@blamejs/pki 0.6.54 → 0.7.0

package/lib/tls-cert-compress.js

@@ -35,12 +35,13 @@
  *
  *   All three registered algorithms (zlib, brotli and zstd) are implemented,
  *   and each is offered only where the running Node can decompress it safely. A
- *   decompressor must fault on a frame it could not finish; where one instead
- *   returns a short result and reports the whole input consumed, a peer could cut
- *   a frame's tail and have the receiver read a prefix as the whole message. Any
- *   algorithm whose decompressor behaves that way is dropped at startup and is
- *   then neither advertised nor accepted. On the current long-term-support Node
- *   this leaves zlib and brotli.
+ *   decompressor must fault on a frame it could not finish. At load each is
+ *   handed a frame with its last two bytes cut, and one that returns anything at
+ *   all rather than faulting is dropped, because a runtime that accepts a cut
+ *   frame lets a peer strip a frame's tail and have the receiver read a prefix as
+ *   the whole message. A dropped algorithm is then neither compressed to nor
+ *   accepted. At the Node 24.21 engine floor all three qualify; on a runtime
+ *   where one does not, it is dropped.
  *
  * @card
  *   Encode and decode RFC 8879 TLS compressed certificate messages and the

package/lib/vendor/MANIFEST.json

@@ -1,4 +1,4 @@
 {
-  "_comment": "Vendored dependencies — none currently. @blamejs/pki's cryptography runs entirely on Node's built-in node:crypto: the classical algorithm set (RSA, ECDSA, EdDSA, ECDH, AES, HMAC, HKDF, PBKDF2, the SHA family) AND the FIPS 203/204/205 post-quantum algorithms (ML-KEM, ML-DSA, SLH-DSA) via the platform OpenSSL 3.5 that the Node engine floor (>=24.19) ships. A built-in ships zero bytes and is OpenSSL-interoperable by construction, so no crypto bundle is vendored. A package is added here ONLY when a specific operation is confirmed missing from the engine floor; see lib/vendor/README.md for the policy.",
+  "_comment": "Vendored dependencies: none currently. @blamejs/pki's cryptography runs entirely on Node's built-in node:crypto: the classical algorithm set (RSA, ECDSA, EdDSA, ECDH, AES, HMAC, HKDF, PBKDF2, the SHA family) AND the FIPS 203/204/205 post-quantum algorithms (ML-KEM, ML-DSA, SLH-DSA) via the platform OpenSSL 3.5 that the Node engine floor (>=24.21) ships. A built-in ships zero bytes and is OpenSSL-interoperable by construction, so no crypto bundle is vendored. A package is added here ONLY when a specific operation is confirmed missing from the engine floor; see lib/vendor/README.md for the policy.",
   "packages": {}
 }

package/lib/vendor/README.md

@@ -6,7 +6,7 @@ nothing. This directory holds only the manifest.
 ## Native-first crypto
 
 The toolkit's cryptography runs entirely on Node's built-in `node:crypto`. The
-engine floor (Node `>=24.19`) links OpenSSL 3.5, which provides:
+engine floor (Node `>=24.21`) links OpenSSL 3.5, which provides:
 
 - the full classical set: RSA (PKCS#1 v1.5, PSS, OAEP), ECDSA, EdDSA
   (Ed25519/Ed448), ECDH including X25519 and X448, AES (GCM/CBC/CTR/KW), HMAC,

