@blamejs/pki 0.5.21 → 0.5.22

package/CHANGELOG.md

@@ -4,7 +4,21 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## v0.5.21 — 2026-08-21
+## v0.5.22 — 2026-08-21
+
+The list tests that decide whether a caller's argument is refused, and which form an extension spec is in, now answer from operations taken at load rather than read when they run.
+
+### Changed
+
+- The DER codec, the PKIX builders and the certificate signer are held to the live-read rule, with the reads each still carries declared as a count that can only fall. Certification-path validation's declared count falls in this release as its list doors convert.
+
+### Fixed
+
+- The DER builder refuses a non-list of children under a captured test. Every structure this toolkit encodes passes through that door, and it was the busiest live read in the library by two orders of magnitude.
+- `pki.x509.sign` picks which form the caller's extension spec is in with a captured test. That choice decides which fields are read and therefore what is signed into the certificate: answering wrongly sends an object down the list arm, and the extensions it carries are never seen. The same test decides whether the spec asserts keyCertSign, which is what makes the issued certificate a CA.
+- The name, key-usage and GeneralNames builders refuse a non-list argument under a captured test, as do certification-path validation's own list doors.
+
+## v0.5.21 — 2026-08-20
 
 The check that holds the crypto engine to load-time captures could be satisfied around, so nine modules had taken the safe primitive at one site and were never held to it anywhere else.
 

package/lib/asn1-der.js

@@ -34,6 +34,10 @@
 var constants = require("./constants");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
+// The list test at each builder door decides whether a caller's argument is refused. Read at the
+// moment it runs, a replacement answering true admits a non-list and the door it guards is gone.
+var _isArray = intrinsic.isArray;
 
 var Asn1Error = frameworkError.Asn1Error;
 var OidError = frameworkError.OidError;
@@ -966,7 +970,7 @@ var build = {
   // encoder composes, so the minimal-encoding rule lives once (the CHECK side is
   // schema.assertMinimalNamedBits). No bits asserted -> the empty BIT STRING.
   namedBitString: function (positions) {
-    if (!Array.isArray(positions)) throw new Asn1Error("asn1/bad-bit-string", "namedBitString requires an array of bit positions");
+    if (!_isArray(positions)) throw new Asn1Error("asn1/bad-bit-string", "namedBitString requires an array of bit positions");
     var hi = -1, i, p;
     for (i = 0; i < positions.length; i++) {
       p = positions[i];
@@ -1059,7 +1063,7 @@ function _intContent(v, who) {
 }
 
 function _asBufferArray(arr, who) {
-  if (!Array.isArray(arr)) throw new Asn1Error("asn1/bad-children", who + ": expected an array of TLV buffers");
+  if (!_isArray(arr)) throw new Asn1Error("asn1/bad-children", who + ": expected an array of TLV buffers");
   return arr.map(function (b) { return _asBuffer(b, who); });
 }
 

