@blamejs/blamejs-shop 0.3.7 → 0.3.9

package/lib/vendor/blamejs/scripts/check-actions-currency.js

@@ -0,0 +1,256 @@
+"use strict";
+/**
+ * GitHub-Actions-currency gate — the sibling of
+ * `scripts/check-vendor-currency.js` for the CI/CD supply chain.
+ *
+ * Walks every `.github/workflows/*.yml`, reads each SHA-pinned
+ * `uses: owner/repo[/subpath]@<sha>  # vX.Y.Z` reference, and asserts
+ * the pinned version (from the trailing comment the pinact discipline
+ * requires) matches the latest upstream release. A stale action
+ * becomes a release blocker HERE — caught in the pre-merge gate suite
+ * — instead of being surfaced after-the-fact by a Dependabot PR.
+ *
+ * Run locally:
+ *   node scripts/check-actions-currency.js
+ *   node scripts/check-actions-currency.js --json     // structured output
+ *   node scripts/check-actions-currency.js --warn     // exit 0, print only
+ *
+ * Run in CI: the workflow passes GITHUB_TOKEN in the environment so the
+ * GitHub API gives the authenticated 5000/hour budget instead of the
+ * 60/hour unauthenticated per-IP limit. `stale` fails the gate;
+ * transient `api-error` results are advisory unless
+ * BLAMEJS_ACTIONS_CURRENCY_STRICT=1 converts them into hard fails too.
+ *
+ * Actions deliberately pinned to an older major (a new major the repo
+ * has not adopted) carry a SPECIAL_MAP entry pinning the expected
+ * major so the gate doesn't fight an intentional hold.
+ */
+
+var fs    = require("fs");
+var path  = require("path");
+var https = require("https");
+
+var WORKFLOWS_DIR = path.join(__dirname, "..", ".github", "workflows");
+
+var WARN_ONLY  = process.argv.indexOf("--warn") !== -1;
+var JSON_OUT   = process.argv.indexOf("--json") !== -1;
+var TIMEOUT_MS = 10000;
+
+// Per-action overrides. Keyed by "owner/repo".
+//   { type: "hold-major", major: N, reason: "..." } — only flag stale
+//        WITHIN the pinned major; a newer major is an intentional hold.
+//   { type: "skip", reason: "..." }                 — never flag.
+var SPECIAL_MAP = {
+  // (none — every pinned action tracks upstream latest)
+};
+
+function _githubGet(apiPath) {
+  return new Promise(function (resolve, reject) {
+    var headers = {
+      "User-Agent": "blamejs-actions-currency/1",
+      "Accept":     "application/vnd.github+json",
+    };
+    // Authenticated requests get the 5000/hour budget. Both env names
+    // are accepted (GITHUB_TOKEN in Actions, GH_TOKEN for local gh).
+    var token = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
+    if (token) headers.Authorization = "Bearer " + token;
+    var req = https.get("https://api.github.com" + apiPath, { timeout: TIMEOUT_MS, headers: headers }, function (res) {
+      var chunks = [];
+      res.on("data", function (c) { chunks.push(c); });
+      res.on("end", function () {
+        if (res.statusCode !== 200) {
+          return reject(new Error("github " + apiPath + " status " + res.statusCode));
+        }
+        try { resolve(JSON.parse(Buffer.concat(chunks).toString("utf8"))); }
+        catch (e) { reject(e); }
+      });
+    });
+    req.on("timeout", function () { req.destroy(new Error("github " + apiPath + " timed out after " + TIMEOUT_MS + "ms")); });
+    req.on("error", reject);
+  });
+}
+
+async function _resolveSha(ownerRepo, ref) {
+  // Resolve a tag to the COMMIT sha it points at — exactly what the
+  // pinact discipline pins (`owner/repo@<commit-sha>  # tag`). The
+  // commits endpoint dereferences annotated tags to their commit.
