@blamejs/blamejs-shop 0.3.7 → 0.3.9

package/lib/vendor/blamejs/lib/middleware/require-bound-key.js

@@ -51,6 +51,7 @@
 var defineClass = require("../framework-error").defineClass;
 var lazyRequire = require("../lazy-require");
 var validateOpts = require("../validate-opts");
+var denyResponse = require("./deny-response").denyResponse;
 
 var bCrypto = lazyRequire(function () { return require("../crypto"); });
 var audit  = lazyRequire(function () { return require("../audit"); });
@@ -98,6 +99,8 @@ function _timingSafeStringEqual(a, b) {
  *     errorMessage:            string,
  *     auditAction:             string,
  *     audit:                   object,
+ *     onDeny:                  function(req, res, info): void,  // own the refusal; info = { status, reason, ...metadata }
+ *     problemDetails:          boolean,   // default false — emit RFC 9457 application/problem+json instead of the default JSON envelope
  *   }
  *
  * @example
@@ -116,7 +119,7 @@ function create(opts) {
   validateOpts(opts, [
     "resolver", "requiredScopes", "getBoundField",
     "audit", "auditAction", "errorMessage",
-    "tolerateMissingPeerCert",
+    "tolerateMissingPeerCert", "onDeny", "problemDetails",
   ], "middleware.requireBoundKey");
 
   if (typeof opts.resolver !== "function") {
@@ -150,6 +153,8 @@ function create(opts) {
   // even when peerCertFingerprints is set on the registered key.
   // Production deployments leave this at default false.
   var tolerateMissingPeerCert = !!opts.tolerateMissingPeerCert;
+  var onDeny = typeof opts.onDeny === "function" ? opts.onDeny : null;
+  var problemMode = opts.problemDetails === true;
 
   function _emitAudit(outcome, metadata) {
     if (!auditOn) return;
@@ -162,30 +167,56 @@ function create(opts) {
     } catch (_e) { /* drop-silent */ }
   }
 
-  function _refuse(res, status, reason, metadata) {
+  // RFC 6750 §3 — the Bearer challenge carries an error code that
+  // matches the failure: 401 with no token presented omits the code
+  // entirely; an unknown / revoked token is `invalid_token`; a 403
+  // missing-scope is `insufficient_scope`; a malformed bound-field
+  // request is `invalid_request`. Server-side failures (500 / 503)
+  // are not authentication challenges, so they advertise the scheme
+  // without an (incorrect) auth-error code.
+  function _bearerChallenge(status, reason) {
+    if (status === 401) {
+      if (reason === "no-bearer-token") return 'Bearer realm="api"';
+      return 'Bearer realm="api", error="invalid_token"';
+    }
+    if (status === 403) return 'Bearer realm="api", error="insufficient_scope"';
+    if (status === 400) return 'Bearer realm="api", error="invalid_request"';   // HTTP 400
+    return 'Bearer realm="api"';
+  }
+
+  function _refuse(req, res, status, reason, metadata) {
     _emitAudit("denied", Object.assign({ reason: reason }, metadata || {}));
-    if (res.writableEnded || typeof res.writeHead !== "function") return;
-    res.writeHead(status, {
-      "Content-Type":     "application/json; charset=utf-8",
-      "WWW-Authenticate": 'Bearer realm="api", error="invalid_request"',
-      "Cache-Control":    "no-store",
+    denyResponse(req, res, {
+      onDeny:        onDeny,
+      problem:       problemMode,
+      status:        status,
+      info:          Object.assign({ status: status, reason: reason }, metadata || {}),
+      problemCode:   "bound-key-refused",
+      problemTitle:  errorMessage,
+      problemDetail: "API key authentication failed: " + reason + ".",
+      problemExt:    { reason: reason },
+      headers:       {
+        "WWW-Authenticate": _bearerChallenge(status, reason),
+        "Cache-Control":    "no-store",
+      },
+      contentType:   "application/json; charset=utf-8",
+      body:          JSON.stringify({ error: errorMessage, reason: reason }),
     });
-    res.end(JSON.stringify({ error: errorMessage, reason: reason }));
   }
 
