@blamejs/core 0.18.2 → 0.18.3

package/lib/mtls-engine-default.js

@@ -41,6 +41,7 @@
  */
 
 var nodeCrypto = require("node:crypto");
+var nodeTls = require("node:tls");
 var pki = require("./vendor/blamejs-pki.cjs");
 
 var C = require("./constants");
@@ -518,11 +519,87 @@ function _normaliseRevokedSerial(serial) {
   return s;
 }
 
+// Loopback mTLS self-test: does node:tls VERIFY a certificate chain issued
+// under `label` on THIS runtime? Issuance succeeding (generateCa/signClientCert)
+// does NOT prove verification — ML-DSA chains verify in node:tls only on the
+// supported OpenSSL (>= 3.5), which is the property that actually gates a safe
+// algorithm flip. Generates a throwaway CA + server + client leaf under the
+// label and runs a real loopback mTLS handshake: the server reaching its
+// secureConnection handler under requestCert+rejectUnauthorized means the
+// client verified the server chain AND the server verified the client chain
+// (TLS 1.3 verifies the server cert before the client sends its own). Resolves
+// true only when both directions authorize; any issuance/load/handshake failure
+// -> false. Never throws.
+async function canVerifyInTls(label) {
+  var ca, serverLeaf, clientLeaf;
+  try {
+    ca = await generateCa({ algorithm: label });
+    var leafArgs = { caCertPem: ca.caCertPem, caKeyPem: ca.caKeyPem, usage: "both", algorithm: label, validityDays: 1 };
+    serverLeaf = await signClientCert(Object.assign({ cn: "localhost" }, leafArgs));
+    clientLeaf = await signClientCert(Object.assign({ cn: "mtls-tls-probe" }, leafArgs));
+  } catch (_e) {
+    // Can't even issue under this label on this runtime -> can't use it.
+    return false;
+  }
+  return new Promise(function (resolve) {
+    var settled = false;
+    var server = null;
+    var client = null;
+    var serverSocket = null;
+    var timer = null;
+    function finish(ok) {
+      if (settled) return;
+      settled = true;
+      if (timer) clearTimeout(timer);
+      // Destroy BOTH ends before closing the listener: server.close() stops
+      // accepting but does NOT tear down a live/stalled handshake, so on the
+      // timeout path a client (and any accepted server) socket would otherwise
+      // leak — keeping a short-lived migration command from exiting.
+      try { if (client) client.destroy(); } catch (_e) { /* best-effort */ }
+      try { if (serverSocket) serverSocket.destroy(); } catch (_e) { /* best-effort */ }
+      try { if (server) server.close(); } catch (_e) { /* best-effort */ }
+      resolve(ok === true);
+    }
+    try {
+      server = nodeTls.createServer({
+        key: serverLeaf.key, cert: serverLeaf.cert, ca: [ca.caCertPem],
+        requestCert: true, rejectUnauthorized: true, minVersion: "TLSv1.3",
+      }, function (socket) {
+        serverSocket = socket;
+        var authorized = socket.authorized === true;
+        socket.on("error", function () { /* client-side close race */ });
+        socket.end();
+        finish(authorized);
+      });
+      // A client whose chain the server can't verify surfaces here, not at the
+      // connection handler — fail fast instead of waiting out the timeout.
+      server.on("tlsClientError", function () { finish(false); });
+      server.on("error", function () { finish(false); });
+      timer = setTimeout(function () { finish(false); }, 8000);
+      if (typeof timer.unref === "function") timer.unref();
+      server.listen(0, "127.0.0.1", function () {
+        var port = server.address().port;
+        client = nodeTls.connect({
+          host: "127.0.0.1", port: port, servername: "localhost",
+          key: clientLeaf.key, cert: clientLeaf.cert, ca: [ca.caCertPem],
+          rejectUnauthorized: true, minVersion: "TLSv1.3",
+        });
+        client.on("secureConnect", function () { client.end(); });
+        // Client rejected the server chain (or any transport fault) -> false.
+        client.on("error", function () { finish(false); });
+      });
+    } catch (_e) {
+      finish(false);
+    }
+  });
+}
+
 module.exports = {
   generateCa:         generateCa,
   signClientCert:     signClientCert,
   packageP12:         packageP12,
   generateCrl:        generateCrl,
+  canVerifyInTls:     canVerifyInTls,
   algorithmEnvelope:  algorithmEnvelope,
   MtlsEngineError:    MtlsEngineError,
 };

