@blamejs/pki 0.7.12 → 0.7.14

package/CHANGELOG.md

@@ -4,6 +4,31 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.7.14 — 2026-09-11
+
+Every option a verify verb decides with is taken once.
+
+### Changed
+
+- The pki.smime verbs take their options once at entry. sign, verify, encrypt, decrypt, compress, decompress and buildCertsOnly share one option-checking helper, and it now returns the options it checked rather than leaving the caller's object to be read again by each later pass.
+
+### Security
+
+- pki.jose.verify took opts.key seven times: a type gate, the RFC 7638 thumbprint comparison against the jwk the JWS embeds, and the key the signature is verified under. An accessor-backed opts.key could satisfy the comparison with the embedded key and hand a different one to the verification, so a JWS naming a signer the caller did not pin returned a verdict of keySource "opts.key" instead of the jose/key-mismatch refusal a plain object gets. The option is taken once, so the key compared is the key used.
+- pki.webauthn.parseClientData took each expected* option twice: once to decide whether to compare, once for the value compared, and the returned checked field then recorded that the comparison ran. An accessor-backed expectedChallenge could enter the branch on the challenge a ceremony issued and be compared against the challenge the response carried, returning checked.challenge true for a comparison that never ran against the caller's value. expectedType and expectedOrigin behaved the same way. Each option is taken once, so checked answers for the value the caller supplied. pki.webauthn.verify and pki.webauthn.verifyAssertion already copied their inputs and were not affected.
+
+## v0.7.13 — 2026-09-10
+
+The certificate signer refuses a pre-encoded extension whose criticality RFC 5280 fixes.
+
+### Changed
+
+- A call that supplied one of the nine fixed-criticality extensions with the wrong flag now throws where it previously produced a certificate or a request. Set the flag the clause requires: omit the critical BOOLEAN for the non-critical set, and encode it TRUE for the critical set. The extensions and extensionRequest object forms already emitted the correct flag and are unaffected, as are the CRL and attribute-certificate signers, which enforce the criticality their own profiles fix.
+
+### Fixed
+
+- pki.x509.sign and pki.csr.sign now refuse a pre-encoded extension carrying a criticality RFC 5280 does not permit, throwing x509/bad-input or csr/bad-input with the governing clause in the message. Nine extensions leave the issuer no choice. authorityKeyIdentifier (section 4.2.1.1), subjectKeyIdentifier (section 4.2.1.2), subjectDirectoryAttributes (section 4.2.1.8), freshestCRL (section 4.2.1.15), authorityInfoAccess (section 4.2.2.1) and subjectInfoAccess (section 4.2.2.2) must be non-critical. nameConstraints (section 4.2.1.10), policyConstraints (section 4.2.1.11) and inhibitAnyPolicy (section 4.2.1.14) must be critical. The check covers the pre-encoded array form on both verbs, which is the only way to supply these six extensions.
+
 ## v0.7.12 — 2026-09-10
 
 An issuer can draw a certificate serial number before signing with it.

package/lib/jose.js

@@ -319,6 +319,11 @@ var _VERIFY_KEYS = intrinsic.assign(intrinsic.create(null), { key: 1, profile: 1
 async function verify(jws, opts) {
   opts = opts || {};
   guard.identifier.assertKnownKeys(opts, _VERIFY_KEYS, E, "jose/bad-input", "unknown pki.jose.verify option ");
+  /** @internal opts.key is examined several times: the type gate, the RFC 7638 thumbprint comparison
+   *  against the embedded jwk, and the key the signature is verified under. An option reached through
+   *  an accessor answers each read separately, so the key the comparison ran on need not be the key
+   *  the verification used. Take each option once. */
+  opts = guard.identifier.snapshotOptions(opts, _VERIFY_KEYS);
   if (!jws || typeof jws !== "object" || _isArray(jws)) throw E("jose/bad-jws", "a flattened JWS object is required");
   if (_hasOwn(jws, "signatures")) throw E("jose/bad-jws", "the multi-signature signatures member is forbidden");
   if (_hasOwn(jws, "header")) throw E("jose/bad-jws", "the unprotected header member is forbidden");

package/lib/pki-build.js

@@ -273,6 +273,17 @@ function reqDenseArrayImpl(list, what, E, code) {
   return out;
 }
 
