@blamejs/blamejs-shop 0.2.30 → 0.3.0

package/lib/vendor/blamejs/lib/middleware/cookies.js

@@ -89,6 +89,10 @@ function create(opts) {
   var audit = opts.audit || null;
 
   return function cookiesMiddleware(req, res, next) {
+    // Idempotent: if an earlier cookies middleware already parsed the jar
+    // this request (e.g. createApp wired it AND an operator mounted it
+    // again), don't re-parse — keep the first jar.
+    if (req.cookieJar !== undefined) return next();
     var header = req && req.headers ? req.headers.cookie : "";
     var rv = cookies.parseSafe(header || "", {
       maxHeaderBytes: maxHeaderBytes,

package/lib/vendor/blamejs/lib/middleware/csp-nonce.js

@@ -333,6 +333,10 @@ function create(opts) {
   }
 
   function cspNonce(req, res, next) {
+    // Idempotent: if an earlier cspNonce middleware already set a nonce on
+    // this request, keep it — re-generating would desync the header nonce
+    // from the one templates already rendered against.
+    if (req[property] !== undefined) return next();
     // Generate the nonce. Cheap (16 bytes from getrandom → SHAKE256 →
     // base64 encode); do it always for consistency unless `always:
     // false` was set explicitly.

package/lib/vendor/blamejs/lib/middleware/csrf-protect.js

@@ -261,6 +261,7 @@ function _writeReject(res, message) {
  *     requireJsonContentType: boolean,
  *     trustProxy:             boolean|number,
  *     audit:                  boolean,
+ *     skipStateless:          boolean,   // default false — skip validation for Authorization-header / cookieless (not-CSRF-able) requests
  *   }
  *
  * @example
@@ -278,7 +279,7 @@ function create(opts) {
   validateOpts(opts, [
     "cookie", "tokenLookup", "fieldName", "headerName", "methods", "audit",
     "trustProxy", "checkOrigin", "allowedOrigins", "requireJsonContentType",
-    "requireOrigin",
+    "requireOrigin", "skipStateless",
   ], "middleware.csrfProtect");
   var trustProxy = opts.trustProxy === true || typeof opts.trustProxy === "number"
     ? opts.trustProxy : false;
@@ -335,6 +336,19 @@ function create(opts) {
   // is opt-in rather than silent.
   var requireOriginOpt = opts.requireOrigin === true;
 
+  // skipStateless — skip token VALIDATION for requests that carry an
+  // Authorization header (bearer / token auth) or no Cookie header at
+  // all. Such requests are not CSRF-able: CSRF abuses a victim's ambient
+  // cookie credential, and a token-authenticated or cookieless request
+  // has none to abuse. The token is still ISSUED on safe methods so a
+  // later cookie-authenticated browser flow on the same app works. Default
+  // false (strict — every state-changing request is validated). createApp
+  // wires its default csrf with this on so mixed browser-form + token-API
+  // surfaces don't reject legitimate API clients. Cross-site form CSRF is
+  // unaffected: the browser auto-sends the victim's cookies, so the attack
+  // request always carries a Cookie header and is validated.
+  var skipStateless = opts.skipStateless === true;
+
   // Cookie issuance config (only when opts.cookie is set).
   var cookieCfg = null;
   if (hasCookie) {
@@ -436,6 +450,12 @@ function create(opts) {
   }
 
   return function csrfProtect(req, res, next) {
+    // Idempotent: a second csrf mount this request (e.g. createApp wired
+    // it AND an operator mounted it again) is a no-op — the first instance
+    // already issued + validated.
+    if (req._csrfApplied) return next();
+    req._csrfApplied = true;
+
     // Issue/refresh the token on EVERY request (safe + state-changing)
     // when running in cookie mode — templates rendered after a POST
     // (e.g. error response) still need req.csrfToken populated.
@@ -443,6 +463,14 @@ function create(opts) {
 
     if (methods.indexOf(req.method) === -1) return next();
 
