@blamejs/pki 0.8.0 → 0.8.2

package/lib/schema-pkix.js

@@ -280,10 +280,10 @@ function pbkdf2Params(ns) {
       var keyLength = guard.range.positiveInt31(m.fields.keyLength.value, ctx.E, ctx.prefix + "/bad-mac-data", "PBKDF2 keyLength");
       var prf = m.fields.prf.present ? m.fields.prf.value.result : null;
       var pp = prf ? prf.parameters : null;
-      if (prf && prf.oid === hmacSha1 && pp !== null && pp.length === 2 && pp[0] === 0x05 && pp[1] === 0x00) {
+      if (prf && prf.oid === hmacSha1 && pp !== null && guard.der.isNull(pp)) {
         throw ctx.E(ctx.prefix + "/bad-mac-data", "a PBKDF2 prf equal to its DEFAULT algid-hmacWithSHA1 must be omitted (X.690 sec. 11.5, RFC 8018 sec. 5.2)");
       }
-      if (prf && pp !== null && !(pp.length === 2 && pp[0] === 0x05 && pp[1] === 0x00)) {
+      if (prf && pp !== null && !guard.der.isNull(pp)) {
         throw ctx.E(ctx.prefix + "/bad-mac-data", "the PBKDF2 prf parameters must be absent or NULL (RFC 8018 App. B.1)");
       }
       return {
@@ -313,7 +313,7 @@ function pbmac1Params(ns) {
       }
       var scheme = m.fields.messageAuthScheme.value.result;
       var sp = scheme.parameters;
-      if (sp !== null && !(sp.length === 2 && sp[0] === 0x05 && sp[1] === 0x00)) {
+      if (sp !== null && !guard.der.isNull(sp)) {
         throw ctx.E(ctx.prefix + "/bad-mac-data", "the PBMAC1 messageAuthScheme parameters must be absent or NULL (RFC 8018 App. B.1)");
       }
       return {
@@ -403,7 +403,8 @@ function name(ns, opts) {
       _forEach(rdnItem.value.items, function (atvItem) {
         var a = atvItem.value.result;
         _push(atvs, a);
-        var label = (a.name && _hasOwn(DN_SHORT, a.name) && DN_SHORT[a.name]) || a.name || a.type;
+        var label = (a.name && _hasOwn(DN_SHORT, a.name) && DN_SHORT[a.name]) ||
+          (guard.name.isAttributeDescriptor(a.name) ? a.name : a.type);
         _push(atvParts, label + "=" + _dnDisplayValue(a.value));
       });
       _push(rdns, atvs);

package/lib/x509-sign.js

@@ -23,6 +23,9 @@ var signScheme = require("./sign-scheme");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
 var _isArray = intrinsic.isArray, _bufferEquals = intrinsic.bufferEquals;
+var _dnCharCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
+var _dnKeys = intrinsic.keys;
+var _dnHasOwn = intrinsic.hasOwn;
 var frameworkError = require("./framework-error");
 var schema = require("./schema-engine");
 var pkix = require("./schema-pkix");
@@ -788,4 +791,100 @@ function _extension(name, value, opts) {
   return _ext(row.oid, critical, valueDer);
 }
 