+  var c = await _githubGet("/repos/" + ownerRepo + "/commits/" + encodeURIComponent(ref));
+  if (!c || typeof c.sha !== "string") throw new Error("could not resolve sha for " + ownerRepo + "@" + ref);
+  return c.sha;
+}
+
+async function _latestVersion(ownerRepo) {
+  // Prefer the published "latest" release tag; fall back to the
+  // highest semver tag for actions that ship tags without GitHub
+  // Releases (e.g. ludeeus/action-shellcheck). Returns { tag, sha }
+  // so the report can hand back a ready-to-paste pin line.
+  var tag = null;
+  try {
+    var rel = await _githubGet("/repos/" + ownerRepo + "/releases/latest");
+    // Only trust the release tag when it is semver-shaped. Some repos
+    // (github/codeql-action) publish a non-semver bundle tag as their
+    // "latest release" (codeql-bundle-vX.Y.Z) while the ACTION is
+    // versioned on separate vN.N.N tags — fall through to tags then.
+    if (rel && typeof rel.tag_name === "string" && _semverParse(rel.tag_name)) tag = rel.tag_name;
+  } catch (_e) { /* fall through to tags */ }
+  if (!tag) {
+    var tags = await _githubGet("/repos/" + ownerRepo + "/tags?per_page=100");
+    if (!Array.isArray(tags) || tags.length === 0) {
+      throw new Error("no releases or tags for " + ownerRepo);
+    }
+    var best = null;
+    for (var i = 0; i < tags.length; i++) {
+      var p = _semverParse(tags[i].name);
+      if (p && (!best || _semverCompare(p, best.parsed) > 0)) {
+        best = { name: tags[i].name, parsed: p };
+      }
+    }
+    if (!best) throw new Error("no semver-shaped tag for " + ownerRepo);
+    tag = best.name;
+  }
+  return { tag: tag, sha: await _resolveSha(ownerRepo, tag) };
+}
+
+function _semverParse(v) {
+  // Accept partial tags (v4 / v4.1) by treating missing segments as 0.
+  var m = String(v).match(/^v?(\d+)(?:\.(\d+))?(?:\.(\d+))?/);
+  if (!m) return null;
+  return [parseInt(m[1], 10), parseInt(m[2] || "0", 10), parseInt(m[3] || "0", 10)];
+}
+
+function _semverCompare(a, b) {
+  if (!a || !b) return 0;
+  for (var i = 0; i < 3; i++) {
+    if (a[i] > b[i]) return  1;
+    if (a[i] < b[i]) return -1;
+  }
+  return 0;
+}
+
+// Collect distinct SHA-pinned actions across every workflow file.
+// Returns { "owner/repo": { version, refs: [{ file, line, subpath }] } }.
+function _collectPinnedActions() {
+  var out = {};
+  var files = fs.readdirSync(WORKFLOWS_DIR).filter(function (f) {
+    return f.endsWith(".yml") || f.endsWith(".yaml");
+  });
+  // `uses: owner/repo[/subpath]@<40-hex-sha>  # vX.Y[.Z]`
+  var re = /uses:\s*([A-Za-z0-9._-]+\/[A-Za-z0-9._-]+)(\/[^@\s]+)?@([0-9a-f]{40})\s*#\s*v?(\d+(?:\.\d+){0,2})/;
+  for (var f = 0; f < files.length; f++) {
+    var rel = ".github/workflows/" + files[f];
+    var lines = fs.readFileSync(path.join(WORKFLOWS_DIR, files[f]), "utf8").split("\n");
+    for (var L = 0; L < lines.length; L++) {
+      var m = lines[L].match(re);
+      if (!m) continue;
+      var ownerRepo = m[1];
+      var subpath   = m[2] || "";
+      var version   = m[4];
+      if (!out[ownerRepo]) out[ownerRepo] = { version: version, refs: [] };
+      out[ownerRepo].refs.push({ file: rel, line: L + 1, subpath: subpath });
+      // If the same repo is pinned at two different versions across
+      // files, record the lowest so a partial bump still flags.
