@blamejs/core 0.7.20 → 0.7.22

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.7.x
 
+- **0.7.22** (2026-05-05) — DKIM dual-signer + soc2-cc7 → soc2 posture rename. **`b.mail.dkim.dualSigner`** — RFC 8463 §3 transition signer that produces messages with BOTH a legacy RSA-SHA-256 DKIM-Signature AND an Ed25519-SHA-256 DKIM-Signature header. Receivers without Ed25519 support validate the RSA signature; receivers that prefer Ed25519 validate the post-quantum-friendlier signature. Operators rolling off RSA-SHA-256 wire `b.mail.dkim.dualSigner({ domain, rsa: { selector, privateKey }, eddsa: { selector, privateKey } })` and pass the result anywhere a regular DKIM signer is accepted; `sign()` produces a wire with two `DKIM-Signature` headers. Both signers are constructed eagerly at create-time (configuration errors surface at boot, not at first send). **soc2-cc7 → soc2 posture rename** — every guard's compliance posture name changes from `"soc2-cc7"` to `"soc2"`. The CC7-specific scoping was misleading (SOC 2 controls span CC1–CC9; the existing posture wasn't CC7-specific). Operators with `compliancePosture: "soc2-cc7"` MUST update to `compliancePosture: "soc2"` — the old name now throws `unknown compliance posture`. Smoke 8478 / wiki e2e 178 / Linux container smoke 8478 / Linux container wiki e2e 178 / eslint clean / api-snapshot baseline refreshed.
+
+- **0.7.21** (2026-05-05) — small primitive batch (5 fixes): TLS 1.3 framework-wide minimum, `b.safeRedirect`, `b.pick`, audit-sign legacy compat-shim removed, webhook PQC signatures emit base64url. **Framework-wide TLS 1.3 minimum** — `index.js` sets `tls.DEFAULT_MIN_VERSION = "TLSv1.3"` once at boot, before any framework module loads `node:tls`. Applies to every TLS socket (outbound `https.request` / mail SMTP+STARTTLS / Redis-Postgres-Mongo TLS / `b.httpClient`, AND inbound `https.createServer` when blamejs is the listener). Per-call override still works for legacy peers. **`b.safeRedirect`** — open-redirect (CWE-601) defense. `b.safeRedirect.resolve(rawTarget, { allowedOrigins, allowedHosts, fallback })` returns the safe URL (or fallback). Refuses protocol-relative (`//attacker.com`), backslash variants (`\\\\attacker.com`), control-char-laden (CRLF header injection), and `data:` / `javascript:` schemes; same-origin paths (`/dashboard`) and fragments (`#x`) pass through; full URLs require explicit allowlist. Operator drops the result straight into `res.writeHead(302, { Location: ... })`. **`b.pick`** — mass-assignment (CWE-915 / OWASP API3:2023) defense. `b.pick(req.body, ["a", "b", ["nested", ["sub1"]]])` returns a NEW object with only allowlisted keys; prototype-pollution keys (`__proto__` / `constructor` / `prototype`) ALWAYS stripped even if listed. `opts.onUnknown: "throw"` rejects unknown keys instead of silently dropping. Nested allowlist syntax for object-shaped fields. **Audit-sign legacy compat-shim removed** — `lib/audit-sign.js` no longer falls back to `ml-dsa-87` for key files missing the `algorithm` field. Throws `KEY_FILE_MISSING_ALG` / `UNWRAPPED_MISSING_ALG` at load time; operators with legacy files rotate the key (deletes + regenerates) or hand-edit to add `"algorithm": "slh-dsa-shake-256f"`. Pre-v1 compat-shim sweep per the no-pre-v1-compat rule. **Webhook PQC signatures emit base64url** — `b.webhook` now signs to base64url (was hex). SLH-DSA-SHAKE-256f signatures are ~29.5 KB binary → ~40 KB base64url vs ~59 KB hex; the hex form blew past nginx default 8 KB / Cloudflare default 16 KB / many CDN edge limits. Verification accepts EITHER encoding for a transition window — base64url-shaped sig values decode as base64url; hex-shaped values decode as hex. Smoke 8478 / wiki e2e 178 / Linux container smoke 8478 / Linux container wiki e2e 178 / eslint clean / api-snapshot baseline refreshed.
+
 - **0.7.20** (2026-05-05) — browser-hardening batch (5 fixes): CSRF Origin/Referer cross-check, default CSP gains Trusted Types, expanded Permissions-Policy, `__Host-` / `__Secure-` cookie prefix invariants, `b.middleware.fetchMetadata`. **CSRF Origin/Referer cross-check** (`b.middleware.csrfProtect`) — second-line defense alongside the double-submit token. State-changing requests whose Origin (or Referer when Origin is absent) doesn't resolve to the request's own origin are refused before the token check. Defaults ON; operator opt-out via `checkOrigin: false`; operator allowlist via `allowedOrigins: ["https://app.example.com"]`. Missing-Origin-AND-Missing-Referer (curl, server-to-server) defers to the token check. **Trusted Types in default CSP** (`b.middleware.securityHeaders`) — default CSP now includes `require-trusted-types-for 'script'; trusted-types 'allow-duplicates' default;`. Compatible browsers (Chrome 83+, Edge 83+) enforce typed-value DOM-sink writes (defends every untrusted-string-to-DOM XSS vector at runtime); Firefox + Safari ignore (no regression). Operators opt out by passing an explicit `csp:` value. **Expanded Permissions-Policy** — defaults now disable `browsing-topics=()`, `attribution-reporting=()`, `unload=()`, `interest-cohort=()`, `join-ad-interest-group=()`, `run-ad-auction=()`, `private-state-token-issuance=()`, `private-state-token-redemption=()`, `compute-pressure=()`, `hid=()`, `serial=()`, `idle-detection=()` — closes advertising / tracking / load-event-leak / device-API surfaces. Existing operator overrides via `permissionsPolicy: "..."` continue unchanged. **`__Host-` / `__Secure-` cookie prefix invariants** (`b.cookies.serialize`) — RFC 6265bis §4.1.3 enforced at serialize time. `__Secure-*` requires `secure: true`; `__Host-*` requires `secure: true` AND `path: "/"` AND no `domain:`. Each violation throws a typed `CookieError` with operator-actionable code (`cookies/prefix-secure-required`, `cookies/prefix-host-secure-required`, `cookies/prefix-host-path-required`, `cookies/prefix-host-no-domain`) instead of producing a malformed cookie that browsers silently reject. **`b.middleware.fetchMetadata`** — new fetch-metadata isolation primitive. Reads `Sec-Fetch-Site` / `Sec-Fetch-Mode` / `Sec-Fetch-Dest` and refuses cross-site state-changing requests by default. Operators opt in to specific destinations (e.g. `allowedDest: ["empty", "document"]`) or specific origins (`allowCrossSite: true`). Direct navigations (typed URL / bookmark — `Sec-Fetch-Site: none`) pass through; `same-origin` always passes; `same-site` configurable. Missing fetch-metadata (legacy browsers, server-to-server) deferred to other auth/CSRF layers per `allowMissing: true` default. Smoke 8481 / wiki e2e 178 / Linux container smoke 8481 / Linux container wiki e2e 178 / eslint clean / api-snapshot baseline refreshed.
 
