@blamejs/pki 0.6.8 → 0.6.9

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.6.9 — 2026-08-31
+
+pki.cmp.verify holds a received PKIMessage to the RFC 9483 sec. 3.5 header rules, and pki.path.build and pki.est read a response body an injected transport returns as any BufferSource, not only a Node Buffer.
+
+### Changed
+
+- pki.cmp.verify holds a received PKIMessage to the RFC 9483 sec. 3.5 receiving-side header rules once its protection verifies: the pvno must be cmp2000(2) or cmp2021(3), the transactionID must be present, and the senderNonce must be present and carry at least 128 bits. A message failing any of these is a fail-closed verdict (cmp/unsupported-version, cmp/bad-transaction-id, cmp/bad-sender-nonce). A cmp1999(1) message stays valid RFC 9810 syntax that pki.cmp.parse still decodes; the profile refuses it only on receipt. pki.cmp.session applies these checks to every response and additionally refuses a waiting ip/cp/kup CertResponse that carries failInfo (RFC 9483 sec. 4.4). A conformant peer is unaffected; a peer that omits a required header field is now refused.
+
+### Fixed
+
+- pki.path.build's opt-in AIA caIssuers fetch reads a certificate an injected transport returns as any BufferSource (a Uint8Array, a raw ArrayBuffer, a DataView), not only a Node Buffer. A typed-array body was coerced to a comma-joined string and failed to parse, silently dropping an AIA-discoverable intermediate from the built path; it is now re-viewed through the byte guard and parsed from its bytes.
+- Every pki.est network verb reads a response body an injected transport returns as any BufferSource, not only a Node Buffer or a string. The transfer decode, the multipart splitter, the response-size checks, and the error diagnostic take the raw bytes through the byte guard, so a cacerts, enrollment, or serverkeygen response delivered in a typed array is parsed and sized from its bytes.
+
 ## v0.6.8 — 2026-08-31
 
 pki.cmp.build assembles the ccr cross-certification request body (RFC 9810 sec. 5.3.11), and the ACME client accepts a response body an injected transport returns as any BufferSource, not only a Node Buffer.

package/lib/cmp-session.js

@@ -847,6 +847,13 @@ function session(opts) {
       if (!resp) return { state: "unexpected", reason: "a " + arm + " carried no CertResponse for certReqId " + activeCertReqId };
       var code = resp.status && resp.status.status ? resp.status.status.code : null;
       var isGrantLeg = _isGranted(code);
+      // RFC 9483 sec. 4.4: a "waiting" CertResponse must not carry failInfo -- a wait is not a failure. Refuse
+      // a contradictory failInfo (mirroring the _classifyError waiting check). A granting status carrying
+      // failInfo is already refused upstream: the parser rejects failInfo alongside a certifiedKeyPair (RFC 9810
+      // sec. 5.3.4), and a grant with no certificate is refused as a missing issued certificate.
+      if (code === 3 && resp.status && resp.status.failInfo != null) {
+        return { state: "unexpected", reason: "a waiting " + arm + " CertResponse must not carry failInfo (RFC 9483 sec. 4.4)" };
+      }
       // Accumulate the AUTHENTICATED caPubs of EVERY ip/cp/kup leg (waiting AND granting): a CA may deliver the
       // issuing chain in a `waiting` response and omit it from the grant, so the leaf's issuer must survive the poll.
       // Bound + validate + dedup the caPubs AS ACCUMULATED, not only when _finish is reached: an authenticated CA

