@blamejs/blamejs-shop 0.5.19 → 0.5.21

package/lib/vendor/blamejs/lib/mail-scan.js

@@ -296,6 +296,9 @@ function create(opts) {
           var threats = [];
           if (parsed.threatName) threats.push(parsed.threatName);
           resolve({
+            // ICAP's own codes (RFC 3507): 200 with the message returned, 204
+            // when it needed no change. They are not HTTP statuses, so they are
+            // not named as though they were.
             verdict:      parsed.threatFound ? "infected" : (parsed.statusCode === 200 || parsed.statusCode === 204 ? "clean" : "error"),
             icapResponse: parsed,
             threats:      threats,

package/lib/vendor/blamejs/lib/mail-store.js

@@ -158,7 +158,13 @@ function create(opts) {
   // expressions (the decrement update + the accumulate-on-conflict upsert),
   // which a structured set()/value cell cannot express. Every other table
   // identifier emits through the b.sql builders above with quoteName.
-  var qQuota = safeSql.quoteIdentifier(quotaTable, "sqlite");
+  // The name is built from an operator `tablePrefix`, so it is quoted the way
+  // every other operator-supplied identifier is. It changes nothing today and
+  // is not meant to: `create()` refuses a reserved-word prefix outright, and
+  // the `_quota` suffix means this name could not be a bare keyword anyway.
+  // It is here so the rule reads the same at every call site rather than
+  // depending on a reader re-deriving those two facts.
+  var qQuota = safeSql.quoteIdentifier(quotaTable, "sqlite", { allowReserved: true });
 
   var maxMessageBytes = opts.maxMessageBytes !== undefined ? opts.maxMessageBytes : DEFAULT_MAX_MESSAGE_BYTES;
   var maxBodyBytes    = opts.maxBodyBytes    !== undefined ? opts.maxBodyBytes    : DEFAULT_MAX_BODY_BYTES;

package/lib/vendor/blamejs/lib/mail.js

@@ -819,7 +819,11 @@ function _dotStuffForData(msg) {
 function _smtpTlsOpts(cfg, extra) {
   var out = Object.assign(networkTls().outboundPosture(), cfg.tlsOpts);
   if (extra) Object.assign(out, extra);
-  return out;
+  // The posture advertises RFC 8879 certificate compression, which is a TLS
+  // 1.3 extension. An SMTP peer that only speaks TLS 1.2 is common enough
+  // that operators cap this dial; Node refuses the whole options object
+  // rather than ignoring an extension it cannot use.
+  return networkTls()._stripUnreachableCertCompression(out, cfg.tlsOpts);
 }
 
 function smtpTransport(opts) {

package/lib/vendor/blamejs/lib/middleware/age-gate.js

@@ -37,6 +37,7 @@
  *   router.use(gate);
  */
 
+var C = require("../constants");
 var defineClass = require("../framework-error").defineClass;
 var lazyRequire = require("../lazy-require");
 var validateOpts = require("../validate-opts");
@@ -165,8 +166,8 @@ function create(opts) {
         denyResponse(req, res, {
           onDeny:        onDeny,
           problem:       problemMode,
-          status:        451,                                                             // HTTP 451 Unavailable For Legal Reasons
-          info:          { status: 451, reason: "parental-consent-required",
+          status:        C.HTTP.STATUS.UNAVAILABLE_FOR_LEGAL_REASONS,                                                             // HTTP 451 Unavailable For Legal Reasons
+          info:          { status: C.HTTP.STATUS.UNAVAILABLE_FOR_LEGAL_REASONS, reason: "parental-consent-required",
             age: age, classification: classification, requireAge: requireAge },
           problemCode:   "parental-consent-required",
           problemTitle:  "Unavailable For Legal Reasons",

package/lib/vendor/blamejs/lib/middleware/api-encrypt.js

@@ -376,7 +376,7 @@ function create(opts) {
   }
   numericBounds.requirePositiveFiniteInt(sessionMaxResponses,
     "apiEncrypt: sessionMaxResponses", ApiEncryptError, "BAD_OPT", null,
-    { permanent: true, statusCode: 500 });
+    { permanent: true, statusCode: C.HTTP.STATUS.INTERNAL_SERVER_ERROR });
   // sessionStore — duck-typed handle exposing { get, set, delete }. The
   // helper optionalObjectWithMethod only checks one method; here we need
   // three. Inline shape kept; not a generic enough pattern to warrant a