 - **0.7.19** (2026-05-05) — auth-primitives batch (5 fixes): session idle/absolute timeout, JWT keyResolver for kid rotation, `b.middleware.bearerAuth`, `b.auth.jwt.verifyExternal` (classical-alg JWT verifier with JWKS support), and Argon2id parameter audit visibility. **Session idle + absolute timeouts** (`b.session.verify`) now enforce OWASP ASVS 5.0 §3.3 / NIST SP 800-63B-4 — defaults: 30 min idle, 12 hours absolute. Operators opt out per-call by passing `idleTimeoutMs: 0` / `absoluteTimeoutMs: 0`. Both surface `auth.session.expired_idle` / `auth.session.expired_absolute` audit events on enforcement. **JWT `keyResolver` opt** (`b.auth.jwt.verify`) — operator passes `keyResolver(decodedHeader)` to look up the public key per-token (typically by `kid`). Mutually exclusive with `opts.publicKey`. Async-friendly. Closes the kid-rotation gap where signers carried `kid` but verifiers only accepted a single static key. **`b.middleware.bearerAuth`** — new middleware that extracts `Authorization: Bearer <token>`, runs an operator-supplied `verify(token)` function, and attaches `req.user`. Distinct from cookie-session `attachUser`. Missing-Authorization passes through (so cookie path can take over); invalid/null/throw rejects 401 + `WWW-Authenticate: Bearer error="invalid_token"` per RFC 6750 §3. **`b.auth.jwt.verifyExternal`** — new generic classical-alg JWT verifier (RS256 / RS384 / RS512 / PS256 / PS384 / PS512 / ES256 / ES384 / ES512 / EdDSA) for integration with external IdPs (Auth0 / Okta / Keycloak / Cognito / Azure AD / Google / Apple). `algorithms` is REQUIRED with no default — defends the alg-confusion class (CVE-2024-54150 / CVE-2025-30144 / CVE-2026-22817 Hono). HMAC algs and `none` are explicitly refused (HMAC + JWKS public-key trust source IS the alg-confusion vector). Three key-source options: `jwks` (pre-fetched array), `jwksUri` (auto-fetched + TTL-cached via `b.httpClient` SSRF gate), `keyResolver` (custom). Standard claim checks (`exp` / `nbf` / `iat` / `aud` / `iss` / `sub`) with operator-tunable `clockSkewMs`. **`b.auth.password.params()`** — new accessor returning the active Argon2id params (`memoryCostKib` / `timeCost` / `parallelism`) plus the OWASP 2026 floor (`19 MiB` / `t>=2` / `p>=1`) plus `meetsFloor: bool`. Compliance-audit visibility without parsing PHC strings. Smoke 8458 → 8481 / wiki e2e 178 / Linux container smoke 8481 / Linux container wiki e2e 178 / eslint clean / api-snapshot baseline refreshed.

