@blamejs/blamejs-shop 0.3.6 → 0.3.8

package/lib/vendor/blamejs/lib/middleware/require-mtls.js

@@ -48,6 +48,7 @@
 var defineClass = require("../framework-error").defineClass;
 var lazyRequire = require("../lazy-require");
 var validateOpts = require("../validate-opts");
+var denyResponse = require("./deny-response").denyResponse;
 
 var bCrypto = lazyRequire(function () { return require("../crypto"); });
 var audit  = lazyRequire(function () { return require("../audit"); });
@@ -84,6 +85,8 @@ function _normalizeFingerprintEntry(entry) {
  *     fingerprintAllowList: string[],
  *     denyList:             string[],
  *     onAuthenticated:      function(req, res, next): void,
+ *     onDeny:               function(req, res, info): void,  // own the refusal (mirrors onAuthenticated); info = { status, reason, ...metadata }
+ *     problemDetails:       boolean,        // default false — emit RFC 9457 application/problem+json instead of the default JSON envelope
  *     auditAction:          string,
  *     errorMessage:         string,
  *     audit:                object,
@@ -100,7 +103,7 @@ function create(opts) {
   opts = opts || {};
   validateOpts(opts, [
     "fingerprintAllowList", "denyList",
-    "onAuthenticated", "audit",
+    "onAuthenticated", "onDeny", "problemDetails", "audit",
     "auditAction", "errorMessage",
   ], "middleware.requireMtls");
 
@@ -109,6 +112,8 @@ function create(opts) {
   var denyList = Array.isArray(opts.denyList)
     ? opts.denyList.map(_normalizeFingerprintEntry) : [];
   var onAuthenticated = typeof opts.onAuthenticated === "function" ? opts.onAuthenticated : null;
+  var onDeny = typeof opts.onDeny === "function" ? opts.onDeny : null;
+  var problemMode = opts.problemDetails === true;
   var auditOn  = opts.audit !== false;
   var actionBase = typeof opts.auditAction === "string" && opts.auditAction.length > 0
     ? opts.auditAction : "mtls.required";
@@ -126,16 +131,24 @@ function create(opts) {
     } catch (_e) { /* drop-silent — audit is best-effort, never blocks the request */ }
   }
 
-  function _refuse(res, reason, metadata) {
+  function _refuse(req, res, reason, metadata) {
     _emit("denied", Object.assign({ reason: reason }, metadata || {}));
-    if (typeof res.writeHead === "function") {
-      res.writeHead(401, {
-        "Content-Type":     "application/json; charset=utf-8",
+    denyResponse(req, res, {
+      onDeny:        onDeny,
+      problem:       problemMode,
+      status:        401,
+      info:          Object.assign({ status: 401, reason: reason }, metadata || {}),
+      problemCode:   "client-certificate-required",
+      problemTitle:  "Unauthorized",
+      problemDetail: errorMessage,
+      problemExt:    { reason: reason },
+      headers:       {
         "WWW-Authenticate": "Mutual",
         "Cache-Control":    "no-store",
-      });
-      res.end(JSON.stringify({ error: errorMessage, reason: reason }));
-    }
+      },
+      contentType:   "application/json; charset=utf-8",
+      body:          JSON.stringify({ error: errorMessage, reason: reason }),
+    });
   }
 
   return function requireMtlsMiddleware(req, res, next) {
@@ -158,10 +171,10 @@ function create(opts) {
 
     if (!authorized) {
       var authzError = (sock && sock.authorizationError) || "no-peer-cert";
-      return _refuse(res, "tls-unauthorized", { authorizationError: String(authzError) });
+      return _refuse(req, res, "tls-unauthorized", { authorizationError: String(authzError) });
     }
     if (!peerCert || !peerCert.raw) {
-      return _refuse(res, "no-peer-cert", {});
+      return _refuse(req, res, "no-peer-cert", {});
     }
 
