@blamejs/pki 0.5.5 → 0.5.7

package/lib/tsp-sign.js

@@ -27,18 +27,40 @@ var guard = require("./guard-all");
 var frameworkError = require("./framework-error");
 
 var pkix = require("./schema-pkix");
+var pkiBuild = require("./pki-build");
 var TspError = frameworkError.TspError;
 var _NS = pkix.makeNS("tsp", TspError, oid);
 var b = asn1.build;
 function _err(code, message, cause) { return new TspError(code, message, cause); }
 function O(name) { return oid.byName(name); }
 
+// The shared authoring-side builder, for the same pre-encoded-Extension validation every other
+// request builder uses (a CSR's extensionRequest, a CRMF CertTemplate, a CRL's entry extensions).
+var _b = pkiBuild.makeBuilder({
+  ErrorClass: TspError, prefix: "tsp", O: O, NS: _NS,
+  NAME_SCHEMA: pkix.name(_NS), SPKI_SCHEMA: pkix.spki(_NS),
+});
+
 // Digest names whose imprint / certHash this producer supports (the SHA-2 family).
 var NODE_DIGEST = { sha256: "sha256", sha384: "sha384", sha512: "sha512" };
 // The message-imprint hash MUST be exactly the digest algorithm's output length (RFC 3161 sec.
 // 2.4.1 -- hashedMessage is "the hash of the datum to be time-stamped").
 var HASH_LEN = { sha256: 32, sha384: 48, sha512: 64 };
 
+// How much a `pki.path.validate` revocationChecked outcome ESTABLISHED, ordered. `false` is "no
+// checker ran at all"; "undetermined" is "one ran and could not answer"; "waived" is an
+// undetermined one a caller chose to pass; "determined" is an explicit good-or-revoked answer.
+// Ranking them lets a caller trying several candidate paths keep the most established outcome any
+// of them reached, rather than whichever happened to run last.
+var _REVOCATION_RANK = { "false": 0, "undetermined": 1, "waived": 2, "determined": 3 };
+function _rankRevocation(v) {
+  var r = _REVOCATION_RANK[String(v)];
+  return r === undefined ? 0 : r;   // an unrecognized value establishes nothing
+}
+function _moreEstablished(candidate, current) {
+  return _rankRevocation(candidate) > _rankRevocation(current);
+}
+
 // A hash AlgorithmIdentifier { OID, NULL } -- messageImprint and ESSCertIDv2 hash algorithms
 // carry an explicit NULL parameter (the form RFC 3161 / RFC 5035 producers emit).
 function _hashAlgId(name) {
@@ -109,7 +131,17 @@ function _signingCertV2(certDer, hashName) {
  *   var token = await pki.tsp.sign(imprint, { cert: signerCertDer, key: signerKeyPkcs8 }, { policy: "1.3.6.1.4.1.1", serialNumber: 1 });
  *   (await pki.cms.verify(token)).valid;   // true
  */
+// Documented `-> Promise`, so a fault leaves as a REJECTION (guard-async); the checks stay
+// synchronous because they read the caller's mutable imprint, TSA material and options.
 function sign(messageImprint, tsa, opts) {
+  // Every caller-owned argument copied at entry and released when the call settles -- see the note
+  // on the same call in x509-sign. The imprint matters most: it is the digest the token attests to.
+  return guard.bytes.fixedCall(TspError, "tsp/bad-input", [
+    [messageImprint, "the messageImprint"], [tsa, "the TSA"], [opts, "pki.tsp.sign options"],
+  ], _sign);
+}
+
+function _sign(messageImprint, tsa, opts) {
   opts = opts || {};
   if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("tsp/bad-input", "pki.tsp.sign options must be an object");
   var mi = messageImprint || {};
@@ -130,10 +162,14 @@ function sign(messageImprint, tsa, opts) {
   // non-Date or an Invalid Date that would encode a garbage GeneralizedTime).
   if (opts.genTime != null) guard.time.assertValid(opts.genTime, _err, "tsp/bad-input", "genTime");
   var genTime = opts.genTime instanceof Date ? opts.genTime : new Date();
-  var fields = [b.integer(1n), _policy(opts.policy), imprint, b.integer(BigInt(opts.serialNumber)), b.generalizedTime(genTime)];
+  // A caller-authored INTEGER is coerced through the shared guard, so a value that is not one is a
+  // typed tsp/bad-input rather than a raw SyntaxError or RangeError out of BigInt() -- an untyped
+  // fault escaping a public verb, which a caller cannot catch by code.
+  var serial = guard.range.authoredInteger(opts.serialNumber, _err, "tsp/bad-input", "serialNumber");
+  var fields = [b.integer(1n), _policy(opts.policy), imprint, b.integer(serial), b.generalizedTime(genTime)];
   if (opts.accuracy) fields.push(_accuracy(opts.accuracy));
   if (opts.ordering === true) fields.push(b.boolean(true));
-  if (opts.nonce != null) fields.push(b.integer(BigInt(opts.nonce)));
+  if (opts.nonce != null) fields.push(b.integer(guard.range.authoredInteger(opts.nonce, _err, "tsp/bad-input", "nonce")));
   var tstInfo = b.sequence(fields);
 
