams.padding = nodeCrypto.constants.RSA_PKCS1_PSS_PADDING; signParams.saltLength = 48; }   // RFC 7518 PS384 salt
     var sig = nodeCrypto.sign(signAlgo, Buffer.from(input, "ascii"), signParams);
     signedJwt = input + "." + _b64url(sig);
   }

package/lib/vendor/blamejs/lib/middleware/rate-limit.js

@@ -364,6 +364,7 @@ function _resolveBackend(opts) {
  *     statusOnLimit:   number,           // default 429
  *     bodyOnLimit:     string,           // default "Too Many Requests"
  *     header:          boolean,          // default true
+ *     headerPrefix:    string,           // default "X-RateLimit-" — builds <prefix>Limit / <prefix>Remaining (e.g. "RateLimit-" for the IETF draft names)
  *     skipPaths:       Array<string|RegExp>,
  *     scope:           "global"|"per-route",
  *     backend:         "memory"|"cluster"|{ take, reset },
@@ -390,7 +391,7 @@ function _resolveBackend(opts) {
 function create(opts) {
   opts = opts || {};
   validateOpts(opts, [
-    "keyFn", "statusOnLimit", "bodyOnLimit", "header", "skipPaths", "scope",
+    "keyFn", "statusOnLimit", "bodyOnLimit", "header", "headerPrefix", "skipPaths", "scope",
     "backend", "trustProxy", "algorithm",
     // memory backend (token-bucket)
     "burst", "refillPerSecond",
@@ -404,6 +405,14 @@ function create(opts) {
   var statusOnLimit = opts.statusOnLimit || 429;
   var bodyOnLimit = opts.bodyOnLimit !== undefined ? opts.bodyOnLimit : "Too Many Requests";
   var emitHeaders = opts.header !== false;
+  // headerPrefix (default "X-RateLimit-") builds the limit/remaining header
+  // names as <prefix>Limit / <prefix>Remaining. The X-RateLimit-* family is a
+  // de-facto convention, not RFC-pinned — operators matching the IETF draft
+  // pass "RateLimit-", or a gateway's own prefix. Kept as a matched pair.
+  var headerPrefix = (typeof opts.headerPrefix === "string" && opts.headerPrefix.length > 0)
+    ? opts.headerPrefix : "X-RateLimit-";
+  var limitHeader = headerPrefix + "Limit";
+  var remainingHeader = headerPrefix + "Remaining";
   var skipPaths = opts.skipPaths || [];
   // Throw at create(): each entry must be a string prefix or a RegExp.
   // Anything else would crash _shouldSkip with TypeError on the first request.
@@ -429,8 +438,8 @@ function create(opts) {
 
   function _writeBlocked(req, res, k, verdict) {
     if (emitHeaders && typeof res.setHeader === "function") {
-      res.setHeader("X-RateLimit-Limit", String(verdict.limit));
-      res.setHeader("X-RateLimit-Remaining", String(verdict.remaining));
+      res.setHeader(limitHeader, String(verdict.limit));
+      res.setHeader(remainingHeader, String(verdict.remaining));
       if (verdict.retryAfter > 0) res.setHeader("Retry-After", String(verdict.retryAfter));
     }
     try {
@@ -459,8 +468,8 @@ function create(opts) {
 
     function _handle(verdict) {
       if (emitHeaders && typeof res.setHeader === "function") {
-        res.setHeader("X-RateLimit-Limit", String(verdict.limit));
-        res.setHeader("X-RateLimit-Remaining", String(verdict.remaining));
+        res.setHeader(limitHeader, String(verdict.limit));
+        res.setHeader(remainingHeader, String(verdict.remaining));
       }
       if (!verdict.allowed) return _writeBlocked(req, res, k, verdict);
       next();