package/lib/vendor/MANIFEST.json

@@ -18,7 +18,7 @@
       "hashes": {
         "server": "sha256:2b30a26f728c5349f4c4b47834f862a4f77393b1224fc12b22abe3ce2cfab78f"
       },
-      "refreshedAt": "2026-07-27T03:18:03.695Z"
+      "refreshedAt": "2026-08-01T16:08:02.316Z"
     },
     "@noble/curves": {
       "version": "2.2.0",
@@ -40,7 +40,7 @@
       "hashes": {
         "server": "sha256:2880c288b1285ef51d356d057bee6f0c8a00de36638cf47b47617e8c1faf10d5"
       },
-      "refreshedAt": "2026-07-27T03:18:03.695Z"
+      "refreshedAt": "2026-08-01T16:08:02.316Z"
     },
     "@noble/post-quantum": {
       "version": "0.6.1",
@@ -71,7 +71,7 @@
       "hashes": {
         "server": "sha256:f9c94094b3c10fe73dac5343289da582454ea6053494fab2bf66099d9103d6c3"
       },
-      "refreshedAt": "2026-07-27T03:18:03.695Z"
+      "refreshedAt": "2026-08-01T16:08:02.316Z"
     },
     "@simplewebauthn/server": {
       "version": "13.3.2",
@@ -94,7 +94,7 @@
       "hashes": {
         "server": "sha256:e83195dc9f189385da9c856ef38843f4466f93ea8f3d7fc2efcb1e1b18da6f20"
       },
-      "refreshedAt": "2026-07-27T03:18:03.695Z"
+      "refreshedAt": "2026-08-01T16:08:02.316Z"
     },
     "SecLists-common-passwords-top-10000": {
       "version": "10k-most-common (master)",
@@ -114,7 +114,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-07-27T03:18:03.695Z"
+      "refreshedAt": "2026-08-01T16:08:02.316Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -139,7 +139,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-07-27T03:18:03.695Z"
+      "refreshedAt": "2026-08-01T16:08:02.316Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -159,10 +159,10 @@
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-07-27T03:18:03.695Z"
+      "refreshedAt": "2026-08-01T16:08:02.316Z"
     },
     "@blamejs/pki": {
-      "version": "0.3.25",
+      "version": "0.3.27",
       "license": "Apache-2.0",
       "author": "blamejs",
       "source": "https://github.com/blamejs/pki",
@@ -182,12 +182,12 @@
         "server": "lib/vendor/blamejs-pki.cjs"
       },
       "bundler": "esbuild --format=cjs --platform=node --external:crypto --external:node:crypto",
-      "bundledAt": "2026-07-26T00:00:00Z",
-      "cpe": "cpe:2.3:a:blamejs:pki:0.3.25:*:*:*:*:node.js:*:*",
+      "bundledAt": "2026-08-01T00:00:00Z",
+      "cpe": "cpe:2.3:a:blamejs:pki:0.3.27:*:*:*:*:node.js:*:*",
       "hashes": {
-        "server": "sha256:ca475ca19f86eb9cce5ad185132b9e69fea49d1e72bae404c4845cc80727f5be"
+        "server": "sha256:28b53546b062fef30e9fe5569036fcf51b6669cbd0a910542a52064eb4814e81"
       },
-      "refreshedAt": "2026-07-27T03:18:03.695Z"
+      "refreshedAt": "2026-08-01T16:08:02.316Z"
     }
   }
 }