   return async function requireBoundKeyMiddleware(req, res, next) {
     var apiKey = _parseBearer(req);
-    if (!apiKey) return _refuse(res, 401, "no-bearer-token", {});
+    if (!apiKey) return _refuse(req, res, 401, "no-bearer-token", {});
 
     var record;
     try { record = await resolver(apiKey); }
     catch (e) {
-      return _refuse(res, 503, "resolver-unavailable", {
+      return _refuse(req, res, 503, "resolver-unavailable", {
         error: (e && e.message) || String(e),
       });
     }
     if (!record || typeof record !== "object") {
-      return _refuse(res, 401, "key-unknown-or-revoked", {});
+      return _refuse(req, res, 401, "key-unknown-or-revoked", {});
     }
 
     // Required-scope check — operator-supplied requiredScopes must be
@@ -193,7 +224,7 @@ function create(opts) {
     var keyScopes = Array.isArray(record.scopes) ? record.scopes : [];
     for (var rsi = 0; rsi < requiredScopes.length; rsi++) {
       if (keyScopes.indexOf(requiredScopes[rsi]) === -1) {
-        return _refuse(res, 403, "missing-scope", {
+        return _refuse(req, res, 403, "missing-scope", {
           requiredScope: requiredScopes[rsi], keyId: record.id || null,
         });
       }
@@ -208,25 +239,25 @@ function create(opts) {
       var fieldName = registeredKeys[bfi];
       var getter = getBoundField[fieldName];
       if (!getter) {
-        return _refuse(res, 500, "bound-field-no-getter", {
+        return _refuse(req, res, 500, "bound-field-no-getter", {
           field: fieldName, keyId: record.id || null,
         });
       }
       var presented;
       try { presented = getter(req); }
       catch (e) {
-        return _refuse(res, 400, "bound-field-getter-threw", {                            // HTTP 400
+        return _refuse(req, res, 400, "bound-field-getter-threw", {                            // HTTP 400
           field: fieldName, error: (e && e.message) || String(e),
         });
       }
       if (typeof presented !== "string" || presented.length === 0) {
-        return _refuse(res, 400, "bound-field-missing", {                                 // HTTP 400
+        return _refuse(req, res, 400, "bound-field-missing", {                                 // HTTP 400
           field: fieldName, keyId: record.id || null,
         });
       }
       var expected = String(registered[fieldName]);
       if (!_timingSafeStringEqual(presented, expected)) {
-        return _refuse(res, 403, "bound-field-mismatch", {
+        return _refuse(req, res, 403, "bound-field-mismatch", {
           field: fieldName, keyId: record.id || null,
         });
       }
@@ -252,7 +283,7 @@ function create(opts) {
           // Audited bypass for dev fixtures.
           _emitAudit("denied", { reason: "peer-cert-bypass-tolerated", keyId: record.id });
         } else {
-          return _refuse(res, 401, "peer-cert-required", {
+          return _refuse(req, res, 401, "peer-cert-required", {
             keyId: record.id || null,
           });
         }
@@ -262,7 +293,7 @@ function create(opts) {
         // because it does the same constant-time hex/colon comparison
         // we want for an allow-list. A future refactor can rename to
         // isCertFingerprintInSet — semantically identical.
-        return _refuse(res, 403, "peer-cert-not-pinned", {
+        return _refuse(req, res, 403, "peer-cert-not-pinned", {
           fingerprint: fpColon, keyId: record.id || null,
         });
       }

package/lib/vendor/blamejs/lib/middleware/require-content-type.js

@@ -18,6 +18,7 @@
  */
 
 var lazyRequire = require("../lazy-require");
+var denyResponse = require("./deny-response").denyResponse;
 var { defineClass } = require("../framework-error");
 
