@blamejs/blamejs-shop 0.5.19 → 0.5.21

package/lib/vendor/blamejs/lib/request-helpers.js

@@ -43,6 +43,7 @@
 // values (RFC 9110), not byte sizes. Names are RFC 9110 reason phrases;
 // every consumer reads HTTP_STATUS.<NAME> rather than the underlying
 // integer, so the hex form is purely an internal storage detail.
+var C = require("./constants");
 var structuredFields = require("./structured-fields");
 var pick = require("./pick");
 var codepointClass = require("./codepoint-class");
@@ -245,8 +246,15 @@ function resolveActorWithOverride(callerOpts, baseOverride) {
  * for a security decision on an internet-facing listener. Prefer the
  * predicate form. Returns `null` when no address can be read — never throws.
  *
+ * `forwardedHeaders` names which header carries the address, in preference
+ * order — the first one PRESENT on the request is used (present rather than
+ * non-empty), and it defaults to
+ * `["x-forwarded-for"]`. It only has an effect alongside `trustProxy`; list
+ * only headers your proxy sets or overwrites (see `trustedClientIp`).
+ *
  * @opts
- *   trustProxy: boolean | number | function   // false (default) | predicate (peer-gated) | legacy true/hop-count
+ *   trustProxy:       boolean | number | function   // false (default) | predicate (peer-gated) | legacy true/hop-count
+ *   forwardedHeaders: string[]                      // header family, in order — default: ["x-forwarded-for"]
  *
  * @example
  *   var req = {
@@ -268,6 +276,52 @@ function resolveActorWithOverride(callerOpts, baseOverride) {
  *   b.requestHelpers.clientIp(undefined);
  *   // → null
  */
+// The forwarded-header family read when none is named. Unchanged default for
+// every caller: X-Forwarded-For alone.
+var DEFAULT_FORWARDED_HEADERS = Object.freeze(["x-forwarded-for"]);
+
+// RFC 9110 5.1 field-name = token. An operator writes these at config time, so
+// a typo (a stray space, a trailing colon copied out of a vendor doc) should
+// surface at construction rather than silently matching no header and reading
+// as "this deployment sends nothing".
+var FORWARDED_HEADER_NAME_RE  = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
+// Length is bounded before the pattern runs; no real field name approaches it.
+var MAX_FORWARDED_HEADER_NAME = 64;
+
+// Normalise an operator-declared forwarded-header family to lowercase — node
+// lowercases incoming header names, so a name written in the vendor's
+// documented casing (CF-Connecting-IP) has to fold or it matches nothing.
+function _normForwardedHeaders(value, where) {
+  if (value === undefined || value === null) return DEFAULT_FORWARDED_HEADERS;
+  if (!Array.isArray(value) || value.length === 0) {
+    throw new TypeError(where + ": forwardedHeaders must be a non-empty array of " +
+                        "header names, got " + JSON.stringify(value));
+  }
+  var out = [];
+  for (var i = 0; i < value.length; i++) {
+    var name = value[i];
+    var bounded = typeof name === "string" &&
+                  name.length > 0 && name.length <= MAX_FORWARDED_HEADER_NAME;
+    if (!bounded || !FORWARDED_HEADER_NAME_RE.test(name)) {
+      throw new TypeError(where + ": forwardedHeaders[" + i + "] is not a valid HTTP " +
+                          "field name, got " + JSON.stringify(name));
+    }
+    out.push(name.toLowerCase());
+  }
+  return out;
+}
+
+// The non-throwing counterpart for the per-request path: a malformed family
+// yields an EMPTY list, so no forwarded header is read and resolution falls
+// back to the socket address. Returning the default family instead would
+// honour X-Forwarded-For on a deployment whose operator asked for something
+// else, which is the wrong way to fail.
+function _normForwardedHeadersOrNone(value) {
+  if (value === undefined || value === null) return DEFAULT_FORWARDED_HEADERS;
+  try { return _normForwardedHeaders(value, "clientIp"); }
+  catch (_e) { return []; }
+}
+
 function clientIp(req, opts) {
   if (!req) return null;
   var socketAddr =
@@ -276,7 +330,30 @@ function clientIp(req, opts) {
     : null;
   var trust = opts && opts.trustProxy;
   if (trust && req.headers) {
-    var xff = req.headers["x-forwarded-for"];
+    // Which header carries the address is the operator's to declare; the trust
+    // decision below is not. The first header PRESENT on the request wins, so
+    // the order is the order they listed.
+    //
+    // This is a request-shape reader on the hot path, so a malformed family
+    // reads no forwarded header at all rather than throwing out of a live
+    // request — falling back to the socket address, the fail-closed direction.
+    // The construction-time path (`trustedClientIp`) is where a typo is a
