@blamejs/pki 0.1.17 → 0.1.19

package/lib/schema-pkix.js

@@ -77,8 +77,17 @@ function _isPemArmor(buf) {
 
 // Decode the DER root, wrapping a codec fault in the caller's <prefix>/bad-der.
 function decodeRoot(der, opts) {
-  try { return asn1.decode(der); }
-  catch (e) { throw new opts.ErrorClass(opts.prefix + "/bad-der", (opts.what || "input") + " DER did not decode: " + ((e && e.message) || String(e)), e); }
+  // A format whose wire encoding is normatively BER (RFC 7292 PKCS#12) opts
+  // in to the codec's ber mode for the WHOLE decode. BER-vs-DER divergence is
+  // not always a decode-time throw — a definite-length constructed IMPLICIT
+  // OCTET STRING decodes strictly and only diverges at the typed reader — so
+  // a strict-first-retry-on-throw boundary would miss legal BER shapes. A
+  // strict-DER input decodes identically under the ber mode, every other
+  // strictness verdict included.
+  try { return asn1.decode(der, opts.ber ? { ber: true } : undefined); }
+  catch (e) {
+    throw new opts.ErrorClass(opts.prefix + "/bad-der", (opts.what || "input") + " DER did not decode: " + ((e && e.message) || String(e)), e);
+  }
 }
 
 // The shared parse entry: coerce -> decode -> walk the top schema. A format's
@@ -383,7 +392,10 @@ function certExtensionDecoders(ns) {
     if (kids[i] && kids[i].tagClass === "universal" && kids[i].tagNumber === _T.INTEGER) {
       if (!cA) throw ns.E(C, "BasicConstraints pathLenConstraint is only permitted when cA is TRUE (RFC 5280 §4.2.1.9)");
       var pl = readInt(kids[i], C, "pathLenConstraint");
-      if (pl < 0n) throw ns.E(C, "BasicConstraints pathLenConstraint must be non-negative");
+      // Bounded before Number() narrowing — a value past the safe-integer range
+      // would round silently and be compared as a path-length ceiling, so it is
+      // exact-or-rejected (the same rule the RSASSA-PSS/PKCS#12 counters follow).
+      if (pl < 0n || pl > 2147483647n) throw ns.E(C, "BasicConstraints pathLenConstraint must be a non-negative integer within range");
       pathLen = Number(pl); i++;
     }
     if (i !== kids.length) throw ns.E(C, "BasicConstraints has unexpected trailing fields");
@@ -404,13 +416,8 @@ function certExtensionDecoders(ns) {
     var anyBit = false;
     for (var z = 0; z < bs.bytes.length; z++) { if (bs.bytes[z] !== 0) { anyBit = true; break; } }
     if (!anyBit) throw ns.E(C, "KeyUsage must assert at least one bit (RFC 5280 §4.2.1.3)");
-    // KeyUsage is a NamedBitList: DER (X.690 §11.2.2) strips all trailing zero
-    // bits, so the last content octet must be non-zero and the lowest USED bit
-    // (at position unusedBits) must be set — one canonical encoding per value.
-    var last = bs.bytes[bs.bytes.length - 1];
-    if (last === 0 || ((last >> bs.unusedBits) & 1) !== 1) {
-      throw ns.E(C, "KeyUsage must use the minimal DER NamedBitList encoding (no trailing zero bits, X.690 §11.2.2)");
-    }
+    // KeyUsage is a NamedBitList — enforce the shared X.690 §11.2.2 minimal-DER rule.
+    schema.assertMinimalNamedBits(bs.unusedBits, bs.bytes, function (m) { throw ns.E(C, m); });
     var out = {};
     KU_BITS.forEach(function (nm, bit) {
       var byte = bit >> 3, mask = 0x80 >> (bit & 7);
@@ -523,7 +530,9 @@ function certExtensionDecoders(ns) {
       pcLastTag = k.tagNumber;
       var v;
       try { v = asn1.read.integerImplicit(k, k.tagNumber); } catch (e) { throw ns.E(C, "PolicyConstraints field must be an INTEGER", e); }
-      if (v < 0n) throw ns.E(C, "PolicyConstraints skip count must be non-negative");
+      // Bounded before Number() narrowing (a skip count past the safe-integer
+      // range would round silently) — exact-or-rejected.
+      if (v < 0n || v > 2147483647n) throw ns.E(C, "PolicyConstraints skip count must be a non-negative integer within range");
       if (k.tagNumber === 0) rep = Number(v);
       else if (k.tagNumber === 1) ipm = Number(v);
       else throw ns.E(C, "PolicyConstraints has an unexpected field [" + k.tagNumber + "]");
@@ -537,7 +546,9 @@ function certExtensionDecoders(ns) {
     var n = decodeTop(buf, C, "InhibitAnyPolicy");
     if (n.tagClass !== "universal" || n.tagNumber !== _T.INTEGER) throw ns.E(C, "InhibitAnyPolicy must be an INTEGER (RFC 5280 §4.2.1.14)");
     var v = readInt(n, C, "InhibitAnyPolicy");
-    if (v < 0n) throw ns.E(C, "InhibitAnyPolicy skip count must be non-negative");
+    // Bounded before Number() narrowing (a skip count past the safe-integer
+    // range would round silently) — exact-or-rejected.
+    if (v < 0n || v > 2147483647n) throw ns.E(C, "InhibitAnyPolicy skip count must be a non-negative integer within range");
     return Number(v);
   }
 