 var RequireContentTypeError = defineClass("RequireContentTypeError", { alwaysPermanent: true });
@@ -58,8 +59,10 @@ function _normalizeAllowed(types) {
  *
  * @opts
  *   {
- *     methods: string[],   // override default ["POST", "PUT", "PATCH"]
- *     audit:   boolean,    // default true
+ *     methods:        string[],   // override default ["POST", "PUT", "PATCH"]
+ *     audit:          boolean,    // default true
+ *     onDeny:         function(req, res, info): void,  // own the 415; info = { status, reason, contentType, accepted }
+ *     problemDetails: boolean,    // default false — emit RFC 9457 application/problem+json instead of text/plain
  *   }
  *
  * @example
@@ -82,6 +85,8 @@ function create(allowed, opts) {
                   ? opts.methods.map(function (m) { return m.toUpperCase(); })
                   : DEFAULT_BODY_METHODS.slice();
   var auditOn = opts.audit !== false;
+  var onDeny = typeof opts.onDeny === "function" ? opts.onDeny : null;
+  var problemMode = opts.problemDetails === true;
 
   return function requireContentTypeMiddleware(req, res, next) {
     var m = (req.method || "").toUpperCase();
@@ -90,13 +95,19 @@ function create(allowed, opts) {
     var bare = (typeof ct === "string" ? ct.split(";")[0].trim().toLowerCase() : "");
     if (bare.length > 0 && normalized.indexOf(bare) !== -1) return next();
     if (!res.headersSent) {
-      var body = "Unsupported Media Type";
-      res.writeHead(415, {                                                       // HTTP 415 status
-        "Accept":         normalized.join(", "),
-        "Content-Type":   "text/plain; charset=utf-8",
-        "Content-Length": Buffer.byteLength(body),
+      denyResponse(req, res, {
+        onDeny:        onDeny,
+        problem:       problemMode,
+        status:        415,
+        info:          { status: 415, reason: "unsupported-media-type",
+          contentType: bare || null, accepted: normalized },
+        problemCode:   "unsupported-media-type",
+        problemTitle:  "Unsupported Media Type",
+        problemDetail: "The request Content-Type is not accepted on this resource.",
+        headers:       { "Accept": normalized.join(", ") },
+        contentType:   "text/plain; charset=utf-8",
+        body:          "Unsupported Media Type",
       });
-      res.end(body);
     }
     if (auditOn) {
       try {

package/lib/vendor/blamejs/lib/middleware/require-methods.js

@@ -16,6 +16,7 @@
  */
 
 var lazyRequire = require("../lazy-require");
+var denyResponse = require("./deny-response").denyResponse;
 var { defineClass } = require("../framework-error");
 
 var RequireMethodsError = defineClass("RequireMethodsError", { alwaysPermanent: true });
@@ -38,7 +39,9 @@ var observability = lazyRequire(function () { return require("../observability")
  *
  * @opts
  *   {
- *     audit: boolean,   // default true
+ *     audit:          boolean,   // default true
+ *     onDeny:         function(req, res, info): void,  // own the 405; info = { status, reason, method, allowed }
+ *     problemDetails: boolean,   // default false — emit RFC 9457 application/problem+json instead of text/plain
  *   }
  *
  * @example
@@ -69,18 +72,25 @@ function create(allowed, opts) {
   var allowHeader = normalized.join(", ");
   opts = opts || {};
   var auditOn = opts.audit !== false;
+  var onDeny = typeof opts.onDeny === "function" ? opts.onDeny : null;
+  var problemMode = opts.problemDetails === true;
 
   return function requireMethodsMiddleware(req, res, next) {
     var m = (req.method || "").toUpperCase();
     if (normalized.indexOf(m) !== -1) return next();
     if (!res.headersSent) {
-      var body = "Method Not Allowed";
-      res.writeHead(405, {                                                       // HTTP 405 status
-        "Allow":          allowHeader,
-        "Content-Type":   "text/plain; charset=utf-8",
-        "Content-Length": Buffer.byteLength(body),
+      denyResponse(req, res, {
+        onDeny:        onDeny,
+        problem:       problemMode,
+        status:        405,
+        info:          { status: 405, reason: "method-not-allowed", method: m, allowed: normalized },
+        problemCode:   "method-not-allowed",
+        problemTitle:  "Method Not Allowed",
+        problemDetail: "The " + m + " method is not allowed on this resource.",
+        headers:       { "Allow": allowHeader },
+        contentType:   "text/plain; charset=utf-8",
+        body:          "Method Not Allowed",
       });
-      res.end(body);
     }
     if (auditOn) {
       try {

