@blamejs/core 0.14.4 → 0.14.6

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.14.x
 
+- v0.14.6 (2026-05-30) — **Access-refusal middleware can return RFC 9457 problem+json or a custom response, and several documented-but-uncallable APIs are now reachable.** Every access-refusal middleware — the auth gates (bearer, DPoP, mTLS, AAL, bound-key), CSRF, CORS, rate-limit, bot-guard, age-gate, the host and network allowlists, and the method and content-type gates — now accepts two uniform options: `problemDetails: true` returns an RFC 9457 `application/problem+json` body, and `onDeny(req, res, info)` hands the response to the caller. With neither set the refusal is byte-for-byte what it was, so this is a drop-in change that lets a service standardize one error envelope across its API instead of working around each middleware's hardcoded body. Alongside that: `b.middleware.requireBoundKey` is now exported (it was documented and tested but never wired into the middleware surface), `b.middleware.bearerAuth` accepts `requiredScopes` (previously rejected at construction, which made its scope-enforcement path unreachable), API-key refusals send the RFC 6750 challenge code that matches the failure, two documented call paths that named a missing namespace segment are corrected, and the release flow now flags stale GitHub Actions and vendored bundles — with a ready-to-paste pin — before a dependency PR is needed. **Added:** *Uniform `onDeny` and `problemDetails` options on every access-refusal middleware* — Each request-lifecycle middleware that refuses a request now takes `problemDetails: true` to emit an RFC 9457 `application/problem+json` body (composing `b.problemDetails`) and `onDeny(req, res, info)` to take over the response entirely; `info` carries the status, a machine reason, and the middleware-specific fields. The deny-path response headers (`Allow`, `WWW-Authenticate`, `Retry-After`, `Accept`) survive every mode. When neither option is set the response is unchanged. Covers `requireAuth`, `requireAal`, `requireMethods`, `requireContentType`, `requireMtls`, `requireBoundKey`, `bearerAuth`, `dpop`, `csrfProtect`, `fetchMetadata`, `botGuard`, `ageGate`, `hostAllowlist`, `networkAllowlist`, `cors`, `rateLimit`, and `dailyByteQuota` (whose existing `onExceeded` keeps working as an alias of `onDeny`). **Fixed:** *`b.middleware.requireBoundKey` is now callable* — The Bearer-API-key middleware was documented (with examples and tests) but never exported on `b.middleware`, so `b.middleware.requireBoundKey(...)` threw `undefined is not a function`. It is now wired into the middleware surface. · *`b.middleware.bearerAuth` accepts `requiredScopes`* — The RFC 6750 scope-enforcement path read `opts.requiredScopes`, but the option was rejected at construction with `unknown option`, making the 403 `insufficient_scope` behavior unreachable. `requiredScopes` is now an accepted option. · *RFC 6750 challenge codes on API-key refusals* — `b.middleware.requireBoundKey` now sends the `WWW-Authenticate` error code that matches the failure: `insufficient_scope` on a 403 missing-scope, `invalid_token` on an unknown or revoked token, and no error code on a 401 that presented no credentials (RFC 6750 §3). It previously sent `invalid_request` for every refusal. · *Corrected two documented call paths* — The compliance and network references named a path that dropped a namespace segment: the conformity-assessment scaffold is at `b.cra.report.conformityAssessment` (not `b.cra.conformityAssessment`), and the per-socket tuning helper is at `b.network.socket.applyToSocket` (not `b.network.applyToSocket`). The documented signatures now match the callable paths. · *GitHub Actions pins refreshed* — `github/codeql-action` 4.35.5 to 4.36.0, and `docker/login-action`, `docker/setup-buildx-action`, and `docker/setup-qemu-action` to their latest releases. **Detectors:** *`@primitive` reachability gate* — A new check resolves every documented `b.X.Y` primitive against the actual public surface and fails the build when a documented path is not callable (factory-instance shorthands excluded). This is the gate that would have caught the `requireBoundKey` and call-path issues above. · *Deny-path composition gate* — A new check requires every access-refusal middleware to route its refusal through the shared deny-response writer, so a future middleware cannot reintroduce a hardcoded body that locks callers out of `onDeny` / `problemDetails`. · *Actions and vendor currency in the release flow* — The release flow now fails the cut when a SHA-pinned GitHub Action or a vendored bundle is behind its latest upstream release. The actions report prints a ready-to-paste `owner/repo@<sha>  # vX.Y.Z` pin and every file and line that uses it, so the bump is copy-paste rather than an after-the-fact dependency PR. Transient registry or API errors stay advisory so a flaky network response does not block an unrelated release.
+
+- v0.14.5 (2026-05-30) — **Finished cleaning up the mislabeled byte-literal lint suppressions, with no API or behavior changes.** A follow-up to the byte-literal lint tightening. The remaining suppression comments that named the byte-literal check on values that are not byte sizes — JSON-RPC error codes, HTTP status codes, octet ranges, day-in-milliseconds constants — are removed, keeping their explanatory text and any correctly-named companion suppression. Every byte-literal suppression that remains is now on genuine 1024-scale byte arithmetic. Source-comment hygiene only. **Changed:** *Remaining mislabeled byte-literal suppressions removed* — The byte-literal lint was previously a check on any multiple-of-8 integer, so suppression comments naming it were scattered across non-byte values. The last of those (in a handful of files, in mixed comment formats) are now removed — their explanatory text is retained as plain comments, and any correctly-named companion suppression is kept. The only byte-literal suppressions that remain are on genuine 1024-scale byte arithmetic. No change to any exported API, error code, wire format, or runtime behavior.
+
 - v0.14.4 (2026-05-30) — **Removed three pieces of dead code from the SAML, TLS, and JMAP surfaces; no API or behavior changes.** Cleanup of unreachable code. A reverse signature-algorithm lookup in the SAML verifier was never called — the actual verification path resolves the algorithm through the supported-signature table — so it is removed and a stale comment that referenced it is corrected. A leftover no-op placeholder in the TLS certificate re-encode path (a zero-length slice that was assigned and discarded) is removed, leaving the verbatim extension re-encode it sat next to. An unused JMAP well-known-path constant that existed only to be discarded is removed. None of this changes any exported API, error code, wire format, or runtime behavior. **Removed:** *Unreachable code in SAML, TLS, and JMAP* — Removed `_sigAlgFromUri` from the SAML module (a reverse alg lookup that was never called — the embedded XML-DSig verifier resolves the algorithm via the supported-signature table, and the redirect-binding path uses the forward `_sigAlgUrn`), a discarded zero-length-slice placeholder in the TLS certificate extension re-encode path, and an unused well-known-path constant in the JMAP server. Internal cleanup only — no change to any exported API, error code, wire format, or runtime behavior.
 
 - v0.14.3 (2026-05-30) — **A codebase check now ensures every lint-suppression marker names a real check, so a typo can't silently disable a guard.** Source files suppress an individual lint with an `// allow:<class>` comment. If the class is mistyped or stale, the comment suppresses nothing — the check it names does not exist — so the issue it was meant to explain ships unflagged. A new codebase check now verifies every `// allow:<class>` marker names a registered check class and fails if it does not, with the full set of valid classes maintained as an explicit registry. Two markers that named a non-kebab class were corrected as part of this. No runtime, API, or wire-format changes. **Detectors:** *Lint-suppression markers must name a registered check* — A new check flags any `// allow:<class>` suppression comment whose class is not one of the registered check classes — catching typos and stale markers (for example a marker that named a check which was later renamed) that would otherwise silently disable the guard they appear to explain. The valid classes are kept as an explicit registry, so adding a check with a new allow-class is a one-line registration. Source-comment hygiene only — no change to any exported API, error code, wire format, or runtime behavior.

package/README.md

@@ -129,6 +129,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
   - CSRF protection — double-submit cookie + Origin/Referer cross-check; auto-skips Authorization-header / cookieless requests, which are not CSRF-able (`b.middleware.csrfProtect`)
   - CORS (W3C Private Network Access preflight refusal default + `allowPrivateNetwork` opt) and rate-limit are wired when configured via `middleware.cors` / `middleware.rateLimit`
   - `Cache-Control: no-store` on every 401 from `requireAuth` / `requireAal` / `requireStepUp` per RFC 9111 §5.2.2.5
+  - Every access-refusal layer takes a uniform `problemDetails: true` for an RFC 9457 `application/problem+json` body or `onDeny(req, res, info)` to render the refusal itself — so a service can standardize one error envelope across its API without working around hardcoded bodies (`b.problemDetails`)
 - **Additional middleware** to mount in your `routes` callback: compression, SSE, request logging, request-time DB role binding (`b.middleware.dbRoleFor`), in-process CIDR fence (`b.middleware.networkAllowlist`)
 - **Outbound HTTP client** — HTTP/1.1 + HTTP/2 with SSRF gate (cloud-metadata IPs hard-denied; private / loopback / link-local overridable per call); scheme + userinfo + per-host destination allowlist; redirects, multipart, interceptors, progress, encrypted cookie jar (`b.httpClient`, `b.ssrfGuard`, `b.safeUrl`)
 - **Network configurability (`b.network`)** — env-driven NTP / NTS (RFC 8915), IPv4/IPv6 NTP, DNS with IPv6 / DoH / DoT (private-CA pinning) / cache / lookup timeout; local DNSSEC signature verification (RFC 4035 — `b.network.dns.dnssec.verifyRrset` over a canonicalised RRset against RSA / ECDSA P-256·P-384 / Ed25519 DNSKEYs, plus DS-digest + key-tag, plus `verifyDenial` for NSEC / NSEC3 (RFC 5155) NXDOMAIN / NODATA proofs with iteration caps + Opt-Out handling, plus `verifyChain` to validate a full root→TLD→zone delegation chain against the pinned IANA root anchors) so a resolver client can verify both positive and negative answers instead of trusting the upstream AD bit; DANE / TLSA certificate matching (RFC 6698/7671 — `b.network.dns.dane.matchCertificate`) to pin a service's key through DNSSEC instead of a public CA; TSIG transaction signatures (RFC 8945 — `b.network.dns.tsig.sign` / `verify`) for shared-key HMAC authentication of zone transfers, dynamic updates, and query/response pairs, with constant-time MAC compare + fudge-window check (verified against dnspython); outbound HTTP proxy (`HTTP_PROXY` / `HTTPS_PROXY` / `NO_PROXY`); runtime DPI trust-store CA additions; application-level heartbeats; TCP socket defaults

package/lib/a2a-tasks.js

@@ -62,17 +62,17 @@ var A2aTasksError = defineClass("A2aTasksError", { alwaysPermanent: true });
 var JSONRPC_VERSION = "2.0";
 
 // JSON-RPC 2.0 fixed error codes — A2A inherits these.
-var JSONRPC_PARSE_ERROR      = -32700;                                                             // allow:raw-byte-literal — JSON-RPC fixed code / allow:raw-time-literal — not seconds
-var JSONRPC_INVALID_REQUEST  = -32600;                                                             // allow:raw-byte-literal — JSON-RPC fixed code / allow:raw-time-literal — not seconds
-var JSONRPC_METHOD_NOT_FOUND = -32601;                                                             // allow:raw-byte-literal — JSON-RPC fixed code / allow:raw-time-literal — not seconds
-var JSONRPC_INVALID_PARAMS   = -32602;                                                             // allow:raw-byte-literal — JSON-RPC fixed code / allow:raw-time-literal — not seconds
-var JSONRPC_INTERNAL_ERROR   = -32603;                                                             // allow:raw-byte-literal — JSON-RPC fixed code / allow:raw-time-literal — not seconds
+var JSONRPC_PARSE_ERROR      = -32700;                                                             // allow:raw-time-literal — not seconds
+var JSONRPC_INVALID_REQUEST  = -32600;                                                             // allow:raw-time-literal — not seconds
+var JSONRPC_METHOD_NOT_FOUND = -32601;                                                             // allow:raw-time-literal — not seconds
+var JSONRPC_INVALID_PARAMS   = -32602;                                                             // allow:raw-time-literal — not seconds
+var JSONRPC_INTERNAL_ERROR   = -32603;                                                             // allow:raw-time-literal — not seconds
 
 // A2A-specific error codes per the spec's task-error vocabulary.
 // A2A_TASK_NOT_FOUND (-32002) + A2A_TASK_NOT_CANCELABLE (-32003) are
 // raised by operator handlers — they're reserved here for documentation
 // purposes only.
-var A2A_SCOPE_DENIED         = -32001;                                                             // allow:raw-byte-literal — JSON-RPC server-error range / allow:raw-time-literal — not seconds
+var A2A_SCOPE_DENIED         = -32001;                                                             // allow:raw-time-literal — not seconds
 
 var ALLOWED_METHODS = Object.freeze(["tasks/send", "tasks/get", "tasks/cancel"]);
 

package/lib/ai-input.js

@@ -26,7 +26,7 @@ var audit = require("./audit");
 var { AiInputError } = require("./framework-error");
 
 var SAMPLE_TRUNC = 80;                                                                       // sample truncation length, not bytes
-var CONFIDENCE_BASE = 60;                                                                    // allow:raw-byte-literal — confidence percentage base / allow:raw-time-literal — not seconds
+var CONFIDENCE_BASE = 60;                                                                    // allow:raw-time-literal — not seconds
 
 var PATTERNS = [
   { id: "ignore-prior-instructions", severity: 3, re:

package/lib/auth/sd-jwt-vc.js

@@ -597,7 +597,7 @@ async function verify(presentation, opts) {
     }
     // Verify KB-JWT signature
     var kbHeaderObj;
-    try { kbHeaderObj = safeJson.parse(_b64uDecodeStr(maybeKbJwt.split(".")[0]), { maxBytes: 4096 }); }  // allow:bare-json-parse — kb header from validated KB-JWT; signature verifies // allow:raw-byte-literal — kb-header cap (4 KB)
+    try { kbHeaderObj = safeJson.parse(_b64uDecodeStr(maybeKbJwt.split(".")[0]), { maxBytes: 4096 }); }  // allow:bare-json-parse — kb header from validated KB-JWT; signature verifies
     catch (e) {
       throw new AuthError("auth-sd-jwt-vc/bad-kb-header",
         "verify: malformed KB-JWT header: " + e.message);

package/lib/calendar.js

@@ -99,7 +99,7 @@ var JSCAL_NOTE_STATUS = Object.freeze({
 // Recurrence-expansion caps. Mirror b.safeIcal's RRULE limits so the
 // expand path can't outpace what the parser already permitted.
 var MAX_EXPAND_INSTANCES = 4096;                                                                       // instance count cap, not bytes
-var MAX_EXPAND_SPAN_MS   = 10 * 365 * 24 * 60 * 60 * 1000;                                             // allow:raw-byte-literal + allow:raw-time-literal — 10 year max expansion span
+var MAX_EXPAND_SPAN_MS   = 10 * 365 * 24 * 60 * 60 * 1000;                                             // allow:raw-time-literal — 10 year max expansion span
 
 /**
  * @primitive b.calendar.validate
@@ -697,7 +697,7 @@ function _expandSingleRule(rule, startMs, ctx) {
   }
   var byHourSet   = _bySet(rule.byHour,   0, 23);                                                      // RFC 5545 hour range
   var byMinuteSet = _bySet(rule.byMinute, 0, 59);                                                      // RFC 5545 minute range
-  var bySecondSet = _bySet(rule.bySecond, 0, 60);                                                      // allow:raw-byte-literal — RFC 5545 second range incl. leap second // allow:raw-time-literal — second-of-minute bound, not a duration
+  var bySecondSet = _bySet(rule.bySecond, 0, 60);                                                      // allow:raw-time-literal — second-of-minute bound, not a duration
 
   function _isoWeekParts(d) {
     // ISO 8601 week-of-year + week-year. The week-YEAR can differ
@@ -709,7 +709,7 @@ function _expandSingleRule(rule, startMs, ctx) {
     tmp.setUTCDate(tmp.getUTCDate() + 4 - dayOfWeek);                                                  // ISO week-year anchor (Thursday)
     var weekYear = tmp.getUTCFullYear();
     var yearStart = new Date(Date.UTC(weekYear, 0, 1));
-    var week = Math.ceil((((tmp - yearStart) / 86400000) + 1) / 7);                                    // allow:raw-time-literal — 86400000 ms/day, 7 days/week // allow:raw-byte-literal
+    var week = Math.ceil((((tmp - yearStart) / 86400000) + 1) / 7);                                    // allow:raw-time-literal — 86400000 ms/day, 7 days/week
     return { week: week, year: weekYear };
   }
   function _isoWeekOf(d) {
@@ -717,7 +717,7 @@ function _expandSingleRule(rule, startMs, ctx) {
   }
   function _yearDayOf(d) {
     var startOfYear = new Date(Date.UTC(d.getUTCFullYear(), 0, 1));
-    return Math.floor((d - startOfYear) / 86400000) + 1;                                               // allow:raw-time-literal — 86400000 ms/day // allow:raw-byte-literal
+    return Math.floor((d - startOfYear) / 86400000) + 1;                                               // allow:raw-time-literal — 86400000 ms/day
   }
   function _daysInYear(year) {
     return ((year % 4 === 0 && year % 100 !== 0) || year % 400 === 0) ? 366 : 365;                      // Gregorian leap-year rule
@@ -869,7 +869,7 @@ function _expandWithBysetpos(ctx) {
       stepBudgetRef.remaining -= 1;
       var candidate = _withTimeOfDay(dayMs, hh, mm, ss, ms);
       if (matchesBy(candidate)) candidates.push(candidate);
-      dayMs += 86400000;                                                                               // allow:raw-time-literal — 86400000 ms/day step // allow:raw-byte-literal — same constant in ms/day form
+      dayMs += 86400000;                                                                               // allow:raw-time-literal — 86400000 ms/day step
     }
 
     // Sort + apply BYSETPOS. Positive index 1-based from start;
@@ -930,7 +930,7 @@ function _periodForIndex(freq, startDate, offset) {
   var dow = anchor.getUTCDay() || 7;
   anchor.setUTCDate(anchor.getUTCDate() - (dow - 1) + offset * 7);                                     // days/week
   var ws = anchor.getTime();
-  var we = ws + 7 * 86400000 - 1;                                                                      // allow:raw-byte-literal + allow:raw-time-literal — 7-day window
+  var we = ws + 7 * 86400000 - 1;                                                                      // allow:raw-time-literal — 7-day window
   return { startMs: ws, endMs: we };
 }
 

package/lib/content-credentials.js

@@ -590,7 +590,7 @@ var CAC_KIND_ENUM = Object.freeze({
   text: true, image: true, audio: true, video: true,
   "virtual-scene": true, other: true,
 });
-var CAC_USCC_RE = /^[0-9A-HJ-NPQRTUWXY]{18}$/;                                                  // allow:raw-byte-literal — GB 32100-2015 USCC fixed length, not bytes // allow:raw-time-literal — 18 is char-count of the credit code, not seconds
+var CAC_USCC_RE = /^[0-9A-HJ-NPQRTUWXY]{18}$/;                                                  // allow:raw-time-literal — 18 is char-count of the credit code, not seconds
 var ISO8601_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/;
 
 function cacImplicitLabel(opts) {
@@ -605,7 +605,7 @@ function cacImplicitLabel(opts) {
     throw new ContentCredentialsError("cac-implicit-label/oversize-provider-name",
       "cacImplicitLabel: providerName exceeds " + STR_LEN_MAX + " bytes (UTF-8)");
   }
-  if (typeof opts.providerCode !== "string" || opts.providerCode.length !== 18 ||                // allow:raw-byte-literal — USCC fixed length (GB 32100-2015), not bytes // allow:raw-time-literal — string length, not seconds
+  if (typeof opts.providerCode !== "string" || opts.providerCode.length !== 18 ||                // allow:raw-time-literal — string length, not seconds
       !CAC_USCC_RE.test(opts.providerCode)) {                                                    // allow:regex-no-length-cap — length-bounded immediately above
     throw new ContentCredentialsError("cac-implicit-label/bad-provider-code",
       "cacImplicitLabel: providerCode must be an 18-char unified social credit code " +

package/lib/cra-report.js

@@ -190,8 +190,8 @@ function create(opts) {
 }
 
 /**
- * @primitive b.cra.conformityAssessment
- * @signature b.cra.conformityAssessment(opts)
+ * @primitive b.cra.report.conformityAssessment
+ * @signature b.cra.report.conformityAssessment(opts)
  * @since     0.8.77
  *
  * EU Cyber Resilience Act (Regulation 2024/2847) — Annex VIII
@@ -223,7 +223,7 @@ function create(opts) {
  *   }
  *
  * @example
- *   var dossier = b.cra.conformityAssessment({
+ *   var dossier = b.cra.report.conformityAssessment({
  *     manufacturer: { name: "Acme Inc.", address: "1 St", contact: "ce@acme.example" },
  *     product:      { name: "Widget Pro", identifier: "WID-001", version: "1.0", description: "..." },
  *     classification: "default",

package/lib/guard-cidr.js

@@ -73,7 +73,7 @@ var IPV4_RESERVED = Object.freeze([
   { net: _ipv4ToUint32([127, 0, 0, 0]),      prefix: 8,  label: "loopback" },                    // IPv4 octets
   { net: _ipv4ToUint32([169, 254, 0, 0]),    prefix: 16, label: "link-local" },                  // IPv4 octets
   { net: _ipv4ToUint32([224, 0, 0, 0]),      prefix: 4,  label: "multicast" },                   // IPv4 octets
-  { net: _ipv4ToUint32([240, 0, 0, 0]),      prefix: 4,  label: "reserved-class-e" },            // allow:raw-byte-literal — IPv4 octets allow:raw-time-literal — 240 is an IPv4 octet not seconds
+  { net: _ipv4ToUint32([240, 0, 0, 0]),      prefix: 4,  label: "reserved-class-e" },            // allow:raw-time-literal — 240 is an IPv4 octet not seconds
   { net: _ipv4ToUint32([192, 0, 2, 0]),      prefix: 24, label: "documentation-test-net-1" },    // IPv4 octets
   { net: _ipv4ToUint32([198, 51, 100, 0]),   prefix: 24, label: "documentation-test-net-2" },    // IPv4 octets
   { net: _ipv4ToUint32([203, 0, 113, 0]),    prefix: 24, label: "documentation-test-net-3" },    // IPv4 octets

package/lib/http-client-cache.js

@@ -66,7 +66,7 @@ var HEURISTIC_MAX_AGE_MS = C.TIME.hours(24);
 // Statuses RFC 9110 designates as heuristically cacheable. (Plus 200/206
 // which are universally cacheable when a freshness lifetime is given.)
 var CACHEABLE_STATUSES = new Set([
-  200, 203, 204, 206, 300, 301, 308, 404, 405, 410, 414, 501,                                  // allow:raw-byte-literal — HTTP status codes per RFC 9110 / allow:raw-time-literal — same line, status codes not seconds
+  200, 203, 204, 206, 300, 301, 308, 404, 405, 410, 414, 501,                                  // allow:raw-time-literal — same line, status codes not seconds
 ]);
 
 // Headers that MUST not be forwarded when serving a 304-updated entry.

package/lib/mail-auth.js

@@ -1476,7 +1476,7 @@ async function _verifyAmsViaDkim(rfc822, hop, sigValue, tags, dkim, dnsLookup) {
 
 function _parseArcTagList(value) {
   var tags = {};
-  var parts = String(value).split(";");                                                          // allow:bare-split-on-quoted-header — allow:raw-byte-literal — RFC 8617 §4 ARC tag-list grammar (same as the DKIM RFC's): `tag-spec *( ";" tag-spec )`, tag-value contains no DQUOTE
+  var parts = String(value).split(";");                                                          // allow:bare-split-on-quoted-header — RFC 8617 §4 ARC tag-list grammar (same as the DKIM RFC's): `tag-spec *( ";" tag-spec )`, tag-value contains no DQUOTE
 
   for (var i = 0; i < parts.length; i += 1) {
     var p = parts[i].trim();

package/lib/mail-crypto-smime.js

@@ -754,7 +754,7 @@ function checkCert(opts) {
   if (pub && pub.asymmetricKeyType === "rsa") {
     var jwk = pub.export({ format: "jwk" });
     var nBytes = Buffer.from(jwk.n, "base64url");
-    var bits = nBytes.length * 8;                                                                     // allow:raw-byte-literal — bits-per-byte conversion // allow:raw-time-literal — RFC 5280 in comment, not seconds
+    var bits = nBytes.length * 8;                                                                     // allow:raw-time-literal — RFC 5280 in comment, not seconds
     if (bits < RSA_MIN_BITS) {
       throw new MailCryptoError("mail-crypto/smime/rsa-too-small",
         "cert public key is " + bits + " RSA bits; minimum is " + RSA_MIN_BITS +

package/lib/mail-deploy.js

@@ -155,7 +155,7 @@ function mtaStsPublish(opts) {
     throw new MailDeployError("mail-deploy/bad-max-age",
       "mtaStsPublish: opts.maxAgeSec must be a positive integer");
   }
-  if (opts.maxAgeSec > 31557600) {                                                                    // allow:raw-time-literal — 1 year in seconds (RFC 8461 §3.2 max_age unit) // allow:raw-byte-literal — same numeric, no byte semantic
+  if (opts.maxAgeSec > 31557600) {                                                                    // allow:raw-time-literal — 1 year in seconds (RFC 8461 §3.2 max_age unit)
     throw new MailDeployError("mail-deploy/bad-max-age",
       "mtaStsPublish: opts.maxAgeSec exceeds 1 year (RFC 8461 §3.2 SHOULD ≤ 31557600)");
   }

package/lib/mail-dkim.js

@@ -950,7 +950,7 @@ async function verify(rfc822, opts) {
       // Allow up to 24h future-skew; beyond that, refuse — neither
       // operator clock drift nor delivery latency explains a future-
       // dated signing time of more than a day.
-      if (isFinite(tSec) && tSec - (24 * 60 * 60) > nowSec) {                                  // allow:raw-byte-literal — Unix-seconds offset, not bytes / allow:raw-time-literal — 24h future-date sanity ceiling
+      if (isFinite(tSec) && tSec - (24 * 60 * 60) > nowSec) {                                  // allow:raw-time-literal — 24h future-date sanity ceiling
         results.push({ d: d || null, s: s || null, alg: alg || null,
           result: "permerror",
           errors: ["DKIM-Signature t=" + tSec + " is more than 24h in the future (RFC 6376 §3.5 sanity)"] });

package/lib/mail-server-jmap.js

@@ -595,7 +595,7 @@ function create(opts) {
     } else {
       pingN = parseInt(params.ping, 10);
       if (!isFinite(pingN) || pingN < 5) pingN = 30;                                                   // RFC 8620 §7.3 default ping seconds
-      if (pingN > 900) pingN = 900;                                                                    // allow:raw-byte-literal — operator-supplied ping seconds, not bytes // allow:raw-time-literal — explicit max-ping cap (15 minutes)
+      if (pingN > 900) pingN = 900;                                                                    // allow:raw-time-literal — explicit max-ping cap (15 minutes)
     }
 
     // SSE wire headers per the HTML5 spec § "Server-sent events"
@@ -676,7 +676,7 @@ function create(opts) {
         }
         unsubscribe = typeof unsub === "function" ? unsub : null;
         if (!pingDisabled) {
-          pingTimer = setInterval(_pingTick, pingN * 1000);                                            // allow:raw-time-literal — seconds → ms conversion // allow:raw-byte-literal — not bytes, time conversion
+          pingTimer = setInterval(_pingTick, pingN * 1000);                                            // allow:raw-time-literal — seconds → ms conversion
           if (pingTimer && typeof pingTimer.unref === "function") pingTimer.unref();
         }
       })

package/lib/mcp.js

@@ -45,12 +45,12 @@ var METHOD_NAME_MAX   = 256;
 // JSON-RPC 2.0 error codes (https://www.jsonrpc.org/specification#error_object).
 // Negative numerics by spec; mapped to HTTP status for the framework's
 // HTTP-shaped reply envelope.
-var JSONRPC_PARSE_ERROR     = -32700;                                                        // allow:raw-byte-literal — JSON-RPC 2.0 fixed error code / allow:raw-time-literal — not seconds
-var JSONRPC_INVALID_REQUEST = -32600;                                                        // allow:raw-byte-literal — JSON-RPC 2.0 fixed error code / allow:raw-time-literal — not seconds
-var JSONRPC_METHOD_NOT_FOUND= -32601;                                                        // allow:raw-byte-literal — JSON-RPC 2.0 fixed error code / allow:raw-time-literal — not seconds
-var JSONRPC_INVALID_PARAMS  = -32602;                                                        // allow:raw-byte-literal — JSON-RPC 2.0 fixed error code / allow:raw-time-literal — not seconds
-var JSONRPC_INTERNAL_ERROR  = -32603;                                                        // allow:raw-byte-literal — JSON-RPC 2.0 fixed error code / allow:raw-time-literal — not seconds
-var JSONRPC_AUTH_REQUIRED   = -32001;                                                        // allow:raw-byte-literal — JSON-RPC server-error reserved range / allow:raw-time-literal — not seconds
+var JSONRPC_PARSE_ERROR     = -32700;                                                        // allow:raw-time-literal — not seconds
+var JSONRPC_INVALID_REQUEST = -32600;                                                        // allow:raw-time-literal — not seconds
+var JSONRPC_METHOD_NOT_FOUND= -32601;                                                        // allow:raw-time-literal — not seconds
+var JSONRPC_INVALID_PARAMS  = -32602;                                                        // allow:raw-time-literal — not seconds
+var JSONRPC_INTERNAL_ERROR  = -32603;                                                        // allow:raw-time-literal — not seconds
+var JSONRPC_AUTH_REQUIRED   = -32001;                                                        // allow:raw-time-literal — not seconds
 var TOOL_NAME_RE     = /^[a-zA-Z][a-zA-Z0-9._-]{0,63}$/;
 var RESOURCE_NAME_RE = /^[a-zA-Z][a-zA-Z0-9._/-]{0,255}$/;
 

package/lib/middleware/age-gate.js

@@ -38,6 +38,7 @@
 var defineClass = require("../framework-error").defineClass;
 var lazyRequire = require("../lazy-require");
 var validateOpts = require("../validate-opts");
+var denyResponse = require("./deny-response").denyResponse;
 
 var audit = lazyRequire(function () { return require("../audit"); });
 
@@ -72,6 +73,8 @@ var AgeGateError = defineClass("AgeGateError", { alwaysPermanent: true });
  *     errorMessage:       string,
  *     privacyPostureHeader: string,                     // default "X-Privacy-Posture"; null/false to suppress
  *     audit:              boolean,                      // default true
+ *     onDeny:             function(req, res, info): void,  // own the 451; info = { status, reason, age, classification, requireAge }
+ *     problemDetails:     boolean,                      // default false — emit RFC 9457 application/problem+json instead of the default JSON envelope
  *   }
  *
  * @example
@@ -89,6 +92,7 @@ function create(opts) {
   validateOpts(opts, [
     "audit", "getAge", "requireAge", "consentRequired",
     "hasParentalConsent", "skipPaths", "errorMessage", "privacyPostureHeader",
+    "onDeny", "problemDetails",
   ], "middleware.ageGate");
 
   if (typeof opts.getAge !== "function") {
@@ -105,6 +109,8 @@ function create(opts) {
   var auditOn = opts.audit !== false;
   var errorMessage = typeof opts.errorMessage === "string" && opts.errorMessage.length > 0
     ? opts.errorMessage : "service unavailable without parental consent";
+  var onDeny = typeof opts.onDeny === "function" ? opts.onDeny : null;
+  var problemMode = opts.problemDetails === true;
   // privacyPostureHeader (default "X-Privacy-Posture") names the response
   // header carrying the below-threshold classification. Pass null/false to
   // suppress it, or a string to rename it for a downstream convention.
@@ -168,13 +174,20 @@ function create(opts) {
       var hasConsent = hasParentalConsent ? !!hasParentalConsent(req) : false;
       if (!hasConsent) {
         _emitAudit("refused", "denied", { age: age, classification: classification, requireAge: requireAge });
-        if (!res.writableEnded && typeof res.writeHead === "function") {
-          res.writeHead(451, {                                                            // HTTP 451 Unavailable For Legal Reasons
-            "Content-Type":  "application/json; charset=utf-8",
-            "Cache-Control": "no-store, private",
-          });
-          res.end(JSON.stringify({ error: errorMessage, requireAge: requireAge, parentalConsent: false }));
-        }
+        denyResponse(req, res, {
+          onDeny:        onDeny,
+          problem:       problemMode,
+          status:        451,                                                             // HTTP 451 Unavailable For Legal Reasons
+          info:          { status: 451, reason: "parental-consent-required",
+            age: age, classification: classification, requireAge: requireAge },
+          problemCode:   "parental-consent-required",
+          problemTitle:  "Unavailable For Legal Reasons",
+          problemDetail: errorMessage,
+          problemExt:    { requireAge: requireAge, parentalConsent: false },
+          headers:       { "Cache-Control": "no-store, private" },
+          contentType:   "application/json; charset=utf-8",
+          body:          JSON.stringify({ error: errorMessage, requireAge: requireAge, parentalConsent: false }),
+        });
         return;
       }
     }

package/lib/middleware/bearer-auth.js

@@ -37,21 +37,34 @@
 var lazyRequire = require("../lazy-require");
 var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
+var denyResponse = require("./deny-response").denyResponse;
 var { AuthError } = require("../framework-error");
 
 var audit = lazyRequire(function () { return require("../audit"); });
 var observability = lazyRequire(function () { return require("../observability"); });
 
-function _writeUnauthorized(res, scheme, message, realm) {
-  if (res.headersSent) return;
-  var body = JSON.stringify({ error: message });
-  var challenge = scheme + (realm ? ' realm="' + realm + '"' : "");
-  res.writeHead(401, {                                                           // HTTP 401 status
-    "Content-Type":     "application/json; charset=utf-8",
-    "Content-Length":   Buffer.byteLength(body),
-    "WWW-Authenticate": challenge,
+// Shared 401/403 refusal writer for every bearer-auth deny path —
+// routes through denyResponse so a consumer can override via onDeny
+// or emit RFC 9457 application/problem+json via problemDetails.
+function _refuse(req, res, status, challenge, bodyObj, reason, problemExt, onDeny, problemMode) {
+  denyResponse(req, res, {
+    onDeny:        onDeny,
+    problem:       problemMode,
+    status:        status,
+    info:          Object.assign({ status: status, reason: reason }, problemExt || {}),
+    problemCode:   "bearer-" + reason,
+    problemTitle:  status === 403 ? "Forbidden" : "Unauthorized",
+    problemDetail: typeof bodyObj.error === "string" ? bodyObj.error : ("bearer authentication failed: " + reason),
+    problemExt:    problemExt || null,
+    headers:       { "WWW-Authenticate": challenge },
+    contentType:   "application/json; charset=utf-8",
+    body:          JSON.stringify(bodyObj),
   });
-  res.end(body);
+}
+
+function _writeUnauthorized(req, res, scheme, message, realm, onDeny, problemMode) {
+  var challenge = scheme + (realm ? ' realm="' + realm + '"' : "");
+  _refuse(req, res, 401, challenge, { error: message }, "unauthorized", null, onDeny, problemMode);
 }
 
 // Three-state extractor: { state: "absent" } when no Authorization
@@ -102,10 +115,13 @@ function _extractToken(req, scheme) {
  *     verify:         async function(token): user|null,  // required
  *     scheme:         string,    // default "Bearer"; some ops use "Token"
  *     realm:          string,
+ *     requiredScopes: string[],  // RFC 6750 §3 — refuse 403 insufficient_scope when the verified token lacks one
  *     errorMessage:   string,
  *     tokenAttachKey: string,
  *     userAttachKey:  string,
  *     audit:          boolean,   // default true
+ *     onDeny:         function(req, res, info): void,  // own the 401/403; info = { status, reason, ... }
+ *     problemDetails: boolean,   // default false — emit RFC 9457 application/problem+json instead of the default JSON envelope
  *   }
  *
  * @example
@@ -122,7 +138,7 @@ function create(opts) {
   opts = opts || {};
   validateOpts(opts, [
     "verify", "audit", "scheme", "errorMessage", "realm",
-    "tokenAttachKey", "userAttachKey",
+    "tokenAttachKey", "userAttachKey", "requiredScopes", "onDeny", "problemDetails",
   ], "middleware.bearerAuth");
 
   if (typeof opts.verify !== "function") {
@@ -131,6 +147,8 @@ function create(opts) {
       "the verification path (b.apiKey.verify / b.auth.jwt.verifyExternal / custom)");
   }
   var auditOn       = opts.audit !== false;
+  var onDeny        = typeof opts.onDeny === "function" ? opts.onDeny : null;
+  var problemMode   = opts.problemDetails === true;
   var scheme        = opts.scheme || "Bearer";
   var errorMessage  = opts.errorMessage || "Bearer token required.";
   var realm         = opts.realm || null;
@@ -197,13 +215,8 @@ function create(opts) {
       if (!res.headersSent) {
         var malformedChallenge = scheme + ' error="invalid_request"' +
           (realm ? ', realm="' + realm + '"' : "");
-        var malformedBody = JSON.stringify({ error: errorMessage });
-        res.writeHead(401, {                                                     // HTTP 401 status
-          "Content-Type":     "application/json; charset=utf-8",
-          "Content-Length":   Buffer.byteLength(malformedBody),
-          "WWW-Authenticate": malformedChallenge,
-        });
-        res.end(malformedBody);
+        _refuse(req, res, 401, malformedChallenge, { error: errorMessage },       // HTTP 401 status
+          "malformed-authorization", null, onDeny, problemMode);
       }
       return;
     }
@@ -221,13 +234,8 @@ function create(opts) {
       var challenge = scheme + ' error="invalid_token"' +
         (realm ? ', realm="' + realm + '"' : "");
       if (!res.headersSent) {
-        var body = JSON.stringify({ error: errorMessage });
-        res.writeHead(401, {                                                     // HTTP 401 status
-          "Content-Type":     "application/json; charset=utf-8",
-          "Content-Length":   Buffer.byteLength(body),
-          "WWW-Authenticate": challenge,
-        });
-        res.end(body);
+        _refuse(req, res, 401, challenge, { error: errorMessage },                // HTTP 401 status
+          "invalid-token", null, onDeny, problemMode);
       }
       return;
     }
@@ -235,7 +243,7 @@ function create(opts) {
     if (!user) {
       _emitAudit("auth.bearer.failure", "failure", req, "verifier-returned-null");
       _emitObs("auth.bearer.rejected", 1, { reason: "verifier-null" });
-      _writeUnauthorized(res, scheme, errorMessage, realm);
+      _writeUnauthorized(req, res, scheme, errorMessage, realm, onDeny, problemMode);
       return;
     }
 
@@ -260,16 +268,9 @@ function create(opts) {
           var scopeChallenge = scheme + ' error="insufficient_scope"' +
             ', scope="' + opts.requiredScopes.join(" ") + '"' +
             (realm ? ', realm="' + realm + '"' : "");
-          var scopeBody = JSON.stringify({
-            error: "insufficient_scope",
-            required: opts.requiredScopes.slice(),
-          });
-          res.writeHead(403, {                                                     // HTTP 403 status
-            "Content-Type":     "application/json; charset=utf-8",
-            "Content-Length":   Buffer.byteLength(scopeBody),
-            "WWW-Authenticate": scopeChallenge,
-          });
-          res.end(scopeBody);
+          _refuse(req, res, 403, scopeChallenge,                                    // HTTP 403 status
+            { error: "insufficient_scope", required: opts.requiredScopes.slice() },
+            "insufficient-scope", { required: opts.requiredScopes.slice() }, onDeny, problemMode);
         }
         return;
       }

package/lib/middleware/bot-guard.js

@@ -51,6 +51,7 @@ var DEFAULT_BLOCKED_AGENTS = [
 var lazyRequire = require("../lazy-require");
 var requestHelpers = require("../request-helpers");
 var validateOpts = require("../validate-opts");
+var denyResponse = require("./deny-response").denyResponse;
 var { defineClass } = require("../framework-error");
 var audit = lazyRequire(function () { return require("../audit"); });
 
@@ -112,6 +113,8 @@ function _xffIpFor(trustProxy) {
  *     skipPaths:     string[],
  *     statusOnBlock: number,            // default 403
  *     bodyOnBlock:   string,
+ *     onDeny:        function(req, res, info): void,  // own the block response; info = { status, reason }
+ *     problemDetails: boolean,          // default false — emit RFC 9457 application/problem+json instead of text/plain
  *     trustProxy:    boolean|number,
  *   }
  *
@@ -128,7 +131,7 @@ function create(opts) {
   opts = opts || {};
   validateOpts(opts, [
     "mode", "onlyForHtml", "allowedAgents", "blockedAgents",
-    "skipPaths", "statusOnBlock", "bodyOnBlock", "trustProxy",
+    "skipPaths", "statusOnBlock", "bodyOnBlock", "onDeny", "problemDetails", "trustProxy",
   ], "middleware.botGuard");
   var trustProxy = opts.trustProxy === true || typeof opts.trustProxy === "number"
     ? opts.trustProxy : false;
@@ -144,6 +147,8 @@ function create(opts) {
   var skipPaths = opts.skipPaths || [];
   var statusOnBlock = opts.statusOnBlock || 403;
   var bodyOnBlock = opts.bodyOnBlock !== undefined ? opts.bodyOnBlock : "Forbidden";
+  var onDeny = typeof opts.onDeny === "function" ? opts.onDeny : null;
+  var problemMode = opts.problemDetails === true;
 
   function _shouldSkip(req) {
     var path = req.pathname || req.url || "/";
@@ -240,10 +245,17 @@ function create(opts) {
     } catch (_e) { /* audit best-effort */ }
 
     if (res.writableEnded) return;
-    if (typeof res.writeHead === "function") {
-      res.writeHead(statusOnBlock, { "Content-Type": "text/plain" });
-      res.end(bodyOnBlock);
-    }
+    denyResponse(req, res, {
+      onDeny:        onDeny,
+      problem:       problemMode,
+      status:        statusOnBlock,
+      info:          { status: statusOnBlock, reason: hit },
+      problemCode:   "bot-blocked",
+      problemTitle:  "Forbidden",
+      problemDetail: "The request was identified as automated traffic and refused.",
+      contentType:   "text/plain",
+      body:          bodyOnBlock,
+    });
     // Don't call next() — terminate the chain
   };
 }

package/lib/middleware/compose-pipeline.js

@@ -97,7 +97,7 @@ var CANONICAL_POSITIONS = Object.freeze({
   botGuard:      42,                                                                                      // canonical position bucket
   requireAuth:   50,                                                                                      // canonical position bucket
   attachUser:    52,                                                                                      // canonical position bucket
-  handler:       60,                                                                                      // allow:raw-byte-literal — canonical position bucket // allow:raw-time-literal — pipeline position int, not seconds
+  handler:       60,                                                                                      // allow:raw-time-literal — pipeline position int, not seconds
   errorHandler:  90,                                                                                      // canonical position bucket
 });