package/lib/cmp-verify.js

@@ -523,6 +523,19 @@ function _bufEq(a, x) {
   return _compare(a, x) === 0;
 }
 function _headerChecks(m, opts) {
+  // RFC 9483 sec. 3.5: the pvno MUST be cmp2000(2) or cmp2021(3) (failInfo unsupportedVersion). The parser
+  // accepts cmp1999(1) as valid RFC 9810 sec. 5.1.1 syntax; the lightweight profile refuses it on receipt.
+  if (m.header.pvno !== 2 && m.header.pvno !== 3) {
+    return { code: "cmp/unsupported-version", reason: "the header pvno is " + m.header.pvno + "; a received PKIMessage MUST carry cmp2000(2) or cmp2021(3) (RFC 9483 sec. 3.5)" };
+  }
+  // RFC 9483 sec. 3.5: the transactionID MUST be present (failInfo badDataFormat).
+  if (!guard.bytes.isByteSource(m.header.transactionID)) {
+    return { code: "cmp/bad-transaction-id", reason: "the header transactionID is absent; a received PKIMessage MUST carry one (RFC 9483 sec. 3.5)" };
+  }
+  // RFC 9483 sec. 3.5: the senderNonce MUST be present and MUST contain at least 128 bits (failInfo badSenderNonce).
+  if (!guard.bytes.isByteSource(m.header.senderNonce) || guard.bytes.lengthOf(m.header.senderNonce) < 16) {
+    return { code: "cmp/bad-sender-nonce", reason: "the header senderNonce is absent or shorter than 128 bits (RFC 9483 sec. 3.5)" };
+  }
   if (opts.transactionID != null && !_bufEq(m.header.transactionID, opts.transactionID)) {
     return { code: "cmp/transaction-id-mismatch", reason: "header.transactionID does not equal the expected value (RFC 9810 sec. 5.1.1)" };
   }
@@ -1110,6 +1123,12 @@ async function _verify(message, opts) {
  * signature path the authenticated header `sender` field MUST match the signer certificate subject (RFC 9483
  * sec. 3.1), so a certificate the anchor trusts cannot sign under another party's sender name.
  *
+ * On a protection-verified message the RFC 9483 sec. 3.5 receiving-side header rules apply: the `pvno` MUST be
+ * cmp2000(2) or cmp2021(3) (a cmp1999(1) message stays valid RFC 9810 syntax `pki.schema.cmp.parse` decodes,
+ * refused only on receipt), the `transactionID` MUST be present, and the `senderNonce` MUST be present and
+ * carry at least 128 bits; a violation is a `{ valid: false }` verdict carrying `cmp/unsupported-version`,
+ * `cmp/bad-transaction-id`, or `cmp/bad-sender-nonce`.
+ *
  * Returns a verdict (never a bare boolean): `{ valid, trusted, protectionType, protectionAlg, signer,
  * transactionID, senderNonce, recipNonce, header, body, code?, reason? }`. `valid` is whether the
  * protection is cryptographically intact under the declared algorithm; `trusted` is whether a MAC secret

