@blamejs/core 0.7.22 → 0.7.24

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.7.x
 
+- **0.7.24** (2026-05-05) — `b.retention.complianceFloor` accessor for regulatory minimum-retention windows. **Surface**: `b.retention.complianceFloor(posture, candidateTtlMs?)` returns the effective TTL that meets-or-exceeds the regulatory floor; throws `retention/unknown-posture` on unknown names. **`b.retention.COMPLIANCE_RETENTION_FLOOR_MS`** exposes the per-posture minimums for compliance audit visibility: `pci-dss` 365 days (PCI-DSS Req 10.7.1), `hipaa` 6 years (45 CFR §164.316(b)(2)), `sox` 7 years (Sarbanes-Oxley §802), `soc2` 1 year, `dora` 5 years (DORA Article 17). When `candidateTtlMs` exceeds the floor it wins; when it's below, the floor takes over. Smoke 8488 / wiki e2e 178 / Linux container smoke 8488 / Linux container wiki e2e 178 / eslint clean / api-snapshot baseline refreshed.
+
+- **0.7.23** (2026-05-05) — DNS-over-HTTPS default-on. **Default-on DoH for outbound DNS** — `lib/network-dns.js` now uses Cloudflare DoH (`https://cloudflare-dns.com/dns-query`) for hostname resolution by default when neither `useDnsOverHttps()` nor `useDnsOverTls()` has been called explicitly. Privacy-respecting (encrypted DNS over TLS to a non-ISP resolver), aligned with Core Rule §3 ("security defaults are not opt-in"). **Local-form hosts route through node:dns** — RFC 6761 / 6762 special-form names (`localhost`, `*.localhost`, `*.local`, `*.test`, `*.invalid`, `*.internal`, `*.intranet`, `*.lan`, `*.home`, `*.corp`) AND IP literals skip DoH and use node:dns directly so `/etc/hosts` lookups + dev workflows continue to resolve correctly. **Operator opt-out via `b.network.dns.useSystemResolver()`** — split-horizon / internal-DNS deployments call this once at boot and every lookup routes through the OS resolver thereafter. **Env override `BLAMEJS_DNS_TRANSPORT`** — operators set `system` (force OS resolver), `dot` (force Cloudflare DNS-over-TLS at 1.1.1.1:853), or leave unset (default DoH). Smoke 8478 / wiki e2e 178 / Linux container smoke 8478 / Linux container wiki e2e 178 / eslint clean / api-snapshot baseline refreshed.
+
 - **0.7.22** (2026-05-05) — DKIM dual-signer + soc2-cc7 → soc2 posture rename. **`b.mail.dkim.dualSigner`** — RFC 8463 §3 transition signer that produces messages with BOTH a legacy RSA-SHA-256 DKIM-Signature AND an Ed25519-SHA-256 DKIM-Signature header. Receivers without Ed25519 support validate the RSA signature; receivers that prefer Ed25519 validate the post-quantum-friendlier signature. Operators rolling off RSA-SHA-256 wire `b.mail.dkim.dualSigner({ domain, rsa: { selector, privateKey }, eddsa: { selector, privateKey } })` and pass the result anywhere a regular DKIM signer is accepted; `sign()` produces a wire with two `DKIM-Signature` headers. Both signers are constructed eagerly at create-time (configuration errors surface at boot, not at first send). **soc2-cc7 → soc2 posture rename** — every guard's compliance posture name changes from `"soc2-cc7"` to `"soc2"`. The CC7-specific scoping was misleading (SOC 2 controls span CC1–CC9; the existing posture wasn't CC7-specific). Operators with `compliancePosture: "soc2-cc7"` MUST update to `compliancePosture: "soc2"` — the old name now throws `unknown compliance posture`. Smoke 8478 / wiki e2e 178 / Linux container smoke 8478 / Linux container wiki e2e 178 / eslint clean / api-snapshot baseline refreshed.
 
