@blamejs/core 0.15.7 → 0.15.8

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.15.x
 
+- v0.15.8 (2026-06-13) — **Redacts OTLP log-sink attributes to close a secret/PII egress the span fix missed, adds EU DSA and China PIPL cross-border compliance record-builders, ships an SSDF producer self-attestation with every release, and makes the published tarball reproducible.** This release closes a telemetry egress hole, adds two compliance record-builder namespaces, and hardens the release supply chain. The OTLP log sinks (HTTP-JSON and gRPC) shipped a log record's meta attributes and the resource attributes to the collector unredacted — a log line carrying a bearer token, password, or API key reached the wire verbatim (CWE-532). The 0.15.4 fix wired the telemetry redactor into the span and metric exporters but the log sinks were missed; both now run record and resource attributes through the same redactor before serialization. New b.dsa builds the EU Digital Services Act (Reg 2022/2065) records an intermediary or platform must keep — Art. 16 notice-and-action, Art. 17 statement of reasons, and the Art. 15 / 24(3) transparency report. New b.pipl builds the China PIPL cross-border transfer records — an Art. 38/40 assessment that determines whether a CAC security assessment is mandatory (CIIO, important data, or the volume / sensitive-PI thresholds), and an Art. 40 security-assessment certificate. On the supply-chain side, every release now ships ssdf-attestation.json, a machine-readable NIST SP 800-218 / OMB M-22-18 producer self-attestation mapping each secure-development practice to its implementing control, and the published tarball is now packed with SOURCE_DATE_EPOCH so an operator can rebuild it byte-for-byte from the release commit. **Added:** *b.dsa — EU Digital Services Act compliance record-builders* — `b.dsa` builds the dated, frozen records the EU Digital Services Act (Regulation (EU) 2022/2065) requires an online intermediary or platform to keep: `b.dsa.noticeAndAction` (Art. 16) records a notice against a piece of content and computes the action-due window; `b.dsa.statementOfReasons` (Art. 17) records a moderation decision with its legal or contractual ground (exactly one is required), the facts, whether it was automated, and the redress routes offered; `b.dsa.transparencyReport` (Art. 15 / 24(3)) aggregates the period counts into a report with the next-due date. The builders perform no network I/O and emit a best-effort audit event; they map to the `dsa` compliance posture. · *b.pipl — China PIPL cross-border transfer record-builders* — `b.pipl.sccFilingAssessment` builds a PIPL Art. 38/40/55 cross-border transfer assessment and determines the lawful mechanism: it forces a CAC security assessment (over a self-selected standard contract or certification) when the exporter is a critical-information-infrastructure operator, exports important data, handles personal information of more than 1,000,000 individuals, or crosses the cumulative volume / sensitive-PI thresholds. `b.pipl.securityAssessmentCertificate` records an Art. 40 security-assessment self-declaration with a 3-year validity clock. Both return frozen dated records and map to the `pipl-cn` posture. · *SSDF producer self-attestation shipped with every release* — Every release now attaches `ssdf-attestation.json` — a machine-readable NIST SP 800-218 (SSDF v1.1) / OMB M-22-18 producer self-attestation. It maps each secure-software-development practice to its implementing control in the tree (SLSA L3 provenance, SSH-signed tags, vendored zero-runtime-dep supply chain, OSV-Scanner gating, coordinated disclosure) and is deterministic from the release commit. Its sha256 is a subject of the SLSA L3 provenance, so verifying the provenance verifies the attestation has not been tampered with. Downstream consumers who require SSDF supplier-compliance evidence can download it from the release page. **Security:** *OTLP log sinks redact record and resource attributes before export* — `b.logStream`'s OTLP log sinks (HTTP-JSON and gRPC) shipped a log record's `meta` attributes and the sink's resource attributes to the collector UNREDACTED, so a log line whose meta carried a bearer token, password, or API key — or a credential placed in a resource attribute — reached the OTLP wire verbatim (CWE-532). The 0.15.4 change baked the telemetry redactor into the span and metric exporters but its detector was anchored on the span/metric encoder function names, leaving the log sinks uncovered. Both log sinks now run record and resource attributes through `b.observability.redactAttrs` before serialization, the same egress contract the span and metric exporters already hold. · *Reproducible published tarball (SOURCE_DATE_EPOCH)* — The release workflow now exports `SOURCE_DATE_EPOCH` (derived from the tagged commit's author date) before `npm pack`, so the mtime stamped into every tar header is deterministic. An operator can re-pack the package from the same commit and match the published tarball's sha256 byte-for-byte, strengthening the source-to-artifact verification path alongside the existing SLSA L3 provenance and PQC signatures. **Detectors:** *otlp-log-sink-encodes-attrs-without-redactor* — Fires when an OTLP log-sink encoder hands a raw `record.meta` or resource-attribute map to serialization without routing it through `observability.redactAttrs` — the class the span/metric detector could not see because the log sinks carry the OTLP-logs schema function names.
+
 - v0.15.7 (2026-06-13) — **Hardens the new URL canonicalizer against an IPv4-mapped allowlist bypass, enforces the OIDC azp authorized-party check, and closes a set of audited correctness gaps in retention, credential rehashing, the scheduler, and SD-JWT key binding.** This release deepens the URL/host canonicalizer shipped in 0.15.6 and clears a batch of audited correctness gaps. The canonicalizer now folds an IPv4-mapped IPv6 address (::ffff:1.2.3.4) to its embedded IPv4 and strips every trailing dot from a host, so a dual-stack peer can no longer slip past an operator's dotted-IPv4 allowlist and host./host.. no longer evade a host comparison. (NAT64 and 6to4 hosts are deliberately kept as IPv6 so canonicalizing then classifying agrees with the SSRF classifier, which treats them as reserved.) On the OIDC side, verifyIdToken now enforces OIDC Core 3.1.3.7: a multi-audience ID token must carry an azp (authorized party) and a present azp must equal the client_id, closing a confused-deputy hole where a token minted for a different client but listing this RP in its audience array verified clean. The rest are audited fixes: retention.complianceFloor now honors the active posture set via applyPosture (the documented inheritance was unimplemented); credentialHash.needsRehash now drives the advertised SHAKE256 length-rotation (raising the output length now triggers a rehash, upgrade-only); the task scheduler no longer lets a run abandoned by its watchdog clobber the next run's state or emit a stale success when its slow promise settles late; and the SD-JWT key-binding JWT compares its audience and nonce in constant time. **Fixed:** *retention.complianceFloor honors the active compliance posture* — `b.retention.complianceFloor` required an explicit posture and never read the active posture set by `applyPosture` (the `b.compliance.set` cascade), so the documented inheritance was unimplemented dead state. It now inherits the active posture when none is passed — `complianceFloor(candidateTtlMs)` uses the active posture, an explicit posture still overrides it — and `applyPosture(null)` now clears the active posture (it was a silent no-op, so `b.compliance.clear` could not reset it). · *credentialHash.needsRehash drives the SHAKE256 length-rotation* — `b.credentialHash.needsRehash` never compared the stored SHAKE256 digest length against the configured length, so raising the output length never triggered a rehash and the advertised length-rotation was a silent no-op. It now flags a digest shorter than the configured/default length for rehash (upgrade-only — a longer-than-target digest is never shortened, matching the Argon2 convention). · *The scheduler no longer lets a watchdog-abandoned run corrupt the next run* — `b.scheduler`'s watchdog force-clears a task's running flag after `maxJobMs` so a hung handler can't lock out future fires, and the next tick re-fires. The original slow promise then settled late and unconditionally overwrote the task's running / lastFinish / lastError state and emitted a `system.scheduler.task.success`|`failure` for a run the watchdog had already given up on — clobbering the new run and double-counting. Each run is now tagged with a generation that the watchdog and every fire bump; a settle whose tag is stale is ignored. **Security:** *The URL canonicalizer folds IPv4-mapped IPv6 addresses to IPv4* — `b.safeUrl.canonicalize` / `b.ssrfGuard.canonicalizeHost` now fold an IPv4-mapped IPv6 address (`::ffff:1.2.3.4`, the `::ffff:0:0/96` block) to its embedded IPv4 dotted form. Previously it canonicalized to an IPv6 string, so a dual-stack peer never unified with an operator's `1.2.3.4` allow/deny entry — an allowlist bypass. Only the IPv4-mapped block folds, because the SSRF classifier maps it to the embedded v4 verdict directly; NAT64 (`64:ff9b::/96`) and 6to4 (`2002::/16`) are deliberately kept as IPv6, since the classifier treats a NAT64 literal as reserved and folding it would turn a blocked verdict into an allowed public IPv4. The host canonicalizer also now strips every trailing dot, so `host`, `host.`, and `host..` collapse to one form. · *verifyIdToken enforces the OIDC azp (authorized party) check* — `b.auth.oauth`'s `verifyIdToken` validated only that its `client_id` was present in the token's `aud`, ignoring `azp`. Per OIDC Core 3.1.3.7, a multi-audience ID token must carry an `azp` and a present `azp` must equal the RP's `client_id`. Without it, a token whose authorized party is a different client — but whose `aud` array also lists this RP — verified clean (a confused-deputy / token-substitution hole). The verifier now rejects a multi-audience token with no `azp` (`auth-oauth/azp-required`) and any token whose `azp` is not the `client_id` (`auth-oauth/azp-mismatch`). A single-audience token with no `azp` (the common case) is unaffected. · *SD-JWT key-binding audience and nonce compare in constant time* — `b.auth.sdJwtVc.verify` compared the key-binding JWT's `aud` and `nonce` with a short-circuiting `!==`, while the adjacent `sd_hash` check already used a constant-time compare. The `nonce` is a verifier-issued replay-defense value, so a non-constant-time compare leaks a matching-prefix timing oracle; both checks now use the constant-time helper.
 
