@blamejs/core 0.15.12 → 0.15.14

package/lib/webhook.js

@@ -48,6 +48,7 @@
  */
 
 var nodeCrypto = require("node:crypto");
+var numericBounds = require("./numeric-bounds");
 var bCrypto = require("./crypto");
 var httpClient = require("./http-client");
 var safeBuffer = require("./safe-buffer");
@@ -57,8 +58,14 @@ var C = require("./constants");
 var lazyRequire = require("./lazy-require");
 var numericChecks = require("./numeric-checks");
 var requestHelpers = require("./request-helpers");
+// Lazy — ssrf-guard pulls in the DNS/network stack; only touched on send().
+var ssrfGuard = lazyRequire(function () { return require("./ssrf-guard"); });
 var validateOpts = require("./validate-opts");
 var { WebhookError } = require("./framework-error");
+// b.webhook.dispatcher — durable signed-webhook delivery store. Lives in its
+// own module (distinct domain: persistence) and lazyRequires this file back,
+// so this top-level require is cycle-safe.
+var webhookDispatcher = require("./webhook-dispatcher");
 
 var observability = lazyRequire(function () { return require("./observability"); });
 
@@ -424,6 +431,18 @@ function signer(opts) {
       allowedProtocols: httpOpts.allowedProtocols || safeUrl.ALLOW_HTTP_TLS,
       errorClass:       WebhookError,
     });
+    // SSRF gate at the webhook layer: refuse private / loopback / link-local /
+    // cloud-metadata destinations up front, before the retry loop. httpClient
+    // also enforces this on every request, but checking here fails fast (no
+    // wasted retries) and keeps the SSRF boundary explicit at the send() API
+    // rather than relying on the transport's internal gate. allowInternal
+    // mirrors the operator's http opts (its affirmative waiver).
+    try {
+      await ssrfGuard().checkUrl(url, { allowInternal: httpOpts.allowInternal === true });
+    } catch (e) {
+      if (e && e.isSsrfError) throw _err("SSRF_REFUSED", "webhook.signer.send: " + e.message);
+      throw e;
+    }
     _validateBody(body);
     var signed = sign(body, { kid: input.kid });
     var mergedHeaders = Object.assign({}, input.headers || {}, signed.headers);
@@ -641,7 +660,7 @@ function verifier(opts) {
       throw _failure("MISSING_TIMESTAMP", "webhook: t= field missing from signature header", "missing-timestamp", ctxReq);
     }
     var ts = Number(parsed.t);
-    if (!isFinite(ts) || ts < 0 || Math.floor(ts) !== ts) {
+    if (!numericBounds.isNonNegativeFiniteInt(ts)) {
       throw _failure("BAD_TIMESTAMP", "webhook: t= field is not a non-negative integer, got " + JSON.stringify(parsed.t), "bad-timestamp", ctxReq);
     }
     if (parsed.id === null || parsed.id.length === 0) {
@@ -832,16 +851,28 @@ function _coerceBodyString(body) {
  * HMAC-SHA-256 over the literal `<t>.<rawBody>` string using the
  * operator's `whsec_...` secret bytes verbatim (the prefix IS the key).
  * Refuses signatures older than the tolerance window (default 5 min,
- * minimum 30 s). When `nonceStore` is supplied the verifier records
- * the accepted v1 signature so a replay within the tolerance window
- * is refused. Constant-time compare via `b.crypto.timingSafeEqual`.
+ * minimum 30 s). When `nonceStore` is supplied the verifier atomically
+ * records the accepted v1 signature so a replay within the tolerance window
+ * is refused; the store speaks the same `checkAndInsert(nonce, expireAt) →
+ * bool` contract as `b.webhook.verifier` and `b.nonceStore.create`, so the
+ * framework's own replay store plugs in directly and concurrent redeliveries
+ * cannot race. Constant-time compare via `b.crypto.timingSafeEqual`.
+ *
+ * @opts
+ *   alg:        "hmac-sha256-stripe",
+ *   secret:     string | Buffer,                      // whsec_... bytes verbatim
+ *   header:     string,                               // Stripe-Signature value
+ *   body:       string | Buffer,                      // raw request body
+ *   toleranceMs: number,                              // default 5 min, min 30 s
+ *   nonceStore: { checkAndInsert(nonce, expireAt) },  // optional atomic replay defense
  *
  * @example
- *   b.webhook.verify({
- *     alg:    "hmac-sha256-stripe",
- *     secret: "whsec_abc...",
- *     header: req.headers["stripe-signature"],
- *     body:   rawBodyBuffer,
+ *   await b.webhook.verify({
+ *     alg:        "hmac-sha256-stripe",
+ *     secret:     "whsec_abc...",
+ *     header:     req.headers["stripe-signature"],
+ *     body:       rawBodyBuffer,
+ *     nonceStore: b.nonceStore.create({ backend: "memory" }),
  *   });
  *   // → { ok: true, timestamp: 1700000000, scheme: "v1" }
  */
@@ -889,24 +920,30 @@ async function verify(input) {
       "verify: no v1 signature matched HMAC-SHA-256 of <t>.<body>");
   }
 