package/lib/path-validate.js

@@ -771,7 +771,7 @@ function isSubtreeBaseValid(tag, base) {
     case 1: case 2: case 6: return typeof base === "string";                       // rfc822Name / dNSName / URI
     case 7: return (Buffer.isBuffer(base) || base instanceof Uint8Array) &&
                    (base.length === 8 || base.length === 32);                      // iPAddress: address + mask
-    case 4: return base !== null && typeof base === "object" && !!base.rdns && Array.isArray(base.rdns);   // directoryName
+    case 4: return base !== null && typeof base === "object" && !!base.rdns && intrinsic.isArray(base.rdns);   // directoryName
     default: return base !== undefined;
   }
 }
@@ -782,7 +782,7 @@ function isSubtreeBaseValid(tag, base) {
 // disabling the constraint the caller configured -- so it throws instead.
 function checkedSubtreeSeeds(list, optName) {
   if (list === undefined || list === null) return [];
-  if (!Array.isArray(list)) throw E("path/bad-input", "validate: opts." + optName + " must be an array of { tag, base } subtree entries");
+  if (!intrinsic.isArray(list)) throw E("path/bad-input", "validate: opts." + optName + " must be an array of { tag, base } subtree entries");
   return list.map(function (st) {
     if (!st || typeof st !== "object" || !Number.isInteger(st.tag) || st.tag < 0 || st.tag > 8 || !isSubtreeBaseValid(st.tag, st.base)) {
       throw E("path/bad-input", "validate: opts." + optName + " entries must be { tag: <GeneralName tag number 0..8>, base: <that form's constraint value> }");
@@ -1217,7 +1217,7 @@ async function validate(path, opts) {
   guard.identifier.assertKnownKeys(opts, _VALIDATE_OPTS, E, "path/bad-input",
     "pki.path.validate has an unknown option. The anchor here is `trustAnchor`, singular; " +
     "pki.path.build takes `trustAnchors`. The unknown option was: ");
-  if (!Array.isArray(path)) throw E("path/bad-input", "validate: path must be an array of certificates");
+  if (!intrinsic.isArray(path)) throw E("path/bad-input", "validate: path must be an array of certificates");
   // Bound the per-cert asymmetric-verify work BEFORE parsing an untrusted bundle
   // (the policy-tree cap guards CVE-2023-0464-style blow-up; this guards linear
   // crypto amplification from an oversized path). Entry-point tier: throw.
@@ -1242,7 +1242,7 @@ async function validate(path, opts) {
   // Membership is tested with indexOf, so a raw string here would be consulted
   // as a SUBSTRING match -- validated to an array of strings instead.
   if (opts.userInitialPolicySet !== undefined) {
-    var uipsOk = Array.isArray(opts.userInitialPolicySet) && opts.userInitialPolicySet.length > 0 &&
+    var uipsOk = intrinsic.isArray(opts.userInitialPolicySet) && opts.userInitialPolicySet.length > 0 &&
       guard.list.allMatch(opts.userInitialPolicySet, function (p) { return typeof p === "string" && p.length > 0; });
     if (!uipsOk) throw E("path/bad-input", "validate: opts.userInitialPolicySet must be a non-empty array of policy OID strings");
     // Each entry is compared (indexOf) against canonical decoder output, so a
@@ -2643,7 +2643,7 @@ function assertAnchorConstraints(ta, checkPurpose) {
 function resolvePurposeOpts(opts) {
   var requiredEku = null;
   if (opts.requiredEku !== undefined) {
-    if (!Array.isArray(opts.requiredEku) || opts.requiredEku.length === 0) {
+    if (!intrinsic.isArray(opts.requiredEku) || opts.requiredEku.length === 0) {
       throw E("path/bad-input", "validate: opts.requiredEku must be a non-empty array of key-purpose OID names or dotted OID strings");
     }
     requiredEku = opts.requiredEku.map(function (p) {
@@ -2679,7 +2679,7 @@ function toAnchor(entry) {
     // (name matching), publicKey bytes and the algorithm OID (the sec. 6.1.4 key
     // hand-off). trustAnchors is a caller option, so a malformed tuple is a config
     // error and fails closed at entry, not a downstream no-path / soft verdict.
-    if (!Array.isArray(entry.name.rdns) || !Buffer.isBuffer(entry.publicKey) || typeof entry.algorithm !== "string") {
+    if (!intrinsic.isArray(entry.name.rdns) || !Buffer.isBuffer(entry.publicKey) || typeof entry.algorithm !== "string") {
       throw E("path/bad-input", "build: a trustAnchor tuple must be { name: { rdns: [...] }, publicKey: Buffer, algorithm: OID string }");
     }
     return entry;
@@ -2972,7 +2972,7 @@ async function build(leaf, opts) {
 
   var poolInput = opts.candidates !== undefined ? opts.candidates : opts.intermediates;
   if (poolInput === undefined) poolInput = [];
-  if (!Array.isArray(poolInput)) throw E("path/bad-input", "build: opts.candidates must be an array of certificates");
+  if (!intrinsic.isArray(poolInput)) throw E("path/bad-input", "build: opts.candidates must be an array of certificates");
   // A pool larger than the absolute ceiling is rejected at entry (bounds the
   // parse work on an untrusted bundle) -- distinct from the per-search tick
   // budget below, which an operator may set lower to cap the DFS.
@@ -2987,7 +2987,7 @@ async function build(leaf, opts) {
   var poolDerKeys = new Set();
   for (var pdk = 0; pdk < pool.length; pdk++) intrinsic.setAdd(poolDerKeys, certDerKey(pool[pdk]));
 