     // Compute fingerprint via the framework's SHA3-512 helper. Buffer
@@ -171,17 +184,17 @@ function create(opts) {
     try {
       fp = bCrypto().hashCertFingerprint(peerCert.raw);
     } catch (e) {
-      return _refuse(res, "fingerprint-failed", { error: (e && e.message) || String(e) });
+      return _refuse(req, res, "fingerprint-failed", { error: (e && e.message) || String(e) });
     }
 
     if (denyList.length > 0 && bCrypto().isCertRevoked(peerCert.raw, denyList)) {
-      return _refuse(res, "fingerprint-on-deny-list", {
+      return _refuse(req, res, "fingerprint-on-deny-list", {
         fingerprint: fp.colon,
         subject:     (peerCert.subject && peerCert.subject.CN) || null,
       });
     }
     if (allowList && allowList.length > 0 && !bCrypto().isCertRevoked(peerCert.raw, allowList)) {
-      return _refuse(res, "fingerprint-not-allowed", {
+      return _refuse(req, res, "fingerprint-not-allowed", {
         fingerprint: fp.colon,
         subject:     (peerCert.subject && peerCert.subject.CN) || null,
       });
@@ -199,7 +212,7 @@ function create(opts) {
     if (onAuthenticated) {
       try { return onAuthenticated(req, res, next); }
       catch (e) {
-        return _refuse(res, "on-authenticated-threw", { error: (e && e.message) || String(e) });
+        return _refuse(req, res, "on-authenticated-threw", { error: (e && e.message) || String(e) });
       }
     }
     return next();

package/lib/vendor/blamejs/lib/network.js

@@ -108,8 +108,8 @@ function _socketDefaults() {
 }
 
 /**
- * @primitive b.network.applyToSocket
- * @signature b.network.applyToSocket(socket)
+ * @primitive b.network.socket.applyToSocket
+ * @signature b.network.socket.applyToSocket(socket)
  * @since     0.7.68
  * @related   b.network.bootFromEnv, b.network.snapshot
  *
@@ -124,7 +124,7 @@ function _socketDefaults() {
  * @example
  *   var net = require("net");
  *   var s   = new net.Socket();
- *   var ret = b.network.applyToSocket(s);
+ *   var ret = b.network.socket.applyToSocket(s);
  *   ret === s;
  *   // → true
  *   s.destroy();
@@ -164,7 +164,7 @@ var ntpFacade = {
  * @primitive b.network.bootFromEnv
  * @signature b.network.bootFromEnv(opts)
  * @since     0.7.68
- * @related   b.network.snapshot, b.network.applyToSocket
+ * @related   b.network.snapshot, b.network.socket.applyToSocket
  *
  * Read `BLAMEJS_*` environment variables once and apply the union to
  * the live network facade. Recognised keys cover NTP servers /

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.14.5",
+  "version": "0.14.6",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.14.6.json