+      if (_semverCompare(_semverParse(version), _semverParse(out[ownerRepo].version)) < 0) {
+        out[ownerRepo].version = version;
+      }
+    }
+  }
+  return out;
+}
+
+async function _checkOne(ownerRepo, entry) {
+  var special = SPECIAL_MAP[ownerRepo];
+  if (special && special.type === "skip") {
+    return { action: ownerRepo, status: "skipped", reason: special.reason, pinned: entry.version };
+  }
+  var pinned = _semverParse(entry.version);
+  try {
+    var info = await _latestVersion(ownerRepo);
+    var latest = _semverParse(info.tag);
+    var cmp = _semverCompare(pinned, latest);
+    var status = cmp >= 0 ? "current" : "stale";
+    if (special && special.type === "hold-major" && latest && latest[0] > special.major) {
+      // A newer major exists but the repo intentionally holds an
+      // older major — only flag stale WITHIN the held major.
+      status = "current";
+    }
+    return {
+      action:    ownerRepo,
+      pinned:    entry.version,
+      latest:    info.tag,
+      latestSha: info.sha,
+      status:    status,
+      refs:      entry.refs,
+    };
+  } catch (e) {
+    return {
+      action: ownerRepo,
+      pinned: entry.version,
+      status: "api-error",
+      error:  (e && e.message) || String(e),
+      refs:   entry.refs,
+    };
+  }
+}
+
+async function main() {
+  var pinned = _collectPinnedActions();
+  var actions = Object.keys(pinned).sort();
+  var results = [];
+  // Sequential + polite — the action count is small and serial GETs
+  // keep us well inside the API budget on shared CI IPs.
+  for (var i = 0; i < actions.length; i++) {
+    results.push(await _checkOne(actions[i], pinned[actions[i]]));
+  }
+
+  if (JSON_OUT) {
+    process.stdout.write(JSON.stringify({ results: results }, null, 2) + "\n");
+  } else {
+    process.stdout.write("[actions-currency] " + actions.length + " SHA-pinned action(s) inspected:\n");
+    for (var j = 0; j < results.length; j++) {
+      var r = results[j];
+      var label = r.status === "current"   ? "OK"
+                : r.status === "stale"     ? "STALE"
+                : r.status === "api-error" ? "ERR"
+                : r.status === "skipped"   ? "skip"
+                :                            r.status;
+      var line = "  [" + label + "] " + r.action + "  " + r.pinned;
+      if (r.latest) line += " -> " + r.latest;
+      if (r.reason) line += "  (" + r.reason + ")";
+      if (r.error)  line += "  (api: " + r.error + ")";
+      process.stdout.write(line + "\n");
+      // For stale entries, print a ready-to-paste pin line + every
+      // file:line that needs the bump, so updating is copy-paste.
+      if (r.status === "stale" && r.latestSha) {
+        process.stdout.write("        pin:  " + r.action + "@" + r.latestSha + "  # " + r.latest + "\n");
+        for (var rf = 0; rf < (r.refs || []).length; rf++) {
+          process.stdout.write("        used: " + r.refs[rf].file + ":" + r.refs[rf].line + "\n");
+        }
+      }
+    }
+  }
+
+  var stale   = results.filter(function (r) { return r.status === "stale"; });
+  var errored = results.filter(function (r) { return r.status === "api-error"; });
+
+  if (WARN_ONLY) {
+    if (stale.length || errored.length) {
+      process.stdout.write("[actions-currency] --warn: " + stale.length + " stale, " +
+        errored.length + " errored — exit 0 anyway\n");
+    }
+    process.exit(0);
+  }
+
+  var strictErrors = process.env.BLAMEJS_ACTIONS_CURRENCY_STRICT === "1";
+  if (stale.length > 0 || (strictErrors && errored.length > 0)) {
+    process.stdout.write("[actions-currency] FAIL — " + stale.length + " stale, " +
+      errored.length + " api-error(s). Bump the pinned SHA + version comment to the latest release.\n");
+    process.exit(1);
+  }
+  process.stdout.write("[actions-currency] OK — every pinned action matches the latest upstream release\n");
+  process.exit(0);
+}
+
+main().catch(function (e) {
+  process.stderr.write("[actions-currency] script crashed: " + (e && e.stack || e) + "\n");
+  process.exit(2);
+});

package/lib/vendor/blamejs/scripts/release.js

@@ -258,6 +258,17 @@ function cmdPrepare(opts) {
   _run("node", ["scripts/validate-source-comment-blocks.js"]);
   _ok("eslint + codebase-patterns + source-comment-blocks clean");
 
+  _section("supply-chain currency");
+  // A stale SHA-pinned GitHub Action or vendored bundle becomes a
+  // release blocker HERE — with a ready-to-paste pin line in the
+  // actions report — instead of an after-the-fact Dependabot PR.