-  if (!Array.isArray(opts.trustAnchors) || opts.trustAnchors.length === 0) throw E("path/bad-input", "build: opts.trustAnchors must be a non-empty array of anchor tuples or root certificates");
+  if (!intrinsic.isArray(opts.trustAnchors) || opts.trustAnchors.length === 0) throw E("path/bad-input", "build: opts.trustAnchors must be a non-empty array of anchor tuples or root certificates");
   var anchors = opts.trustAnchors.map(toAnchor);
 
   guard.time.assertValid(opts.time, E, "path/bad-input", "build: opts.time (the validity-window check date, forwarded to validate)");

package/lib/pki-build.js

@@ -14,6 +14,10 @@ var asn1 = require("./asn1-der");
 var schema = require("./schema-engine");
 var compositeSig = require("./composite-sig");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
+// Each of these doors refuses a caller argument that is not a list. Read live, a replacement
+// answering true lets a non-list through the check written to stop it.
+var _isArray = intrinsic.isArray;
 var oid = require("./oid");
 var ipUtils = require("./ip-utils");
 var nodeCrypto = require("crypto");
@@ -83,7 +87,7 @@ function makeBuilder(ctx) {
   function encodeName(spec) {
     if (Buffer.isBuffer(spec)) { assertValidNameDer(spec); return spec; }
     if (typeof spec === "string") spec = [{ commonName: spec }];
-    if (!Array.isArray(spec)) throw E("bad-name", "a name must be a string, an array of RDNs, or raw Name DER");
+    if (!_isArray(spec)) throw E("bad-name", "a name must be a string, an array of RDNs, or raw Name DER");
     return b.sequence(spec.map(encodeRdn));
   }
   // Full validation of a raw Name DER: walk it through the exact RDNSequence parser the decoder uses.
@@ -161,7 +165,7 @@ function makeBuilder(ctx) {
 
   // ---- extension-value encoders (the inverse of certExtensionDecoders) ----
   function extKeyUsage(names) {
-    if (!Array.isArray(names) || !names.length) throw E("bad-input", "keyUsage must assert at least one bit (RFC 5280 sec. 4.2.1.3)");
+    if (!_isArray(names) || !names.length) throw E("bad-input", "keyUsage must assert at least one bit (RFC 5280 sec. 4.2.1.3)");
     var positions = names.map(function (n) {
       var pos = KU_BIT[n];
       if (pos == null) throw E("bad-input", "unknown keyUsage bit " + JSON.stringify(n));
@@ -187,7 +191,7 @@ function makeBuilder(ctx) {
     throw E("bad-input", "unknown " + label + " " + JSON.stringify(n) + " (expected a registered name or a dotted-decimal OID)");
   }
   function extExtKeyUsage(names) {
-    if (!Array.isArray(names) || !names.length) throw E("bad-input", "extendedKeyUsage must list at least one KeyPurposeId");
+    if (!_isArray(names) || !names.length) throw E("bad-input", "extendedKeyUsage must list at least one KeyPurposeId");
     return b.sequence(names.map(function (n) { return b.oid(_resolveOid(n, "extendedKeyUsage purpose")); }));
   }
   function validateBcSpec(bc) {
@@ -214,14 +218,14 @@ function makeBuilder(ctx) {
   // RoleSyntax.roleAuthority [0], IetfAttrSyntax.policyAuthority [0]); the [n] node's children ARE the
   // GeneralName members, no inner SEQUENCE wrapper.
   function encodeGeneralNames(entries, implicitTag) {
-    if (!Array.isArray(entries) || !entries.length) throw E("bad-input", "a GeneralNames must carry at least one GeneralName");
+    if (!_isArray(entries) || !entries.length) throw E("bad-input", "a GeneralNames must carry at least one GeneralName");
     var members = entries.map(encodeGeneralName);
     if (implicitTag == null) return b.sequence(members);
     return b.contextConstructed(implicitTag, Buffer.concat(members));
   }
   function extSan(entries) { return encodeGeneralNames(entries); }
   function extCertPolicies(names) {
-    if (!Array.isArray(names) || !names.length) throw E("bad-input", "certificatePolicies must list at least one policy OID");
+    if (!_isArray(names) || !names.length) throw E("bad-input", "certificatePolicies must list at least one policy OID");
     var seen = {};
     return b.sequence(names.map(function (n) {
       var pOid = _resolveOid(n, "certificate policy");
@@ -301,7 +305,7 @@ function makeBuilder(ctx) {
   };
   function requestedExtensions(extSpec, spki) {
     var EXT_DECODERS = ctx.EXT_DECODERS;
-    if (Array.isArray(extSpec)) {
+    if (_isArray(extSpec)) {
       if (!extSpec.length) throw E("bad-input", "the requested extensions list must carry at least one extension");
       var seen = {};
       return b.sequence(extSpec.map(function (e, i) {

