@blamejs/pki 0.6.27 → 0.6.28

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.6.28 — 2026-09-02
+
+pki.path.build returns the best accepted path when the candidate cap is reached during policy ranking, instead of discarding it.
+
+### Fixed
+
+- pki.path.build with userInitialPolicySet no longer throws path/build-limit after it has already accepted a valid path. When the candidate cap is reached during policy ranking, it returns the best-policy accepted path (forward and reverse directions), and candidatesConsidered reflects the full expansion count. It throws path/build-limit only when no valid path was accepted before the cap. This restores the pre-0.6.26 behavior for a policy set that no single path fully covers under a bounded search.
+
 ## v0.6.27 — 2026-09-02
 
 The SCEP client can reach a CA through a forward proxy, with Basic authentication over an https proxy.

package/lib/guard-limits.js

@@ -49,6 +49,7 @@ function counter(max, E, code, label) {
       n += 1;
       if (n > max) throw E(code, (label || "decoded item") + " count exceeds the cap " + max);
     },
+    count: function () { return n; },
   };
 }
 

package/lib/path-validate.js

@@ -2305,7 +2305,7 @@ async function _fetchAiaIssuers(current, aia) {
  * @opts  maxAiaPerCert          Cap on caIssuers URLs tried per certificate (default `C.LIMITS.PATH_AIA_MAX_PER_CERT`).
  * @opts  aiaTimeout             Per-fetch timeout in ms, forwarded to the transport.
  * @opts  maxResponseBytes       Per-fetch response size cap, forwarded to the transport (tightenable downward only).
- * @opts  (validate options)     Every `pki.path.validate` option (`requiredEku`, `revocationChecker`, `checkPurpose`, the initial policy inputs, ...) is forwarded unchanged. When `userInitialPolicySet` is supplied, build returns the accepted path whose user-constrained policy set best satisfies it (RFC 4158 sec. 4 forward policy chaining) rather than the first accepted path; `validate` still gates every path, so this changes only which valid path is chosen. The ranking explores more of the candidate graph than a first-accept build, so it is bounded by `maxCandidatesConsidered` like the rest of the search: a cap too tight for the ranking reaches `path/build-limit`. An `anyPolicy` entry makes the set unconstrained, so ranking is skipped and the first accepted path is returned.
+ * @opts  (validate options)     Every `pki.path.validate` option (`requiredEku`, `revocationChecker`, `checkPurpose`, the initial policy inputs, ...) is forwarded unchanged. When `userInitialPolicySet` is supplied, build returns the accepted path whose user-constrained policy set best satisfies it (RFC 4158 sec. 4 forward policy chaining) rather than the first accepted path; `validate` still gates every path, so this changes only which valid path is chosen. The ranking explores more of the candidate graph than a first-accept build, so it is bounded by `maxCandidatesConsidered` like the rest of the search. Reaching that cap means stop looking, not nothing found: if a valid path was already accepted, build returns the best-policy one of those; it reaches `path/build-limit` only when the cap is hit before any valid path is accepted. An `anyPolicy` entry makes the set unconstrained, so ranking is skipped and the first accepted path is returned.
  * @example
  *   var pair = await pki.key.generate("Ed25519");
  *   var pemString = await pki.x509.sign({ subject: "Example Root", subjectPublicKey: await pki.key.export(pair.publicKey),
@@ -2424,6 +2424,7 @@ async function build(leaf, opts) {
   }
   var accepted = selectByPolicy ? [] : null;
 
+  try {
   if (direction === "reverse") {
     var rstack = [];
     for (var rsi = 0; rsi < anchors.length; rsi++) intrinsic.push(rstack, { chain: [], hop: 0, keys: new Set([identityKey(leafCert)]), anchor: anchors[rsi] });
@@ -2523,6 +2524,11 @@ async function build(leaf, opts) {
     considered += _pushCandidates(frame, scored, stack, counter);
   }
   }
+  } catch (_limitErr) {
+    // allow:swallow-unverified the candidate cap means "stop looking", not "nothing found": once a valid path has
+    if (!(selectByPolicy && accepted && accepted.length && _limitErr && _limitErr.code === "path/build-limit")) throw _limitErr;
+    considered = counter.count();
+  }
 
   if (selectByPolicy && !success && accepted.length) success = _bestByPolicy(accepted, uipsDistinct);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.27",
+  "version": "0.6.28",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:9742df6c-59a0-4fce-a64b-ddc916ee2fba",
+  "serialNumber": "urn:uuid:74721cd1-1687-4508-a102-a5ca6b30f23d",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-02T20:36:04.064Z",
+    "timestamp": "2026-09-02T21:18:19.420Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.27",
+      "bom-ref": "@blamejs/pki@0.6.28",
       "type": "application",
       "name": "pki",
-      "version": "0.6.27",
+      "version": "0.6.28",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.27",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.28",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.27",
+      "ref": "@blamejs/pki@0.6.28",
       "dependsOn": []
     }
   ]