@blamejs/pki 0.8.10 → 0.8.11

package/lib/schema-x509.js

@@ -35,6 +35,7 @@ var schema = require("./schema-engine");
 var oid = require("./oid");
 var frameworkError = require("./framework-error");
 var pkix = require("./schema-pkix");
+var intrinsic = require("./guard-intrinsic");
 
 var CertificateError = frameworkError.CertificateError;
 var PemError = frameworkError.PemError;
@@ -124,7 +125,7 @@ var CERTIFICATE = pkix.signedEnvelope(NS, CERTIFICATE_TBS, {
   build: function (e, ctx) {
     var tbs = e.tbsMatch;
 
-    if (!e.outerSignatureAlgorithmBytes.equals(tbs.fields.signature.node.bytes)) {
+    if (!intrinsic.bufferEquals(e.outerSignatureAlgorithmBytes, tbs.fields.signature.node.bytes)) {
       throw ctx.E("x509/bad-signature-algorithm", "signatureAlgorithm must match tbsCertificate.signature (RFC 5280 sec. 4.1.1.2)");
     }
 
@@ -148,7 +149,7 @@ var CERTIFICATE = pkix.signedEnvelope(NS, CERTIFICATE_TBS, {
     return {
       version:               version,
       serialNumber:          tbs.fields.serialNumber.value,
-      serialNumberHex:       serialNode.content.toString("hex"),
+      serialNumberHex:       intrinsic.bufToString(serialNode.content, "hex"),
       signatureAlgorithm:    e.signatureAlgorithm,
       tbsSignatureAlgorithm: tbs.fields.signature.value.result,
       issuer:                issuer,
@@ -213,14 +214,107 @@ function matches(root) {
   var validity = kids[i + 3];
   return schema.isUniversal(validity, TAGS.SEQUENCE) &&
     !!validity.children && validity.children.length === 2 &&
-    validity.children.every(function (t) {
+    intrinsic.every(validity.children, function (t) {
       return schema.isUniversalOneOf(t, [TAGS.UTC_TIME, TAGS.GENERALIZED_TIME]);
     });
 }
 