package/lib/est.js

@@ -784,7 +784,17 @@ function classifyResponse(status, headers, body, opts) {
     // toString(enc, start, end) bounds the decode WITHOUT constructing a subarray
     // view, so a detached body reads as "" here rather than throwing a raw
     // TypeError that would mask the est/http-error verdict.
-    var text = Buffer.isBuffer(body) ? body.toString("utf8", 0, 512) : String(body || "").slice(0, 512);
+    var text;
+    if (Buffer.isBuffer(body)) {
+      text = body.toString("utf8", 0, 512);
+    } else if (guard.bytes.isByteSource(body)) {
+      // A byte source from an injected transport (a Uint8Array / ArrayBuffer): decode a bounded prefix through
+      // the byte guard rather than String()-coercing it to a "48,130,..." comma list.
+      try { text = guard.bytes.source(body, EstError, "est/bad-input", "the EST error body").toString("utf8", 0, 512); }
+      catch (_e) { /* allow:swallow-unverified a detached / unreadable error body reads as an empty snippet rather than masking the est/http-error verdict with a raw TypeError */ text = ""; }
+    } else {
+      text = String(body || "").slice(0, 512);
+    }
     throw E("est/http-error", "EST server returned HTTP " + status + (text ? ": " + text : ""));
   }
   return { status: "unexpected", httpStatus: status };
@@ -1142,7 +1152,7 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
       // Measure an injected string body as UTF-8 -- the byte width the body is decoded/transfer-decoded at,
       // and what the real socket transport counts -- so a non-ASCII body (multi-byte chars are ~half the
       // count under latin1) cannot undercount past the DoS cap and reach body handling.
-      var blen = Buffer.isBuffer(res.body) ? guard.bytes.lengthOf(res.body) : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
+      var blen = res.body == null ? 0 : (typeof res.body === "string" ? Buffer.byteLength(res.body, "utf8") : (Buffer.isBuffer(res.body) ? guard.bytes.lengthOf(res.body) : guard.bytes.lengthOf(guard.bytes.source(res.body, EstError, "est/bad-input", "the response body"))));
       if (blen > budgets.maxResponseBytes) throw E("est/response-too-large", "the response body (" + blen + " bytes) exceeds the " + budgets.maxResponseBytes + "-byte cap (RFC 7030 sec. 6)");
       // The transport contract returns lowercased headers, but the injectable seam only promises
       // { status, headers, body }; normalize here so a redirect Location / WWW-Authenticate from an
@@ -1292,7 +1302,7 @@ function _certsResult(op, res, opts, csrSpki) {
   if (verdict.status !== "ok") throw E("est/http-error", "an EST " + op + " response must be HTTP 200 or 202 (RFC 7030 sec. 4.1.3 / 4.2.3), got " + res.status);
   // Measure the body as UTF-8 for parity with the transport cap above (this check only distinguishes empty
   // from non-empty, where the encoding is immaterial, but the shape is kept uniform so no site undercounts).
-  var bodyLen = Buffer.isBuffer(res.body) ? guard.bytes.lengthOf(res.body) : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
+  var bodyLen = res.body == null ? 0 : (typeof res.body === "string" ? Buffer.byteLength(res.body, "utf8") : (Buffer.isBuffer(res.body) ? guard.bytes.lengthOf(res.body) : guard.bytes.lengthOf(guard.bytes.source(res.body, EstError, "est/bad-input", "the response body"))));
   if (bodyLen === 0) throw E("est/empty-body", "a 200 " + op + " response carried an empty body (RFC 7030 sec. 4.1.3 / 4.2.3)");
   var parsed = parseCertsOnly(transferDecode(res.body));
   if (op === "cacerts") return { certificates: parsed.certificates, crls: parsed.crls };
@@ -1856,7 +1866,7 @@ function _fullcmcResult(res, opts, wanted, sent) {
       "an EST /fullcmc response must be HTTP 200 or 202 (RFC 7030 sec. 4.3.2), got " + res.status);
   }
 
-  var bodyLen = Buffer.isBuffer(res.body) ? guard.bytes.lengthOf(res.body) : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
+  var bodyLen = res.body == null ? 0 : (typeof res.body === "string" ? Buffer.byteLength(res.body, "utf8") : (Buffer.isBuffer(res.body) ? guard.bytes.lengthOf(res.body) : guard.bytes.lengthOf(guard.bytes.source(res.body, EstError, "est/bad-input", "the response body"))));
   if (bodyLen === 0) throw E("est/empty-body", "a 200 /fullcmc response carried an empty body (RFC 7030 sec. 4.3.2)");
   var der = transferDecode(res.body);
 