+    // config mistake and is refused loudly.
+    var names = _normForwardedHeadersOrNone(opts && opts.forwardedHeaders);
+    var xff = null;
+    for (var n = 0; n < names.length; n++) {
+      var candidate = req.headers[names[n]];
+      // PRESENT decides, not non-empty. A header the operator listed first is
+      // the one they trust most; if their proxy set it and it came through
+      // empty, that says this request has no forwarded address — falling
+      // through to a lower-priority header would answer with one the client
+      // may have set instead, which is the wrong direction to resolve an
+      // ambiguity about who the caller is.
+      if (candidate !== undefined && candidate !== null) {
+        xff = candidate;
+        break;
+      }
+    }
     if (xff) {
       var hops = parseListHeader(xff);
       if (hops.length) {
@@ -333,17 +410,45 @@ function clientIp(req, opts) {
  * gate uses it to refuse a bare `trustProxy` at construction (fail closed).
  *
  * With `clientIpResolver(req)` the operator owns resolution entirely. With
- * `trustedProxies` (CIDRs of the reverse proxies), `X-Forwarded-For` is
+ * `trustedProxies` (CIDRs of the reverse proxies), the forwarded header is
  * honored only when the immediate peer is one of them. With neither, only
  * the socket address is used and forwarded headers are ignored.
  *
+ * `forwardedHeaders` names which header carries the address, in preference
+ * order — the first one PRESENT on the request is used, present rather than
+ * non-empty: a first-listed header that arrives empty says this request
+ * carries no forwarded address, rather than deferring to a lower-priority
+ * one the client may have set. It defaults to
+ * `["x-forwarded-for"]`. Cloudflare publishes the client address as
+ * `CF-Connecting-IP` and the common nginx recipe
+ * (`proxy_set_header X-Real-IP $remote_addr`) as `X-Real-IP`, so a deployment
+ * behind either had no way to use this resolver at all: reading the header
+ * directly drops the peer gate, and `clientIpResolver` hands back the whole
+ * trust decision — the CIDR matching, the IPv4-mapped-IPv6 folding — while
+ * still reporting `peerGated`. Every listed header is parsed the same way, so
+ * a single-address header is simply a one-hop chain.
+ *
+ * List ONLY headers your proxy sets or overwrites on every request. The peer
+ * gate proves the request arrived THROUGH your proxy; it cannot prove your
+ * proxy authored the header. A proxy that passes an unknown header through
+ * unchanged lets a client inject it, and naming that header here would honor
+ * the injected value — which is why the default stays the single header the
+ * chain walk was designed for.
+ *
  * @opts
- *   trustedProxies:   string | string[],          // CIDRs — peer-gate X-Forwarded-For
+ *   trustedProxies:   string | string[],          // CIDRs — peer-gate the forwarded header
+ *   forwardedHeaders: string[],                    // header family, in order — default: ["x-forwarded-for"]
  *   clientIpResolver: function(req): string|null,  // own resolution entirely
  *
  * @example
  *   var tip = b.requestHelpers.trustedClientIp({ trustedProxies: ["10.0.0.0/8"] });
  *   var ip  = tip.resolve(req);   // peer-gated; forged XFF from a direct caller ignored
+ *
+ *   var cf = b.requestHelpers.trustedClientIp({
+ *     trustedProxies:   ["10.0.0.0/8"],
+ *     forwardedHeaders: ["cf-connecting-ip"],
+ *   });
+ *   cf.resolve(req);              // same gate, the header the edge actually sets
  */
 // Build the trusted-proxy predicate shared by trustedClientIp / trustedProtocol.
 // Validates each CIDR (a CIDR is valid iff it contains its own network address,
@@ -387,11 +492,15 @@ function trustedClientIp(opts) {
     throw new TypeError("trustedClientIp: clientIpResolver must be a function(req) => ip|null");
   }
   var predicate = _trustedProxyPredicate(_normTrustedProxies(opts), "trustedClientIp");
+  // Validated whether or not a peer gate is configured — a malformed family is
+  // an operator typo either way, and it should not wait for the deployment
+  // that finally turns the gate on to surface.
+  var forwardedHeaders = _normForwardedHeaders(opts.forwardedHeaders, "trustedClientIp");
   return {
     peerGated: !!(resolver || predicate),
     resolve: function (req) {
       if (resolver) return resolver(req);
-      if (predicate) return clientIp(req, { trustProxy: predicate });
+      if (predicate) return clientIp(req, { trustProxy: predicate, forwardedHeaders: forwardedHeaders });
       return clientIp(req, { trustProxy: false });
     },
   };
@@ -1480,7 +1589,74 @@ function makeResourceAuditEmitter(sink, resourceKind, idFor) {
   };
 }
 
