@blamejs/pki 0.5.37 → 0.5.38

package/CHANGELOG.md

@@ -4,7 +4,15 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## v0.5.37 — 2026-08-30
+## v0.5.38 — 2026-08-30
+
+Builder verbs reject a sparse or nullish array argument with a typed error instead of a native one.
+
+### Changed
+
+- The array arguments of pki.pkcs12.build (SafeContents bags), pki.ocsp.buildRequest and pki.ocsp.sign (the query and response batches), pki.cmc.build (requests and the CMS and other-message sequences), pki.crl.sign (revoked entries and the issuing-distribution-point and freshest-CRL general names), pki.crmf.build (controls and registration info), and pki.cms.encrypt (authenticated attributes) are checked for holes and nullish entries up front. A sparse or nullish array is now the verb's own typed `<domain>/bad-input` error naming the index, in place of the native `TypeError` the hole previously produced at the encoder. A valid (dense) array is unaffected and its emitted structure is byte-for-byte identical.
+
+## v0.5.37 — 2026-08-29
 
 pki.cms.decrypt can return the recovered content as an async iterable of plaintext chunks.
 

package/lib/cmc-build.js

@@ -27,6 +27,7 @@
 
 var nodeCrypto = require("node:crypto");
 var asn1 = require("./asn1-der");
+var pkiBuild = require("./pki-build");   // reqDenseArray: reject a sparse/nullish caller array as a typed cmc/bad-input
 var csr = require("./schema-csr");    // to read the Subject Key Identifier a tcr request declares
 var crmf = require("./schema-crmf");  // ... and the one a crm request declares
 var cmcFmt = require("./schema-cmc");  // to read the assembled message back before signing it
@@ -510,7 +511,9 @@ function _build(spec, signer, opts) {
   // them has no replay defense, and pki.cmc.verify cannot enforce a binding the
   // client never sent, so the omission is invisible from both ends.
   guard.identifier.assertKnownKeys(spec, KNOWN_SPEC_KEYS, E, "cmc/bad-input", "unknown spec field ");
-  var requests = spec.requests || [];
+  // Density up front: requests is iterated by both the forEach below and the map that encodes it, and a
+  // hole would survive either (map/forEach skip it) to reach b.sequence as a native error.
+  var requests = spec.requests != null ? pkiBuild.reqDenseArray(spec.requests, "requests", E, "cmc/bad-input") : [];
   if (!Array.isArray(requests)) throw E("cmc/bad-input", "spec.requests must be an array");
   var callerControls = spec.controls || [];
   if (!Array.isArray(callerControls)) throw E("cmc/bad-input", "spec.controls must be an array");
@@ -532,10 +535,10 @@ function _build(spec, signer, opts) {
     var fixed = fixedRequestId(r, i);
     if (fixed != null) ids.reserve(fixed, "request " + i);
   });
-  var cmsSequence = (spec.cmsSequence || []).map(function (el, i) {
+  var cmsSequence = (spec.cmsSequence != null ? pkiBuild.reqDenseArray(spec.cmsSequence, "cmsSequence", E, "cmc/bad-input") : []).map(function (el, i) {
     return _claimRawElement(el, ids, "a cmsSequence element (index " + i + ")");
   });
-  var otherMsgSequence = (spec.otherMsgSequence || []).map(function (el, i) {
+  var otherMsgSequence = (spec.otherMsgSequence != null ? pkiBuild.reqDenseArray(spec.otherMsgSequence, "otherMsgSequence", E, "cmc/bad-input") : []).map(function (el, i) {
     return _claimRawElement(el, ids, "an otherMsgSequence element (index " + i + ")");
   });
 