 - v0.15.6 (2026-06-12) — **Closes SAML and OIDC assertion-replay windows, bounds SSE memory under a slow client, restores at-least-once delivery for a crashed outbox publisher, makes sealed-column membership queries work, ships JOSE-conformant SD-JWT signatures, and adds a URL canonicalizer for SSRF-safe comparison.** A security and correctness release. On the identity surface: a SAML Response whose Bearer (or Holder-of-Key) SubjectConfirmation omits NotOnOrAfter is now rejected instead of accepted as fresh-forever, and the OIDC ID-token verifier no longer lets a caller disable expiry validation on a normal token - the exp bypass is restricted to back-channel-logout tokens and bounded by an issued-at freshness floor. SD-JWT-VC ES256/ES384 signatures are now emitted as JOSE raw r||s, so credentials this issuer signs verify in conformant wallets and verifiers. A new b.safeUrl.canonicalize (and b.ssrfGuard.canonicalizeHost) collapses obfuscated host and IP forms to one canonical string so allowlist and SSRF comparisons can't be bypassed by encoding tricks. On the reliability side: server-sent-event channels now cap their per-connection outbound buffer and evict a stalled client instead of growing the heap without bound; the outbox reclaims a job left in-flight by a publisher that crashed mid-delivery; the background worker pool no longer drops a task queued behind one that timed out; a retention preview no longer rewrites the whole database file; an equality / membership query on an encrypted column now hashes each candidate (membership queries previously failed outright); and the on-read re-hash of a legacy lookup digest now runs on Postgres and MySQL handles, not only SQLite. **Fixed:** *SD-JWT-VC ES256 / ES384 signatures are JOSE-conformant* — `b.auth.sdJwtVc` signed and verified ES256 / ES384 credentials with node:crypto's default DER ECDSA encoding instead of the raw r||s (`ieee-p1363`) form JOSE and EUDI wallets require, so a credential this issuer signed was rejected by conformant verifiers and the library rejected conformant holders' key-binding JWTs. The issuer JWT and the holder KB-JWT now both sign and verify with `ieee-p1363`, matching the rest of the framework's JOSE signers. · *Membership queries on an encrypted column now work* — Querying an encrypted (sealed) column with `IN` / `$in` - `b.db.from(table).whereIn("email", [...])` or `b.db.collection(table).find({ email: { $in: [...] } })` - threw, because the sealed-field-to-derived-hash rewrite passed the whole candidate array to the hash lookup as a single value. Each candidate is now hashed individually and matched against both its active keyed digest and its legacy digest, so membership queries on an encrypted column return the right rows, including rows written before the lookup-hash default changed. · *A timing-out background task no longer drops the task queued behind it* — When a `b.workerPool` task timed out or its worker errored, the slot was returned to the idle pool and drained one moment before it was marked for recycling, so a task queued behind it could be dispatched to the worker about to be terminated - and came back as `workerpool/worker-exit` (or hung) instead of running. The slot is now marked recycling before the queue is drained, so the queued task waits for the replacement worker. · *The outbox recovers a job stranded by a crashed publisher* — `b.outbox` claims a row by flipping it to in-flight, but the claim scan only selected pending rows, so a publisher that crashed between claiming a row and recording delivery left that row in-flight forever - the event was silently dropped, breaking at-least-once delivery. The outbox now stamps each claim with a timestamp and, at the start of every poll, returns any in-flight row older than the claim lease (`claimReclaimMs`, default 5 minutes) to the pending pool so it is delivered. An existing outbox table gains the new column automatically. · *A retention preview no longer rewrites the whole database* — Previewing a retention rule with `b.retention` (`run(name, { dryRun: true })` or the `retention preview` command) ran a full database VACUUM for every candidate row under a regulated posture (gdpr / hipaa / and similar), because the per-row erase - which schedules the vacuum - ran before the dry-run check. A preview now computes what it would erase without touching the database; the vacuum runs only on a real erase. · *On-read lookup-digest upgrade runs on Postgres and MySQL* — When `b.cryptoField.unsealRow` re-hashed a legacy lookup digest to the current keyed form and persisted it, the UPDATE was always built for SQLite, so on a Postgres or MySQL handle the durable rewrite quoted identifiers for the wrong dialect and silently no-opped - the legacy digest stayed on disk and the migration never completed off SQLite. The rewrite now uses the handle's own dialect. **Security:** *SAML SubjectConfirmation without NotOnOrAfter is rejected* — `b.auth.saml` SP response verification treated the `NotOnOrAfter` attribute on a Bearer SubjectConfirmationData as optional: a confirmation that omitted it was accepted with no upper bound on the assertion's freshness - a captured assertion replayable indefinitely. SAML 2.0 Web Browser SSO Profile §4.1.4.2 requires Bearer confirmations to carry NotOnOrAfter. `verifyResponse` now rejects a confirmation that is missing NotOnOrAfter, has an unparseable value, or is expired; the Holder-of-Key path (Profile §3.1) is hardened the same way, including the previously-accepted unparseable-value case. · *ID-token expiry can no longer be disabled on a normal token* — `b.auth.oauth`'s `verifyIdToken` honored a `skipExpCheck` option with no constraint, so any caller could verify an expired - or replayed - ID token. That option exists only for OIDC Back-Channel Logout tokens, which carry no `exp`. It is now self-guarding: `verifyIdToken` rejects `skipExpCheck` (`auth-oauth/skip-exp-check-not-allowed`) on any token that lacks the back-channel-logout event claim, and even for a logout token it enforces an `iat` freshness floor (`auth-oauth/logout-token-stale`). The internal logout path is unaffected. · *Server-sent-event channels bound their outbound buffer* — An SSE channel wrote to the response with no regard for backpressure and no cap on buffered bytes, so a single stalled client could make the server buffer events until the heap was exhausted (a memory-exhaustion denial of service). Each channel now tracks its unflushed-byte count and, past a per-channel cap (`maxBufferedBytes`, default 1 MiB), closes the connection and throws `sse/backpressure` - evicting the slow consumer instead of buffering without limit. A client that keeps up is never affected. · *URL and host canonicalizer for SSRF-safe comparison* — New `b.safeUrl.canonicalize(url, opts?)` and `b.ssrfGuard.canonicalizeHost(host)` return the canonical, comparable form of a URL or host: scheme and host lowercased, IDN hosts emitted as their punycode A-label (a confusable / mixed-script host is rejected), every base of an IP literal (decimal, octal, hex, dotted, IPv4-mapped and zero-compressed IPv6) collapsed to one canonical address, default ports stripped, trailing-dot hosts normalized, and path percent-encoding normalized per RFC 3986. Use it to build host allowlists, deduplicate URLs, or compare a fetch target so an allowlist check can't be bypassed by encoding the same address a different way.

package/README.md

@@ -194,6 +194,8 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 - **AEDT bias audit** — NYC Local Law 144 bias-audit figures (`b.ai.aedtBiasAudit`): selection / scoring rates and EEOC four-fifths-rule impact ratios across sex, race/ethnicity, and their intersection, with the most-selected group and adverse-impact flags (impact ratio < 0.8) for the annual published summary; sub-2% categories excludable per DCWP §5-301
 - **Frontier AI protocol** — California SB 53 (Transparency in Frontier AI Act) obligations (`b.ai.frontierModelProtocol`): classify the frontier-model (>10²⁶ training FLOPs) and large-frontier-developer (>$500M revenue) thresholds, enumerate the resulting obligations, check a safety framework for required elements, and build a critical-safety-incident report with the 15-day / 24-hour California OES notification deadline (`.incidentReport`)
 - **GPAI Code-of-Practice adherence** — signed, tamper-evident EU AI Act Art. 53 / 55 adherence declarations with a regulation-derived obligation set (a systemic-risk model omitting the Art. 55 chapter is refused) and SHA3-512 evidence binding, emitted inside an ML-DSA-87-signed CycloneDX 1.6 ML-BOM and replay-checked on verify (`b.compliance.aiAct.gpai.declareAdherence` / `verifyAdherence`)
+- **EU Digital Services Act records** — dated, frozen builders for the content-governance loop the DSA (Reg 2022/2065) requires: Art. 16 notice-and-action with the action-due window, Art. 17 statement of reasons (exactly one legal-or-contractual ground, redress routes, automated-decision flag), and the Art. 15 / 24(3) transparency report (`b.dsa.noticeAndAction` / `statementOfReasons` / `transparencyReport`)
+- **China PIPL cross-border transfer records** — Art. 38/40/55 assessment that forces a CAC security assessment over a self-selected standard contract when a critical-information-infrastructure operator, important data, or the volume / sensitive-PI thresholds are in scope, plus an Art. 40 security-assessment certificate with a 3-year validity clock (`b.pipl.sccFilingAssessment` / `securityAssessmentCertificate`)
 
