@blamejs/core 0.12.66 → 0.12.69

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.12.x
 
+- v0.12.69 (2026-05-26) — **`b.middleware.botGuard` no longer blocks browsers that omit Sec-Fetch-Mode.** b.middleware.botGuard treated a missing Sec-Fetch-Mode header as a bot signal and returned 403 Forbidden, which refused legitimate browsers on any origin where the browser does not emit Fetch Metadata: every plain-HTTP non-localhost origin (Umbrel apps, LAN and *.local reverse-proxy deployments) and Safari before 16.4 even over HTTPS. Browsers only send Sec-Fetch-* in a secure context, so its absence is normal there — not a bot. Sec-Fetch-Mode is now advisory only: it never blocks, and it sets req.suspectedBot in mode:"tag" only on a secure-context HTML GET where a modern browser would have sent it. Drive-by bots are still blocked by the missing-Accept-Language and User-Agent heuristics. No configuration change is needed; if you had widened skipPaths or disabled bot-guard to work around this, you can revert that. **Fixed:** *`b.middleware.botGuard` no longer 403s browsers over plain HTTP or older Safari* — A missing `Sec-Fetch-Mode` was a blocking heuristic, but browsers omit Fetch Metadata outside a secure context (every plain-HTTP non-localhost origin — Umbrel, LAN, `*.local` proxies) and Safari < 16.4 omits it even over HTTPS. Those legitimate browsers were refused with `403 Forbidden`. `Sec-Fetch-Mode` is now advisory: it never blocks, and only sets `req.suspectedBot` in `mode: "tag"` on a secure-context HTML GET. The `Accept-Language` and User-Agent heuristics (which catch the same bots) are unchanged. **Detectors:** *reserved-hostname trailing-dot detector recognizes regex strips* — The codebase-patterns gate that requires stripping the RFC 1034 trailing root-zone dot before a reserved-hostname comparison now also recognizes end-anchored regex strips (`.replace(/\.$/, …)`), not only the `charAt` / `while`-loop forms.
+
+- v0.12.68 (2026-05-26) — **`b.jwk` — RFC 7638 JWK thumbprint.** Compute the RFC 7638 thumbprint of a JSON Web Key — the canonical base64url(SHA-256(canonical-JSON)) identifier used to name a key (DPoP jkt bindings, ACME account-key thumbprints, DBSC session pins, kid derivation). b.jwk.thumbprint(jwk) returns the digest; b.jwk.canonicalize(jwk) returns the exact JSON that is hashed — only the key-type's required members, member names in lexicographic order, no whitespace, so the same key always yields the same thumbprint regardless of how its JWK was serialized. The standard key types are supported (EC, RSA, oct, OKP per RFC 8037) plus AKP, the IANA key type Node uses for ML-DSA / SLH-DSA post-quantum public keys; SHA-256 is the default, with hash: "sha384" | "sha512" for RFC 9278 thumbprint-with-hash. Verified against the RFC 7638 §3.1 worked example. b.auth.dpop, b.acme, and b.dbsc now compute their thumbprints through this primitive. **Added:** *`b.jwk.thumbprint` / `b.jwk.canonicalize`* — RFC 7638 JWK thumbprint. `thumbprint(jwk, opts)` returns `base64url(hash(canonical-JSON))` — only the key-type's required members feed the hash, so optional fields (`kid`, `use`, `alg`, …) never change the result. `canonicalize(jwk)` returns the canonical JSON string itself. Supports EC / RSA / oct / OKP and the AKP post-quantum key type; SHA-256 default, `hash` selects SHA-384 / SHA-512. Throws `JwkError` on an invalid key or unknown hash. **Changed:** *DPoP, ACME, and DBSC compose `b.jwk`* — `b.auth.dpop` (the `jkt` proof-key thumbprint), `b.acme` (the RFC 8555 account-key authorization), and `b.dbsc` (the session-pin thumbprint) now compute RFC 7638 thumbprints through `b.jwk` instead of carrying their own implementations. Behavior is unchanged — DPoP still refuses symmetric key types, and each surface keeps its own error codes.
+
 - v0.12.66 (2026-05-26) — **`b.uriTemplate` — RFC 6570 URI Template expansion.** Expand RFC 6570 URI Templates — the {var} syntax that OpenAPI links, HAL _links, and hypermedia API clients use to turn a template plus a set of variables into a concrete URI. The full Level 4 grammar is supported: every operator ({+var} reserved, {#var} fragment, {.var} label, {/var} path, {;var} path-style parameters, {?var} query, {&var} query continuation), the {var:3} prefix modifier, and the {var*} explode modifier for lists and associative arrays. b.uriTemplate.expand(template, vars) returns the expanded string; b.uriTemplate.compile(template) parses once for templates applied to many variable sets. A malformed template (unclosed expression, reserved operator, non-numeric prefix, unmatched brace) throws UriTemplateError. Verified against the official uritemplate-test conformance suite (all 135 spec, extended, and negative cases). **Added:** *`b.uriTemplate.expand` / `b.uriTemplate.compile`* — RFC 6570 URI Template expansion, full Level 4. `expand(template, vars)` substitutes variables into a template and returns the URI; `compile(template)` returns a reusable `{ expand }` for repeated use. Variable values may be strings, numbers, booleans, arrays (lists), or plain objects (associative arrays); undefined, null, and empty list/map variables are omitted. All eight operators, the `:N` prefix modifier, and the `*` explode modifier follow §3.2, including reserved-set encoding for `{+var}` / `{#var}`. Composes naturally with `b.hal`, `b.linkHeader`, and `b.openapi` link objects. A malformed template throws `UriTemplateError`.
 