package/README.md

@@ -46,7 +46,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 - **Crypto** — envelope-versioned PQC at rest (ML-KEM-1024 + P-384 hybrid, XChaCha20-Poly1305, SHAKE256), vault sealing, field-level crypto + cryptographic erasure (`b.cryptoField.eraseRow`), signed webhooks (SLH-DSA-SHAKE-256f), ECIES API encryption (`b.crypto`, `b.vault`, `b.webhook`); pure-JS mTLS CA that issues clientAuth / serverAuth / dual-EKU certs with SAN entries and auto-detects the highest-PQC signature algorithm the vendored x509 library accepts (today: ECDSA-P384-SHA384 bridge; self-upgrades to SLH-DSA / ML-DSA when the X.509 ecosystem catches up), PQC TLS gates inbound + outbound (`b.mtlsCa`, `b.pqcGate`, `b.pqcAgent`).
 - **HTTP** — router with schema-validated routes + OpenAPI publication; full middleware stack (CSRF, CORS, rate-limit, security headers, CSP nonce, body parser, compression, SSE, request log, request-time DB role binding via `b.middleware.dbRoleFor`, in-process CIDR fence via `b.middleware.networkAllowlist`) wired by `createApp`; HTTP/1.1 + HTTP/2 outbound client with SSRF gate (cloud-metadata IPs hard-denied unconditionally; private / loopback / link-local overridable per call), scheme + userinfo + per-host (wildcard / per-method) destination allowlist, redirects, multipart, interceptors, progress, encrypted cookie jar (`b.httpClient`, `b.ssrfGuard`, `b.safeUrl`); operator-tunable network configurability — env-driven NTP / NTS (RFC 8915 authenticated time), IPv4-or-IPv6 NTP servers, DNS with IPv6 / DoH / DoT (private-CA trust pinning via `opts.ca`) / cache / lookup timeout, outbound HTTP proxy (`HTTP_PROXY` / `HTTPS_PROXY` / `NO_PROXY`), runtime DPI trust-store CA additions, application-level heartbeats, TCP socket defaults (`b.network`).
 - **Defensive parsers** — `b.safeJson`, `b.safeBuffer`, `b.safeSql`, `b.safeSchema`, `b.parsers` (XML / TOML / YAML / .env), `b.config` (schema-validated env), `b.fileType` magic-byte content classification with deny-on-upload categories (image / document / archive / executable / etc.).
-- **Content-safety gates** — `b.gateContract` uniform composition contract (mode posture / hooks / forensic snapshot / decision cache / runtime cap). Family members: `b.guardCsv` (formula injection ASCII + full-width prefixes, dangerous-function denylist, bidi / homoglyph / control / null / BOM / zero-width detection, dialect ambiguity, CSV-bombs, numeric precision, schema-bound serializer); `b.guardHtml` (XSS / mXSS / DOM-clobbering / dangerous-tag / event-handler-family / dangerous-URL-scheme with entity-decode / CSS-injection in style attribute / IE conditional comments + token-level sanitize + always-correct `escapeText` / `escapeAttr` entity encoders); `b.guardSvg` (script / foreignObject / animation-element href hijack / DOCTYPE billion-laughs / XXE / SVGZ / cross-origin `<use>` SSRF / event-handlers + token-level sanitize). `b.guardArchive` (zip-slip / symlink + hardlink escape / decompression-ratio bombs (per-entry + aggregate) / nested-archive depth / duplicate-entry / case-insensitive collision / encryption-claim mismatch / format-claim mismatch via magic-byte detection — composes `b.guardFilename` for per-entry-name validation); `b.guardJson` (source-level prototype-pollution detection, duplicate-key, NaN/Infinity, JSON5 syntax, BOM, bidi, numeric-precision-loss, top-level-key allowlist, depth/breadth/array/string/node-count caps); `b.guardYaml` (deserialization-tag RCE via language-specific tag prefixes, billion-laughs alias recursion, Norway-problem implicit booleans, leading-zero octals, multi-document streams, duplicate keys, merge-key chains, depth+anchor+node caps); `b.guardXml` (XXE / billion-laughs / external-entity / parameter-entity / XInclude / xsi:schemaLocation / processing-instruction / CDATA / XML-signature-wrapping detection — DOCTYPE refused at all profile levels); `b.guardMarkdown` (source-level scan run BEFORE any markdown renderer sees the input — dangerous URL schemes in inline links + images + autolinks + reference-link definitions with HTML-entity decode bypass; whitespace-tolerant dangerous-tag matching per CVE-2026-30838; front-matter; HTML comments; code-fence language injection; catastrophic emphasis-run ReDoS per CVE-2025-6493 class; inline DOCTYPE; depth + link + image + autolink + ref-def caps); `b.guardEmail` (single-address + full RFC 822/5322 message validation — SMTP smuggling per CVE-2023-51764 / 51765 / 51766 / CVE-2026-32178 class via bare-CR + bare-LF + smuggled SMTP verbs; CRLF header injection; IDN homograph mixed-script domains with operator-opt-in `allowedScripts`; Punycode flag; display-name spoofing; IP-literal addresses; RFC 5322 comment syntax; multi-@; RFC 5321 length caps + RFC 5322 line cap; BOM injection). Filename safety: `b.guardFilename` (path traversal raw + percent-encoded + overlong-UTF-8 + null-byte truncation + Windows reserved names + NTFS ADS + RTLO bidi spoofing + shell-exec / double-extension detection — standalone, wires into `b.fileUpload` via `filenameSafety`). All members ship strict / balanced / permissive profiles plus hipaa / pci-dss / gdpr / soc2-cc7 compliance postures. `b.guardAll` is the registry + aggregator: every shipped guard ON by default; opt-out per guard with audited reason via `exceptFor: { name: { reason } }`. **As of v0.7.12, `b.fileUpload` and `b.staticServe` wire `b.guardAll.byExtension({ profile: "strict" })` automatically + `b.fileUpload` also wires `b.guardFilename.gate({ profile: "strict" })` as `filenameSafety`** — defense-in-depth applied without any explicit operator wiring. Operators opt out per host-primitive via `contentSafety: null` / `filenameSafety: null` (audited at create() with operator-supplied reason).
+- **Content-safety gates** — `b.gateContract` uniform composition contract (mode posture / hooks / forensic snapshot / decision cache / runtime cap). Family members: `b.guardCsv` (formula injection ASCII + full-width prefixes, dangerous-function denylist, bidi / homoglyph / control / null / BOM / zero-width detection, dialect ambiguity, CSV-bombs, numeric precision, schema-bound serializer); `b.guardHtml` (XSS / mXSS / DOM-clobbering / dangerous-tag / event-handler-family / dangerous-URL-scheme with entity-decode / CSS-injection in style attribute / IE conditional comments + token-level sanitize + always-correct `escapeText` / `escapeAttr` entity encoders); `b.guardSvg` (script / foreignObject / animation-element href hijack / DOCTYPE billion-laughs / XXE / SVGZ / cross-origin `<use>` SSRF / event-handlers + token-level sanitize). `b.guardArchive` (zip-slip / symlink + hardlink escape / decompression-ratio bombs (per-entry + aggregate) / nested-archive depth / duplicate-entry / case-insensitive collision / encryption-claim mismatch / format-claim mismatch via magic-byte detection — composes `b.guardFilename` for per-entry-name validation); `b.guardJson` (source-level prototype-pollution detection, duplicate-key, NaN/Infinity, JSON5 syntax, BOM, bidi, numeric-precision-loss, top-level-key allowlist, depth/breadth/array/string/node-count caps); `b.guardYaml` (deserialization-tag RCE via language-specific tag prefixes, billion-laughs alias recursion, Norway-problem implicit booleans, leading-zero octals, multi-document streams, duplicate keys, merge-key chains, depth+anchor+node caps); `b.guardXml` (XXE / billion-laughs / external-entity / parameter-entity / XInclude / xsi:schemaLocation / processing-instruction / CDATA / XML-signature-wrapping detection — DOCTYPE refused at all profile levels); `b.guardMarkdown` (source-level scan run BEFORE any markdown renderer sees the input — dangerous URL schemes in inline links + images + autolinks + reference-link definitions with HTML-entity decode bypass; whitespace-tolerant dangerous-tag matching per CVE-2026-30838; front-matter; HTML comments; code-fence language injection; catastrophic emphasis-run ReDoS per CVE-2025-6493 class; inline DOCTYPE; depth + link + image + autolink + ref-def caps); `b.guardEmail` (single-address + full RFC 822/5322 message validation — SMTP smuggling per CVE-2023-51764 / 51765 / 51766 / CVE-2026-32178 class via bare-CR + bare-LF + smuggled SMTP verbs; CRLF header injection; IDN homograph mixed-script domains with operator-opt-in `allowedScripts`; Punycode flag; display-name spoofing; IP-literal addresses; RFC 5322 comment syntax; multi-@; RFC 5321 length caps + RFC 5322 line cap; BOM injection). Filename safety: `b.guardFilename` (path traversal raw + percent-encoded + overlong-UTF-8 + null-byte truncation + Windows reserved names + NTFS ADS + RTLO bidi spoofing + shell-exec / double-extension detection — standalone, wires into `b.fileUpload` via `filenameSafety`). All members ship strict / balanced / permissive profiles plus hipaa / pci-dss / gdpr / soc2 compliance postures. `b.guardAll` is the registry + aggregator: every shipped guard ON by default; opt-out per guard with audited reason via `exceptFor: { name: { reason } }`. **As of v0.7.12, `b.fileUpload` and `b.staticServe` wire `b.guardAll.byExtension({ profile: "strict" })` automatically + `b.fileUpload` also wires `b.guardFilename.gate({ profile: "strict" })` as `filenameSafety`** — defense-in-depth applied without any explicit operator wiring. Operators opt out per host-primitive via `contentSafety: null` / `filenameSafety: null` (audited at create() with operator-supplied reason).
 - **Communication** — WebSockets with channel/room fan-out across cluster replicas (`b.websocket`, `b.websocketChannels`); generic distributed pub/sub with cluster-table / Redis PUB/SUB / custom backends (`b.pubsub`); mail with multipart + attachments + DKIM + calendar invites + bounce intake (`b.mail`, `b.mailBounce`); generic notification dispatcher with operator-supplied transports (`b.notify`); chunked file uploads with per-chunk SHA3-512 verification + atomic finalize + tombstone cleanup (`b.fileUpload`).
 - **Observability** — tamper-evident audit chain with SLH-DSA-signed checkpoints, metrics, tracing (OTel pass-through when wired), PII redaction, log-stream sinks (local file rotation, generic webhook, OTLP/HTTP-JSON OR OTLP/gRPC to an OTel collector, AWS CloudWatch Logs via SigV4 with optional autoCreate, RFC 5424 syslog over UDP/TCP/TLS), OTLP/HTTP-JSON exporter for traces + metrics (`b.audit`, `b.metrics`, `b.tracing`, `b.redact`, `b.logStream`, `b.otelExport`); operator-callable boot-time security policy assertions (`b.security.assertProduction`) and tamper-evident config-baseline drift detection signed with the audit-signing key (`b.configDrift`).
 - **i18n** — CLDR plural rules, Accept-Language negotiation, Intl formatters, RTL (`b.i18n`).