@@ -0,0 +1,60 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.14.6",
+  "date": "2026-05-30",
+  "headline": "Access-refusal middleware can return RFC 9457 problem+json or a custom response, and several documented-but-uncallable APIs are now reachable",
+  "summary": "Every access-refusal middleware — the auth gates (bearer, DPoP, mTLS, AAL, bound-key), CSRF, CORS, rate-limit, bot-guard, age-gate, the host and network allowlists, and the method and content-type gates — now accepts two uniform options: `problemDetails: true` returns an RFC 9457 `application/problem+json` body, and `onDeny(req, res, info)` hands the response to the caller. With neither set the refusal is byte-for-byte what it was, so this is a drop-in change that lets a service standardize one error envelope across its API instead of working around each middleware's hardcoded body. Alongside that: `b.middleware.requireBoundKey` is now exported (it was documented and tested but never wired into the middleware surface), `b.middleware.bearerAuth` accepts `requiredScopes` (previously rejected at construction, which made its scope-enforcement path unreachable), API-key refusals send the RFC 6750 challenge code that matches the failure, two documented call paths that named a missing namespace segment are corrected, and the release flow now flags stale GitHub Actions and vendored bundles — with a ready-to-paste pin — before a dependency PR is needed.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "Uniform `onDeny` and `problemDetails` options on every access-refusal middleware",
+          "body": "Each request-lifecycle middleware that refuses a request now takes `problemDetails: true` to emit an RFC 9457 `application/problem+json` body (composing `b.problemDetails`) and `onDeny(req, res, info)` to take over the response entirely; `info` carries the status, a machine reason, and the middleware-specific fields. The deny-path response headers (`Allow`, `WWW-Authenticate`, `Retry-After`, `Accept`) survive every mode. When neither option is set the response is unchanged. Covers `requireAuth`, `requireAal`, `requireMethods`, `requireContentType`, `requireMtls`, `requireBoundKey`, `bearerAuth`, `dpop`, `csrfProtect`, `fetchMetadata`, `botGuard`, `ageGate`, `hostAllowlist`, `networkAllowlist`, `cors`, `rateLimit`, and `dailyByteQuota` (whose existing `onExceeded` keeps working as an alias of `onDeny`)."
+        }
+      ]
+    },
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "`b.middleware.requireBoundKey` is now callable",
+          "body": "The Bearer-API-key middleware was documented (with examples and tests) but never exported on `b.middleware`, so `b.middleware.requireBoundKey(...)` threw `undefined is not a function`. It is now wired into the middleware surface."
+        },
+        {
+          "title": "`b.middleware.bearerAuth` accepts `requiredScopes`",
+          "body": "The RFC 6750 scope-enforcement path read `opts.requiredScopes`, but the option was rejected at construction with `unknown option`, making the 403 `insufficient_scope` behavior unreachable. `requiredScopes` is now an accepted option."
+        },
+        {
+          "title": "RFC 6750 challenge codes on API-key refusals",
+          "body": "`b.middleware.requireBoundKey` now sends the `WWW-Authenticate` error code that matches the failure: `insufficient_scope` on a 403 missing-scope, `invalid_token` on an unknown or revoked token, and no error code on a 401 that presented no credentials (RFC 6750 §3). It previously sent `invalid_request` for every refusal."
+        },
+        {
+          "title": "Corrected two documented call paths",
+          "body": "The compliance and network references named a path that dropped a namespace segment: the conformity-assessment scaffold is at `b.cra.report.conformityAssessment` (not `b.cra.conformityAssessment`), and the per-socket tuning helper is at `b.network.socket.applyToSocket` (not `b.network.applyToSocket`). The documented signatures now match the callable paths."
+        },
+        {
+          "title": "GitHub Actions pins refreshed",
+          "body": "`github/codeql-action` 4.35.5 to 4.36.0, and `docker/login-action`, `docker/setup-buildx-action`, and `docker/setup-qemu-action` to their latest releases."
+        }
+      ]
+    },
+    {
+      "heading": "Detectors",
+      "items": [
+        {
+          "title": "`@primitive` reachability gate",
+          "body": "A new check resolves every documented `b.X.Y` primitive against the actual public surface and fails the build when a documented path is not callable (factory-instance shorthands excluded). This is the gate that would have caught the `requireBoundKey` and call-path issues above."
+        },
+        {
+          "title": "Deny-path composition gate",
+          "body": "A new check requires every access-refusal middleware to route its refusal through the shared deny-response writer, so a future middleware cannot reintroduce a hardcoded body that locks callers out of `onDeny` / `problemDetails`."
+        },
+        {
+          "title": "Actions and vendor currency in the release flow",
+          "body": "The release flow now fails the cut when a SHA-pinned GitHub Action or a vendored bundle is behind its latest upstream release. The actions report prints a ready-to-paste `owner/repo@<sha>  # vX.Y.Z` pin and every file and line that uses it, so the bump is copy-paste rather than an after-the-fact dependency PR. Transient registry or API errors stay advisory so a flaky network response does not block an unrelated release."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/scripts/check-actions-currency.js