+/** @internal RFC 5280 sec. 4.2 fixes the criticality of these certificate extensions. Each entry maps
+ *  the extension OID to the flag the RFC requires and the clause that sets it. */
+var CERT_FIXED_CRITICALITY = intrinsic.create(null);
+[["authorityKeyIdentifier", false, "RFC 5280 sec. 4.2.1.1"], ["subjectKeyIdentifier", false, "RFC 5280 sec. 4.2.1.2"],
+  ["subjectDirectoryAttributes", false, "RFC 5280 sec. 4.2.1.8"], ["nameConstraints", true, "RFC 5280 sec. 4.2.1.10"],
+  ["policyConstraints", true, "RFC 5280 sec. 4.2.1.11"], ["inhibitAnyPolicy", true, "RFC 5280 sec. 4.2.1.14"],
+  ["freshestCRL", false, "RFC 5280 sec. 4.2.1.15"], ["authorityInfoAccess", false, "RFC 5280 sec. 4.2.2.1"],
+  ["subjectInfoAccess", false, "RFC 5280 sec. 4.2.2.2"]].forEach(function (r) {
+  CERT_FIXED_CRITICALITY[oid.byName(r[0])] = { critical: r[1], citation: r[2] };
+});
+
 function makeBuilder(ctx) {
   var ErrorClass = ctx.ErrorClass, O = ctx.O, NS = ctx.NS;
   var NAME_SCHEMA = ctx.NAME_SCHEMA, SPKI_SCHEMA = ctx.SPKI_SCHEMA;
@@ -498,6 +509,15 @@ function makeBuilder(ctx) {
     var last = n.children[n.children.length - 1];
     if (last.tagNumber !== asn1.TAGS.OCTET_STRING || last.tagClass !== "universal") throw E("bad-input", "pre-encoded extension [" + idx + "] extnValue must be an OCTET STRING");
   }
+  /** @internal Applies the certificate profile's fixed-criticality table. The CRL, CRL-entry and
+   *  attribute-certificate profiles set their own criticality in their own signers. */
+  function assertCertCriticality(extnId, isCritical, label) {
+    if (!intrinsic.hasOwn(CERT_FIXED_CRITICALITY, extnId)) return;
+    var req = CERT_FIXED_CRITICALITY[extnId];
+    if (isCritical === req.critical) return;
+    throw E("bad-input", label + " " + (oid.name(extnId) || extnId) + " extension must be marked " +
+      (req.critical ? "critical" : "non-critical") + " (" + req.citation + ")");
+  }
   var BC_KEYS = { cA: 1, pathLen: 1, critical: 1 };
   var REQ_EXT_KEYS = {
     subjectAltName: 1, keyUsage: 1, keyUsageCritical: 1, extendedKeyUsage: 1, extendedKeyUsageCritical: 1,
@@ -515,6 +535,7 @@ function makeBuilder(ctx) {
         var extnId = asn1.read.oid(n.children[0]);
         if (seen[extnId]) throw E("bad-input", "duplicate requested extension " + extnId + " (RFC 5280 sec. 4.2)");
         seen[extnId] = true;
+        assertCertCriticality(extnId, n.children.length === 3, "requested");
         var dec = EXT_DECODERS && EXT_DECODERS[extnId];
         if (dec) {
           try { dec(asn1.read.octetString(n.children[n.children.length - 1])); }
@@ -607,6 +628,7 @@ function makeBuilder(ctx) {
     extSan: extSan, extCertPolicies: extCertPolicies, ext: ext,
     spkiKeyId: spkiKeyId, skiKeyId: skiKeyId,
     reqDer: reqDer, reqDenseArray: reqDenseArray, reqDerSequence: reqDerSequence, assertValidSpki: assertValidSpki, assertValidExtension: assertValidExtension,
+    assertCertCriticality: assertCertCriticality,
     certLikeFromSpki: certLikeFromSpki, assertSignatureVerifies: assertSignatureVerifies,
     samePublicKey: samePublicKey,
   };

package/lib/smime.js

@@ -64,11 +64,15 @@ var DECRYPT_OPTS = Object.assign(Object.create(null), { recipientIndex: 1, maxIt
 var COMPRESS_OPTS = Object.assign(Object.create(null), { entity: 1, contentType: 1, level: 1 });
 var DECOMPRESS_OPTS = Object.assign(Object.create(null), { maxOutputBytes: 1 });
 