-  // Optional replay defense — the nonceStore is operator-supplied
-  // (e.g. `b.kv` or a Redis-shaped { has, set, expire }) so the
-  // primitive doesn't own retention. `has` / `set` MAY return a
-  // Promise — we always `await` them so async backends (Redis, KV,
-  // DynamoDB) work without falsely flagging a Promise as truthy.
+  // Optional replay defense — the nonceStore speaks the SAME atomic
+  // `checkAndInsert(nonce, expireAt) → bool` contract as b.webhook.verifier
+  // and b.nonceStore.create, so the framework's own replay store drops in
+  // with no adapter. The check + insert is one atomic step: a non-atomic
+  // check-then-set would race two concurrent redeliveries of the same event
+  // (both observe "unseen", both proceed) — the exact failure replay defense
+  // exists to prevent. checkAndInsert MAY return a Promise (Redis / KV /
+  // cluster SQL); we always await it. `expireAt` is the absolute epoch-ms at
+  // which the signature itself falls outside the tolerance window, so a stored
+  // nonce is retained exactly as long as a replay of it could still be fresh.
   if (input.nonceStore) {
     var ns = input.nonceStore;
-    if (typeof ns.has !== "function" || typeof ns.set !== "function") {
+    if (typeof ns.checkAndInsert !== "function") {
       throw new WebhookError("webhook/bad-nonce-store",
-        "verify: nonceStore must expose { has(key), set(key, ttlMs) }");
+        "verify: nonceStore must expose checkAndInsert(nonce, expireAt) — the " +
+        "b.nonceStore contract shared with b.webhook.verifier");
     }
     var nonceKey = "stripe:" + parsed.timestamp + ":" + expectedHex;
-    var seen = await ns.has(nonceKey);
-    if (seen) {
+    var expireAt = C.TIME.seconds(parsed.timestamp) + tolerance;
+    var fresh = await ns.checkAndInsert(nonceKey, expireAt);
+    if (!fresh) {
       throw new WebhookError("webhook/replay",
         "verify: signature already seen within tolerance window (replay)");
     }
-    await ns.set(nonceKey, tolerance);
   }
 
   return { ok: true, timestamp: parsed.timestamp, scheme: "v1" };
@@ -974,4 +1011,7 @@ module.exports = {
   // v0.11.25 — Stripe-shaped inbound HMAC-SHA-256 verifier + signer.
   verify:         verify,
   sign:           sign,
+  // Durable signed-webhook delivery store (sign + persist + deliver + retry +
+  // dead-letter + operator replay). Defined in lib/webhook-dispatcher.js.
+  dispatcher:     webhookDispatcher.dispatcher,
 };

