@blamejs/core 0.7.21 → 0.7.23

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.7.x
 
+- **0.7.23** (2026-05-05) — DNS-over-HTTPS default-on. **Default-on DoH for outbound DNS** — `lib/network-dns.js` now uses Cloudflare DoH (`https://cloudflare-dns.com/dns-query`) for hostname resolution by default when neither `useDnsOverHttps()` nor `useDnsOverTls()` has been called explicitly. Privacy-respecting (encrypted DNS over TLS to a non-ISP resolver), aligned with Core Rule §3 ("security defaults are not opt-in"). **Local-form hosts route through node:dns** — RFC 6761 / 6762 special-form names (`localhost`, `*.localhost`, `*.local`, `*.test`, `*.invalid`, `*.internal`, `*.intranet`, `*.lan`, `*.home`, `*.corp`) AND IP literals skip DoH and use node:dns directly so `/etc/hosts` lookups + dev workflows continue to resolve correctly. **Operator opt-out via `b.network.dns.useSystemResolver()`** — split-horizon / internal-DNS deployments call this once at boot and every lookup routes through the OS resolver thereafter. **Env override `BLAMEJS_DNS_TRANSPORT`** — operators set `system` (force OS resolver), `dot` (force Cloudflare DNS-over-TLS at 1.1.1.1:853), or leave unset (default DoH). Smoke 8478 / wiki e2e 178 / Linux container smoke 8478 / Linux container wiki e2e 178 / eslint clean / api-snapshot baseline refreshed.
+
+- **0.7.22** (2026-05-05) — DKIM dual-signer + soc2-cc7 → soc2 posture rename. **`b.mail.dkim.dualSigner`** — RFC 8463 §3 transition signer that produces messages with BOTH a legacy RSA-SHA-256 DKIM-Signature AND an Ed25519-SHA-256 DKIM-Signature header. Receivers without Ed25519 support validate the RSA signature; receivers that prefer Ed25519 validate the post-quantum-friendlier signature. Operators rolling off RSA-SHA-256 wire `b.mail.dkim.dualSigner({ domain, rsa: { selector, privateKey }, eddsa: { selector, privateKey } })` and pass the result anywhere a regular DKIM signer is accepted; `sign()` produces a wire with two `DKIM-Signature` headers. Both signers are constructed eagerly at create-time (configuration errors surface at boot, not at first send). **soc2-cc7 → soc2 posture rename** — every guard's compliance posture name changes from `"soc2-cc7"` to `"soc2"`. The CC7-specific scoping was misleading (SOC 2 controls span CC1–CC9; the existing posture wasn't CC7-specific). Operators with `compliancePosture: "soc2-cc7"` MUST update to `compliancePosture: "soc2"` — the old name now throws `unknown compliance posture`. Smoke 8478 / wiki e2e 178 / Linux container smoke 8478 / Linux container wiki e2e 178 / eslint clean / api-snapshot baseline refreshed.
+
 - **0.7.21** (2026-05-05) — small primitive batch (5 fixes): TLS 1.3 framework-wide minimum, `b.safeRedirect`, `b.pick`, audit-sign legacy compat-shim removed, webhook PQC signatures emit base64url. **Framework-wide TLS 1.3 minimum** — `index.js` sets `tls.DEFAULT_MIN_VERSION = "TLSv1.3"` once at boot, before any framework module loads `node:tls`. Applies to every TLS socket (outbound `https.request` / mail SMTP+STARTTLS / Redis-Postgres-Mongo TLS / `b.httpClient`, AND inbound `https.createServer` when blamejs is the listener). Per-call override still works for legacy peers. **`b.safeRedirect`** — open-redirect (CWE-601) defense. `b.safeRedirect.resolve(rawTarget, { allowedOrigins, allowedHosts, fallback })` returns the safe URL (or fallback). Refuses protocol-relative (`//attacker.com`), backslash variants (`\\\\attacker.com`), control-char-laden (CRLF header injection), and `data:` / `javascript:` schemes; same-origin paths (`/dashboard`) and fragments (`#x`) pass through; full URLs require explicit allowlist. Operator drops the result straight into `res.writeHead(302, { Location: ... })`. **`b.pick`** — mass-assignment (CWE-915 / OWASP API3:2023) defense. `b.pick(req.body, ["a", "b", ["nested", ["sub1"]]])` returns a NEW object with only allowlisted keys; prototype-pollution keys (`__proto__` / `constructor` / `prototype`) ALWAYS stripped even if listed. `opts.onUnknown: "throw"` rejects unknown keys instead of silently dropping. Nested allowlist syntax for object-shaped fields. **Audit-sign legacy compat-shim removed** — `lib/audit-sign.js` no longer falls back to `ml-dsa-87` for key files missing the `algorithm` field. Throws `KEY_FILE_MISSING_ALG` / `UNWRAPPED_MISSING_ALG` at load time; operators with legacy files rotate the key (deletes + regenerates) or hand-edit to add `"algorithm": "slh-dsa-shake-256f"`. Pre-v1 compat-shim sweep per the no-pre-v1-compat rule. **Webhook PQC signatures emit base64url** — `b.webhook` now signs to base64url (was hex). SLH-DSA-SHAKE-256f signatures are ~29.5 KB binary → ~40 KB base64url vs ~59 KB hex; the hex form blew past nginx default 8 KB / Cloudflare default 16 KB / many CDN edge limits. Verification accepts EITHER encoding for a transition window — base64url-shaped sig values decode as base64url; hex-shaped values decode as hex. Smoke 8478 / wiki e2e 178 / Linux container smoke 8478 / Linux container wiki e2e 178 / eslint clean / api-snapshot baseline refreshed.
 