 - v0.12.65 (2026-05-26) — **`b.base32` — RFC 4648 Base32 encode / decode.** Encode and decode RFC 4648 Base32 — the case-insensitive alphabet behind TOTP / 2FA secrets, DNSSEC NSEC3 hashes, and human-transcribable identifiers. Both RFC 4648 variants are supported: the standard alphabet (the default) and the extended-hex alphabet. b.base32.encode pads to an 8-character boundary by default (pass padding: false for the bare form TOTP key URIs use); b.base32.decode is strict by default but accepts the real-world shapes humans produce — lower-case, embedded spaces and dashes, missing padding — under loose: true. Verified against the RFC 4648 §10 test vectors for both alphabets. The TOTP primitive now composes this codec instead of carrying its own Base32 implementation. **Added:** *`b.base32.encode` / `b.base32.decode`* — RFC 4648 Base32 codec. `encode(buf, opts)` takes a Buffer or Uint8Array and returns a Base32 string, padded to an 8-character boundary unless `padding: false`; `decode(str, opts)` returns a Buffer. The `variant` option selects the standard (`"rfc4648"`, default) or extended-hex (`"rfc4648-hex"`) alphabet. Decoding is strict by default — any character outside the alphabet throws `Base32Error` — and `loose: true` up-cases the input and ignores embedded spaces, dashes, and missing padding, which is how copied TOTP keys and hand-typed codes arrive. **Changed:** *TOTP composes `b.base32`* — `b.auth.totp` now encodes and decodes its secrets through `b.base32` rather than a private Base32 implementation. Behavior is unchanged — secrets are still emitted unpadded and parsed leniently (case-insensitive, ignoring spaces and dashes).

package/README.md

@@ -71,6 +71,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 
 - **Passwords** — Argon2id + policy primitive (`b.auth.password`); NIST 800-63B / PCI-DSS 4.0 / HIPAA-AAL2 profiles; HaveIBeenPwned k-anonymity breach check; length / context / dictionary / complexity rules; rotation + history
 - **Multi-factor + WebAuthn** — passkeys (WebAuthn), TOTP, JWT (PQ-default)
+- **JWK thumbprint** — RFC 7638 `base64url(SHA-256(canonical-JSON))` key identifier (`b.jwk.thumbprint` / `canonicalize`): EC / RSA / oct / OKP + the AKP post-quantum key type, SHA-256/384/512; the canonical key name behind DPoP `jkt`, ACME account keys, and DBSC session pins
 - **OAuth / OIDC RP** — `b.auth.oauth`
   - RP-Initiated / Front-Channel / Back-Channel Logout 1.0 (`parseFrontchannelLogoutRequest` + `verifyBackchannelLogoutToken` with jti-replay defense)
   - RFC 9207 AS Issuer Identifier validation on callbacks (`parseCallback` — refuses iss mismatch + OP `error=` redirect)