package/lib/websocket-channels.js

@@ -60,6 +60,7 @@
 
 var lazyRequire = require("./lazy-require");
 var pubsub = require("./pubsub");
+var boundedMap = require("./bounded-map");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -187,17 +188,18 @@ function create(opts) {
     if (typeof channel !== "string" || channel.length === 0) {
       throw _err("INVALID_CHANNEL", "subscribe: channel must be a non-empty string");
     }
-    if (!connToChannels.has(conn)) {
+    boundedMap.requirePresent(connToChannels, conn, function () {
       throw _err("NOT_ATTACHED", "subscribe: connection must be attach()-ed first");
-    }
-    if (!channelToConns.has(channel)) {
-      channelToConns.set(channel, new Set());
+    });
+    var subs = boundedMap.getOrInsert(channelToConns, channel, function () {
       // First local listener for this channel — open a pubsub
-      // subscription so cross-node fan-out reaches us.
+      // subscription so cross-node fan-out reaches us, recording the
+      // token under the same key the new Set is stored at.
       var token = ps.subscribe(channel, _onPubsubMessage);
       channelToToken.set(channel, token);
-    }
-    channelToConns.get(channel).add(conn);
+      return new Set();
+    });
+    subs.add(conn);
     connToChannels.get(conn).add(channel);
   }
 

package/lib/websocket.js

@@ -82,6 +82,7 @@ var C                = require("./constants");
 var requestHelpers   = require("./request-helpers");
 var safeAsync        = require("./safe-async");
 var safeBuffer       = require("./safe-buffer");
+var pick             = require("./pick");
 var structuredFields = require("./structured-fields");
 var { FrameworkError } = require("./framework-error");
 var { boot } = require("./log");
@@ -543,7 +544,7 @@ function _parseExtensionHeader(header) {
       var kv = parts[j].split("=");
       var k = kv[0].trim().toLowerCase();
       if (!k) continue;
-      if (k === "__proto__" || k === "constructor" || k === "prototype") continue;
+      if (pick.isPoisonedKey(k)) continue;
       var v = kv.length > 1 ? kv.slice(1).join("=").trim() : true;
       // Strip surrounding quotes per the token-or-quoted-string grammar.
       if (typeof v === "string") {
@@ -572,7 +573,7 @@ function _negotiatePermessageDeflate(reqHeader) {
       "server_max_window_bits": true,     "client_max_window_bits": true,
     };
     var ok = true;
-    for (var k in p) { if (Object.prototype.hasOwnProperty.call(p, k) && !KNOWN[k]) { ok = false; break; } }
+    for (var k in p) { if (Object.prototype.hasOwnProperty.call(p, k) && !Object.prototype.hasOwnProperty.call(KNOWN, k)) { ok = false; break; } }
     if (!ok) continue;
     // Always negotiate WITH no_context_takeover in BOTH directions, so
     // every message uses a fresh zlib state. Echo any client window-
@@ -1128,7 +1129,7 @@ class WebSocketConnection extends EventEmitter {
         return this._abort(CLOSE_INVALID_PAYLOAD,
           "permessage-deflate inflate failed: " + ((e && e.message) || String(e)));
       }
-      if (data.length > this.maxMessageBytes) {
+      if (safeBuffer.byteLengthOf(data) > this.maxMessageBytes) {
         return this._abort(CLOSE_MESSAGE_TOO_BIG,
           "decompressed message exceeds maxMessageBytes");
       }
@@ -1241,8 +1242,11 @@ class WebSocketConnection extends EventEmitter {
     } else if (Buffer.isBuffer(data)) {
       this._sendDataFrame(OPCODE_BINARY, data);
     } else {
+      // WebSocketError's constructor is (code, message, closeCode) — code
+      // first — so the (message, code) errorClass path would swap the two.
+      // errorFactory hands toBuffer a (code, message) constructor instead.
       data = safeBuffer.toBuffer(data, {
-        errorClass: WebSocketError,
+        errorFactory: function (code, message) { return new WebSocketError(code, message); },
         typeCode:   "ws/invalid-payload",
         typeMessage: "send() requires Buffer, Uint8Array, or string",
       });

