@blamejs/pki 0.7.3 → 0.7.4

package/CHANGELOG.md

@@ -4,6 +4,15 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.7.4 — 2026-09-10
+
+Two authoring inputs that were accepted quietly are now refused by name.
+
+### Fixed
+
+- pki.csr.sign refuses an option it does not recognize. It reads the same three options its sibling pki.x509.sign reads, and that verb already refused anything else, so a name outside the set was accepted and dropped here alone: a caller asking for PEM output and misspelling the option received DER and no error. A name every object inherits, such as toString, is not a recognized option either. The three it does read are unchanged.
+- A distinguished name given as an array with a missing element is refused with this toolkit's own typed error. Encoding walks the array per element, and a gap left the element absent all the way to the encoder, which then failed on it as an untyped read of undefined rather than as a verdict naming the input. It affected the subject of a certificate and of a certification request, and an explicitly supplied issuer name. Every other authoring list already refused a gap, and this now answers the same way, in the domain of the verb that was called.
+
 ## v0.7.3 — 2026-09-10
 
 A timestamp verification takes its options once, so every pass reads the same answer.

package/lib/csr-sign.js

@@ -30,6 +30,10 @@ var csrVerify = require("./csr-verify");
 
 var CsrError = frameworkError.CsrError;
 var KNOWN_SPEC_KEYS = Object.assign(Object.create(null), { subject: 1, subjectPublicKey: 1, extensionRequest: 1, challengePassword: 1, attributes: 1 });
+/** @internal The three this verb reads, which are the three `pki.x509.sign` reads. A name outside
+ * them was accepted and dropped, so asking for PEM and misspelling the option returned DER and
+ * reported nothing. */
+var KNOWN_SIGN_OPTS = Object.assign(Object.create(null), { digestAlgorithm: 1, pem: 1, pss: 1 });
 var b = asn1.build;
 function _err(code, message, cause) { return new CsrError(code, message, cause); }
 function _signE(kind, message, cause) { return new CsrError("csr/" + kind, message, cause); }
@@ -99,6 +103,7 @@ function _sign(spec, key, opts) {
   opts = opts || {};
   if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("csr/bad-input", "the certification-request spec must be an object");
   guard.identifier.assertKnownKeys(spec, KNOWN_SPEC_KEYS, _err, "csr/bad-input", "unknown spec field ");
+  guard.identifier.assertKnownKeys(opts, KNOWN_SIGN_OPTS, _err, "csr/bad-input", "pki.csr.sign has an unknown option ");
   var signingKey = (key && typeof key === "object" && !Buffer.isBuffer(key) && !(key instanceof Uint8Array) && key.type == null && "key" in key) ? key.key : key;
   if (signingKey == null) throw _err("csr/bad-input", "a signing key (the subject's private key) is required");
 

package/lib/pki-build.js

@@ -300,7 +300,10 @@ function makeBuilder(ctx) {
     if (guard.bytes.isByteSource(spec)) { var _nd = guard.bytes.snapshotSource(spec, ErrorClass, ctx.prefix + "/bad-name", "raw Name DER"); assertValidNameDer(_nd); return _nd; }
     if (typeof spec === "string") spec = [{ commonName: spec }];
     if (!_isArray(spec)) throw E("bad-name", "a name must be a string, an array of RDNs, or raw Name DER");
-    return b.sequence(spec.map(encodeRdn));
+    /** @internal Held to the same density every other authoring list is held to. Mapping over a
+     * sparse array leaves the hole in place, so an absent element reached the encoder and surfaced
+     * as an untyped read of undefined rather than as a refusal a caller can act on. */
+    return b.sequence(reqDenseArray(spec, "a name's RDN array").map(encodeRdn));
   }
   function assertValidNameDer(der) {
     var node;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.7.3",
+  "version": "0.7.4",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:7729b1e4-672e-4d2e-ac81-8d11135b58a9",
+  "serialNumber": "urn:uuid:f78d7d30-68ed-48a9-905f-3e46577f4005",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-10T08:34:35.597Z",
+    "timestamp": "2026-09-10T10:14:34.771Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.7.3",
+      "bom-ref": "@blamejs/pki@0.7.4",
       "type": "application",
       "name": "pki",
-      "version": "0.7.3",
+      "version": "0.7.4",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.7.3",
+      "purl": "pkg:npm/%40blamejs/pki@0.7.4",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.7.3",
+      "ref": "@blamejs/pki@0.7.4",
       "dependsOn": []
     }
   ]