@@ -0,0 +1,256 @@
+"use strict";
+/**
+ * GitHub-Actions-currency gate — the sibling of
+ * `scripts/check-vendor-currency.js` for the CI/CD supply chain.
+ *
+ * Walks every `.github/workflows/*.yml`, reads each SHA-pinned
+ * `uses: owner/repo[/subpath]@<sha>  # vX.Y.Z` reference, and asserts
+ * the pinned version (from the trailing comment the pinact discipline
+ * requires) matches the latest upstream release. A stale action
+ * becomes a release blocker HERE — caught in the pre-merge gate suite
+ * — instead of being surfaced after-the-fact by a Dependabot PR.
+ *
+ * Run locally:
+ *   node scripts/check-actions-currency.js
+ *   node scripts/check-actions-currency.js --json     // structured output
+ *   node scripts/check-actions-currency.js --warn     // exit 0, print only
+ *
+ * Run in CI: the workflow passes GITHUB_TOKEN in the environment so the
+ * GitHub API gives the authenticated 5000/hour budget instead of the
+ * 60/hour unauthenticated per-IP limit. `stale` fails the gate;
+ * transient `api-error` results are advisory unless
+ * BLAMEJS_ACTIONS_CURRENCY_STRICT=1 converts them into hard fails too.
+ *
+ * Actions deliberately pinned to an older major (a new major the repo
+ * has not adopted) carry a SPECIAL_MAP entry pinning the expected
+ * major so the gate doesn't fight an intentional hold.
+ */
+
+var fs    = require("fs");
+var path  = require("path");
+var https = require("https");
+
+var WORKFLOWS_DIR = path.join(__dirname, "..", ".github", "workflows");
+
+var WARN_ONLY  = process.argv.indexOf("--warn") !== -1;
+var JSON_OUT   = process.argv.indexOf("--json") !== -1;
+var TIMEOUT_MS = 10000;
+
+// Per-action overrides. Keyed by "owner/repo".
+//   { type: "hold-major", major: N, reason: "..." } — only flag stale
+//        WITHIN the pinned major; a newer major is an intentional hold.
+//   { type: "skip", reason: "..." }                 — never flag.
+var SPECIAL_MAP = {
+  // (none — every pinned action tracks upstream latest)
+};
+
+function _githubGet(apiPath) {
+  return new Promise(function (resolve, reject) {
+    var headers = {
+      "User-Agent": "blamejs-actions-currency/1",
+      "Accept":     "application/vnd.github+json",
+    };
+    // Authenticated requests get the 5000/hour budget. Both env names
+    // are accepted (GITHUB_TOKEN in Actions, GH_TOKEN for local gh).
+    var token = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
+    if (token) headers.Authorization = "Bearer " + token;
+    var req = https.get("https://api.github.com" + apiPath, { timeout: TIMEOUT_MS, headers: headers }, function (res) {
+      var chunks = [];
+      res.on("data", function (c) { chunks.push(c); });
+      res.on("end", function () {
+        if (res.statusCode !== 200) {
+          return reject(new Error("github " + apiPath + " status " + res.statusCode));
+        }
+        try { resolve(JSON.parse(Buffer.concat(chunks).toString("utf8"))); }
+        catch (e) { reject(e); }
+      });
+    });
+    req.on("timeout", function () { req.destroy(new Error("github " + apiPath + " timed out after " + TIMEOUT_MS + "ms")); });
+    req.on("error", reject);
+  });
+}
+
+async function _resolveSha(ownerRepo, ref) {
+  // Resolve a tag to the COMMIT sha it points at — exactly what the
+  // pinact discipline pins (`owner/repo@<commit-sha>  # tag`). The
+  // commits endpoint dereferences annotated tags to their commit.
+  var c = await _githubGet("/repos/" + ownerRepo + "/commits/" + encodeURIComponent(ref));
+  if (!c || typeof c.sha !== "string") throw new Error("could not resolve sha for " + ownerRepo + "@" + ref);