package/lib/worm.js

@@ -102,7 +102,7 @@ function create(opts) {
   opts = opts || {};
   validateOpts(opts, ["store", "mode", "defaultRetentionMs", "clock"], "worm.create");
   var mode = opts.mode || "compliance";
-  if (!MODES[mode]) throw new WormError("worm/bad-mode", "worm.create: mode must be 'compliance' or 'governance'");
+  if (!Object.prototype.hasOwnProperty.call(MODES, mode)) throw new WormError("worm/bad-mode", "worm.create: mode must be 'compliance' or 'governance'");
   var store = opts.store || _memStore();
   ["get", "set", "delete", "has", "keys"].forEach(function (m) {
     if (typeof store[m] !== "function") throw new WormError("worm/bad-store", "worm.create: store adapter must implement " + m + "()");
@@ -113,10 +113,9 @@ function create(opts) {
     throw new WormError("worm/bad-opt", "worm.create: defaultRetentionMs must be a non-negative finite number");
   }
 
+  var _baseAudit = audit().namespaced("worm");
   function _emit(action, outcome, id, metadata) {
-    try {
-      audit().safeEmit({ action: "worm." + action, actor: { type: "system" }, outcome: outcome, metadata: Object.assign({ id: id, mode: mode }, metadata || {}) });
-    } catch (_e) { /* audit is drop-silent by design */ }
+    _baseAudit(action, outcome, Object.assign({ id: id, mode: mode }, metadata || {}), { actor: { type: "system" } });
   }
 
   function _resolveRetainUntil(now, putOpts) {

package/lib/ws-client.js

@@ -60,6 +60,7 @@ var audit          = lazyRequire(function () { return require("./audit"); });
 var networkTls     = lazyRequire(function () { return require("./network-tls"); });
 var safeJson       = lazyRequire(function () { return require("./safe-json"); });
 var ssrfGuard      = require("./ssrf-guard");
+var structuredFields = require("./structured-fields");
 var C              = require("./constants");
 var { defineClass } = require("./framework-error");
 
@@ -247,17 +248,13 @@ function connect(target, opts) {
   });
   // SSRF gate — refuse private / loopback / link-local / cloud-metadata /
   // reserved IP destinations by default. Symmetric to b.httpClient. The
-  // returned `ips` are pinned through tls.connect / net.connect so the
+  // validated `ips` are pinned through tls.connect / net.connect so the
   // actual TCP connect targets the validated address (closes the DNS-
   // rebinding TOCTOU window). Cloud-metadata IPs are unconditional
-  // hard-deny — `allowInternal: true` does not bypass them.
-  var hostnameForUrl = parsed.protocol === "wss:" ? "https:" : "http:";
-  var probeUrl = new nodeUrl.URL(hostnameForUrl + "//" + parsed.host + parsed.pathname + parsed.search);
-  ssrfGuard.checkUrl(probeUrl, {
-    allowInternal: opts.allowInternal,
-    errorClass:    WsClientError,
-  }).then(function (result) {
-    client._ssrfPinnedIps = result && result.ips;
+  // hard-deny — `allowInternal: true` does not bypass them. _prepareDial
+  // performs the (async) check + pinning before the dial and reruns it on
+  // every reconnect, so a urlFor-swapped target is validated too.
+  client._prepareDial().then(function () {
     client._dial();
   }).catch(function (e) {
     setImmediate(function () { client._handleSocketError(e); });
@@ -314,51 +311,50 @@ class WsClient extends EventEmitter {
   get subprotocol()            { return this._negotiatedSubprotocol; }
   get url()                    { return this._opts.target; }
 