 - **0.7.20** (2026-05-05) — browser-hardening batch (5 fixes): CSRF Origin/Referer cross-check, default CSP gains Trusted Types, expanded Permissions-Policy, `__Host-` / `__Secure-` cookie prefix invariants, `b.middleware.fetchMetadata`. **CSRF Origin/Referer cross-check** (`b.middleware.csrfProtect`) — second-line defense alongside the double-submit token. State-changing requests whose Origin (or Referer when Origin is absent) doesn't resolve to the request's own origin are refused before the token check. Defaults ON; operator opt-out via `checkOrigin: false`; operator allowlist via `allowedOrigins: ["https://app.example.com"]`. Missing-Origin-AND-Missing-Referer (curl, server-to-server) defers to the token check. **Trusted Types in default CSP** (`b.middleware.securityHeaders`) — default CSP now includes `require-trusted-types-for 'script'; trusted-types 'allow-duplicates' default;`. Compatible browsers (Chrome 83+, Edge 83+) enforce typed-value DOM-sink writes (defends every untrusted-string-to-DOM XSS vector at runtime); Firefox + Safari ignore (no regression). Operators opt out by passing an explicit `csp:` value. **Expanded Permissions-Policy** — defaults now disable `browsing-topics=()`, `attribution-reporting=()`, `unload=()`, `interest-cohort=()`, `join-ad-interest-group=()`, `run-ad-auction=()`, `private-state-token-issuance=()`, `private-state-token-redemption=()`, `compute-pressure=()`, `hid=()`, `serial=()`, `idle-detection=()` — closes advertising / tracking / load-event-leak / device-API surfaces. Existing operator overrides via `permissionsPolicy: "..."` continue unchanged. **`__Host-` / `__Secure-` cookie prefix invariants** (`b.cookies.serialize`) — RFC 6265bis §4.1.3 enforced at serialize time. `__Secure-*` requires `secure: true`; `__Host-*` requires `secure: true` AND `path: "/"` AND no `domain:`. Each violation throws a typed `CookieError` with operator-actionable code (`cookies/prefix-secure-required`, `cookies/prefix-host-secure-required`, `cookies/prefix-host-path-required`, `cookies/prefix-host-no-domain`) instead of producing a malformed cookie that browsers silently reject. **`b.middleware.fetchMetadata`** — new fetch-metadata isolation primitive. Reads `Sec-Fetch-Site` / `Sec-Fetch-Mode` / `Sec-Fetch-Dest` and refuses cross-site state-changing requests by default. Operators opt in to specific destinations (e.g. `allowedDest: ["empty", "document"]`) or specific origins (`allowCrossSite: true`). Direct navigations (typed URL / bookmark — `Sec-Fetch-Site: none`) pass through; `same-origin` always passes; `same-site` configurable. Missing fetch-metadata (legacy browsers, server-to-server) deferred to other auth/CSRF layers per `allowMissing: true` default. Smoke 8481 / wiki e2e 178 / Linux container smoke 8481 / Linux container wiki e2e 178 / eslint clean / api-snapshot baseline refreshed.