+/**
+ * @primitive b.requestHelpers.failAfterHeaders
+ * @signature b.requestHelpers.failAfterHeaders(res)
+ * @since     0.18.19
+ * @status    stable
+ * @related   b.render.stream, b.errorPage.create
+ *
+ * End a response that has already sent its status line, in a way that tells the
+ * client the transfer is incomplete. Returns `true` when it handled the
+ * response, `false` when the caller still owns it and can write a normal error.
+ *
+ * Once the headers are on the wire they cannot be replaced, and every attempt
+ * to do so makes things worse rather than better: `writeHead` throws
+ * `ERR_HTTP_HEADERS_SENT`, and a caller that catches that and falls back to
+ * `res.end("Internal Server Error")` appends those words to whatever partial
+ * body the client already has. The client then sees a 200 with a plausible
+ * final row. Silent truncation presented as success is a data-integrity
+ * failure, so the honest signal is an incomplete transfer.
+ *
+ * Which signal that is depends on the protocol, which is why this is one
+ * primitive rather than a line repeated at each error path:
+ *
+ * - **HTTP/1.1** — destroy the socket, so a chunked response ends without its
+ *   terminating chunk and the client reports a failed download.
+ * - **HTTP/2** — destroying with no argument closes the stream with
+ *   `RST_STREAM(NO_ERROR)`, which a client reads as a clean end: the truncated
+ *   body arrives as a complete 200. The stream is closed with
+ *   `INTERNAL_ERROR` instead so the failure survives the protocol.
+ * - **A response that cannot carry a body** — HEAD, 204, 304 — is already
+ *   complete once its headers are sent. There is nothing to truncate, so it is
+ *   ended normally; destroying would throw away a valid response.
+ *
+ * @example
+ *   if (!b.requestHelpers.failAfterHeaders(res)) {
+ *     b.render.json(res, { error: "internal" }, { status: 500 });
+ *   }
+ */
+var H2_INTERNAL_ERROR = 0x02;                                                    // RFC 9113 §7
+
+function failAfterHeaders(res) {
+  if (!res) return true;
+  if (res.writableEnded === true || res.destroyed === true) return true;
+  if (res.headersSent !== true) return false;                                    // the caller still owns it
+  try {
+    // A bodiless response is complete the moment its headers are sent, so
+    // there is nothing a truncation signal could mean — destroying one throws
+    // away a response that was whole. Which statuses those are is a rule of the
+    // protocol rather than of this function, so it is asked rather than
+    // restated; `_hasBody` covers the other case, a response to HEAD, which is
+    // a property of the REQUEST and so not something a status can answer.
+    if (res._hasBody === false ||
+        (typeof res.statusCode === "number" && C.HTTP.bodiless(res.statusCode))) {
+      if (typeof res.end === "function") res.end();
+      return true;
+    }
+    // HTTP/2: a bare destroy closes with NO_ERROR, which reads as a clean end.
+    if (res.stream && typeof res.stream.close === "function") {
+      res.stream.close(H2_INTERNAL_ERROR);
+      return true;
+    }
+    if (typeof res.destroy === "function") { res.destroy(); return true; }
+    if (typeof res.end === "function") res.end();
+  } catch (_e) { /* socket already gone */ }
+  return true;
+}
+
 module.exports = {
+  failAfterHeaders:          failAfterHeaders,
   resolveRoute:              resolveRoute,
   makeResourceAuditEmitter:  makeResourceAuditEmitter,
   makeSkipMatcher:           makeSkipMatcher,