package/index.js

@@ -406,6 +406,7 @@ var jtd = require("./lib/jtd");
 var jsonSchema = require("./lib/json-schema");
 var base32 = require("./lib/base32");
 var uriTemplate = require("./lib/uri-template");
+var jwk = require("./lib/jwk");
 var standardWebhooks = require("./lib/standard-webhooks");
 var lro = require("./lib/lro");
 var jsonApi = require("./lib/jsonapi");
@@ -433,6 +434,7 @@ module.exports = {
   jsonSchema:       jsonSchema,
   base32:           base32,
   uriTemplate:      uriTemplate,
+  jwk:              jwk,
   standardWebhooks: standardWebhooks,
   lro:              lro,
   jsonApi:          jsonApi,

package/lib/acme.js

@@ -45,6 +45,7 @@ var nodeCrypto = require("node:crypto");
 
 var C = require("./constants");
 var asn1 = require("./asn1-der");
+var jwk = require("./jwk");
 var safeUrl = require("./safe-url");
 var safeJson = require("./safe-json");
 var validateOpts = require("./validate-opts");
@@ -114,8 +115,7 @@ function _publicJwkFromKeyObject(keyObject) {
 
 function _jwkThumbprint(publicJwk) {
   // RFC 7638 §3 — base64url(SHA-256(canonical JSON of required members)).
-  var canon = JSON.stringify({ crv: publicJwk.crv, kty: publicJwk.kty, x: publicJwk.x, y: publicJwk.y });
-  return _b64u(nodeCrypto.createHash("sha256").update(canon).digest());
+  return jwk.thumbprint(publicJwk);
 }
 
 function _signJws(privateKey, protectedHeader, payload) {

package/lib/auth/dpop.js

@@ -28,6 +28,7 @@
 
 var nodeCrypto = require("node:crypto");
 var bCrypto = require("../crypto");
+var jwk = require("../jwk");
 var safeJson = require("../safe-json");
 var safeUrl = require("../safe-url");
 var validateOpts = require("../validate-opts");
@@ -84,52 +85,21 @@ function _b64urlDecode(s) {
   }
 }
 