package/README.md

@@ -46,7 +46,7 @@ The framework bundles the surface a typical Node app reaches for. Every primitiv
 - **Crypto** — envelope-versioned PQC at rest (ML-KEM-1024 + P-384 hybrid, XChaCha20-Poly1305, SHAKE256), vault sealing, field-level crypto + cryptographic erasure (`b.cryptoField.eraseRow`), signed webhooks (SLH-DSA-SHAKE-256f), ECIES API encryption (`b.crypto`, `b.vault`, `b.webhook`); pure-JS mTLS CA that issues clientAuth / serverAuth / dual-EKU certs with SAN entries and auto-detects the highest-PQC signature algorithm the vendored x509 library accepts (today: ECDSA-P384-SHA384 bridge; self-upgrades to SLH-DSA / ML-DSA when the X.509 ecosystem catches up), PQC TLS gates inbound + outbound (`b.mtlsCa`, `b.pqcGate`, `b.pqcAgent`).
 - **HTTP** — router with schema-validated routes + OpenAPI publication; full middleware stack (CSRF, CORS, rate-limit, security headers, CSP nonce, body parser, compression, SSE, request log, request-time DB role binding via `b.middleware.dbRoleFor`, in-process CIDR fence via `b.middleware.networkAllowlist`) wired by `createApp`; HTTP/1.1 + HTTP/2 outbound client with SSRF gate (cloud-metadata IPs hard-denied unconditionally; private / loopback / link-local overridable per call), scheme + userinfo + per-host (wildcard / per-method) destination allowlist, redirects, multipart, interceptors, progress, encrypted cookie jar (`b.httpClient`, `b.ssrfGuard`, `b.safeUrl`); operator-tunable network configurability — env-driven NTP / NTS (RFC 8915 authenticated time), IPv4-or-IPv6 NTP servers, DNS with IPv6 / DoH / DoT (private-CA trust pinning via `opts.ca`) / cache / lookup timeout, outbound HTTP proxy (`HTTP_PROXY` / `HTTPS_PROXY` / `NO_PROXY`), runtime DPI trust-store CA additions, application-level heartbeats, TCP socket defaults (`b.network`).
 - **Defensive parsers** — `b.safeJson`, `b.safeBuffer`, `b.safeSql`, `b.safeSchema`, `b.parsers` (XML / TOML / YAML / .env), `b.config` (schema-validated env), `b.fileType` magic-byte content classification with deny-on-upload categories (image / document / archive / executable / etc.).
-- **Content-safety gates** — `b.gateContract` uniform composition contract (mode posture / hooks / forensic snapshot / decision cache / runtime cap). Family members: `b.guardCsv` (formula injection ASCII + full-width prefixes, dangerous-function denylist, bidi / homoglyph / control / null / BOM / zero-width detection, dialect ambiguity, CSV-bombs, numeric precision, schema-bound serializer); `b.guardHtml` (XSS / mXSS / DOM-clobbering / dangerous-tag / event-handler-family / dangerous-URL-scheme with entity-decode / CSS-injection in style attribute / IE conditional comments + token-level sanitize + always-correct `escapeText` / `escapeAttr` entity encoders); `b.guardSvg` (script / foreignObject / animation-element href hijack / DOCTYPE billion-laughs / XXE / SVGZ / cross-origin `<use>` SSRF / event-handlers + token-level sanitize). `b.guardArchive` (zip-slip / symlink + hardlink escape / decompression-ratio bombs (per-entry + aggregate) / nested-archive depth / duplicate-entry / case-insensitive collision / encryption-claim mismatch / format-claim mismatch via magic-byte detection — composes `b.guardFilename` for per-entry-name validation); `b.guardJson` (source-level prototype-pollution detection, duplicate-key, NaN/Infinity, JSON5 syntax, BOM, bidi, numeric-precision-loss, top-level-key allowlist, depth/breadth/array/string/node-count caps); `b.guardYaml` (deserialization-tag RCE via language-specific tag prefixes, billion-laughs alias recursion, Norway-problem implicit booleans, leading-zero octals, multi-document streams, duplicate keys, merge-key chains, depth+anchor+node caps); `b.guardXml` (XXE / billion-laughs / external-entity / parameter-entity / XInclude / xsi:schemaLocation / processing-instruction / CDATA / XML-signature-wrapping detection — DOCTYPE refused at all profile levels); `b.guardMarkdown` (source-level scan run BEFORE any markdown renderer sees the input — dangerous URL schemes in inline links + images + autolinks + reference-link definitions with HTML-entity decode bypass; whitespace-tolerant dangerous-tag matching per CVE-2026-30838; front-matter; HTML comments; code-fence language injection; catastrophic emphasis-run ReDoS per CVE-2025-6493 class; inline DOCTYPE; depth + link + image + autolink + ref-def caps); `b.guardEmail` (single-address + full RFC 822/5322 message validation — SMTP smuggling per CVE-2023-51764 / 51765 / 51766 / CVE-2026-32178 class via bare-CR + bare-LF + smuggled SMTP verbs; CRLF header injection; IDN homograph mixed-script domains with operator-opt-in `allowedScripts`; Punycode flag; display-name spoofing; IP-literal addresses; RFC 5322 comment syntax; multi-@; RFC 5321 length caps + RFC 5322 line cap; BOM injection). Filename safety: `b.guardFilename` (path traversal raw + percent-encoded + overlong-UTF-8 + null-byte truncation + Windows reserved names + NTFS ADS + RTLO bidi spoofing + shell-exec / double-extension detection — standalone, wires into `b.fileUpload` via `filenameSafety`). All members ship strict / balanced / permissive profiles plus hipaa / pci-dss / gdpr / soc2-cc7 compliance postures. `b.guardAll` is the registry + aggregator: every shipped guard ON by default; opt-out per guard with audited reason via `exceptFor: { name: { reason } }`. **As of v0.7.12, `b.fileUpload` and `b.staticServe` wire `b.guardAll.byExtension({ profile: "strict" })` automatically + `b.fileUpload` also wires `b.guardFilename.gate({ profile: "strict" })` as `filenameSafety`** — defense-in-depth applied without any explicit operator wiring. Operators opt out per host-primitive via `contentSafety: null` / `filenameSafety: null` (audited at create() with operator-supplied reason).
