@blamejs/core 0.7.19 → 0.7.21

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.7.x
 
+- **0.7.21** (2026-05-05) — small primitive batch (5 fixes): TLS 1.3 framework-wide minimum, `b.safeRedirect`, `b.pick`, audit-sign legacy compat-shim removed, webhook PQC signatures emit base64url. **Framework-wide TLS 1.3 minimum** — `index.js` sets `tls.DEFAULT_MIN_VERSION = "TLSv1.3"` once at boot, before any framework module loads `node:tls`. Applies to every TLS socket (outbound `https.request` / mail SMTP+STARTTLS / Redis-Postgres-Mongo TLS / `b.httpClient`, AND inbound `https.createServer` when blamejs is the listener). Per-call override still works for legacy peers. **`b.safeRedirect`** — open-redirect (CWE-601) defense. `b.safeRedirect.resolve(rawTarget, { allowedOrigins, allowedHosts, fallback })` returns the safe URL (or fallback). Refuses protocol-relative (`//attacker.com`), backslash variants (`\\\\attacker.com`), control-char-laden (CRLF header injection), and `data:` / `javascript:` schemes; same-origin paths (`/dashboard`) and fragments (`#x`) pass through; full URLs require explicit allowlist. Operator drops the result straight into `res.writeHead(302, { Location: ... })`. **`b.pick`** — mass-assignment (CWE-915 / OWASP API3:2023) defense. `b.pick(req.body, ["a", "b", ["nested", ["sub1"]]])` returns a NEW object with only allowlisted keys; prototype-pollution keys (`__proto__` / `constructor` / `prototype`) ALWAYS stripped even if listed. `opts.onUnknown: "throw"` rejects unknown keys instead of silently dropping. Nested allowlist syntax for object-shaped fields. **Audit-sign legacy compat-shim removed** — `lib/audit-sign.js` no longer falls back to `ml-dsa-87` for key files missing the `algorithm` field. Throws `KEY_FILE_MISSING_ALG` / `UNWRAPPED_MISSING_ALG` at load time; operators with legacy files rotate the key (deletes + regenerates) or hand-edit to add `"algorithm": "slh-dsa-shake-256f"`. Pre-v1 compat-shim sweep per the no-pre-v1-compat rule. **Webhook PQC signatures emit base64url** — `b.webhook` now signs to base64url (was hex). SLH-DSA-SHAKE-256f signatures are ~29.5 KB binary → ~40 KB base64url vs ~59 KB hex; the hex form blew past nginx default 8 KB / Cloudflare default 16 KB / many CDN edge limits. Verification accepts EITHER encoding for a transition window — base64url-shaped sig values decode as base64url; hex-shaped values decode as hex. Smoke 8478 / wiki e2e 178 / Linux container smoke 8478 / Linux container wiki e2e 178 / eslint clean / api-snapshot baseline refreshed.
+
+- **0.7.20** (2026-05-05) — browser-hardening batch (5 fixes): CSRF Origin/Referer cross-check, default CSP gains Trusted Types, expanded Permissions-Policy, `__Host-` / `__Secure-` cookie prefix invariants, `b.middleware.fetchMetadata`. **CSRF Origin/Referer cross-check** (`b.middleware.csrfProtect`) — second-line defense alongside the double-submit token. State-changing requests whose Origin (or Referer when Origin is absent) doesn't resolve to the request's own origin are refused before the token check. Defaults ON; operator opt-out via `checkOrigin: false`; operator allowlist via `allowedOrigins: ["https://app.example.com"]`. Missing-Origin-AND-Missing-Referer (curl, server-to-server) defers to the token check. **Trusted Types in default CSP** (`b.middleware.securityHeaders`) — default CSP now includes `require-trusted-types-for 'script'; trusted-types 'allow-duplicates' default;`. Compatible browsers (Chrome 83+, Edge 83+) enforce typed-value DOM-sink writes (defends every untrusted-string-to-DOM XSS vector at runtime); Firefox + Safari ignore (no regression). Operators opt out by passing an explicit `csp:` value. **Expanded Permissions-Policy** — defaults now disable `browsing-topics=()`, `attribution-reporting=()`, `unload=()`, `interest-cohort=()`, `join-ad-interest-group=()`, `run-ad-auction=()`, `private-state-token-issuance=()`, `private-state-token-redemption=()`, `compute-pressure=()`, `hid=()`, `serial=()`, `idle-detection=()` — closes advertising / tracking / load-event-leak / device-API surfaces. Existing operator overrides via `permissionsPolicy: "..."` continue unchanged. **`__Host-` / `__Secure-` cookie prefix invariants** (`b.cookies.serialize`) — RFC 6265bis §4.1.3 enforced at serialize time. `__Secure-*` requires `secure: true`; `__Host-*` requires `secure: true` AND `path: "/"` AND no `domain:`. Each violation throws a typed `CookieError` with operator-actionable code (`cookies/prefix-secure-required`, `cookies/prefix-host-secure-required`, `cookies/prefix-host-path-required`, `cookies/prefix-host-no-domain`) instead of producing a malformed cookie that browsers silently reject. **`b.middleware.fetchMetadata`** — new fetch-metadata isolation primitive. Reads `Sec-Fetch-Site` / `Sec-Fetch-Mode` / `Sec-Fetch-Dest` and refuses cross-site state-changing requests by default. Operators opt in to specific destinations (e.g. `allowedDest: ["empty", "document"]`) or specific origins (`allowCrossSite: true`). Direct navigations (typed URL / bookmark — `Sec-Fetch-Site: none`) pass through; `same-origin` always passes; `same-site` configurable. Missing fetch-metadata (legacy browsers, server-to-server) deferred to other auth/CSRF layers per `allowMissing: true` default. Smoke 8481 / wiki e2e 178 / Linux container smoke 8481 / Linux container wiki e2e 178 / eslint clean / api-snapshot baseline refreshed.
+
 - **0.7.19** (2026-05-05) — auth-primitives batch (5 fixes): session idle/absolute timeout, JWT keyResolver for kid rotation, `b.middleware.bearerAuth`, `b.auth.jwt.verifyExternal` (classical-alg JWT verifier with JWKS support), and Argon2id parameter audit visibility. **Session idle + absolute timeouts** (`b.session.verify`) now enforce OWASP ASVS 5.0 §3.3 / NIST SP 800-63B-4 — defaults: 30 min idle, 12 hours absolute. Operators opt out per-call by passing `idleTimeoutMs: 0` / `absoluteTimeoutMs: 0`. Both surface `auth.session.expired_idle` / `auth.session.expired_absolute` audit events on enforcement. **JWT `keyResolver` opt** (`b.auth.jwt.verify`) — operator passes `keyResolver(decodedHeader)` to look up the public key per-token (typically by `kid`). Mutually exclusive with `opts.publicKey`. Async-friendly. Closes the kid-rotation gap where signers carried `kid` but verifiers only accepted a single static key. **`b.middleware.bearerAuth`** — new middleware that extracts `Authorization: Bearer <token>`, runs an operator-supplied `verify(token)` function, and attaches `req.user`. Distinct from cookie-session `attachUser`. Missing-Authorization passes through (so cookie path can take over); invalid/null/throw rejects 401 + `WWW-Authenticate: Bearer error="invalid_token"` per RFC 6750 §3. **`b.auth.jwt.verifyExternal`** — new generic classical-alg JWT verifier (RS256 / RS384 / RS512 / PS256 / PS384 / PS512 / ES256 / ES384 / ES512 / EdDSA) for integration with external IdPs (Auth0 / Okta / Keycloak / Cognito / Azure AD / Google / Apple). `algorithms` is REQUIRED with no default — defends the alg-confusion class (CVE-2024-54150 / CVE-2025-30144 / CVE-2026-22817 Hono). HMAC algs and `none` are explicitly refused (HMAC + JWKS public-key trust source IS the alg-confusion vector). Three key-source options: `jwks` (pre-fetched array), `jwksUri` (auto-fetched + TTL-cached via `b.httpClient` SSRF gate), `keyResolver` (custom). Standard claim checks (`exp` / `nbf` / `iat` / `aud` / `iss` / `sub`) with operator-tunable `clockSkewMs`. **`b.auth.password.params()`** — new accessor returning the active Argon2id params (`memoryCostKib` / `timeCost` / `parallelism`) plus the OWASP 2026 floor (`19 MiB` / `t>=2` / `p>=1`) plus `meetsFloor: bool`. Compliance-audit visibility without parsing PHC strings. Smoke 8458 → 8481 / wiki e2e 178 / Linux container smoke 8481 / Linux container wiki e2e 178 / eslint clean / api-snapshot baseline refreshed.
 