@@ -2255,7 +2265,7 @@ async function _serverkeygenResult(res, opts, derived) {
   // A 202 is an enrollment posture (RFC 7030 sec. 4.4 treats /serverkeygen as an enroll): surfaced, never slept.
   if (verdict.status === "retry") return { retry: true, retryAfterSeconds: verdict.retryAfterSeconds, retryAfterDate: verdict.retryAfterDate };
   if (verdict.status !== "ok") throw E("est/http-error", "an EST serverkeygen response must be HTTP 200 or 202 (RFC 7030 sec. 4.4.2), got " + res.status);
-  var bodyLen = Buffer.isBuffer(res.body) ? guard.bytes.lengthOf(res.body) : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
+  var bodyLen = res.body == null ? 0 : (typeof res.body === "string" ? Buffer.byteLength(res.body, "utf8") : (Buffer.isBuffer(res.body) ? guard.bytes.lengthOf(res.body) : guard.bytes.lengthOf(guard.bytes.source(res.body, EstError, "est/bad-input", "the response body"))));
   if (bodyLen === 0) throw E("est/empty-body", "a 200 serverkeygen response carried an empty body (RFC 7030 sec. 4.4.2)");
   _assertConfidentialCipher(res);
   // parseServerKeygenResponse does the per-part transfer-decode; the recipient coherence is bound to the CSR.
@@ -2357,7 +2367,7 @@ function _csrattrsResult(res, opts) {
   // A 202 is nonconforming for a policy GET (sec. 4.5.2 lists only 200 / 204 / 404).
   if (verdict.status === "retry") throw E("est/http-error", "a /csrattrs response must be HTTP 200, 204, or 404, not 202 (RFC 7030 sec. 4.5.2)");
   if (verdict.status !== "ok") throw E("est/http-error", "an EST csrattrs response must be HTTP 200 / 204 / 404 (RFC 7030 sec. 4.5.2), got " + res.status);
-  var bodyLen = Buffer.isBuffer(res.body) ? guard.bytes.lengthOf(res.body) : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
+  var bodyLen = res.body == null ? 0 : (typeof res.body === "string" ? Buffer.byteLength(res.body, "utf8") : (Buffer.isBuffer(res.body) ? guard.bytes.lengthOf(res.body) : guard.bytes.lengthOf(guard.bytes.source(res.body, EstError, "est/bad-input", "the response body"))));
   // An empty HTTP body is distinct from a valid EMPTY CsrAttrs (`30 00` / base64 `MAA=`), which parses as {items:[]}.
   if (bodyLen === 0) throw E("est/empty-body", "a 200 csrattrs response carried an empty body (RFC 7030 sec. 4.5.2)");
   var attrs = csrattrsFmt.parse(transferDecode(res.body));

package/lib/guard-text.js

@@ -34,15 +34,14 @@ var intrinsic = require("./guard-intrinsic");
 //                        UTF-8 rule all still run and all still pass.
 //   _byteLength          measures the string arm against the cap. One returning 0 admits a string
 //                        of any size, which is the allocation-DoS this guard exists to bound.
-//   _isInteger           decides whether the cap itself is usable, and _isBuffer decides which arm
-//                        an input takes.
+//   _isInteger           decides whether the cap itself is usable; guard.bytes.isByteSource decides
+//                        whether an input takes the byte arm or the string arm.
 // The two method captures are uncurried, so their call sites read no property of them; see
 // guard-intrinsic for why capturing a method and then reading `.call` on it reopens the hole.
 var _toString = intrinsic.uncurry(Buffer.prototype.toString);
 var _decode = intrinsic.uncurry(TextDecoder.prototype.decode);
 // Already plain functions rather than methods, so these are invoked directly.
 var _byteLength = Buffer.byteLength;
-var _isBuffer = Buffer.isBuffer;
 var _isInteger = Number.isInteger;
 var _TextDecoder = TextDecoder;
 