package/lib/x509-sign.js

@@ -27,6 +27,11 @@ var oid = require("./oid");
 var x509 = require("./schema-x509");
 var signScheme = require("./sign-scheme");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
+// This test picks which FORM the caller's extension spec is in, so it decides which fields are read
+// and therefore what is signed into the certificate. Read live, a replacement answering true sends
+// an object down the list arm and the extensions it carries are never seen.
+var _isArray = intrinsic.isArray;
 var frameworkError = require("./framework-error");
 var schema = require("./schema-engine");
 var pkix = require("./schema-pkix");
@@ -112,7 +117,7 @@ function _akiKeyId(val, ctx) {
 // Extension DER buffers). Enforces the RFC 5280 CA cross-field gates, then emits a deterministic order.
 function _buildExtensions(extSpec, ctx) {
   if (extSpec == null) return [];
-  if (Array.isArray(extSpec)) {
+  if (_isArray(extSpec)) {
     // Validate each pre-encoded extension, reject a duplicate extnID (RFC 5280 sec. 4.2 allows at most one
     // instance of an extension), and decode basicConstraints + keyUsage to apply the same CA
     // cross-field rules the object form enforces (below), so the array escape hatch cannot bypass them.
@@ -161,7 +166,7 @@ function _buildExtensions(extSpec, ctx) {
   if (bc != null) _validateBcSpec(bc);
   var caTrue = !!(bc && bc.cA === true);
   var ku = extSpec.keyUsage;
-  var assertsKeyCertSign = Array.isArray(ku) && ku.indexOf("keyCertSign") >= 0;
+  var assertsKeyCertSign = _isArray(ku) && ku.indexOf("keyCertSign") >= 0;
   // RFC 5280 sec. 4.2.1.3 -- keyCertSign requires basicConstraints cA=TRUE.
   if (assertsKeyCertSign && !caTrue) throw _err("x509/bad-input", "keyUsage keyCertSign requires basicConstraints cA=TRUE (RFC 5280 sec. 4.2.1.3)");
   // RFC 5280 sec. 4.2.1.9 -- pathLenConstraint requires cA=TRUE AND keyCertSign.
@@ -217,7 +222,7 @@ function _assertIssuerIsCa(issuerCert) {
 // pre-encoded array extensions form (used to honor a supplied issuer's pathLenConstraint).
 function _issuedCaInfo(extSpec) {
   if (extSpec == null) return { cA: false, pathLen: null };
-  if (!Array.isArray(extSpec)) {
+  if (!_isArray(extSpec)) {
     var bc = extSpec.basicConstraints;
     return { cA: !!(bc && bc.cA === true), pathLen: bc && bc.pathLen != null ? Number(bc.pathLen) : null };
   }
@@ -234,7 +239,7 @@ function _issuedCaInfo(extSpec) {
 // is decoded to look for an Extension whose extnID is subjectAltName with a TRUE critical flag.
 function _hasCriticalSan(extSpec) {
   if (extSpec == null) return false;
-  if (!Array.isArray(extSpec)) return !!extSpec.subjectAltName;
+  if (!_isArray(extSpec)) return !!extSpec.subjectAltName;
   var sanOid = O("subjectAltName");
   for (var i = 0; i < extSpec.length; i++) {
     var n = asn1.decode(_reqDer(extSpec[i], "extension"));
@@ -362,17 +367,23 @@ function _sign(spec, issuer, opts) {
   if (guard.time.instantOf(spec.notBefore) > guard.time.instantOf(spec.notAfter)) throw _err("x509/bad-input", "notBefore must not be after notAfter (RFC 5280 sec. 4.1.2.5)");
   var validityDer = b.sequence([_timeDer(spec.notBefore, "notBefore"), _timeDer(spec.notAfter, "notAfter")]);
 