package/index.js

@@ -1,4 +1,16 @@
 "use strict";
+
+// TLS 1.3 minimum, framework-wide. Sets the default for every TLS
+// socket the process opens — outbound (https.request, mail SMTP+
+// STARTTLS, redis/postgres/mongo with TLS, http-client) AND inbound
+// (https.createServer when blamejs is the listener). Per-call override
+// still works when an operator with a legacy peer needs TLSv1.2.
+// node:tls reads `DEFAULT_MIN_VERSION` once at first TLS use; setting
+// it here, before any framework module loads node:tls, makes the
+// default sticky for the entire process.
+var _tls = require("node:tls");
+_tls.DEFAULT_MIN_VERSION = "TLSv1.3";
+
 /**
  * blamejs — public API entry point.
  *
@@ -83,6 +95,8 @@ httpClient.encrypted = require("./lib/middleware/api-encrypt").httpClient;
 httpClient.cookieJar = require("./lib/http-client-cookie-jar");
 var websocket = require("./lib/websocket");
 var safeUrl = require("./lib/safe-url");
+var safeRedirect = require("./lib/safe-redirect");
+var pick = require("./lib/pick");
 var gateContract = require("./lib/gate-contract");
 var guardCsv = require("./lib/guard-csv");
 var guardHtml = require("./lib/guard-html");
@@ -220,6 +234,8 @@ module.exports = {
   httpClient:       httpClient,
   websocket:        websocket,
   safeUrl:          safeUrl,
+  safeRedirect:     safeRedirect,
+  pick:             pick,
   gateContract:     gateContract,
   guardCsv:         guardCsv,
   guardHtml:        guardHtml,

package/lib/audit-sign.js

@@ -77,12 +77,11 @@ var _err = AuditSignError.factory;
 
 // Default for newly-generated keys. Operators can override at init
 // via opts.algorithm — e.g. `auditSigning: { algorithm: "ml-dsa-87" }`
-// for throughput-sensitive deployments. Existing key files determine
-// their own algorithm via the on-disk `algorithm` field; legacy key
-// files that predate the algorithm field load as "ml-dsa-87" (the
-// previous implicit default).
+// for throughput-sensitive deployments. Every key file MUST carry the
+// `algorithm` field on disk — the framework refuses to load a key file
+// that lacks it. The legacy implicit-default-to-ml-dsa-87 fallback was
+// removed as part of the pre-v1 compat-shim sweep.
 var DEFAULT_SIGNING_ALG = "slh-dsa-shake-256f";
-var LEGACY_DEFAULT_ALG  = "ml-dsa-87";
 var SUPPORTED_SIGNING_ALGS = Object.freeze(["slh-dsa-shake-256f", "ml-dsa-87"]);
 