 ### Compliance regimes
 

package/index.js

@@ -89,6 +89,8 @@ audit.export = function (opts) {
 var auditChain = require("./lib/audit-chain");
 var consent = require("./lib/consent");
 var privacy = require("./lib/privacy");
+var dsa = require("./lib/dsa");
+var pipl = require("./lib/pipl-cn");
 var subject = require("./lib/subject");
 var session = require("./lib/session");
 var storage = require("./lib/storage");
@@ -467,6 +469,8 @@ module.exports = {
   events:           events,
   consent:          consent,
   privacy:          privacy,
+  dsa:              dsa,
+  pipl:             pipl,
   subject:          subject,
   session:          session,
   storage:          storage,

package/lib/audit.js

@@ -343,6 +343,7 @@ var FRAMEWORK_NAMESPACES = [
                 //   (role-switching, RLS-shaped events)
   "dkim",       // b.mail.dkim (DKIM-Signature generation events)
   "dora",       // b.dora (DORA Article 17: dora.incident.classified / reported / draftFinal)
+  "dsa",        // b.dsa (EU Digital Services Act: dsa.notice.recorded / dsa.sor.recorded / dsa.transparency_report.generated)
   "dsr",        // b.dsr (Data Subject Rights workflow: dsr.ticket.* / dsr.source.*)
   "dual",       // b.dualControl (dual.grant.requested / approved / denied / consumed / expired / self_approval_denied)
   "mail",       // b.mail (b.mail-bounce uses "system.mail.*")
@@ -357,6 +358,7 @@ var FRAMEWORK_NAMESPACES = [
   "inbox",      // b.inbox (inbox.received / handled / handle_failed / swept)
   "flag",       // b.flag (flag.evaluated / flag.evaluation.error / flag.cache.bust)
   "permissions", // b.permissions
+  "pipl",       // b.pipl (China PIPL cross-border: pipl.transfer.assessed / pipl.security_assessment.recorded)
   "pqcagent",   // b.pqcAgent (pqcagent.operator_group.accepted)
   "privacy",    // b.privacy (privacy.vendor_review.recorded)
   "restore",    // b.restore