package/lib/vendor/blamejs/lib/middleware/require-aal.js

@@ -36,7 +36,7 @@ function _writeUnauthorized(res, requiredBand, actualBand, realm) {
   });
   var realmStr = realm ? ' realm="' + realm + '"' : "";
   var challenge = "AAL-StepUp" + realmStr + ', required="' + requiredBand + '"';
-  res.writeHead(401, {                                                             // allow:raw-byte-literal — HTTP 401 status
+  res.writeHead(401, {                                                             // HTTP 401 status
     "Content-Type":     "application/json; charset=utf-8",
     "Content-Length":   Buffer.byteLength(body),
     "WWW-Authenticate": challenge,

package/lib/vendor/blamejs/lib/middleware/require-bound-key.js

@@ -215,12 +215,12 @@ function create(opts) {
       var presented;
       try { presented = getter(req); }
       catch (e) {
-        return _refuse(res, 400, "bound-field-getter-threw", {                            // allow:raw-byte-literal — HTTP 400
+        return _refuse(res, 400, "bound-field-getter-threw", {                            // HTTP 400
           field: fieldName, error: (e && e.message) || String(e),
         });
       }
       if (typeof presented !== "string" || presented.length === 0) {
-        return _refuse(res, 400, "bound-field-missing", {                                 // allow:raw-byte-literal — HTTP 400
+        return _refuse(res, 400, "bound-field-missing", {                                 // HTTP 400
           field: fieldName, keyId: record.id || null,
         });
       }

package/lib/vendor/blamejs/lib/middleware/require-content-type.js

@@ -91,7 +91,7 @@ function create(allowed, opts) {
     if (bare.length > 0 && normalized.indexOf(bare) !== -1) return next();
     if (!res.headersSent) {
       var body = "Unsupported Media Type";
-      res.writeHead(415, {                                                       // allow:raw-byte-literal — HTTP 415 status
+      res.writeHead(415, {                                                       // HTTP 415 status
         "Accept":         normalized.join(", "),
         "Content-Type":   "text/plain; charset=utf-8",
         "Content-Length": Buffer.byteLength(body),

package/lib/vendor/blamejs/lib/middleware/require-methods.js

@@ -75,7 +75,7 @@ function create(allowed, opts) {
     if (normalized.indexOf(m) !== -1) return next();
     if (!res.headersSent) {
       var body = "Method Not Allowed";
-      res.writeHead(405, {                                                       // allow:raw-byte-literal — HTTP 405 status
+      res.writeHead(405, {                                                       // HTTP 405 status
         "Allow":          allowHeader,
         "Content-Type":   "text/plain; charset=utf-8",
         "Content-Length": Buffer.byteLength(body),

package/lib/vendor/blamejs/lib/middleware/require-step-up.js

@@ -67,7 +67,7 @@ function _defaultGetClaims(req) {
 function _writeChallenge(res, challenge, body, statusCode) {
   if (res.headersSent) return;
   var json = JSON.stringify(body);
-  res.writeHead(statusCode, {                                                      // allow:raw-byte-literal — HTTP status passthrough
+  res.writeHead(statusCode, {                                                      // HTTP status passthrough
     "Content-Type":     "application/json; charset=utf-8",
     "Content-Length":   Buffer.byteLength(json),
     "WWW-Authenticate": challenge,
@@ -218,7 +218,7 @@ function create(opts) {
         error:             stepUp().INSUFFICIENT_USER_AUTHENTICATION,
         error_description: errorDesc || "A higher level of authentication is required",
       },
-      401                                                                                  // allow:raw-byte-literal — HTTP 401
+      401                                                                                  // HTTP 401
     );
   };
 }

package/lib/vendor/blamejs/lib/middleware/scim-server.js

@@ -61,7 +61,7 @@ function create(opts) {
   if (opts.groups) _validateResourceImpl(opts.groups, "groups");
 
   var basePath    = opts.basePath || "/scim/v2";
-  var maxPageSize = opts.maxPageSize || 200;                                                                  // allow:raw-byte-literal — page-size count, not bytes
+  var maxPageSize = opts.maxPageSize || 200;                                                                  // page-size count, not bytes
   var bearer      = opts.bearer || null;
 