 var SIGNING_KEY_SCHEMA = {
@@ -202,11 +201,16 @@ function _initPlaintext() {
       throw _err("KEY_FILE_CORRUPT",
         "audit-sign.key corrupted or schema-invalid at " + paths.plaintext + " - " + e.message);
     }
-    var loadedAlg = loaded.algorithm || LEGACY_DEFAULT_ALG;
+    if (typeof loaded.algorithm !== "string" || loaded.algorithm.length === 0) {
+      throw _err("KEY_FILE_MISSING_ALG",
+        "audit-sign.key at " + paths.plaintext + " is missing the required " +
+        "`algorithm` field. Regenerate the keypair (deletes the file and " +
+        "boots fresh) or hand-edit to add `\"algorithm\": \"slh-dsa-shake-256f\"`.");
+    }
     keys = {
       publicKey:  loaded.publicKey,
       privateKey: loaded.privateKey,
-      algorithm:  loadedAlg,
+      algorithm:  loaded.algorithm,
       fingerprint: _computeFingerprint(loaded.publicKey),
     };
     return;
@@ -248,14 +252,17 @@ async function _initWrapped() {
       throw _err("UNWRAPPED_INVALID",
         "unwrapped audit-sign.key invalid: " + e.message);
     }
-    var loadedAlg = loaded.algorithm || LEGACY_DEFAULT_ALG;
+    if (typeof loaded.algorithm !== "string" || loaded.algorithm.length === 0) {
+      throw _err("UNWRAPPED_MISSING_ALG",
+        "unwrapped audit-sign.key is missing the required `algorithm` field.");
+    }
     keys = {
       publicKey:  loaded.publicKey,
       privateKey: loaded.privateKey,
-      algorithm:  loadedAlg,
+      algorithm:  loaded.algorithm,
       fingerprint: _computeFingerprint(loaded.publicKey),
     };
-    log("audit-signing keypair unsealed (alg=" + loadedAlg + ").");
+    log("audit-signing keypair unsealed (alg=" + loaded.algorithm + ").");
   } finally {
     // The audit-signing passphrase is single-use at boot — no re-wrap path
     // keeps it alive (unlike vault.currentPassphrase). Zero on the way out.

package/lib/csv.js

@@ -39,7 +39,7 @@
  * `b.guardCsv` — its `serialize` / `validate` / `sanitize` / `gate`
  * surface handles every documented threat with a single profile choice
  * (strict / balanced / permissive / email-attachment) or compliance
- * posture (hipaa / pci-dss / gdpr / soc2-cc7).
+ * posture (hipaa / pci-dss / gdpr / soc2).
  *
  * Throws CsvError (FrameworkError, permanent) on shape violations.
  */

package/lib/guard-all.js

@@ -43,7 +43,7 @@
  *   - PROFILES          — object map; must include the SHARED_PROFILES
  *                         vocabulary (strict / balanced / permissive)
  *   - COMPLIANCE_POSTURES — object map; must include the SHARED_POSTURES
- *                         vocabulary (hipaa / pci-dss / gdpr / soc2-cc7)
+ *                         vocabulary (hipaa / pci-dss / gdpr / soc2)
  *   - gate(opts)        — returns a b.gateContract-shaped gate
  *
  * The parity check at module load throws GuardAllError if a registered
@@ -95,7 +95,7 @@ var STANDALONE_GUARDS = [
 // support. Adding a new shared profile / posture is a coordinated
 // cross-guard change — every member must implement it.
 var SHARED_PROFILES = Object.freeze(["strict", "balanced", "permissive"]);
-var SHARED_POSTURES = Object.freeze(["hipaa", "pci-dss", "gdpr", "soc2-cc7"]);
+var SHARED_POSTURES = Object.freeze(["hipaa", "pci-dss", "gdpr", "soc2"]);
 
 // ---- Registry parity check (runs at module load) ----
 

package/lib/guard-archive.js

@@ -117,7 +117,7 @@
  *   permissive — symlinks + hardlinks within root allowed; nested-depth
  *                4; 100000 entries; 10 GiB total; 1000:1 ratio.
  *
- * Compliance postures: hipaa / pci-dss / gdpr / soc2-cc7 — strict
+ * Compliance postures: hipaa / pci-dss / gdpr / soc2 — strict
  * overlay + forensic snapshots.
  */
 
@@ -248,7 +248,7 @@ var COMPLIANCE_POSTURES = Object.freeze({
   "gdpr": Object.assign({}, PROFILES["balanced"], {
     forensicSnippetBytes: C.BYTES.bytes(128),
   }),
-  "soc2-cc7": Object.assign({}, PROFILES["strict"], {
+  "soc2": Object.assign({}, PROFILES["strict"], {
     forensicSnippetBytes: C.BYTES.bytes(512),
   }),
 });

package/lib/guard-csv.js

@@ -47,7 +47,7 @@
  *     validation.
  *   - Profiles: strict (OWASP-aligned, prefix-tab default per OWASP) /
  *     balanced / permissive / email-attachment.
- *   - Compliance postures: hipaa / pci-dss / gdpr / soc2-cc7.
+ *   - Compliance postures: hipaa / pci-dss / gdpr / soc2.
  *   - Operator extensibility: profile composition, custom rules, hooks
  *     (beforeCheck / afterCheck / onIssue / onSanitize / onRefuse /
  *     onAudit), threat-intel feeds, sandbox isolation, snapshot tests.
@@ -275,7 +275,7 @@ var COMPLIANCE_POSTURES = Object.freeze({
     piiPolicy:              "redact",
     forensicSnippetBytes:   FORENSIC_SNIPPET_GDPR,
   },
-  "soc2-cc7": {
+  "soc2": {
     formulaInjectionPolicy: "prefix-tab",
     bidiCharPolicy:         "reject",
     controlCharPolicy:      "reject",

package/lib/guard-email.js

@@ -265,7 +265,7 @@ var COMPLIANCE_POSTURES = Object.freeze({
   "gdpr": Object.assign({}, PROFILES["balanced"], {
     forensicSnippetBytes: C.BYTES.bytes(128),
   }),
-  "soc2-cc7": Object.assign({}, PROFILES["strict"], {
+  "soc2": Object.assign({}, PROFILES["strict"], {
     forensicSnippetBytes: C.BYTES.bytes(512),
   }),
 });

package/lib/guard-filename.js

@@ -234,7 +234,7 @@ var COMPLIANCE_POSTURES = Object.freeze({
     leadingTrailingPolicy: "strip",
     forensicSnippetBytes: C.BYTES.bytes(128),
   },
-  "soc2-cc7": {
+  "soc2": {
     bidiPolicy: "reject", controlPolicy: "reject", nullBytePolicy: "reject",
     zeroWidthPolicy: "reject", traversalPolicy: "reject",
     reservedCharPolicy: "reject", reservedNamePolicy: "reject",