package/lib/webauthn-mds.js

@@ -139,27 +139,35 @@ function _verifyMetadataBlob(blob, opts) {
   opts = opts || {};
   if (!_isPlainObject(opts)) throw _err("webauthn/bad-input", "opts must be an object");
   guard.identifier.assertKnownKeys(opts, _BLOB_OPTS, _err, "webauthn/bad-input", "opts has an unknown key ");
-  var roots = opts.rootCertificates;
+  /** @internal Every option is read here, once, into a plain snapshot, and validation, the checks and
+   * the result all read that snapshot. An option reached through an accessor answers each read
+   * separately, so a baseline that answered absent where the rollback comparison runs and present
+   * where the result is built skipped the comparison and still reported a baseline as checked.
+   * Read as the rest of the file reads an option, `opts.<name>`, so an inherited one still counts. */
+  var o = guard.identifier.snapshotOptions(opts, _BLOB_OPTS);
+
+  var roots = o.rootCertificates;
   if (!Array.isArray(roots) || roots.length === 0) {
     throw _err("webauthn/metadata-no-root", "verifying a metadata BLOB requires opts.rootCertificates -- the FIDO root(s) to anchor it to; this library bundles none");
   }
-  if (opts.time !== undefined) guard.time.assertValid(opts.time, _err, "webauthn/bad-input", "opts.time");
-  var at = opts.time === undefined ? new Date() : opts.time;
-  if (opts.previousNo !== undefined && (!Number.isSafeInteger(opts.previousNo) || opts.previousNo < 0)) {
+  if (o.time !== undefined) guard.time.assertValid(o.time, _err, "webauthn/bad-input", "opts.time");
+  var at = o.time === undefined ? new Date() : o.time;
+  if (o.previousNo !== undefined && (!Number.isSafeInteger(o.previousNo) || o.previousNo < 0)) {
     throw _err("webauthn/bad-input", "opts.previousNo must be a non-negative safe integer");
   }
   ["requireRollbackCheck", "allowStale", "rejectUnknownStatus"].forEach(function (k) {
-    if (opts[k] !== undefined && typeof opts[k] !== "boolean") {
+    if (o[k] !== undefined && typeof o[k] !== "boolean") {
       throw _err("webauthn/bad-input", "opts." + k + " must be a boolean");
     }
   });
-  if (opts.statusPolicy !== undefined && typeof opts.statusPolicy !== "function" &&
-      opts.statusPolicy !== "any" && opts.statusPolicy !== "latest-by-date") {
+  if (o.statusPolicy !== undefined && typeof o.statusPolicy !== "function" &&
+      o.statusPolicy !== "any" && o.statusPolicy !== "latest-by-date") {
     throw _err("webauthn/bad-input", "opts.statusPolicy must be \"any\", \"latest-by-date\", or a function");
   }
-  if (opts.requireRollbackCheck === true && opts.previousNo === undefined) {
+  if (o.requireRollbackCheck === true && o.previousNo === undefined) {
     throw _err("webauthn/metadata-no-baseline", "opts.requireRollbackCheck was set without opts.previousNo, so there is no baseline to compare against");
   }
+  opts = o;
   var anchors = roots.map(function (r, i) { return _asCert(r, "opts.rootCertificates[" + i + "]"); });
 
   var raw = guard.bytes.isByteSource(blob)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.54",
+  "version": "0.7.0",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",
@@ -51,7 +51,7 @@
     "owns-its-stack"
   ],
   "engines": {
-    "node": ">=24.19.0"
+    "node": ">=24.21.0"
   },
   "files": [
     "index.js",
@@ -68,7 +68,8 @@
     "test": "node test/smoke.js",
     "lint": "eslint --max-warnings 0 .",
     "fuzz": "npm ci --prefix fuzz && npx --prefix fuzz jazzer fuzz/asn1-der.fuzz.js -- -max_total_time=60",
-    "gates": "node test/layer-0-primitives/codebase-patterns.test.js && node scripts/validate-source-comment-blocks.js && node scripts/check-api-snapshot.js && node scripts/check-spelling-consistency.js",
+    "gates": "node test/layer-0-primitives/codebase-patterns.test.js && node scripts/validate-source-comment-blocks.js && node scripts/check-api-snapshot.js && node scripts/check-spelling-consistency.js && node scripts/check-engine-floor.js",
+    "check:engine-floor": "node scripts/check-engine-floor.js",
     "check:spelling": "node scripts/check-spelling-consistency.js",
     "coverage": "c8 --include=lib/** --include=index.js --reporter=text-summary --reporter=lcov node test/smoke.js",
     "check:prose": "node scripts/check-operator-prose.js",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3fcb367d-0079-41f4-bd25-0141050006d7",
+  "serialNumber": "urn:uuid:fb4bc11f-cd39-480a-b276-ec20713541e7",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-07T18:01:28.536Z",
+    "timestamp": "2026-09-10T03:36:52.727Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -15,18 +15,18 @@
       {
         "vendor": "npm",
         "name": "cli",
-        "version": "11.17.0"
+        "version": "11.19.0"
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.54",
+      "bom-ref": "@blamejs/pki@0.7.0",
       "type": "application",
       "name": "pki",
-      "version": "0.6.54",
+      "version": "0.7.0",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.54",
+      "purl": "pkg:npm/%40blamejs/pki@0.7.0",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.54",
+      "ref": "@blamejs/pki@0.7.0",
       "dependsOn": []
     }
   ]