-// Canonical JWK per RFC 7638 — keys present in lexicographic order,
-// only the kty-defined "required" members. Used for thumbprint.
-function _canonicalJwk(jwk) {
-  if (!jwk || typeof jwk !== "object") {
-    throw new AuthError("auth-dpop/bad-jwk", "jwk must be an object");
-  }
-  if (typeof jwk.kty !== "string" || jwk.kty.length === 0) {
-    throw new AuthError("auth-dpop/bad-jwk", "jwk.kty is required");
-  }
-  if (jwk.kty === "EC") {
-    if (typeof jwk.crv !== "string" || typeof jwk.x !== "string" || typeof jwk.y !== "string") {
-      throw new AuthError("auth-dpop/bad-jwk", "EC jwk requires crv, x, y");
-    }
-    return JSON.stringify({ crv: jwk.crv, kty: "EC", x: jwk.x, y: jwk.y });
+// Asymmetric key types DPoP accepts (its proof model relies on a
+// signature, so symmetric "oct" keys are refused). AKP is the IANA key
+// type for ML-DSA / SLH-DSA PQC public keys.
+var DPOP_KTY = { EC: 1, OKP: 1, RSA: 1, AKP: 1 };
+
+function thumbprint(key) {
+  if (!key || typeof key !== "object" || typeof key.kty !== "string" || key.kty.length === 0) {
+    throw new AuthError("auth-dpop/bad-jwk", "jwk must be an object with a kty");
   }
-  if (jwk.kty === "OKP") {
-    if (typeof jwk.crv !== "string" || typeof jwk.x !== "string") {
-      throw new AuthError("auth-dpop/bad-jwk", "OKP jwk requires crv, x");
-    }
-    return JSON.stringify({ crv: jwk.crv, kty: "OKP", x: jwk.x });
+  if (!DPOP_KTY[key.kty]) {
+    throw new AuthError("auth-dpop/refused-kty", "jwk.kty='" + key.kty + "' is not allowed (DPoP requires asymmetric kty)");
   }
-  if (jwk.kty === "RSA") {
-    if (typeof jwk.e !== "string" || typeof jwk.n !== "string") {
-      throw new AuthError("auth-dpop/bad-jwk", "RSA jwk requires e, n");
-    }
-    return JSON.stringify({ e: jwk.e, kty: "RSA", n: jwk.n });
-  }
-  if (jwk.kty === "AKP") {
-    // PQC asymmetric key package (draft-ietf-cose-cnsa-pqc / IANA AKP
-    // registry). Node:crypto exports ML-DSA / SLH-DSA public keys with
-    // kty=AKP, alg=<algId>, pub=<base64url public bytes>.
-    if (typeof jwk.alg !== "string" || typeof jwk.pub !== "string") {
-      throw new AuthError("auth-dpop/bad-jwk", "AKP jwk requires alg, pub");
-    }
-    return JSON.stringify({ alg: jwk.alg, kty: "AKP", pub: jwk.pub });
-  }
-  // Symmetric keys (oct) and any other kty are refused outright — DPoP's
-  // proof model requires asymmetric.
-  throw new AuthError("auth-dpop/refused-kty",
-    "jwk.kty='" + jwk.kty + "' is not allowed (DPoP requires asymmetric kty)");
-}
-
-function thumbprint(jwk) {
-  var canonical = _canonicalJwk(jwk);
-  var hash = nodeCrypto.createHash("sha256").update(canonical, "utf8").digest();
-  return _b64urlEncode(hash);
+  // The RFC 7638 thumbprint itself is computed by b.jwk.
+  try { return jwk.thumbprint(key); }
+  catch (e) { throw new AuthError("auth-dpop/bad-jwk", (e && e.message) || "invalid jwk"); }
 }
 
 function _sha256B64Url(input) {

package/lib/dbsc.js

@@ -36,7 +36,7 @@ var nodeCrypto    = require("node:crypto");
 var validateOpts  = require("./validate-opts");
 var safeJson      = require("./safe-json");
 var bCrypto       = require("./crypto");
-var canonicalJson = require("./canonical-json");
+var jwk           = require("./jwk");
 var jwtExternal   = require("./auth/jwt-external");
 var C             = require("./constants");
 var { defineClass } = require("./framework-error");
@@ -272,23 +272,10 @@ function _trimLeadingZeros(buf) {
   return buf.slice(i);
 }
 
-function _jwkThumbprint(jwk) {
-  // RFC 7638 canonical thumbprint: alphabetic key-name ordering + no
-  // whitespace + SHA-256 + base64url. For EC P-256 the required keys
-  // are { crv, kty, x, y }.
-  var members;
-  if (jwk.kty === "EC") {
-    members = { crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y };
-  } else if (jwk.kty === "RSA") {
-    members = { e: jwk.e, kty: jwk.kty, n: jwk.n };
-  } else {
-    throw new DbscError("dbsc/bad-jwk-kty",
-      "jwkThumbprint: unsupported kty " + jwk.kty);
-  }
-  var canonical = canonicalJson.stringify(members);
-  return bCrypto.toBase64Url(
-    nodeCrypto.createHash("sha256").update(Buffer.from(canonical, "utf8")).digest()
-  );
+function _jwkThumbprint(key) {
+  // RFC 7638 thumbprint (base64url(SHA-256(canonical JWK))) via b.jwk.
+  try { return jwk.thumbprint(key); }
+  catch (e) { throw new DbscError("dbsc/bad-jwk-kty", "jwkThumbprint: " + ((e && e.message) || "invalid jwk")); }
 }
 