   var signCert = { type: "signingCertificateV2", values: [_signingCertV2(certDer, certHashAlg)] };
@@ -237,12 +273,26 @@ function request(messageImprint, opts) {
   // extensions in schema order. certReq DEFAULT FALSE -> only an explicit TRUE is encoded (DER).
   var fields = [b.integer(1n), imprint];
   if (opts.reqPolicy != null) fields.push(_policy(opts.reqPolicy));
-  if (opts.nonce != null) fields.push(b.integer(BigInt(opts.nonce)));
+  if (opts.nonce != null) fields.push(b.integer(guard.range.authoredInteger(opts.nonce, _err, "tsp/bad-input", "nonce")));
   if (opts.certReq != null && typeof opts.certReq !== "boolean") throw _err("tsp/bad-input", "certReq must be a boolean");
   if (opts.certReq === true) fields.push(b.boolean(true));
   if (opts.extensions != null) {
     if (!Array.isArray(opts.extensions) || !opts.extensions.every(function (e) { return Buffer.isBuffer(e) || e instanceof Uint8Array; })) throw _err("tsp/bad-input", "extensions must be an array of encoded Extension DER buffers");
-    if (opts.extensions.length) fields.push(b.contextConstructed(0, Buffer.concat(opts.extensions.map(function (e) { return Buffer.from(e); }))));
+    // Each pre-encoded Extension is validated as one, and its extnID must not repeat -- the same
+    // gate every other request builder applies. Spliced in unchecked, a caller relaying a blob it
+    // did not author put fully chosen bytes inside [0] and this encoder emitted DER its own
+    // parseRequest refuses: an undecodable value, a duplicate extnID, an explicit critical=FALSE
+    // the DER DEFAULT rule forbids.
+    var seenExt = {};
+    var encoded = opts.extensions.map(function (e, i) {
+      var der = Buffer.from(e);
+      _b.assertValidExtension(der, i);
+      var extnId = asn1.read.oid(asn1.decode(der).children[0]);
+      if (seenExt[extnId]) throw _err("tsp/bad-input", "duplicate request extension " + extnId + " (RFC 5280 sec. 4.2)");
+      seenExt[extnId] = true;
+      return der;
+    });
+    if (encoded.length) fields.push(b.contextConstructed(0, Buffer.concat(encoded)));
   }
   var der = b.sequence(fields);
   return opts.pem ? schemaTsp.pemEncode(der, "TIMESTAMP REQUEST") : der;
@@ -564,7 +614,8 @@ function _buildTsaChains(leaf, pool) {
  * PEM (never a parsed object -- every checked field is read from the CMS-verified eContent, so a
  * mutated parsed structure cannot desynchronize the checks from the signed bytes). `data` is the
  * original bytes (hashed under the token's messageImprint algorithm) or a precomputed
- * `{ hashAlgorithm, hashedMessage }`. Returns `{ valid, trusted, genTime, accuracy, serialNumber,
+ * `{ hashAlgorithm, hashedMessage }`. Returns `{ valid, trusted, revocationChecked,
+ * anchorConstraints, genTime, accuracy, serialNumber,
  * serialNumberHex, policy, nonce, tsa, tstInfo, signer, code?, reason? }`. `valid` is true only
  * when the CMS signature, the imprint match, the eContentType, the ESSCertID(V2) binding, the
  * RFC 3161 sec. 2.3 critical single-`timeStamping` extendedKeyUsage rule, the requested nonce (when
@@ -579,11 +630,19 @@ function _buildTsaChains(leaf, pool) {
  * accepting one. A timestamp is archived precisely to be re-read years later, and one boolean
  * cannot answer both questions then.
  *
+ * `revocationChecked` is the third claim, for the same reason. Revocation runs only when a
+ * `revocationChecker` is supplied, so a `trusted` token whose TSA was never checked against a CRL
+ * or an OCSP responder reads identically to one established un-revoked -- unless the verdict says
+ * which. It is `false` whenever no path ran at all. `anchorConstraints` carries whatever the anchor
+ * itself constrained, from `pki.path.validate`.
+ *
  * @opts  trustAnchor   Anchor `{ name, publicKey, algorithm }` -- runs `pki.path.validate` on the
  *                       TSA certificate chain ordered from the token's embedded certificates
- *                       (validity at genTime, requiredEku timeStamping, revocation), so a TSA under