+    // Stateless / token-authenticated requests are not CSRF-able — the
+    // token was still issued above for any later browser flow.
+    if (skipStateless) {
+      var hasAuthHeader = !!(req.headers && req.headers.authorization);
+      var hasCookieHeader = !!(req.headers && req.headers.cookie);
+      if (hasAuthHeader || !hasCookieHeader) return next();
+    }
+
     // requireJsonContentType — refuse before the token check.
     if (requireJsonCt) {
       var ct = req.headers && req.headers["content-type"];

package/lib/vendor/blamejs/lib/middleware/fetch-metadata.js

@@ -120,6 +120,9 @@ function create(opts) {
   }
 
   return function fetchMetadata(req, res, next) {
+    // Idempotent: a second fetch-metadata mount this request is a no-op.
+    if (req._fetchMetadataChecked) return next();
+    req._fetchMetadataChecked = true;
     if (methods.indexOf(req.method) === -1) return next();
 
     var headers = req.headers || {};

package/lib/vendor/blamejs/lib/network-tls.js

@@ -20,6 +20,7 @@ var NetworkTlsError = defineClass("NetworkTlsError", { alwaysPermanent: true });
 var observability = lazyRequire(function () { return require("./observability"); });
 var audit = lazyRequire(function () { return require("./audit"); });
 var networkDns = lazyRequire(function () { return require("./network-dns"); });
+var httpClient = lazyRequire(function () { return require("./http-client"); });
 var asn1 = require("./asn1-der");
 
 // STATE.tlsKeyShares is initialized to the default PQC group list at
@@ -1194,9 +1195,10 @@ function evaluateOcspResponse(ocspDer, opts) {
 //
 // Constructs a DER-encoded OCSPRequest for a single (leafCertDer,
 // issuerCertDer) pair, optionally with an RFC 8954 nonce extension.
-// Operators send the returned `requestDer` to the OCSP responder URL
-// (e.g. via b.httpClient with `Content-Type: application/ocsp-request`)
-// and pass `nonce` to `ocsp.evaluate(responseDer, { expectedNonce })`
+// `ocsp.fetch` composes this with `b.httpClient` to POST the request to
+// the cert's responder and return a validated response; operators who
+// need the raw request (custom transport, batched requests) call this
+// directly and pass `nonce` to `ocsp.evaluate(responseDer, { expectedNonce })`
 // to defend against replay attacks.
 //
 // Nonce DEFAULT ON — defense in depth. RFC 6960 §4.4.1 marks nonce
@@ -1291,8 +1293,10 @@ function buildOcspRequest(opts) {
   // framework that touches SHA-1" need a signal. Emit an audit row
   // on every OCSP request build so the algorithm choice is visible
   // in the chain.
-  var nameHash = nodeCrypto.createHash("sha1").update(iss.issuerNameDer).digest();
-  var keyHash  = nodeCrypto.createHash("sha1").update(iss.issuerKey).digest();
+  // lgtm[js/weak-cryptographic-algorithm] — RFC 6960 §4.1.1 CertID lookup hash over the PUBLIC issuer name; a name/key lookup, not an integrity or secrecy operation. SHA-256 CertIDs are §4.3-optional and rejected by most responders.
+  var nameHash = nodeCrypto.createHash("sha1").update(iss.issuerNameDer).digest(); // lgtm[js/weak-cryptographic-algorithm]
+  // lgtm[js/weak-cryptographic-algorithm] — RFC 6960 §4.1.1 CertID lookup hash over the PUBLIC issuer key; a name/key lookup, not an integrity or secrecy operation.
+  var keyHash  = nodeCrypto.createHash("sha1").update(iss.issuerKey).digest(); // lgtm[js/weak-cryptographic-algorithm]
   setImmediate(function () {
     try {
       var auditMod = require("./audit");                                            // allow:inline-require — circular-load defense (audit imports network-tls)
@@ -1339,6 +1343,77 @@ function buildOcspRequest(opts) {
   return { requestDer: requestDer, nonce: nonceBytes };
 }
 