@@ -692,7 +703,8 @@ function spki(ns, opts) {
 function attribute(ns) {
   return schema.seq([
     schema.field("type", schema.oidLeaf()),
-    schema.field("values", schema.setOf(schema.any(), { assert: "set", min: 1, code: ns.prefix + "/bad-attribute-values", what: "attribute values" })),
+    schema.field("values", schema.setOf(schema.any(), { assert: "set", min: 1, max: constants.LIMITS.ATTRIBUTE_MAX_VALUES,
+      code: ns.prefix + "/bad-attribute-values", what: "attribute values" })),
   ], {
     assert: "sequence", arity: { exact: 2 }, code: ns.prefix + "/bad-attribute", what: "Attribute",
     build: function (m, ctx) {
@@ -715,13 +727,25 @@ function attribute(ns) {
 // detectors cannot drift on it (the CRL detector historically omitted the
 // tbs-is-universal check this recovers).
 function signedEnvelopeTbs(root) {
-  if (!root || root.tagClass !== "universal" || root.tagNumber !== asn1.TAGS.SEQUENCE) return null;
+  if (!schema.isUniversal(root, asn1.TAGS.SEQUENCE)) return null;
   if (!root.children || root.children.length !== 3) return null;
   var tbs = root.children[0];
-  if (!tbs.children || tbs.tagClass !== "universal" || tbs.tagNumber !== asn1.TAGS.SEQUENCE) return null;
+  if (!tbs.children || !schema.isUniversal(tbs, asn1.TAGS.SEQUENCE)) return null;
   return tbs;
 }
 
+// rootSequenceChildren(root, minLen, maxLen) — the shared root-shape guard the
+// format matches() detectors re-inline: returns root.children when root is a
+// NON-EMPTY universal SEQUENCE whose child count is within [minLen, maxLen]
+// (maxLen optional/Infinity), else null. Sibling of signedEnvelopeTbs.
+function rootSequenceChildren(root, minLen, maxLen) {
+  if (!schema.isUniversal(root, asn1.TAGS.SEQUENCE) || !root.children) return null;
+  var n = root.children.length;
+  if (n < (minLen || 0)) return null;
+  if (maxLen != null && n > maxLen) return null;
+  return root.children;
+}
+
 // Every format's `parse` is the shared runParse bound to that format's identity
 // (PEM label, error class, error-code prefix, top-level schema). This returns the
 // bound parser so a format declares its configuration once and never re-writes the
@@ -775,6 +799,7 @@ module.exports = {
   spki: spki,
   makeParser: makeParser,
   signedEnvelopeTbs: signedEnvelopeTbs,
+  rootSequenceChildren: rootSequenceChildren,
   signedEnvelope: signedEnvelope,
   attrValueToString: attrValueToString,
   attributeTypeAndValue: attributeTypeAndValue,

package/lib/schema-tsp.js

@@ -217,13 +217,7 @@ var PKI_STATUS_INFO = schema.seq([
 // declared unusedBits must sit exactly below the lowest set bit of the last octet (so
 // the encoding is minimal). The empty value encodes as 0 content octets, 0 unusedBits.
 function _assertMinimalNamedBits(unusedBits, bytes) {
-  if (bytes.length === 0) {
-    if (unusedBits !== 0) throw NS.E("tsp/bad-failinfo", "an empty PKIFailureInfo must encode with 0 unused bits (X.690 §11.2.2)");
-    return;
-  }
-  var last = bytes[bytes.length - 1];
-  if (last === 0) throw NS.E("tsp/bad-failinfo", "PKIFailureInfo NamedBitList must not have a trailing all-zero octet (X.690 §11.2.2)");
-  if (((last >> unusedBits) & 1) !== 1) throw NS.E("tsp/bad-failinfo", "PKIFailureInfo NamedBitList must have all trailing zero bits removed (X.690 §11.2.2)");
+  schema.assertMinimalNamedBits(unusedBits, bytes, function (m) { throw NS.E("tsp/bad-failinfo", m); });
 }
 