+- **Content-safety gates** — `b.gateContract` uniform composition contract (mode posture / hooks / forensic snapshot / decision cache / runtime cap). Family members: `b.guardCsv` (formula injection ASCII + full-width prefixes, dangerous-function denylist, bidi / homoglyph / control / null / BOM / zero-width detection, dialect ambiguity, CSV-bombs, numeric precision, schema-bound serializer); `b.guardHtml` (XSS / mXSS / DOM-clobbering / dangerous-tag / event-handler-family / dangerous-URL-scheme with entity-decode / CSS-injection in style attribute / IE conditional comments + token-level sanitize + always-correct `escapeText` / `escapeAttr` entity encoders); `b.guardSvg` (script / foreignObject / animation-element href hijack / DOCTYPE billion-laughs / XXE / SVGZ / cross-origin `<use>` SSRF / event-handlers + token-level sanitize). `b.guardArchive` (zip-slip / symlink + hardlink escape / decompression-ratio bombs (per-entry + aggregate) / nested-archive depth / duplicate-entry / case-insensitive collision / encryption-claim mismatch / format-claim mismatch via magic-byte detection — composes `b.guardFilename` for per-entry-name validation); `b.guardJson` (source-level prototype-pollution detection, duplicate-key, NaN/Infinity, JSON5 syntax, BOM, bidi, numeric-precision-loss, top-level-key allowlist, depth/breadth/array/string/node-count caps); `b.guardYaml` (deserialization-tag RCE via language-specific tag prefixes, billion-laughs alias recursion, Norway-problem implicit booleans, leading-zero octals, multi-document streams, duplicate keys, merge-key chains, depth+anchor+node caps); `b.guardXml` (XXE / billion-laughs / external-entity / parameter-entity / XInclude / xsi:schemaLocation / processing-instruction / CDATA / XML-signature-wrapping detection — DOCTYPE refused at all profile levels); `b.guardMarkdown` (source-level scan run BEFORE any markdown renderer sees the input — dangerous URL schemes in inline links + images + autolinks + reference-link definitions with HTML-entity decode bypass; whitespace-tolerant dangerous-tag matching per CVE-2026-30838; front-matter; HTML comments; code-fence language injection; catastrophic emphasis-run ReDoS per CVE-2025-6493 class; inline DOCTYPE; depth + link + image + autolink + ref-def caps); `b.guardEmail` (single-address + full RFC 822/5322 message validation — SMTP smuggling per CVE-2023-51764 / 51765 / 51766 / CVE-2026-32178 class via bare-CR + bare-LF + smuggled SMTP verbs; CRLF header injection; IDN homograph mixed-script domains with operator-opt-in `allowedScripts`; Punycode flag; display-name spoofing; IP-literal addresses; RFC 5322 comment syntax; multi-@; RFC 5321 length caps + RFC 5322 line cap; BOM injection). Filename safety: `b.guardFilename` (path traversal raw + percent-encoded + overlong-UTF-8 + null-byte truncation + Windows reserved names + NTFS ADS + RTLO bidi spoofing + shell-exec / double-extension detection — standalone, wires into `b.fileUpload` via `filenameSafety`). All members ship strict / balanced / permissive profiles plus hipaa / pci-dss / gdpr / soc2 compliance postures. `b.guardAll` is the registry + aggregator: every shipped guard ON by default; opt-out per guard with audited reason via `exceptFor: { name: { reason } }`. **As of v0.7.12, `b.fileUpload` and `b.staticServe` wire `b.guardAll.byExtension({ profile: "strict" })` automatically + `b.fileUpload` also wires `b.guardFilename.gate({ profile: "strict" })` as `filenameSafety`** — defense-in-depth applied without any explicit operator wiring. Operators opt out per host-primitive via `contentSafety: null` / `filenameSafety: null` (audited at create() with operator-supplied reason).
 - **Communication** — WebSockets with channel/room fan-out across cluster replicas (`b.websocket`, `b.websocketChannels`); generic distributed pub/sub with cluster-table / Redis PUB/SUB / custom backends (`b.pubsub`); mail with multipart + attachments + DKIM + calendar invites + bounce intake (`b.mail`, `b.mailBounce`); generic notification dispatcher with operator-supplied transports (`b.notify`); chunked file uploads with per-chunk SHA3-512 verification + atomic finalize + tombstone cleanup (`b.fileUpload`).
 - **Observability** — tamper-evident audit chain with SLH-DSA-signed checkpoints, metrics, tracing (OTel pass-through when wired), PII redaction, log-stream sinks (local file rotation, generic webhook, OTLP/HTTP-JSON OR OTLP/gRPC to an OTel collector, AWS CloudWatch Logs via SigV4 with optional autoCreate, RFC 5424 syslog over UDP/TCP/TLS), OTLP/HTTP-JSON exporter for traces + metrics (`b.audit`, `b.metrics`, `b.tracing`, `b.redact`, `b.logStream`, `b.otelExport`); operator-callable boot-time security policy assertions (`b.security.assertProduction`) and tamper-evident config-baseline drift detection signed with the audit-signing key (`b.configDrift`).
 - **i18n** — CLDR plural rules, Accept-Language negotiation, Intl formatters, RTL (`b.i18n`).