package/lib/dsa.js

@@ -0,0 +1,482 @@
+"use strict";
+/**
+ * @module b.dsa
+ * @nav    Compliance
+ * @title  Digital Services Act
+ *
+ * @intro
+ *   Record-builders for the operator workflows the EU Digital Services
+ *   Act (Regulation (EU) 2022/2065) requires an online intermediary or
+ *   platform to keep on file. Three dated, frozen attestation records
+ *   cover the regulation's core content-governance loop:
+ *
+ *     - `noticeAndAction` (Art. 16) records a notice a third party
+ *       submits against a piece of content and computes the window
+ *       inside which the provider must act on it.
+ *     - `statementOfReasons` (Art. 17) records the moderation decision
+ *       taken on a piece of content, its legal or contractual ground,
+ *       the facts relied on, whether it was automated, and the redress
+ *       routes offered to the affected recipient.
+ *     - `transparencyReport` (Art. 15 / Art. 24(3)) aggregates the
+ *       period counts a provider must publish — notices received,
+ *       actions taken, automated decisions, appeals — into a report
+ *       record with the next due date.
+ *
+ *   The builders follow the operator-feeds-metadata pattern: the
+ *   operator supplies the facts and each function returns a frozen,
+ *   timestamped record that composes into the operator's own retention /
+ *   audit / export sink. None of them persist to the framework or touch
+ *   the network. A best-effort `dsa.*` audit event fires when an audit
+ *   sink is wired. They map to the `dsa` compliance posture, which
+ *   cascades ML-DSA-87 audit-chain signing and a TLS 1.3 floor.
+ *
+ * @card
+ *   EU Digital Services Act (Reg 2022/2065) record-builders — Art. 16 notice-and-action, Art. 17 statement of reasons, Art. 15/24(3) transparency report.
+ */
+
+var validateOpts = require("./validate-opts");
+var lazyRequire = require("./lazy-require");
+var C = require("./constants");
+var { DsaError } = require("./framework-error");
+
+var audit = lazyRequire(function () { return require("./audit"); });
+
+// ---- Art. 16 notice-and-action ----
+
+// The notice categories Art. 16(2) expects a notice-and-action
+// mechanism to distinguish. A notice that alleges illegal content
+// (Art. 16(2)(a)-(d)) starts the diligent-and-timely action clock and
+// MUST be answered with an Art. 17 statement of reasons when the
+// provider acts on it; a terms-of-service notice need not be.
+var NOTICE_TYPES = Object.freeze({
+  "illegal-content":   { statementOfReasonsRequired: true,  description: "Notice alleges the content is illegal under Union or member-state law (Art. 16(2))." },
+  "terms-violation":   { statementOfReasonsRequired: false, description: "Notice alleges the content breaches the provider's terms and conditions." },
+  "ip-infringement":   { statementOfReasonsRequired: true,  description: "Notice alleges intellectual-property infringement (a sub-case of illegal content)." },
+  "other":             { statementOfReasonsRequired: false, description: "Any other notice category the provider's mechanism accepts." },
+});
+var NOTICE_TYPE_IDS = Object.keys(NOTICE_TYPES);
+
+// Who submitted the notice. A trusted flagger (Art. 22) is processed
+// with priority; the field is recorded so the provider can evidence
+// the Art. 22(1) priority-handling obligation.
+var SUBMITTER_TYPES = Object.freeze(["individual", "trusted-flagger", "authority", "rights-holder", "other"]);
+
+// Default action window. Art. 16(6) requires action "in a timely,
+// diligent, non-arbitrary and objective manner"; it sets no fixed
+// hour count, so the framework default is a conservative 24h SLA that
+// operators override per their own published policy via actionWindowMs.
+var DEFAULT_ACTION_WINDOW_MS = C.TIME.hours(24);
+
+/**
+ * @primitive  b.dsa.noticeAndAction
+ * @signature  b.dsa.noticeAndAction(opts)
+ * @since      0.15.8
+ * @status     stable
+ * @compliance dsa
+ * @related    b.dsa.statementOfReasons, b.dsa.transparencyReport, b.compliance.describe
+ *
+ * Record an Art. 16 notice-and-action notice and compute the window
+ * inside which the provider must act on it. The operator supplies the
+ * notice facts — the content it targets, the alleged category, the
+ * substantiating reason, when it was submitted, and who submitted it —
+ * and `noticeAndAction` validates the shape, stamps `recordedAt`,
+ * derives `actionDueBy` from the submission time plus the action
+ * window, and flags whether acting on the notice will require an
+ * Art. 17 statement of reasons (true for illegal-content / IP notices).
+ * The returned record is frozen and is NOT framework-persisted —
+ * compose it into your retention / audit / export sink. A best-effort
+ * `dsa.notice.recorded` audit event fires when an audit sink is wired.
+ *
+ * @opts
+ *   contentId:       string,   // required — the content the notice targets
+ *   noticeType:      string,   // required — illegal-content | terms-violation | ip-infringement | other
+ *   reason:          string,   // required — the notice's substantiation (Art. 16(2)(a))
+ *   submittedAt:     number,   // required — epoch ms the notice was submitted
+ *   submitterType:   string,   // required — individual | trusted-flagger | authority | rights-holder | other
+ *   noticeId:        string,   // optional — operator notice id; defaults to "dsa-notice-<submittedAt>"
+ *   actionWindowMs:  number,   // optional — SLA window; default 24h (Art. 16(6) "timely")
+ *
+ * @example
+ *   var n = b.dsa.noticeAndAction({
+ *     contentId:     "post-9931",
+ *     noticeType:    "illegal-content",
+ *     reason:        "Depicts a sale prohibited under national law.",
+ *     submittedAt:   Date.now(),
+ *     submitterType: "trusted-flagger",
+ *   });
+ *   // → { noticeId, contentId, noticeType, status: "recorded",
+ *   //     recordedAt, actionDueBy, statementOfReasonsRequired: true }
+ */
+function noticeAndAction(opts) {
+  validateOpts.requireObject(opts, "b.dsa.noticeAndAction: opts", DsaError, "dsa/bad-opts");
+  validateOpts(opts, [
+    "contentId", "noticeType", "reason", "submittedAt", "submitterType",
+    "noticeId", "actionWindowMs",
+  ], "b.dsa.noticeAndAction");
+  validateOpts.requireNonEmptyString(opts.contentId, "b.dsa.noticeAndAction: opts.contentId", DsaError, "dsa/bad-content-id");
+  validateOpts.requireNonEmptyString(opts.noticeType, "b.dsa.noticeAndAction: opts.noticeType", DsaError, "dsa/bad-notice-type");
+  if (NOTICE_TYPE_IDS.indexOf(opts.noticeType) === -1) {
+    throw new DsaError("dsa/unknown-notice-type",
+      "b.dsa.noticeAndAction: unknown noticeType '" + opts.noticeType +
+      "' (allowed: " + NOTICE_TYPE_IDS.join(", ") + ")");
+  }
+  validateOpts.requireNonEmptyString(opts.reason, "b.dsa.noticeAndAction: opts.reason", DsaError, "dsa/bad-reason");
+  if (typeof opts.submittedAt !== "number" || !isFinite(opts.submittedAt) || opts.submittedAt <= 0) {
+    throw new DsaError("dsa/bad-submitted-at",
+      "b.dsa.noticeAndAction: opts.submittedAt must be a positive epoch-ms number");
+  }
+  validateOpts.requireNonEmptyString(opts.submitterType, "b.dsa.noticeAndAction: opts.submitterType", DsaError, "dsa/bad-submitter-type");
+  if (SUBMITTER_TYPES.indexOf(opts.submitterType) === -1) {
+    throw new DsaError("dsa/unknown-submitter-type",
+      "b.dsa.noticeAndAction: unknown submitterType '" + opts.submitterType +
+      "' (allowed: " + SUBMITTER_TYPES.join(", ") + ")");
+  }
+  validateOpts.optionalNonEmptyString(opts.noticeId, "b.dsa.noticeAndAction: opts.noticeId", DsaError, "dsa/bad-notice-id");
+  var actionWindowMs = opts.actionWindowMs === undefined
+    ? DEFAULT_ACTION_WINDOW_MS
+    : validateOpts.optionalPositiveFinite(opts.actionWindowMs, "b.dsa.noticeAndAction: opts.actionWindowMs", DsaError, "dsa/bad-action-window");
+
+  var recordedAt = Date.now();
+  var sorRequired = NOTICE_TYPES[opts.noticeType].statementOfReasonsRequired;
+  var record = Object.freeze({
+    noticeId:                    opts.noticeId || ("dsa-notice-" + opts.submittedAt),
+    contentId:                   opts.contentId,
+    noticeType:                  opts.noticeType,
+    submitterType:               opts.submitterType,
+    reason:                      opts.reason,
+    submittedAt:                 opts.submittedAt,
+    status:                      "recorded",
+    recordedAt:                  recordedAt,
+    actionDueBy:                 opts.submittedAt + actionWindowMs,
+    statementOfReasonsRequired:  sorRequired,
+  });
+  try {
+    audit().safeEmit({
+      action:   "dsa.notice.recorded",
+      outcome:  "success",
+      metadata: {
+        noticeId:                   record.noticeId,
+        contentId:                  record.contentId,
+        noticeType:                 record.noticeType,
+        submitterType:              record.submitterType,
+        actionDueBy:                record.actionDueBy,
+        statementOfReasonsRequired: record.statementOfReasonsRequired,
+      },
+    });
+  } catch (_e) { /* drop-silent — audit is best-effort, never block the builder */ }
+  return record;
+}
+
+// ---- Art. 17 statement of reasons ----
+
+// The moderation decisions Art. 17(1) covers. Each restricts the
+// content or the recipient's account; the statement of reasons must
+// state which (Art. 17(3)(a)).
+var DECISIONS = Object.freeze([
+  "content-removed",
+  "content-disabled",
+  "content-demoted",
+  "age-restricted",
+  "monetisation-removed",
+  "account-suspended",
+  "account-terminated",
+  "no-action",
+]);
+
+// The redress routes Art. 17(3)(f) requires the statement to point the
+// recipient to. At least one must be offered for a restrictive
+// decision.
+var REDRESS_OPTIONS = Object.freeze([
+  "internal-complaint",       // Art. 20 internal complaint-handling system
+  "out-of-court-settlement",  // Art. 21 out-of-court dispute settlement
+  "judicial-redress",         // Art. 17(3)(f) — judicial remedy
+]);
+
+/**
+ * @primitive  b.dsa.statementOfReasons
+ * @signature  b.dsa.statementOfReasons(opts)
+ * @since      0.15.8
+ * @status     stable
+ * @compliance dsa
+ * @related    b.dsa.noticeAndAction, b.dsa.transparencyReport, b.compliance.describe
+ *
+ * Record an Art. 17 statement of reasons for a content-moderation
+ * decision. Whenever a provider restricts content (or a recipient's
+ * account) it must give the affected recipient a clear, specific
+ * statement of reasons; this builder records that statement as a frozen
+ * dated record. The operator supplies the decision, the legal ground
+ * (Art. 17(3)(d)) or the contractual ground (Art. 17(3)(e)) it rests
+ * on, the facts relied on (Art. 17(3)(c)), whether the decision was
+ * taken by automated means (Art. 17(3)(c)), and the redress routes
+ * offered (Art. 17(3)(f)). Exactly one of `legalGround` /
+ * `contractualGround` is required so the ground is never left implicit.
+ * The returned record is frozen and is NOT framework-persisted — also
+ * submit it to the Commission's DSA Transparency Database per Art. 24(5)
+ * from your own pipeline. A best-effort `dsa.sor.recorded` audit event
+ * fires when an audit sink is wired.
+ *
+ * @opts
+ *   contentId:          string,    // required — the content the decision concerns
+ *   decision:           string,    // required — content-removed | content-disabled | ... | no-action
+ *   facts:              string,    // required — the facts and circumstances relied on (Art. 17(3)(c))
+ *   automated:          boolean,   // required — was the decision taken by automated means (Art. 17(3)(c))
+ *   redressOptions:     string[],  // required — internal-complaint | out-of-court-settlement | judicial-redress
+ *   legalGround:        string,    // one-of-two — the legal ground when the decision rests on illegality (Art. 17(3)(d))
+ *   contractualGround:  string,    // one-of-two — the T&C clause when the decision rests on the contract (Art. 17(3)(e))
+ *   sorId:              string,    // optional — operator id; defaults to "dsa-sor-<recordedAt>"
+ *   noticeId:           string,    // optional — the Art. 16 notice this answers, if any
+ *   territorialScope:   string,    // optional — geographic scope of the restriction (Art. 17(3)(b))
