@blamejs/pki 0.8.17 → 0.8.19

package/lib/oid.js

@@ -118,11 +118,39 @@ var FAMILIES = Object.assign(Object.create(null), {
 
   pkixOn: { base: [1, 3, 6, 1, 5, 5, 7, 8], of: { hardwareModuleName: 4, dnsSRV: 7, smtpUtf8Mailbox: 9, macAddress: 12 } },
 
+  /** @internal The S/MIME BR reserved policy identifiers of sec. 7.1.6.1 are a 4x3 matrix of
+   *  certificate type by generation, and a subscriber certificate asserts exactly one. Reading it
+   *  is how a linter learns which generation's table to hold the certificate to, so all twelve are
+   *  named rather than only the current ones. */
   cabfPolicy: { base: [2, 23, 140, 1], of: {
-    "ev-guidelines": 1, "domain-validated": [2, 1], "organization-validated": [2, 2], "individual-validated": [2, 3] } },
+    "ev-guidelines": 1, "domain-validated": [2, 1], "organization-validated": [2, 2], "individual-validated": [2, 3],
+    "smime-mailbox-legacy": [5, 1, 1], "smime-mailbox-multipurpose": [5, 1, 2], "smime-mailbox-strict": [5, 1, 3],
+    "smime-organization-legacy": [5, 2, 1], "smime-organization-multipurpose": [5, 2, 2], "smime-organization-strict": [5, 2, 3],
+    "smime-sponsor-legacy": [5, 3, 1], "smime-sponsor-multipurpose": [5, 3, 2], "smime-sponsor-strict": [5, 3, 3],
+    "smime-individual-legacy": [5, 4, 1], "smime-individual-multipurpose": [5, 4, 2], "smime-individual-strict": [5, 4, 3],
+    "code-signing-ev": 3, "code-signing": [4, 1], "code-signing-timestamping": [4, 2] } },
 
   idCp: { base: [1, 3, 6, 1, 5, 5, 7, 14], of: { "id-cp-ipAddr-asNumber": 2, "id-cp-ipAddr-asNumber-v2": 3 } },
 
+  /** @internal The Legal Entity Identifier extensions of S/MIME BR sec. 7.1.2.3 (l), which the
+   *  certificate type decides the admissibility of. */
+  lei: { base: [1, 3, 6, 1, 4, 1, 52266], of: { "lei-identifier": 1, "lei-role": 2 } },
+
+  /** @internal The Adobe extensions of S/MIME BR sec. 7.1.2.3 (m), prohibited under the Strict
+   *  generation. */
+  adobe: { base: [1, 2, 840, 113583, 1, 1, 9], of: { "adobe-timestamp": 1, "adobe-archive-rev-info": 2 } },
+
+  /** @internal The extended key purposes Code Signing BR sec. 7.1.2.3 (f) names as MAY beside
+   *  id-kp-codeSigning, so a row reporting any other purpose can exclude them by name. Document
+   *  Signing is registered twice: Microsoft assigns it 1.3.6.1.4.1.311.10.3.12, the sibling of the
+   *  Lifetime Signing arc printed two lines above it in that clause, and the clause itself prints
+   *  1.3.6.1.4.1.311.3.10.3.12. Both resolve, so a certificate carrying either is read as the
+   *  purpose the clause permits. */
+  msEku: { base: [1, 3, 6, 1, 4, 1, 311], of: {
+    "ms-lifetime-signing": [10, 3, 13],
+    "ms-document-signing": [10, 3, 12],
+    "ms-document-signing-as-printed": [3, 10, 3, 12] } },
+
   gsmaRspRole: { base: [2, 23, 146, 1, 2, 1], of: {
     "id-rspRole-ci": 0, "id-rspRole-euicc-v2": 1, "id-rspRole-euicc": [0, 0, 0, 0, 0],
     "id-rspRole-eum-v2": 2, "id-rspRole-eum": [0, 0, 0],

package/lib/pki-build.js

@@ -42,6 +42,9 @@ function _isSubDelim(c) {
   }
 }
 function _isUserinfoByte(c) { return _isUnreserved(c) || _isSubDelim(c) || c === 58; }
+/** @internal The bytes RFC 3986 sec. 3.2.2 admits in a reg-name, beside a percent-encoding. A DNS
+ *  label admits fewer, which is why a reader does not hold a host it was given to that rule. */
+function _isRegNameByte(c) { return _isUnreserved(c) || _isSubDelim(c); }
 function _isUriByte(c) {
   return _isUnreserved(c) || _isSubDelim(c) || c === 58 || c === 47 || c === 63 || c === 35 || c === 64;
 }
@@ -99,7 +102,61 @@ function _validUriIp6Host(s, from, to) {
   return packed !== null && intrinsic.sizeOf(packed) === 16;
 }
 