package/lib/cms-encrypt.js

@@ -17,6 +17,7 @@
 
 var nodeCrypto = require("crypto");
 var asn1 = require("./asn1-der");
+var pkiBuild = require("./pki-build");   // reqDenseArray: reject a sparse/nullish caller array as a typed cms/bad-input
 var oid = require("./oid");
 var x509 = require("./schema-x509");
 var schemaCms = require("./schema-cms");
@@ -589,8 +590,14 @@ async function _envelopedData(contentBytes, contentStream, cek, ca, contentType,
 // design (RFC 5652 sec. 9.2), while for AuthEnvelopedData that value is the unencrypted hash of a
 // plaintext the message exists to conceal (RFC 5083 sec. 2.1 / sec. 5).
 function _assertAuthAttrs(pairs, forbidden) {
+  // Reject a sparse/nullish attribute array as a typed error before b.setOf reaches it as a native one.
+  // This gate runs before the setOf on both the AuthEnveloped and AuthenticatedData paths.
+  // Validate AND SNAPSHOT: reqDenseArray returns a fresh dense copy, and it is that copy the caller must
+  // iterate and encode. Iterating the original `pairs` would let an indexed getter that sparsified it
+  // during validation slip a hole into b.setOf as a native error; the returned snapshot cannot.
+  var dense = pkiBuild.reqDenseArray(pairs, "authAttrs", _err, "cms/bad-input");
   var seenTypes = {};
-  pairs.forEach(function (p) {
+  dense.forEach(function (p) {
     var node;
     try { node = asn1.decode(p); } catch (e) { throw _err("cms/bad-input", "an authenticated attribute is not well-formed DER", e); }
     if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children || node.children.length !== 2 ||
@@ -604,6 +611,7 @@ function _assertAuthAttrs(pairs, forbidden) {
     seenTypes[t] = 1;
     if (forbidden && t === forbidden.oid) throw _err("cms/bad-input", forbidden.why);
   });
+  return dense;
 }
 
 // The one attribute AuthEnvelopedData declines to emit. Its value is the unencrypted one-way hash of
@@ -623,9 +631,9 @@ async function _authEnvelopedData(contentBytes, contentStream, cek, ca, contentT
     throw _err("cms/bad-input", "AuthEnvelopedData with a non-data contentType requires authAttrs (RFC 5083 sec. 2.1)");
   }
   if (opts.authAttrs && opts.authAttrs.length) {
-    _assertAuthAttrs(opts.authAttrs, AUTH_ENVELOPED_FORBIDDEN);
+    var denseAttrs = _assertAuthAttrs(opts.authAttrs, AUTH_ENVELOPED_FORBIDDEN);
     // authAttrs are transmitted [1] IMPLICIT but MACed under the EXPLICIT SET OF tag (RFC 5083 sec. 2.2).
-    var setOf = b.setOf(opts.authAttrs);
+    var setOf = b.setOf(denseAttrs);
     aad = setOf; authAttrsDer = b.contextConstructed(1, setOf.subarray(_tlvHeaderLen(setOf)));
   }
   // A 16-octet (128-bit) GCM tag, the strongest ICV and what OpenSSL emits, so the message
@@ -799,7 +807,7 @@ async function authenticate(content, recipients, opts) {
         b.sequence([b.oid(O("messageDigest")), b.setOf([b.octetString(mdDigest)])]),
       ];
       if (opts.authAttrs && opts.authAttrs.length) pairs = pairs.concat(opts.authAttrs);
-      _assertAuthAttrs(pairs, null);
+      pairs = _assertAuthAttrs(pairs, null);
       var setOf = b.setOf(pairs);
       preimage = setOf;                                                            // MAC over the 0x31 SET OF
       authAttrsDer = b.contextConstructed(2, setOf.subarray(_tlvHeaderLen(setOf)));   // [2] IMPLICIT on the wire

package/lib/crl-sign.js

@@ -203,7 +203,7 @@ function _idpValue(idp) {
   if (idp.onlyContainsAttributeCerts === true) throw _err("crl/bad-idp", "onlyContainsAttributeCerts=TRUE is not permitted for a conforming CRL issuer (RFC 5280 sec. 5.2.5)");
   var children = [];
   if (idp.fullName != null) {
-    var entries = Array.isArray(idp.fullName) ? idp.fullName : [idp.fullName];
+    var entries = Array.isArray(idp.fullName) ? pkiBuild.reqDenseArray(idp.fullName, "issuingDistributionPoint.fullName", _err, "crl/bad-idp") : [idp.fullName];
     if (!entries.length) throw _err("crl/bad-idp", "issuingDistributionPoint fullName must carry at least one GeneralName");
     // distributionPoint [0] { fullName [0] IMPLICIT GeneralNames }
     children.push(b.contextConstructed(0, b.contextConstructed(0, Buffer.concat(entries.map(_encodeGeneralName)))));
@@ -243,11 +243,12 @@ function _validatePreEncodedIdp(inner) {
 // fullName) or an array of { fullName } distribution points.
 function _freshestValue(spec) {
   if (!Array.isArray(spec) || !spec.length) throw _err("crl/bad-input", "freshestCRL must be a non-empty array of GeneralNames (or { fullName } distribution points)");
-  var dps = spec.every(function (e) { return e && typeof e === "object" && !Buffer.isBuffer(e) && Object.keys(e).length === 1 && e.fullName != null; })
-    ? spec.map(function (dp) { return dp.fullName; })
-    : [spec];
+  var dense = _b.reqDenseArray(spec, "freshestCRL");   // density before every()/map() skip a hole into b.sequence
+  var dps = dense.every(function (e) { return e && typeof e === "object" && !Buffer.isBuffer(e) && Object.keys(e).length === 1 && e.fullName != null; })
+    ? dense.map(function (dp) { return dp.fullName; })
+    : [dense];
   return b.sequence(dps.map(function (fullName) {
-    var entries = Array.isArray(fullName) ? fullName : [fullName];
+    var entries = Array.isArray(fullName) ? _b.reqDenseArray(fullName, "a freshestCRL distribution point fullName") : [fullName];
     if (!entries.length) throw _err("crl/bad-input", "a freshestCRL distribution point must carry at least one GeneralName (GeneralNames is SIZE(1..MAX), RFC 5280 sec. 4.2.1.13)");
     return b.sequence([b.contextConstructed(0, b.contextConstructed(0, Buffer.concat(entries.map(_encodeGeneralName))))]);
   }));
@@ -345,7 +346,8 @@ function _buildCrlExtensions(spec, ctx) {
 function _buildRevoked(entryList, isDelta) {
   if (!Array.isArray(entryList)) throw _err("crl/bad-input", "revoked must be an array of revoked-certificate entries");
   var anyExt = false, seenSerials = {};
-  var entries = entryList.map(function (e, idx) {
+  // Density before the map, which would otherwise skip a hole into b.sequence as a native error.
+  var entries = _b.reqDenseArray(entryList, "revoked").map(function (e, idx) {
     if (!e || typeof e !== "object" || Buffer.isBuffer(e)) throw _err("crl/bad-input", "each revoked entry must be an object");
     // Before any field of the entry is encoded, so an unrecognized name is a refusal rather than an
     // entry signed without what it asked for.

