@blamejs/pki 0.5.17 → 0.5.19

package/lib/x509-sign.js

@@ -53,6 +53,27 @@ var OID_SKI = O("subjectKeyIdentifier");
 
 // The recognized keys of the `extensions` spec object; an unknown key is a typo and throws at
 // config-time (a custom extension is passed as pre-encoded DER via the array form).
+// The three caller-owned objects pki.x509.sign reads, each with its own door. A key nothing here
+// names is a typo or a misplaced argument, and the failure it causes is invisible: the certificate
+// builds, signs, and simply does not carry what was asked for. `spec.extension` (one letter short
+// of `extensions`) emitted a certificate with NO extensions at all -- no basicConstraints on an
+// intended CA, no keyUsage on an intended constrained leaf. `spec.issuer` is the other shape: the
+// issuer is argument TWO, and nesting it in the spec left the certificate SELF-SIGNED with nothing
+// to read as a failure.
+//
+// Every table is derived from what the function actually reads, not from the doc block, because a
+// table naming a key nothing reads reopens the hole it was added to close.
+var KNOWN_SPEC_KEYS = {
+  subject: 1, subjectPublicKey: 1, notBefore: 1, notAfter: 1, serialNumber: 1, extensions: 1,
+};
+// The issuer names itself in one of two FORMS, and the cert form wins unconditionally: when
+// `issuer.cert` is present the builder takes the DN and the public key from it and never reads
+// `name` or `publicKey`. A union accepted `{ key, cert, name: "Different CA", publicKey }` and
+// signed under the certificate's identity while discarding the identity the caller wrote out.
+var KNOWN_ISSUER_CERT_KEYS = { key: 1, cert: 1 };
+var KNOWN_ISSUER_EXPLICIT_KEYS = { key: 1, name: 1, publicKey: 1 };
+var KNOWN_SIGN_OPTS = { digestAlgorithm: 1, pem: 1, pss: 1 };
+
 var KNOWN_EXT_KEYS = {
   subjectKeyIdentifier: 1, authorityKeyIdentifier: 1, keyUsage: 1, keyUsageCritical: 1,
   extendedKeyUsage: 1, extendedKeyUsageCritical: 1, basicConstraints: 1, subjectAltName: 1,
@@ -282,6 +303,22 @@ function _sign(spec, issuer, opts) {
   opts = opts || {};
   if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("x509/bad-input", "the certificate spec must be an object");
   issuer = issuer || {};
+  // Before a single field is read, so a misspelling is a refusal rather than an omission carried
+  // into a signed certificate. The issuer message names its own argument because the mistake this
+  // catches most often is putting the issuer inside the spec, where it self-signed in silence.
+  guard.identifier.assertKnownKeys(spec, KNOWN_SPEC_KEYS, _err, "x509/bad-input", function (k) {
+    return "unknown certificate spec field " + JSON.stringify(k) +
+      (k === "issuer" ? "; the issuer is the SECOND argument to pki.x509.sign, not a spec field" : "") +
+      (k === "extension" ? "; the extensions spec field is `extensions`" : "");
+  });
+  var byCert = issuer.cert != null;
+  guard.identifier.assertKnownKeys(issuer, byCert ? KNOWN_ISSUER_CERT_KEYS : KNOWN_ISSUER_EXPLICIT_KEYS,
+    _err, "x509/bad-input", function (k) {
+      return "unknown issuer field " + JSON.stringify(k) + " for the " + (byCert
+        ? "certificate form; issuer.cert supplies the name and the public key, so they are not read here"
+        : "explicit form; the issuer takes { key, name, publicKey }, or { key, cert } to take both from a certificate");
+    });
+  guard.identifier.assertKnownKeys(opts, KNOWN_SIGN_OPTS, _err, "x509/bad-input", "pki.x509.sign has an unknown option ");
   if (issuer.key == null) throw _err("x509/bad-input", "a signing key (issuer.key, a PKCS#8 private key) is required");
 
   var spki = _reqDer(spec.subjectPublicKey, "spec.subjectPublicKey (the SPKI DER of the certified key)");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.5.17",
+  "version": "0.5.19",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:b8b3d2cf-001e-4a5b-8644-a627ed3ce3c5",
+  "serialNumber": "urn:uuid:d0064cbc-a37c-4d4f-ae67-0b9ba6887de2",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-20T14:50:41.972Z",
+    "timestamp": "2026-08-20T21:35:06.293Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.5.17",
+      "bom-ref": "@blamejs/pki@0.5.19",
       "type": "application",
       "name": "pki",
-      "version": "0.5.17",
+      "version": "0.5.19",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.5.17",
+      "purl": "pkg:npm/%40blamejs/pki@0.5.19",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.5.17",
+      "ref": "@blamejs/pki@0.5.19",
       "dependsOn": []
     }
   ]