-  var exts = _buildExtensions(spec.extensions, { spki: spki, issuerSpki: issuerSpki, issuerCert: issuerCert, subjectEmpty: subjectEmpty });
+  // Read ONCE. Three separate consumers test which form this spec is in -- the encoder, the
+  // empty-subject rule below and the path-length rule under it -- and each answering for its own
+  // read is three chances to answer differently about one certificate. The door deep-copies the
+  // spec, so today they cannot disagree; taking the value once means they still cannot if the
+  // shape of that door ever changes.
+  var extSpec = spec.extensions;
+  var exts = _buildExtensions(extSpec, { spki: spki, issuerSpki: issuerSpki, issuerCert: issuerCert, subjectEmpty: subjectEmpty });
   // RFC 5280 sec. 4.1.2.6 -- an empty subject requires a critical subjectAltName (recognized in both the
   // object form and a pre-encoded array-form extension).
-  if (subjectEmpty && !_hasCriticalSan(spec.extensions)) {
+  if (subjectEmpty && !_hasCriticalSan(extSpec)) {
     throw _err("x509/bad-input", "an empty subject requires a critical subjectAltName (RFC 5280 sec. 4.1.2.6)");
   }
   // Honor a supplied issuer's pathLenConstraint (RFC 5280 sec. 4.2.1.9): a CA certificate issued below
   // it consumes one unit of path length, so pathLen=0 forbids issuing a CA below it, and an issued CA's
   // own pathLenConstraint must leave room within the issuer's remaining depth.
   if (issuerPathLen != null) {
-    var issued = _issuedCaInfo(spec.extensions);
+    var issued = _issuedCaInfo(extSpec);
     // A self-issued CA certificate (subject == issuer, e.g. a CA key rollover) does NOT consume path
     // length (RFC 5280 sec. 6.1 counts only non-self-issued intermediates), so it is permitted even at
     // pathLen 0. Compare canonically (sec. 7.1) via the parsed RDN sequences.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.5.21",
+  "version": "0.5.22",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:353e5368-910e-4a85-a222-14a2add84cee",
+  "serialNumber": "urn:uuid:3735feb6-6447-4894-953a-28811d47f2c0",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-21T02:50:54.975Z",
+    "timestamp": "2026-08-21T03:44:09.554Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.5.21",
+      "bom-ref": "@blamejs/pki@0.5.22",
       "type": "application",
       "name": "pki",
-      "version": "0.5.21",
+      "version": "0.5.22",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.5.21",
+      "purl": "pkg:npm/%40blamejs/pki@0.5.22",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.5.21",
+      "ref": "@blamejs/pki@0.5.22",
       "dependsOn": []
     }
   ]