package/lib/guard-html.js

@@ -351,7 +351,7 @@ var COMPLIANCE_POSTURES = Object.freeze({
     mxssHintPolicy:   "audit",
     forensicSnippetBytes: C.BYTES.bytes(128),
   },
-  "soc2-cc7": {
+  "soc2": {
     allowedTags:      STRICT_ALLOWED_TAGS,
     bidiPolicy:       "reject",
     controlPolicy:    "reject",

package/lib/guard-json.js

@@ -204,7 +204,7 @@ var COMPLIANCE_POSTURES = Object.freeze({
   "gdpr": Object.assign({}, PROFILES["balanced"], {
     forensicSnippetBytes: C.BYTES.bytes(128),
   }),
-  "soc2-cc7": Object.assign({}, PROFILES["strict"], {
+  "soc2": Object.assign({}, PROFILES["strict"], {
     forensicSnippetBytes: C.BYTES.bytes(512),
   }),
 });

package/lib/guard-markdown.js

@@ -213,7 +213,7 @@ var COMPLIANCE_POSTURES = Object.freeze({
   "gdpr": Object.assign({}, PROFILES["balanced"], {
     forensicSnippetBytes: C.BYTES.bytes(128),
   }),
-  "soc2-cc7": Object.assign({}, PROFILES["strict"], {
+  "soc2": Object.assign({}, PROFILES["strict"], {
     forensicSnippetBytes: C.BYTES.bytes(512),
   }),
 });

package/lib/guard-svg.js

@@ -327,7 +327,7 @@ var COMPLIANCE_POSTURES = Object.freeze({
     allowAnimation:     false,
     forensicSnippetBytes: C.BYTES.bytes(128),
   },
-  "soc2-cc7": {
+  "soc2": {
     allowedTags:        STRICT_ALLOWED_TAGS,
     bidiPolicy:         "reject",
     controlPolicy:      "reject",

package/lib/guard-xml.js

@@ -143,7 +143,7 @@ var COMPLIANCE_POSTURES = Object.freeze({
   "gdpr": Object.assign({}, PROFILES["balanced"], {
     forensicSnippetBytes: C.BYTES.bytes(128),
   }),
-  "soc2-cc7": Object.assign({}, PROFILES["strict"], {
+  "soc2": Object.assign({}, PROFILES["strict"], {
     forensicSnippetBytes: C.BYTES.bytes(512),
   }),
 });

package/lib/guard-yaml.js

@@ -183,7 +183,7 @@ var COMPLIANCE_POSTURES = Object.freeze({
   "gdpr": Object.assign({}, PROFILES["balanced"], {
     forensicSnippetBytes: C.BYTES.bytes(128),
   }),
-  "soc2-cc7": Object.assign({}, PROFILES["strict"], {
+  "soc2": Object.assign({}, PROFILES["strict"], {
     forensicSnippetBytes: C.BYTES.bytes(512),
   }),
 });

package/lib/mail-dkim.js

@@ -358,11 +358,62 @@ function create(opts) {
   };
 }
 
+// dualSigner — RFC 8463 §3 transition signer. Produces messages with
+// BOTH a legacy RSA-SHA-256 DKIM-Signature AND an Ed25519-SHA-256
+// DKIM-Signature header. Receivers that don't yet support Ed25519
+// validate the RSA signature; receivers that prefer Ed25519 validate
+// the post-quantum-friendlier signature. The transition pattern is
+// the recommended path for moving the operator's domain off RSA-SHA-
+// 256 without breaking older verifiers.
+//
+//   var dual = b.mail.dkim.dualSigner({
+//     domain: "example.com",
+//     rsa:    { selector: "rsa1",   privateKey: rsaPemKey },
+//     eddsa:  { selector: "eddsa1", privateKey: ed25519PemKey },
+//     // every other create() opt is shared (canonicalization,
+//     // headersToSign, audit) but can be overridden per algorithm.
+//   });
+//   var signed = dual.sign(rfc822Wire);
+//   // → wire with two DKIM-Signature: headers (RSA first, Ed25519 second)
+//
+// Both signers are constructed eagerly at create-time (configuration
+// errors surface at boot, not at first send). The combined sign()
+// applies the RSA signer first, then the Ed25519 signer on top.
+function dualSigner(opts) {
+  if (!opts || !opts.rsa || !opts.eddsa) {
+    throw new DkimError("dkim/dual-signer-missing",
+      "dualSigner requires both opts.rsa and opts.eddsa");
+  }
+  if (!opts.domain) {
+    throw new DkimError("dkim/dual-signer-missing-domain",
+      "dualSigner requires opts.domain");
+  }
+  function _merge(base, alg, override) {
+    return Object.assign({}, base, { algorithm: alg }, override);
+  }
+  var sharedBase = {};
+  var commonKeys = ["domain", "headersToSign", "canonicalization", "audit"];
+  for (var i = 0; i < commonKeys.length; i += 1) {
+    if (opts[commonKeys[i]] !== undefined) sharedBase[commonKeys[i]] = opts[commonKeys[i]];
+  }
+  var rsaSigner   = create(_merge(sharedBase, "rsa-sha256",     opts.rsa));
+  var eddsaSigner = create(_merge(sharedBase, "ed25519-sha256", opts.eddsa));
+  return {
+    sign: function (rfc822) {
+      var afterRsa = rsaSigner.sign(rfc822);
+      return eddsaSigner.sign(afterRsa);
+    },
+    rsa:   rsaSigner,
+    eddsa: eddsaSigner,
+  };
+}
+
 // Test-only exports for unit testing the canonicalization primitives
 // directly without going through a full sign() round.
 module.exports = {
-  create:    create,
-  DkimError: DkimError,
+  create:      create,
+  dualSigner:  dualSigner,
+  DkimError:   DkimError,
   _canonHeaderRelaxedForTest: _canonHeaderRelaxed,
   _canonBodyRelaxedForTest:   _canonBodyRelaxed,
   _canonBodySimpleForTest:    _canonBodySimple,