+/** @internal Checks the option names and RETURNS the options taken once. A verb reads one option to
+ *  decide whether a rule applies and reads it again for the value the rule uses, and an option
+ *  reached through an accessor answers each read separately. Callers assign the return value. */
 function _knownOpts(opts, known, verb) {
   guard.identifier.assertKnownKeys(opts, known, _err, "smime/bad-input", function (k) {
     return "unknown option " + JSON.stringify(k) + " for pki.smime." + verb + " -- accepted: " +
       Object.keys(known).sort().join(", ");
   });
+  return guard.identifier.snapshotOptions(opts, known);
 }
 
 function _isPkcs7(type, kind) {
@@ -500,7 +504,7 @@ function _base64Body(der) {
  */
 async function sign(content, signers, opts) {
   opts = opts || {};
-  _knownOpts(opts, SIGN_OPTS, "sign");
+  opts = _knownOpts(opts, SIGN_OPTS, "sign");
   var hp = opts.protectHeaders === true;
   var hpList = hp ? _hpHeaderList(opts.headers) : null;
   var outerList = hp ? _outerHeaderList(hpList, "clear", opts.hcp) : null;
@@ -612,7 +616,7 @@ function _capped(msg) {
  */
 async function verify(message, opts) {
   opts = opts || {};
-  _knownOpts(opts, VERIFY_OPTS, "verify");
+  opts = _knownOpts(opts, VERIFY_OPTS, "verify");
   var ent = mime.parse(message, SmimeError, "smime/bad-mime");
   var ct = ent.contentType;
   var vOpts = {};
@@ -720,7 +724,7 @@ function _cmsEncryptOpts(opts) {
  */
 async function encrypt(content, recipients, opts) {
   opts = opts || {};
-  _knownOpts(opts, ENCRYPT_OPTS, "encrypt");
+  opts = _knownOpts(opts, ENCRYPT_OPTS, "encrypt");
   var hp = opts.protectHeaders === true;
   var hpList = hp ? _hpHeaderList(opts.headers) : null;
   var outerList = hp ? _outerHeaderList(hpList, "cipher", opts.hcp) : null;
@@ -776,7 +780,7 @@ async function encrypt(content, recipients, opts) {
  */
 async function decrypt(message, keyMaterial, opts) {
   opts = opts || {};
-  _knownOpts(opts, DECRYPT_OPTS, "decrypt");
+  opts = _knownOpts(opts, DECRYPT_OPTS, "decrypt");
   var ent = mime.parse(message, SmimeError, "smime/bad-mime");
   var ct = ent.contentType;
   if (!_isPkcs7(ct.type, "mime")) throw _err("smime/unsupported-type", "not an encrypted S/MIME message (Content-Type " + JSON.stringify(ct.type) + ")");
@@ -821,7 +825,7 @@ async function decrypt(message, keyMaterial, opts) {
  */
 async function compress(content, opts) {
   opts = opts || {};
-  _knownOpts(opts, COMPRESS_OPTS, "compress");
+  opts = _knownOpts(opts, COMPRESS_OPTS, "compress");
   var entity = _entityBytes(content, opts);
   var cOpts = {};
   if (opts.level !== undefined) cOpts.level = opts.level;
@@ -855,7 +859,7 @@ async function compress(content, opts) {
  */
 async function decompress(message, opts) {
   opts = opts || {};
-  _knownOpts(opts, DECOMPRESS_OPTS, "decompress");
+  opts = _knownOpts(opts, DECOMPRESS_OPTS, "decompress");
   var ent = mime.parse(message, SmimeError, "smime/bad-mime");
   var ct = ent.contentType;
   if (!_isPkcs7(ct.type, "mime")) throw _err("smime/unsupported-type", "not a compressed S/MIME message (Content-Type " + JSON.stringify(ct.type) + ")");
@@ -901,7 +905,7 @@ var CERTS_ONLY_OPTS = Object.assign(Object.create(null), { crls: 1 });
  */
 function buildCertsOnly(certs, opts) {
   opts = opts || {};
-  _knownOpts(opts, CERTS_ONLY_OPTS, "buildCertsOnly");
+  opts = _knownOpts(opts, CERTS_ONLY_OPTS, "buildCertsOnly");
   var der = _toBuf(cms.certsOnly(certs, { crls: opts.crls }));
   return _capped(Buffer.concat([_pkcs7MimeHead("certs-only", "smime.p7c"), _base64Body(der), mime.CRLF]));
 }

package/lib/webauthn.js

@@ -1275,6 +1275,11 @@ function parseClientData(bytes, opts) {
   opts = opts || {};
   if (!_isPlainObject(opts)) throw _err("webauthn/bad-input", "opts must be an object");
   guard.identifier.assertKnownKeys(opts, _CLIENT_DATA_OPTS, _err, "webauthn/bad-input", "opts has an unknown key ");
+  /** @internal Each expected* option is read to decide whether to compare and read again for the
+   *  value compared, and `checked` then records that the comparison ran. An option reached through an
+   *  accessor answers each read separately, so `checked` could describe a comparison against a value
+   *  the caller never supplied. Take each option once. */
+  opts = guard.identifier.snapshotOptions(opts, _CLIENT_DATA_OPTS);
   bytes = _bytesArg(bytes, "clientDataJSON");
   var doc = guard.json.parse(Buffer.from(bytes), _err, {
     maxBytes: constants.LIMITS.JSON_MAX_BYTES, maxDepth: constants.LIMITS.JSON_MAX_DEPTH,

package/lib/x509-sign.js

@@ -56,6 +56,7 @@ var KNOWN_EXT_KEYS = intrinsic.assign(intrinsic.create(null), {
 var _b = pkiBuild.makeBuilder({ ErrorClass: CertificateError, prefix: "x509", O: O, NS: NS, NAME_SCHEMA: NAME_SCHEMA, SPKI_SCHEMA: SPKI_SCHEMA, EXT_DECODERS: EXT_DECODERS });
 var _encodeName = _b.encodeName, _isEmptyName = _b.isEmptyName, _reqDer = _b.reqDer,
   _assertValidSpki = _b.assertValidSpki, _assertValidExtension = _b.assertValidExtension,
+  _assertCertCriticality = _b.assertCertCriticality,
   _certLikeFromSpki = _b.certLikeFromSpki, _assertCertVerifies = _b.assertSignatureVerifies,
   _ext = _b.ext, _extBasicConstraints = _b.extBasicConstraints, _validateBcSpec = _b.validateBcSpec,
   _extKeyUsage = _b.extKeyUsage, _extExtKeyUsage = _b.extExtKeyUsage, _extSki = _b.extSki,
@@ -89,6 +90,7 @@ function _buildExtensions(extSpec, ctx) {
       var extnId = asn1.read.oid(n.children[0]);
       if (seenExt[extnId]) throw _err("x509/bad-input", "duplicate extension " + extnId + " in the extensions array (RFC 5280 sec. 4.2 -- at most one instance of an extension)");
       seenExt[extnId] = true;
+      _assertCertCriticality(extnId, n.children.length === 3, "pre-encoded");
       var dec = EXT_DECODERS[extnId];
       if (dec) {
         var decoded;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.7.12",
+  "version": "0.7.14",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:4cd44552-2dd6-48c5-b89d-d0f03d957e45",
+  "serialNumber": "urn:uuid:bf9440b0-2e9b-45e1-8551-36b17188bd96",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-11T00:21:46.779Z",
+    "timestamp": "2026-09-11T02:22:59.455Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.7.12",
+      "bom-ref": "@blamejs/pki@0.7.14",
       "type": "application",
       "name": "pki",
-      "version": "0.7.12",
+      "version": "0.7.14",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.7.12",
+      "purl": "pkg:npm/%40blamejs/pki@0.7.14",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.7.12",
+      "ref": "@blamejs/pki@0.7.14",
       "dependsOn": []
     }
   ]