+ *
+ * @example
+ *   var s = b.dsa.statementOfReasons({
+ *     contentId:      "post-9931",
+ *     decision:       "content-removed",
+ *     legalGround:    "National law prohibiting the depicted sale.",
+ *     facts:          "Listing offered a prohibited item for sale.",
+ *     automated:      false,
+ *     redressOptions: ["internal-complaint", "judicial-redress"],
+ *   });
+ *   // → { sorId, contentId, decision, recordedAt, groundType, automated, ... }
+ */
+function statementOfReasons(opts) {
+  validateOpts.requireObject(opts, "b.dsa.statementOfReasons: opts", DsaError, "dsa/bad-opts");
+  validateOpts(opts, [
+    "contentId", "decision", "facts", "automated", "redressOptions",
+    "legalGround", "contractualGround", "sorId", "noticeId", "territorialScope",
+  ], "b.dsa.statementOfReasons");
+  validateOpts.requireNonEmptyString(opts.contentId, "b.dsa.statementOfReasons: opts.contentId", DsaError, "dsa/bad-content-id");
+  validateOpts.requireNonEmptyString(opts.decision, "b.dsa.statementOfReasons: opts.decision", DsaError, "dsa/bad-decision");
+  if (DECISIONS.indexOf(opts.decision) === -1) {
+    throw new DsaError("dsa/unknown-decision",
+      "b.dsa.statementOfReasons: unknown decision '" + opts.decision +
+      "' (allowed: " + DECISIONS.join(", ") + ")");
+  }
+  validateOpts.requireNonEmptyString(opts.facts, "b.dsa.statementOfReasons: opts.facts", DsaError, "dsa/bad-facts");
+  if (typeof opts.automated !== "boolean") {
+    throw new DsaError("dsa/bad-automated",
+      "b.dsa.statementOfReasons: opts.automated must be a boolean (Art. 17(3)(c) — was the decision automated)");
+  }
+  // Exactly one ground — never both, never neither. Art. 17(3)(d)/(e)
+  // require the statement to state the specific ground; leaving it
+  // implicit or asserting two grounds at once is the compliance-theater
+  // shape this refuses.
+  validateOpts.optionalNonEmptyString(opts.legalGround, "b.dsa.statementOfReasons: opts.legalGround", DsaError, "dsa/bad-legal-ground");
+  validateOpts.optionalNonEmptyString(opts.contractualGround, "b.dsa.statementOfReasons: opts.contractualGround", DsaError, "dsa/bad-contractual-ground");
+  var hasLegal = typeof opts.legalGround === "string" && opts.legalGround.length > 0;
+  var hasContractual = typeof opts.contractualGround === "string" && opts.contractualGround.length > 0;
+  if (hasLegal === hasContractual) {
+    throw new DsaError("dsa/ground-required",
+      "b.dsa.statementOfReasons: supply exactly one of legalGround (Art. 17(3)(d)) or " +
+      "contractualGround (Art. 17(3)(e)) — got " + (hasLegal ? "both" : "neither"));
+  }
+  if (!Array.isArray(opts.redressOptions) || opts.redressOptions.length === 0) {
+    throw new DsaError("dsa/redress-required",
+      "b.dsa.statementOfReasons: opts.redressOptions must be a non-empty array (Art. 17(3)(f)) — " +
+      "allowed: " + REDRESS_OPTIONS.join(", "));
+  }
+  opts.redressOptions.forEach(function (r, i) {
+    if (typeof r !== "string" || REDRESS_OPTIONS.indexOf(r) === -1) {
+      throw new DsaError("dsa/unknown-redress-option",
+        "b.dsa.statementOfReasons: redressOptions[" + i + "] '" + r +
+        "' is not a recognised redress route (allowed: " + REDRESS_OPTIONS.join(", ") + ")");
+    }
+  });
+  validateOpts.optionalNonEmptyString(opts.sorId, "b.dsa.statementOfReasons: opts.sorId", DsaError, "dsa/bad-sor-id");
+  validateOpts.optionalNonEmptyString(opts.noticeId, "b.dsa.statementOfReasons: opts.noticeId", DsaError, "dsa/bad-notice-id");
+  validateOpts.optionalNonEmptyString(opts.territorialScope, "b.dsa.statementOfReasons: opts.territorialScope", DsaError, "dsa/bad-territorial-scope");
+
+  var recordedAt = Date.now();
+  var record = Object.freeze({
+    sorId:             opts.sorId || ("dsa-sor-" + recordedAt),
+    contentId:         opts.contentId,
+    noticeId:          opts.noticeId || null,
+    decision:          opts.decision,
+    groundType:        hasLegal ? "legal" : "contractual",
+    legalGround:       hasLegal ? opts.legalGround : null,
+    contractualGround: hasContractual ? opts.contractualGround : null,
+    facts:             opts.facts,
+    automated:         opts.automated,
+    redressOptions:    Object.freeze(opts.redressOptions.slice()),
+    territorialScope:  opts.territorialScope || null,
+    recordedAt:        recordedAt,
+  });
+  try {
+    audit().safeEmit({
+      action:   "dsa.sor.recorded",
+      outcome:  "success",
+      metadata: {
+        sorId:      record.sorId,
+        contentId:  record.contentId,
+        decision:   record.decision,
+        groundType: record.groundType,
+        automated:  record.automated,
+        noticeId:   record.noticeId,
+      },
+    });
+  } catch (_e) { /* drop-silent — audit is best-effort, never block the builder */ }
+  return record;
+}
+
+// ---- Art. 15 / Art. 24(3) transparency report ----
+
+// The metric fields Art. 15(1) + Art. 24 expect a transparency report
+// to carry. Every metric is a non-negative integer count over the
+// reporting period; an omitted metric defaults to 0 so a partial
+// report still produces a complete, comparable shape.
+var METRIC_FIELDS = Object.freeze([
+  "noticesReceived",        // Art. 15(1)(b) — notices submitted under Art. 16
+  "actionsTaken",           // Art. 15(1)(b) — actions taken on those notices
+  "automatedDecisions",     // Art. 15(1)(e) — content moderation by automated means
+  "ownInitiativeActions",   // Art. 15(1)(c) — own-initiative content moderation
+  "statementsOfReasons",    // Art. 24(1) — statements of reasons issued
+  "appeals",                // Art. 24(1)(a) — Art. 20 internal complaints received
+  "appealsUpheld",          // Art. 24(1)(a) — complaints decided in the recipient's favour
+  "outOfCourtDisputes",     // Art. 24(1)(b) — Art. 21 out-of-court settlements
+  "accountSuspensions",     // Art. 23 — suspensions for misuse
+]);
+
+// The annual re-report clock. Art. 15(1) requires reporting "at least
+// once a year"; the next-due default is one year after the period end.
+var REPORT_PERIOD_MS = C.TIME.days(365);
+
+/**
+ * @primitive  b.dsa.transparencyReport
+ * @signature  b.dsa.transparencyReport(opts)
+ * @since      0.15.8
+ * @status     stable
+ * @compliance dsa
+ * @related    b.dsa.noticeAndAction, b.dsa.statementOfReasons, b.compliance.describe
+ *
+ * Build an Art. 15 (all intermediary services) / Art. 24(3) (online
+ * platforms) transparency report. The operator supplies the reporting
+ * period and the period counts — notices received, actions taken,
+ * automated decisions, appeals, and so on — and `transparencyReport`
+ * validates the shape, normalises every metric to a non-negative
+ * integer (omitted metrics default to 0 so a partial report still has a
+ * complete, comparable shape), stamps `generatedAt`, and computes
+ * `nextReportDueBy` one year after the period end (Art. 15(1) "at least
+ * once a year"). The returned report is frozen and is NOT
+ * framework-persisted — publish it from your own pipeline. A
+ * best-effort `dsa.transparency_report.generated` audit event fires
+ * when an audit sink is wired.
+ *
+ * @opts
+ *   period:    object,   // required — { from: number, to: number } epoch-ms window (from < to)
+ *   metrics:   object,   // optional — { <metric>: number } period counts; see b.dsa.listTransparencyMetrics()
+ *   reportId:  string,   // optional — operator id; defaults to "dsa-transparency-<to>"
+ *   service:   string,   // optional — the service the report covers
+ *
+ * @example
+ *   var r = b.dsa.transparencyReport({
+ *     period:  { from: Date.UTC(2025, 0, 1), to: Date.UTC(2025, 11, 31) },
+ *     metrics: { noticesReceived: 1200, actionsTaken: 940, automatedDecisions: 610, appeals: 75 },
+ *   });
+ *   // → { reportId, period, metrics: {...all 9 normalised...}, generatedAt, nextReportDueBy }
+ */
+function transparencyReport(opts) {
+  validateOpts.requireObject(opts, "b.dsa.transparencyReport: opts", DsaError, "dsa/bad-opts");
+  validateOpts(opts, ["period", "metrics", "reportId", "service"], "b.dsa.transparencyReport");
+  if (!opts.period || typeof opts.period !== "object" || Array.isArray(opts.period)) {
+    throw new DsaError("dsa/bad-period",
+      "b.dsa.transparencyReport: opts.period must be a { from, to } object of epoch-ms numbers");
+  }
+  var from = opts.period.from;
+  var to = opts.period.to;
+  if (typeof from !== "number" || !isFinite(from) || from <= 0 ||
+      typeof to !== "number" || !isFinite(to) || to <= 0) {
+    throw new DsaError("dsa/bad-period",
+      "b.dsa.transparencyReport: opts.period.from and opts.period.to must be positive epoch-ms numbers");
+  }
+  if (from >= to) {
+    throw new DsaError("dsa/bad-period-order",
+      "b.dsa.transparencyReport: opts.period.from must be strictly before opts.period.to");
+  }
+  validateOpts.optionalNonEmptyString(opts.reportId, "b.dsa.transparencyReport: opts.reportId", DsaError, "dsa/bad-report-id");
+  validateOpts.optionalNonEmptyString(opts.service, "b.dsa.transparencyReport: opts.service", DsaError, "dsa/bad-service");
+
+  var supplied = opts.metrics;
+  if (supplied !== undefined && supplied !== null &&
+      (typeof supplied !== "object" || Array.isArray(supplied))) {
+    throw new DsaError("dsa/bad-metrics",
+      "b.dsa.transparencyReport: opts.metrics must be a plain object of metric counts");
+  }
+  supplied = supplied || {};
+  // Reject unknown metric keys — a misspelled metric would otherwise
+  // silently drop out of the published report.
+  Object.keys(supplied).forEach(function (k) {
+    if (METRIC_FIELDS.indexOf(k) === -1) {
+      throw new DsaError("dsa/unknown-metric",
+        "b.dsa.transparencyReport: unknown metric '" + k +
+        "' (see b.dsa.listTransparencyMetrics())");
+    }
+  });
+  var metrics = {};
+  METRIC_FIELDS.forEach(function (field) {
+    var v = supplied[field];
+    if (v === undefined || v === null) { metrics[field] = 0; return; }
+    if (typeof v !== "number" || !isFinite(v) || v < 0 || Math.floor(v) !== v) {
+      throw new DsaError("dsa/bad-metric-value",
+        "b.dsa.transparencyReport: metrics." + field +
+        " must be a non-negative integer, got " +
+        (typeof v === "number" ? String(v) : typeof v));
+    }
+    metrics[field] = v;
+  });
+
+  var generatedAt = Date.now();
+  var report = Object.freeze({
+    reportId:        opts.reportId || ("dsa-transparency-" + to),
+    service:         opts.service || null,
+    period:          Object.freeze({ from: from, to: to }),
+    metrics:         Object.freeze(metrics),
+    generatedAt:     generatedAt,
+    nextReportDueBy: to + REPORT_PERIOD_MS,
+  });
+  try {
+    audit().safeEmit({
+      action:   "dsa.transparency_report.generated",
+      outcome:  "success",
+      metadata: {
+        reportId:        report.reportId,
+        service:         report.service,
+        periodFrom:      from,
+        periodTo:        to,
+        noticesReceived: metrics.noticesReceived,
+        actionsTaken:    metrics.actionsTaken,
+      },
+    });
+  } catch (_e) { /* drop-silent — audit is best-effort, never block the builder */ }
+  return report;
+}
+
+/**
+ * @primitive  b.dsa.listTransparencyMetrics
+ * @signature  b.dsa.listTransparencyMetrics()
+ * @since      0.15.8
+ * @status     stable
+ * @related    b.dsa.transparencyReport
+ *
+ * Return the frozen list of metric field names a `transparencyReport`
+ * aggregates — each maps to an Art. 15 / Art. 24 reporting obligation.
+ * Use it to render a data-entry form or to enumerate the counts the
+ * report normalises.
+ *
+ * @example
+ *   b.dsa.listTransparencyMetrics();
+ *   // → ["noticesReceived", "actionsTaken", "automatedDecisions", ...]
+ */
+function listTransparencyMetrics() {
+  return METRIC_FIELDS;
+}
+
+module.exports = {
+  noticeAndAction:         noticeAndAction,
+  statementOfReasons:      statementOfReasons,
+  transparencyReport:      transparencyReport,
+  listTransparencyMetrics: listTransparencyMetrics,
+  NOTICE_TYPES:            NOTICE_TYPES,
+  DECISIONS:               DECISIONS,
+  REDRESS_OPTIONS:         REDRESS_OPTIONS,
+  METRIC_FIELDS:           METRIC_FIELDS,
+  DsaError:                DsaError,
+};