package/lib/csv.js

@@ -39,7 +39,7 @@
  * `b.guardCsv` — its `serialize` / `validate` / `sanitize` / `gate`
  * surface handles every documented threat with a single profile choice
  * (strict / balanced / permissive / email-attachment) or compliance
- * posture (hipaa / pci-dss / gdpr / soc2-cc7).
+ * posture (hipaa / pci-dss / gdpr / soc2).
  *
  * Throws CsvError (FrameworkError, permanent) on shape violations.
  */

package/lib/guard-all.js

@@ -43,7 +43,7 @@
  *   - PROFILES          — object map; must include the SHARED_PROFILES
  *                         vocabulary (strict / balanced / permissive)
  *   - COMPLIANCE_POSTURES — object map; must include the SHARED_POSTURES
- *                         vocabulary (hipaa / pci-dss / gdpr / soc2-cc7)
+ *                         vocabulary (hipaa / pci-dss / gdpr / soc2)
  *   - gate(opts)        — returns a b.gateContract-shaped gate
  *
  * The parity check at module load throws GuardAllError if a registered
@@ -95,7 +95,7 @@ var STANDALONE_GUARDS = [
 // support. Adding a new shared profile / posture is a coordinated
 // cross-guard change — every member must implement it.
 var SHARED_PROFILES = Object.freeze(["strict", "balanced", "permissive"]);
-var SHARED_POSTURES = Object.freeze(["hipaa", "pci-dss", "gdpr", "soc2-cc7"]);
+var SHARED_POSTURES = Object.freeze(["hipaa", "pci-dss", "gdpr", "soc2"]);
 
 // ---- Registry parity check (runs at module load) ----
 

package/lib/guard-archive.js

@@ -117,7 +117,7 @@
  *   permissive — symlinks + hardlinks within root allowed; nested-depth
  *                4; 100000 entries; 10 GiB total; 1000:1 ratio.
  *
- * Compliance postures: hipaa / pci-dss / gdpr / soc2-cc7 — strict
+ * Compliance postures: hipaa / pci-dss / gdpr / soc2 — strict
  * overlay + forensic snapshots.
  */
 
@@ -248,7 +248,7 @@ var COMPLIANCE_POSTURES = Object.freeze({
   "gdpr": Object.assign({}, PROFILES["balanced"], {
     forensicSnippetBytes: C.BYTES.bytes(128),
   }),
-  "soc2-cc7": Object.assign({}, PROFILES["strict"], {
+  "soc2": Object.assign({}, PROFILES["strict"], {
     forensicSnippetBytes: C.BYTES.bytes(512),
   }),
 });

package/lib/guard-csv.js

@@ -47,7 +47,7 @@
  *     validation.
  *   - Profiles: strict (OWASP-aligned, prefix-tab default per OWASP) /
  *     balanced / permissive / email-attachment.
- *   - Compliance postures: hipaa / pci-dss / gdpr / soc2-cc7.
+ *   - Compliance postures: hipaa / pci-dss / gdpr / soc2.
  *   - Operator extensibility: profile composition, custom rules, hooks
  *     (beforeCheck / afterCheck / onIssue / onSanitize / onRefuse /
  *     onAudit), threat-intel feeds, sandbox isolation, snapshot tests.
@@ -275,7 +275,7 @@ var COMPLIANCE_POSTURES = Object.freeze({
     piiPolicy:              "redact",
     forensicSnippetBytes:   FORENSIC_SNIPPET_GDPR,
   },
-  "soc2-cc7": {
+  "soc2": {
     formulaInjectionPolicy: "prefix-tab",
     bidiCharPolicy:         "reject",
     controlCharPolicy:      "reject",