-  _dial() {
-    var self = this;
+  // Resolve the dial target and re-validate it BEFORE any socket opens.
+  // urlFor may swap the URL and tlsOptsFor may rotate TLS material every
+  // dial (including reconnects). The resolved target is re-checked through
+  // ssrfGuard — AWAITED, because checkUrl is async: the prior code called it
+  // synchronously inside _dial and discarded the Promise, so a urlFor that
+  // pointed at a private / cloud-metadata address mid-reconnect was connected
+  // anyway (the SSRF rejection surfaced only as an unhandled rejection) and
+  // the connect was never pinned. Returns a Promise; sync throws from
+  // urlFor / tlsOptsFor become rejections (async fn) handled by the caller.
+  async _prepareDial() {
     var opts = this._opts;
-    this._readyState = "connecting";
-
-    // Per-dial overrides — urlFor swaps the target URL, tlsOptsFor
-    // overrides TLS material. Both fire every dial including reconnects
-    // so callers can rotate state. urlFor's result is re-validated
-    // through ssrfGuard so a hostile upstream can't direct the client
-    // at a private address mid-reconnect.
     var attempt = this._reconnectAttempt || 0;
-    var dialTarget = opts.target;
     var dialParsed = opts.parsedUrl;
     if (typeof opts.urlFor === "function") {
-      try {
-        var nextTarget = opts.urlFor(attempt);
-        if (typeof nextTarget === "string" && nextTarget.length > 0 && nextTarget !== dialTarget) {
-          dialParsed = _parseUrl(nextTarget);
-          dialTarget = nextTarget;
-          var probeProto = dialParsed.protocol === "wss:" ? "https:" : "http:";
-          var probeUrl = new nodeUrl.URL(probeProto + "//" + dialParsed.host + dialParsed.pathname + dialParsed.search);
-          var probe = ssrfGuard.checkUrl(probeUrl, {
-            allowInternal: opts.allowInternal,
-            errorClass:    WsClientError,
-          });
-          this._ssrfPinnedIps = probe && probe.ips ? probe.ips : null;
-        }
-      } catch (e) {
-        return self._handleSocketError(e);
+      var nextTarget = opts.urlFor(attempt);
+      if (typeof nextTarget === "string" && nextTarget.length > 0 && nextTarget !== opts.target) {
+        dialParsed = _parseUrl(nextTarget);
       }
     }
-
     var dialTlsOpts = opts.tlsOpts;
     if (typeof opts.tlsOptsFor === "function") {
-      try {
-        var override = opts.tlsOptsFor(attempt);
-        if (override && typeof override === "object") {
-          dialTlsOpts = Object.assign({}, opts.tlsOpts || {}, override);
-        }
-      } catch (e) {
-        return self._handleSocketError(e);
+      var override = opts.tlsOptsFor(attempt);
+      if (override && typeof override === "object") {
+        dialTlsOpts = Object.assign({}, opts.tlsOpts || {}, override);
       }
     }
+    var probeProto = dialParsed.protocol === "wss:" ? "https:" : "http:";
+    var probeUrl = new nodeUrl.URL(probeProto + "//" + dialParsed.host + dialParsed.pathname + dialParsed.search);
+    var probe = await ssrfGuard.checkUrl(probeUrl, {
+      allowInternal: opts.allowInternal,
+      errorClass:    WsClientError,
+    });
+    this._ssrfPinnedIps = probe && probe.ips ? probe.ips : null;
+    this._dialParsed    = dialParsed;
+    this._dialTlsOpts   = dialTlsOpts;
+  }
+
+  _dial() {
+    var self = this;
+    this._readyState = "connecting";
 
