@blamejs/core 0.18.2 → 0.18.4

package/lib/mtls-engine-default.js

@@ -41,6 +41,7 @@
  */
 
 var nodeCrypto = require("node:crypto");
+var nodeTls = require("node:tls");
 var pki = require("./vendor/blamejs-pki.cjs");
 
 var C = require("./constants");
@@ -518,11 +519,87 @@ function _normaliseRevokedSerial(serial) {
   return s;
 }
 
+// Loopback mTLS self-test: does node:tls VERIFY a certificate chain issued
+// under `label` on THIS runtime? Issuance succeeding (generateCa/signClientCert)
+// does NOT prove verification — ML-DSA chains verify in node:tls only on the
+// supported OpenSSL (>= 3.5), which is the property that actually gates a safe
+// algorithm flip. Generates a throwaway CA + server + client leaf under the
+// label and runs a real loopback mTLS handshake: the server reaching its
+// secureConnection handler under requestCert+rejectUnauthorized means the
+// client verified the server chain AND the server verified the client chain
+// (TLS 1.3 verifies the server cert before the client sends its own). Resolves
+// true only when both directions authorize; any issuance/load/handshake failure
+// -> false. Never throws.
+async function canVerifyInTls(label) {
+  var ca, serverLeaf, clientLeaf;
+  try {
+    ca = await generateCa({ algorithm: label });
+    var leafArgs = { caCertPem: ca.caCertPem, caKeyPem: ca.caKeyPem, usage: "both", algorithm: label, validityDays: 1 };
+    serverLeaf = await signClientCert(Object.assign({ cn: "localhost" }, leafArgs));
+    clientLeaf = await signClientCert(Object.assign({ cn: "mtls-tls-probe" }, leafArgs));
+  } catch (_e) {
+    // Can't even issue under this label on this runtime -> can't use it.
+    return false;
+  }
+  return new Promise(function (resolve) {
+    var settled = false;
+    var server = null;
+    var client = null;
+    var serverSocket = null;
+    var timer = null;
+    function finish(ok) {
+      if (settled) return;
+      settled = true;
+      if (timer) clearTimeout(timer);
+      // Destroy BOTH ends before closing the listener: server.close() stops
+      // accepting but does NOT tear down a live/stalled handshake, so on the
+      // timeout path a client (and any accepted server) socket would otherwise
+      // leak — keeping a short-lived migration command from exiting.
+      try { if (client) client.destroy(); } catch (_e) { /* best-effort */ }
+      try { if (serverSocket) serverSocket.destroy(); } catch (_e) { /* best-effort */ }
+      try { if (server) server.close(); } catch (_e) { /* best-effort */ }
+      resolve(ok === true);
+    }
+    try {
+      server = nodeTls.createServer({
+        key: serverLeaf.key, cert: serverLeaf.cert, ca: [ca.caCertPem],
+        requestCert: true, rejectUnauthorized: true, minVersion: "TLSv1.3",
+      }, function (socket) {
+        serverSocket = socket;
+        var authorized = socket.authorized === true;
+        socket.on("error", function () { /* client-side close race */ });
+        socket.end();
+        finish(authorized);
+      });
+      // A client whose chain the server can't verify surfaces here, not at the
+      // connection handler — fail fast instead of waiting out the timeout.
+      server.on("tlsClientError", function () { finish(false); });
+      server.on("error", function () { finish(false); });
+      timer = setTimeout(function () { finish(false); }, 8000);
+      if (typeof timer.unref === "function") timer.unref();
+      server.listen(0, "127.0.0.1", function () {
+        var port = server.address().port;
+        client = nodeTls.connect({
+          host: "127.0.0.1", port: port, servername: "localhost",
+          key: clientLeaf.key, cert: clientLeaf.cert, ca: [ca.caCertPem],
+          rejectUnauthorized: true, minVersion: "TLSv1.3",
+        });
+        client.on("secureConnect", function () { client.end(); });
+        // Client rejected the server chain (or any transport fault) -> false.
+        client.on("error", function () { finish(false); });
+      });
+    } catch (_e) {
+      finish(false);
+    }
+  });
+}
+
 module.exports = {
   generateCa:         generateCa,
   signClientCert:     signClientCert,
   packageP12:         packageP12,
   generateCrl:        generateCrl,
+  canVerifyInTls:     canVerifyInTls,
   algorithmEnvelope:  algorithmEnvelope,
   MtlsEngineError:    MtlsEngineError,
 };

package/lib/session.js

@@ -63,6 +63,16 @@ var safeJson = require("./safe-json");
 var sql = require("./sql");
 var { SessionError } = require("./framework-error");
 