   function middleware(req, res, next) {

package/lib/vendor/blamejs/lib/middleware/security-txt.js

@@ -144,15 +144,15 @@ function create(opts) {
                   (alsoAtRoot && path === "/security.txt");
     if (!matches) return next();
     if (req.method !== "GET" && req.method !== "HEAD") {
-      res.writeHead(405, {                                                       // allow:raw-byte-literal — HTTP 405 status
+      res.writeHead(405, {                                                       // HTTP 405 status
         "Allow":          "GET, HEAD",
         "Content-Type":   "text/plain; charset=utf-8",
-        "Content-Length": 18,                                                    // allow:raw-byte-literal — len of "Method Not Allowed"
+        "Content-Length": 18,                                                    // len of "Method Not Allowed"
       });
       res.end("Method Not Allowed");
       return;
     }
-    res.writeHead(200, {                                                         // allow:raw-byte-literal — HTTP 200 status
+    res.writeHead(200, {                                                         // HTTP 200 status
       "Content-Type":     "text/plain; charset=utf-8",
       "Content-Length":   bodyBuf.length,
       "Cache-Control":    "public, max-age=86400",

package/lib/vendor/blamejs/lib/middleware/sse.js

@@ -90,6 +90,7 @@ function _formatEvent(msg) {
  *   {
  *     heartbeatMs: number|false,   // default 15000
  *     headers:     object,         // extra response headers
+ *     proxyBuffer: boolean,        // default true — sets X-Accel-Buffering: no; false to suppress
  *   }
  *
  * @example
@@ -105,13 +106,17 @@ function create(handler, opts) {
     throw new Error("middleware.sse: handler must be a function (channel, req) => ...");
   }
   opts = opts || {};
-  validateOpts(opts, ["heartbeatMs", "headers"], "middleware.sse");
+  validateOpts(opts, ["heartbeatMs", "headers", "proxyBuffer"], "middleware.sse");
   var heartbeatMs = opts.heartbeatMs === false ? 0
     : (opts.heartbeatMs != null ? opts.heartbeatMs : DEFAULT_HEARTBEAT_MS);
   if (heartbeatMs !== 0 && (typeof heartbeatMs !== "number" || !isFinite(heartbeatMs) || heartbeatMs <= 0)) {
     throw new Error("middleware.sse: heartbeatMs must be a positive finite number or false");
   }
   var extraHeaders = opts.headers || {};
+  // proxyBuffer (default true) sets `X-Accel-Buffering: no` (the nginx hint
+  // that disables proxy buffering). Pass false when not behind nginx, or
+  // when buffering is controlled at the load balancer, to suppress it.
+  var proxyBuffer = opts.proxyBuffer !== false;
 
   return async function sseMiddleware(req, res) {
     if (typeof res.writeHead !== "function" || typeof res.write !== "function") {
@@ -119,13 +124,14 @@ function create(handler, opts) {
       // unusual. Fail closed rather than silently dropping the handler.
       throw new Error("middleware.sse: res does not support writeHead/write — wire SSE only on HTTP routes");
     }
-    var headers = Object.assign({
-      "Content-Type":     "text/event-stream; charset=utf-8",
-      "Cache-Control":    "no-cache, no-transform",
-      "Connection":       "keep-alive",
-      // Disable nginx response buffering when terminating behind it.
-      "X-Accel-Buffering": "no",
-    }, extraHeaders);
+    var baseHeaders = {
+      "Content-Type":  "text/event-stream; charset=utf-8",
+      "Cache-Control": "no-cache, no-transform",
+      "Connection":    "keep-alive",
+    };
+    // Disable nginx response buffering when terminating behind it.
+    if (proxyBuffer) baseHeaders["X-Accel-Buffering"] = "no";
+    var headers = Object.assign(baseHeaders, extraHeaders);
     // Append Vary: Accept so a proxy doesn't serve a cached non-SSE
     // response on the same URL to a future client.
     res.writeHead(requestHelpers.HTTP_STATUS.OK, headers);

package/lib/vendor/blamejs/lib/middleware/tus-upload.js

@@ -59,18 +59,18 @@ var TUS_ID_BYTES = C.BYTES.bytes(18);
 