 // Decode the set NamedBitList bits to their RFC 3161 names (bit 0 = MSB of byte 0).
@@ -277,7 +271,7 @@ var TIME_STAMP_RESP = schema.seq([
  * @primitive  pki.schema.tsp.parseTstInfo
  * @signature  pki.schema.tsp.parseTstInfo(input) -> tstInfo
  * @since      0.1.13
- * @status     experimental
+ * @status     stable
  * @spec       RFC 3161
  * @related    pki.schema.tsp.parseToken, pki.schema.tsp.parse
  *
@@ -299,7 +293,7 @@ var parseTstInfo = pkix.makeParser({ pemLabel: null, PemError: PemError, ErrorCl
  * @primitive  pki.schema.tsp.parse
  * @signature  pki.schema.tsp.parse(input) -> timeStampResp
  * @since      0.1.13
- * @status     experimental
+ * @status     stable
  * @spec       RFC 3161
  * @related    pki.schema.tsp.parseToken, pki.schema.parse
  *
@@ -320,7 +314,7 @@ var parse = pkix.makeParser({ pemLabel: null, PemError: PemError, ErrorClass: Ts
  * @primitive  pki.schema.tsp.parseToken
  * @signature  pki.schema.tsp.parseToken(input) -> tstInfo
  * @since      0.1.13
- * @status     experimental
+ * @status     stable
  * @spec       RFC 3161, RFC 5652
  * @related    pki.schema.tsp.parse, pki.schema.cms.parse
  *
@@ -359,7 +353,7 @@ function parseToken(input) {
     throw new TspError("tsp/multi-signer", "a TimeStampToken must contain exactly one (TSA) signerInfo (RFC 3161 §2.4.2)");
   }
   var tstInfo;
-  try { tstInfo = schema.walk(TST_INFO, asn1.decode(encap.eContent), NS); }
+  try { tstInfo = schema.embeddedDer(TST_INFO, encap.eContent, NS, { code: "tsp/bad-der", what: "the encapsulated TSTInfo" }); }
   catch (e) {
     if (e instanceof TspError) throw e;
     throw new TspError("tsp/bad-der", "the encapsulated TSTInfo did not decode: " + ((e && e.message) || String(e)), e);
@@ -374,7 +368,7 @@ function parseToken(input) {
  * @primitive  pki.schema.tsp.pemDecode
  * @signature  pki.schema.tsp.pemDecode(text, label?) -> Buffer
  * @since      0.1.13
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468, RFC 3161
  * @related    pki.schema.tsp.parse
  *
@@ -392,13 +386,12 @@ function pemDecode(text, label) { return pkix.pemDecode(text, label || null, Pem
 // CMS ContentInfo, the INTEGER-first PKCS#8 key, and the exactly-3 signed-envelope
 // trio, so it detects unambiguously regardless of registry order.
 function matches(root) {
-  if (!root || root.tagClass !== "universal" || root.tagNumber !== TAGS.SEQUENCE || !root.children) return false;
-  var k = root.children;
-  if (k.length < 1 || k.length > 2) return false;
+  var k = pkix.rootSequenceChildren(root, 1, 2);
+  if (!k) return false;
   var si = k[0];
-  if (!(si.tagClass === "universal" && si.tagNumber === TAGS.SEQUENCE && si.children && si.children.length >= 1)) return false;
-  if (!(si.children[0].tagClass === "universal" && si.children[0].tagNumber === TAGS.INTEGER)) return false;
-  if (k.length === 2 && !(k[1].tagClass === "universal" && k[1].tagNumber === TAGS.SEQUENCE)) return false;
+  if (!(schema.isUniversal(si, TAGS.SEQUENCE) && si.children && si.children.length >= 1)) return false;
+  if (!schema.isUniversal(si.children[0], TAGS.INTEGER)) return false;
+  if (k.length === 2 && !schema.isUniversal(k[1], TAGS.SEQUENCE)) return false;
   return true;
 }
 

package/lib/schema-x509.js

@@ -220,12 +220,12 @@ function matches(root) {
   var tbs = pkix.signedEnvelopeTbs(root);
   if (!tbs) return false;
   var kids = tbs.children;
-  var i = (kids[0] && kids[0].tagClass === "context" && kids[0].tagNumber === 0) ? 1 : 0; // optional [0] version
+  var i = schema.isContext(kids[0], 0) ? 1 : 0; // optional [0] version
   var validity = kids[i + 3]; // serial(i), signature(i+1), issuer(i+2), validity(i+3)
-  return !!validity && validity.tagClass === "universal" && validity.tagNumber === TAGS.SEQUENCE &&
+  return schema.isUniversal(validity, TAGS.SEQUENCE) &&
     !!validity.children && validity.children.length === 2 &&
     validity.children.every(function (t) {
-      return t.tagClass === "universal" && (t.tagNumber === TAGS.UTC_TIME || t.tagNumber === TAGS.GENERALIZED_TIME);
+      return schema.isUniversalOneOf(t, [TAGS.UTC_TIME, TAGS.GENERALIZED_TIME]);
     });
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.1.17",
+  "version": "0.1.19",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:b6db5d53-2a3e-46f9-9187-9c2f6fd9249b",
+  "serialNumber": "urn:uuid:c8d0b092-58fa-4019-9da1-b2b636e61608",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-07T05:30:55.753Z",
+    "timestamp": "2026-07-09T11:21:47.988Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.1.17",
+      "bom-ref": "@blamejs/pki@0.1.19",
       "type": "application",
       "name": "pki",
-      "version": "0.1.17",
+      "version": "0.1.19",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.1.17",
+      "purl": "pkg:npm/%40blamejs/pki@0.1.19",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.1.17",
+      "ref": "@blamejs/pki@0.1.19",
       "dependsOn": []
     }
   ]