 - **0.7.18** (2026-05-05) — transport-layer smuggling hardening (four ship-blocker fixes). **HTTP request-smuggling defense** in `b.middleware.bodyParser` per RFC 9112 §6.1: rejects requests with both `Content-Length` and `Transfer-Encoding` headers (CL.TE / TE.CL smuggling — CVE-2022-31394 / CVE-2024-27316 class), multiple `Content-Length` values, `Transfer-Encoding` whose final coding is not `chunked`, and duplicate `chunked` tokens (TE.TE smuggling). Each rejection responds 400 + `Connection: close` so the upstream proxy doesn't reuse the socket. **Static-serve symlink-escape + filename safety** in `b.staticServe`: `_resolveSafe` now `fs.realpathSync`-es the resolved path (defeats symlink-out-of-root) AND validates the basename through `b.guardFilename` at the balanced profile (rejects path traversal, null-byte, NTFS alternate data streams, UNC paths, RTLO bidi, overlong UTF-8, Windows reserved device names, double-extension; balanced profile chosen over strict so legitimate operator-deposited shell-exec extensions like `.exe`/`.bin` remain serveable). **Outbound SMTP smuggling defense** in `b.mail` SMTP transport: every produced RFC 822 wire (post-DKIM-sign) is run through `b.guardEmail.validateMessage` at strict profile before the socket opens; refuses on critical issues — bare CR / bare LF + smuggled SMTP verbs (CVE-2023-51764 Postfix / CVE-2023-51765 Sendmail / CVE-2023-51766 Exim / CVE-2026-32178 .NET class) cannot leave the framework even when operator-supplied subject/body/headers contain the pattern. **DKIM `l=` body-length tag forbidden** in `b.mail.dkim.create`: passing `bodyLength` now throws `dkim/l-tag-forbidden` at create-time. M³AAWG / Gmail / Microsoft 365 guidance is "never use l=" — it enables append-after-signature attacks where an attacker appends arbitrary content past the signed length and the DKIM signature still validates against the original prefix. The body is always hashed in full. Smoke 8450 → 8458 / wiki e2e 178 / Linux container smoke 8458 / Linux container wiki e2e 178 / eslint clean / api-snapshot baseline refreshed.