-    var parsed = dialParsed;
+    // Target + TLS material were resolved and SSRF-validated by _prepareDial.
+    var parsed = this._dialParsed || this._opts.parsedUrl;
+    var dialTlsOpts = this._dialTlsOpts || this._opts.tlsOpts;
     var port = parsed.port ? parseInt(parsed.port, 10) :
                (parsed.protocol === "wss:" ? 443 : 80);                                  // TLS / HTTP default port
     var host = parsed.hostname;
@@ -421,8 +417,8 @@ class WsClient extends EventEmitter {
 
     this._handshakeTimer = setTimeout(function () {
       self._handleSocketError(new WsClientError("ws-client/handshake-timeout",
-        "Handshake exceeded " + opts.handshakeTimeoutMs + "ms"));
-    }, opts.handshakeTimeoutMs);
+        "Handshake exceeded " + self._opts.handshakeTimeoutMs + "ms"));
+    }, self._opts.handshakeTimeoutMs);
     if (typeof this._handshakeTimer.unref === "function") this._handshakeTimer.unref();
   }
 
@@ -492,7 +488,7 @@ class WsClient extends EventEmitter {
     this._handshakeBuf = Buffer.concat([this._handshakeBuf, chunk]);
     var headerEnd = this._handshakeBuf.indexOf("\r\n\r\n");
     if (headerEnd === -1) {
-      if (this._handshakeBuf.length > C.BYTES.kib(64)) {
+      if (safeBuffer.byteLengthOf(this._handshakeBuf) > C.BYTES.kib(64)) {
         this._handleSocketError(new WsClientError("ws-client/handshake-too-large",
           "handshake response exceeded 64 KiB before CRLFCRLF"));
       }
@@ -526,13 +522,10 @@ class WsClient extends EventEmitter {
     }
 
     var headers = Object.create(null);
-    for (var i = 1; i < lines.length; i += 1) {
-      var idx = lines[i].indexOf(":");
-      if (idx === -1) continue;
-      var hkey = lines[i].slice(0, idx).trim().toLowerCase();
-      var hval = lines[i].slice(idx + 1).trim();
-      headers[hkey] = hval;
-    }
+    var hkvps = structuredFields.parseKeyValuePieces(lines, 1, ":");
+    structuredFields.forEachKeyValue(hkvps, function (key, value) {
+      headers[key] = value;
+    });
 
     if ((headers["upgrade"] || "").toLowerCase() !== "websocket" ||
         (headers["connection"] || "").toLowerCase().indexOf("upgrade") === -1) {
@@ -646,6 +639,17 @@ class WsClient extends EventEmitter {
         return;
       }
     }
+    // Fail the connection on any opcode outside the six RFC 6455 §5.2-defined
+    // values (CONT/TEXT/BINARY/CLOSE/PING/PONG). Without this, a reserved
+    // opcode (0x3-0x7, 0xB-0xF) from a malicious server fell through every
+    // branch to the FIN block and emitted a (stale/empty) message — a
+    // fragmented-message desync / frame-injection lever.
+    if (frame.opcode !== OPCODE_CONT && frame.opcode !== OPCODE_TEXT &&
+        frame.opcode !== OPCODE_BINARY && !isControl) {
+      this._handleSocketError(new WsClientError("ws-client/reserved-opcode",
+        "reserved/unknown WebSocket opcode 0x" + frame.opcode.toString(16) + " (RFC 6455 §5.2)"));
+      return;
+    }
     // Continuation frames MUST NOT carry rsv1 (RFC 7692 §6.1) — only
     // the first frame of a compressed message sets rsv1.
     if (frame.opcode === OPCODE_CONT && frame.rsv1) {
@@ -698,7 +702,7 @@ class WsClient extends EventEmitter {
     }
     if (frame.fin) {
       var fullPayload = Buffer.concat(this._fragmentChunks);                              // allow:handrolled-buffer-collect — bounded by maxMessageBytes below
-      if (fullPayload.length > this._opts.maxMessageBytes) {
+      if (safeBuffer.byteLengthOf(fullPayload) > this._opts.maxMessageBytes) {
         this._handleSocketError(new WsClientError("ws-client/message-too-big",
           "incoming message exceeds maxMessageBytes (" + this._opts.maxMessageBytes + ")"));
         return;
@@ -797,7 +801,7 @@ class WsClient extends EventEmitter {
     } else {
       payload = Buffer.from(JSON.stringify(data), "utf8");
     }
-    if (payload.length > this._opts.maxMessageBytes) {
+    if (safeBuffer.byteLengthOf(payload) > this._opts.maxMessageBytes) {
       throw new WsClientError("ws-client/payload-too-big",
         "send: payload exceeds maxMessageBytes (" + this._opts.maxMessageBytes + ")");
     }
@@ -928,7 +932,12 @@ class WsClient extends EventEmitter {
     this._reconnectTimer = setTimeout(function () {
       self._reconnectTimer = null;
       if (self._closed) return;                                                           // operator-cancelled in flight
-      self._dial();
+      // Re-resolve + re-validate the target (urlFor swap, DNS rebind) before
+      // reconnecting — awaited, so a now-private/metadata address is refused.
+      self._prepareDial().then(function () {
+        if (self._closed) return;
+        self._dial();
+      }).catch(function (e) { self._handleSocketError(e); });
     }, delay);
     if (typeof this._reconnectTimer.unref === "function") this._reconnectTimer.unref();
     this.emit("reconnecting", { attempt: this._reconnectAttempt, delayMs: delay });

