@blamejs/pki 0.5.33 → 0.5.34

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.5.34 — 2026-08-29
+
+A subjectAltName URI shorthand whose authority is a bracketed IPv6 literal is now accepted rather than refused.
+
+### Fixed
+
+- A bare-string `subjectAltName` entry whose value is a URI with a bracketed IPv6 authority, such as `https://[2001:db8::1]:443/path`, now classifies as a `uniformResourceIdentifier`. The bracketed host is taken as one unit before an optional port, so a colon inside the IPv6 literal is no longer read as the port separator. An unterminated bracket, a bracket body that is not a valid IPv6 address, or bytes other than a port after the closing bracket stay refused, and the explicit `{ uniformResourceIdentifier: ... }` object form is unchanged.
+
 ## v0.5.33 — 2026-08-29
 
 pki.cms.sign and pki.cms.verify accept the content as an async iterable of byte chunks, so a detached signature over a large payload is produced and verified without holding the payload in memory.

package/lib/pki-build.js

@@ -70,7 +70,8 @@ function _isSubDelim(c) {
 function _isUserinfoByte(c) { return _isUnreserved(c) || _isSubDelim(c) || c === 58; }
 // A path/query/fragment byte: unreserved / sub-delim / a non-bracket gen-delim (":" "/" "?" "#" "@").
 // "%" is handled separately (it must open a "%HEXHEX" triplet); the IP-literal brackets "[" "]" are
-// excluded, so an IPv6-literal host is refused by the shorthand and uses the object form.
+// excluded here because they are authority syntax -- a bracketed IPv6 host is validated in
+// _validUriAuthority (RFC 3986 sec. 3.2.2), never in the path.
 function _isUriByte(c) {
   return _isUnreserved(c) || _isSubDelim(c) || c === 58 || c === 47 || c === 63 || c === 35 || c === 64;
 }
@@ -122,8 +123,8 @@ function _componentBytesOk(s, from, to, byteOk) {
 // or an FQDN of strict-LDH labels (the email-domain grammar: no underscore, no hyphen at a label edge) with
 // at least one dot -- a single-label host such as "localhost" is not fully qualified and uses the object
 // form, matching the email domain. An IPv4-SHAPED host that is not a valid address is refused as ambiguous
-// (the same rule the top-level classifier uses), and an IPv6-literal host -- needing the excluded "[" "]"
-// -- uses the object form.
+// (the same rule the top-level classifier uses). An IPv6-literal host is written in "[" "]" and validated
+// by _validUriIp6Host from _validUriAuthority, never reaching this unbracketed-host check.
 function _validUriHost(s, from, to) {
   if (to <= from) return false;                                                        // empty host
   var host = _sliceStr(s, from, to), len = host.length;
@@ -135,10 +136,21 @@ function _validUriHost(s, from, to) {
   return _labelsValid(host, 0, len, _isHostLabelRange, true);                           // strict-LDH FQDN, root "." allowed
 }
 
+// A bracketed IPv6-literal URI host (RFC 3986 sec. 3.2.2): the bytes between "[" and "]" must be a valid
+// IPv6 address (16 packed octets), never an IPv4 literal (which uses the unbracketed IPv4address form). The
+// bracket is the ONLY way to write an IPv6 host in a URI, and an IPv6 host is a valid iPAddress per RFC 5280
+// sec. 4.2.1.6, so the shorthand accepts it rather than forcing the object form.
+function _validUriIp6Host(s, from, to) {
+  if (to <= from) return false;                                                        // empty "[ ]"
+  var packed = _packIpLiteral(_sliceStr(s, from, to));
+  return packed !== null && intrinsic.sizeOf(packed) === 16;                            // IPv6 literal only (16 octets)
+}
+
 // The authority in [from,to) is "[ userinfo "@" ] host [ ":" port ]" (RFC 3986 sec. 3.2): at most one "@"
-// (userinfo and reg-name each exclude it), a host validated by _validUriHost (RFC 5280 FQDN or IPv4), and
-// an all-digit -- possibly empty -- port after the host's single ":" (a reg-name has no ":"). The userinfo
-// bytes are validated against the RFC 3986 userinfo class.
+// (userinfo and reg-name each exclude it), a host that is an RFC 5280 FQDN or IPv4 (_validUriHost) or a
+// bracketed IPv6 literal (_validUriIp6Host), and an all-digit -- possibly empty -- port after the host's
+// ":". A bracketed host is taken as ONE unit before the port, so a ":" inside the IPv6 literal is not read
+// as the port separator. The userinfo bytes are validated against the RFC 3986 userinfo class.
 function _validUriAuthority(s, from, to) {
   var i, c, at = -1;
   for (i = from; i < to; i += 1) {
@@ -147,6 +159,17 @@ function _validUriAuthority(s, from, to) {
   }
   var hostStart = at === -1 ? from : at + 1;
   if (at !== -1 && !_componentBytesOk(s, from, at, _isUserinfoByte)) return false;      // userinfo
+  if (hostStart < to && _charCodeAt(s, hostStart) === 91) {                             // "[" -> bracketed IPv6 host
+    var close = -1;
+    for (i = hostStart + 1; i < to; i += 1) { if (_charCodeAt(s, i) === 93) { close = i; break; } }   // "]"
+    if (close === -1) return false;                                                    // unterminated "["
+    if (!_validUriIp6Host(s, hostStart + 1, close)) return false;                       // IPv6 literal in "[ ]"
+    var after = close + 1;
+    if (after === to) return true;                                                     // "[ ipv6 ]" with no port
+    if (_charCodeAt(s, after) !== 58) return false;                                    // only a ":" port may follow "]"
+    for (i = after + 1; i < to; i += 1) { if (!_isDigitCode(_charCodeAt(s, i))) return false; }   // port = *DIGIT
+    return true;
+  }
   var colon = -1;
   for (i = hostStart; i < to; i += 1) { if (_charCodeAt(s, i) === 58) { colon = i; break; } }   // ":" -> port
   var hostEnd = colon === -1 ? to : colon;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.5.33",
+  "version": "0.5.34",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:50c541ec-c574-4bac-aa78-36123ed457dc",
+  "serialNumber": "urn:uuid:849173ca-4a17-451d-91be-1f2d75d83f00",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-29T08:57:14.236Z",
+    "timestamp": "2026-08-29T10:04:44.768Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.5.33",
+      "bom-ref": "@blamejs/pki@0.5.34",
       "type": "application",
       "name": "pki",
-      "version": "0.5.33",
+      "version": "0.5.34",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.5.33",
+      "purl": "pkg:npm/%40blamejs/pki@0.5.34",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.5.33",
+      "ref": "@blamejs/pki@0.5.34",
       "dependsOn": []
     }
   ]