package/lib/vendor/blamejs/lib/middleware/assetlinks.js

@@ -27,6 +27,7 @@
  * multiple statement entries.
  */
 
+var C = require("../constants");
 var lazyRequire = require("../lazy-require");
 var safeJson = require("../safe-json");
 var validateOpts = require("../validate-opts");
@@ -114,7 +115,7 @@ function create(opts) {
       denyResponse.methodNotAllowed(res, "GET, HEAD");
       return;
     }
-    res.writeHead(200, {                                                         // HTTP 200 status
+    res.writeHead(C.HTTP.STATUS.OK, {                                                         // HTTP 200 status
       "Content-Type":     "application/json; charset=utf-8",
       "Content-Length":   bodyBuf.length,
       "Cache-Control":    "public, max-age=86400",

package/lib/vendor/blamejs/lib/middleware/asyncapi-serve.js

@@ -21,6 +21,7 @@
  * paths / methods.
  */
 
+var C             = require("../constants");
 var nodeCrypto    = require("node:crypto");
 var validateOpts  = require("../validate-opts");
 var lazyRequire   = require("../lazy-require");
@@ -157,7 +158,7 @@ function create(opts) {
   function _writeBody(req, res, body, etag, contentType) {
     var requestEtag = (req.headers && req.headers["if-none-match"]) || null;
     if (requestEtag && requestEtag === etag) {
-      res.writeHead(304, { "ETag": etag, "Cache-Control": cacheControl });           // HTTP 304
+      res.writeHead(C.HTTP.STATUS.NOT_MODIFIED, { "ETag": etag, "Cache-Control": cacheControl });           // HTTP 304
       res.end();
       return;
     }
@@ -174,7 +175,7 @@ function create(opts) {
       // origin to another's request (Fetch Standard §3.2.1).
       if (allowOriginHeader !== "*") headers["Vary"] = "Origin";
     }
-    res.writeHead(200, headers);                                                     // HTTP 200
+    res.writeHead(C.HTTP.STATUS.OK, headers);                                                     // HTTP 200
     // HEAD carries the GET headers (incl. Content-Length) with no body
     // (RFC 9110 §9.3.2).
     if ((req.method || "GET").toUpperCase() === "HEAD") { res.end(); return; }

package/lib/vendor/blamejs/lib/middleware/bearer-auth.js

@@ -36,6 +36,7 @@
  * route).
  */
 
+var C = require("../constants");
 var lazyRequire = require("../lazy-require");
 var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
@@ -56,7 +57,7 @@ function _refuse(req, res, status, challenge, bodyObj, reason, problemExt, onDen
     status:        status,
     info:          Object.assign({ status: status, reason: reason }, problemExt || {}),
     problemCode:   "bearer-" + reason,
-    problemTitle:  status === 403 ? "Forbidden" : "Unauthorized",
+    problemTitle:  status === C.HTTP.STATUS.FORBIDDEN ? "Forbidden" : "Unauthorized",
     problemDetail: typeof bodyObj.error === "string" ? bodyObj.error : ("bearer authentication failed: " + reason),
     problemExt:    problemExt || null,
     headers:       { "WWW-Authenticate": challenge },

package/lib/vendor/blamejs/lib/middleware/compression.js

@@ -334,7 +334,7 @@ function create(opts) {
       // UNtransformed (RFC 7233 §4.1) — compressing it drops Content-Length but
       // leaves Content-Range advertising an uncompressed byte interval over a
       // now-compressed body, corrupting range-assembling clients.
-      if (statusCode === 206) { compress = false; return; }
+      if (statusCode === C.HTTP.STATUS.PARTIAL_CONTENT) { compress = false; return; }
       var crRange = (headersObj && headersObj["content-range"]) ||
                     (originalGetHeader && originalGetHeader("Content-Range"));
       if (crRange) { compress = false; return; }

