@blamejs/pki 0.1.24 → 0.1.26

package/lib/oid.js

@@ -74,7 +74,8 @@ var FAMILIES = {
   // RFC 5755 attribute-certificate id-pe extensions: ac-auditIdentity sec. 4.3.1,
   // aaControls sec. 7.4, ac-proxying sec. 7.2).
   pkixAccess: { base: [1, 3, 6, 1, 5, 5, 7, 1], of: {
-    authorityInfoAccess: 1, acAuditIdentity: 4, aaControls: 6, acProxying: 10 } },
+    authorityInfoAccess: 1, acAuditIdentity: 4, aaControls: 6, acProxying: 10,
+    acmeIdentifier: 31 } },
 
   // id-aca -- RFC 5755 attribute-certificate attribute types on the id-pkix 10 arc:
   // authenticationInfo sec. 4.4.1 .. group sec. 4.4.4, plus encAttrs sec. 7.1 (the encrypted-

package/lib/schema-pkix.js

@@ -56,6 +56,38 @@ function pemDecode(text, label, PemError) {
   return der;
 }
 
+// pemDecodeAll(text, label, PemError): decode EVERY PEM block under the STRICT
+// RFC 7468 profile for application/pem-certificate-chain (RFC 8555 sec. 9.1) --
+// each block must carry `label` (default CERTIFICATE), explanatory text MUST NOT
+// appear before/between/after blocks (errata 5983: certchain = stricttextualmsg
+// *(eol stricttextualmsg)), and at least one block is required. Every block's
+// base64 body is canonical (the pemDecode rule); returns an array of DER buffers.
+function pemDecodeAll(text, label, PemError) {
+  label = label || "CERTIFICATE";
+  if (Buffer.isBuffer(text)) {
+    if (text.length > constants.LIMITS.PEM_MAX_BYTES) throw new PemError("pem/too-large", "PEM input exceeds size cap");
+    text = text.toString("latin1");
+  }
+  if (typeof text !== "string") throw new PemError("pem/bad-input", "pemDecodeAll expects a string or Buffer");
+  if (text.length > constants.LIMITS.PEM_MAX_BYTES) throw new PemError("pem/too-large", "PEM input exceeds size cap");
+  var re = /-----BEGIN ([A-Z0-9 ]+)-----([\s\S]*?)-----END \1-----/g;
+  var blocks = [];
+  var lastEnd = 0, m;
+  while ((m = re.exec(text)) !== null) {
+    if (/\S/.test(text.slice(lastEnd, m.index))) throw new PemError("pem/explanatory-text", "explanatory text is not permitted around PEM blocks (RFC 8555 sec. 9.1)");
+    if (m[1] !== label) throw new PemError("pem/label-mismatch", "expected " + JSON.stringify(label) + " block, got " + JSON.stringify(m[1]));
+    var b64 = m[2].replace(/[\r\n\t ]+/g, "");
+    if (!/^[A-Za-z0-9+/]*={0,2}$/.test(b64) || b64.length % 4 !== 0) throw new PemError("pem/bad-base64", "PEM body is not canonical base64 (RFC 4648 sec. 3.5)");
+    var der = Buffer.from(b64, "base64");
+    if (der.toString("base64") !== b64) throw new PemError("pem/bad-base64", "PEM base64 body is not canonical (RFC 4648 sec. 3.5)");
+    blocks.push(der);
+    lastEnd = re.lastIndex;
+  }
+  if (blocks.length === 0) throw new PemError("pem/no-block", "no PEM block found");
+  if (/\S/.test(text.slice(lastEnd))) throw new PemError("pem/explanatory-text", "explanatory text is not permitted after the PEM chain (RFC 8555 sec. 9.1)");
+  return blocks;
+}
+
 // The label must be re-readable by this module's own PEM_RE (uppercase
 // alphanumeric words separated by single spaces, a subset of the RFC 7468
 // sec. 3 label grammar). Anything else (lowercase, a leading/trailing space,
@@ -1022,6 +1054,7 @@ function signedEnvelope(ns, tbsSchema, opts) {
 
 module.exports = {
   pemDecode: pemDecode,
+  pemDecodeAll: pemDecodeAll,
   pemEncode: pemEncode,
   coerceToDer: coerceToDer,
   decodeRoot: decodeRoot,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.1.24",
+  "version": "0.1.26",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",
@@ -65,10 +65,12 @@
     "lint": "eslint --max-warnings 0 .",
     "fuzz": "npm ci --prefix fuzz && npx --prefix fuzz jazzer fuzz/asn1-der.fuzz.js -- -max_total_time=60",
     "gates": "node test/layer-0-primitives/codebase-patterns.test.js && node scripts/validate-source-comment-blocks.js && node scripts/check-api-snapshot.js",
+    "coverage": "c8 --include=lib/** --include=index.js --reporter=text-summary --reporter=lcov node test/smoke.js",
     "prepack": "node scripts/check-pack-against-gitignore.js",
     "check:vendor-currency": "node scripts/check-vendor-currency.js"
   },
   "devDependencies": {
+    "c8": "11.0.0",
     "esbuild": "0.28.1",
     "eslint": "10.3.0"
   }

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:dfb00f98-2ca7-4fd1-b0e7-90fccf92604a",
+  "serialNumber": "urn:uuid:51669f50-bf8f-4b65-8c89-e8fd503b0399",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-10T12:57:51.582Z",
+    "timestamp": "2026-07-10T23:32:35.928Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.1.24",
+      "bom-ref": "@blamejs/pki@0.1.26",
       "type": "application",
       "name": "pki",
-      "version": "0.1.24",
+      "version": "0.1.26",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.1.24",
+      "purl": "pkg:npm/%40blamejs/pki@0.1.26",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.1.24",
+      "ref": "@blamejs/pki@0.1.26",
       "dependsOn": []
     }
   ]