+  // Each script treats only an actually-newer upstream version as a
+  // failure; transient registry / API errors stay advisory (exit 0)
+  // so a flaky network response doesn't block the cut.
+  _run("node", ["scripts/check-actions-currency.js"]);
+  _run("node", ["scripts/check-vendor-currency.js"]);
+  _ok("github actions + vendored bundles current");
+
   console.log("\nnext: node scripts/release.js smoke");
 }
 

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -295,6 +295,7 @@ var VALID_ALLOW_CLASSES = {
   "bare-json-parse": 1,
   "bare-split-on-quoted-header": 1,
   "console-direct": 1,
+  "deny-path-hardcoded-response": 1,
   "duplicate-regex": 1,
   "dynamic-regex": 1,
   "dynamic-require": 1,
@@ -313,6 +314,7 @@ var VALID_ALLOW_CLASSES = {
   "no-number-money-arithmetic": 1,
   "numeric-opt-Infinity": 1,
   "numeric-opt-no-bounds-check": 1,
+  "primitive-unreachable": 1,
   "process-exit": 1,
   "raw-byte-literal": 1,
   "raw-hash-compare": 1,
@@ -2356,6 +2358,16 @@ async function testNoDuplicateCodeBlocks() {
       files: ["lib/guard-filename.js:verifyExtractionPath", "lib/hal.js:resource", "lib/vault-aad.js:_canonicalize"],
       reason: "v0.13.13 — coincidental token shingle of the generic split-then-walk-segments idiom (`x.split(sep); for (...) { var seg = ...; if (...) throw/continue }`). guard-filename verifyExtractionPath walks path components refusing per-segment Windows-extraction hazards (reserved names / NTFS-ADS / trailing-dot); hal.js:resource builds a HAL resource by walking link/embedded keys; vault-aad.js:_canonicalize canonicalizes AAD key-value segments. Three unrelated domains (path safety / hypermedia link assembly / crypto AAD canonicalization) — no shared behaviour to extract; the only commonality is the universal split-and-loop control-flow shape.",
     },
+    {
+      mode:  "family-subset",
+      files: [
+        "lib/middleware/host-allowlist.js:create",
+        "lib/middleware/require-auth.js:create",
+        "lib/middleware/require-content-type.js:create",
+        "lib/middleware/require-methods.js:create",
+      ],
+      reason: "v0.14.6 — the shared shingle is the uniform deny-path denyResponse() call-site shape. The deny-response WRITER is already extracted to lib/middleware/deny-response.js; what repeats here is each create()'s ctx object literal ({ onDeny, problem, status, info, problemCode, problemTitle, problemDetail, contentType, body }). Each middleware passes a DIFFERENT status (405 / 415 / 421 / 401), problemCode, title, default body and headers — the literal IS the per-middleware configuration the consumer-facing onDeny / problemDetails convention drives. Consolidating further would mean a config table strictly less readable than the inline ctx, and the per-middleware values are exactly the divergence the dup detector can't see.",
+    },
     {
       mode:  "family-subset",
       files: [
@@ -10474,7 +10486,133 @@ function testSafeGuardHasMustComposeDetector() {
     unpaired);
 }
 
+// ---- Pattern: every `@primitive b.X.Y` doc block resolves to a real
+//               callable on the public surface (advertised-vs-actual
+//               reachability). A wiki page that documents an
+//               uncallable path is an operator-facing lie: an operator
+//               following the docs gets `undefined is not a function`.
+//
+// Two shapes this catches:
+//   - a wiring gap (the primitive's `create` exists but was never
+//     wired into index.js, so `b.middleware.requireBoundKey` was
+//     undefined);
+//   - a doc-path drop (`b.cra.conformityAssessment` where the real
+//     path is `b.cra.report.conformityAssessment`).
