@blamejs/core 0.14.26 → 0.15.0

package/lib/constants.js

@@ -156,22 +156,27 @@ var PQC_GROUPS = Object.freeze({
   SecP384r1MLKEM1024:    0x11ED,
 });
 
-// Highest-first preference list. Node TLS picks the first mutually-
-// supported group during the handshake, so SecP384r1MLKEM1024
-// (P-384 + ML-KEM-1024) is what we always use when the peer also
-// advertises it. X25519MLKEM768 is the only fallback — both are
-// PQC hybrids with current standardized parameter sets.
+// Highest-first preference list for OUTBOUND TLS (clients only — the
+// server's accept-groups are configured separately). Node TLS picks the
+// first mutually-supported group during the handshake, so a peer that
+// advertises SecP384r1MLKEM1024 (P-384 + ML-KEM-1024) gets it, then the
+// X25519 / SecP256r1 ML-KEM hybrids. X25519 (classical) is the LAST-RESORT
+// fallback for peers that support no ML-KEM hybrid yet — still most of the
+// public TLS surface in 2026 (webhooks, OAuth/OIDC, ACME, third-party APIs).
 //
-// Weaker hybrids (e.g. P-256 + ML-KEM-768) are deliberately excluded
-// from the framework's default preference. An operator integrating
-// with a peer that only supports a weaker PQC group constructs their
-// own https.Agent outside lib/pqc-agent so the downgrade is visible
-// in the diff — the framework primitive cannot be coaxed into
-// negotiating below this list.
+// The framework always PREFERS a hybrid on every handshake; classical
+// X25519 is only negotiated when the peer offers none of the hybrids. When
+// a connection lands on classical instead, the outbound path emits a
+// `tls.classical_downgrade` audit event (lib/pqc-agent.js) so operators can
+// see which peers forced a non-PQC negotiation and track their
+// dependencies' PQC readiness. Weaker non-hybrid classical groups
+// (P-256 / P-384) are deliberately NOT offered — the fallback floor is the
+// X25519 group.
 var TLS_GROUP_PREFERENCE = Object.freeze([
   "SecP384r1MLKEM1024",
   "X25519MLKEM768",
   "SecP256r1MLKEM768",
+  "X25519",
 ]);
 
 var TLS_GROUP_CURVE_STR = TLS_GROUP_PREFERENCE.join(":");