 - **0.7.21** (2026-05-05) — small primitive batch (5 fixes): TLS 1.3 framework-wide minimum, `b.safeRedirect`, `b.pick`, audit-sign legacy compat-shim removed, webhook PQC signatures emit base64url. **Framework-wide TLS 1.3 minimum** — `index.js` sets `tls.DEFAULT_MIN_VERSION = "TLSv1.3"` once at boot, before any framework module loads `node:tls`. Applies to every TLS socket (outbound `https.request` / mail SMTP+STARTTLS / Redis-Postgres-Mongo TLS / `b.httpClient`, AND inbound `https.createServer` when blamejs is the listener). Per-call override still works for legacy peers. **`b.safeRedirect`** — open-redirect (CWE-601) defense. `b.safeRedirect.resolve(rawTarget, { allowedOrigins, allowedHosts, fallback })` returns the safe URL (or fallback). Refuses protocol-relative (`//attacker.com`), backslash variants (`\\\\attacker.com`), control-char-laden (CRLF header injection), and `data:` / `javascript:` schemes; same-origin paths (`/dashboard`) and fragments (`#x`) pass through; full URLs require explicit allowlist. Operator drops the result straight into `res.writeHead(302, { Location: ... })`. **`b.pick`** — mass-assignment (CWE-915 / OWASP API3:2023) defense. `b.pick(req.body, ["a", "b", ["nested", ["sub1"]]])` returns a NEW object with only allowlisted keys; prototype-pollution keys (`__proto__` / `constructor` / `prototype`) ALWAYS stripped even if listed. `opts.onUnknown: "throw"` rejects unknown keys instead of silently dropping. Nested allowlist syntax for object-shaped fields. **Audit-sign legacy compat-shim removed** — `lib/audit-sign.js` no longer falls back to `ml-dsa-87` for key files missing the `algorithm` field. Throws `KEY_FILE_MISSING_ALG` / `UNWRAPPED_MISSING_ALG` at load time; operators with legacy files rotate the key (deletes + regenerates) or hand-edit to add `"algorithm": "slh-dsa-shake-256f"`. Pre-v1 compat-shim sweep per the no-pre-v1-compat rule. **Webhook PQC signatures emit base64url** — `b.webhook` now signs to base64url (was hex). SLH-DSA-SHAKE-256f signatures are ~29.5 KB binary → ~40 KB base64url vs ~59 KB hex; the hex form blew past nginx default 8 KB / Cloudflare default 16 KB / many CDN edge limits. Verification accepts EITHER encoding for a transition window — base64url-shaped sig values decode as base64url; hex-shaped values decode as hex. Smoke 8478 / wiki e2e 178 / Linux container smoke 8478 / Linux container wiki e2e 178 / eslint clean / api-snapshot baseline refreshed.

package/lib/network-dns.js

@@ -24,6 +24,7 @@ var IPV6_HEX_GROUPS  = C.BYTES.bytes(8);    // IPv6 16-bit hex groups
 var HEX_RADIX        = C.BYTES.bytes(16);   // parseInt / toString radix-16
 
 var observability = lazyRequire(function () { return require("./observability"); });
+var safeEnv = require("./parsers/safe-env");
 
 var STATE = {
   servers:        null,
@@ -34,8 +35,51 @@ var STATE = {
   cacheNegativeTtlMs: 0,
   doh:            null,
   dot:            null,
+  // Default-on secure DNS (DoH via Cloudflare) when neither doh nor dot
+  // is operator-configured AND no opt-out env var is set. Operators
+  // who explicitly want the system resolver call useSystemResolver()
+  // or set BLAMEJS_DNS_TRANSPORT=system. Default-on per Core Rule §3
+  // ("security defaults are not opt-in").
+  systemResolver: false,
 };
 