+//
+// Factory namespaces (the parent exposes `create`) document instance
+// methods on the create()-return value with namespace shorthand
+// (`b.auth.oauth.parseCallback` is reached via
+// `b.auth.oauth.create(...).parseCallback`). Those are NOT gaps, so a
+// parent that exposes `create` is skipped.
+function testPrimitiveReachability() {
+  // class: primitive-unreachable
+  var bSurface;
+  try { bSurface = require("../../index.js"); }
+  catch (_e) { check("primitive-reachability — index.js require", false); return; }
+
+  function resolve(dotted) {
+    var parts = dotted.split(".");
+    var cur = bSurface;
+    for (var i = 1; i < parts.length; i += 1) {
+      if (cur == null) return undefined;
+      cur = cur[parts[i]];
+    }
+    return cur;
+  }
+
+  // @primitive paths that legitimately don't resolve as a flat member
+  // (documented elsewhere / intentional). Keyed by dotted name.
+  var REACHABILITY_ALLOWLIST = {
+    // (none — every surfaced gap is fixed in-tree)
+  };
+
+  var libFiles = _libFiles();
+  var unreachable = [];
+  for (var i = 0; i < libFiles.length; i += 1) {
+    var rel = _relPath(libFiles[i]);
+    var src = fs.readFileSync(libFiles[i], "utf8");
+    var re = /@primitive\s+(b\.[A-Za-z0-9_.]+)/g;
+    var m;
+    while ((m = re.exec(src)) !== null) {
+      var name = m[1];
+      if (REACHABILITY_ALLOWLIST[name]) continue;
+      if (typeof resolve(name) !== "undefined") continue;
+      var parts = name.split(".");
+      var parentName = parts.slice(0, -1).join(".");
+      var parent = resolve(parentName);
+      // Flag only flat namespaces (object parent without a `create`
+      // factory). Factory-instance shorthands are skipped.
+      if (parent && typeof parent === "object" && typeof parent.create !== "function") {
+        unreachable.push({
+          file:    rel,
+          line:    1,
+          content: "@primitive " + name + " documents a b.* path that does not resolve (parent `" +
+                   parentName + "` is a flat namespace without this member). Wire it into the " +
+                   "namespace, or correct the @primitive/@signature path.",
+        });
+      }
+    }
+  }
+  _report("every @primitive b.X.Y doc block resolves to a callable on the public surface " +
+          "(advertised-vs-actual reachability; factory-instance shorthands excluded)",
+    unreachable);
+}
+
+// ---- Pattern: every access-refusal middleware routes its deny
+//               response through lib/middleware/deny-response.js so a
+//               consumer can override the body / Content-Type (emit
+//               RFC 9457 application/problem+json) via the uniform
+//               onDeny / problemDetails opts. A new deny-path
+//               middleware that hardcodes
+//               `res.writeHead(<4xx/5xx>, { "Content-Type": ... })`
+//               locks consumers out of the response shape — the
+//               integration-friction class that blocked downstream
+//               adoption (the rate-limit text/plain 429). ----
+function testDenyPathComposesDenyResponse() {
+  // class: deny-path-hardcoded-response
+  var MW_ROOT = path.resolve(LIB_ROOT, "middleware");
+  // NOT access-refusals: content-servers that 4xx when the
+  // .well-known resource isn't configured, and the CSP report-ingest
+  // machine endpoint. Their 4xx is not a user-facing access denial.