package/lib/guard-email.js

@@ -265,7 +265,7 @@ var COMPLIANCE_POSTURES = Object.freeze({
   "gdpr": Object.assign({}, PROFILES["balanced"], {
     forensicSnippetBytes: C.BYTES.bytes(128),
   }),
-  "soc2-cc7": Object.assign({}, PROFILES["strict"], {
+  "soc2": Object.assign({}, PROFILES["strict"], {
     forensicSnippetBytes: C.BYTES.bytes(512),
   }),
 });

package/lib/guard-filename.js

@@ -234,7 +234,7 @@ var COMPLIANCE_POSTURES = Object.freeze({
     leadingTrailingPolicy: "strip",
     forensicSnippetBytes: C.BYTES.bytes(128),
   },
-  "soc2-cc7": {
+  "soc2": {
     bidiPolicy: "reject", controlPolicy: "reject", nullBytePolicy: "reject",
     zeroWidthPolicy: "reject", traversalPolicy: "reject",
     reservedCharPolicy: "reject", reservedNamePolicy: "reject",

package/lib/guard-html.js

@@ -351,7 +351,7 @@ var COMPLIANCE_POSTURES = Object.freeze({
     mxssHintPolicy:   "audit",
     forensicSnippetBytes: C.BYTES.bytes(128),
   },
-  "soc2-cc7": {
+  "soc2": {
     allowedTags:      STRICT_ALLOWED_TAGS,
     bidiPolicy:       "reject",
     controlPolicy:    "reject",

package/lib/guard-json.js

@@ -204,7 +204,7 @@ var COMPLIANCE_POSTURES = Object.freeze({
   "gdpr": Object.assign({}, PROFILES["balanced"], {
     forensicSnippetBytes: C.BYTES.bytes(128),
   }),
-  "soc2-cc7": Object.assign({}, PROFILES["strict"], {
+  "soc2": Object.assign({}, PROFILES["strict"], {
     forensicSnippetBytes: C.BYTES.bytes(512),
   }),
 });

package/lib/guard-markdown.js

@@ -213,7 +213,7 @@ var COMPLIANCE_POSTURES = Object.freeze({
   "gdpr": Object.assign({}, PROFILES["balanced"], {
     forensicSnippetBytes: C.BYTES.bytes(128),
   }),
-  "soc2-cc7": Object.assign({}, PROFILES["strict"], {
+  "soc2": Object.assign({}, PROFILES["strict"], {
     forensicSnippetBytes: C.BYTES.bytes(512),
   }),
 });

package/lib/guard-svg.js

@@ -327,7 +327,7 @@ var COMPLIANCE_POSTURES = Object.freeze({
     allowAnimation:     false,
     forensicSnippetBytes: C.BYTES.bytes(128),
   },
-  "soc2-cc7": {
+  "soc2": {
     allowedTags:        STRICT_ALLOWED_TAGS,
     bidiPolicy:         "reject",
     controlPolicy:      "reject",

package/lib/guard-xml.js

@@ -143,7 +143,7 @@ var COMPLIANCE_POSTURES = Object.freeze({
   "gdpr": Object.assign({}, PROFILES["balanced"], {
     forensicSnippetBytes: C.BYTES.bytes(128),
   }),
-  "soc2-cc7": Object.assign({}, PROFILES["strict"], {
+  "soc2": Object.assign({}, PROFILES["strict"], {
     forensicSnippetBytes: C.BYTES.bytes(512),
   }),
 });

package/lib/guard-yaml.js

@@ -183,7 +183,7 @@ var COMPLIANCE_POSTURES = Object.freeze({
   "gdpr": Object.assign({}, PROFILES["balanced"], {
     forensicSnippetBytes: C.BYTES.bytes(128),
   }),
-  "soc2-cc7": Object.assign({}, PROFILES["strict"], {
+  "soc2": Object.assign({}, PROFILES["strict"], {
     forensicSnippetBytes: C.BYTES.bytes(512),
   }),
 });