package/lib/vendor/blamejs/lib/middleware/cors.js

@@ -296,7 +296,7 @@ function create(opts) {
       onDeny:        onDeny,
       problem:       problemMode,
       status:        requestHelpers.HTTP_STATUS.FORBIDDEN,
-      info:          Object.assign({ status: 403, reason: reason }, ext || {}),
+      info:          Object.assign({ status: C.HTTP.STATUS.FORBIDDEN, reason: reason }, ext || {}),
       problemCode:   "cors-refused",
       problemTitle:  "Forbidden",
       problemDetail: body,

package/lib/vendor/blamejs/lib/middleware/csp-report.js

@@ -175,7 +175,7 @@ function create(opts) {
 
   return async function cspReport(req, res, _next) {
     if (req.method !== "POST") {
-      res.writeHead(405, { "Allow": "POST" });                                     // HTTP 405 status
+      res.writeHead(C.HTTP.STATUS.METHOD_NOT_ALLOWED, { "Allow": "POST" });                                     // HTTP 405 status
       res.end();
       _emitReject(req, res, 405, "method-not-allowed");
       return;
@@ -184,7 +184,7 @@ function create(opts) {
     try {
       body = await safeBuffer.collectStream(req, { maxBytes: maxBytes });
     } catch (_e) {
-      res.writeHead(413);                                                         // HTTP 413 status
+      res.writeHead(C.HTTP.STATUS.CONTENT_TOO_LARGE);                                                         // HTTP 413 status
       res.end();
       _emitReject(req, res, 413, "payload-too-large");
       return;
@@ -192,7 +192,7 @@ function create(opts) {
     var parsed;
     try { parsed = safeJson.parse(body.toString("utf8")); }
     catch (_e) {
-      res.writeHead(400);                                                         // HTTP 400 status
+      res.writeHead(C.HTTP.STATUS.BAD_REQUEST);                                                         // HTTP 400 status
       res.end();
       _emitReject(req, res, 400, "invalid-json");
       return;
@@ -204,7 +204,7 @@ function create(opts) {
     // unauthenticated caller can force. A throwing/absent audit or hook is
     // unaffected — nothing is processed on this path.
     if (reports.length > maxReports) {
-      res.writeHead(413);                                                         // HTTP 413 status
+      res.writeHead(C.HTTP.STATUS.CONTENT_TOO_LARGE);                                                         // HTTP 413 status
       res.end();
       _emitReject(req, res, 413, "too-many-reports");
       return;
@@ -225,7 +225,7 @@ function create(opts) {
         try { onReport(normalized); } catch (_e) { /* hook best-effort */ }
       }
     }
-    res.writeHead(204);                                                           // HTTP 204 status
+    res.writeHead(C.HTTP.STATUS.NO_CONTENT);                                                           // HTTP 204 status
     res.end();
   };
 }

package/lib/vendor/blamejs/lib/middleware/csrf-protect.js

@@ -68,6 +68,7 @@
  *     audit:        true
  *   }
  */
+var C = require("../constants");
 var lazyRequire = require("../lazy-require");
 var pick = require("../pick");
 var forms = require("../forms");
@@ -235,7 +236,7 @@ function _writeReject(req, res, message, reason, onDeny, problemMode) {
     onDeny:        onDeny,
     problem:       problemMode,
     status:        requestHelpers.HTTP_STATUS.FORBIDDEN,
-    info:          { status: 403, reason: reason },
+    info:          { status: C.HTTP.STATUS.FORBIDDEN, reason: reason },
     problemCode:   "csrf-refused",
     problemTitle:  "Forbidden",
     problemDetail: message,

package/lib/vendor/blamejs/lib/middleware/daily-byte-quota.js

@@ -158,7 +158,7 @@ function create(opts) {
       _emitMetric("refused", 1, { reason: "quota-exceeded" });
       _emitAudit("refused", "denied", { key: key, total: total, quota: bytesPerDay });
       var info = {
-        status:          429,
+        status:          C.HTTP.STATUS.TOO_MANY_REQUESTS,
         reason:          "quota-exceeded",
         quota:           bytesPerDay,
         total:           total,
@@ -167,7 +167,7 @@ function create(opts) {
       denyResponse(req, res, {
         onDeny:        onDeny,
         problem:       problemMode,
-        status:        429,
+        status:        C.HTTP.STATUS.TOO_MANY_REQUESTS,
         info:          info,
         problemCode:   "daily-byte-quota-exceeded",
         problemTitle:  "Too Many Requests",

package/lib/vendor/blamejs/lib/middleware/deny-response.js

@@ -35,6 +35,7 @@
  * middleware that composes it.
  */
 
+var C = require("../constants");
 var problemDetails = require("../problem-details");
 var validateOpts = require("../validate-opts");
 
