@blamejs/pki 0.7.2 → 0.7.3

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.7.3 — 2026-09-10
+
+A timestamp verification takes its options once, so every pass reads the same answer.
+
+### Changed
+
+- pki.tsp.verify reads each option once. A token is examined in more than one pass, and opts.certs was consulted again by each of them, so an option reached through an accessor could hand one set of certificates to the signature check and another to the chain the signer is traced through. No route was found that turns this into a wrong verdict, and a caller passing options as plain values was never affected; the change makes the verdict describe one set of inputs rather than relying on a caller object to answer consistently. It follows the same read-once shape applied to the PKCS#12 verbs in 0.7.2.
+
 ## v0.7.2 — 2026-09-10
 
 A PKCS#12 iteration cap is read once, so it cannot be answered with a value that is not a number.

package/lib/tsp-sign.js

@@ -596,6 +596,12 @@ async function verify(token, data, opts) {
   if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("tsp/bad-input", "pki.tsp.verify options must be an object");
   guard.identifier.assertKnownKeys(opts, _VERIFY_OPTS, _err, "tsp/bad-input",
     "pki.tsp.verify has an unknown option (the anchor option is `trustAnchors`) ");
+  /** @internal Every option is taken once, here, and each pass below reads that copy. A token is
+   * examined in several passes: the signature over it, then the chain from the signer to the
+   * caller's anchors. An option left on the caller's object is read again by each, and an option
+   * reached through an accessor answers each read separately, so the certificates that verified the
+   * signature need not be the certificates the chain was built from. */
+  opts = guard.identifier.snapshotOptions(opts, _VERIFY_OPTS);
   if (opts.certs != null && (!Array.isArray(opts.certs) || !guard.list.allMatch(opts.certs, function (c) { return guard.bytes.isByteSource(c); }))) {
     throw _err("tsp/bad-input", "pki.tsp.verify opts.certs must be an array of DER certificate Buffers");
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.7.2",
+  "version": "0.7.3",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3b58cd3c-2ea1-4d00-9d93-8181e4a421b2",
+  "serialNumber": "urn:uuid:7729b1e4-672e-4d2e-ac81-8d11135b58a9",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-10T07:33:50.131Z",
+    "timestamp": "2026-09-10T08:34:35.597Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.7.2",
+      "bom-ref": "@blamejs/pki@0.7.3",
       "type": "application",
       "name": "pki",
-      "version": "0.7.2",
+      "version": "0.7.3",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.7.2",
+      "purl": "pkg:npm/%40blamejs/pki@0.7.3",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.7.2",
+      "ref": "@blamejs/pki@0.7.3",
       "dependsOn": []
     }
   ]