package/lib/vendor/blamejs/lib/middleware/require-mtls.js

@@ -48,6 +48,7 @@
 var defineClass = require("../framework-error").defineClass;
 var lazyRequire = require("../lazy-require");
 var validateOpts = require("../validate-opts");
+var denyResponse = require("./deny-response").denyResponse;
 
 var bCrypto = lazyRequire(function () { return require("../crypto"); });
 var audit  = lazyRequire(function () { return require("../audit"); });
@@ -84,6 +85,8 @@ function _normalizeFingerprintEntry(entry) {
  *     fingerprintAllowList: string[],
  *     denyList:             string[],
  *     onAuthenticated:      function(req, res, next): void,
+ *     onDeny:               function(req, res, info): void,  // own the refusal (mirrors onAuthenticated); info = { status, reason, ...metadata }
+ *     problemDetails:       boolean,        // default false — emit RFC 9457 application/problem+json instead of the default JSON envelope
  *     auditAction:          string,
  *     errorMessage:         string,
  *     audit:                object,
@@ -100,7 +103,7 @@ function create(opts) {
   opts = opts || {};
   validateOpts(opts, [
     "fingerprintAllowList", "denyList",
-    "onAuthenticated", "audit",
+    "onAuthenticated", "onDeny", "problemDetails", "audit",
     "auditAction", "errorMessage",
   ], "middleware.requireMtls");
 
@@ -109,6 +112,8 @@ function create(opts) {
   var denyList = Array.isArray(opts.denyList)
     ? opts.denyList.map(_normalizeFingerprintEntry) : [];
   var onAuthenticated = typeof opts.onAuthenticated === "function" ? opts.onAuthenticated : null;
+  var onDeny = typeof opts.onDeny === "function" ? opts.onDeny : null;
+  var problemMode = opts.problemDetails === true;
   var auditOn  = opts.audit !== false;
   var actionBase = typeof opts.auditAction === "string" && opts.auditAction.length > 0
     ? opts.auditAction : "mtls.required";
@@ -126,16 +131,24 @@ function create(opts) {
     } catch (_e) { /* drop-silent — audit is best-effort, never blocks the request */ }
   }
 
-  function _refuse(res, reason, metadata) {
+  function _refuse(req, res, reason, metadata) {
     _emit("denied", Object.assign({ reason: reason }, metadata || {}));
-    if (typeof res.writeHead === "function") {
-      res.writeHead(401, {
-        "Content-Type":     "application/json; charset=utf-8",
+    denyResponse(req, res, {
+      onDeny:        onDeny,
+      problem:       problemMode,
+      status:        401,
+      info:          Object.assign({ status: 401, reason: reason }, metadata || {}),
+      problemCode:   "client-certificate-required",
+      problemTitle:  "Unauthorized",
+      problemDetail: errorMessage,
+      problemExt:    { reason: reason },
+      headers:       {
         "WWW-Authenticate": "Mutual",
         "Cache-Control":    "no-store",
-      });
-      res.end(JSON.stringify({ error: errorMessage, reason: reason }));
-    }
+      },
+      contentType:   "application/json; charset=utf-8",
+      body:          JSON.stringify({ error: errorMessage, reason: reason }),
+    });
   }
 
   return function requireMtlsMiddleware(req, res, next) {
@@ -158,10 +171,10 @@ function create(opts) {
 
     if (!authorized) {
       var authzError = (sock && sock.authorizationError) || "no-peer-cert";
-      return _refuse(res, "tls-unauthorized", { authorizationError: String(authzError) });
+      return _refuse(req, res, "tls-unauthorized", { authorizationError: String(authzError) });
     }
     if (!peerCert || !peerCert.raw) {
-      return _refuse(res, "no-peer-cert", {});
+      return _refuse(req, res, "no-peer-cert", {});
     }
 