package/lib/framework-error.js

@@ -389,6 +389,18 @@ var ComplianceError       = defineClass("ComplianceError",       { alwaysPermane
 // vendorReview opts object, a non-boolean clause attestation, or an
 // unknown clause key. Permanent — operator configuration, not transient.
 var PrivacyError          = defineClass("PrivacyError",          { alwaysPermanent: true });
+// DsaError covers b.dsa config-time misuse (EU Digital Services Act,
+// Reg 2022/2065): malformed noticeAndAction / statementOfReasons /
+// transparencyReport opts, an unknown notice-type / decision / redress /
+// metric key, a statement of reasons with neither or both grounds, an
+// out-of-order reporting period. Permanent — operator-supplied record shape.
+var DsaError              = defineClass("DsaError",              { alwaysPermanent: true });
+// PiplError covers b.pipl config-time misuse (China PIPL cross-border
+// transfer): a malformed sccFilingAssessment / securityAssessmentCertificate
+// opts object, an unknown legalBasis / riskRating enum, an empty required
+// array, a bad recordedAt clock, or a malformed injected audit sink.
+// Permanent — operator configuration, not transient.
+var PiplError             = defineClass("PiplError",             { alwaysPermanent: true });
 // SmtpPolicyError covers MTA-STS / DANE / TLS-RPT misuse: bad-policy
 // shape, fetch failures, TLSA-record format errors, missing records.
 // Permanent — these are policy / DNS configuration errors, not
@@ -722,6 +734,8 @@ module.exports = {
   DoraError:              DoraError,
   ComplianceError:        ComplianceError,
   PrivacyError:           PrivacyError,
+  DsaError:               DsaError,
+  PiplError:              PiplError,
   SmtpPolicyError:        SmtpPolicyError,
   MailAuthError:          MailAuthError,
   MailArfError:           MailArfError,