 module.exports = {

package/lib/jwk.js

@@ -0,0 +1,127 @@
+"use strict";
+/**
+ * @module b.jwk
+ * @nav    Identity
+ * @title  JWK Thumbprint
+ *
+ * @intro
+ *   Compute the <a href="https://www.rfc-editor.org/rfc/rfc7638">RFC 7638</a>
+ *   thumbprint of a JSON Web Key — the canonical, hash-based identifier used
+ *   to name a key (DPoP <code>jkt</code> bindings, ACME account-key
+ *   thumbprints per RFC 8555, DBSC session pins, and <code>kid</code>
+ *   derivation). The thumbprint is
+ *   <code>base64url(SHA-256(canonical-JSON))</code>, where the canonical
+ *   JSON contains only the key-type's required members, with member names
+ *   in lexicographic order and no whitespace — so the same key always
+ *   produces the same thumbprint regardless of how its JWK was serialized.
+ *
+ *   <code>thumbprint(jwk)</code> returns the base64url digest;
+ *   <code>canonicalize(jwk)</code> returns the exact JSON string that is
+ *   hashed. The standard key types are supported — EC, RSA, oct, and OKP
+ *   (RFC 8037 Ed25519 / X25519) — plus AKP, the IANA key type Node uses for
+ *   ML-DSA / SLH-DSA post-quantum public keys. SHA-256 is the default;
+ *   <code>hash: "sha384" | "sha512"</code> selects a longer digest
+ *   (RFC 9278 thumbprint-with-hash).
+ *
+ * @card
+ *   RFC 7638 JWK thumbprint — the canonical
+ *   <code>base64url(SHA-256(canonical-JSON))</code> identifier for a JSON
+ *   Web Key (EC / RSA / oct / OKP / AKP), behind DPoP <code>jkt</code>,
+ *   ACME account keys, and DBSC session pins.
+ */
+
+var nodeCrypto = require("node:crypto");
+var canonicalJson = require("./canonical-json");
+var { defineClass } = require("./framework-error");
+
+var JwkError = defineClass("JwkError", { alwaysPermanent: true });
+
+var HASHES = { sha256: "sha256", sha384: "sha384", sha512: "sha512" };
+
+// RFC 7638 §3.2 + JWA: the required members per key type, which (and only
+// which) participate in the thumbprint. Listed for documentation; the
+// canonical form is produced with lexicographic ordering regardless.
+var REQUIRED = {
+  EC:  ["crv", "kty", "x", "y"],
+  RSA: ["e", "kty", "n"],
+  oct: ["k", "kty"],
+  OKP: ["crv", "kty", "x"],   // RFC 8037
+  AKP: ["alg", "kty", "pub"], // IANA AKP — ML-DSA / SLH-DSA public keys
+};
+
+function _requiredMembers(jwk) {
+  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) {
+    throw new JwkError("jwk/bad-jwk", "jwk: must be a JWK object");
+  }
+  if (typeof jwk.kty !== "string" || jwk.kty.length === 0) {
+    throw new JwkError("jwk/bad-jwk", "jwk: 'kty' is required");
+  }
+  var names = REQUIRED[jwk.kty];
+  if (!names) throw new JwkError("jwk/unsupported-kty", "jwk: unsupported kty '" + jwk.kty + "'");
+  var out = {};
+  for (var i = 0; i < names.length; i++) {
+    var n = names[i];
+    if (typeof jwk[n] !== "string" || jwk[n].length === 0) {
+      throw new JwkError("jwk/bad-jwk", "jwk: " + jwk.kty + " key requires a string '" + n + "' member");
+    }
+    out[n] = jwk[n];
+  }
+  return out;
+}
+
+/**
+ * @primitive  b.jwk.canonicalize
+ * @signature  b.jwk.canonicalize(jwk)
+ * @since      0.12.68
+ * @status     stable
+ * @related    b.jwk.thumbprint
+ *
+ * Return the RFC 7638 canonical JSON string for a JWK — only the key-type's
+ * required members, member names in lexicographic order, no whitespace.
+ * This is the exact input that <code>thumbprint</code> hashes. Throws
+ * <code>JwkError</code> for a missing <code>kty</code>, an unsupported key
+ * type, or a missing required member.
+ *
+ * @example
+ *   b.jwk.canonicalize({ kty: "EC", crv: "P-256", x: "...", y: "...", use: "sig" });
+ *   // → '{"crv":"P-256","kty":"EC","x":"...","y":"..."}'  (use omitted)
+ */
+function canonicalize(jwk) {
+  return canonicalJson.stringify(_requiredMembers(jwk));
+}
+
+/**
+ * @primitive  b.jwk.thumbprint
+ * @signature  b.jwk.thumbprint(jwk, opts?)
+ * @since      0.12.68
+ * @status     stable
+ * @related    b.jwk.canonicalize
+ *
+ * Compute the RFC 7638 thumbprint of a JWK:
+ * <code>base64url(hash(canonicalJSON))</code>. Only the key-type's required
+ * members feed the hash, so optional fields (<code>kid</code>,
+ * <code>use</code>, <code>alg</code>, …) never change the result. SHA-256
+ * is the default digest; <code>hash</code> selects a longer one. Throws
+ * <code>JwkError</code> on an invalid JWK or unknown hash.
+ *
+ * @opts
+ *   hash:   "sha256" | "sha384" | "sha512",   // default: "sha256"
+ *
+ * @example
+ *   b.jwk.thumbprint({ kty: "RSA", e: "AQAB", n: "0vx7ago...DKgw" });
+ *   // → "NzbLsXh8uDCcd-6MNwXF4W_7noWXFZAfHkxZsRGC9Xs"
+ */
+function thumbprint(jwk, opts) {
+  opts = opts || {};
+  var hash = HASHES[opts.hash || "sha256"];
+  if (!hash) throw new JwkError("jwk/bad-hash", "jwk.thumbprint: hash must be sha256, sha384, or sha512");
+  var canon = canonicalize(jwk);
+  return nodeCrypto.createHash(hash).update(canon, "utf8").digest("base64url");
+}
+
+module.exports = {
+  thumbprint:   thumbprint,
+  canonicalize: canonicalize,
+  REQUIRED:     REQUIRED,
+  JwkError:     JwkError,
+};