@@ -158,7 +159,7 @@ function denyResponse(req, res, ctx) {
 // "GET, HEAD").
 function methodNotAllowed(res, allow) {
   var bodyMsg = "Method Not Allowed";
-  res.writeHead(405, {                                                           // HTTP 405 status
+  res.writeHead(C.HTTP.STATUS.METHOD_NOT_ALLOWED, {                                                           // HTTP 405 status
     "Allow":          allow,
     "Content-Type":   "text/plain; charset=utf-8",
     "Content-Length": Buffer.byteLength(bodyMsg),

package/lib/vendor/blamejs/lib/middleware/dpop.js

@@ -64,8 +64,8 @@ function _writeUnauthorized(req, res, errorCode, description, freshNonce, onDeny
   denyResponse(req, res, {
     onDeny:        onDeny,
     problem:       problemMode,
-    status:        401,                                                            // HTTP 401 status
-    info:          { status: 401, reason: errorCode, error_description: description },
+    status:        C.HTTP.STATUS.UNAUTHORIZED,                                                            // HTTP 401 status
+    info:          { status: C.HTTP.STATUS.UNAUTHORIZED, reason: errorCode, error_description: description },
     problemCode:   "dpop-" + errorCode.replace(/_/g, "-"),
     problemTitle:  "Unauthorized",
     problemDetail: description,

package/lib/vendor/blamejs/lib/middleware/fetch-metadata.js

@@ -35,6 +35,7 @@
  * own auth threat model.
  */
 
+var C = require("../constants");
 var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
 var lazyRequire = require("../lazy-require");
@@ -100,7 +101,7 @@ function _writeReject(req, res, message, reason, onDeny, problemMode) {
     onDeny:        onDeny,
     problem:       problemMode,
     status:        requestHelpers.HTTP_STATUS.FORBIDDEN,
-    info:          { status: 403, reason: reason },
+    info:          { status: C.HTTP.STATUS.FORBIDDEN, reason: reason },
     problemCode:   "fetch-metadata-refused",
     problemTitle:  "Forbidden",
     problemDetail: message,

package/lib/vendor/blamejs/lib/middleware/flag-context.js

@@ -31,6 +31,7 @@ var { defineClass } = require("../framework-error");
 var FlagError = defineClass("FlagError", { alwaysPermanent: true });
 
 var contextMod = lazyRequire(function () { return require("../flag-evaluation-context"); });
+var requestHelpers = lazyRequire(function () { return require("../request-helpers"); });
 
 /**
  * @primitive b.middleware.flagContext
@@ -70,6 +71,7 @@ function create(opts) {
   opts = opts || {};
   validateOpts(opts, [
     "userKey", "userKeyHeader", "extractAttributes", "tenantKeyHeader",
+    "trustedProxies", "forwardedHeaders", "clientIpResolver",
   ], "middleware.flagContext");
   if (opts.extractAttributes != null && typeof opts.extractAttributes !== "function") {
     throw new FlagError("flag/bad-opt",
@@ -84,6 +86,14 @@ function create(opts) {
   var explicitUserKey = (typeof opts.userKey === "string" && opts.userKey.length > 0)
     ? opts.userKey
     : null;
+  var declaredTrust = opts.trustedProxies !== undefined ||
+                      opts.forwardedHeaders !== undefined ||
+                      opts.clientIpResolver !== undefined;
+  var trustedIp = declaredTrust ? requestHelpers().trustedClientIp({
+    trustedProxies:   opts.trustedProxies,
+    forwardedHeaders: opts.forwardedHeaders,
+    clientIpResolver: opts.clientIpResolver,
+  }) : null;
 
