@blamejs/core 0.16.0 → 0.16.2

package/lib/middleware/daily-byte-quota.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * dailyByteQuota middleware — per-IP rolling 24-hour byte budget.

package/lib/middleware/db-role-for.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * dbRoleFor middleware — binds a request-time DB role.

package/lib/middleware/deny-response.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Shared deny-path response writer for the request-lifecycle

package/lib/middleware/dpop.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * dpop middleware — RFC 9449 Demonstrating Proof of Possession.

package/lib/middleware/error-handler.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Error-handler middleware — thin adapter over lib/error-page.

package/lib/middleware/fetch-metadata.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * fetch-metadata — Sec-Fetch-Site / Sec-Fetch-Mode / Sec-Fetch-Dest

package/lib/middleware/flag-context.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * flag-context middleware — extracts an OpenFeature evaluation context

package/lib/middleware/gpc.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.middleware.gpc — Sec-GPC (Global Privacy Control) middleware.

package/lib/middleware/headers.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.middleware.headers — inbound HTTP header threat detection.

package/lib/middleware/health.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * health — liveness / readiness / startup endpoint primitive.

package/lib/middleware/host-allowlist.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * host-allowlist — DNS rebinding defense.

package/lib/middleware/idempotency-key.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.middleware.idempotencyKey

package/lib/middleware/index.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * HTTP middleware — request-lifecycle hardening primitives.

package/lib/middleware/nel.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.middleware.nel

package/lib/middleware/network-allowlist.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * network-allowlist — restrict an opt-named set of paths to operator-

package/lib/middleware/no-cache.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.middleware.noCache

package/lib/middleware/openapi-serve.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * openapi-serve middleware — expose an OpenAPI 3.1 document as a

package/lib/middleware/protected-resource-metadata.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.middleware.protectedResourceMetadata

package/lib/middleware/rate-limit.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Rate-limit middleware — pluggable backend, default in-memory.

package/lib/middleware/request-id.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Request-ID middleware. Propagates an existing X-Request-Id header

package/lib/middleware/request-log.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * request-log — HTTP access-log middleware. Captures method, path,

package/lib/middleware/require-aal.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * require-aal middleware — gate routes by NIST SP 800-63-4 AAL band.

package/lib/middleware/require-auth.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * require-auth middleware — gates routes that require an authenticated

package/lib/middleware/require-bound-key.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * requireBoundKey middleware — Bearer-API-key auth with scope + bound-

package/lib/middleware/require-content-type.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * require-content-type middleware — refuses requests with a body

package/lib/middleware/require-methods.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * require-methods middleware — refuses HTTP methods outside an

package/lib/middleware/require-mtls.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * requireMtls middleware — soft-enforcement gate for routes that

package/lib/middleware/require-step-up.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * require-step-up middleware — gate routes per RFC 9470 OAuth 2.0

package/lib/middleware/scim-server.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 // SCIM 2.0 server middleware (RFC 7642 / 7643 / 7644).
 // Provides /Users + /Groups + /ServiceProviderConfig + /ResourceTypes

package/lib/middleware/security-headers.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Security headers middleware. Sets the headers every modern app should

package/lib/middleware/security-txt.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * security-txt middleware — RFC 9116 /.well-known/security.txt emitter.

package/lib/middleware/span-http-server.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * spanHttpServer middleware — auto-creates a root span per HTTP

package/lib/middleware/speculation-rules.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.middleware.speculationRules

package/lib/middleware/sse.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * sse — Server-Sent Events middleware. One-way streaming from server

package/lib/middleware/trace-log-correlation.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * trace-log-correlation middleware — wraps the operator's b.log

package/lib/middleware/trace-propagate.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * trace-propagate middleware — consumes the inbound `traceparent`

package/lib/middleware/tus-upload.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * TUS resumable upload middleware (tus.io v1.0.0).

package/lib/middleware/web-app-manifest.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * web-app-manifest middleware — emits the W3C Web App Manifest at

package/lib/migration-files.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * migration-files — shared filename-shape primitive.

package/lib/migrations.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * migrations — public migration runner with up / down / status.

package/lib/mime-parse.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * mime-parse — minimal RFC 5322 + RFC 2045 + RFC 2046 reader shared by

package/lib/module-loader.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * lib/module-loader.js — the single audited entry point for loading an

package/lib/money.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module    b.money

package/lib/mtls-ca.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.mtlsCa

package/lib/mtls-engine-default.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * mtls-engine-default — pure-JS X.509 engine wired into b.mtlsCa.