+  return c.sha;
+}
+
+async function _latestVersion(ownerRepo) {
+  // Prefer the published "latest" release tag; fall back to the
+  // highest semver tag for actions that ship tags without GitHub
+  // Releases (e.g. ludeeus/action-shellcheck). Returns { tag, sha }
+  // so the report can hand back a ready-to-paste pin line.
+  var tag = null;
+  try {
+    var rel = await _githubGet("/repos/" + ownerRepo + "/releases/latest");
+    // Only trust the release tag when it is semver-shaped. Some repos
+    // (github/codeql-action) publish a non-semver bundle tag as their
+    // "latest release" (codeql-bundle-vX.Y.Z) while the ACTION is
+    // versioned on separate vN.N.N tags — fall through to tags then.
+    if (rel && typeof rel.tag_name === "string" && _semverParse(rel.tag_name)) tag = rel.tag_name;
+  } catch (_e) { /* fall through to tags */ }
+  if (!tag) {
+    var tags = await _githubGet("/repos/" + ownerRepo + "/tags?per_page=100");
+    if (!Array.isArray(tags) || tags.length === 0) {
+      throw new Error("no releases or tags for " + ownerRepo);
+    }
+    var best = null;
+    for (var i = 0; i < tags.length; i++) {
+      var p = _semverParse(tags[i].name);
+      if (p && (!best || _semverCompare(p, best.parsed) > 0)) {
+        best = { name: tags[i].name, parsed: p };
+      }
+    }
+    if (!best) throw new Error("no semver-shaped tag for " + ownerRepo);
+    tag = best.name;
+  }
+  return { tag: tag, sha: await _resolveSha(ownerRepo, tag) };
+}
+
+function _semverParse(v) {
+  // Accept partial tags (v4 / v4.1) by treating missing segments as 0.
+  var m = String(v).match(/^v?(\d+)(?:\.(\d+))?(?:\.(\d+))?/);
+  if (!m) return null;
+  return [parseInt(m[1], 10), parseInt(m[2] || "0", 10), parseInt(m[3] || "0", 10)];
+}
+
+function _semverCompare(a, b) {
+  if (!a || !b) return 0;
+  for (var i = 0; i < 3; i++) {
+    if (a[i] > b[i]) return  1;
+    if (a[i] < b[i]) return -1;
+  }
+  return 0;
+}
+
+// Collect distinct SHA-pinned actions across every workflow file.
+// Returns { "owner/repo": { version, refs: [{ file, line, subpath }] } }.
+function _collectPinnedActions() {
+  var out = {};
+  var files = fs.readdirSync(WORKFLOWS_DIR).filter(function (f) {
+    return f.endsWith(".yml") || f.endsWith(".yaml");
+  });
+  // `uses: owner/repo[/subpath]@<40-hex-sha>  # vX.Y[.Z]`
+  var re = /uses:\s*([A-Za-z0-9._-]+\/[A-Za-z0-9._-]+)(\/[^@\s]+)?@([0-9a-f]{40})\s*#\s*v?(\d+(?:\.\d+){0,2})/;
+  for (var f = 0; f < files.length; f++) {
+    var rel = ".github/workflows/" + files[f];
+    var lines = fs.readFileSync(path.join(WORKFLOWS_DIR, files[f]), "utf8").split("\n");
+    for (var L = 0; L < lines.length; L++) {
+      var m = lines[L].match(re);
+      if (!m) continue;
+      var ownerRepo = m[1];
+      var subpath   = m[2] || "";
+      var version   = m[4];
+      if (!out[ownerRepo]) out[ownerRepo] = { version: version, refs: [] };
+      out[ownerRepo].refs.push({ file: rel, line: L + 1, subpath: subpath });
+      // If the same repo is pinned at two different versions across
+      // files, record the lowest so a partial bump still flags.
+      if (_semverCompare(_semverParse(version), _semverParse(out[ownerRepo].version)) < 0) {
+        out[ownerRepo].version = version;
+      }
+    }
+  }
+  return out;
+}
+
+async function _checkOne(ownerRepo, entry) {
+  var special = SPECIAL_MAP[ownerRepo];
+  if (special && special.type === "skip") {
+    return { action: ownerRepo, status: "skipped", reason: special.reason, pinned: entry.version };
+  }
+  var pinned = _semverParse(entry.version);