 // HTTP status codes used by TUS — hoisted to named constants so the
 // raw-byte-literal detector doesn't fire on every status path.
-var STATUS_OK                = 200;                                                // allow:raw-byte-literal — HTTP status
-var STATUS_CREATED           = 201;                                                // allow:raw-byte-literal — HTTP status
-var STATUS_NO_CONTENT        = 204;                                                // allow:raw-byte-literal — HTTP status
-var STATUS_BAD_REQUEST       = 400;                                                // allow:raw-byte-literal — HTTP status
-var STATUS_NOT_FOUND         = 404;                                                // allow:raw-byte-literal — HTTP status
-var STATUS_METHOD_NOT_ALLOWED = 405;                                               // allow:raw-byte-literal — HTTP status
-var STATUS_CONFLICT          = 409;                                                // allow:raw-byte-literal — HTTP status
-var STATUS_PRECONDITION_FAILED = 412;                                              // allow:raw-byte-literal — HTTP status
-var STATUS_PAYLOAD_TOO_LARGE = 413;                                                // allow:raw-byte-literal — HTTP status
-var STATUS_UNSUPPORTED_MEDIA = 415;                                                // allow:raw-byte-literal — HTTP status
-var STATUS_CHECKSUM_MISMATCH = 460;                                                // allow:raw-byte-literal — TUS-specific status (§3.5)
-var STATUS_INTERNAL_ERROR    = 500;                                                // allow:raw-byte-literal — HTTP status
+var STATUS_OK                = 200;                                                // HTTP status
+var STATUS_CREATED           = 201;                                                // HTTP status
+var STATUS_NO_CONTENT        = 204;                                                // HTTP status
+var STATUS_BAD_REQUEST       = 400;                                                // HTTP status
+var STATUS_NOT_FOUND         = 404;                                                // HTTP status
+var STATUS_METHOD_NOT_ALLOWED = 405;                                               // HTTP status
+var STATUS_CONFLICT          = 409;                                                // HTTP status
+var STATUS_PRECONDITION_FAILED = 412;                                              // HTTP status
+var STATUS_PAYLOAD_TOO_LARGE = 413;                                                // HTTP status
+var STATUS_UNSUPPORTED_MEDIA = 415;                                                // HTTP status
+var STATUS_CHECKSUM_MISMATCH = 460;                                                // TUS-specific status (§3.5)
+var STATUS_INTERNAL_ERROR    = 500;                                                // HTTP status
 
 var TusError = defineClass("TusError", { alwaysPermanent: true });
 

package/lib/vendor/blamejs/lib/middleware/web-app-manifest.js

@@ -136,7 +136,7 @@ function create(opts) {
     if (!matches) return next();
     if (req.method !== "GET" && req.method !== "HEAD") {
       var bodyMsg = "Method Not Allowed";
-      res.writeHead(405, {                                                       // allow:raw-byte-literal — HTTP 405 status
+      res.writeHead(405, {                                                       // HTTP 405 status
         "Allow":          "GET, HEAD",
         "Content-Type":   "text/plain; charset=utf-8",
         "Content-Length": Buffer.byteLength(bodyMsg),
@@ -144,7 +144,7 @@ function create(opts) {
       res.end(bodyMsg);
       return;
     }
-    res.writeHead(200, {                                                         // allow:raw-byte-literal — HTTP 200 status
+    res.writeHead(200, {                                                         // HTTP 200 status
       "Content-Type":     "application/manifest+json",
       "Content-Length":   bodyBuf.length,
       "Cache-Control":    "public, max-age=86400",

package/lib/vendor/blamejs/lib/network-byte-quota.js

@@ -48,7 +48,7 @@ var observability = lazyRequire(function () { return require("./observability");
 
 var ByteQuotaError = defineClass("ByteQuotaError", { alwaysPermanent: true });
 
-var BINS_PER_DAY = 24;                                                                  // allow:raw-byte-literal — 24 hours in a day
+var BINS_PER_DAY = 24;                                                                  // 24 hours in a day
 var BIN_MS = C.TIME.hours(1);
 
 function _hourBin(nowMs) { return Math.floor(nowMs / BIN_MS); }