package/index.js

@@ -1,4 +1,16 @@
 "use strict";
+
+// TLS 1.3 minimum, framework-wide. Sets the default for every TLS
+// socket the process opens — outbound (https.request, mail SMTP+
+// STARTTLS, redis/postgres/mongo with TLS, http-client) AND inbound
+// (https.createServer when blamejs is the listener). Per-call override
+// still works when an operator with a legacy peer needs TLSv1.2.
+// node:tls reads `DEFAULT_MIN_VERSION` once at first TLS use; setting
+// it here, before any framework module loads node:tls, makes the
+// default sticky for the entire process.
+var _tls = require("node:tls");
+_tls.DEFAULT_MIN_VERSION = "TLSv1.3";
+
 /**
  * blamejs — public API entry point.
  *
@@ -83,6 +95,8 @@ httpClient.encrypted = require("./lib/middleware/api-encrypt").httpClient;
 httpClient.cookieJar = require("./lib/http-client-cookie-jar");
 var websocket = require("./lib/websocket");
 var safeUrl = require("./lib/safe-url");
+var safeRedirect = require("./lib/safe-redirect");
+var pick = require("./lib/pick");
 var gateContract = require("./lib/gate-contract");
 var guardCsv = require("./lib/guard-csv");
 var guardHtml = require("./lib/guard-html");
@@ -220,6 +234,8 @@ module.exports = {
   httpClient:       httpClient,
   websocket:        websocket,
   safeUrl:          safeUrl,
+  safeRedirect:     safeRedirect,
+  pick:             pick,
   gateContract:     gateContract,
   guardCsv:         guardCsv,
   guardHtml:        guardHtml,

package/lib/audit-sign.js

@@ -77,12 +77,11 @@ var _err = AuditSignError.factory;
 
 // Default for newly-generated keys. Operators can override at init
 // via opts.algorithm — e.g. `auditSigning: { algorithm: "ml-dsa-87" }`
-// for throughput-sensitive deployments. Existing key files determine
-// their own algorithm via the on-disk `algorithm` field; legacy key
-// files that predate the algorithm field load as "ml-dsa-87" (the
-// previous implicit default).
+// for throughput-sensitive deployments. Every key file MUST carry the
+// `algorithm` field on disk — the framework refuses to load a key file
+// that lacks it. The legacy implicit-default-to-ml-dsa-87 fallback was
+// removed as part of the pre-v1 compat-shim sweep.
 var DEFAULT_SIGNING_ALG = "slh-dsa-shake-256f";
-var LEGACY_DEFAULT_ALG  = "ml-dsa-87";
 var SUPPORTED_SIGNING_ALGS = Object.freeze(["slh-dsa-shake-256f", "ml-dsa-87"]);
 
 var SIGNING_KEY_SCHEMA = {
@@ -202,11 +201,16 @@ function _initPlaintext() {
       throw _err("KEY_FILE_CORRUPT",
         "audit-sign.key corrupted or schema-invalid at " + paths.plaintext + " - " + e.message);
     }
-    var loadedAlg = loaded.algorithm || LEGACY_DEFAULT_ALG;
+    if (typeof loaded.algorithm !== "string" || loaded.algorithm.length === 0) {
+      throw _err("KEY_FILE_MISSING_ALG",
+        "audit-sign.key at " + paths.plaintext + " is missing the required " +
+        "`algorithm` field. Regenerate the keypair (deletes the file and " +
+        "boots fresh) or hand-edit to add `\"algorithm\": \"slh-dsa-shake-256f\"`.");
+    }
     keys = {
       publicKey:  loaded.publicKey,
       privateKey: loaded.privateKey,
-      algorithm:  loadedAlg,
+      algorithm:  loaded.algorithm,
       fingerprint: _computeFingerprint(loaded.publicKey),
     };
     return;
@@ -248,14 +252,17 @@ async function _initWrapped() {
       throw _err("UNWRAPPED_INVALID",
         "unwrapped audit-sign.key invalid: " + e.message);
     }
-    var loadedAlg = loaded.algorithm || LEGACY_DEFAULT_ALG;
+    if (typeof loaded.algorithm !== "string" || loaded.algorithm.length === 0) {
+      throw _err("UNWRAPPED_MISSING_ALG",
+        "unwrapped audit-sign.key is missing the required `algorithm` field.");
+    }
     keys = {
       publicKey:  loaded.publicKey,
       privateKey: loaded.privateKey,
-      algorithm:  loadedAlg,
+      algorithm:  loaded.algorithm,
       fingerprint: _computeFingerprint(loaded.publicKey),
     };
-    log("audit-signing keypair unsealed (alg=" + loadedAlg + ").");
+    log("audit-signing keypair unsealed (alg=" + loaded.algorithm + ").");
   } finally {
     // The audit-signing passphrase is single-use at boot — no re-wrap path
     // keeps it alive (unlike vault.currentPassphrase). Zero on the way out.

package/lib/cookies.js

@@ -144,6 +144,41 @@ function serialize(name, value, attrs) {
   _validateValue(value);
   attrs = attrs || {};
 
+  // RFC 6265bis §4.1.3 cookie-prefix invariants — refused at serialize-
+  // time so an operator-side typo doesn't ship a broken cookie that
+  // browsers silently reject (and the operator wonders why their cookie
+  // never sets).
+  //
+  //   __Secure-* — MUST be Secure
+  //   __Host-*   — MUST be Secure, Path=/, NO Domain
+  //
+  // Caught at the source so every caller (csrf-protect / session /
+  // operator) gets the same enforcement.
+  if (name.indexOf("__Secure-") === 0) {
+    if (attrs.secure !== true) {
+      throw new CookieError("cookies/prefix-secure-required",
+        "__Secure-* cookies MUST set Secure (RFC 6265bis §4.1.3.1) — got '" +
+        name + "' without secure: true");
+    }
+  }
+  if (name.indexOf("__Host-") === 0) {
+    if (attrs.secure !== true) {
+      throw new CookieError("cookies/prefix-host-secure-required",
+        "__Host-* cookies MUST set Secure (RFC 6265bis §4.1.3.2) — got '" +
+        name + "' without secure: true");
+    }
+    if (attrs.path !== "/") {
+      throw new CookieError("cookies/prefix-host-path-required",
+        "__Host-* cookies MUST set Path=/ (RFC 6265bis §4.1.3.2) — got '" +
+        name + "' with path=" + JSON.stringify(attrs.path || "<unset>"));
+    }
+    if (attrs.domain) {
+      throw new CookieError("cookies/prefix-host-no-domain",
+        "__Host-* cookies MUST NOT set Domain (RFC 6265bis §4.1.3.2) — got '" +
+        name + "' with domain=" + JSON.stringify(attrs.domain));
+    }
+  }
+
   var parts = [name + "=" + encodeURIComponent(value)];
 