+  try {
+    var info = await _latestVersion(ownerRepo);
+    var latest = _semverParse(info.tag);
+    var cmp = _semverCompare(pinned, latest);
+    var status = cmp >= 0 ? "current" : "stale";
+    if (special && special.type === "hold-major" && latest && latest[0] > special.major) {
+      // A newer major exists but the repo intentionally holds an
+      // older major — only flag stale WITHIN the held major.
+      status = "current";
+    }
+    return {
+      action:    ownerRepo,
+      pinned:    entry.version,
+      latest:    info.tag,
+      latestSha: info.sha,
+      status:    status,
+      refs:      entry.refs,
+    };
+  } catch (e) {
+    return {
+      action: ownerRepo,
+      pinned: entry.version,
+      status: "api-error",
+      error:  (e && e.message) || String(e),
+      refs:   entry.refs,
+    };
+  }
+}
+
+async function main() {
+  var pinned = _collectPinnedActions();
+  var actions = Object.keys(pinned).sort();
+  var results = [];
+  // Sequential + polite — the action count is small and serial GETs
+  // keep us well inside the API budget on shared CI IPs.
+  for (var i = 0; i < actions.length; i++) {
+    results.push(await _checkOne(actions[i], pinned[actions[i]]));
+  }
+
+  if (JSON_OUT) {
+    process.stdout.write(JSON.stringify({ results: results }, null, 2) + "\n");
+  } else {
+    process.stdout.write("[actions-currency] " + actions.length + " SHA-pinned action(s) inspected:\n");
+    for (var j = 0; j < results.length; j++) {
+      var r = results[j];
+      var label = r.status === "current"   ? "OK"
+                : r.status === "stale"     ? "STALE"
+                : r.status === "api-error" ? "ERR"
+                : r.status === "skipped"   ? "skip"
+                :                            r.status;
+      var line = "  [" + label + "] " + r.action + "  " + r.pinned;
+      if (r.latest) line += " -> " + r.latest;
+      if (r.reason) line += "  (" + r.reason + ")";
+      if (r.error)  line += "  (api: " + r.error + ")";
+      process.stdout.write(line + "\n");
+      // For stale entries, print a ready-to-paste pin line + every
+      // file:line that needs the bump, so updating is copy-paste.
+      if (r.status === "stale" && r.latestSha) {
+        process.stdout.write("        pin:  " + r.action + "@" + r.latestSha + "  # " + r.latest + "\n");
+        for (var rf = 0; rf < (r.refs || []).length; rf++) {
+          process.stdout.write("        used: " + r.refs[rf].file + ":" + r.refs[rf].line + "\n");
+        }
+      }
+    }
+  }
+
+  var stale   = results.filter(function (r) { return r.status === "stale"; });
+  var errored = results.filter(function (r) { return r.status === "api-error"; });
+
+  if (WARN_ONLY) {
+    if (stale.length || errored.length) {
+      process.stdout.write("[actions-currency] --warn: " + stale.length + " stale, " +
+        errored.length + " errored — exit 0 anyway\n");
+    }
+    process.exit(0);
+  }
+
+  var strictErrors = process.env.BLAMEJS_ACTIONS_CURRENCY_STRICT === "1";
+  if (stale.length > 0 || (strictErrors && errored.length > 0)) {
+    process.stdout.write("[actions-currency] FAIL — " + stale.length + " stale, " +
+      errored.length + " api-error(s). Bump the pinned SHA + version comment to the latest release.\n");
+    process.exit(1);
+  }
+  process.stdout.write("[actions-currency] OK — every pinned action matches the latest upstream release\n");
+  process.exit(0);
+}
+
+main().catch(function (e) {
+  process.stderr.write("[actions-currency] script crashed: " + (e && e.stack || e) + "\n");
+  process.exit(2);
+});