package/lib/network-byte-quota.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.network.byteQuota — per-key rolling 24-hour byte budget primitive.

package/lib/network-dane.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.network.dns.dane

package/lib/network-dns-resolver.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.network.dns.resolver

package/lib/network-dns.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 var dns = require("node:dns");

package/lib/network-dnssec.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.network.dns.dnssec

package/lib/network-heartbeat.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 var net = require("node:net");

package/lib/network-nts.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 var nodeTls = require("node:tls");

package/lib/network-proxy.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 var http = require("node:http");

package/lib/network-smtp-policy.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.network.smtp.policy — MTA-STS + DANE + TLS-RPT outbound SMTP gates.
@@ -673,7 +675,10 @@ async function tlsRptSubmit(report, opts) {
           body:    gzipped,
           timeoutMs: timeoutMs,
         });
-        entry.status = rv && rv.status;
+        // The framework httpClient resolves { statusCode, headers, body }
+        // (same shape mtaSts.fetch reads above) — not { status }. Reading
+        // the wrong field marked every real 2xx submission as a failure.
+        entry.status = rv && rv.statusCode;
         entry.ok = entry.status >= 200 && entry.status < 300;                  // HTTP 2xx range
         if (!entry.ok) entry.error = "HTTP " + entry.status;
       } else if (/^mailto:/i.test(uri)) {

package/lib/network-tls.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 
 var nodeTls = require("node:tls");

package/lib/network-tsig.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.network.dns.tsig

package/lib/network.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.network

package/lib/nis2-report.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.nis2.report — NIS2 Directive incident-reporting wrapper.

package/lib/nist-crosswalk.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module     b.nistCrosswalk

package/lib/nonce-store.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * nonce-store — pluggable replay-protection store.

package/lib/notify.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.notify

package/lib/ntp-check.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.ntpCheck

package/lib/numeric-bounds.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * numeric-bounds — shared validators for operator-tunable numeric opts.

package/lib/numeric-checks.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * numeric-checks — predicate helpers for opts / arg validation.

package/lib/object-store/azure-blob-bucket-ops.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * azure-blob-bucket-ops — container-level operations for Azure Blob.

package/lib/object-store/azure-blob.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Azure Blob Storage protocol adapter — Shared Key auth (account-level).

package/lib/object-store/gcs-bucket-ops.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * gcs-bucket-ops — bucket-level operations for Google Cloud Storage.

package/lib/object-store/gcs.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Google Cloud Storage (GCS) protocol adapter — native JSON API.

package/lib/object-store/http-put.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Generic HTTP PUT/GET protocol adapter.

package/lib/object-store/http-request.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Shared HTTP-request helper for object-store backends.

package/lib/object-store/index.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Object-store dispatcher — protocol-agnostic remote (and local) storage.

package/lib/object-store/local.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Local-filesystem protocol adapter for object-store.

package/lib/object-store/sigv4-bucket-ops.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * sigv4-bucket-ops — bucket-level operations for SigV4 backends.

package/lib/object-store/sigv4.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * SigV4 protocol adapter — AWS Signature Version 4.

package/lib/observability-otlp-exporter.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.observability.otlpExporter — OTLP/HTTP JSON span exporter.

package/lib/observability-tracer.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * b.observability.tracer — OTel-shaped distributed-tracing span builder.

package/lib/observability.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.observability

package/lib/openapi-paths-builder.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * OpenAPI 3.1 / 3.2 — paths / operations + webhooks builder.

package/lib/openapi-schema-walk.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * OpenAPI 3.1 — converts a b.safeSchema description into the JSON

package/lib/openapi-security.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * OpenAPI 3.1 — security-scheme builders.

package/lib/openapi-yaml.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * OpenAPI 3.1 — minimal YAML 1.2 emitter for the document JSON.

package/lib/openapi.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.openapi

package/lib/otel-export.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * otel-export — OTLP/HTTP-JSON exporter for `b.observability` events.

package/lib/outbox.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * Transactional outbox — at-least-once event publication without

package/lib/pagination.js

@@ -1,3 +1,5 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
 "use strict";
 /**
  * @module b.pagination