package/lib/vendor/blamejs/lib/router.js

@@ -56,6 +56,10 @@ var audit = lazyRequire(function () { return require("./audit"); });
 // the operator's `b.compliance.set(...)` runs; the posture lookup only
 // matters at listen() time, well after boot finishes.
 var compliance = lazyRequire(function () { return require("./compliance"); });
+// network-tls — lazy for the same reason as compliance: it is only consulted
+// at listen() time, and loading the trust store during router's own require
+// would pull it in on every boot that never serves TLS.
+var networkTls = lazyRequire(function () { return require("./network-tls"); });
 
 var log = boot("router");
 var HTTP_STATUS = requestHelpers.HTTP_STATUS;
@@ -67,6 +71,18 @@ var HTTP_STATUS = requestHelpers.HTTP_STATUS;
 // even when Node's nghttp2 vendor lags the upstream fix: tag every
 // session with `_blamejsGoawaySent` on the framework's GOAWAY emission,
 // and force-destroy on any subsequent frame activity.
+// The last thing a request handler can do when everything above it has failed.
+// Writing a status is only possible while the headers are still ours; past
+// that, the honest answer is an incomplete transfer, which failAfterHeaders
+// produces correctly for HTTP/1.1, HTTP/2 and bodiless responses alike.
+function _lastResortError(res) {
+  try {
+    if (requestHelpers.failAfterHeaders(res)) return;
+    res.writeHead(HTTP_STATUS.INTERNAL_SERVER_ERROR, { "Content-Type": "text/plain" });
+    res.end("Internal Server Error");
+  } catch (_e) { /* the connection is already gone; nothing left to say */ }
+}
+
 var WINDOW_UPDATE_FRAME_TYPE = 0x8;                                              // RFC 7540 §6.9 frame type
 // Per-stream WINDOW_UPDATE rate cap. Above this rate the framework
 // destroys the stream; legitimate clients never burst this fast on a
@@ -971,7 +987,7 @@ class Router {
           metadata: { reason: "posture-refuse", method: req.method, url: req.url },
         });
       } catch (_e) { /* audit best-effort */ }
-      return { status: 425, reason: "early-data-refused" };
+      return { status: C.HTTP.STATUS.TOO_EARLY, reason: "early-data-refused" };
     }
     // posture === "replay-cache" — dedupe by SHA3-512 within the rolling
     // window. Hash inputs (method + url + Host + Authorization + bound
@@ -999,7 +1015,7 @@ class Router {
                       windowMs: TLS_0RTT_REPLAY_WINDOW_MS },
         });
       } catch (_e) { /* audit best-effort */ }
-      return { status: 425, reason: "early-data-replay" };
+      return { status: C.HTTP.STATUS.TOO_EARLY, reason: "early-data-replay" };
     }
     // Bounded entry count — when the cache hits the cap, drop the
     // oldest entries to make room. The reap pass already ran above.
@@ -1041,7 +1057,7 @@ class Router {
       if (verdict0Rtt) {
         // RFC 8470 §5 — 425 Too Early. Connection: close so the peer
         // cannot reuse the session ticket on the next attempt.
-        res.writeHead(425, {
+        res.writeHead(C.HTTP.STATUS.TOO_EARLY, {
           "Content-Type": "text/plain; charset=utf-8",
           "Connection":   "close",
         });
@@ -1094,7 +1110,7 @@ class Router {
         if (url.charAt(0) === "/" &&
             url.charAt(1) !== "/" && url.charAt(1) !== "\\") {
           // 302 Found — RFC 7231 §6.4.3. Not in HTTP_STATUS table.
-          res.writeHead(302, { Location: url });
+          res.writeHead(C.HTTP.STATUS.FOUND, { Location: url });
           res.end();
           return;
         }
@@ -1153,7 +1169,7 @@ class Router {
             metadata: { target: url, origin: targetOrigin },
           });
         } catch (_e) { /* audit best-effort */ }
-        res.writeHead(302, { Location: url });
+        res.writeHead(C.HTTP.STATUS.FOUND, { Location: url });
         res.end();
       };
       res.status = (code) => {
@@ -1164,16 +1180,18 @@ class Router {
       self.handle(req, res).catch((err) => {
         log.error("route error: " + req.method + " " + req.url + " " + err.message + " " +
           (err.stack ? err.stack.split("\n").slice(0, 5).join(" | ") : ""));
+        // `writableEnded` is false for a response that is mid-body, so this
+        // fallback used to call writeHead on a response whose headers were
+        // already sent. That throws ERR_HTTP_HEADERS_SENT — from inside this
+        // .catch, where nothing handles it — and the unhandled rejection takes
+        // the whole process down, along with every other in-flight request.
+        // One route whose producer fails after the first byte was enough.
         if (self.errorHandler) {
           try { self.errorHandler(err, req, res); } catch (_) {
-            if (!res.writableEnded) {
-              res.writeHead(HTTP_STATUS.INTERNAL_SERVER_ERROR, { "Content-Type": "text/plain" });
-              res.end("Internal Server Error");
-            }
+            _lastResortError(res);
           }
-        } else if (!res.writableEnded) {
-          res.writeHead(HTTP_STATUS.INTERNAL_SERVER_ERROR, { "Content-Type": "text/plain" });
-          res.end("Internal Server Error");
+        } else {
+          _lastResortError(res);
         }
       });
     };
@@ -1262,7 +1280,13 @@ class Router {
       // an empty list — Node rejects an unknown option, and "no algorithms"
       // and "extension disabled" are the same wire behaviour anyway.
       if (certCompression.length > 0) h2Defaults.certificateCompression = certCompression;
-      server = http2.createSecureServer(Object.assign(h2Defaults, tlsOptions), requestHandler);
+      // An operator serving legacy clients caps the listener below TLS 1.3;
+      // certificate compression is a TLS 1.3 extension and Node refuses the
+      // whole options object rather than ignoring it, so the listener would
+      // die at bind over an option they never asked for.
+      var h2Opts = networkTls()._stripUnreachableCertCompression(
+        Object.assign(h2Defaults, tlsOptions), tlsOptions);
+      server = http2.createSecureServer(h2Opts, requestHandler);
 