+// Default DoH provider when nothing is configured. Cloudflare's
+// 1.1.1.1 service is privacy-respecting, free, and global.
+var DEFAULT_DOH_URL = "https://cloudflare-dns.com/dns-query";
+
+// RFC 6761 + RFC 6762 + operator-internal special-form host names that
+// public DoH/DoT providers don't resolve. Local lookups for these names
+// route through node:dns which honours /etc/hosts + LDH locally.
+var LOCAL_SUFFIXES = [".localhost", ".local", ".test", ".invalid",
+                      ".internal", ".intranet", ".lan", ".home", ".corp"];
+function _isLocalFormHost(host) {
+  if (typeof host !== "string" || host.length === 0) return true;
+  if (host === "localhost") return true;
+  // IP literal — skip DNS resolution entirely (caller passes through).
+  if (net.isIP(host)) return true;
+  var lc = host.toLowerCase();
+  for (var i = 0; i < LOCAL_SUFFIXES.length; i += 1) {
+    if (lc.length > LOCAL_SUFFIXES[i].length &&
+        lc.slice(-LOCAL_SUFFIXES[i].length) === LOCAL_SUFFIXES[i]) {
+      return true;
+    }
+  }
+  return false;
+}
+
+function _ensureSecureDefault() {
+  if (STATE.doh || STATE.dot || STATE.systemResolver) return;
+  var override = safeEnv.readVar("BLAMEJS_DNS_TRANSPORT");
+  if (override === "system") { STATE.systemResolver = true; return; }
+  if (override === "dot") {
+    // Cloudflare 1.1.1.1 over TLS, port 853.
+    STATE.dot = { host: "1.1.1.1", port: 853, servername: "1.1.1.1", ca: null };  // allow:raw-byte-literal — IANA-assigned DoT port
+    return;
+  }
+  // Default: DoH via Cloudflare.
+  STATE.doh = { url: DEFAULT_DOH_URL, method: null, ca: null };
+}
+
 var POSITIVE_CACHE = new Map();
 var NEGATIVE_CACHE = new Map();
 
@@ -144,6 +188,20 @@ function setCacheTtlMs(ms, negativeMs) {
   if (ms === 0) _clearCache();
 }
 
+// Operator opt-out from the default-on secure DNS. After calling this,
+// every lookup routes through node:dns (the OS resolver). Equivalent
+// to setting BLAMEJS_DNS_TRANSPORT=system. Operators on internal-DNS
+// deployments (split-horizon, custom resolver appliances) need this
+// to keep their hostnames resolving locally.
+function useSystemResolver() {
+  STATE.doh = null;
+  STATE.dot = null;
+  STATE.systemResolver = true;
+  _resetDotPool();
+  _clearCache();
+  _emitObs("network.dns.system_resolver.set", {});
+}
+
 function useDnsOverHttps(opts) {
   opts = opts || {};
   validateOpts(opts, ["provider", "url", "method", "ca"], "dns.useDnsOverHttps");
@@ -514,15 +572,27 @@ async function lookup(host, opts) {
   }
   _emitObs("network.dns.lookup.requested", { family: cacheKey });
   var startMs = _now();
+  // Resolve secure-DNS default on first use. Idempotent.
+  _ensureSecureDefault();
+
+  // Special-form hostnames per RFC 6761 (localhost / .test / .invalid /
+  // .localhost) and operator-internal suffixes never hit DoH/DoT —
+  // public DoH providers don't resolve these. Route through node:dns
+  // (which checks /etc/hosts and the OS resolver). This keeps tests +
+  // dev workflows working while public-internet resolution still goes
+  // through the secure transport.
+  var isLocalForm = _isLocalFormHost(host);
+
   try {
     var addrs;
-    if (STATE.doh) {
+    if (STATE.doh && !isLocalForm) {
       addrs = await _dualStack(_dohLookup, host, family);
-    } else if (STATE.dot) {
+    } else if (STATE.dot && !isLocalForm) {
       addrs = await _dualStack(_dotLookup, host, family);
     } else {
+      // System resolver (operator explicit opt-out via useSystemResolver).
       var nodeOpts = { all: true };
-      if (family === 4 || family === 6) nodeOpts.family = family;
+      if (family === 4 || family === 6) nodeOpts.family = family;                // allow:raw-byte-literal — IPv4/IPv6 family literals
       addrs = await _withTimeout(dnsPromises.lookup(host, nodeOpts), STATE.lookupTimeoutMs, host);
       if (!Array.isArray(addrs)) addrs = [addrs];
     }
@@ -606,7 +676,7 @@ function _stateForTest() { return STATE; }
 function _resetForTest() {
   STATE.servers = null; STATE.resultOrder = null; STATE.family = 0;
   STATE.lookupTimeoutMs = 0; STATE.cacheTtlMs = 0; STATE.cacheNegativeTtlMs = 0;
-  STATE.doh = null; STATE.dot = null;
+  STATE.doh = null; STATE.dot = null; STATE.systemResolver = false;
   _clearCache();
   _resetDotPool();
 }
@@ -620,6 +690,7 @@ module.exports = {
   setCacheTtlMs:     setCacheTtlMs,
   useDnsOverHttps:   useDnsOverHttps,
   useDnsOverTls:     useDnsOverTls,
+  useSystemResolver: useSystemResolver,
   lookup:            lookup,
   resolve4:          resolve4,
   resolve6:          resolve6,