package/lib/vendor/blamejs/scripts/release.js

@@ -258,6 +258,17 @@ function cmdPrepare(opts) {
   _run("node", ["scripts/validate-source-comment-blocks.js"]);
   _ok("eslint + codebase-patterns + source-comment-blocks clean");
 
+  _section("supply-chain currency");
+  // A stale SHA-pinned GitHub Action or vendored bundle becomes a
+  // release blocker HERE — with a ready-to-paste pin line in the
+  // actions report — instead of an after-the-fact Dependabot PR.
+  // Each script treats only an actually-newer upstream version as a
+  // failure; transient registry / API errors stay advisory (exit 0)
+  // so a flaky network response doesn't block the cut.
+  _run("node", ["scripts/check-actions-currency.js"]);
+  _run("node", ["scripts/check-vendor-currency.js"]);
+  _ok("github actions + vendored bundles current");
+
   console.log("\nnext: node scripts/release.js smoke");
 }
 

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -295,6 +295,7 @@ var VALID_ALLOW_CLASSES = {
   "bare-json-parse": 1,
   "bare-split-on-quoted-header": 1,
   "console-direct": 1,
+  "deny-path-hardcoded-response": 1,
   "duplicate-regex": 1,
   "dynamic-regex": 1,
   "dynamic-require": 1,
@@ -313,6 +314,7 @@ var VALID_ALLOW_CLASSES = {
   "no-number-money-arithmetic": 1,
   "numeric-opt-Infinity": 1,
   "numeric-opt-no-bounds-check": 1,
+  "primitive-unreachable": 1,
   "process-exit": 1,
   "raw-byte-literal": 1,
   "raw-hash-compare": 1,
@@ -2356,6 +2358,16 @@ async function testNoDuplicateCodeBlocks() {
       files: ["lib/guard-filename.js:verifyExtractionPath", "lib/hal.js:resource", "lib/vault-aad.js:_canonicalize"],
       reason: "v0.13.13 — coincidental token shingle of the generic split-then-walk-segments idiom (`x.split(sep); for (...) { var seg = ...; if (...) throw/continue }`). guard-filename verifyExtractionPath walks path components refusing per-segment Windows-extraction hazards (reserved names / NTFS-ADS / trailing-dot); hal.js:resource builds a HAL resource by walking link/embedded keys; vault-aad.js:_canonicalize canonicalizes AAD key-value segments. Three unrelated domains (path safety / hypermedia link assembly / crypto AAD canonicalization) — no shared behaviour to extract; the only commonality is the universal split-and-loop control-flow shape.",
     },
+    {
+      mode:  "family-subset",
+      files: [
+        "lib/middleware/host-allowlist.js:create",
+        "lib/middleware/require-auth.js:create",
+        "lib/middleware/require-content-type.js:create",
+        "lib/middleware/require-methods.js:create",
+      ],
+      reason: "v0.14.6 — the shared shingle is the uniform deny-path denyResponse() call-site shape. The deny-response WRITER is already extracted to lib/middleware/deny-response.js; what repeats here is each create()'s ctx object literal ({ onDeny, problem, status, info, problemCode, problemTitle, problemDetail, contentType, body }). Each middleware passes a DIFFERENT status (405 / 415 / 421 / 401), problemCode, title, default body and headers — the literal IS the per-middleware configuration the consumer-facing onDeny / problemDetails convention drives. Consolidating further would mean a config table strictly less readable than the inline ctx, and the per-middleware values are exactly the divergence the dup detector can't see.",
+    },
     {
       mode:  "family-subset",
       files: [
@@ -10474,7 +10486,133 @@ function testSafeGuardHasMustComposeDetector() {
     unpaired);
 }
 