+  var NOT_DENY_PATH = {
+    "lib/middleware/assetlinks.js":       ".well-known content-server; 4xx = not-configured, not access-refusal",
+    "lib/middleware/security-txt.js":     ".well-known content-server; 4xx = not-configured, not access-refusal",
+    "lib/middleware/web-app-manifest.js": "manifest content-server; 4xx = not-configured, not access-refusal",
+    "lib/middleware/csp-report.js":       "CSP report-ingest machine endpoint; 4xx = malformed-report rejection on a browser-posting sink",
+    "lib/middleware/deny-response.js":    "the shared deny-response helper itself",
+  };
+  var denyStatusRe = new RegExp("writeHead\\(\\s*(?:4\\d\\d|5\\d\\d|requestHelpers\\.HTTP_STATUS\\." +
+    "(?:FORBIDDEN|UNAUTHORIZED|NOT_FOUND|BAD_REQUEST|METHOD_NOT_ALLOWED|UNSUPPORTED_MEDIA_TYPE|" +
+    "TOO_MANY_REQUESTS|UNAVAILABLE_FOR_LEGAL_REASONS|MISDIRECTED_REQUEST))");
+  var composesRe = /require\(\s*["']\.\/deny-response["']\s*\)/;
+  var files = fs.readdirSync(MW_ROOT).filter(function (f) { return f.endsWith(".js"); });
+  var violations = [];
+  for (var i = 0; i < files.length; i += 1) {
+    var rel = "lib/middleware/" + files[i];
+    if (NOT_DENY_PATH[rel]) continue;
+    var src = fs.readFileSync(path.join(MW_ROOT, files[i]), "utf8");
+    if (!denyStatusRe.test(src)) continue;       // doesn't write a deny status
+    if (composesRe.test(src)) continue;          // routes through the helper
+    var lines = src.split("\n");
+    var ln = 1;
+    for (var L = 0; L < lines.length; L += 1) {
+      if (denyStatusRe.test(lines[L])) { ln = L + 1; break; }
+    }
+    violations.push({
+      file:    rel,
+      line:    ln,
+      content: "access-refusal middleware writes a deny-status response without composing deny-response.js — " +
+               "route it through denyResponse() so consumers get onDeny / problemDetails (RFC 9457). If this " +
+               "is NOT an access-refusal (content-server / machine endpoint), add it to NOT_DENY_PATH with a reason.",
+    });
+  }
+  _report("every access-refusal middleware composes deny-response.js (onDeny / problemDetails override path)",
+    violations);
+}
+
 async function run() {
+  testPrimitiveReachability();
+  testDenyPathComposesDenyResponse();
   testNoOrphanAllowClass();
   testNoRawByteLiterals();
   testNoRawTimeLiterals();

package/lib/vendor/blamejs/test/layer-0-primitives/deny-response.test.js

@@ -0,0 +1,228 @@
+"use strict";
+/**
+ * Deny-path response convention — every access-refusal middleware
+ * routes its refusal through lib/middleware/deny-response.js, giving a
+ * consumer one uniform way to shape it:
+ *
+ *   - default            — the middleware's existing body + Content-Type
+ *                          (no behavior change)
+ *   - problemDetails:true — RFC 9457 application/problem+json
+ *   - onDeny(req,res,info) — the consumer fully owns the response; a
+ *                          throwing or no-op hook falls through to the
+ *                          default rather than hanging the request
+ *
+ * The deny-path response headers (Allow / WWW-Authenticate /
+ * Retry-After / Accept) survive every mode.
+ *
+ * The shared b.testing mocks don't capture setHeader + writeHead body
+ * + writableEnded together (problem mode writes via setHeader; default
+ * mode via writeHead), so — like require-auth-cache-control.test.js —
+ * this file rolls one complete response mock.