       // CVE-2026-21714 — H/2 WINDOW_UPDATE leak after GOAWAY. nghttp2
       // holds per-stream flow-control state after GOAWAY; late-arriving

package/lib/vendor/blamejs/lib/safe-async.js

@@ -245,6 +245,147 @@ function withSignal(promise, signal) {
 // exits even with pending awaits — the unref'd timer is not enough to
 // hold the loop alive, so the awaiting promise never resolves.)
 //
+/**
+ * @primitive b.safeAsync.writeChunk
+ * @signature b.safeAsync.writeChunk(writable, chunk)
+ * @since     0.18.19
+ * @status    stable
+ * @related   b.render.stream, b.safeAsync.safeAwait
+ *
+ * Write one chunk to a `Writable` and resolve when it has been accepted,
+ * waiting for `'drain'` when the stream says it is full.
+ *
+ * `write()` returning `false` is easy to discard, and nothing appears to break
+ * when you do: a local client drains instantly, so the queue never grows in
+ * testing. Under a slow client Node keeps buffering in memory and a
+ * deliberately bounded-memory export becomes unbounded.
+ *
+ * Waiting is not enough on its own, either. A closed socket never emits
+ * `'drain'`, so a loop that always awaits it hangs the request forever — this
+ * settles on `'error'` and `'close'` as well, so a disconnected peer rejects
+ * rather than stalls. Every listener it adds is removed on the way out,
+ * whichever event wins.
+ *
+ * @example
+ *   for await (var row of rows) {
+ *     await b.safeAsync.writeChunk(res, row + "\n");
+ *   }
+ */
+function _swallow() {}
+
+// Does this sink report the outcome of a write through the callback the stream
+// contract gives it? Asked of the object, not of how its `write` happens to be
+// declared — a wrapper written as `write(chunk, ...args)` supports the callback
+// exactly as one written out in full does, and counting parameters would say
+// otherwise. Every Node writable and every HTTP response carries the buffered
+// length; a hand-rolled response double does not, and is answered on the spot.
+function _reportsCompletion(writable) {
+  if (!writable || typeof writable.write !== "function") return false;
+  return writable.writableLength !== undefined || typeof writable._write === "function";
+}
+
+// Take delivery of the ONE `error` a failing sink is about to emit, and only
+// when nothing else is listening for it — a caller with its own handler keeps
+// seeing it, and an unrelated error later still surfaces.
+function _absorbOneError(writable) {
+  if (!writable || typeof writable.once !== "function" ||
+      typeof writable.removeListener !== "function") return;
+  if (typeof writable.listenerCount === "function" &&
+      writable.listenerCount("error") > 0) return;
+  writable.once("error", _swallow);
+  setImmediate(function () { writable.removeListener("error", _swallow); });
+}
+
+function writeChunk(writable, chunk) {
+  return new Promise(function (resolve, reject) {
+    if (!writable || typeof writable.write !== "function") {
+      reject(new SafeAsyncError(
+        "safeAsync.writeChunk: expected a writable with a write() method",
+        "async/bad-writable"));
+      return;
+    }
+    // Already gone before the call. `close` is one-shot, so a listener
+    // attached now would never fire; `write()` on a destroyed stream returns
+    // false without re-emitting `error`; and `drain` never comes. Every one of
+    // those is a wait that outlives the request — the archive writer pinned a
+    // handler, its entry list and its source streams for the life of the
+    // process this way, against a client that had already hung up.