- *                       an intermediate CA validates, not only one directly under the anchor. Omit
- *                       to verify signature + imprint + binding + EKU only and anchor the cert yourself.
+ *                       (validity at genTime, requiredEku timeStamping, and revocation when a
+ *                       `revocationChecker` is supplied -- `revocationChecked` reports which), so a
+ *                       TSA under an intermediate CA validates, not only one directly under the
+ *                       anchor. Omit to verify signature + imprint + binding + EKU only and anchor
+ *                       the cert yourself.
  * @opts  nonce         Require the token's TSTInfo.nonce to equal this (a number/BigInt).
  * @opts  reqPolicy     Require the token's policy to equal this (an OID name or dotted string).
  * @opts  certs         Out-of-band TSA certificates (an array of DER `Buffer`s) added to the signer
@@ -630,8 +689,15 @@ async function verify(token, data, opts) {
   // `res.trusted` must get an answer on both branches -- an undefined on the failure path is the
   // same "cannot tell what was checked" the field was added to remove, and `!res.trusted` reading
   // true by accident is not the same as its reading true because nothing anchored the TSA.
+  // What a path established travels with the REFUSAL as well. Hardcoding these to false/null here
+  // would misreport the one case the field matters most for: a path that ran, established the TSA
+  // REVOKED, and refused on that basis did check revocation, and saying it did not is the same
+  // "cannot tell what was checked" the field was added to remove. They stay false/null until a path
+  // actually produces them, which is the honest answer before one runs.
+  var revocationChecked = false;
+  var anchorConstraints = null;
   function fail(code, reason) {
-    return { valid: false, trusted: false, code: code, reason: reason || null, genTime: tst.genTime, accuracy: tst.accuracy, serialNumber: tst.serialNumber, serialNumberHex: tst.serialNumberHex, policy: tst.policy, nonce: tst.nonce, tsa: tst.tsa, tstInfo: tst, signer: null };
+    return { valid: false, trusted: false, revocationChecked: revocationChecked, anchorConstraints: anchorConstraints, code: code, reason: reason || null, genTime: tst.genTime, accuracy: tst.accuracy, serialNumber: tst.serialNumber, serialNumberHex: tst.serialNumberHex, policy: tst.policy, nonce: tst.nonce, tsa: tst.tsa, tstInfo: tst, signer: null };
   }
   // M12 -- the CMS signature over the exact RFC 5652 sec. 5.4 preimage (message-digest bound to the
   // authenticated eContent). cms.verify re-parses the same bytes; a failure is a fail-closed verdict.
@@ -647,7 +713,7 @@ async function verify(token, data, opts) {
   if (mi !== true) return fail(mi);
   // M14 -- if a request nonce is supplied, the token MUST echo it (BigInt-exact).
   if (opts.nonce != null) {
-    var wantNonce = BigInt(opts.nonce);
+    var wantNonce = guard.range.authoredInteger(opts.nonce, _err, "tsp/bad-input", "opts.nonce");
     if (tst.nonce == null || tst.nonce !== wantNonce) return fail("tsp/nonce-mismatch");
   }
   // M15 -- if the requested policy is supplied, the token's policy MUST equal it.
@@ -713,23 +779,54 @@ async function verify(token, data, opts) {
       // end of the chain and not the other, and a root explicitly distrusted for timestamping would
       // still answer trusted. The purpose is not a caller choice here: this verb validates timestamp
       // tokens and nothing else, so there is exactly one purpose its anchors can be judged under.
+      // EVERY path result goes through this one function, so none can be produced without being
+      // accumulated. The alternative -- validating in several places and accumulating afterwards --
+      // is what let a result be overwritten before it was counted, first across candidate chains and
+      // then across the two endpoints of one candidate. There is now one door and it always counts.
+      //
+      // The two fields accumulate INDEPENDENTLY because they are independent facts. Whether