+// ---- Pattern: every `@primitive b.X.Y` doc block resolves to a real
+//               callable on the public surface (advertised-vs-actual
+//               reachability). A wiki page that documents an
+//               uncallable path is an operator-facing lie: an operator
+//               following the docs gets `undefined is not a function`.
+//
+// Two shapes this catches:
+//   - a wiring gap (the primitive's `create` exists but was never
+//     wired into index.js, so `b.middleware.requireBoundKey` was
+//     undefined);
+//   - a doc-path drop (`b.cra.conformityAssessment` where the real
+//     path is `b.cra.report.conformityAssessment`).
+//
+// Factory namespaces (the parent exposes `create`) document instance
+// methods on the create()-return value with namespace shorthand
+// (`b.auth.oauth.parseCallback` is reached via
+// `b.auth.oauth.create(...).parseCallback`). Those are NOT gaps, so a
+// parent that exposes `create` is skipped.
+function testPrimitiveReachability() {
+  // class: primitive-unreachable
+  var bSurface;
+  try { bSurface = require("../../index.js"); }
+  catch (_e) { check("primitive-reachability — index.js require", false); return; }
+
+  function resolve(dotted) {
+    var parts = dotted.split(".");
+    var cur = bSurface;
+    for (var i = 1; i < parts.length; i += 1) {
+      if (cur == null) return undefined;
+      cur = cur[parts[i]];
+    }
+    return cur;
+  }
+
+  // @primitive paths that legitimately don't resolve as a flat member
+  // (documented elsewhere / intentional). Keyed by dotted name.
+  var REACHABILITY_ALLOWLIST = {
+    // (none — every surfaced gap is fixed in-tree)
+  };
+
+  var libFiles = _libFiles();
+  var unreachable = [];
+  for (var i = 0; i < libFiles.length; i += 1) {
+    var rel = _relPath(libFiles[i]);
+    var src = fs.readFileSync(libFiles[i], "utf8");
+    var re = /@primitive\s+(b\.[A-Za-z0-9_.]+)/g;
+    var m;
+    while ((m = re.exec(src)) !== null) {
+      var name = m[1];
+      if (REACHABILITY_ALLOWLIST[name]) continue;
+      if (typeof resolve(name) !== "undefined") continue;
+      var parts = name.split(".");
+      var parentName = parts.slice(0, -1).join(".");
+      var parent = resolve(parentName);
+      // Flag only flat namespaces (object parent without a `create`
+      // factory). Factory-instance shorthands are skipped.
+      if (parent && typeof parent === "object" && typeof parent.create !== "function") {
+        unreachable.push({
+          file:    rel,
+          line:    1,
+          content: "@primitive " + name + " documents a b.* path that does not resolve (parent `" +
+                   parentName + "` is a flat namespace without this member). Wire it into the " +
+                   "namespace, or correct the @primitive/@signature path.",
+        });
+      }
+    }
+  }
+  _report("every @primitive b.X.Y doc block resolves to a callable on the public surface " +
+          "(advertised-vs-actual reachability; factory-instance shorthands excluded)",
+    unreachable);
+}
+
+// ---- Pattern: every access-refusal middleware routes its deny
+//               response through lib/middleware/deny-response.js so a
+//               consumer can override the body / Content-Type (emit
+//               RFC 9457 application/problem+json) via the uniform
+//               onDeny / problemDetails opts. A new deny-path
+//               middleware that hardcodes
+//               `res.writeHead(<4xx/5xx>, { "Content-Type": ... })`
+//               locks consumers out of the response shape — the
+//               integration-friction class that blocked downstream
+//               adoption (the rate-limit text/plain 429). ----
+function testDenyPathComposesDenyResponse() {
+  // class: deny-path-hardcoded-response
+  var MW_ROOT = path.resolve(LIB_ROOT, "middleware");
+  // NOT access-refusals: content-servers that 4xx when the
+  // .well-known resource isn't configured, and the CSP report-ingest
+  // machine endpoint. Their 4xx is not a user-facing access denial.
+  var NOT_DENY_PATH = {
+    "lib/middleware/assetlinks.js":       ".well-known content-server; 4xx = not-configured, not access-refusal",
+    "lib/middleware/security-txt.js":     ".well-known content-server; 4xx = not-configured, not access-refusal",
+    "lib/middleware/web-app-manifest.js": "manifest content-server; 4xx = not-configured, not access-refusal",
+    "lib/middleware/csp-report.js":       "CSP report-ingest machine endpoint; 4xx = malformed-report rejection on a browser-posting sink",
+    "lib/middleware/deny-response.js":    "the shared deny-response helper itself",
+  };
+  var denyStatusRe = new RegExp("writeHead\\(\\s*(?:4\\d\\d|5\\d\\d|requestHelpers\\.HTTP_STATUS\\." +
+    "(?:FORBIDDEN|UNAUTHORIZED|NOT_FOUND|BAD_REQUEST|METHOD_NOT_ALLOWED|UNSUPPORTED_MEDIA_TYPE|" +
+    "TOO_MANY_REQUESTS|UNAVAILABLE_FOR_LEGAL_REASONS|MISDIRECTED_REQUEST))");
+  var composesRe = /require\(\s*["']\.\/deny-response["']\s*\)/;
+  var files = fs.readdirSync(MW_ROOT).filter(function (f) { return f.endsWith(".js"); });
+  var violations = [];
+  for (var i = 0; i < files.length; i += 1) {
+    var rel = "lib/middleware/" + files[i];
+    if (NOT_DENY_PATH[rel]) continue;
+    var src = fs.readFileSync(path.join(MW_ROOT, files[i]), "utf8");
+    if (!denyStatusRe.test(src)) continue;       // doesn't write a deny status
+    if (composesRe.test(src)) continue;          // routes through the helper
+    var lines = src.split("\n");
+    var ln = 1;
+    for (var L = 0; L < lines.length; L += 1) {
+      if (denyStatusRe.test(lines[L])) { ln = L + 1; break; }
+    }
+    violations.push({
+      file:    rel,
+      line:    ln,
+      content: "access-refusal middleware writes a deny-status response without composing deny-response.js — " +
+               "route it through denyResponse() so consumers get onDeny / problemDetails (RFC 9457). If this " +
+               "is NOT an access-refusal (content-server / machine endpoint), add it to NOT_DENY_PATH with a reason.",
+    });
+  }
+  _report("every access-refusal middleware composes deny-response.js (onDeny / problemDetails override path)",
+    violations);
+}
+
 async function run() {
+  testPrimitiveReachability();
+  testDenyPathComposesDenyResponse();
   testNoOrphanAllowClass();
   testNoRawByteLiterals();
   testNoRawTimeLiterals();