+// A PLAIN object (created by {} or JSON.parse — its prototype is Object.prototype or null), NOT a Date /
+// Buffer / Map / RegExp / class instance. updateData's one-level-deep merge merges two plain objects
+// only; a non-plain value REPLACES so it reaches JSON.stringify as its own form (a Date's ISO string, a
+// Buffer's byte array) instead of being mangled by Object.assign (which copies only enumerable own keys).
+function _isPlainObject(v) {
+  if (v === null || typeof v !== "object" || Array.isArray(v)) return false;
+  var proto = Object.getPrototypeOf(v);
+  return proto === Object.prototype || proto === null;
+}
+
 // vault is initialized at boot before sessions; lazyRequire keeps the
 // load order independent of module-import order. Used to seal/unseal
 // the cookie-side sid so the wire token is ciphertext rather than
@@ -1273,7 +1283,17 @@ async function updateData(token, data, opts) {
     if (data && typeof data === "object") {
       Object.keys(data).forEach(function (k) {
         if (k === "__bj_fingerprint") return;       // reserved — only fingerprint binding writes this
-        next[k] = data[k];
+        var ev = existing[k], nv = data[k];
+        // ONE LEVEL DEEP (per the doc): a PLAIN-object value merges into the existing plain object so its
+        // keys survive; an array, a non-plain object (Date/Buffer/class instance), or a non-object value
+        // REPLACES wholesale. Deeper than one level replaces — Object.assign copies own keys, not
+        // recursively. Both must be PLAIN objects to merge, else a Date (no enumerable keys) would leave
+        // the old object in place and a Buffer would mangle into byte-index keys.
+        if (_isPlainObject(ev) && _isPlainObject(nv)) {
+          next[k] = Object.assign({}, ev, nv);
+        } else {
+          next[k] = nv;
+        }
       });
     }
   } else {

package/lib/vendor/MANIFEST.json

@@ -18,7 +18,7 @@
       "hashes": {
         "server": "sha256:2b30a26f728c5349f4c4b47834f862a4f77393b1224fc12b22abe3ce2cfab78f"
       },
-      "refreshedAt": "2026-07-27T03:18:03.695Z"
+      "refreshedAt": "2026-08-01T21:13:55.453Z"
     },
     "@noble/curves": {
       "version": "2.2.0",
@@ -40,7 +40,7 @@
       "hashes": {
         "server": "sha256:2880c288b1285ef51d356d057bee6f0c8a00de36638cf47b47617e8c1faf10d5"
       },
-      "refreshedAt": "2026-07-27T03:18:03.695Z"
+      "refreshedAt": "2026-08-01T21:13:55.453Z"
     },
     "@noble/post-quantum": {
       "version": "0.6.1",
@@ -71,7 +71,7 @@
       "hashes": {
         "server": "sha256:f9c94094b3c10fe73dac5343289da582454ea6053494fab2bf66099d9103d6c3"
       },
-      "refreshedAt": "2026-07-27T03:18:03.695Z"
+      "refreshedAt": "2026-08-01T21:13:55.453Z"
     },
     "@simplewebauthn/server": {
       "version": "13.3.2",
@@ -94,7 +94,7 @@
       "hashes": {
         "server": "sha256:e83195dc9f189385da9c856ef38843f4466f93ea8f3d7fc2efcb1e1b18da6f20"
       },
-      "refreshedAt": "2026-07-27T03:18:03.695Z"
+      "refreshedAt": "2026-08-01T21:13:55.453Z"
     },
     "SecLists-common-passwords-top-10000": {
       "version": "10k-most-common (master)",
@@ -114,7 +114,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-07-27T03:18:03.695Z"
+      "refreshedAt": "2026-08-01T21:13:55.453Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -139,7 +139,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-07-27T03:18:03.695Z"
+      "refreshedAt": "2026-08-01T21:13:55.453Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -159,10 +159,10 @@
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-07-27T03:18:03.695Z"
+      "refreshedAt": "2026-08-01T21:13:55.453Z"
     },
     "@blamejs/pki": {
-      "version": "0.3.25",
+      "version": "0.3.28",
       "license": "Apache-2.0",
       "author": "blamejs",
       "source": "https://github.com/blamejs/pki",
@@ -182,12 +182,12 @@
         "server": "lib/vendor/blamejs-pki.cjs"
       },
       "bundler": "esbuild --format=cjs --platform=node --external:crypto --external:node:crypto",
-      "bundledAt": "2026-07-26T00:00:00Z",
-      "cpe": "cpe:2.3:a:blamejs:pki:0.3.25:*:*:*:*:node.js:*:*",
+      "bundledAt": "2026-08-01T00:00:00Z",
+      "cpe": "cpe:2.3:a:blamejs:pki:0.3.28:*:*:*:*:node.js:*:*",
       "hashes": {
-        "server": "sha256:ca475ca19f86eb9cce5ad185132b9e69fea49d1e72bae404c4845cc80727f5be"
+        "server": "sha256:5e6824b7a7b0a8f8cf191475c115aeba433b12dba790de6da1afb26ebf43a6ec"
       },
-      "refreshedAt": "2026-07-27T03:18:03.695Z"
+      "refreshedAt": "2026-08-01T21:13:55.453Z"
     }
   }
 }