   if (attrs.maxAge !== undefined && attrs.maxAge !== null) {

package/lib/middleware/csrf-protect.js

@@ -155,6 +155,63 @@ function _appendSetCookie(res, value) {
 // owns size caps, content-type dispatch, and prototype-pollution
 // defense; csrf-protect just reads the validated value.
 
+// Origin / Referer cross-check helper. Returns null when the request's
+// origin is acceptable, or a short reason string ("origin-mismatch" /
+// "referer-mismatch" / "no-origin-or-referer" / "malformed-url") when
+// it should be refused. Compares against opts.allowedOrigins (when
+// supplied) OR same-origin (the request's own Host header).
+//
+// Implementation note — we deliberately don't run safeUrl here; safeUrl
+// throws on file:// / data:// schemes which would crash the middleware
+// instead of refusing the request. URL constructor + try/catch is the
+// right shape for "is this URL well-formed and what's its origin?".
+function _checkOriginAllowed(req, allowedOrigins, isHttpsFn) {
+  var headers = req.headers || {};
+  var origin = headers.origin;
+  var referer = headers.referer;
+  if (typeof origin !== "string" && typeof referer !== "string") {
+    // No Origin/Referer at all — common for non-browser clients
+    // (curl, server-to-server). The token check still applies; this
+    // gate doesn't add to it. Defense-in-depth against a stolen
+    // cookie via a browser-rendered cross-origin fetch IS the value;
+    // headless clients carry their own auth threat model.
+    return null;
+  }
+
+  var requestOrigin = (isHttpsFn && isHttpsFn(req) ? "https://" : "http://") +
+                      (headers.host || "");
+
+  function _originOf(rawUrl) {
+    try {
+      var u = new URL(rawUrl);                                                   // allow:raw-new-url — origin-shape inspection (NOT outbound). Intentionally tolerates file:// / data: which safeUrl.parse refuses.
+      return u.origin;                                                           // "https://host:port" — no path / query / fragment
+    } catch (_e) { return null; }
+  }
+
+  function _isAllowed(candidateOrigin) {
+    if (!candidateOrigin) return false;
+    if (candidateOrigin === requestOrigin) return true;
+    if (Array.isArray(allowedOrigins)) {
+      for (var i = 0; i < allowedOrigins.length; i += 1) {
+        if (candidateOrigin === allowedOrigins[i]) return true;
+      }
+    }
+    return false;
+  }
+
+  if (typeof origin === "string" && origin.length > 0) {
+    var oo = _originOf(origin);
+    if (oo === null) return "malformed-origin";
+    if (!_isAllowed(oo)) return "origin-mismatch (" + oo + " vs " + requestOrigin + ")";
+    return null;
+  }
+  // Origin absent — fall back to Referer.
+  var ro = _originOf(referer);
+  if (ro === null) return "malformed-referer";
+  if (!_isAllowed(ro)) return "referer-mismatch (" + ro + " vs " + requestOrigin + ")";
+  return null;
+}
+
 function _writeReject(res, message) {
   if (typeof res.writeHead === "function") {
     var body = JSON.stringify({ error: message });
@@ -171,7 +228,7 @@ function create(opts) {
 
   validateOpts(opts, [
     "cookie", "tokenLookup", "fieldName", "headerName", "methods", "audit",
-    "trustProxy",
+    "trustProxy", "checkOrigin", "allowedOrigins",
   ], "middleware.csrfProtect");
   var trustProxy = opts.trustProxy === true || typeof opts.trustProxy === "number"
     ? opts.trustProxy : false;
@@ -193,6 +250,20 @@ function create(opts) {
   var methods    = (opts.methods || DEFAULT_METHODS).map(function (m) { return m.toUpperCase(); });
   var auditOn    = opts.audit !== false;
 
+  // Origin / Referer cross-check — second-line defense alongside the
+  // double-submit token. If the request's Origin (or Referer when
+  // Origin is absent — Safari pre-12, certain CORS mode requests)
+  // doesn't resolve to a same-origin or operator-allowlisted origin,
+  // refuse before the token check.
+  //
+  // Default: enabled (defense-in-depth — same shape as bot-guard /
+  // rate-limit / CSP nonce — every default ON per Core Rule §3).
+  // Operator opt-out: opts.checkOrigin = false.
+  // Operator allowlist: opts.allowedOrigins = ["https://app.example.com"].
+  var checkOrigin = opts.checkOrigin !== false;
+  var allowedOrigins = Array.isArray(opts.allowedOrigins)
+    ? opts.allowedOrigins.slice() : null;
+
   // Cookie issuance config (only when opts.cookie is set).
   var cookieCfg = null;
   if (hasCookie) {
@@ -282,6 +353,18 @@ function create(opts) {
 
     if (methods.indexOf(req.method) === -1) return next();
 