+ */
+
+var helpers = require("../helpers");
+var b       = helpers.b;
+var check   = helpers.check;
+
+function _mkRes() {
+  var hdrs = {};
+  return {
+    statusCode:    0,
+    headersSent:   false,
+    writableEnded: false,
+    body:          null,
+    setHeader: function (k, v) { hdrs[k.toLowerCase()] = v; },
+    getHeader: function (k) { return hdrs[k.toLowerCase()]; },
+    writeHead: function (sc, h) {
+      this.statusCode = sc;
+      this.headersSent = true;
+      if (h && typeof h === "object") {
+        for (var k in h) if (Object.prototype.hasOwnProperty.call(h, k)) {
+          hdrs[k.toLowerCase()] = h[k];
+        }
+      }
+      return this;
+    },
+    end: function (x) {
+      if (x !== undefined && x !== null) this.body = x;
+      this.writableEnded = true;
+    },
+    _hdrs: hdrs,
+  };
+}
+
+function _mkReq(opts) {
+  opts = opts || {};
+  return {
+    method:  opts.method || "GET",
+    url:     opts.url || "/x",
+    pathname: opts.pathname || "/x",
+    headers: opts.headers || {},
+    socket:  { remoteAddress: "127.0.0.1", encrypted: false },
+    connection: {},
+  };
+}
+
+function _json(s) { try { return JSON.parse(s); } catch (_e) { return {}; } }
+
+async function _drive(mw, req) {
+  var res = _mkRes();
+  await mw(req, res, function () { res._nextCalled = true; });
+  return res;
+}
+
+async function run() {
+  var denyResponse = require("../../lib/middleware/deny-response").denyResponse;
+
+  // ---- Helper unit: the three resolution modes ----
+  (function () {
+    // default mode
+    var res = _mkRes();
+    denyResponse(_mkReq(), res, {
+      status: 403, contentType: "text/plain", body: "no",
+      headers: { "Allow": "GET" },
+      info: { status: 403, reason: "x" },
+      problemTitle: "Forbidden",
+    });
+    check("denyResponse default: status + content-type + body + extra header",
+      res.statusCode === 403 && res._hdrs["content-type"] === "text/plain" &&
+      res.body === "no" && res._hdrs["allow"] === "GET");
+
+    // problem mode
+    var res2 = _mkRes();
+    denyResponse(_mkReq(), res2, {
+      problem: true, status: 403, contentType: "text/plain", body: "no",
+      headers: { "Allow": "GET" }, problemCode: "x-refused", problemTitle: "Forbidden",
+      problemDetail: "nope", info: { status: 403, reason: "x" },
+    });
+    var p = _json(res2.body);
+    check("denyResponse problem: application/problem+json + RFC 9457 fields + extra header survives",
+      res2.statusCode === 403 && res2._hdrs["content-type"] === "application/problem+json" &&
+      p.status === 403 && p.title === "Forbidden" && p.detail === "nope" &&
+      typeof p.type === "string" && res2._hdrs["allow"] === "GET");
+
+    // onDeny owns
+    var seen = null;
+    var res3 = _mkRes();
+    denyResponse(_mkReq(), res3, {
+      onDeny: function (req, rs, info) { seen = info; rs.writeHead(418, {}); rs.end("teapot"); },
+      status: 403, contentType: "text/plain", body: "no", info: { status: 403, reason: "x" },
+    });
+    check("denyResponse onDeny owns response + receives info",
+      res3.statusCode === 418 && res3.body === "teapot" && seen && seen.reason === "x");
+
+    // onDeny throws -> falls through to default (audited via onThrow)
+    var threw = false;
+    var res4 = _mkRes();
+    denyResponse(_mkReq(), res4, {
+      onDeny: function () { throw new Error("boom"); },
+      onThrow: function () { threw = true; },
+      status: 403, contentType: "text/plain", body: "default-after-throw",
+      info: { status: 403, reason: "x" },
+    });
+    check("denyResponse onDeny throws -> default written + onThrow audited",
+      res4.statusCode === 403 && res4.body === "default-after-throw" && threw === true);
+
+    // onDeny no-op (doesn't write) -> falls through to default
+    var res5 = _mkRes();
+    denyResponse(_mkReq(), res5, {
+      onDeny: function () { /* returns without writing */ },
+      status: 403, contentType: "text/plain", body: "default-after-noop",
+      info: { status: 403, reason: "x" },
+    });
+    check("denyResponse onDeny no-op -> default written (no hang)",
+      res5.statusCode === 403 && res5.body === "default-after-noop");
+  })();
+
+  // ---- require-methods (405 / text/plain) ----
+  (function () {
+    var def = _mkRes();