package/lib/log-stream-otlp-grpc.js

@@ -33,6 +33,11 @@ var safeAsync = require("./safe-async");
 var safeUrl = require("./safe-url");
 var { tearDownH2Session } = require("./http2-teardown");
 var { LogStreamError } = require("./framework-error");
+var lazyRequire = require("./lazy-require");
+// Lazy to break the observability <-> log-stream require cycle. Used only to
+// scrub attribute values through the telemetry redactor before they cross the
+// OTLP egress boundary (CWE-532).
+var observability = lazyRequire(function () { return require("./observability"); });
 
 var _err = LogStreamError.factory;
 var _log = boot("log-stream-otlp-grpc");
@@ -133,7 +138,9 @@ function _encodeLogRecord(record) {
   // operators emitting > year-2255 timestamps. For ms-resolution
   // records the LSB nanos are 0; we still send fixed64.
   var tsNs = BigInt(tsMs) * 1000000n;
-  var attrPieces = _encodeAttributes(record.meta).map(function (kvBody) {
+  // Scrub meta values through the telemetry redactor before the wire (CWE-532),
+  // matching the span/metric exporters' egress contract.
+  var attrPieces = _encodeAttributes(observability().redactAttrs(record.meta)).map(function (kvBody) {
     return pb.embeddedMessage(6, kvBody);
   });
   var msg = (record.message != null ? String(record.message) : "");
@@ -162,7 +169,7 @@ function _encodeScopeLogs(records, scopeName, scopeVersion) {
 // ResourceLogs (logs.proto): resource=1 (Resource),
 // scope_logs=2 (repeated ScopeLogs), schema_url=3
 function _encodeResourceLogs(records, cfg) {
-  var resourceBody = _encodeResource(_resourceAttrs(cfg));
+  var resourceBody = _encodeResource(observability().redactAttrs(_resourceAttrs(cfg)));
   var scopeLogsBody = _encodeScopeLogs(records, cfg.scopeName, cfg.scopeVersion);
   return Buffer.concat([
     pb.embeddedMessage(1, resourceBody),

package/lib/log-stream-otlp.js

@@ -58,6 +58,11 @@ var httpClient = require("./http-client");
 var safeAsync = require("./safe-async");
 var safeUrl = require("./safe-url");
 var authHeader = require("./auth-header");
+var lazyRequire = require("./lazy-require");
+// Lazy to break the observability <-> log-stream require cycle (observability's
+// log path can reach a log-stream sink). Used only to scrub attribute values
+// through the telemetry redactor before they cross the OTLP egress boundary.
+var observability = lazyRequire(function () { return require("./observability"); });
 
 var MAX_RESPONSE_BYTES = C.BYTES.mib(1);
 var FRAMEWORK_VERSION = (pkg && pkg.version) || "unknown";
@@ -141,7 +146,10 @@ function _toLogRecord(record) {
   var sev = SEVERITY[record.level] || SEVERITY.info;
   // OTel timeUnixNano is a string (JSON can't safely represent 64-bit ints).
   var nanos = String(BigInt(record.ts) * 1000000n);
-  var attrs = record.meta ? _encodeAttrs(record.meta) : [];
+  // Telemetry is a first-class EGRESS sink: scrub every meta value through the
+  // redactor before it reaches the collector wire (CWE-532), the same contract
+  // the span/metric exporters hold.
+  var attrs = record.meta ? _encodeAttrs(observability().redactAttrs(record.meta)) : [];
   return {
     timeUnixNano:     nanos,
     observedTimeUnixNano: nanos,
@@ -158,7 +166,7 @@ function _serializeBatch(records, cfg, scopeVersion) {
     resourceLogs: [
       {
         resource: {
-          attributes: _encodeAttrs(resourceAttrs),
+          attributes: _encodeAttrs(observability().redactAttrs(resourceAttrs)),
         },
         scopeLogs: [
           {
@@ -291,10 +299,11 @@ function create(config) {
 }
 
 module.exports = {
-  create:       create,
+  create:         create,
   // Exposed for tests + advanced operator wiring.
-  _resolveUrl:  _resolveUrl,
-  _encodeAttrs: _encodeAttrs,
-  _toLogRecord: _toLogRecord,
-  SEVERITY:     SEVERITY,
+  _resolveUrl:    _resolveUrl,
+  _encodeAttrs:   _encodeAttrs,
+  _toLogRecord:   _toLogRecord,
+  _serializeBatch: _serializeBatch,
+  SEVERITY:       SEVERITY,
 };

package/lib/observability.js

@@ -199,8 +199,9 @@ function getRedactor() {
  *
  * Run every value of a telemetry attribute map through the active redactor and
  * return a NEW `{ key: redactedValue }` object. The OTLP exporters call this on
- * span, span-event, metric, and resource attributes before serialization so no
- * attribute value crosses the egress boundary unscrubbed (CWE-532: insertion of
+ * span, span-event, metric, log-record, and resource attributes before
+ * serialization so no attribute value crosses the egress boundary unscrubbed
+ * (the HTTP-JSON and gRPC log sinks included) (CWE-532: insertion of
  * sensitive information into an externally-shipped sink). A key whose redactor
  * throws is DROPPED — failing toward dropping, never exporting the raw value;
  * `null` / `undefined` values pass through for the type-encoder to handle.