+// _ocspResponderUrl — pull the OCSP responder URL out of a cert's
+// Authority Information Access extension. node:crypto exposes it as a
+// multi-line string ("OCSP - URI:http://...\nCA Issuers - URI:...\n").
+function _ocspResponderUrl(x509) {
+  var ia = x509 && x509.infoAccess;
+  if (typeof ia !== "string") return null;
+  var m = ia.match(/OCSP\s*-\s*URI:(\S+)/i);
+  return m ? m[1].trim() : null;
+}
+
+// fetch — POST a freshly-built OCSPRequest to the cert's responder and
+// return the validated, known-good response bytes. Composes buildRequest +
+// b.httpClient + evaluate, completing the server-side-stapling fetch path
+// (the response is what a TLS server staples via its 'OCSPRequest' handler).
+// The responder URL is taken from the leaf cert's AIA extension unless
+// opts.responderUrl overrides it. Throws TlsTrustError on any failure
+// (no responder, transport error, non-good certStatus, signature mismatch);
+// callers that staple should treat a throw as "no staple this cycle".
+async function fetchOcspResponse(opts) {
+  opts = opts || {};
+  if (typeof opts.leafPem !== "string" || typeof opts.issuerPem !== "string") {
+    throw new TlsTrustError("tls/ocsp-bad-input",
+      "ocsp.fetch: opts.leafPem and opts.issuerPem (PEM strings) are required");
+  }
+  var leafX, issuerX;
+  try {
+    leafX = new nodeCrypto.X509Certificate(opts.leafPem);
+    issuerX = new nodeCrypto.X509Certificate(opts.issuerPem);
+  } catch (e) {
+    throw new TlsTrustError("tls/ocsp-bad-cert",
+      "ocsp.fetch: could not parse leaf/issuer PEM: " + ((e && e.message) || String(e)));
+  }
+  var responderUrl = opts.responderUrl || _ocspResponderUrl(leafX);
+  if (!responderUrl) {
+    throw new TlsTrustError("tls/ocsp-no-responder",
+      "ocsp.fetch: cert has no AIA OCSP responder URL; pass opts.responderUrl");
+  }
+  var built = buildOcspRequest({
+    leafCertDer: leafX.raw, issuerCertDer: issuerX.raw,
+    nonce: opts.nonce, nonceLen: opts.nonceLen,
+  });
+  var res;
+  try {
+    res = await httpClient().request({
+      url:          responderUrl,
+      method:       "POST",
+      headers:      { "content-type": "application/ocsp-request", "accept": "application/ocsp-response" },
+      body:         built.requestDer,
+      responseMode: "buffer",
+      timeoutMs:    opts.timeoutMs || C.TIME.seconds(10),
+    });
+  } catch (e) {
+    throw new TlsTrustError("tls/ocsp-fetch-failed",
+      "ocsp.fetch: responder request to " + responderUrl + " failed: " + ((e && e.message) || String(e)));
+  }
+  if (res.status !== 200 || !Buffer.isBuffer(res.body) || res.body.length === 0) {
+    throw new TlsTrustError("tls/ocsp-fetch-bad-status",
+      "ocsp.fetch: responder returned status " + res.status + " with an empty/non-buffer body");
+  }
+  var evald = evaluateOcspResponse(res.body, {
+    issuerPem:     opts.issuerPem,
+    serialHex:     opts.serialHex || null,
+    expectedNonce: opts.nonce === false ? null : built.nonce,
+  });
+  if (!evald.ok) {
+    throw new TlsTrustError("tls/ocsp-not-good",
+      "ocsp.fetch: response is not good: " + (evald.errors || []).join("; "));
+  }
+  return { ocspDer: res.body, evaluation: evald, responderUrl: responderUrl };
+}
+
 var ocsp = Object.freeze({
   // Connect with OCSP requested. Returns { authorized, ocspBytes,
   // peerCert }. requireStapled: true makes empty / not-stapled responses
@@ -1379,6 +1454,7 @@ var ocsp = Object.freeze({
   },
   parseResponse:        parseOcspResponse,
   evaluate:             evaluateOcspResponse,
+  fetch:                fetchOcspResponse,
   // buildRequest — construct a DER-encoded OCSPRequest for a single
   // (leafCertDer, issuerCertDer) pair. RFC 8954 nonce extension is ON
   // by default (16 random bytes; opts.nonceLen overrides within RFC

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.13.44",
+  "version": "0.13.46",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.13.45.json