package/lib/mail-dkim.js

@@ -358,11 +358,62 @@ function create(opts) {
   };
 }
 
+// dualSigner — RFC 8463 §3 transition signer. Produces messages with
+// BOTH a legacy RSA-SHA-256 DKIM-Signature AND an Ed25519-SHA-256
+// DKIM-Signature header. Receivers that don't yet support Ed25519
+// validate the RSA signature; receivers that prefer Ed25519 validate
+// the post-quantum-friendlier signature. The transition pattern is
+// the recommended path for moving the operator's domain off RSA-SHA-
+// 256 without breaking older verifiers.
+//
+//   var dual = b.mail.dkim.dualSigner({
+//     domain: "example.com",
+//     rsa:    { selector: "rsa1",   privateKey: rsaPemKey },
+//     eddsa:  { selector: "eddsa1", privateKey: ed25519PemKey },
+//     // every other create() opt is shared (canonicalization,
+//     // headersToSign, audit) but can be overridden per algorithm.
+//   });
+//   var signed = dual.sign(rfc822Wire);
+//   // → wire with two DKIM-Signature: headers (RSA first, Ed25519 second)
+//
+// Both signers are constructed eagerly at create-time (configuration
+// errors surface at boot, not at first send). The combined sign()
+// applies the RSA signer first, then the Ed25519 signer on top.
+function dualSigner(opts) {
+  if (!opts || !opts.rsa || !opts.eddsa) {
+    throw new DkimError("dkim/dual-signer-missing",
+      "dualSigner requires both opts.rsa and opts.eddsa");
+  }
+  if (!opts.domain) {
+    throw new DkimError("dkim/dual-signer-missing-domain",
+      "dualSigner requires opts.domain");
+  }
+  function _merge(base, alg, override) {
+    return Object.assign({}, base, { algorithm: alg }, override);
+  }
+  var sharedBase = {};
+  var commonKeys = ["domain", "headersToSign", "canonicalization", "audit"];
+  for (var i = 0; i < commonKeys.length; i += 1) {
+    if (opts[commonKeys[i]] !== undefined) sharedBase[commonKeys[i]] = opts[commonKeys[i]];
+  }
+  var rsaSigner   = create(_merge(sharedBase, "rsa-sha256",     opts.rsa));
+  var eddsaSigner = create(_merge(sharedBase, "ed25519-sha256", opts.eddsa));
+  return {
+    sign: function (rfc822) {
+      var afterRsa = rsaSigner.sign(rfc822);
+      return eddsaSigner.sign(afterRsa);
+    },
+    rsa:   rsaSigner,
+    eddsa: eddsaSigner,
+  };
+}
+
 // Test-only exports for unit testing the canonicalization primitives
 // directly without going through a full sign() round.
 module.exports = {
-  create:    create,
-  DkimError: DkimError,
+  create:      create,
+  dualSigner:  dualSigner,
+  DkimError:   DkimError,
   _canonHeaderRelaxedForTest: _canonHeaderRelaxed,
   _canonBodyRelaxedForTest:   _canonBodyRelaxed,
   _canonBodySimpleForTest:    _canonBodySimple,

package/lib/network-dns.js

@@ -24,6 +24,7 @@ var IPV6_HEX_GROUPS  = C.BYTES.bytes(8);    // IPv6 16-bit hex groups
 var HEX_RADIX        = C.BYTES.bytes(16);   // parseInt / toString radix-16
 
 var observability = lazyRequire(function () { return require("./observability"); });
+var safeEnv = require("./parsers/safe-env");
 
 var STATE = {
   servers:        null,
@@ -34,8 +35,51 @@ var STATE = {
   cacheNegativeTtlMs: 0,
   doh:            null,
   dot:            null,
+  // Default-on secure DNS (DoH via Cloudflare) when neither doh nor dot
+  // is operator-configured AND no opt-out env var is set. Operators
+  // who explicitly want the system resolver call useSystemResolver()
+  // or set BLAMEJS_DNS_TRANSPORT=system. Default-on per Core Rule §3
+  // ("security defaults are not opt-in").
+  systemResolver: false,
 };
 
+// Default DoH provider when nothing is configured. Cloudflare's
+// 1.1.1.1 service is privacy-respecting, free, and global.
+var DEFAULT_DOH_URL = "https://cloudflare-dns.com/dns-query";
+
+// RFC 6761 + RFC 6762 + operator-internal special-form host names that
+// public DoH/DoT providers don't resolve. Local lookups for these names
+// route through node:dns which honours /etc/hosts + LDH locally.
+var LOCAL_SUFFIXES = [".localhost", ".local", ".test", ".invalid",
+                      ".internal", ".intranet", ".lan", ".home", ".corp"];
+function _isLocalFormHost(host) {
+  if (typeof host !== "string" || host.length === 0) return true;
+  if (host === "localhost") return true;
+  // IP literal — skip DNS resolution entirely (caller passes through).
+  if (net.isIP(host)) return true;
+  var lc = host.toLowerCase();
+  for (var i = 0; i < LOCAL_SUFFIXES.length; i += 1) {
+    if (lc.length > LOCAL_SUFFIXES[i].length &&
+        lc.slice(-LOCAL_SUFFIXES[i].length) === LOCAL_SUFFIXES[i]) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function _ensureSecureDefault() {
+  if (STATE.doh || STATE.dot || STATE.systemResolver) return;
+  var override = safeEnv.readVar("BLAMEJS_DNS_TRANSPORT");
+  if (override === "system") { STATE.systemResolver = true; return; }
+  if (override === "dot") {
+    // Cloudflare 1.1.1.1 over TLS, port 853.
+    STATE.dot = { host: "1.1.1.1", port: 853, servername: "1.1.1.1", ca: null };  // allow:raw-byte-literal — IANA-assigned DoT port
+    return;
+  }
+  // Default: DoH via Cloudflare.
+  STATE.doh = { url: DEFAULT_DOH_URL, method: null, ca: null };
+}
+
 var POSITIVE_CACHE = new Map();
 var NEGATIVE_CACHE = new Map();
 