   return function flagContextMiddleware(req, res, next) {
     var headers = req.headers || {};
@@ -104,6 +114,13 @@ function create(opts) {
       augment.tenantId = headers[tenantKeyHeader];
     }
     fromReqOpts.extra = augment;
+    // A request with no identified user is keyed by its client address, and
+    // that key picks the rollout bucket. Behind a reverse proxy the operator
+    // has to say which proxies and which header, or every anonymous caller
+    // arrives as the proxy and shares one bucket. Same options as
+    // flag.middleware; the resolver is built once, so a malformed CIDR fails
+    // at boot rather than on the first request.
+    if (trustedIp) fromReqOpts.clientIpResolver = trustedIp.resolve;
     req.flagCtx = contextMod().fromRequest(req, fromReqOpts);
     return next();
   };

package/lib/vendor/blamejs/lib/middleware/idempotency-key.js

@@ -734,7 +734,7 @@ function create(opts) {
       var missing = problemDetails().create({
         type:   problemDetails().getBase() + "/idempotency/missing-key",
         title:  "Idempotency-Key header required",
-        status: 400,                                                                               // HTTP status 400 Bad Request
+        status: C.HTTP.STATUS.BAD_REQUEST,                                                                               // HTTP status 400 Bad Request
         detail: "This endpoint requires an Idempotency-Key header (draft-ietf-httpapi-idempotency-key).",
       });
       _emitAudit("idempotency.missing_key", { method: method, path: req.url }, "denied");
@@ -745,7 +745,7 @@ function create(opts) {
       var bad = problemDetails().create({
         type:   problemDetails().getBase() + "/idempotency/bad-key",
         title:  "Idempotency-Key malformed",
-        status: 400,                                                                               // HTTP status 400
+        status: C.HTTP.STATUS.BAD_REQUEST,                                                                               // HTTP status 400
         detail: "Idempotency-Key must be ASCII printable, length 1.." + KEY_MAX_LEN + " (draft §2).",
       });
       _emitAudit("idempotency.bad_key", { method: method, keyLen: key.length }, "denied");
@@ -816,7 +816,7 @@ function create(opts) {
         var missingBody = problemDetails().create({
           type:   problemDetails().getBase() + "/idempotency/missing-body-fingerprint",
           title:  "Idempotency body fingerprint unavailable",
-          status: 400,                                                                               // HTTP status 400 Bad Request
+          status: C.HTTP.STATUS.BAD_REQUEST,                                                                               // HTTP status 400 Bad Request
           detail: "The idempotency middleware could not derive a body fingerprint for this " +
                   "request. Mount body-parser BEFORE the idempotency middleware, OR provide an " +
                   "opts.bodyFingerprint(req) hook. To restore the pre-0.9.58 method+path-only " +
@@ -844,7 +844,7 @@ function create(opts) {
         var mismatch = problemDetails().create({
           type:   problemDetails().getBase() + "/idempotency/key-reuse-mismatch",
           title:  "Idempotency-Key reused with different request",
-          status: 422,                                                                             // HTTP status 422 Unprocessable Content (RFC 9110)
+          status: C.HTTP.STATUS.UNPROCESSABLE_CONTENT,                                                                             // HTTP status 422 Unprocessable Content (RFC 9110)
           detail: "The Idempotency-Key matches a prior request but the request body/method/path differs (draft §4.3).",
         });
         _emitAudit("idempotency.key_reuse_mismatch",
@@ -900,10 +900,12 @@ function create(opts) {
       if (!captured) {
         captured = true;
         _pushChunk(chunk, encoding);
-        var status = res.statusCode || 200;                                                        // default HTTP status 200
-        // Only persist 2xx-4xx responses; 5xx is transient infra
-        // failure that should be retried fresh, not replayed.
-        if (!oversized && status >= 200 && status < 500) {                                         // HTTP status class boundaries
+        var status = res.statusCode || C.HTTP.STATUS.OK;
+        // Only persist what the SERVER settled: a success, a redirect, or the
+        // caller's own mistake. A 5xx is transient infrastructure failure that
+        // should be retried fresh rather than replayed from a cache.
+        if (!oversized &&
+            (C.HTTP.success(status) || C.HTTP.redirect(status) || C.HTTP.clientError(status))) {
           var headerMap = {};
           try {
             var allHeaders = typeof res.getHeaders === "function" ? res.getHeaders() : {};

package/lib/vendor/blamejs/lib/middleware/openapi-serve.js

@@ -29,6 +29,7 @@
  * origin is validated and echoed verbatim with `Vary: Origin`.
  */
 