package/lib/pick.js

@@ -0,0 +1,105 @@
+"use strict";
+/**
+ * b.pick — mass-assignment (CWE-915 / OWASP API3:2023) defense.
+ *
+ * The vulnerability: a route accepting `JSON` body and passing
+ * `req.body` straight to a DB write lets an attacker include fields
+ * the operator never intended (`isAdmin`, `passwordHash`, `userId`).
+ * This primitive is the operator's allowlist of acceptable fields —
+ * pass req.body through it before persisting.
+ *
+ *   var safeUserUpdate = b.pick(req.body, [
+ *     "displayName", "bio", "avatarUrl",
+ *   ]);
+ *   await db.users.update(userId, safeUserUpdate);
+ *
+ * Returns a NEW object containing only the keys in the allowlist.
+ * Keys not present in the input are simply absent from the output —
+ * no defaults filled in, no `undefined` values. Prototype-pollution
+ * keys (`__proto__` / `constructor` / `prototype`) are ALWAYS
+ * stripped, even if the operator accidentally lists them.
+ *
+ *   var partial = b.pick(req.body, ["a", "b"], { onUnknown: "throw" });
+ *   // throws if req.body has any key NOT in ["a", "b"]
+ *
+ *   var nested = b.pick(req.body, [
+ *     "name",
+ *     ["profile", ["bio", "url"]],     // nested allowlist for `profile.*`
+ *   ]);
+ */
+
+var POISONED_KEYS = ["__proto__", "constructor", "prototype"];
+
+function _isPlainObject(o) {
+  return o !== null && typeof o === "object" && !Array.isArray(o) &&
+         (Object.getPrototypeOf(o) === Object.prototype ||
+          Object.getPrototypeOf(o) === null);
+}
+
+function _normalizeAllowList(list) {
+  // Accept either ["a","b"] or [["nested",["sub1","sub2"]]] — return
+  // a Map<key, allowList | true>.
+  var out = Object.create(null);
+  for (var i = 0; i < list.length; i += 1) {
+    var entry = list[i];
+    if (typeof entry === "string") {
+      if (POISONED_KEYS.indexOf(entry) !== -1) continue;
+      out[entry] = true;
+    } else if (Array.isArray(entry) && entry.length === 2 &&
+               typeof entry[0] === "string" && Array.isArray(entry[1])) {
+      if (POISONED_KEYS.indexOf(entry[0]) !== -1) continue;
+      out[entry[0]] = _normalizeAllowList(entry[1]);
+    } else {
+      throw new TypeError(
+        "b.pick: allowlist entry must be a string or [name, [...]]; got " +
+        JSON.stringify(entry));
+    }
+  }
+  return out;
+}
+
+function _pickInner(input, normalized, onUnknown, path) {
+  if (!_isPlainObject(input)) {
+    return _isPlainObject(input) ? {} : input;
+  }
+  var output = Object.create(null);
+  var keys = Object.keys(input);
+  for (var i = 0; i < keys.length; i += 1) {
+    var k = keys[i];
+    if (POISONED_KEYS.indexOf(k) !== -1) continue;
+    if (!Object.prototype.hasOwnProperty.call(normalized, k)) {
+      if (onUnknown === "throw") {
+        throw new TypeError(
+          "b.pick: unknown key '" + (path ? path + "." : "") + k +
+          "' not in allowlist");
+      }
+      continue;
+    }
+    var rule = normalized[k];
+    if (rule === true) {
+      output[k] = input[k];
+    } else {
+      // Nested allowlist.
+      output[k] = _isPlainObject(input[k])
+        ? _pickInner(input[k], rule, onUnknown, (path ? path + "." : "") + k)
+        : input[k];
+    }
+  }
+  // Convert to a plain Object (output is currently null-prototype) so
+  // downstream JSON serializers / DB drivers see a normal-shape object.
+  return Object.assign({}, output);
+}
+
+function pick(input, allowList, opts) {
+  opts = opts || {};
+  if (!Array.isArray(allowList)) {
+    throw new TypeError("b.pick: second argument must be an array of allowed keys");
+  }
+  var onUnknown = opts.onUnknown === "throw" ? "throw" : "drop";
+  var normalized = _normalizeAllowList(allowList);
+  return _pickInner(input, normalized, onUnknown, "");
+}
+
+module.exports = pick;
+module.exports.pick = pick;
+module.exports.POISONED_KEYS = Object.freeze(POISONED_KEYS.slice());

package/lib/safe-redirect.js

@@ -0,0 +1,106 @@
+"use strict";
+/**
+ * safe-redirect — open-redirect (CWE-601) defense for operator-supplied
+ * post-login `?next=` / `?return_to=` parameters and similar redirect
+ * targets.
+ *
+ * The vulnerability: an attacker phishes a victim with a link like
+ * `https://app.example.com/login?next=https://attacker.example.com`.
+ * After login, a naive `res.writeHead(302, { Location: req.query.next })`
+ * sends the user to attacker.example.com under the trust of app.example.com.
+ *
+ *   var safe = b.safeRedirect.resolve(rawNext, {
+ *     base:           "https://app.example.com",
+ *     allowedOrigins: ["https://app.example.com"],
+ *     allowedHosts:   ["app.example.com"],
+ *     fallback:       "/dashboard",
+ *   });
+ *   // → safe path or fallback (never attacker.example.com)
+ *
+ * Decision rules (in order):
+ *
+ *   1. rawTarget is null / empty / non-string → fallback
+ *   2. rawTarget starts with "//" or "\\" → fallback (protocol-relative
+ *      open redirect — `//attacker.com/path` interpreted as
+ *      `https://attacker.com/path` by browsers)
+ *   3. rawTarget contains a control char / null / CR / LF → fallback
+ *      (header-injection vector)
+ *   4. rawTarget is a relative path starting with "/" → safe (same-
+ *      origin by definition)
+ *   5. rawTarget is a fragment / search-only ("#x" / "?q=1") → safe
+ *   6. rawTarget is a full URL → parse + check origin against
+ *      allowedOrigins (or host against allowedHosts when the operator
+ *      doesn't care about scheme/port match)
+ *   7. anything else (data:, javascript:, malformed) → fallback
+ *
+ * Returns the safe URL string (path + query + fragment for relative;
+ * full URL for allowed full URLs; fallback otherwise). Operators
+ * pass the result directly to `res.writeHead(302, { Location: ... })`.
+ */
+
+var safeUrl = require("./safe-url");
+var validateOpts = require("./validate-opts");
+
+var DEFAULT_FALLBACK = "/";
+
+function _hasControlChar(s) {
+  for (var i = 0; i < s.length; i += 1) {
+    var c = s.charCodeAt(i);
+    if (c < 0x20 || c === 0x7f) return true;                                     // allow:raw-byte-literal — ASCII control range thresholds
+  }
+  return false;
+}
+
+function resolve(rawTarget, opts) {
+  opts = opts || {};
+  validateOpts(opts, ["base", "allowedOrigins", "allowedHosts", "fallback"], "safeRedirect.resolve");
+
+  var fallback = typeof opts.fallback === "string" ? opts.fallback : DEFAULT_FALLBACK;
+  if (typeof rawTarget !== "string" || rawTarget.length === 0) return fallback;
+  if (_hasControlChar(rawTarget)) return fallback;
+
+  // Reject protocol-relative ("//host/...") and back-slash variant
+  // ("\\host\..." — IE / older browsers may interpret as auth).
+  if (rawTarget.length >= 2) {
+    var p0 = rawTarget.charAt(0);
+    var p1 = rawTarget.charAt(1);
+    if ((p0 === "/" || p0 === "\\") && (p1 === "/" || p1 === "\\")) return fallback;
+  }
+
+  // Same-origin relative (path / query / fragment) — safe by definition.
+  if (rawTarget.charAt(0) === "/" || rawTarget.charAt(0) === "?" ||
+      rawTarget.charAt(0) === "#") {
+    return rawTarget;
+  }
+
+  // Full URL — parse and check against allowlist.
+  var allowedOrigins = Array.isArray(opts.allowedOrigins) ? opts.allowedOrigins : null;
+  var allowedHosts   = Array.isArray(opts.allowedHosts)   ? opts.allowedHosts   : null;
+  if (!allowedOrigins && !allowedHosts) {
+    // Operator gave no allowlist — refuse all full URLs (the safe default).
+    return fallback;
+  }
+
+  var parsed;
+  try { parsed = safeUrl.parse(rawTarget, { allowedProtocols: safeUrl.ALLOW_HTTP_TLS }); }
+  catch (_e) { return fallback; }
+
+  if (allowedOrigins) {
+    for (var i = 0; i < allowedOrigins.length; i += 1) {
+      if (parsed.origin === allowedOrigins[i]) return rawTarget;
+    }
+  }
+  if (allowedHosts) {
+    for (var j = 0; j < allowedHosts.length; j += 1) {
+      if (parsed.host === allowedHosts[j] || parsed.hostname === allowedHosts[j]) {
+        return rawTarget;
+      }
+    }
+  }
+  return fallback;
+}
+
+module.exports = {
+  resolve:           resolve,
+  DEFAULT_FALLBACK:  DEFAULT_FALLBACK,
+};

package/lib/webhook.js

@@ -198,17 +198,37 @@ function _hmacVerify(key, data, expectedHex) {
   return crypto.timingSafeEqual(actualHex, expectedHex);
 }
 
+// PQC signatures encode as base64url. SLH-DSA-SHAKE-256f signatures
+// are ~29.5 KB binary → ~59 KB hex but only ~40 KB base64url. The hex
+// form blew past common front-end limits (nginx default 8 KB / Cloudflare
+// default 16 KB / many CDN edge limits 32 KB). base64url keeps the
+// signature in-header for the bulk of operators while still allowing
+// body-bound signatures (operator passes the wire-encoded sig in body
+// when even base64url is too large for their topology).
+//
+// Verification accepts EITHER encoding for a transition window: a
+// base64url-shaped value is decoded as base64url; otherwise a hex-
+// shaped value is decoded as hex. New signatures are emitted as
+// base64url; old hex-encoded signatures still verify.
 function _pqcSign(privateKeyPem, data) {
-  return crypto.sign(data, privateKeyPem).toString("hex");
+  return crypto.sign(data, privateKeyPem).toString("base64url");
 }
 
-function _pqcVerify(publicKeyPem, data, expectedHex) {
-  if (!safeBuffer.isHex(expectedHex) || (expectedHex.length % 2) !== 0) {
-    return false;
-  }
+var _BASE64URL_RE = /^[A-Za-z0-9_-]+$/;
+
+function _pqcVerify(publicKeyPem, data, expectedSig) {
+  if (typeof expectedSig !== "string" || expectedSig.length === 0) return false;
   var sigBuf;
-  try { sigBuf = Buffer.from(expectedHex, "hex"); }
-  catch (_e) { return false; }
+  try {
+    if (_BASE64URL_RE.test(expectedSig) &&                                       // allow:regex-no-length-cap — sig length bounded by header parser cap
+        !/^[0-9a-f]+$/.test(expectedSig)) {                                      // allow:regex-no-length-cap — same
+      sigBuf = Buffer.from(expectedSig, "base64url");
+    } else if (safeBuffer.isHex(expectedSig) && (expectedSig.length % 2) === 0) {
+      sigBuf = Buffer.from(expectedSig, "hex");
+    } else {
+      return false;
+    }
+  } catch (_e) { return false; }
   try { return crypto.verify(data, sigBuf, publicKeyPem); }
   catch (_e) { return false; }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.7.20",
+  "version": "0.7.22",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cyclonedx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:be5934ef-c4b9-4516-a8ee-b8bb2c31ee26",
+  "serialNumber": "urn:uuid:30b4f7c6-d648-478a-aa77-dbbfb61c7951",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-05T05:52:29.844Z",
+    "timestamp": "2026-05-05T06:18:09.475Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.7.20",
+      "bom-ref": "@blamejs/core@0.7.22",
       "type": "library",
       "name": "blamejs",
-      "version": "0.7.20",
+      "version": "0.7.22",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.7.20",
+      "purl": "pkg:npm/%40blamejs/core@0.7.22",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.7.20",
+      "ref": "@blamejs/core@0.7.22",
       "dependsOn": []
     }
   ]