+    b.middleware.requireMethods(["GET"])(_mkReq({ method: "DELETE" }), def, function () {});
+    check("requireMethods default 405 text/plain + Allow",
+      def.statusCode === 405 && def._hdrs["content-type"] === "text/plain; charset=utf-8" &&
+      def._hdrs["allow"] === "GET" && def.body === "Method Not Allowed");
+
+    var pj = _mkRes();
+    b.middleware.requireMethods(["GET"], { problemDetails: true })(_mkReq({ method: "DELETE" }), pj, function () {});
+    check("requireMethods problemDetails 405 problem+json + Allow survives",
+      pj.statusCode === 405 && pj._hdrs["content-type"] === "application/problem+json" &&
+      pj._hdrs["allow"] === "GET" && _json(pj.body).status === 405);
+  })();
+
+  // ---- rate-limit (429) — X-RateLimit-* + Retry-After survive problem mode ----
+  (function () {
+    var mw = b.middleware.rateLimit({ backend: "memory", algorithm: "fixed-window", limit: 1, windowMs: 60000, problemDetails: true });
+    var req = _mkReq();
+    mw(req, _mkRes(), function () {});
+    var res = _mkRes();
+    mw(req, res, function () {});
+    check("rateLimit problemDetails 429 problem+json + X-RateLimit-Limit survives",
+      res.statusCode === 429 && res._hdrs["content-type"] === "application/problem+json" &&
+      res._hdrs["x-ratelimit-limit"] === "1" && _json(res.body).status === 429);
+  })();
+
+  // ---- age-gate (451 / JSON envelope default) ----
+  (function () {
+    var opts = { getAge: function () { return 5; }, requireAge: 13, consentRequired: 13 };
+    var def = _mkRes();
+    b.middleware.ageGate(opts)(_mkReq(), def, function () {});
+    check("ageGate default 451 JSON envelope",
+      def.statusCode === 451 && def._hdrs["content-type"] === "application/json; charset=utf-8" &&
+      _json(def.body).parentalConsent === false);
+
+    var pj = _mkRes();
+    b.middleware.ageGate(Object.assign({ problemDetails: true }, opts))(_mkReq(), pj, function () {});
+    check("ageGate problemDetails 451 problem+json + requireAge extension",
+      pj.statusCode === 451 && pj._hdrs["content-type"] === "application/problem+json" &&
+      _json(pj.body).requireAge === 13);
+  })();
+
+  // ---- cors (403) ----
+  (function () {
+    var mw = b.middleware.cors({ origins: ["https://ok.example"], problemDetails: true });
+    var res = _mkRes();
+    mw(_mkReq({ headers: { origin: "https://evil.example" } }), res, function () {});
+    check("cors problemDetails 403 problem+json on disallowed origin",
+      res.statusCode === 403 && res._hdrs["content-type"] === "application/problem+json");
+  })();
+
+  // ---- require-bound-key — now reachable on b.middleware + RFC 6750 challenge ----
+  (function () {
+    check("requireBoundKey reachable on b.middleware (was unwired)",
+      typeof b.middleware.requireBoundKey === "function");
+  })();
+
+  await (async function () {
+    var mw = b.middleware.requireBoundKey({
+      resolver: async function () { return { id: "k1", scopes: ["other"], boundFields: {} }; },
+      requiredScopes: ["needed"],
+    });
+    var scope = await _drive(mw, _mkReq({ headers: { authorization: "Bearer abc" } }));
+    check("requireBoundKey 403 missing-scope -> WWW-Authenticate insufficient_scope (RFC 6750)",
+      scope.statusCode === 403 && /insufficient_scope/.test(scope._hdrs["www-authenticate"] || ""));
+    var noTok = await _drive(mw, _mkReq());
+    check("requireBoundKey 401 no-token omits error code (RFC 6750 §3)",
+      noTok.statusCode === 401 && noTok._hdrs["www-authenticate"] === 'Bearer realm="api"');
+  })();
+
+  // ---- bearer-auth — requiredScopes now accepted (was rejected by validateOpts) ----
+  await (async function () {
+    var mw = b.middleware.bearerAuth({
+      verify: async function () { return { id: 1, scopes: ["read"] }; },
+      requiredScopes: ["admin"],
+    });
+    var res = await _drive(mw, _mkReq({ headers: { authorization: "Bearer good" } }));
+    check("bearerAuth requiredScopes reachable -> 403 insufficient_scope",
+      res.statusCode === 403 && /insufficient_scope/.test(res._hdrs["www-authenticate"] || "") &&
+      _json(res.body).required[0] === "admin");
+  })();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e.stack || e); process.exit(1); }
+  );
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.3.7",
+  "version": "0.3.9",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {