@blamejs/core 0.14.4 → 0.14.6

package/lib/middleware/require-methods.js

@@ -16,6 +16,7 @@
  */
 
 var lazyRequire = require("../lazy-require");
+var denyResponse = require("./deny-response").denyResponse;
 var { defineClass } = require("../framework-error");
 
 var RequireMethodsError = defineClass("RequireMethodsError", { alwaysPermanent: true });
@@ -38,7 +39,9 @@ var observability = lazyRequire(function () { return require("../observability")
  *
  * @opts
  *   {
- *     audit: boolean,   // default true
+ *     audit:          boolean,   // default true
+ *     onDeny:         function(req, res, info): void,  // own the 405; info = { status, reason, method, allowed }
+ *     problemDetails: boolean,   // default false — emit RFC 9457 application/problem+json instead of text/plain
  *   }
  *
  * @example
@@ -69,18 +72,25 @@ function create(allowed, opts) {
   var allowHeader = normalized.join(", ");
   opts = opts || {};
   var auditOn = opts.audit !== false;
+  var onDeny = typeof opts.onDeny === "function" ? opts.onDeny : null;
+  var problemMode = opts.problemDetails === true;
 
   return function requireMethodsMiddleware(req, res, next) {
     var m = (req.method || "").toUpperCase();
     if (normalized.indexOf(m) !== -1) return next();
     if (!res.headersSent) {
-      var body = "Method Not Allowed";
-      res.writeHead(405, {                                                       // HTTP 405 status
-        "Allow":          allowHeader,
-        "Content-Type":   "text/plain; charset=utf-8",
-        "Content-Length": Buffer.byteLength(body),
+      denyResponse(req, res, {
+        onDeny:        onDeny,
+        problem:       problemMode,
+        status:        405,
+        info:          { status: 405, reason: "method-not-allowed", method: m, allowed: normalized },
+        problemCode:   "method-not-allowed",
+        problemTitle:  "Method Not Allowed",
+        problemDetail: "The " + m + " method is not allowed on this resource.",
+        headers:       { "Allow": allowHeader },
+        contentType:   "text/plain; charset=utf-8",
+        body:          "Method Not Allowed",
       });
-      res.end(body);
     }
     if (auditOn) {
       try {

package/lib/middleware/require-mtls.js

@@ -48,6 +48,7 @@
 var defineClass = require("../framework-error").defineClass;
 var lazyRequire = require("../lazy-require");
 var validateOpts = require("../validate-opts");
+var denyResponse = require("./deny-response").denyResponse;
 
 var bCrypto = lazyRequire(function () { return require("../crypto"); });
 var audit  = lazyRequire(function () { return require("../audit"); });
@@ -84,6 +85,8 @@ function _normalizeFingerprintEntry(entry) {
  *     fingerprintAllowList: string[],
  *     denyList:             string[],
  *     onAuthenticated:      function(req, res, next): void,
+ *     onDeny:               function(req, res, info): void,  // own the refusal (mirrors onAuthenticated); info = { status, reason, ...metadata }
+ *     problemDetails:       boolean,        // default false — emit RFC 9457 application/problem+json instead of the default JSON envelope
  *     auditAction:          string,
  *     errorMessage:         string,
  *     audit:                object,
@@ -100,7 +103,7 @@ function create(opts) {
   opts = opts || {};
   validateOpts(opts, [
     "fingerprintAllowList", "denyList",
-    "onAuthenticated", "audit",
+    "onAuthenticated", "onDeny", "problemDetails", "audit",
     "auditAction", "errorMessage",
   ], "middleware.requireMtls");
 
@@ -109,6 +112,8 @@ function create(opts) {
   var denyList = Array.isArray(opts.denyList)
     ? opts.denyList.map(_normalizeFingerprintEntry) : [];
   var onAuthenticated = typeof opts.onAuthenticated === "function" ? opts.onAuthenticated : null;
+  var onDeny = typeof opts.onDeny === "function" ? opts.onDeny : null;
+  var problemMode = opts.problemDetails === true;
   var auditOn  = opts.audit !== false;
   var actionBase = typeof opts.auditAction === "string" && opts.auditAction.length > 0
     ? opts.auditAction : "mtls.required";
@@ -126,16 +131,24 @@ function create(opts) {
     } catch (_e) { /* drop-silent — audit is best-effort, never blocks the request */ }
   }
 
-  function _refuse(res, reason, metadata) {
+  function _refuse(req, res, reason, metadata) {
     _emit("denied", Object.assign({ reason: reason }, metadata || {}));
-    if (typeof res.writeHead === "function") {
-      res.writeHead(401, {
-        "Content-Type":     "application/json; charset=utf-8",
+    denyResponse(req, res, {
+      onDeny:        onDeny,
+      problem:       problemMode,
+      status:        401,
+      info:          Object.assign({ status: 401, reason: reason }, metadata || {}),
+      problemCode:   "client-certificate-required",
+      problemTitle:  "Unauthorized",
+      problemDetail: errorMessage,
+      problemExt:    { reason: reason },
+      headers:       {
         "WWW-Authenticate": "Mutual",
         "Cache-Control":    "no-store",
-      });
-      res.end(JSON.stringify({ error: errorMessage, reason: reason }));
-    }
+      },
+      contentType:   "application/json; charset=utf-8",
+      body:          JSON.stringify({ error: errorMessage, reason: reason }),
+    });
   }
 
   return function requireMtlsMiddleware(req, res, next) {
@@ -158,10 +171,10 @@ function create(opts) {
 
     if (!authorized) {
       var authzError = (sock && sock.authorizationError) || "no-peer-cert";
-      return _refuse(res, "tls-unauthorized", { authorizationError: String(authzError) });
+      return _refuse(req, res, "tls-unauthorized", { authorizationError: String(authzError) });
     }
     if (!peerCert || !peerCert.raw) {
-      return _refuse(res, "no-peer-cert", {});
+      return _refuse(req, res, "no-peer-cert", {});
     }
 
     // Compute fingerprint via the framework's SHA3-512 helper. Buffer
@@ -171,17 +184,17 @@ function create(opts) {
     try {
       fp = bCrypto().hashCertFingerprint(peerCert.raw);
     } catch (e) {
-      return _refuse(res, "fingerprint-failed", { error: (e && e.message) || String(e) });
+      return _refuse(req, res, "fingerprint-failed", { error: (e && e.message) || String(e) });
     }
 
     if (denyList.length > 0 && bCrypto().isCertRevoked(peerCert.raw, denyList)) {
-      return _refuse(res, "fingerprint-on-deny-list", {
+      return _refuse(req, res, "fingerprint-on-deny-list", {
         fingerprint: fp.colon,
         subject:     (peerCert.subject && peerCert.subject.CN) || null,
       });
     }
     if (allowList && allowList.length > 0 && !bCrypto().isCertRevoked(peerCert.raw, allowList)) {
-      return _refuse(res, "fingerprint-not-allowed", {
+      return _refuse(req, res, "fingerprint-not-allowed", {
         fingerprint: fp.colon,
         subject:     (peerCert.subject && peerCert.subject.CN) || null,
       });
@@ -199,7 +212,7 @@ function create(opts) {
     if (onAuthenticated) {
       try { return onAuthenticated(req, res, next); }
       catch (e) {
-        return _refuse(res, "on-authenticated-threw", { error: (e && e.message) || String(e) });
+        return _refuse(req, res, "on-authenticated-threw", { error: (e && e.message) || String(e) });
       }
     }
     return next();

package/lib/network.js

@@ -108,8 +108,8 @@ function _socketDefaults() {
 }
 
 /**
- * @primitive b.network.applyToSocket
- * @signature b.network.applyToSocket(socket)
+ * @primitive b.network.socket.applyToSocket
+ * @signature b.network.socket.applyToSocket(socket)
  * @since     0.7.68
  * @related   b.network.bootFromEnv, b.network.snapshot
  *
@@ -124,7 +124,7 @@ function _socketDefaults() {
  * @example
  *   var net = require("net");
  *   var s   = new net.Socket();
- *   var ret = b.network.applyToSocket(s);
+ *   var ret = b.network.socket.applyToSocket(s);
  *   ret === s;
  *   // → true
  *   s.destroy();
@@ -164,7 +164,7 @@ var ntpFacade = {
  * @primitive b.network.bootFromEnv
  * @signature b.network.bootFromEnv(opts)
  * @since     0.7.68
- * @related   b.network.snapshot, b.network.applyToSocket
+ * @related   b.network.snapshot, b.network.socket.applyToSocket
  *
  * Read `BLAMEJS_*` environment variables once and apply the union to
  * the live network facade. Recognised keys cover NTP servers /

package/lib/safe-decompress.js

@@ -105,7 +105,7 @@ var _algorithms = {
 // classic bomb shapes (1000:1) while leaving headroom for legitimate
 // text / JSON / XML payloads (which compress 20-50:1 commonly). Per
 // RFC 8460 §5.2 community guidance for TLS-RPT report decompression.
-var DEFAULT_MAX_RATIO = 50;                                                          // allow:raw-byte-literal — RFC 8460 §5.2 community guidance / allow:raw-time-literal — RFC number not seconds
+var DEFAULT_MAX_RATIO = 50;                                                          // allow:raw-time-literal — RFC number not seconds
 
 // Default input cap when operator omits opts.maxCompressedBytes —
 // 4 MiB matches the TLS-RPT receive surface and is a reasonable

package/lib/safe-url.js

@@ -407,7 +407,7 @@ function format(url) {
     }
     // Constructing URL() is the path that surfaces the IDN-crash on
     // older Node — wrap so the listener never crashes.
-    var u = new URL(url);   // allow:raw-new-url — safeUrl.format wraps URL ctor for CVE-2026-21712; this IS the safe wrapper.   // allow:raw-byte-literal — no byte literal; suppresses cross-detector false-positive from neighboring text
+    var u = new URL(url);   // allow:raw-new-url — safeUrl.format wraps URL ctor for CVE-2026-21712; this IS the safe wrapper.
     return u.href;
   } catch (e) {
     if (e && e.isSafeUrlError) throw e;

package/lib/stream-throttle.js

@@ -71,9 +71,9 @@ var StreamThrottleError = defineClass("StreamThrottleError", { alwaysPermanent:
 // (bytes/sec ↔ wait-ms). This is a unit-conversion constant, not a
 // memory cap or protocol-byte literal; the framework's C.TIME / C.BYTES
 // helpers don't apply.
-var MS_PER_SECOND = 1000;                                                                             // allow:raw-byte-literal — ms/sec unit conversion // allow:raw-time-literal — ms/sec unit conversion
+var MS_PER_SECOND = 1000;                                                                             // allow:raw-time-literal — ms/sec unit conversion
 var NS_PER_MS     = 1e6;                                                                              // ns/ms unit conversion
-var MS_PER_SECOND_HRTIME = 1000;                                                                      // allow:raw-byte-literal — hrtime seconds→ms // allow:raw-time-literal — hrtime seconds→ms
+var MS_PER_SECOND_HRTIME = 1000;                                                                      // allow:raw-time-literal — hrtime seconds→ms
 
 /**
  * @primitive b.streamThrottle.create

package/lib/websocket.js

@@ -190,8 +190,8 @@ var CLOSE_GRACE_MS            = C.TIME.seconds(2);
 // invalid.
 function _isValidCloseCode(code) {
   if (code === 1004 || code === 1005 || code === 1006 || code === 1015) return false;        // RFC 6455 §7.4.2 reserved codes
-  if (code >= 1000 && code <= 1011) return true;                                              // allow:raw-byte-literal — RFC 6455 §7.4.2 spec range / allow:raw-time-literal — code is a numeric, not seconds
-  if (code >= 3000 && code <= 4999) return true;                                              // allow:raw-byte-literal — RFC 6455 §7.4.2 IANA / private range / allow:raw-time-literal — code is a numeric, not seconds
+  if (code >= 1000 && code <= 1011) return true;                                              // allow:raw-time-literal — code is a numeric, not seconds
+  if (code >= 3000 && code <= 4999) return true;                                              // allow:raw-time-literal — code is a numeric, not seconds
   return false;
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.14.4",
+  "version": "0.14.6",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3b6688f8-8f17-4d81-9bad-f0e6166a53c7",
+  "serialNumber": "urn:uuid:ba3e9bdd-f642-4d42-a03c-794d89554a0a",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-30T08:50:20.572Z",
+    "timestamp": "2026-05-30T16:30:23.236Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.14.4",
+      "bom-ref": "@blamejs/core@0.14.6",
       "type": "application",
       "name": "blamejs",
-      "version": "0.14.4",
+      "version": "0.14.6",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.14.4",
+      "purl": "pkg:npm/%40blamejs/core@0.14.6",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.14.4",
+      "ref": "@blamejs/core@0.14.6",
       "dependsOn": []
     }
   ]