package/lib/middleware/bot-guard.js

@@ -6,8 +6,12 @@
  *
  * Heuristics (all combined):
  *   - Missing Accept-Language header (real browsers always send one)
- *   - Missing Sec-Fetch-Mode header (modern browsers send these on every
- *     navigation; absence is suspicious for HTML routes but not API)
+ *   - Missing Sec-Fetch-Mode header — ADVISORY ONLY (never blocks). Tagged
+ *     in mode:"tag" on secure-context HTML GETs where a modern browser
+ *     would have sent it. It cannot block because the header is absent for
+ *     entire browser families (Safari < 16.4) and for every plain-HTTP
+ *     non-localhost origin (Umbrel, LAN / *.local proxies) — a 403 on it
+ *     alone would refuse real users.
  *   - User-Agent matches known automation libraries (curl, wget, python-
  *     requests, axios, Go-http-client) — operators can add or remove
  *     entries via config
@@ -86,9 +90,13 @@ function _xffIpFor(trustProxy) {
  * Cheap fingerprint-based detection of obviously-non-browser requests.
  * Constructed via `b.middleware.botGuard(opts)`; the resulting
  * middleware has the `(req, res, next)` shape shown above.
- * Combines three heuristics: missing `Accept-Language`, missing
- * `Sec-Fetch-Mode` (HTML routes), and User-Agent regex match against
- * a default list (curl / wget / python-requests / axios / etc.). Not
+ * Two blocking heuristics — missing `Accept-Language` and a User-Agent
+ * regex match against a default list (curl / wget / python-requests /
+ * axios / etc.) — plus one advisory signal: a missing `Sec-Fetch-Mode`
+ * on a secure-context HTML GET sets `req.suspectedBot` in `mode: "tag"`
+ * but NEVER blocks (the header is absent for Safari < 16.4 and every
+ * plain-HTTP non-localhost origin, so blocking on it refuses real
+ * users). Not
  * a substitute for proper authentication — catches drive-by scrapers
  * and low-effort bots. In `mode: "block"` (default) the request is
  * refused; in `mode: "tag"` `req.suspectedBot = true` is set and the
@@ -152,6 +160,28 @@ function create(opts) {
     return /^\/api\//.test(path);
   }
 