     // Compute fingerprint via the framework's SHA3-512 helper. Buffer
@@ -171,17 +184,17 @@ function create(opts) {
     try {
       fp = bCrypto().hashCertFingerprint(peerCert.raw);
     } catch (e) {
-      return _refuse(res, "fingerprint-failed", { error: (e && e.message) || String(e) });
+      return _refuse(req, res, "fingerprint-failed", { error: (e && e.message) || String(e) });
     }
 
     if (denyList.length > 0 && bCrypto().isCertRevoked(peerCert.raw, denyList)) {
-      return _refuse(res, "fingerprint-on-deny-list", {
+      return _refuse(req, res, "fingerprint-on-deny-list", {
         fingerprint: fp.colon,
         subject:     (peerCert.subject && peerCert.subject.CN) || null,
       });
     }
     if (allowList && allowList.length > 0 && !bCrypto().isCertRevoked(peerCert.raw, allowList)) {
-      return _refuse(res, "fingerprint-not-allowed", {
+      return _refuse(req, res, "fingerprint-not-allowed", {
         fingerprint: fp.colon,
         subject:     (peerCert.subject && peerCert.subject.CN) || null,
       });
@@ -199,7 +212,7 @@ function create(opts) {
     if (onAuthenticated) {
       try { return onAuthenticated(req, res, next); }
       catch (e) {
-        return _refuse(res, "on-authenticated-threw", { error: (e && e.message) || String(e) });
+        return _refuse(req, res, "on-authenticated-threw", { error: (e && e.message) || String(e) });
       }
     }
     return next();

package/lib/vendor/blamejs/lib/network.js

@@ -108,8 +108,8 @@ function _socketDefaults() {
 }
 
 /**
- * @primitive b.network.applyToSocket
- * @signature b.network.applyToSocket(socket)
+ * @primitive b.network.socket.applyToSocket
+ * @signature b.network.socket.applyToSocket(socket)
  * @since     0.7.68
  * @related   b.network.bootFromEnv, b.network.snapshot
  *
@@ -124,7 +124,7 @@ function _socketDefaults() {
  * @example
  *   var net = require("net");
  *   var s   = new net.Socket();
- *   var ret = b.network.applyToSocket(s);
+ *   var ret = b.network.socket.applyToSocket(s);
  *   ret === s;
  *   // → true
  *   s.destroy();
@@ -164,7 +164,7 @@ var ntpFacade = {
  * @primitive b.network.bootFromEnv
  * @signature b.network.bootFromEnv(opts)
  * @since     0.7.68
- * @related   b.network.snapshot, b.network.applyToSocket
+ * @related   b.network.snapshot, b.network.socket.applyToSocket
  *
  * Read `BLAMEJS_*` environment variables once and apply the union to
  * the live network facade. Recognised keys cover NTP servers /

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.14.5",
+  "version": "0.14.6",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.14.6.json