+var C             = require("../constants");
 var nodeCrypto    = require("node:crypto");
 var validateOpts  = require("../validate-opts");
 var lazyRequire   = require("../lazy-require");
@@ -163,7 +164,7 @@ function create(opts) {
   function _writeBody(req, res, body, etag, contentType) {
     var requestEtag = (req.headers && req.headers["if-none-match"]) || null;
     if (requestEtag && requestEtag === etag) {
-      res.writeHead(304, { "ETag": etag, "Cache-Control": cacheControl });          // HTTP 304
+      res.writeHead(C.HTTP.STATUS.NOT_MODIFIED, { "ETag": etag, "Cache-Control": cacheControl });          // HTTP 304
       res.end();
       return;
     }
@@ -180,7 +181,7 @@ function create(opts) {
       // origin to another's request (Fetch Standard §3.2.1).
       if (allowOriginHeader !== "*") headers["Vary"] = "Origin";
     }
-    res.writeHead(200, headers);                                                    // HTTP 200
+    res.writeHead(C.HTTP.STATUS.OK, headers);                                                    // HTTP 200
     // HEAD carries the GET headers (incl. Content-Length) with no body
     // (RFC 9110 §9.3.2).
     if ((req.method || "GET").toUpperCase() === "HEAD") { res.end(); return; }

package/lib/vendor/blamejs/lib/middleware/require-aal.js

@@ -20,6 +20,7 @@
  *   auth.aal.denied  — request below the required minimum
  */
 
+var C = require("../constants");
 var lazyRequire = require("../lazy-require");
 var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
@@ -42,8 +43,8 @@ function _writeUnauthorized(req, res, requiredBand, actualBand, realm, onDeny, p
   denyResponse(req, res, {
     onDeny:        onDeny,
     problem:       problemMode,
-    status:        401,                                                            // HTTP 401 status
-    info:          { status: 401, reason: "step_up_required",
+    status:        C.HTTP.STATUS.UNAUTHORIZED,                                                            // HTTP 401 status
+    info:          { status: C.HTTP.STATUS.UNAUTHORIZED, reason: "step_up_required",
       required_aal: requiredBand, actual_aal: actualBand || null },
     problemCode:   "step-up-required",
     problemTitle:  "Step-Up Authentication Required",

package/lib/vendor/blamejs/lib/middleware/require-auth.js

@@ -38,6 +38,7 @@
  *     audit:         true         (emit auth.required.denied on reject)
  *   }
  */
+var C = require("../constants");
 var lazyRequire = require("../lazy-require");
 var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
@@ -118,7 +119,7 @@ function create(opts) {
     // before the default content-negotiation runs.
     if (onDeny) {
       try {
-        var returned = onDeny(req, res, { status: 401, reason: "no-authenticated-user", redirectTo: redirectTo });
+        var returned = onDeny(req, res, { status: C.HTTP.STATUS.UNAUTHORIZED, reason: "no-authenticated-user", redirectTo: redirectTo });
         if (res.writableEnded) return returned;
       } catch (_e) {
         if (res.writableEnded) return;
@@ -138,7 +139,7 @@ function create(opts) {
     if (!wantsJson && redirectTo) {
       if (!res.writableEnded && typeof res.writeHead === "function") {
         // 302 Found — RFC 7231 §6.4.3. Not in HTTP_STATUS table.
-        res.writeHead(302, { "Location": redirectTo, "Cache-Control": "no-store" });
+        res.writeHead(C.HTTP.STATUS.FOUND, { "Location": redirectTo, "Cache-Control": "no-store" });
         res.end();
       }
       return;
@@ -146,7 +147,7 @@ function create(opts) {
     denyResponse(req, res, {
       problem:       problemMode,
       status:        requestHelpers.HTTP_STATUS.UNAUTHORIZED,
-      info:          { status: 401, reason: "no-authenticated-user" },
+      info:          { status: C.HTTP.STATUS.UNAUTHORIZED, reason: "no-authenticated-user" },
       problemCode:   "authentication-required",
       problemTitle:  "Unauthorized",
       problemDetail: msg,