+    if (writable.destroyed === true || writable.closed === true ||
+        writable.writableEnded === true) {
+      reject(new SafeAsyncError(
+        "safeAsync.writeChunk: the stream was already closed",
+        "async/writable-closed"));
+      return;
+    }
+    var settled = false;
+    function done(err, absorbFollowingError) {
+      if (settled) return;
+      settled = true;
+      if (typeof writable.removeListener === "function") {
+        writable.removeListener("drain", onDrain);
+        writable.removeListener("error", onError);
+        writable.removeListener("close", onClose);
+      }
+      if (err) {
+        // Only when the sink told us through the write callback: it emits its
+        // own `error` right afterwards, and with nobody else listening that
+        // event ends the process — though the failure is already on its way to
+        // the caller through this promise. When the failure ARRIVED as an
+        // `error` event there is no second one coming, and arming for one would
+        // swallow an unrelated failure that happened to follow it.
+        if (absorbFollowingError) _absorbOneError(writable);
+        reject(err);
+        return;
+      }
+      resolve();
+    }
+    function onDrain() { done(null); }
+    function onError(e) { done(e); }
+    function onClose() {
+      done(new SafeAsyncError(
+        "safeAsync.writeChunk: the stream closed before it drained",
+        "async/writable-closed"));
+    }
+    // A stream that took the chunk has not necessarily written it. `write()`
+    // returning true only means there is room for more; the sink reports the
+    // outcome through the callback, and a failure there arrives as an `error`
+    // event afterwards. Resolving on the return value alone dropped every
+    // listener before that event, leaving it unhandled — which by default ends
+    // the process, so an archive whose destination failed part-way through
+    // took the server down instead of failing the download.
+    // A sink may answer before `write()` has even returned, and until it does
+    // there is no telling whether there is room for more. So a callback that
+    // arrives first is remembered and read below — settling on it here would
+    // resolve a write that still owes a `drain`, and leave every listener
+    // attached afterwards with nothing left to remove them.
+    var accepted;
+    var writeReturned = false;
+    var answered = false;
+    var answeredWith = null;
+    var reportsCompletion = _reportsCompletion(writable);
+    function onWritten(err) {
+      answered = true;
+      answeredWith = err || null;
+      if (!writeReturned) return;
+      if (err) { done(err, true); return; }
+      if (accepted !== false) done(null);                  // written, and there is room
+    }
+    try {
+      accepted = reportsCompletion ? writable.write(chunk, onWritten) : writable.write(chunk);
+    } catch (e) { done(e); return; }
+    writeReturned = true;
+    if (answered) {
+      if (answeredWith) { done(answeredWith, true); return; }
+      if (accepted !== false) { done(null); return; }      // otherwise a drain is still owed
+    }
+    if (typeof writable.once !== "function") { done(null); return; }
+    if (accepted !== false && !reportsCompletion) { done(null); return; }
+    writable.once("error", onError);
+    writable.once("close", onClose);
+    if (accepted === false) writable.once("drain", onDrain);
+  });
+}
+
 // ms <= 0 resolves immediately (matches setTimeout's clamp-to-1ms but
 // without the wasted tick). Non-finite ms rejects.
 