+    // Origin / Referer cross-check (defense-in-depth alongside the
+    // double-submit token). Refuses cross-origin state-changing
+    // requests even when the token is valid (e.g. operator-mistaken
+    // CORS configuration that exposes the cookie).
+    if (checkOrigin) {
+      var originReason = _checkOriginAllowed(req, allowedOrigins, _isHttps);
+      if (originReason !== null) {
+        _emitDenied(req, "origin/referer: " + originReason);
+        return _writeReject(res, "CSRF cross-origin request refused.");
+      }
+    }
+
     if (!cookieCfg) {
       // Session-stored mode — operator's tokenLookup is the source.
       expected = opts.tokenLookup(req);

package/lib/middleware/fetch-metadata.js

@@ -0,0 +1,129 @@
+"use strict";
+/**
+ * fetch-metadata — Sec-Fetch-Site / Sec-Fetch-Mode / Sec-Fetch-Dest
+ * isolation primitive (Resource Isolation Policy / Site Isolation —
+ * https://web.dev/fetch-metadata/).
+ *
+ * Browsers attach Sec-Fetch-* headers describing the FETCH context
+ * (same-site? cross-site? typed-URL? navigation? script load?).
+ * This middleware refuses cross-site requests on state-changing
+ * methods unless the operator explicitly allowlists them — a second-
+ * line defense alongside CSRF tokens.
+ *
+ *   var fmGate = b.middleware.fetchMetadata({
+ *     allowSameSite:    true,           // default
+ *     allowCrossSite:   false,          // default — refuse cross-site state changes
+ *     allowedDest:      ["empty", "document"],   // operator allowlist of Sec-Fetch-Dest
+ *     allowedNavigate:  true,           // allow direct navigations (typed URL / bookmark)
+ *     methods:          ["POST","PUT","DELETE","PATCH"],
+ *     audit:            true,
+ *   });
+ *   router.use("/api", fmGate);
+ *
+ * Refusal shape: 403 application/json + audit row. Same-origin /
+ * same-site requests pass through; cross-site refused unless
+ * allowedDest contains the request's Sec-Fetch-Dest. None / undefined
+ * (legacy browsers without fetch-metadata) is treated per
+ * `allowMissing` (default true — don't break older clients).
+ *
+ * Fail-open posture: when the request is missing Sec-Fetch-* entirely
+ * (curl, server-to-server, browser <Chrome 76 / <Firefox 90 / <Safari
+ * 16.4), the gate defers to other auth/CSRF layers. The browser-fetch-
+ * metadata isolation IS the value-add; non-browser clients carry their
+ * own auth threat model.
+ */
+
+var requestHelpers = require("../request-helpers");
+var validateOpts = require("../validate-opts");
+var lazyRequire = require("../lazy-require");
+
+var audit = lazyRequire(function () { return require("../audit"); });
+var observability = lazyRequire(function () { return require("../observability"); });
+
+var DEFAULT_METHODS = Object.freeze(["POST", "PUT", "DELETE", "PATCH"]);
+
+function _writeReject(res, message) {
+  if (res.headersSent) return;
+  var body = JSON.stringify({ error: message });
+  res.writeHead(requestHelpers.HTTP_STATUS.FORBIDDEN, {
+    "Content-Type":   "application/json; charset=utf-8",
+    "Content-Length": Buffer.byteLength(body),
+  });
+  res.end(body);
+}
+
+function create(opts) {
+  opts = opts || {};
+  validateOpts(opts, [
+    "allowSameSite", "allowCrossSite", "allowMissing",
+    "allowedDest", "allowedNavigate", "methods", "audit",
+  ], "middleware.fetchMetadata");
+
+  var allowSameSite   = opts.allowSameSite !== false;
+  var allowCrossSite  = opts.allowCrossSite === true;
+  var allowMissing    = opts.allowMissing !== false;
+  var allowedDest     = Array.isArray(opts.allowedDest)    ? opts.allowedDest.slice()    : null;
+  var allowedNavigate = opts.allowedNavigate !== false;
+  var methods         = (opts.methods || DEFAULT_METHODS).map(function (m) { return m.toUpperCase(); });
+  var auditOn         = opts.audit !== false;
+
+  function _emitDenied(req, reason) {
+    if (!auditOn) return;
+    try {
+      audit().safeEmit({
+        action:   "auth.fetch_metadata.denied",
+        outcome:  "denied",
+        actor:    requestHelpers.extractActorContext(req),
+        reason:   reason,
+        metadata: { method: req.method, path: (req.url || "").split("?")[0] },
+      });
+    } catch (_e) { /* audit best-effort */ }
+  }
+
+  return function fetchMetadata(req, res, next) {
+    if (methods.indexOf(req.method) === -1) return next();
+
+    var headers = req.headers || {};
+    var site = headers["sec-fetch-site"];
+    var mode = headers["sec-fetch-mode"];
+    var dest = headers["sec-fetch-dest"];
+
+    if (typeof site !== "string" || site.length === 0) {
+      // No Sec-Fetch-Site header — legacy browser or non-browser client.
+      // Defer to other auth/CSRF layers per allowMissing.
+      if (!allowMissing) {
+        _emitDenied(req, "fetch-metadata-missing");
+        return _writeReject(res, "Fetch-metadata required.");
+      }
+      return next();
+    }
+
+    // Direct navigations — typed URL, bookmark, history navigation.
+    if (site === "none") {
+      if (allowedNavigate) return next();
+      _emitDenied(req, "navigate-disallowed");
+      return _writeReject(res, "Direct navigation not allowed for this method.");
+    }
+
+    if (site === "same-origin") return next();
+
+    if (site === "same-site") {
+      if (allowSameSite) return next();
+      _emitDenied(req, "same-site-disallowed");
+      return _writeReject(res, "Same-site request not allowed.");
+    }
+
+    // cross-site
+    if (allowCrossSite) return next();
+    if (allowedDest && typeof dest === "string" && allowedDest.indexOf(dest) !== -1) {
+      return next();
+    }
+    _emitDenied(req, "cross-site-refused (mode=" + (mode || "?") +
+                     ", dest=" + (dest || "?") + ")");
+    try { observability().count("auth.fetch_metadata.cross_site_refused", 1, {}); }
+    catch (_e) { /* best-effort */ }
+    return _writeReject(res, "Cross-site request refused.");
+  };
+}
+
+module.exports = { create: create };