package/lib/crmf-sign.js

@@ -148,7 +148,8 @@ function _buildAttrTypeAndValues(spec, code, label, valueMap) {
   if (Array.isArray(spec)) {
     if (!spec.length) throw _err(code, label + " must carry at least one entry");
     var seenA = {};
-    return b.sequence(spec.map(function (e, i) {
+    // Density before the map, which would otherwise skip a hole into b.sequence as a native error.
+    return b.sequence(pkiBuild.reqDenseArray(spec, label, _err, code).map(function (e, i) {
       var der = _b.reqDer(e, label + " [" + i + "]");
       var n;
       try { n = asn1.decode(der); } catch (err) { throw _err("crmf/bad-input", "pre-encoded " + label + " [" + i + "] is not valid DER", err); }

package/lib/ocsp.js

@@ -25,6 +25,7 @@
 
 var nodeCrypto = require("crypto");
 var asn1 = require("./asn1-der");
+var pkiBuild = require("./pki-build");   // reqDenseArray: reject a sparse/nullish caller array as a typed ocsp/bad-input
 var oid = require("./oid");
 var x509 = require("./schema-x509");
 var ocspSchema = require("./schema-ocsp");
@@ -176,7 +177,9 @@ function _buildRequest(query, opts) {
   var lightweight = opts.profile === "lightweight";
   var hashName = opts.hashAlgorithm || "sha1";
   if (lightweight && hashName !== "sha1") throw _err("ocsp/bad-input", "the lightweight profile requires a SHA-1 CertID (RFC 5019 sec. 2.1.1)");
-  var queries = Array.isArray(query) ? query : [query];
+  // A batch array is density-checked before the map below (which would otherwise skip a hole and reach
+  // Promise.all/b.sequence with an undefined); a single {cert,issuer} wraps to a dense one-element array.
+  var queries = Array.isArray(query) ? pkiBuild.reqDenseArray(query, "queries", _err, "ocsp/bad-input") : [query];
   if (!queries.length) throw _err("ocsp/bad-input", "buildRequest needs at least one { cert, issuer } query");
   if (lightweight && queries.length !== 1) throw _err("ocsp/bad-input", "the lightweight profile permits exactly one Request (RFC 5019 sec. 2.1.1)");
   if (opts.signer && !opts.requestorName) throw _err("ocsp/bad-input", "a signed OCSP request MUST carry requestorName (RFC 6960 sec. 4.1.2)");
@@ -335,7 +338,7 @@ function _sign(responseData, responder, opts) {
 // exit -- sync throw and async rejection alike -- rather than each fallible step needing to
 // remember. `responderKey` is the private copy; it is never the caller's object.
 function _signResponse(responseData, responder, respCert, respCertDer, responderKey, opts) {
-  var responses = responseData.responses || [];
+  var responses = responseData.responses != null ? pkiBuild.reqDenseArray(responseData.responses, "responses", _err, "ocsp/bad-input") : [];
   if (!responses.length) throw _err("ocsp/bad-input", "a response MUST include at least one SingleResponse (RFC 6960 sec. 4.2.1)");
 