+      // revocation was established and which anchor constraints were consulted do not imply each
+      // other: an anchor that rejects the TSA on its own purposes or distrustAfter metadata, with no
+      // revocationChecker configured, establishes constraints while establishing nothing about
+      // revocation.
+      async function validateAt(chain, when) {
+        var res = await pathValidate.validate(chain, {
+          time: when, trustAnchor: opts.trustAnchor, requiredEku: ["timeStamping"], checkPurpose: "timeStamping", revocationChecker: opts.revocationChecker,
+        });
+        // The most any attempt ESTABLISHED, kept across every attempt: backtracking tries several
+        // chains for one TSA certificate and a fractional genTime validates each at two endpoints,
+        // so an attempt that fails earlier than another must not erase what that other established.
+        if (_moreEstablished(res.revocationChecked, revocationChecked)) revocationChecked = res.revocationChecked;
+        // Every attempt validates against the SAME opts.trustAnchor under the same purpose, so any
+        // non-null value describes that one anchor; the first to report them is as good as the last.
+        if (anchorConstraints == null && res.anchorConstraints != null) anchorConstraints = res.anchorConstraints;
+        return res;
+      }
       var chains = _buildTsaChains(pkiX509.parse(tsaCertDer), pool);
       for (var ci = 0; ci < chains.length && !(pathRes && pathRes.valid); ci++) {
-        pathRes = await pathValidate.validate(chains[ci], {
-          time: floorT, trustAnchor: opts.trustAnchor, requiredEku: ["timeStamping"], checkPurpose: "timeStamping", revocationChecker: opts.revocationChecker,
-        });
-        if (pathRes.valid && ceilT !== floorT) {
-          pathRes = await pathValidate.validate(chains[ci], {
-            time: ceilT, trustAnchor: opts.trustAnchor, requiredEku: ["timeStamping"], checkPurpose: "timeStamping", revocationChecker: opts.revocationChecker,
-          });
-        }
+        pathRes = await validateAt(chains[ci], floorT);
+        if (pathRes.valid && ceilT !== floorT) pathRes = await validateAt(chains[ci], ceilT);
       }
     } catch (e) { return fail("tsp/untrusted-tsa", (e && e.message) || String(e)); }
+    // On a REFUSAL the question is whether ANYTHING established the TSA's revocation status, so the
+    // accumulated best answers it: a candidate that reached the checker and was rejected as revoked
+    // did check revocation, and saying otherwise would misdescribe the reason for the refusal.
     if (!pathRes || !pathRes.valid) return fail("tsp/untrusted-tsa", "the TSA certificate did not validate to the trust anchor at genTime");
+    // On ACCEPTANCE the question is narrower and the accumulated best would OVERCLAIM: what matters
+    // is what was checked on the path actually accepted, not what some rejected candidate managed.
+    // The loop stops at the first valid path, so `pathRes` is that path.
+    revocationChecked = pathRes.revocationChecked;
+    anchorConstraints = pathRes.anchorConstraints;
+    // Reduced to a bare `trusted: true`, this answered the same way whether the TSA was established
+    // un-revoked or revocation was never consulted at all -- and revocation only runs when a
+    // revocationChecker is supplied, so the second case is the DEFAULT. A caller archiving a
+    // timestamp verdict could not tell the two apart later, which is the distinction the
+    // valid/trusted split exists to keep.
     trusted = true;
   }
   return {
-    valid: true, trusted: trusted, genTime: tst.genTime, accuracy: tst.accuracy,
+    valid: true, trusted: trusted, revocationChecked: revocationChecked, anchorConstraints: anchorConstraints,
+    genTime: tst.genTime, accuracy: tst.accuracy,
     serialNumber: tst.serialNumber, serialNumberHex: tst.serialNumberHex,
     policy: tst.policy, policyName: tst.policyName, nonce: tst.nonce, tsa: tst.tsa,
     tstInfo: tst, signer: { cert: tsaCertDer, sid: signer.sid },