+/** @internal The certificate scope, as the shared door reads it: RFC 5280 sec. 4.2's extension
+ *  table and the criticality that profile fixes. One scope, so the single-extension verb takes no
+ *  `opts.scope`. */
+var CERT_SCOPES = intrinsic.assign(intrinsic.create(null), {
+  certificate: {
+    decoders: function (ctx) { return pkix.certExtensionDecoders(ctx).byOid; },
+    criticality: pkix.certFixedCriticality(oid),
+  },
+});
+var DOOR = pkix.extensionDoor({
+  ns: NS, ErrorClass: CertificateError, key: "x509", kind: "certificate", what: "the certificate",
+  parse: parse, scopes: CERT_SCOPES, defaultScope: "certificate",
+  segments: function (cert) { return [{ list: cert.extensions || [], scope: "certificate" }]; },
+});
+
+/**
+ * @primitive  pki.schema.x509.decodeExtensions
+ * @signature  pki.schema.x509.decodeExtensions(certOrBytes, opts?) -> rows
+ * @since      0.8.11
+ * @status     stable
+ * @spec       RFC 5280 sec. 4.2
+ * @related    pki.schema.x509.parse, pki.lint.certificate, pki.inspect.certificate
+ *
+ * Read a certificate's extensions as decoded records. `parse` hands back each extension's raw
+ * `extnValue` octets, because what an extension means is a question the reader asks rather than
+ * one the parse answers; this is the verb that asks it. The argument is the object `parse`
+ * returned or the bytes `parse` takes, and a parse result is read rather than re-derived.
+ *
+ * Each row is `{ oid, name, critical, value, scope, index, state, decoded, code, profile }`, with
+ * every field always present. `state` is the discriminator: `"decoded"` when the value read as the
+ * structure its identifier names, `"unrecognized"` when this toolkit registers no decoder for that
+ * OID, and `"undecodable"` when it does and the value did not read. Read `state` rather than
+ * testing `decoded`, because a valid `ocspNoCheck` decodes to `null`.
+ *
+ * `value` carries the raw octets in every arm, byte-identical to the certificate's, for a caller
+ * recomputing a hash or comparing an encoding. `code` is the typed error code in the undecodable
+ * arm and `null` elsewhere. `profile` reports the criticality the RFC fixes for that OID, as
+ * `{ criticalExpected, citation, deviates, violations }`, and is `null` for an extension whose
+ * criticality the issuer chooses.
+ *
+ * Nothing here is a verdict. An unrecognized critical extension is reported rather than refused,
+ * whatever `opts.strict` says, because RFC 5280 sec. 4.2's rule about one is the caller's to
+ * apply and refusing it would make a certificate carrying a private critical extension
+ * unreadable. The two facts that rule needs, `critical` and `state`, are on the row.
+ *
+ * @opts
+ *   - `strict` (boolean) -- throw the decoder's own typed error instead of reporting an
+ *     undecodable value. It does not turn an unrecognized OID into a throw.
+ *   - `maxBytes` / `maxDepth` / `maxItems` (integer) -- decode caps for this call. Each may only
+ *     tighten the built-in ceiling, and each bounds the decoding this call performs.
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var certDer = await pki.x509.sign({ subject: "leaf.example", subjectPublicKey: await pki.key.export(pair.publicKey),
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2027-01-01T00:00:00Z"),
+ *     extensions: { basicConstraints: { cA: false }, subjectAltName: [{ dNSName: "leaf.example" }] } },
+ *     { key: await pki.key.export(pair.privateKey) });
+ *   var rows = pki.schema.x509.decodeExtensions(certDer);
+ *   rows.filter(function (r) { return r.critical && r.state !== "decoded"; }).length;  // -> 0
+ *   // The filter above is the RFC 5280 sec. 4.2 rule: a relying party rejects a certificate whose
+ *   // critical extensions it cannot read.
+ */
+var decodeExtensions = DOOR.decodeExtensions;
+
+/**
+ * @primitive  pki.schema.x509.decodeExtension
+ * @signature  pki.schema.x509.decodeExtension(ext, opts?) -> row
+ * @since      0.8.11
+ * @status     stable
+ * @spec       RFC 5280 sec. 4.2
+ * @related    pki.schema.x509.decodeExtensions
+ *
+ * Read one certificate extension record as a decoded row. The argument is one element of a
+ * `pki.schema.x509.parse` result's `extensions`, as `{ oid, name, critical, value }`, and the row
+ * is the one `decodeExtensions` would have produced for it, with `index` 0.
+ *
+ * @opts
+ *   - `strict` (boolean) -- throw the decoder's own typed error instead of reporting an
+ *     undecodable value.
+ *   - `maxBytes` / `maxDepth` / `maxItems` (integer) -- decode caps for this call. Each may only
+ *     tighten the built-in ceiling.
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var certDer = await pki.x509.sign({ subject: "leaf.example", subjectPublicKey: await pki.key.export(pair.publicKey),
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2027-01-01T00:00:00Z"),
+ *     extensions: { basicConstraints: { cA: false } } },
+ *     { key: await pki.key.export(pair.privateKey) });
+ *   var parsed = pki.schema.x509.parse(certDer);
+ *   pki.schema.x509.decodeExtension(parsed.extensions[0]).state;  // -> "decoded"
+ */
+var decodeExtension = DOOR.decodeExtension;
+
 module.exports = {
   parse:     parse,
   pemDecode: pemDecode,
   pemEncode: pemEncode,
   matches:   matches,
+  decodeExtensions: decodeExtensions,
+  decodeExtension:  decodeExtension,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.10",
+  "version": "0.8.11",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:4cdebd00-c3c0-4ba6-9d9c-daacb902163c",
+  "serialNumber": "urn:uuid:41170205-6ef3-4f77-9577-7ba33e5632bc",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-23T19:58:00.767Z",
+    "timestamp": "2026-09-23T22:37:26.125Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.10",
+      "bom-ref": "@blamejs/pki@0.8.11",
       "type": "application",
       "name": "pki",
-      "version": "0.8.10",
+      "version": "0.8.11",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.10",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.11",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.10",
+      "ref": "@blamejs/pki@0.8.11",
       "dependsOn": []
     }
   ]