+  // Browsers only emit Fetch Metadata (Sec-Fetch-*) in a *secure context*
+  // (W3C Secure Contexts): an HTTPS origin, or a localhost-family origin
+  // even over plain HTTP. On a plain-HTTP non-localhost origin — an Umbrel
+  // app, a LAN / *.local reverse-proxy deployment — the browser omits
+  // Sec-Fetch-* entirely, so a missing Sec-Fetch-Mode is NORMAL there and
+  // must not be read as a bot signal. The effective scheme honours
+  // X-Forwarded-Proto only under trustProxy (otherwise it is forgeable).
+  function _isSecureContext(req) {
+    if (requestHelpers.requestProtocol(req, { trustProxy: trustProxy }) === "https") return true;
+    var host = (req.headers && req.headers.host) || "";
+    host = String(host).toLowerCase().replace(/:\d+$/, "");   // strip :port
+    if (host.charAt(0) === "[") {                              // [::1] IPv6 literal
+      var end = host.indexOf("]");
+      host = end === -1 ? host.slice(1) : host.slice(1, end);
+    }
+    host = host.replace(/\.$/, "");                            // strip trailing root-zone dot (RFC 1034 §3.1) so "localhost." matches
+    if (host === "localhost" || /\.localhost$/.test(host)) return true;
+    if (host === "::1") return true;
+    if (/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host)) return true;   // allow:regex-no-length-cap — bounded dotted-quad loopback
+    return false;
+  }
+
   function _checkHeuristics(req) {
     var headers = req.headers || {};
     var ua = headers["user-agent"] || "";
@@ -167,7 +197,14 @@ function create(opts) {
       return null;
     }
     if (!headers["accept-language"]) return "missing-accept-language";
-    if (req.method === "GET" && !headers["sec-fetch-mode"]) return "missing-sec-fetch-mode";
+    // Missing Sec-Fetch-Mode NEVER blocks: the header is absent for entire
+    // browser families (Safari < 16.4 omits Fetch Metadata even over HTTPS)
+    // and for every plain-HTTP non-localhost origin (Umbrel, LAN / *.local
+    // reverse proxies), so a 403 on it alone refuses real users. It survives
+    // only as an advisory TAG in mode:"tag", and even then only in a secure
+    // context where a modern browser would have sent it. Drive-by bots are
+    // still blocked by missing Accept-Language + the User-Agent deny-list.
+    if (mode === "tag" && req.method === "GET" && _isSecureContext(req) && !headers["sec-fetch-mode"]) return "missing-sec-fetch-mode";
     return null;
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.12.66",
+  "version": "0.12.69",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:4e9da547-078d-46ac-833b-3eae7e281a06",
+  "serialNumber": "urn:uuid:99cf7113-3c76-4163-809f-e0478728ac1c",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-26T10:01:10.136Z",
+    "timestamp": "2026-05-26T15:45:38.862Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.12.66",
+      "bom-ref": "@blamejs/core@0.12.69",
       "type": "application",
       "name": "blamejs",
-      "version": "0.12.66",
+      "version": "0.12.69",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.12.66",
+      "purl": "pkg:npm/%40blamejs/core@0.12.69",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.12.66",
+      "ref": "@blamejs/core@0.12.69",
       "dependsOn": []
     }
   ]