   return _responderID(responseData.responderID, respCert).then(function (ridNode) {

package/lib/pkcs12-build.js

@@ -47,6 +47,7 @@ var cmsSign = require("./cms-sign");   // the signer-descriptor field tables, fo
 var cmsDecrypt = require("./cms-decrypt");   // the @internal decryptEnvelopedData seam -- opens a privacy safe off the pkcs12 parser's already-walked (BER-capable) EnvelopedData node
 var schemaPkcs12 = require("./schema-pkcs12");
 var pkix = require("./schema-pkix");
+var pkiBuild = require("./pki-build");   // reqDenseArray: reject a sparse/nullish caller array as a typed pkcs12/bad-input
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
 var frameworkError = require("./framework-error");
@@ -463,9 +464,13 @@ function _pbeOpts(enc) {
 
 // SafeContents ::= SEQUENCE OF SafeBag (ordered, and not a SET OF).
 function _buildSafeContents(bags, opts, depth) {
-  if (!Array.isArray(bags)) throw _err("pkcs12/bad-input", "bags must be an array");
-  if (bags.length > C.LIMITS.PKCS12_MAX_ELEMENTS) throw _err("pkcs12/bad-input", "a SafeContents exceeds the element cap " + C.LIMITS.PKCS12_MAX_ELEMENTS);
-  return b.sequence(bags.map(function (bag) { return _buildBag(bag, opts, depth); }));
+  // The element cap is enforced BEFORE the density scan, so a huge dense array is rejected in O(1) rather
+  // than walked. reqDenseArray then rejects a non-array, or a sparse hole / nullish entry that
+  // Array.prototype.map would skip into Buffer.concat as a native error, testing own-property presence
+  // and failing at the first bad index.
+  if (intrinsic.isArray(bags) && bags.length > C.LIMITS.PKCS12_MAX_ELEMENTS) throw _err("pkcs12/bad-input", "a SafeContents exceeds the element cap " + C.LIMITS.PKCS12_MAX_ELEMENTS);
+  var dense = pkiBuild.reqDenseArray(bags, "bags", _err, "pkcs12/bad-input");
+  return b.sequence(dense.map(function (bag) { return _buildBag(bag, opts, depth); }));
 }
 
 // One AuthenticatedSafe element: a plaintext id-data ContentInfo, an id-encryptedData ContentInfo whose

package/lib/pki-build.js

@@ -329,6 +329,34 @@ var KU_BIT = {
   dataEncipherment: 3, keyAgreement: 4, keyCertSign: 5, cRLSign: 6, encipherOnly: 7, decipherOnly: 8,
 };
 