@@ -144,6 +188,20 @@ function setCacheTtlMs(ms, negativeMs) {
   if (ms === 0) _clearCache();
 }
 
+// Operator opt-out from the default-on secure DNS. After calling this,
+// every lookup routes through node:dns (the OS resolver). Equivalent
+// to setting BLAMEJS_DNS_TRANSPORT=system. Operators on internal-DNS
+// deployments (split-horizon, custom resolver appliances) need this
+// to keep their hostnames resolving locally.
+function useSystemResolver() {
+  STATE.doh = null;
+  STATE.dot = null;
+  STATE.systemResolver = true;
+  _resetDotPool();
+  _clearCache();
+  _emitObs("network.dns.system_resolver.set", {});
+}
+
 function useDnsOverHttps(opts) {
   opts = opts || {};
   validateOpts(opts, ["provider", "url", "method", "ca"], "dns.useDnsOverHttps");
@@ -514,15 +572,27 @@ async function lookup(host, opts) {
   }
   _emitObs("network.dns.lookup.requested", { family: cacheKey });
   var startMs = _now();
+  // Resolve secure-DNS default on first use. Idempotent.
+  _ensureSecureDefault();
+
+  // Special-form hostnames per RFC 6761 (localhost / .test / .invalid /
+  // .localhost) and operator-internal suffixes never hit DoH/DoT —
+  // public DoH providers don't resolve these. Route through node:dns
+  // (which checks /etc/hosts and the OS resolver). This keeps tests +
+  // dev workflows working while public-internet resolution still goes
+  // through the secure transport.
+  var isLocalForm = _isLocalFormHost(host);
+
   try {
     var addrs;
-    if (STATE.doh) {
+    if (STATE.doh && !isLocalForm) {
       addrs = await _dualStack(_dohLookup, host, family);
-    } else if (STATE.dot) {
+    } else if (STATE.dot && !isLocalForm) {
       addrs = await _dualStack(_dotLookup, host, family);
     } else {
+      // System resolver (operator explicit opt-out via useSystemResolver).
       var nodeOpts = { all: true };
-      if (family === 4 || family === 6) nodeOpts.family = family;
+      if (family === 4 || family === 6) nodeOpts.family = family;                // allow:raw-byte-literal — IPv4/IPv6 family literals
       addrs = await _withTimeout(dnsPromises.lookup(host, nodeOpts), STATE.lookupTimeoutMs, host);
       if (!Array.isArray(addrs)) addrs = [addrs];
     }
@@ -606,7 +676,7 @@ function _stateForTest() { return STATE; }
 function _resetForTest() {
   STATE.servers = null; STATE.resultOrder = null; STATE.family = 0;
   STATE.lookupTimeoutMs = 0; STATE.cacheTtlMs = 0; STATE.cacheNegativeTtlMs = 0;
-  STATE.doh = null; STATE.dot = null;
+  STATE.doh = null; STATE.dot = null; STATE.systemResolver = false;
   _clearCache();
   _resetDotPool();
 }
@@ -620,6 +690,7 @@ module.exports = {
   setCacheTtlMs:     setCacheTtlMs,
   useDnsOverHttps:   useDnsOverHttps,
   useDnsOverTls:     useDnsOverTls,
+  useSystemResolver: useSystemResolver,
   lookup:            lookup,
   resolve4:          resolve4,
   resolve6:          resolve6,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.7.21",
+  "version": "0.7.23",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cyclonedx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:e04975c4-d3d5-4299-aad3-3e7d44ea1d43",
+  "serialNumber": "urn:uuid:2ed35351-9ec7-4e19-9471-f35604ba988a",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-05T06:06:29.999Z",
+    "timestamp": "2026-05-05T06:39:17.238Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.7.21",
+      "bom-ref": "@blamejs/core@0.7.23",
       "type": "library",
       "name": "blamejs",
-      "version": "0.7.21",
+      "version": "0.7.23",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.7.21",
+      "purl": "pkg:npm/%40blamejs/core@0.7.23",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.7.21",
+      "ref": "@blamejs/core@0.7.23",
       "dependsOn": []
     }
   ]