@blamejs/pki 0.7.2 → 0.7.4

package/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.7.4 — 2026-09-10
+
+Two authoring inputs that were accepted quietly are now refused by name.
+
+### Fixed
+
+- pki.csr.sign refuses an option it does not recognize. It reads the same three options its sibling pki.x509.sign reads, and that verb already refused anything else, so a name outside the set was accepted and dropped here alone: a caller asking for PEM output and misspelling the option received DER and no error. A name every object inherits, such as toString, is not a recognized option either. The three it does read are unchanged.
+- A distinguished name given as an array with a missing element is refused with this toolkit's own typed error. Encoding walks the array per element, and a gap left the element absent all the way to the encoder, which then failed on it as an untyped read of undefined rather than as a verdict naming the input. It affected the subject of a certificate and of a certification request, and an explicitly supplied issuer name. Every other authoring list already refused a gap, and this now answers the same way, in the domain of the verb that was called.
+
+## v0.7.3 — 2026-09-10
+
+A timestamp verification takes its options once, so every pass reads the same answer.
+
+### Changed
+
+- pki.tsp.verify reads each option once. A token is examined in more than one pass, and opts.certs was consulted again by each of them, so an option reached through an accessor could hand one set of certificates to the signature check and another to the chain the signer is traced through. No route was found that turns this into a wrong verdict, and a caller passing options as plain values was never affected; the change makes the verdict describe one set of inputs rather than relying on a caller object to answer consistently. It follows the same read-once shape applied to the PKCS#12 verbs in 0.7.2.
+
 ## v0.7.2 — 2026-09-10
 
 A PKCS#12 iteration cap is read once, so it cannot be answered with a value that is not a number.

package/lib/csr-sign.js

@@ -30,6 +30,10 @@ var csrVerify = require("./csr-verify");
 
 var CsrError = frameworkError.CsrError;
 var KNOWN_SPEC_KEYS = Object.assign(Object.create(null), { subject: 1, subjectPublicKey: 1, extensionRequest: 1, challengePassword: 1, attributes: 1 });
+/** @internal The three this verb reads, which are the three `pki.x509.sign` reads. A name outside
+ * them was accepted and dropped, so asking for PEM and misspelling the option returned DER and
+ * reported nothing. */
+var KNOWN_SIGN_OPTS = Object.assign(Object.create(null), { digestAlgorithm: 1, pem: 1, pss: 1 });
 var b = asn1.build;
 function _err(code, message, cause) { return new CsrError(code, message, cause); }
 function _signE(kind, message, cause) { return new CsrError("csr/" + kind, message, cause); }
@@ -99,6 +103,7 @@ function _sign(spec, key, opts) {
   opts = opts || {};
   if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("csr/bad-input", "the certification-request spec must be an object");
   guard.identifier.assertKnownKeys(spec, KNOWN_SPEC_KEYS, _err, "csr/bad-input", "unknown spec field ");
+  guard.identifier.assertKnownKeys(opts, KNOWN_SIGN_OPTS, _err, "csr/bad-input", "pki.csr.sign has an unknown option ");
   var signingKey = (key && typeof key === "object" && !Buffer.isBuffer(key) && !(key instanceof Uint8Array) && key.type == null && "key" in key) ? key.key : key;
   if (signingKey == null) throw _err("csr/bad-input", "a signing key (the subject's private key) is required");
 

package/lib/pki-build.js

@@ -300,7 +300,10 @@ function makeBuilder(ctx) {
     if (guard.bytes.isByteSource(spec)) { var _nd = guard.bytes.snapshotSource(spec, ErrorClass, ctx.prefix + "/bad-name", "raw Name DER"); assertValidNameDer(_nd); return _nd; }
     if (typeof spec === "string") spec = [{ commonName: spec }];
     if (!_isArray(spec)) throw E("bad-name", "a name must be a string, an array of RDNs, or raw Name DER");
-    return b.sequence(spec.map(encodeRdn));
+    /** @internal Held to the same density every other authoring list is held to. Mapping over a
+     * sparse array leaves the hole in place, so an absent element reached the encoder and surfaced
+     * as an untyped read of undefined rather than as a refusal a caller can act on. */
+    return b.sequence(reqDenseArray(spec, "a name's RDN array").map(encodeRdn));
   }
   function assertValidNameDer(der) {
     var node;

package/lib/tsp-sign.js

@@ -596,6 +596,12 @@ async function verify(token, data, opts) {
   if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("tsp/bad-input", "pki.tsp.verify options must be an object");
   guard.identifier.assertKnownKeys(opts, _VERIFY_OPTS, _err, "tsp/bad-input",
     "pki.tsp.verify has an unknown option (the anchor option is `trustAnchors`) ");
+  /** @internal Every option is taken once, here, and each pass below reads that copy. A token is
+   * examined in several passes: the signature over it, then the chain from the signer to the
+   * caller's anchors. An option left on the caller's object is read again by each, and an option
+   * reached through an accessor answers each read separately, so the certificates that verified the
+   * signature need not be the certificates the chain was built from. */
+  opts = guard.identifier.snapshotOptions(opts, _VERIFY_OPTS);
   if (opts.certs != null && (!Array.isArray(opts.certs) || !guard.list.allMatch(opts.certs, function (c) { return guard.bytes.isByteSource(c); }))) {
     throw _err("tsp/bad-input", "pki.tsp.verify opts.certs must be an array of DER certificate Buffers");
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.7.2",
+  "version": "0.7.4",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3b58cd3c-2ea1-4d00-9d93-8181e4a421b2",
+  "serialNumber": "urn:uuid:f78d7d30-68ed-48a9-905f-3e46577f4005",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-10T07:33:50.131Z",
+    "timestamp": "2026-09-10T10:14:34.771Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.7.2",
+      "bom-ref": "@blamejs/pki@0.7.4",
       "type": "application",
       "name": "pki",
-      "version": "0.7.2",
+      "version": "0.7.4",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.7.2",
+      "purl": "pkg:npm/%40blamejs/pki@0.7.4",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.7.2",
+      "ref": "@blamejs/pki@0.7.4",
       "dependsOn": []
     }
   ]