@blamejs/pki 0.6.54 → 0.7.0

package/lib/guard-identifier.js

@@ -87,6 +87,15 @@ function assertKnownKeys(obj, known, E, code, message) {
   });
 }
 
+// @enforced-by behavioral -- reading a property twice has no rename-proof code shape; the RED
+// @enforced-by behavioral -- vectors that drive an accessor-backed option are the guard
+function snapshotOptions(obj, known) {
+  var out = _create(null);
+  if (obj === null || obj === undefined) return out;
+  _forEach(_getOwnPropertyNames(known), function (k) { out[k] = obj[k]; });
+  return out;
+}
+
 var _PRISTINE_OBJECT_PROTO = (function () {
   var s = _create(null);
   _forEach(["constructor", "hasOwnProperty", "isPrototypeOf", "propertyIsEnumerable", "toLocaleString",
@@ -441,6 +450,7 @@ module.exports = intrinsic.freeze({
   isPlainRecord: isPlainRecord,
   optionsObject: optionsObject,
   refuseAccessorFields: refuseAccessorFields,
+  snapshotOptions: snapshotOptions,
   readableNames: readableNames,
   readableIndices: readableIndices
 });

package/lib/oid.js

@@ -192,6 +192,13 @@ var FAMILIES = Object.assign(Object.create(null), {
   entrustAlg: { base: [1, 2, 840, 113533, 7, 66], of: {
     passwordBasedMac: 13, kemBasedMac: 16, dhBasedMac: 30 } },
 
+  /** @internal ANSI X9.42 (RFC 3279 sec. 2.3.3): the SubjectPublicKeyInfo algorithm an X.509
+   * Diffie-Hellman certificate names, whose parameters are DomainParameters rather than the PKCS#3
+   * DHParameter that pkcs3 below names. */
+  ansiX942: { base: [1, 2, 840, 10046, 2], of: { dhpublicnumber: 1 } },
+
+  pkcs3: { base: [1, 2, 840, 113549, 1, 3], of: { dhKeyAgreement: 1 } },
+
   pkcs12BagTypes: { base: [1, 2, 840, 113549, 1, 12, 10, 1], of: {
     keyBag: 1, pkcs8ShroudedKeyBag: 2, certBag: 3, crlBag: 4, secretBag: 5, safeContentsBag: 6 } },
 
@@ -226,6 +233,7 @@ var FAMILIES = Object.assign(Object.create(null), {
 
   pkixAlg: { base: [1, 3, 6, 1, 5, 5, 7, 6], of: {
     "id-alg-noSignature": 2,
+    "id-dhPop-static-HMAC-SHA1": 3, "id-alg-dhPOP": 4,
     "id-RSASSA-PSS-SHAKE128": 30, "id-RSASSA-PSS-SHAKE256": 31,
     "id-alg-xmss-hashsig": 34, "id-alg-xmssmt-hashsig": 35,
     "id-MLDSA44-RSA2048-PSS-SHA256": 37, "id-MLDSA44-RSA2048-PKCS15-SHA256": 38,

package/lib/schema-pkix.js

@@ -182,7 +182,22 @@ function pemDecodeLenient(text, label) {
   return _bufferFrom(_keepBase64(_strSlice(text, bodyStart, ei)), "base64");
 }
 
+/** @internal Every refusal below is built from opts, so opts is checked before the first one can be
+ * reached. A caller that misspells a key otherwise gets a working accept path and a set of refusal
+ * paths that throw `undefined is not a constructor`: the input is still rejected, but as an untyped
+ * runtime error carrying no reason, and the label check silently passes everything. */
+function _requireCoerceOpts(opts) {
+  if (!opts || typeof opts !== "object") throw new TypeError("coerceToDer requires an options object");
+  if (typeof opts.PemError !== "function") throw new TypeError("coerceToDer requires opts.PemError, an error constructor");
+  if (typeof opts.ErrorClass !== "function") throw new TypeError("coerceToDer requires opts.ErrorClass, an error constructor");
+  if (typeof opts.prefix !== "string" || opts.prefix === "") throw new TypeError("coerceToDer requires opts.prefix, a non-empty error-code prefix");
+  if (!(opts.pemLabel === null || typeof opts.pemLabel === "string")) {
+    throw new TypeError("coerceToDer requires opts.pemLabel, a PEM label to enforce or null to accept any");
+  }
+}
+
 function coerceToDer(input, opts) {
+  _requireCoerceOpts(opts);
   if (typeof input === "string") return pemDecode(input, opts.pemLabel, opts.PemError);
   if (guard.bytes.isByteSource(input)) {
     var buf = guard.bytes.source(input, opts.ErrorClass, opts.prefix + "/bad-input", "parse");