@@ -58,10 +57,10 @@ var LATIN1 = "latin1";
 //                 tooLarge: code for the over-cap reject,
 //                 badDecode: code for a fatal-charset (bad-UTF-8) reject
 //                            (required only when fatal is set),
-//                 badInput: code for a non-Buffer/non-string reject,
+//                 badInput: code for a non-byte-source/non-string reject,
 //                 label:    human phrase for the message }
 // @enforced-by behavioral -- cap-before-copy has no rename-proof code shape; the
-//   over-cap RED vectors + the detached re-view through guard.bytes.view (itself
+//   over-cap RED vectors + the detached re-view through guard.bytes.source (itself
 //   enforced) are the guard.
 function decode(input, maxBytes, ErrorClass, spec) {
   // maxBytes is an authoring input: an undefined / NaN / fractional cap makes
@@ -72,12 +71,12 @@ function decode(input, maxBytes, ErrorClass, spec) {
     throw new TypeError("guard.text.decode: maxBytes must be a non-negative integer");
   }
   var charset = spec.charset || LATIN1;
-  if (_isBuffer(input)) {
-    // Re-view through the byte guard first so a detached backing ArrayBuffer (a
-    // transferred / structuredClone'd Buffer, which reads as zero-length) fails
-    // closed here -- the same detached-buffer defense the byte boundaries get --
-    // instead of being decoded as an empty string. Then cap, then decode.
-    input = bytes.view(input, ErrorClass, spec.badInput, spec.label);
+  if (bytes.isByteSource(input)) {
+    // Re-view through the byte guard first so any byte source (a Buffer, a Uint8Array or other typed array, a
+    // DataView, or a raw ArrayBuffer -- a caller-injected transport may return any of these) is normalized to a
+    // usable view, and a detached backing ArrayBuffer (a transferred / structuredClone'd view, which reads as
+    // zero-length) fails closed here instead of being decoded as an empty string. Then cap, then decode.
+    input = bytes.source(input, ErrorClass, spec.badInput, spec.label);
     // Measured through the byte guard's captured intrinsic getter, never `input.length`. On a typed
     // array `length` is an accessor on the prototype and it is configurable, so a replacement
     // returning 0 lets a buffer of any size past the cap and straight into the decode -- the
@@ -96,7 +95,7 @@ function decode(input, maxBytes, ErrorClass, spec) {
     if (byteLen > maxBytes) throw new ErrorClass(spec.tooLarge, spec.label + " exceeds the size cap");
     return input;
   }
-  throw new ErrorClass(spec.badInput, spec.label + " expects a string or Buffer");
+  throw new ErrorClass(spec.badInput, spec.label + " expects a string or a byte source (Buffer / TypedArray / DataView / ArrayBuffer)");
 }
 
 // Frozen for the reason the family header gives: a boundary reads its guard off this object at the

package/lib/path-validate.js

@@ -3352,7 +3352,12 @@ async function _aiaFetchOne(uri, aia) {
   var res = await aia.transport({ method: "GET", url: uri, tls: aia.tls, timeout: aia.timeout, maxResponseBytes: aia.maxResponseBytes, blockPrivateAddresses: true });
   res = res || {};
   if (res.status !== 200) throw E("path/aia-status", "an AIA fetch returned HTTP " + res.status + " (only 200 is a cert source; no redirect following)");
-  var body = Buffer.isBuffer(res.body) ? res.body : Buffer.from(res.body == null ? "" : String(res.body), "latin1");
+  // A binary view from an injected transport (Buffer / Uint8Array / ArrayBuffer / DataView) is re-viewed
+  // through the byte guard, as the request path does; only a genuine string body falls back to a latin1
+  // decode -- a typed array is never String()-coerced to "48,130,..." garbage that then fails to parse.
+  var body = guard.bytes.isByteSource(res.body)
+    ? guard.bytes.source(res.body, PathError, "path/aia-bad-body", "the AIA response body")
+    : Buffer.from(res.body == null ? "" : String(res.body), "latin1");
   if (body.length === 0) throw E("path/aia-empty", "an AIA fetch returned an empty body");
   // Belt for an INJECTED transport that ignores maxResponseBytes (the real transport streaming-aborts at the cap).
   if (body.length > aia.maxResponseBytes) throw E("path/aia-too-large", "an AIA response exceeds the " + aia.maxResponseBytes + "-byte cap");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.8",
+  "version": "0.6.9",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:ce70e235-3eb4-4497-bf76-5f97f81cffee",
+  "serialNumber": "urn:uuid:2f668b08-8394-4a54-b202-eac9892a6e2f",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-31T13:12:39.009Z",
+    "timestamp": "2026-08-31T15:15:24.682Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.8",
+      "bom-ref": "@blamejs/pki@0.6.9",
       "type": "application",
       "name": "pki",
-      "version": "0.6.8",
+      "version": "0.6.9",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.8",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.9",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.8",
+      "ref": "@blamejs/pki@0.6.9",
       "dependsOn": []
     }
   ]