package/lib/middleware/index.js

@@ -27,6 +27,7 @@ var cspNonce = require("./csp-nonce");
 var csrfProtect = require("./csrf-protect");
 var dbRoleFor = require("./db-role-for");
 var errorHandler = require("./error-handler");
+var fetchMetadata = require("./fetch-metadata");
 var health = require("./health");
 var networkAllowlist = require("./network-allowlist");
 var rateLimit = require("./rate-limit");
@@ -47,6 +48,7 @@ module.exports = {
   bearerAuth:       bearerAuth.create,
   requireAuth:      requireAuth.create,
   csrfProtect:      csrfProtect.create,
+  fetchMetadata:    fetchMetadata.create,
   bodyParser:       bodyParser.create,
   health:           health.create,
   compression:      compression.create,
@@ -69,6 +71,7 @@ module.exports = {
     bearerAuth:       bearerAuth,
     requireAuth:      requireAuth,
     csrfProtect:      csrfProtect,
+    fetchMetadata:    fetchMetadata,
     bodyParser:       bodyParser,
     health:           health,
     compression:      compression,

package/lib/middleware/security-headers.js

@@ -46,12 +46,15 @@ var DEFAULT_PERMISSIONS = [
   "screen-wake-lock=()", "sync-xhr=()", "usb=()", "web-share=()", "xr-spatial-tracking=()",
 ];
 
-// Strict CSP — no 'unsafe-inline' on script-src OR style-src. Operators
-// with inline styles / scripts wire `b.middleware.cspNonce()` and use
-// `{{ cspNonce }}` in their views (or req.cspNonce in handlers); the
-// nonce hooks into the policy via the `csp` opt or a custom value.
-// Operators in transitional environments who genuinely need inline
-// styles set `csp` explicitly to the loose form.
+// Strict CSP — no 'unsafe-inline' on script-src OR style-src.
+// Trusted Types (require-trusted-types-for 'script') enables the
+// browser's strongest XSS-mitigation primitive — DOM-sink writes via
+// innerHTML / outerHTML / setHTML require typed values, surfacing
+// every untrusted-string-to-DOM path at runtime so operators can audit
+// + fix them. Compatible browsers (Chrome 83+, Edge 83+) enforce;
+// Firefox + Safari ignore (no regression). Operators with inline
+// scripts wire `b.middleware.cspNonce()` and use `{{ cspNonce }}` in
+// views.
 var DEFAULT_CSP =
   "default-src 'self'; " +
   "script-src 'self'; " +
@@ -62,7 +65,9 @@ var DEFAULT_CSP =
   "frame-ancestors 'none'; " +
   "base-uri 'self'; " +
   "form-action 'self'; " +
-  "object-src 'none';";
+  "object-src 'none'; " +
+  "require-trusted-types-for 'script'; " +
+  "trusted-types 'allow-duplicates' default;";
 
 function create(opts) {
   opts = opts || {};

package/lib/pick.js

@@ -0,0 +1,105 @@
+"use strict";
+/**
+ * b.pick — mass-assignment (CWE-915 / OWASP API3:2023) defense.
+ *
+ * The vulnerability: a route accepting `JSON` body and passing
+ * `req.body` straight to a DB write lets an attacker include fields
+ * the operator never intended (`isAdmin`, `passwordHash`, `userId`).
+ * This primitive is the operator's allowlist of acceptable fields —
+ * pass req.body through it before persisting.
+ *
+ *   var safeUserUpdate = b.pick(req.body, [
+ *     "displayName", "bio", "avatarUrl",
+ *   ]);
+ *   await db.users.update(userId, safeUserUpdate);
+ *
+ * Returns a NEW object containing only the keys in the allowlist.
+ * Keys not present in the input are simply absent from the output —
+ * no defaults filled in, no `undefined` values. Prototype-pollution
+ * keys (`__proto__` / `constructor` / `prototype`) are ALWAYS
+ * stripped, even if the operator accidentally lists them.
+ *
+ *   var partial = b.pick(req.body, ["a", "b"], { onUnknown: "throw" });
+ *   // throws if req.body has any key NOT in ["a", "b"]
+ *
+ *   var nested = b.pick(req.body, [
+ *     "name",
+ *     ["profile", ["bio", "url"]],     // nested allowlist for `profile.*`
+ *   ]);
+ */
+
+var POISONED_KEYS = ["__proto__", "constructor", "prototype"];
+
+function _isPlainObject(o) {
+  return o !== null && typeof o === "object" && !Array.isArray(o) &&
+         (Object.getPrototypeOf(o) === Object.prototype ||
+          Object.getPrototypeOf(o) === null);
+}
+
+function _normalizeAllowList(list) {
+  // Accept either ["a","b"] or [["nested",["sub1","sub2"]]] — return
+  // a Map<key, allowList | true>.
+  var out = Object.create(null);
+  for (var i = 0; i < list.length; i += 1) {
+    var entry = list[i];
+    if (typeof entry === "string") {
+      if (POISONED_KEYS.indexOf(entry) !== -1) continue;
+      out[entry] = true;
+    } else if (Array.isArray(entry) && entry.length === 2 &&
+               typeof entry[0] === "string" && Array.isArray(entry[1])) {
+      if (POISONED_KEYS.indexOf(entry[0]) !== -1) continue;
+      out[entry[0]] = _normalizeAllowList(entry[1]);
+    } else {
+      throw new TypeError(
+        "b.pick: allowlist entry must be a string or [name, [...]]; got " +
+        JSON.stringify(entry));
+    }
+  }
+  return out;
+}
+
+function _pickInner(input, normalized, onUnknown, path) {
+  if (!_isPlainObject(input)) {
+    return _isPlainObject(input) ? {} : input;
+  }
+  var output = Object.create(null);
+  var keys = Object.keys(input);
+  for (var i = 0; i < keys.length; i += 1) {
+    var k = keys[i];
+    if (POISONED_KEYS.indexOf(k) !== -1) continue;
+    if (!Object.prototype.hasOwnProperty.call(normalized, k)) {
+      if (onUnknown === "throw") {
+        throw new TypeError(
+          "b.pick: unknown key '" + (path ? path + "." : "") + k +
+          "' not in allowlist");
+      }
+      continue;
+    }
+    var rule = normalized[k];
+    if (rule === true) {
+      output[k] = input[k];
+    } else {
+      // Nested allowlist.
+      output[k] = _isPlainObject(input[k])
+        ? _pickInner(input[k], rule, onUnknown, (path ? path + "." : "") + k)
+        : input[k];
+    }
+  }
+  // Convert to a plain Object (output is currently null-prototype) so
+  // downstream JSON serializers / DB drivers see a normal-shape object.
+  return Object.assign({}, output);
+}
+
+function pick(input, allowList, opts) {
+  opts = opts || {};
+  if (!Array.isArray(allowList)) {
+    throw new TypeError("b.pick: second argument must be an array of allowed keys");
+  }
+  var onUnknown = opts.onUnknown === "throw" ? "throw" : "drop";
+  var normalized = _normalizeAllowList(allowList);
+  return _pickInner(input, normalized, onUnknown, "");
+}
+
+module.exports = pick;
+module.exports.pick = pick;
+module.exports.POISONED_KEYS = Object.freeze(POISONED_KEYS.slice());