@@ -0,0 +1,31 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.45",
+  "date": "2026-05-29",
+  "headline": "`b.cert` now fetches and staples a validated OCSP response per certificate, and validates declared compliance postures at create()",
+  "summary": "Two capabilities that b.cert documented but did not act on are now wired through. OCSP stapling: the cert manager fetches the leaf's OCSP response from the responder named in its Authority Information Access extension, validates it against the issuer (status, nonce, serial) via b.network.tls.ocsp, caches the DER, and exposes it on getContext().ocspResponse so a TLS server's OCSPRequest handler can staple it. The fetch runs in the background on a refresh timer and never blocks cert.start() — a slow or unreachable responder produces an audited per-certificate failure, not a stalled boot. Compliance postures: opts.compliance names are now validated against b.compliance.KNOWN_POSTURES at create() (an unknown name throws cert/unknown-compliance-posture instead of being silently recorded) and are surfaced on getContext().compliance for an auditor. Storage-confidentiality postures hold by construction because cert keys and certificates are always sealed at rest. The supporting composition primitive b.network.tls.ocsp.fetch (build request, POST to the responder through b.httpClient, validate the response) is now part of the public OCSP surface.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "b.network.tls.ocsp.fetch — fetch and validate an OCSP response",
+          "body": "The OCSP helper set previously built requests and evaluated responses but had no way to actually retrieve one. b.network.tls.ocsp.fetch({ leafPem, issuerPem, nonce?, timeoutMs? }) reads the responder URL from the leaf certificate's Authority Information Access extension, builds the request, POSTs it through b.httpClient (so the SSRF guard and pinned DNS apply), and validates the response against the issuer — returning the validated DER plus the parsed evaluation. It rejects when the leaf carries no OCSP responder URL or the response fails validation."
+        },
+        {
+          "title": "b.cert staples a validated OCSP response per certificate",
+          "body": "With ocsp.stapling enabled (the default), the cert manager refreshes each certificate's OCSP response on a timer (ocsp.refreshMs, default 12h) and caches the validated DER. getContext(serverName).ocspResponse returns that DER for a TLS server to hand back from its OCSPRequest handler. The refresh runs in the background and is never on the path of cert.start(): an unreachable or slow responder is recorded as an audited cert.ocsp.refresh failure for that certificate and leaves the rest of the manager running."
+        }
+      ]
+    },
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "opts.compliance posture names are validated at create()",
+          "body": "b.cert.create now checks each name in opts.compliance against b.compliance.KNOWN_POSTURES and throws cert/unknown-compliance-posture on an unrecognized name, so a typo is caught at construction rather than being silently recorded. The declared postures are surfaced on getContext().compliance. Cert keys and certificates are always sealed at rest, so storage-confidentiality postures are satisfied by construction."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.13.46.json

@@ -0,0 +1,35 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.13.46",
+  "date": "2026-05-29",
+  "headline": "`createApp` now wires the documented security middleware ON by default — CSRF, CSP nonce, cookie parser, fetch-metadata, and body parser",
+  "summary": "The README has long described a security middleware stack as \"wired by createApp\", but createApp only mounted request-ID, security-headers, and bot-guard by default — CSRF protection, the CSP nonce, the threat-aware cookie parser, the fetch-metadata guard, and the body parser were documented but not actually wired. This release closes that gap: createApp now mounts all of them by default, in dependency order (cookies, CSP nonce, fetch-metadata, then body parser, then CSRF last so it can read a body-field token). This is a behavior change — apps built with createApp now enforce CSRF on state-changing requests by default. Each layer is configurable via opts.middleware.<name> (operator cookie and field names flow straight through — nothing is hardcoded) or can be turned off with false, and disabling a security default now emits an app.middleware.disabled audit event. Every layer is idempotent: an operator who also mounts one of these inside opts.routes gets a no-op second mount rather than a double-apply. The default CSRF is a double-submit cookie that auto-skips requests carrying an Authorization header or no cookies at all, which are not CSRF-able, so token-authenticated API clients are not rejected. The README middleware list is now an accurate description of what createApp wires.",
+  "sections": [
+    {
+      "heading": "Changed",
+      "items": [
+        {
+          "title": "createApp wires CSRF, CSP nonce, cookie parser, fetch-metadata, and body parser by default (breaking)",
+          "body": "Applications constructed with b.createApp now mount, in order: the threat-aware cookie parser, the CSP nonce generator, the fetch-metadata resource-isolation guard, the body parser (JSON / urlencoded / text / multipart), and CSRF protection — in addition to the request-ID, security-headers, and bot-guard layers already wired. The ordering guarantees CSRF runs after the body parser so a body-field token is available. This is a behavior change: state-changing requests (POST / PUT / DELETE / PATCH) that carry a session cookie are now CSRF-validated by default. Each layer is configured through opts.middleware.<name> (an object passes operator options straight through; cookie and field names are not hardcoded) or disabled with false. Operators who were mounting these middleware themselves inside opts.routes do not need to change anything — the second mount is now a no-op (see idempotency below)."
+        },
+        {
+          "title": "Default CSRF auto-skips token-authenticated and cookieless requests",
+          "body": "The CSRF middleware gains a skipStateless option (default false; createApp's default wiring sets it true). When on, token validation is skipped for requests that carry an Authorization header or no Cookie header at all — such requests are not CSRF-able, because CSRF abuses a victim's ambient cookie credential and these have none. The token is still issued on safe methods so a later cookie-authenticated browser flow works. Cross-site form CSRF is unaffected: the browser auto-sends the victim's cookies, so an attack request always carries a Cookie header and is validated."
+        },
+        {
+          "title": "Disabling a default security middleware is audited",
+          "body": "Passing false for one of the security-on-by-default middleware (for example middleware: { csrf: false }) now emits an app.middleware.disabled audit event naming the middleware, so a weakened posture leaves a trace in the audit chain rather than being silent."
+        }
+      ]
+    },
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "Idempotent security middleware",
+          "body": "The cookie parser, CSP nonce, fetch-metadata, and CSRF middleware are now idempotent within a request: if one has already run (because createApp wired it and an operator also mounted it), the second instance is a no-op rather than re-parsing, re-generating a nonce, or issuing a second CSRF cookie. This lets an application compose its own middleware order on top of createApp's defaults without double-applying. The body parser already had this behavior."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/50-integration.js

@@ -287,6 +287,200 @@ async function testCreateAppMiddlewareDisableable() {
   }
 }
 
+// Extract a 64-hex csrf token for `name` from a response's Set-Cookie(s).
+function _csrfCookieFrom(resp, name) {
+  var sc = resp.headers["set-cookie"];
+  if (!sc) return null;
+  var arr = Array.isArray(sc) ? sc : [sc];
+  var re = new RegExp("(?:^|;\\s*)" + name + "=([a-f0-9]{64})");
+  for (var i = 0; i < arr.length; i++) {
+    var m = re.exec(arr[i]);
+    if (m) return m[1];
+  }
+  return null;
+}
+
+async function testCreateAppSecurityDefaultsWired() {
+  // createApp wires cookies + cspNonce + fetchMetadata + bodyParser + csrf
+  // ON by default (Core Rule §3). Verify cspNonce patches the CSP, csrf
+  // issues a double-submit cookie + enforces it, and the stateless-skip
+  // lets token-API / cookieless callers through.
+  process.env.BLAMEJS_SKIP_NTP_CHECK = "1";
+  process.env.BLAMEJS_AUDIT_SIGNING_MODE = "plaintext";
+  b.cluster._resetForTest();
+  b.audit._resetForTest();
+  b.vault._resetForTest();
+  b.db._resetForTest();
+  var dataDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-app-sec-"));
+  var app = await b.createApp({
+    dataDir: dataDir,
+    vault:   { mode: "plaintext" },
+    db:      { atRest: "plain", auditSigning: { mode: "plaintext" } },
+    schema:  [],
+    middleware: { botGuard: false },   // bot-guard refuses non-browser-y test clients
+    routes:  function (r) {
+      r.get("/", function (req, res) { b.render.text(res, "OK"); });
+      r.post("/act", function (req, res) { b.render.text(res, "DID"); });
+    },
+  });
+  var addr = await app.listen({ port: 0, host: "127.0.0.1" });
+  try {
+    var g = await _appGet(addr.port, "/");
+    check("security defaults: cspNonce patched the CSP header",
+          typeof g.headers["content-security-policy"] === "string" &&
+          g.headers["content-security-policy"].indexOf("nonce-") !== -1);
+    var token = _csrfCookieFrom(g, "csrf");
+    check("security defaults: csrf double-submit cookie issued",
+          typeof token === "string" && token.length === 64);
+
+    // Cookie-bearing POST without a token → enforced (403).
+    var noTok = await b.httpClient.request({
+      method: "POST", url: "http://127.0.0.1:" + addr.port + "/act",
+      headers: { "Cookie": "csrf=" + token }, body: Buffer.from(""),
+      responseMode: "always-resolve",
+      allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL, allowInternal: true,
+    });
+    check("security defaults: cookie'd POST without token → 403", noTok.statusCode === 403);
+
+    // Cookie + matching header token → validates (200).
+    var withTok = await b.httpClient.request({
+      method: "POST", url: "http://127.0.0.1:" + addr.port + "/act",
+      headers: { "Cookie": "csrf=" + token, "X-CSRF-Token": token }, body: Buffer.from(""),
+      responseMode: "always-resolve",
+      allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL, allowInternal: true,
+    });
+    check("security defaults: cookie'd POST with valid token → 200", withTok.statusCode === 200);
+
+    // Cookieless POST → not CSRF-able → skipStateless skip (200).
+    var cookieless = await b.httpClient.request({
+      method: "POST", url: "http://127.0.0.1:" + addr.port + "/act",
+      body: Buffer.from(""), responseMode: "always-resolve",
+      allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL, allowInternal: true,
+    });
+    check("security defaults: cookieless POST skipped → 200", cookieless.statusCode === 200);
+
+    // Bearer-authenticated POST (even WITH a cookie) → token-auth, not
+    // CSRF-able → skipStateless skip (200).
+    var bearer = await b.httpClient.request({
+      method: "POST", url: "http://127.0.0.1:" + addr.port + "/act",
+      headers: { "Cookie": "csrf=" + token, "Authorization": "Bearer test.token.value" },
+      body: Buffer.from(""), responseMode: "always-resolve",
+      allowedProtocols: b.safeUrl.ALLOW_HTTP_ALL, allowInternal: true,
+    });
+    check("security defaults: bearer-auth POST skipped → 200", bearer.statusCode === 200);
+  } finally {
+    await app.shutdown();
+    fs.rmSync(dataDir, { recursive: true, force: true });
+  }
+}
+
+async function testCreateAppCsrfCustomNaming() {
+  // The default csrf wiring is configurable — operator cookie/field names
+  // flow straight through opts.middleware.csrf, nothing static is baked in.
+  process.env.BLAMEJS_SKIP_NTP_CHECK = "1";
+  process.env.BLAMEJS_AUDIT_SIGNING_MODE = "plaintext";
+  b.cluster._resetForTest();
+  b.audit._resetForTest();
+  b.vault._resetForTest();
+  b.db._resetForTest();
+  var dataDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-app-csrfname-"));
+  var app = await b.createApp({
+    dataDir: dataDir,
+    vault:   { mode: "plaintext" },
+    db:      { atRest: "plain", auditSigning: { mode: "plaintext" } },
+    schema:  [],
+    middleware: { botGuard: false, csrf: { cookie: { name: "app_csrf" }, fieldName: "tok" } },
+    routes:  function (r) { r.get("/", function (req, res) { b.render.text(res, "OK"); }); },
+  });
+  var addr = await app.listen({ port: 0, host: "127.0.0.1" });
+  try {
+    var g = await _appGet(addr.port, "/");
+    check("csrf custom naming: operator cookie name issued through the default wiring",
+          typeof _csrfCookieFrom(g, "app_csrf") === "string");
+    check("csrf custom naming: default 'csrf' cookie name not used",
+          _csrfCookieFrom(g, "csrf") === null);
+  } finally {
+    await app.shutdown();
+    fs.rmSync(dataDir, { recursive: true, force: true });
+  }
+}
+
+async function testCreateAppSecurityDisableAudits() {
+  // Disabling a security default leaves an audit trace (app.middleware.
+  // disabled) and actually drops the middleware.
+  process.env.BLAMEJS_SKIP_NTP_CHECK = "1";
+  process.env.BLAMEJS_AUDIT_SIGNING_MODE = "plaintext";
+  b.cluster._resetForTest();
+  b.audit._resetForTest();
+  b.vault._resetForTest();
+  b.db._resetForTest();
+  var dataDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-app-disable-"));
+  var emitted = [];
+  var realSafeEmit = b.audit.safeEmit;
+  b.audit.safeEmit = function (ev) { emitted.push(ev); return realSafeEmit.call(b.audit, ev); };
+  var app;
+  try {
+    app = await b.createApp({
+      dataDir: dataDir,
+      vault:   { mode: "plaintext" },
+      db:      { atRest: "plain", auditSigning: { mode: "plaintext" } },
+      schema:  [],
+      middleware: { botGuard: false, csrf: false },
+      routes:  function (r) { r.get("/", function (req, res) { b.render.text(res, "OK"); }); },
+    });
+    var disabled = emitted
+      .filter(function (e) { return e && e.action === "app.middleware.disabled"; })
+      .map(function (e) { return e.metadata && e.metadata.middleware; });
+    check("disable audit: csrf disable emits app.middleware.disabled",
+          disabled.indexOf("csrf") !== -1);
+    check("disable audit: botGuard disable emits app.middleware.disabled",
+          disabled.indexOf("botGuard") !== -1);
+    var addr = await app.listen({ port: 0, host: "127.0.0.1" });
+    var g = await _appGet(addr.port, "/");
+    check("disable audit: csrf off → no csrf cookie issued",
+          _csrfCookieFrom(g, "csrf") === null);
+  } finally {
+    b.audit.safeEmit = realSafeEmit;
+    if (app) await app.shutdown();
+    fs.rmSync(dataDir, { recursive: true, force: true });
+  }
+}
+
+async function testCreateAppCsrfIdempotent() {
+  // An operator who ALSO mounts csrf inside opts.routes must not double-
+  // apply — the second mount is a no-op (single cookie issued).
+  process.env.BLAMEJS_SKIP_NTP_CHECK = "1";
+  process.env.BLAMEJS_AUDIT_SIGNING_MODE = "plaintext";
+  b.cluster._resetForTest();
+  b.audit._resetForTest();
+  b.vault._resetForTest();
+  b.db._resetForTest();
+  var dataDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-app-idem-"));
+  var app = await b.createApp({
+    dataDir: dataDir,
+    vault:   { mode: "plaintext" },
+    db:      { atRest: "plain", auditSigning: { mode: "plaintext" } },
+    schema:  [],
+    middleware: { botGuard: false },
+    routes:  function (r) {
+      r.use(b.middleware.csrfProtect({ cookie: true }));   // redundant — createApp already wired csrf
+      r.get("/", function (req, res) { b.render.text(res, "OK"); });
+    },
+  });
+  var addr = await app.listen({ port: 0, host: "127.0.0.1" });
+  try {
+    var g = await _appGet(addr.port, "/");
+    var sc = g.headers["set-cookie"];
+    var arr = Array.isArray(sc) ? sc : (sc ? [sc] : []);
+    var csrfCookies = arr.filter(function (c) { return /^csrf=/.test(c); });
+    check("csrf idempotent: redundant route-level mount issues a single csrf cookie",
+          csrfCookies.length === 1);
+  } finally {
+    await app.shutdown();
+    fs.rmSync(dataDir, { recursive: true, force: true });
+  }
+}
+
 async function testCreateAppRoutesCallback() {
   process.env.BLAMEJS_SKIP_NTP_CHECK = "1";
   process.env.BLAMEJS_AUDIT_SIGNING_MODE = "plaintext";
@@ -462,6 +656,10 @@ async function run() {
   await testCreateAppMinimalBoot();
   await testCreateAppDefaultMiddleware();
   await testCreateAppMiddlewareDisableable();
+  await testCreateAppSecurityDefaultsWired();
+  await testCreateAppCsrfCustomNaming();
+  await testCreateAppSecurityDisableAudits();
+  await testCreateAppCsrfIdempotent();
   await testCreateAppRoutesCallback();
   await testCreateAppWithJobs();
   await testCreateAppShutdown();
@@ -480,6 +678,10 @@ module.exports = {
   testCreateAppMinimalBoot:           testCreateAppMinimalBoot,
   testCreateAppDefaultMiddleware:     testCreateAppDefaultMiddleware,
   testCreateAppMiddlewareDisableable: testCreateAppMiddlewareDisableable,
+  testCreateAppSecurityDefaultsWired: testCreateAppSecurityDefaultsWired,
+  testCreateAppCsrfCustomNaming:      testCreateAppCsrfCustomNaming,
+  testCreateAppSecurityDisableAudits: testCreateAppSecurityDisableAudits,
+  testCreateAppCsrfIdempotent:        testCreateAppCsrfIdempotent,
   testCreateAppRoutesCallback:        testCreateAppRoutesCallback,
   testCreateAppWithJobs:              testCreateAppWithJobs,
   testCreateAppShutdown:              testCreateAppShutdown,

package/lib/vendor/blamejs/test/layer-0-primitives/cert.test.js

@@ -245,6 +245,49 @@ function testFactoryRefusesBadOpts() {
     });
     check("cert name '" + JSON.stringify(badName) + "' refused as path-segment", e && e.code === "cert/bad-cert-name");
   });
+
+  // ---- compliance posture validation ----
+  // opts.compliance names are validated against b.compliance.KNOWN_POSTURES
+  // at create() so a typo is caught at boot rather than silently recorded.
+  var goodChallenge = { type: "http-01", provision: function () {}, cleanup: function () {} };
+  var eBadPosture = threw(function () {
+    b.cert.create({
+      storage:    { type: "sealed-disk", rootDir: _tmpDir(), vault: _ephemeralVault() },
+      acme:       { directory: "https://example/", accountKey: "auto" },
+      certs:      [{ name: "m", domains: ["a.com"], challenge: goodChallenge }],
+      compliance: ["not-a-real-posture"],
+      audit:      false,
+    });
+  });
+  check("unknown compliance posture → cert/unknown-compliance-posture",
+    eBadPosture && eBadPosture.code === "cert/unknown-compliance-posture");
+
+  var eGoodPosture = threw(function () {
+    b.cert.create({
+      storage:    { type: "sealed-disk", rootDir: _tmpDir(), vault: _ephemeralVault() },
+      acme:       { directory: "https://example/", accountKey: "auto" },
+      certs:      [{ name: "m", domains: ["a.com"], challenge: goodChallenge }],
+      compliance: ["hipaa", "pci-dss"],
+      audit:      false,
+    });
+  });
+  check("known compliance postures accepted", !eGoodPosture);
+
+  // ---- b.network.tls.ocsp.fetch composition surface ----
+  check("b.network.tls.ocsp.fetch is a function",
+    typeof b.network.tls.ocsp.fetch === "function");
+}
+
+// b.network.tls.ocsp.fetch rejects on missing leafPem/issuerPem rather than
+// issuing an outbound request with undefined inputs.
+async function testOcspFetchRejectsBadInput() {
+  var rejected = false;
+  try {
+    await b.network.tls.ocsp.fetch({});
+  } catch (_e) {
+    rejected = true;
+  }
+  check("ocsp.fetch({}) rejects (no leafPem/issuerPem)", rejected);
 }
 
 // ---- Sealed-disk storage roundtrip ----
@@ -699,6 +742,7 @@ async function testCorruptAccountKeyClearError() {
 async function run() {
   testSurface();
   testFactoryRefusesBadOpts();
+  await testOcspFetchRejectsBadInput();
   await testStorageRoundtrip();
   await testSniCallback();
   await testSniWildcardSingleLabel();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/blamejs-shop",
-  "version": "0.2.30",
+  "version": "0.3.0",
   "description": "Open-source framework built on blamejs. Vendored stack, zero npm runtime deps, PQC-first crypto, security-on by default.",
   "main": "lib/index.js",
   "scripts": {