@@ -0,0 +1,60 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.14.6",
+  "date": "2026-05-30",
+  "headline": "Access-refusal middleware can return RFC 9457 problem+json or a custom response, and several documented-but-uncallable APIs are now reachable",
+  "summary": "Every access-refusal middleware — the auth gates (bearer, DPoP, mTLS, AAL, bound-key), CSRF, CORS, rate-limit, bot-guard, age-gate, the host and network allowlists, and the method and content-type gates — now accepts two uniform options: `problemDetails: true` returns an RFC 9457 `application/problem+json` body, and `onDeny(req, res, info)` hands the response to the caller. With neither set the refusal is byte-for-byte what it was, so this is a drop-in change that lets a service standardize one error envelope across its API instead of working around each middleware's hardcoded body. Alongside that: `b.middleware.requireBoundKey` is now exported (it was documented and tested but never wired into the middleware surface), `b.middleware.bearerAuth` accepts `requiredScopes` (previously rejected at construction, which made its scope-enforcement path unreachable), API-key refusals send the RFC 6750 challenge code that matches the failure, two documented call paths that named a missing namespace segment are corrected, and the release flow now flags stale GitHub Actions and vendored bundles — with a ready-to-paste pin — before a dependency PR is needed.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "Uniform `onDeny` and `problemDetails` options on every access-refusal middleware",
+          "body": "Each request-lifecycle middleware that refuses a request now takes `problemDetails: true` to emit an RFC 9457 `application/problem+json` body (composing `b.problemDetails`) and `onDeny(req, res, info)` to take over the response entirely; `info` carries the status, a machine reason, and the middleware-specific fields. The deny-path response headers (`Allow`, `WWW-Authenticate`, `Retry-After`, `Accept`) survive every mode. When neither option is set the response is unchanged. Covers `requireAuth`, `requireAal`, `requireMethods`, `requireContentType`, `requireMtls`, `requireBoundKey`, `bearerAuth`, `dpop`, `csrfProtect`, `fetchMetadata`, `botGuard`, `ageGate`, `hostAllowlist`, `networkAllowlist`, `cors`, `rateLimit`, and `dailyByteQuota` (whose existing `onExceeded` keeps working as an alias of `onDeny`)."
+        }
+      ]
+    },
+    {
+      "heading": "Fixed",
+      "items": [
+        {
+          "title": "`b.middleware.requireBoundKey` is now callable",
+          "body": "The Bearer-API-key middleware was documented (with examples and tests) but never exported on `b.middleware`, so `b.middleware.requireBoundKey(...)` threw `undefined is not a function`. It is now wired into the middleware surface."
+        },
+        {
+          "title": "`b.middleware.bearerAuth` accepts `requiredScopes`",
+          "body": "The RFC 6750 scope-enforcement path read `opts.requiredScopes`, but the option was rejected at construction with `unknown option`, making the 403 `insufficient_scope` behavior unreachable. `requiredScopes` is now an accepted option."
+        },
+        {
+          "title": "RFC 6750 challenge codes on API-key refusals",
+          "body": "`b.middleware.requireBoundKey` now sends the `WWW-Authenticate` error code that matches the failure: `insufficient_scope` on a 403 missing-scope, `invalid_token` on an unknown or revoked token, and no error code on a 401 that presented no credentials (RFC 6750 §3). It previously sent `invalid_request` for every refusal."
+        },
+        {
+          "title": "Corrected two documented call paths",
+          "body": "The compliance and network references named a path that dropped a namespace segment: the conformity-assessment scaffold is at `b.cra.report.conformityAssessment` (not `b.cra.conformityAssessment`), and the per-socket tuning helper is at `b.network.socket.applyToSocket` (not `b.network.applyToSocket`). The documented signatures now match the callable paths."
+        },
+        {
+          "title": "GitHub Actions pins refreshed",
+          "body": "`github/codeql-action` 4.35.5 to 4.36.0, and `docker/login-action`, `docker/setup-buildx-action`, and `docker/setup-qemu-action` to their latest releases."
+        }
+      ]
+    },
+    {
+      "heading": "Detectors",
+      "items": [
+        {
+          "title": "`@primitive` reachability gate",
+          "body": "A new check resolves every documented `b.X.Y` primitive against the actual public surface and fails the build when a documented path is not callable (factory-instance shorthands excluded). This is the gate that would have caught the `requireBoundKey` and call-path issues above."
+        },
+        {
+          "title": "Deny-path composition gate",
+          "body": "A new check requires every access-refusal middleware to route its refusal through the shared deny-response writer, so a future middleware cannot reintroduce a hardcoded body that locks callers out of `onDeny` / `problemDetails`."
+        },
+        {
+          "title": "Actions and vendor currency in the release flow",
+          "body": "The release flow now fails the cut when a SHA-pinned GitHub Action or a vendored bundle is behind its latest upstream release. The actions report prints a ready-to-paste `owner/repo@<sha>  # vX.Y.Z` pin and every file and line that uses it, so the bump is copy-paste rather than an after-the-fact dependency PR. Transient registry or API errors stay advisory so a flaky network response does not block an unrelated release."
+        }
+      ]
+    }
+  ]
+}