package/lib/retention.js

@@ -55,6 +55,7 @@
  * write. This is the escape hatch; the table+ageField+ttlMs shape
  * covers the common case.
  */
+var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
@@ -433,7 +434,47 @@ function create(opts) {
   return { declare: declare, run: run, runAll: runAll, preview: preview, list: list };
 }
 
+// Audit-log retention floors per regulatory posture. These are the
+// MINIMUMS — operators may declare longer windows but cannot declare
+// shorter ones. Operator-facing helper for compliance audit.
+//
+//   PCI-DSS Requirement 10.7.1   — 12 months online (active accessible)
+//   HIPAA 45 CFR §164.316(b)(2)  — 6 years from creation
+//   SOX (Sarbanes-Oxley) §802     — 7 years for audit-relevant records
+//   GDPR Art. 5(1)(e)             — no fixed minimum; operator declares
+//   SOC 2 (CC1–CC9)              — 1 year typical; auditor-driven
+//   DORA Art. 17 (incident logs) — 5 years
+var COMPLIANCE_RETENTION_FLOOR_MS = Object.freeze({
+  "pci-dss":  C.TIME.days(365),       // 12 months
+  "hipaa":    C.TIME.days(365 * 6),   // 6 years
+  "sox":      C.TIME.days(365 * 7),   // 7 years
+  "soc2":     C.TIME.days(365),       // 1 year
+  "dora":     C.TIME.days(365 * 5),   // 5 years (Article 17 incident logs)
+});
+
+// Operator passes a posture name + a candidate ttlMs; returns the
+// effective ttl that meets-or-exceeds the floor. Throws if posture is
+// unknown so typos surface at config time.
+function complianceFloor(posture, candidateTtlMs) {
+  if (typeof posture !== "string") {
+    throw new RetentionError("retention/bad-posture",
+      "complianceFloor: posture must be a string, got " + JSON.stringify(posture));
+  }
+  var floor = COMPLIANCE_RETENTION_FLOOR_MS[posture];
+  if (floor === undefined) {
+    throw new RetentionError("retention/unknown-posture",
+      "complianceFloor: unknown posture '" + posture + "'; expected one of " +
+      Object.keys(COMPLIANCE_RETENTION_FLOOR_MS).join(", "));
+  }
+  if (typeof candidateTtlMs !== "number" || !isFinite(candidateTtlMs) || candidateTtlMs <= 0) {
+    return floor;
+  }
+  return candidateTtlMs > floor ? candidateTtlMs : floor;
+}
+
 module.exports = {
-  create:         create,
-  RetentionError: RetentionError,
+  create:                         create,
+  complianceFloor:                complianceFloor,
+  COMPLIANCE_RETENTION_FLOOR_MS:  COMPLIANCE_RETENTION_FLOOR_MS,
+  RetentionError:                 RetentionError,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.7.22",
+  "version": "0.7.24",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cyclonedx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:30b4f7c6-d648-478a-aa77-dbbfb61c7951",
+  "serialNumber": "urn:uuid:942606f7-1484-4ac3-9332-63f73e25256f",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-05-05T06:18:09.475Z",
+    "timestamp": "2026-05-05T06:51:47.053Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.7.22",
+      "bom-ref": "@blamejs/core@0.7.24",
       "type": "library",
       "name": "blamejs",
-      "version": "0.7.22",
+      "version": "0.7.24",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.7.22",
+      "purl": "pkg:npm/%40blamejs/core@0.7.24",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.7.22",
+      "ref": "@blamejs/core@0.7.24",
       "dependsOn": []
     }
   ]