+// A caller-supplied array a builder is about to map over: reject a sparse hole or a nullish entry as a
+// typed error. Array.prototype.map SKIPS a hole, which would otherwise reach Buffer.concat as a native
+// ERR_INVALID_ARG_TYPE and, on a huge sparse length, traverse the empty slots. Tests OWN-property presence
+// (intrinsic.hasOwn) at each index BEFORE reading it, so a polluted Array.prototype[i] cannot slip a hole
+// past the check, and fails fast at the first bad index so the length alone can never force a walk. Takes
+// the caller's error factory E (invoked E(fullCode, msg)) so a builder WITHOUT a makeBuilder instance
+// routes its caller arrays through the same choke point; makeBuilder's own reqDenseArray delegates here.
+function reqDenseArrayImpl(list, what, E, code) {
+  if (!_isArray(list)) throw E(code, what + " must be an array");
+  var n = list.length;
+  // Snapshot each own index into a FRESH dense array and return THAT, never `list`. Reading list[i] can
+  // fire a caller-defined indexed accessor that mutates `list` (extending it with holes past the captured
+  // n, or deleting an already-checked index); returning `list` would then hand the caller's map a
+  // newly-sparse array and the native error this guard exists to prevent. The copy captures the value as
+  // read, so a later mutation of `list` cannot reintroduce a hole into what the caller iterates.
+  var out = [];
+  for (var i = 0; i < n; i++) {
+    if (!intrinsic.hasOwn(list, i)) throw E(code, what + "[" + i + "] is missing (a sparse array is not allowed)");
+    var v = list[i];
+    if (v === undefined || v === null) throw E(code, what + "[" + i + "] is missing (a nullish array entry is not allowed)");
+    // defineProperty, not `out[i] = v`: a plain assignment invokes an inherited Array.prototype[i] SETTER
+    // ([[Set]]) if one is polluted in, which could leave `out` sparse; [[DefineOwnProperty]] always makes
+    // an own data property, so the snapshot is dense regardless of prototype pollution.
+    intrinsic.defineProperty(out, i, { value: v, writable: true, enumerable: true, configurable: true });
+  }
+  return out;
+}
+
 // makeBuilder(ctx) -> the bound producing primitives. ctx = { ErrorClass, prefix, O, NS, NAME_SCHEMA,
 // SPKI_SCHEMA, EXT_DECODERS }. `E(kind, msg, cause)` builds a `<prefix>/<kind>` typed error.
 function makeBuilder(ctx) {
@@ -593,23 +621,9 @@ function makeBuilder(ctx) {
     if (guard.bytes.isByteSource(v)) return guard.bytes.snapshotSource(v, ErrorClass, ctx.prefix + "/bad-input", what);
     throw E("bad-input", what + " must be a DER Buffer");
   }
-  // A caller-supplied array a builder is about to map over: reject a sparse hole or a nullish entry HERE
-  // as a typed error. Array.prototype.map SKIPS a hole, which would otherwise reach Buffer.concat as a
-  // native ERR_INVALID_ARG_TYPE and, on a huge sparse length, traverse the empty slots. Test OWN-property
-  // presence at each index BEFORE reading it: a bare `list[i]` on a hole walks the prototype chain, so a
-  // polluted `Array.prototype[i]` would read as a value and slip a hole past the check while map still
-  // skips it. Fails fast at the first bad index, so the length alone can never force a walk. Returns the
-  // validated dense array for the caller to map normally.
-  function reqDenseArray(list, what) {
-    if (!_isArray(list)) throw E("bad-input", what + " must be an array");
-    var n = list.length;
-    for (var i = 0; i < n; i++) {
-      if (!intrinsic.hasOwn(list, i)) throw E("bad-input", what + "[" + i + "] is missing (a sparse array is not allowed)");
-      var v = list[i];
-      if (v === undefined || v === null) throw E("bad-input", what + "[" + i + "] is missing (a nullish array entry is not allowed)");
-    }
-    return list;
-  }
+  // The bound 2-arg form every makeBuilder consumer calls (`_b.reqDenseArray(list, what)`); it delegates
+  // to the standalone guard above with this builder's namespace, so the density rule lives in ONE place.
+  function reqDenseArray(list, what) { return reqDenseArrayImpl(list, what, rawErr, ctx.prefix + "/bad-input"); }
   // A caller-supplied DER a builder validates with a PEM-accepting parser and then embeds verbatim with
   // b.raw. Those parsers unwrap PEM from a byte source, so a PEM-armored input (a Buffer straight from
   // fs.readFileSync) passes the parse, but b.raw embeds the raw ASCII armor -- which the enclosing
@@ -817,4 +831,10 @@ function tbsSerialNumber(cert) {
   return asn1.read.integer(tbs.children[hasVersion ? 1 : 0]);
 }
 
-module.exports = { makeBuilder: makeBuilder, KU_BIT: KU_BIT, tbsNameField: tbsNameField, tbsSerialNumber: tbsSerialNumber };
+// Frozen so a co-resident cannot reassign an exported guard (e.g. reqDenseArray) to bypass it: the
+// standalone consumers read reqDenseArray off this object at call time, so the object holding it must be
+// immutable, the way the guard-* modules freeze their surfaces.
+// Frozen so a co-resident cannot reassign an exported guard (e.g. reqDenseArray) to bypass it: the
+// standalone consumers read reqDenseArray off this object at call time, so the object holding it must be
+// immutable, the way the guard-* modules freeze their surfaces.
+module.exports = intrinsic.freeze({ makeBuilder: makeBuilder, reqDenseArray: reqDenseArrayImpl, KU_BIT: KU_BIT, tbsNameField: tbsNameField, tbsSerialNumber: tbsSerialNumber });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.5.37",
+  "version": "0.5.38",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:1796fef8-97af-4412-bcd2-31524856507a",
+  "serialNumber": "urn:uuid:fe024f86-e1b5-48d0-97ee-173c19cc63b0",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-30T00:38:29.705Z",
+    "timestamp": "2026-08-30T02:10:51.770Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.5.37",
+      "bom-ref": "@blamejs/pki@0.5.38",
       "type": "application",
       "name": "pki",
-      "version": "0.5.37",
+      "version": "0.5.38",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.5.37",
+      "purl": "pkg:npm/%40blamejs/pki@0.5.38",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.5.37",
+      "ref": "@blamejs/pki@0.5.38",
       "dependsOn": []
     }
   ]