package/lib/x509-chain.js

@@ -0,0 +1,44 @@
+"use strict";
+
+// Internal X.509 path-validation helpers shared by the framework's
+// certificate-chain walkers (b.tsa.verifyToken, b.mail.bimi VMC/CMC,
+// b.mail.crypto.smime.verify). They exist because node:crypto's
+// X509Certificate.checkIssued() validates the issuer/subject DN match,
+// the AKI/SKI linkage, and — when a keyUsage extension is present —
+// keyCertSign, but it does NOT enforce basicConstraints cA:TRUE. A
+// leaf / end-entity certificate (cA:FALSE) that omits keyUsage is
+// therefore wrongly accepted as a signing CA for the next cert in the
+// chain — the classic basicConstraints bypass (CVE-2002-0862 class).
+// Every chain walker routes its issuer test through these helpers so the
+// cA enforcement can never be forgotten in one walker but present in
+// another.
+
+// True only when `cert` asserts basicConstraints cA:TRUE. node's
+// X509Certificate exposes `.ca` (a boolean); a cert with no
+// basicConstraints extension or with cA:FALSE returns false. A missing
+// cert or a non-boolean `.ca` (parse failure / unsupported runtime)
+// fails closed.
+function isCaCert(cert) {
+  return !!cert && cert.ca === true;
+}
+
+// True when `issuer` validly issued `subject` AND is itself a CA: the
+// DN / AKI-SKI / keyUsage linkage (checkIssued), the cryptographic
+// signature (verify), and basicConstraints cA:TRUE (isCaCert). The cA
+// check runs first so a non-CA cert is rejected before the expensive
+// signature verification. Any exception (malformed cert, unsupported
+// key type) fails closed to false.
+function issuerValidlyIssued(issuer, subject) {
+  try {
+    return isCaCert(issuer) &&
+      subject.checkIssued(issuer) &&
+      subject.verify(issuer.publicKey);
+  } catch (_e) {
+    return false;
+  }
+}
+
+module.exports = {
+  isCaCert:            isCaCert,
+  issuerValidlyIssued: issuerValidlyIssued,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.15.12",
+  "version": "0.15.14",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:caf34b84-1358-4d28-a517-e360819dc35a",
+  "serialNumber": "urn:uuid:81a205f2-938f-47e5-9426-3245e2ac5859",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-06-14T16:52:10.733Z",
+    "timestamp": "2026-06-21T13:24:58.132Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.15.12",
+      "bom-ref": "@blamejs/core@0.15.14",
       "type": "application",
       "name": "blamejs",
-      "version": "0.15.12",
+      "version": "0.15.14",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.15.12",
+      "purl": "pkg:npm/%40blamejs/core@0.15.14",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.15.12",
+      "ref": "@blamejs/core@0.15.14",
       "dependsOn": []
     }
   ]