package/lib/safe-redirect.js

@@ -0,0 +1,106 @@
+"use strict";
+/**
+ * safe-redirect — open-redirect (CWE-601) defense for operator-supplied
+ * post-login `?next=` / `?return_to=` parameters and similar redirect
+ * targets.
+ *
+ * The vulnerability: an attacker phishes a victim with a link like
+ * `https://app.example.com/login?next=https://attacker.example.com`.
+ * After login, a naive `res.writeHead(302, { Location: req.query.next })`
+ * sends the user to attacker.example.com under the trust of app.example.com.
+ *
+ *   var safe = b.safeRedirect.resolve(rawNext, {
+ *     base:           "https://app.example.com",
+ *     allowedOrigins: ["https://app.example.com"],
+ *     allowedHosts:   ["app.example.com"],
+ *     fallback:       "/dashboard",
+ *   });
+ *   // → safe path or fallback (never attacker.example.com)
+ *
+ * Decision rules (in order):
+ *
+ *   1. rawTarget is null / empty / non-string → fallback
+ *   2. rawTarget starts with "//" or "\\" → fallback (protocol-relative
+ *      open redirect — `//attacker.com/path` interpreted as
+ *      `https://attacker.com/path` by browsers)
+ *   3. rawTarget contains a control char / null / CR / LF → fallback
+ *      (header-injection vector)
+ *   4. rawTarget is a relative path starting with "/" → safe (same-
+ *      origin by definition)
+ *   5. rawTarget is a fragment / search-only ("#x" / "?q=1") → safe
+ *   6. rawTarget is a full URL → parse + check origin against
+ *      allowedOrigins (or host against allowedHosts when the operator
+ *      doesn't care about scheme/port match)
+ *   7. anything else (data:, javascript:, malformed) → fallback
+ *
+ * Returns the safe URL string (path + query + fragment for relative;
+ * full URL for allowed full URLs; fallback otherwise). Operators
+ * pass the result directly to `res.writeHead(302, { Location: ... })`.
+ */
+
+var safeUrl = require("./safe-url");
+var validateOpts = require("./validate-opts");
+
+var DEFAULT_FALLBACK = "/";
+
+function _hasControlChar(s) {
+  for (var i = 0; i < s.length; i += 1) {
+    var c = s.charCodeAt(i);
+    if (c < 0x20 || c === 0x7f) return true;                                     // allow:raw-byte-literal — ASCII control range thresholds
+  }
+  return false;
+}
+
+function resolve(rawTarget, opts) {
+  opts = opts || {};
+  validateOpts(opts, ["base", "allowedOrigins", "allowedHosts", "fallback"], "safeRedirect.resolve");
+
+  var fallback = typeof opts.fallback === "string" ? opts.fallback : DEFAULT_FALLBACK;
+  if (typeof rawTarget !== "string" || rawTarget.length === 0) return fallback;
+  if (_hasControlChar(rawTarget)) return fallback;
+
+  // Reject protocol-relative ("//host/...") and back-slash variant
+  // ("\\host\..." — IE / older browsers may interpret as auth).
+  if (rawTarget.length >= 2) {
+    var p0 = rawTarget.charAt(0);
+    var p1 = rawTarget.charAt(1);
+    if ((p0 === "/" || p0 === "\\") && (p1 === "/" || p1 === "\\")) return fallback;
+  }
+
+  // Same-origin relative (path / query / fragment) — safe by definition.
+  if (rawTarget.charAt(0) === "/" || rawTarget.charAt(0) === "?" ||
+      rawTarget.charAt(0) === "#") {
+    return rawTarget;
+  }
+
+  // Full URL — parse and check against allowlist.
+  var allowedOrigins = Array.isArray(opts.allowedOrigins) ? opts.allowedOrigins : null;
+  var allowedHosts   = Array.isArray(opts.allowedHosts)   ? opts.allowedHosts   : null;
+  if (!allowedOrigins && !allowedHosts) {
+    // Operator gave no allowlist — refuse all full URLs (the safe default).
+    return fallback;
+  }
+
+  var parsed;
+  try { parsed = safeUrl.parse(rawTarget, { allowedProtocols: safeUrl.ALLOW_HTTP_TLS }); }
+  catch (_e) { return fallback; }
+
+  if (allowedOrigins) {
+    for (var i = 0; i < allowedOrigins.length; i += 1) {
+      if (parsed.origin === allowedOrigins[i]) return rawTarget;
+    }
+  }
+  if (allowedHosts) {
+    for (var j = 0; j < allowedHosts.length; j += 1) {
+      if (parsed.host === allowedHosts[j] || parsed.hostname === allowedHosts[j]) {
+        return rawTarget;
+      }
+    }
+  }
+  return fallback;
+}
+
+module.exports = {
+  resolve:           resolve,
+  DEFAULT_FALLBACK:  DEFAULT_FALLBACK,
+};