package/lib/validator-tpm.js

@@ -225,7 +225,7 @@ function normalizeObjectAttributePolicy(policy, E, code) {
       // canonical round-trip -- the same three checks written here by hand, and now written
       // once. It also decodes, so the hex path cannot validate one string and decode another.
       allow = ap.allow.map(function (entry, i) {
-        if (Buffer.isBuffer(entry)) return entry;
+        if (Buffer.isBuffer(entry)) return guard.bytes.snapshot(entry, E, code, "opts.tpmPolicy.authPolicy.allow[" + i + "]");
         var label = "opts.tpmPolicy.authPolicy.allow[" + i + "]";
         if (typeof entry !== "string" || entry.length === 0) {
           throw new E(code, label + " must be a Buffer or an even-length hex string");

package/lib/webauthn-mds.js

@@ -233,7 +233,7 @@ function _asCert(v, label) {
 // with this toolkit: which metadata authority to trust is the operator's choice, and a verifier
 // that bundled its own would be deciding trust on the caller's behalf.
 function verifyMetadataBlob(blob, opts) {
-  return Promise.resolve().then(function () { return _verifyMetadataBlob(blob, opts); });
+  return guard.async.deferred(function () { return _verifyMetadataBlob(blob, opts); });
 }
 
 function _verifyMetadataBlob(blob, opts) {

package/lib/webauthn.js

@@ -531,7 +531,7 @@ var _FORMAT_SCOPED_BOOLEAN_OPTS = ["verifySafetyNetJws", "requireCtsProfileMatch
 // object cannot recurse without end.
 function _cloneParsed(v, depth) {
   if (depth > 64) throw _err("webauthn/bad-input", "opts.rootCertificates[] is nested too deeply to be a parsed certificate");
-  if (Buffer.isBuffer(v) || v instanceof Uint8Array) return Buffer.from(v);
+  if (Buffer.isBuffer(v) || v instanceof Uint8Array) return guard.bytes.snapshot(v, _err, "webauthn/bad-input", "a byte field of opts.rootCertificates[]");
   if (Array.isArray(v)) return v.map(function (x) { return _cloneParsed(x, depth + 1); });
   if (v instanceof Date) return new Date(v.getTime());
   if (v && typeof v === "object") {

package/lib/x509-sign.js

@@ -78,7 +78,7 @@ function _skiValueOf(caCert) {
   return null;
 }
 function _akiKeyId(val, ctx) {
-  if (Buffer.isBuffer(val)) return val;
+  if (Buffer.isBuffer(val)) return guard.bytes.snapshot(val, CertificateError, "x509/bad-input", "the authorityKeyIdentifier keyIdentifier");
   if (val === true) {
     if (ctx.issuerCert) { var ski = _skiValueOf(ctx.issuerCert); if (ski) return ski; }
     return _spkiKeyId(ctx.issuerSpki);
@@ -265,7 +265,16 @@ function _hasCriticalSan(extSpec) {
  *   pki.schema.x509.parse(root).subject.dn;   // "CN=Example Root CA"
  */
 function sign(spec, issuer, opts) {
-  return Promise.resolve().then(function () { return _sign(spec, issuer, opts); });
+  // EVERY caller-owned argument is copied before a field of any of them is read, and every copy is
+  // cleared when the call settles. The checks below run NOW, and the values they approved are
+  // encoded, signed and emitted several promise turns afterwards, while the caller still owns all
+  // three objects -- so a spec, an option or a signer read again after the first turn need not be
+  // the one that passed. Copying only some of them leaves the rest reachable; copying without the
+  // release leaves a duplicate of whatever secret was nested in them. guard.bytes.fixArguments is
+  // both halves, and is what every producing verb in the toolkit opens with.
+  return guard.bytes.fixedCall(CertificateError, "x509/bad-input", [
+    [spec, "the certificate spec"], [issuer, "the issuer"], [opts, "pki.x509.sign options"],
+  ], _sign);
 }
 
 function _sign(spec, issuer, opts) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.5.5",
+  "version": "0.5.7",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:e4afed62-75b0-4b79-b65c-4d16c17ee70b",
+  "serialNumber": "urn:uuid:a8c014a2-3631-443a-b33d-f10501d992fb",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-15T23:54:15.184Z",
+    "timestamp": "2026-08-16T09:48:05.398Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.5.5",
+      "bom-ref": "@blamejs/pki@0.5.7",
       "type": "application",
       "name": "pki",
-      "version": "0.5.5",
+      "version": "0.5.7",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.5.5",
+      "purl": "pkg:npm/%40blamejs/pki@0.5.7",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.5.5",
+      "ref": "@blamejs/pki@0.5.7",
       "dependsOn": []
     }
   ]