package/lib/vendor/blamejs/lib/middleware/require-bound-key.js

@@ -50,6 +50,7 @@
  * undefined → refused with reason "resolver-unavailable".
  */
 
+var C = require("../constants");
 var defineClass = require("../framework-error").defineClass;
 var lazyRequire = require("../lazy-require");
 var validateOpts = require("../validate-opts");
@@ -177,12 +178,12 @@ function create(opts) {
   // are not authentication challenges, so they advertise the scheme
   // without an (incorrect) auth-error code.
   function _bearerChallenge(status, reason) {
-    if (status === 401) {
+    if (status === C.HTTP.STATUS.UNAUTHORIZED) {
       if (reason === "no-bearer-token") return 'Bearer realm="api"';
       return 'Bearer realm="api", error="invalid_token"';
     }
-    if (status === 403) return 'Bearer realm="api", error="insufficient_scope"';
-    if (status === 400) return 'Bearer realm="api", error="invalid_request"';   // HTTP 400
+    if (status === C.HTTP.STATUS.FORBIDDEN) return 'Bearer realm="api", error="insufficient_scope"';
+    if (status === C.HTTP.STATUS.BAD_REQUEST) return 'Bearer realm="api", error="invalid_request"';   // HTTP 400
     return 'Bearer realm="api"';
   }
 

package/lib/vendor/blamejs/lib/middleware/require-content-type.js

@@ -19,6 +19,7 @@
  * `methods` to override.
  */
 
+var C = require("../constants");
 var lazyRequire = require("../lazy-require");
 var denyResponse = require("./deny-response").denyResponse;
 var { defineClass } = require("../framework-error");
@@ -100,8 +101,8 @@ function create(allowed, opts) {
       denyResponse(req, res, {
         onDeny:        onDeny,
         problem:       problemMode,
-        status:        415,
-        info:          { status: 415, reason: "unsupported-media-type",
+        status:        C.HTTP.STATUS.UNSUPPORTED_MEDIA_TYPE,
+        info:          { status: C.HTTP.STATUS.UNSUPPORTED_MEDIA_TYPE, reason: "unsupported-media-type",
           contentType: bare || null, accepted: normalized },
         problemCode:   "unsupported-media-type",
         problemTitle:  "Unsupported Media Type",

package/lib/vendor/blamejs/lib/middleware/require-methods.js

@@ -17,6 +17,7 @@
  * RFC 9110 §15.5.6.
  */
 
+var C = require("../constants");
 var lazyRequire = require("../lazy-require");
 var denyResponse = require("./deny-response").denyResponse;
 var { defineClass } = require("../framework-error");
@@ -84,8 +85,8 @@ function create(allowed, opts) {
       denyResponse(req, res, {
         onDeny:        onDeny,
         problem:       problemMode,
-        status:        405,
-        info:          { status: 405, reason: "method-not-allowed", method: m, allowed: normalized },
+        status:        C.HTTP.STATUS.METHOD_NOT_ALLOWED,
+        info:          { status: C.HTTP.STATUS.METHOD_NOT_ALLOWED, reason: "method-not-allowed", method: m, allowed: normalized },
         problemCode:   "method-not-allowed",
         problemTitle:  "Method Not Allowed",
         problemDetail: "The " + m + " method is not allowed on this resource.",