@@ -1662,6 +1803,7 @@ var CircuitBreaker = retryHelper.CircuitBreaker;
 module.exports = {
   withTimeout:        withTimeout,
   withSignal:         withSignal,
+  writeChunk:         writeChunk,
   withTimeoutSignal:  withTimeoutSignal,
   sleep:              sleep,
   repeating:          repeating,

package/lib/vendor/blamejs/lib/safe-icap.js

@@ -460,6 +460,9 @@ function _detectThreat(statusCode, headers) {
   // hit, or 200 + the modified-message with X-Infection-Found set.
   var found = false;
   var name;
+  // Deliberately the number: an ICAP status line carries ICAP's own codes,
+  // which merely look like HTTP's. Naming this through C.HTTP.STATUS would say
+  // "HTTP" about a protocol that is not HTTP.
   if (statusCode === 403) found = true;
   var inf = _firstHeader(headers["x-infection-found"]);
   if (typeof inf === "string" && inf.length > 0) {

package/lib/vendor/blamejs/lib/safe-sql.js

@@ -222,7 +222,7 @@ function quoteIdentifier(name, dialect, opts) {
 
 /**
  * @primitive b.safeSql.quoteQualified
- * @signature b.safeSql.quoteQualified(parts, dialect?)
+ * @signature b.safeSql.quoteQualified(parts, dialect?, opts?)
  * @since     0.1.0
  * @status    stable
  * @related   b.safeSql.quoteIdentifier, b.safeSql.validateIdentifier
@@ -235,6 +235,18 @@ function quoteIdentifier(name, dialect, opts) {
  * usually-nonexistent object). Accepts an array of parts OR a
  * dot-separated string.
  *
+ * `opts` is forwarded to `quoteIdentifier` for every segment, so
+ * `{ allowReserved: true }` reaches a qualified name the same way it
+ * reaches a bare one. Without it this was the stricter of the two
+ * siblings with no way to opt out, and a view in a schema legitimately
+ * named after a keyword was refused here while `b.db.from()` queried
+ * it.
+ *
+ * @opts
+ *   allowReserved:  boolean,   // default: false — permit SQL-keyword names in
+ *                              // ANY segment (safe once quoted); forwarded to
+ *                              // quoteIdentifier for each one
+ *
  * @example
  *   var b = require("blamejs");
  *   b.safeSql.quoteQualified(["public", "users"]);
@@ -249,7 +261,7 @@ function quoteIdentifier(name, dialect, opts) {
  *   b.safeSql.quoteQualified(["app", "orders"], "mysql");
  *   // → "`app`.`orders`"
  */
-function quoteQualified(parts, dialect) {
+function quoteQualified(parts, dialect, opts) {
   var arr;
   if (typeof parts === "string") {
     if (parts.length === 0) {
@@ -269,7 +281,7 @@ function quoteQualified(parts, dialect) {
   }
   var quoted = [];
   for (var i = 0; i < arr.length; i++) {
-    quoted.push(quoteIdentifier(arr[i], dialect));
+    quoted.push(quoteIdentifier(arr[i], dialect, opts));
   }
   return quoted.join(".");
 }

package/lib/vendor/blamejs/lib/self-update.js

@@ -526,7 +526,7 @@ async function poll(opts) {
       "selfUpdate.poll: request failed: " + ((e && e.message) || String(e)));
   }
 
-  if (res.statusCode === 304) {                                                    // HTTP status code (RFC 7232), not bytes
+  if (res.statusCode === C.HTTP.STATUS.NOT_MODIFIED) {                                                    // HTTP status code (RFC 7232), not bytes
     _safeAuditEmit("selfupdate.poll.checked", "success", {
       releasesUrl:    opts.releasesUrl,
       currentVersion: opts.currentVersion,
@@ -534,7 +534,7 @@ async function poll(opts) {
       etagHit:        true,
     });
     return { available: false, latestTag: null, currentVersion: opts.currentVersion,
-             asset: null, signature: null, etag: opts.etag, statusCode: 304 };    // HTTP status code (RFC 7232), not bytes
+             asset: null, signature: null, etag: opts.etag, statusCode: C.HTTP.STATUS.NOT_MODIFIED };    // HTTP status code (RFC 7232), not bytes
   }
   if (res.statusCode < 200 || res.statusCode >= 300) {
     _safeAuditEmit("selfupdate.poll.checked", "denied", {