package/lib/static.js

@@ -168,19 +168,21 @@ function _resolveSafe(root, requestedPath) {
 
   // Symlink-escape defense — the lexical resolve above only sees the
   // requested path tokens; a symlink anywhere along `resolved` can
-  // still point outside `rootResolved` on disk. realpath every node
-  // (only when it exists; missing files are routed through the
-  // standard 404 path by the caller).
+  // still point outside `rootResolved` on disk. Compare via realpath
+  // for the escape check ONLY; do NOT substitute the realpath result
+  // for `resolved`. Substituting breaks downstream consumers that key
+  // on the lexical path (revoke list, ETag cache, audit row) AND
+  // breaks deploys where the OS prefix-symlinks the temp dir
+  // (macOS: /var/folders/X/Y → /private/var/folders/X/Y).
   try {
     var real = fs.realpathSync(resolved);
     var rootReal = fs.realpathSync(rootResolved);
     if (real !== rootReal && !real.startsWith(rootReal + path.sep)) return null;
-    resolved = real;
   } catch (_e) {
     // Path doesn't exist (or is denied) — fall through with the lexical
     // resolution so the caller's stat() returns the natural ENOENT and
     // 404s. realpath failures from non-existence are NOT a smuggling
-    // signal.
+    // signal; the lexical bound check above already rejected escapes.
   }
 
   // Filename safety — the basename gates against path-traversal /

package/lib/webhook.js

@@ -198,17 +198,37 @@ function _hmacVerify(key, data, expectedHex) {
   return crypto.timingSafeEqual(actualHex, expectedHex);
 }
 
+// PQC signatures encode as base64url. SLH-DSA-SHAKE-256f signatures
+// are ~29.5 KB binary → ~59 KB hex but only ~40 KB base64url. The hex
+// form blew past common front-end limits (nginx default 8 KB / Cloudflare
+// default 16 KB / many CDN edge limits 32 KB). base64url keeps the
+// signature in-header for the bulk of operators while still allowing
+// body-bound signatures (operator passes the wire-encoded sig in body
+// when even base64url is too large for their topology).
+//
+// Verification accepts EITHER encoding for a transition window: a
+// base64url-shaped value is decoded as base64url; otherwise a hex-
+// shaped value is decoded as hex. New signatures are emitted as
+// base64url; old hex-encoded signatures still verify.
 function _pqcSign(privateKeyPem, data) {
-  return crypto.sign(data, privateKeyPem).toString("hex");
+  return crypto.sign(data, privateKeyPem).toString("base64url");
 }
 
-function _pqcVerify(publicKeyPem, data, expectedHex) {
-  if (!safeBuffer.isHex(expectedHex) || (expectedHex.length % 2) !== 0) {
-    return false;
-  }
+var _BASE64URL_RE = /^[A-Za-z0-9_-]+$/;
+
+function _pqcVerify(publicKeyPem, data, expectedSig) {
+  if (typeof expectedSig !== "string" || expectedSig.length === 0) return false;
   var sigBuf;
-  try { sigBuf = Buffer.from(expectedHex, "hex"); }
-  catch (_e) { return false; }
+  try {
+    if (_BASE64URL_RE.test(expectedSig) &&                                       // allow:regex-no-length-cap — sig length bounded by header parser cap
+        !/^[0-9a-f]+$/.test(expectedSig)) {                                      // allow:regex-no-length-cap — same
+      sigBuf = Buffer.from(expectedSig, "base64url");
+    } else if (safeBuffer.isHex(expectedSig) && (expectedSig.length % 2) === 0) {
+      sigBuf = Buffer.from(expectedSig, "hex");
+    } else {
+      return false;
+    }
+  } catch (_e) { return false; }
   try { return crypto.verify(data, sigBuf, publicKeyPem); }
   catch (_e) { return false; }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.7.19",
+  "version": "0.7.21",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cyclonedx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3cf8a44f-f452-436c-a92e-cc1ae392a5e5",
+  "serialNumber": "urn:uuid:e04975c4-d3d5-4299-aad3-3e7d44ea1d43",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-05T05:30:46.323Z",
+    "timestamp": "2026-05-05T06:06:29.999Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.7.19",
+      "bom-ref": "@blamejs/core@0.7.21",
       "type": "library",
       "name": "blamejs",
-      "version": "0.7.19",
+      "version": "0.7.21",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.7.19",
+      "purl": "pkg:npm/%40blamejs/core@0.7.21",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.7.19",
+      "ref": "@blamejs/core@0.7.21",
       "dependsOn": []
     }
   ]