package/lib/vendor/blamejs/lib/middleware/require-mtls.js

@@ -47,6 +47,7 @@
  * allow-list ALSO requires the fingerprint to match.
  */
 
+var C = require("../constants");
 var nodeCrypto = require("node:crypto");
 var defineClass = require("../framework-error").defineClass;
 var lazyRequire = require("../lazy-require");
@@ -164,8 +165,8 @@ function create(opts) {
     denyResponse(req, res, {
       onDeny:        onDeny,
       problem:       problemMode,
-      status:        401,
-      info:          Object.assign({ status: 401, reason: reason }, metadata || {}),
+      status:        C.HTTP.STATUS.UNAUTHORIZED,
+      info:          Object.assign({ status: C.HTTP.STATUS.UNAUTHORIZED, reason: reason }, metadata || {}),
       problemCode:   "client-certificate-required",
       problemTitle:  "Unauthorized",
       problemDetail: errorMessage,

package/lib/vendor/blamejs/lib/middleware/security-txt.js

@@ -27,6 +27,7 @@
  * also throws when the operator-supplied `expires` is in the past.
  */
 
+var C = require("../constants");
 var lazyRequire = require("../lazy-require");
 var validateOpts = require("../validate-opts");
 var denyResponse = require("./deny-response");
@@ -149,7 +150,7 @@ function create(opts) {
       denyResponse.methodNotAllowed(res, "GET, HEAD");
       return;
     }
-    res.writeHead(200, {                                                         // HTTP 200 status
+    res.writeHead(C.HTTP.STATUS.OK, {                                                         // HTTP 200 status
       "Content-Type":     "text/plain; charset=utf-8",
       "Content-Length":   bodyBuf.length,
       "Cache-Control":    "public, max-age=86400",

package/lib/vendor/blamejs/lib/middleware/web-app-manifest.js

@@ -28,6 +28,7 @@
  * of those are missing.
  */
 
+var C = require("../constants");
 var lazyRequire = require("../lazy-require");
 var safeJson = require("../safe-json");
 var validateOpts = require("../validate-opts");
@@ -141,7 +142,7 @@ function create(opts) {
       denyResponse.methodNotAllowed(res, "GET, HEAD");
       return;
     }
-    res.writeHead(200, {                                                         // HTTP 200 status
+    res.writeHead(C.HTTP.STATUS.OK, {                                                         // HTTP 200 status
       "Content-Type":     "application/manifest+json",
       "Content-Length":   bodyBuf.length,
       "Cache-Control":    "public, max-age=86400",

package/lib/vendor/blamejs/lib/network-dns-resolver.js

@@ -557,7 +557,7 @@ async function _wireLookup(name, qtype, timeoutMs) {
       res.on("end", function () {
         try {
           if (pushFailed) { _fail(pushFailed); return; }
-          if (res.statusCode !== 200) {                                                                  // HTTP 200 OK
+          if (res.statusCode !== C.HTTP.STATUS.OK) {                                                                  // HTTP 200 OK
             _fail(new ResolverError("resolver/upstream-http",
               "DoH HTTP " + res.statusCode + " for " + name));
             return;

package/lib/vendor/blamejs/lib/network-dns.js

@@ -581,7 +581,7 @@ async function _dohLookup(host, family) {
         try {
           if (pushFailed) { reject(pushFailed); return; }
           var body = collector.result();
-          if (res.statusCode !== 200) {
+          if (res.statusCode !== C.HTTP.STATUS.OK) {
             reject(new DnsError("dns/doh-http", "DoH HTTP " + res.statusCode + " for " + host));
             return;
           }
@@ -641,7 +641,7 @@ async function _dohLookupSecure(host, family) {
         try {
           if (pushFailed) { reject(pushFailed); return; }
           var body = collector.result();
-          if (res.statusCode !== 200) {                                          // HTTP 200 OK
+          if (res.statusCode !== C.HTTP.STATUS.OK) {                                          // HTTP 200 OK
             reject(new DnsError("dns/doh-http", "DoH HTTP " + res.statusCode + " for " + host));
             return;
           }
@@ -1005,7 +1005,7 @@ async function _dohRawQuery(host, qtype) {
       res.on("end", function () {
         try {
           if (pushFailed) { reject(pushFailed); return; }
-          if (res.statusCode !== 200) {                                          // HTTP 200 OK
+          if (res.statusCode !== C.HTTP.STATUS.OK) {                                          // HTTP 200 OK
             reject(new DnsError("dns/doh-http", "DoH HTTP " + res.statusCode + " for " + host));
             return;
           }