-module.exports = { sign: sign, randomSerial: randomSerial, extension: extension };
+/**
+ * @primitive  pki.x509.parseDn
+ * @signature  pki.x509.parseDn(dn) -> { rdns, dn, bytes }
+ * @since      0.8.2
+ * @status     stable
+ * @spec       RFC 4514
+ * @related    pki.x509.sign, pki.schema.x509.parse
+ *
+ * Read a distinguished-name string into the `Name` a builder takes, using the attribute names
+ * and value escaping of RFC 4514 sec. 2.4 and sec. 3. It is the inverse of the `dn` string
+ * every parsed name carries: `bytes` is the encoded `Name`, ready to hand to `pki.x509.sign`
+ * as a `subject` or `issuer`, and `dn` is the string re-emitted from what was read, which for
+ * a string this toolkit produced is the string it was given.
+ *
+ * Components are read in the order they are written, so the first one written is the first
+ * element of the encoded `Name`. That is the order every `dn` here is emitted in, and the
+ * order `openssl x509 -subject` prints. RFC 4514 sec. 2.1 specifies the opposite order, so a
+ * string from a directory tool that follows it names the components from last to first;
+ * reverse them before parsing one.
+ *
+ * The string form does not carry the ASN.1 string type of each value, so a parsed value takes
+ * the type this toolkit encodes that attribute with: `PrintableString` for `countryName`,
+ * `IA5String` for `emailAddress`, `UTF8String` otherwise. A name written by something that
+ * chose different types will re-encode to different bytes, which is why RFC 4514 sec. 2.4
+ * defines the `#`-prefixed hex form: a value given that way is the exact DER of the
+ * `AttributeValue` and round-trips byte for byte.
+ *
+ * Malformed input throws `x509/bad-dn`. A non-string throws `x509/bad-input`.
+ *
+ * `bytes` is raw `Name` DER, the form `spec.subject` and `spec.issuer` take alongside a string
+ * or an array of RDNs, so a name read from a string can be signed without rebuilding it.
+ *
+ * @example
+ *   var name = pki.x509.parseDn("C=US, O=Example Inc, CN=leaf");
+ *   name.rdns.length;               // -> 3
+ *   name.rdns[0][0].name;           // -> "countryName"
+ *   name.dn;                        // -> "C=US, O=Example Inc, CN=leaf"
+ *   Buffer.isBuffer(name.bytes);    // -> true
+ */
+function parseDn(dn) {
+  if (typeof dn !== "string") throw _err("x509/bad-input", "pki.x509.parseDn takes a distinguished-name string");
+  var components = guard.name.parseDnString(dn, _err, "x509/bad-dn", "the distinguished name");
+  var spec = [];
+  for (var i = 0; i < components.length; i++) {
+    var rdn = components[i], out = intrinsic.create(null);
+    for (var j = 0; j < rdn.length; j++) {
+      var atv = rdn[j];
+      var attrName;
+      try { attrName = _dnAttrName(atv.type); }
+      catch (e) {
+        if (e instanceof CertificateError && e.code === "x509/bad-dn") throw e;
+        throw _err("x509/bad-dn", "the distinguished name has an attribute type that does not resolve: " + guard.text.showValue(atv.type), e);
+      }
+      if (_dnHasOwn(out, attrName)) {
+        throw _err("x509/bad-dn", "the distinguished name repeats " + attrName + " inside one relative distinguished name");
+      }
+      out[attrName] = atv.hex === null ? _dnLiteralValue(atv.value) : "#" + atv.hex;
+    }
+    guard.list.append(spec, out);
+  }
+  var bytes, read;
+  try {
+    bytes = _b.encodeName(spec);
+    read = schema.walk(NAME_SCHEMA, asn1.decode(bytes), NS).result;
+  } catch (e) {
+    throw _err("x509/bad-dn", "the distinguished name does not encode: " + (e && e.message), e);
+  }
+  return { rdns: read.rdns, dn: read.dn, bytes: bytes };
+}
+
+function _dnAttrName(type) {
+  if (oid.isDottedDecimal(type)) {
+    var byOid = oid.name(type);
+    if (!byOid) throw _err("x509/bad-dn", "the distinguished name names an unregistered attribute OID " + type);
+    return byOid;
+  }
+  var wanted = guard.name.lowerAscii(type);
+  var shortNames = pkix.DN_SHORT;
+  var keys = _dnKeys(shortNames);
+  for (var i = 0; i < keys.length; i++) {
+    if (guard.name.lowerAscii(shortNames[keys[i]]) === wanted || guard.name.lowerAscii(keys[i]) === wanted) return keys[i];
+  }
+  var table = oid.all();
+  var dotted = _dnKeys(table);
+  for (var j = 0; j < dotted.length; j++) {
+    var registered = table[dotted[j]];
+    if (guard.name.lowerAscii(registered) === wanted) return registered;
+  }
+  throw _err("x509/bad-dn", "the distinguished name names an unknown attribute " + guard.text.showValue(type));
+}
+
+function _dnLiteralValue(value) {
+  var first = _dnCharCodeAt(value, 0);
+  return (first === 0x23 || first === 0x5c) ? "\\" + value : value;
+}
+
+module.exports = { sign: sign, randomSerial: randomSerial, extension: extension, parseDn: parseDn };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",
@@ -68,7 +68,9 @@
     "test": "node test/smoke.js",
     "lint": "eslint --max-warnings 0 .",
     "fuzz": "npm ci --prefix fuzz && npx --prefix fuzz jazzer fuzz/asn1-der.fuzz.js -- -max_total_time=60",
-    "gates": "node test/layer-0-primitives/codebase-patterns.test.js && node scripts/validate-source-comment-blocks.js && node scripts/check-api-snapshot.js && node scripts/check-spelling-consistency.js && node scripts/check-engine-floor.js",
+    "gates": "node test/layer-0-primitives/codebase-patterns.test.js && node scripts/validate-source-comment-blocks.js && node scripts/check-api-snapshot.js && node scripts/check-spelling-consistency.js && node scripts/check-engine-floor.js && node scripts/check-cve-vectors.js && node scripts/check-rfc-currency.js",
+    "check:cve-vectors": "node scripts/check-cve-vectors.js",
+    "check:rfc-currency": "node scripts/check-rfc-currency.js",
     "check:engine-floor": "node scripts/check-engine-floor.js",
     "check:spelling": "node scripts/check-spelling-consistency.js",
     "coverage": "c8 --include=lib/** --include=index.js --reporter=text-summary --reporter=lcov node test/smoke.js",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3474a203-558f-4bf4-8d04-ca4aec66e1f7",
+  "serialNumber": "urn:uuid:b0bab233-a055-413d-8f5b-3ed8a3f7a8c4",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-19T19:43:19.653Z",
+    "timestamp": "2026-09-20T02:50:18.934Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.0",
+      "bom-ref": "@blamejs/pki@0.8.2",
       "type": "application",
       "name": "pki",
-      "version": "0.8.0",
+      "version": "0.8.2",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.0",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.2",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.0",
+      "ref": "@blamejs/pki@0.8.2",
       "dependsOn": []
     }
   ]