package/lib/pipl-cn.js

@@ -0,0 +1,377 @@
+"use strict";
+/**
+ * @module b.pipl
+ * @nav    Compliance
+ * @title  PIPL (China)
+ *
+ * @intro
+ *   China PIPL (Personal Information Protection Law) cross-border
+ *   transfer record-builders. PIPL Art. 38 sets three lawful bases for
+ *   transferring personal information outside the PRC: a CAC security
+ *   assessment (Art. 40), the CAC standard contract (SCC), or
+ *   certification by a CAC-accredited body. The CAC security assessment
+ *   is MANDATORY — the operator may not self-select the standard
+ *   contract — when the exporter is a critical-information-infrastructure
+ *   operator (CIIO), handles "important data", or crosses the volume /
+ *   sensitive-PI thresholds in the Measures for Security Assessment of
+ *   Outbound Data Transfers.
+ *
+ *   These primitives follow the operator-feeds-metadata pattern: the
+ *   operator supplies the transfer's facts and the builder returns a
+ *   frozen, dated record (plus a best-effort audit event) that composes
+ *   into the operator's own retention / export sink. They perform NO
+ *   network I/O and do NOT file anything with the CAC — they document
+ *   the legal basis the operator must be able to produce on inspection.
+ *
+ * @card
+ *   China PIPL cross-border transfer records — Art. 38/40/55 SCC + CAC security-assessment basis (sccFilingAssessment, securityAssessmentCertificate).
+ */
+
+var lazyRequire = require("./lazy-require");
+var validateOpts = require("./validate-opts");
+var C = require("./constants");
+var { PiplError } = require("./framework-error");
+
+var audit = lazyRequire(function () { return require("./audit"); });
+
+// PIPL Art. 38(1) lawful cross-border mechanisms. A standard contract or
+// certification is a self-selectable basis; a security assessment is the
+// mechanism the CAC Measures impose when a mandatory trigger is present.
+var LEGAL_BASES = Object.freeze(["standard-contract", "security-assessment", "certification"]);
+
+// Mandatory-security-assessment thresholds from the CAC 2024 Provisions on
+// Promoting and Regulating Cross-Border Data Flows (Art. 7/8), which relaxed
+// the original 2022 Measures. Crossing ANY of these forces the
+// security-assessment mechanism — the operator cannot fall back to the
+// standard contract or certification.
+//   - CIIO exporter, or "important data" in scope: always mandatory.
+//   - cumulative outbound NON-sensitive PI of MORE THAN 1,000,000 individuals
+//     since 1 January of the current year (the 100,000–1,000,000 band is the
+//     standard-contract / certification tier, NOT a security-assessment
+//     trigger).
+//   - cumulative outbound SENSITIVE PI of MORE THAN 10,000 individuals in that
+//     window.
+// The thresholds are CUMULATIVE since 1 January and THIS transfer counts toward
+// them — the transfer's own `volume` is sorted into the sensitive or
+// non-sensitive bucket by `sensitivePI` and added to the running cumulative
+// before the comparison.
+var SECURITY_ASSESSMENT_NONSENSITIVE_PI_THRESHOLD = 1000000;
+var SECURITY_ASSESSMENT_SENSITIVE_PI_THRESHOLD = 10000;
+
+// Re-assessment / re-filing cadence. The CAC security assessment result
+// is valid for 3 years (Measures Art. 14); the standard-contract +
+// certification bases carry a PIPIA (Art. 55) that should be refreshed
+// at least annually or on any material change. We stamp the longer 3-year
+// clock for a mandated security assessment and a 1-year clock otherwise.
+var SECURITY_ASSESSMENT_VALIDITY_DAYS = 365 * 3;
+var STANDARD_REVIEW_DAYS = 365;
+
+var SCC_ASSESSMENT_ALLOWED_KEYS = [
+  "assessmentId", "transferType", "recipientJurisdiction", "dataCategories",
+  "legalBasis", "volume", "sensitivePI", "ciio", "importantData",
+  "cumulativePI", "cumulativeSensitivePI", "recordedAt", "audit",
+];
+
+var RISK_RATINGS = Object.freeze(["low", "medium", "high"]);
+
+var SECURITY_CERT_ALLOWED_KEYS = [
+  "certId", "assessmentScope", "dataExporter", "overseasRecipient",
+  "riskRating", "safeguards", "filingRef", "recordedAt", "audit",
+];
+
+// Resolve the audit sink: an operator-supplied b.audit-shaped object wins
+// (so the call is captured even without a DB-backed global handler);
+// otherwise fall back to the framework's global audit. Validated for shape
+// at the call site so a malformed sink throws rather than silently no-ops.
+function _resolveAudit(optsAudit, label) {
+  if (optsAudit === undefined || optsAudit === null) return audit();
+  return validateOpts.auditShape(optsAudit, label, PiplError, "pipl/bad-audit");
+}
+
+function _requireRecordedAt(value, label) {
+  if (typeof value !== "number" || !isFinite(value) || value <= 0) {
+    throw new PiplError("pipl/bad-recorded-at",
+      label + " must be a positive epoch-ms number");
+  }
+  return value;
+}
+
+/**
+ * @primitive  b.pipl.sccFilingAssessment
+ * @signature  b.pipl.sccFilingAssessment(opts)
+ * @since      0.15.8
+ * @status     stable
+ * @compliance pipl-cn
+ * @related    b.pipl.securityAssessmentCertificate, b.compliance.isCrossBorderRegulated, b.privacy.vendorReview
+ *
+ * Build a dated PIPL Art. 38 / Art. 55 cross-border transfer assessment
+ * and determine the lawful mechanism the transfer requires. PIPL Art. 38(1)
+ * permits three bases for moving personal information out of the PRC — the
+ * CAC standard contract (SCC), a CAC security assessment (Art. 40), or
+ * certification by a CAC-accredited body — but the Measures for Security
+ * Assessment of Outbound Data Transfers make the security assessment
+ * MANDATORY (the operator may NOT self-select the standard contract or
+ * certification) when the exporter is a critical-information-infrastructure
+ * operator (CIIO), exports "important data", handles personal information
+ * of more than 1,000,000 individuals, or has cumulatively exported PI of
+ * more than 100,000 individuals or sensitive PI of more than 10,000
+ * individuals since 1 January of the preceding year.
+ *
+ * The builder validates the operator-supplied facts, computes
+ * `securityAssessmentRequired` against those thresholds, resolves the
+ * `mechanismRequired` (forcing `security-assessment` when any trigger is
+ * present, otherwise honoring the operator's declared `legalBasis`), and
+ * stamps `recordedAt` plus a `nextReviewDueBy` re-assessment clock (3 years
+ * for a mandated security assessment per Measures Art. 14, otherwise the
+ * annual PIPIA refresh under Art. 55). The returned record is frozen and
+ * is NOT framework-persisted — compose it into your retention / audit /
+ * export sink. A best-effort `pipl.transfer.assessed` audit event fires.
+ *
+ * @opts
+ *   assessmentId:          string,    // required — operator's identifier for this assessment
+ *   transferType:          string,    // required — e.g. "intra-group", "processor", "controller-to-controller"
+ *   recipientJurisdiction: string,    // required — destination jurisdiction (e.g. "US", "EU", "SG")
+ *   dataCategories:        string[],  // required — non-empty list of PI categories transferred
+ *   legalBasis:            string,    // required — "standard-contract" | "security-assessment" | "certification"
+ *   volume:                number,    // required — count of data subjects in this transfer (>= 0)
+ *   sensitivePI:           boolean,   // required — whether the transfer includes sensitive PI (Art. 28)
+ *   ciio:                  boolean,   // optional — exporter is a CIIO (forces security assessment); default false
+ *   importantData:         boolean,   // optional — transfer includes "important data" (forces it); default false
+ *   cumulativePI:          number,    // optional — cumulative PI subjects exported since 1 Jan prior year; default 0
+ *   cumulativeSensitivePI: number,    // optional — cumulative sensitive-PI subjects exported in that window; default 0
+ *   recordedAt:            number,    // required — epoch ms of this assessment
+ *   audit:                 object,    // optional — b.audit-shaped sink; default global b.audit
+ *
+ * @example
+ *   var rec = b.pipl.sccFilingAssessment({
+ *     assessmentId:          "xfer-2026-001",
+ *     transferType:          "processor",
+ *     recipientJurisdiction: "US",
+ *     dataCategories:        ["contact", "billing"],
+ *     legalBasis:            "standard-contract",
+ *     volume:                5000,
+ *     sensitivePI:           false,
+ *     recordedAt:            Date.now(),
+ *   });
+ *   // → { assessmentId, mechanismRequired: "standard-contract",
+ *   //     securityAssessmentRequired: false, recordedAt, nextReviewDueBy, ... }
+ */
+function sccFilingAssessment(opts) {
+  validateOpts.requireObject(opts, "b.pipl.sccFilingAssessment: opts", PiplError, "pipl/bad-opts");
+  validateOpts(opts, SCC_ASSESSMENT_ALLOWED_KEYS, "b.pipl.sccFilingAssessment");
+  validateOpts.requireNonEmptyString(opts.assessmentId,
+    "b.pipl.sccFilingAssessment: opts.assessmentId", PiplError, "pipl/bad-assessment-id");
+  validateOpts.requireNonEmptyString(opts.transferType,
+    "b.pipl.sccFilingAssessment: opts.transferType", PiplError, "pipl/bad-transfer-type");
+  validateOpts.requireNonEmptyString(opts.recipientJurisdiction,
+    "b.pipl.sccFilingAssessment: opts.recipientJurisdiction", PiplError, "pipl/bad-recipient");
+
+  if (!Array.isArray(opts.dataCategories) || opts.dataCategories.length === 0) {
+    throw new PiplError("pipl/bad-data-categories",
+      "b.pipl.sccFilingAssessment: opts.dataCategories must be a non-empty array of strings");
+  }
+  validateOpts.optionalNonEmptyStringArray(opts.dataCategories,
+    "b.pipl.sccFilingAssessment: opts.dataCategories", PiplError, "pipl/bad-data-categories");
+
+  if (LEGAL_BASES.indexOf(opts.legalBasis) === -1) {
+    throw new PiplError("pipl/bad-legal-basis",
+      "b.pipl.sccFilingAssessment: opts.legalBasis must be one of " +
+      LEGAL_BASES.join(" | ") + " (PIPL Art. 38(1)) — got " + JSON.stringify(opts.legalBasis));
+  }
+
+  if (typeof opts.volume !== "number" || !isFinite(opts.volume) || opts.volume < 0) {
+    throw new PiplError("pipl/bad-volume",
+      "b.pipl.sccFilingAssessment: opts.volume must be a non-negative finite number (data-subject count)");
+  }
+  if (typeof opts.sensitivePI !== "boolean") {
+    throw new PiplError("pipl/bad-sensitive-pi",
+      "b.pipl.sccFilingAssessment: opts.sensitivePI must be a boolean");
+  }
+
+  var ciio = opts.ciio === undefined ? false
+    : validateOpts.optionalBoolean(opts.ciio, "b.pipl.sccFilingAssessment: opts.ciio", PiplError, "pipl/bad-ciio");
+  var importantData = opts.importantData === undefined ? false
+    : validateOpts.optionalBoolean(opts.importantData, "b.pipl.sccFilingAssessment: opts.importantData", PiplError, "pipl/bad-important-data");
+  var cumulativePI = opts.cumulativePI === undefined ? 0
+    : validateOpts.optionalFiniteNonNegative(opts.cumulativePI, "b.pipl.sccFilingAssessment: opts.cumulativePI", PiplError, "pipl/bad-cumulative-pi");
+  var cumulativeSensitivePI = opts.cumulativeSensitivePI === undefined ? 0
+    : validateOpts.optionalFiniteNonNegative(opts.cumulativeSensitivePI, "b.pipl.sccFilingAssessment: opts.cumulativeSensitivePI", PiplError, "pipl/bad-cumulative-sensitive-pi");
+
+  var recordedAt = _requireRecordedAt(opts.recordedAt, "b.pipl.sccFilingAssessment: opts.recordedAt");
+  // Resolve + shape-validate the audit sink at the entry-point tier (THROWS
+  // on a malformed sink) — NOT inside the drop-silent emission try/catch
+  // below, which would swallow the config error.
+  var auditSink = _resolveAudit(opts.audit, "b.pipl.sccFilingAssessment: opts.audit");
+
+  // Mandatory-security-assessment determination (CAC 2024 Provisions, Art. 7/8).
+  // Crossing ANY trigger forces the security-assessment mechanism regardless of
+  // the operator's declared legalBasis — the operator cannot self-downgrade to
+  // the standard contract or certification once a trigger is present. The
+  // thresholds are cumulative since 1 January and THIS transfer counts: sort its
+  // own volume into the sensitive or non-sensitive bucket and add it to the
+  // running cumulative before comparing, so a first/planned transfer that alone
+  // crosses a threshold is classified correctly without the caller having to
+  // pre-add it to the cumulative field.
+  var effectiveSensitivePI    = cumulativeSensitivePI + (opts.sensitivePI ? opts.volume : 0);
+  var effectiveNonSensitivePI = cumulativePI          + (opts.sensitivePI ? 0 : opts.volume);
+  var triggers = [];
+  if (ciio) triggers.push("ciio");
+  if (importantData) triggers.push("important-data");
+  if (effectiveNonSensitivePI > SECURITY_ASSESSMENT_NONSENSITIVE_PI_THRESHOLD) triggers.push("non-sensitive-pi-volume");
+  if (effectiveSensitivePI > SECURITY_ASSESSMENT_SENSITIVE_PI_THRESHOLD) triggers.push("sensitive-pi-volume");
+
+  var securityAssessmentRequired = triggers.length > 0;
+  var mechanismRequired = securityAssessmentRequired ? "security-assessment" : opts.legalBasis;
+  var nextReviewDays = securityAssessmentRequired ? SECURITY_ASSESSMENT_VALIDITY_DAYS : STANDARD_REVIEW_DAYS;
+
+  var record = Object.freeze({
+    assessmentId:               opts.assessmentId,
+    transferType:               opts.transferType,
+    recipientJurisdiction:      opts.recipientJurisdiction,
+    dataCategories:             Object.freeze(opts.dataCategories.slice()),
+    legalBasis:                 opts.legalBasis,
+    volume:                     opts.volume,
+    sensitivePI:                opts.sensitivePI,
+    mechanismRequired:          mechanismRequired,
+    securityAssessmentRequired: securityAssessmentRequired,
+    securityAssessmentTriggers: Object.freeze(triggers),
+    legalReference:             "PIPL Art. 38 / Art. 40 / Art. 55",
+    recordedAt:                 recordedAt,
+    nextReviewDueBy:            recordedAt + C.TIME.days(nextReviewDays),
+  });
+
+  try {
+    auditSink.safeEmit({
+      action:   "pipl.transfer.assessed",
+      outcome:  "success",
+      resource: { kind: "pipl-cross-border-transfer", id: opts.assessmentId },
+      metadata: {
+        transferType:               opts.transferType,
+        recipientJurisdiction:      opts.recipientJurisdiction,
+        mechanismRequired:          mechanismRequired,
+        securityAssessmentRequired: securityAssessmentRequired,
+        triggers:                   triggers,
+        recordedAt:                 recordedAt,
+      },
+    });
+  } catch (_e) { /* drop-silent — audit is best-effort, never block the builder */ }
+
+  return record;
+}
+
+/**
+ * @primitive  b.pipl.securityAssessmentCertificate
+ * @signature  b.pipl.securityAssessmentCertificate(opts)
+ * @since      0.15.8
+ * @status     stable
+ * @compliance pipl-cn
+ * @related    b.pipl.sccFilingAssessment, b.compliance.isCrossBorderRegulated
+ *
+ * Record a dated PIPL Art. 40 / CAC security-assessment self-declaration
+ * for an outbound data transfer. PIPL Art. 40 and the Measures for
+ * Security Assessment of Outbound Data Transfers require an operator who
+ * must pass (or has passed) the CAC security assessment to document the
+ * assessment scope, the data exporter, the overseas recipient, a risk
+ * rating, and the safeguards relied on — the evidence the operator must be
+ * able to produce on CAC inspection. This builder validates the supplied
+ * facts and returns a frozen, dated certificate record stamped with a
+ * 3-year `validUntil` clock (the CAC security-assessment result validity
+ * period, Measures Art. 14). It performs NO network I/O and files nothing
+ * with the CAC — it documents the assessment the operator conducted. A
+ * best-effort `pipl.security_assessment.recorded` audit event fires.
+ *
+ * @opts
+ *   certId:            string,    // required — operator's identifier for this certificate
+ *   assessmentScope:   string,    // required — scope of the security assessment (systems / data flows covered)
+ *   dataExporter:      string,    // required — the PRC data exporter (controller / processor)
+ *   overseasRecipient: string,    // required — the overseas recipient receiving the PI
+ *   riskRating:        string,    // required — "low" | "medium" | "high"
+ *   safeguards:        string[],  // required — non-empty list of safeguards relied on (encryption, DPA, etc.)
+ *   filingRef:         string,    // optional — CAC filing / acceptance reference number
+ *   recordedAt:        number,    // required — epoch ms of this declaration
+ *   audit:             object,    // optional — b.audit-shaped sink; default global b.audit
+ *
+ * @example
+ *   var cert = b.pipl.securityAssessmentCertificate({
+ *     certId:            "sa-2026-014",
+ *     assessmentScope:   "CRM outbound replication to US region",
+ *     dataExporter:      "Acme (Shanghai) Co., Ltd.",
+ *     overseasRecipient: "Acme Inc. (Delaware)",
+ *     riskRating:        "medium",
+ *     safeguards:        ["XChaCha20 at rest", "standard contractual clauses", "data minimization"],
+ *     recordedAt:        Date.now(),
+ *   });
+ *   // → { certId, assessmentScope, riskRating, recordedAt, validUntil }
+ */
+function securityAssessmentCertificate(opts) {
+  validateOpts.requireObject(opts, "b.pipl.securityAssessmentCertificate: opts", PiplError, "pipl/bad-opts");
+  validateOpts(opts, SECURITY_CERT_ALLOWED_KEYS, "b.pipl.securityAssessmentCertificate");
+  validateOpts.requireNonEmptyString(opts.certId,
+    "b.pipl.securityAssessmentCertificate: opts.certId", PiplError, "pipl/bad-cert-id");
+  validateOpts.requireNonEmptyString(opts.assessmentScope,
+    "b.pipl.securityAssessmentCertificate: opts.assessmentScope", PiplError, "pipl/bad-scope");
+  validateOpts.requireNonEmptyString(opts.dataExporter,
+    "b.pipl.securityAssessmentCertificate: opts.dataExporter", PiplError, "pipl/bad-exporter");
+  validateOpts.requireNonEmptyString(opts.overseasRecipient,
+    "b.pipl.securityAssessmentCertificate: opts.overseasRecipient", PiplError, "pipl/bad-recipient");
+
+  if (RISK_RATINGS.indexOf(opts.riskRating) === -1) {
+    throw new PiplError("pipl/bad-risk-rating",
+      "b.pipl.securityAssessmentCertificate: opts.riskRating must be one of " +
+      RISK_RATINGS.join(" | ") + " — got " + JSON.stringify(opts.riskRating));
+  }
+
+  if (!Array.isArray(opts.safeguards) || opts.safeguards.length === 0) {
+    throw new PiplError("pipl/bad-safeguards",
+      "b.pipl.securityAssessmentCertificate: opts.safeguards must be a non-empty array of strings");
+  }
+  validateOpts.optionalNonEmptyStringArray(opts.safeguards,
+    "b.pipl.securityAssessmentCertificate: opts.safeguards", PiplError, "pipl/bad-safeguards");
+
+  var filingRef = validateOpts.optionalNonEmptyString(opts.filingRef,
+    "b.pipl.securityAssessmentCertificate: opts.filingRef", PiplError, "pipl/bad-filing-ref");
+
+  var recordedAt = _requireRecordedAt(opts.recordedAt, "b.pipl.securityAssessmentCertificate: opts.recordedAt");
+  // Entry-point shape-validate the audit sink (THROWS) before the drop-silent
+  // emission try/catch below.
+  var auditSink = _resolveAudit(opts.audit, "b.pipl.securityAssessmentCertificate: opts.audit");
+
+  var record = Object.freeze({
+    certId:            opts.certId,
+    assessmentScope:   opts.assessmentScope,
+    dataExporter:      opts.dataExporter,
+    overseasRecipient: opts.overseasRecipient,
+    riskRating:        opts.riskRating,
+    safeguards:        Object.freeze(opts.safeguards.slice()),
+    filingRef:         filingRef || null,
+    legalReference:    "PIPL Art. 40 / CAC Measures for Security Assessment of Outbound Data Transfers",
+    recordedAt:        recordedAt,
+    validUntil:        recordedAt + C.TIME.days(SECURITY_ASSESSMENT_VALIDITY_DAYS),
+  });
+
+  try {
+    auditSink.safeEmit({
+      action:   "pipl.security_assessment.recorded",
+      outcome:  "success",
+      resource: { kind: "pipl-security-assessment", id: opts.certId },
+      metadata: {
+        assessmentScope:   opts.assessmentScope,
+        dataExporter:      opts.dataExporter,
+        overseasRecipient: opts.overseasRecipient,
+        riskRating:        opts.riskRating,
+        filingRef:         filingRef || null,
+        recordedAt:        recordedAt,
+      },
+    });
+  } catch (_e) { /* drop-silent — audit is best-effort, never block the builder */ }
+
+  return record;
+}
+
+module.exports = {
+  sccFilingAssessment:           sccFilingAssessment,
+  securityAssessmentCertificate: securityAssessmentCertificate,
+  LEGAL_BASES:                   LEGAL_BASES,
+  RISK_RATINGS:                  RISK_RATINGS,
+  PiplError:                     PiplError,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.7",
+  "version": "0.15.8",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:af262da2-b0f7-4f93-bb1e-8c6cb863a378",
+  "serialNumber": "urn:uuid:d7b8bc62-0d13-40fc-86ee-e6263eb44d87",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-13T17:27:38.127Z",
+    "timestamp": "2026-06-13T19:33:49.247Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.7",
+      "bom-ref": "@blamejs/core@0.15.8",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.7",
+      "version": "0.15.8",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.7",
+      "purl": "pkg:npm/%40blamejs/core@0.15.8",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.7",
+      "ref": "@blamejs/core@0.15.8",
       "dependsOn": []
     }
   ]