+/** @internal A port as RFC 3986 sec. 3.2.3 writes it: ":" *DIGIT, or nothing. An empty port after
+ *  the colon is what the grammar allows, so it is not a reason to refuse. */
+function _validUriPort(s, at, to) {
+  if (at === to) return true;
+  if (_charCodeAt(s, at) !== 58) return false;
+  for (var i = at + 1; i < to; i += 1) { if (!_isDigitCode(_charCodeAt(s, i))) return false; }
+  return true;
+}
+/** @internal An IPvFuture literal, RFC 3986 sec. 3.2.2: "v" 1*HEXDIG "." 1*( unreserved /
+ *  sub-delims / ":" ). */
+function _validIpvFuture(s, from, to) {
+  if (to - from < 4) return false;
+  var c = _charCodeAt(s, from);
+  if (c !== 118 && c !== 86) return false;
+  var i = from + 1, hex = 0;
+  while (i < to && _isHexCode(_charCodeAt(s, i))) { i += 1; hex += 1; }
+  if (hex === 0 || i >= to || _charCodeAt(s, i) !== 46) return false;
+  i += 1;
+  if (i >= to) return false;
+  for (; i < to; i += 1) {
+    c = _charCodeAt(s, i);
+    if (!_isUnreserved(c) && !_isSubDelim(c) && c !== 58) return false;
+  }
+  return true;
+}
+/** @internal The authority of a URL a reader was GIVEN, as RFC 3986 sec. 3.2 writes it:
+ *  [ userinfo "@" ] host [ ":" port ], where host is a non-empty reg-name, an IPv6 literal in
+ *  brackets, or an IPvFuture literal. RFC 7230 sec. 2.7.1 forbids an empty host for http, so the
+ *  host is required here. The structure is checked; the reg-name's own bytes are not held to DNS
+ *  label rules, which is what a URL this toolkit EMITS must satisfy and is not what RFC 3986
+ *  conformance means. Applying the emit rule to a value someone else wrote rejects legal URLs, and
+ *  dropping the structure with it accepts "http://:80". */
+function _validReadAuthority(s, from, to) {
+  var i, at = -1;
+  for (i = from; i < to; i += 1) { if (_charCodeAt(s, i) === 64) at = i; }
+  if (at !== -1 && !_componentBytesOk(s, from, at, _isUserinfoByte)) return false;
+  var hostStart = at === -1 ? from : at + 1;
+  if (hostStart >= to) return false;
+  if (_charCodeAt(s, hostStart) === 91) {
+    var close = -1;
+    for (i = hostStart + 1; i < to; i += 1) { if (_charCodeAt(s, i) === 93) { close = i; break; } }
+    if (close === -1) return false;
+    if (!_validUriIp6Host(s, hostStart + 1, close) && !_validIpvFuture(s, hostStart + 1, close)) return false;
+    return _validUriPort(s, close + 1, to);
+  }
+  var colon = -1;
+  for (i = hostStart; i < to; i += 1) { if (_charCodeAt(s, i) === 58) { colon = i; break; } }
+  var hostEnd = colon === -1 ? to : colon;
+  if (hostEnd === hostStart) return false;
+  if (!_componentBytesOk(s, hostStart, hostEnd, _isRegNameByte)) return false;
+  return colon === -1 ? true : _validUriPort(s, colon, to);
+}
+
 function _validUriAuthority(s, from, to, shape) {
+  if (shape.anyAuthority) return _validReadAuthority(s, from, to);
   var i, c, at = -1;
   for (i = from; i < to; i += 1) {
     c = _charCodeAt(s, i);
@@ -136,6 +193,13 @@ var _URI_SHAPE = intrinsic.assign(intrinsic.create(null), { singleLabel: false,
 /** @internal An HTTP URL (RFC 2616 sec. 3.2.2: "http:" "//" host [ ":" port ] [ abs_path [ "?" query ]]):
  *  no userinfo, a host of one label or many, a query only after an absolute path, no fragment. */
 var _HTTP_URL_SHAPE = intrinsic.assign(intrinsic.create(null), { singleLabel: true, userinfo: false, emptyAuthority: false, emptyHost: false, queryNeedsPath: true, fragment: false });
+/** @internal An http or https URL as RFC 7230 sec. 2.7.1 and 2.7.2 write it: "http:" "//"
+ *  authority path-abempty [ "?" query ], where path-abempty MAY be empty, so a query sits directly
+ *  after the authority, and where a fragment is allowed on the URI reference (RFC 3986 sec. 3.5).
+ *  This is the shape a reader holds a URL it was GIVEN to. The shape above is what the builders
+ *  hold the URLs they EMIT to, which is deliberately narrower, and applying it to a value someone
+ *  else wrote reports a conforming URL. */
+var _HTTP_URL_READ_SHAPE = intrinsic.assign(intrinsic.create(null), { singleLabel: true, userinfo: true, emptyAuthority: false, emptyHost: false, queryNeedsPath: false, fragment: true, anyAuthority: true });
 /** @internal An LDAP URL (RFC 4516 sec. 2: scheme "://" [host [":" port]] ["/" dn ...]): no
  *  userinfo, a host of any label count that may be left out, with or without a port, and no
  *  fragment. The dn, attributes, scope and filter after the "/" are not parsed. */
@@ -143,6 +207,17 @@ var _LDAP_URL_SHAPE = intrinsic.assign(intrinsic.create(null), { singleLabel: tr
 
 function _looksLikeUri(s) { return _uriShape(s, _URI_SHAPE); }
 function isHttpUrl(s) { return typeof s === "string" && guard.name.uriSchemeIs(s, "http") && _uriShape(s, _HTTP_URL_SHAPE); }
+/** @internal The scheme of a well-formed http or https URL as a READER judges one, or null where
+ *  the string is not one of either. Carrying the scheme token is not the same as being a URI of
+ *  that scheme: RFC 7230 sec. 2.7.1 writes http-URI as "http:" "//" authority path-abempty and
+ *  forbids an empty host, so "http:example.com/a" and "http://:80" are neither. A caller that
+ *  admits one scheme and not the other compares the answer rather than testing a prefix. */
+function httpUrlScheme(s) {
+  if (typeof s !== "string" || !_uriShape(s, _HTTP_URL_READ_SHAPE)) return null;
+  if (guard.name.uriSchemeIs(s, "http")) return "http";
+  if (guard.name.uriSchemeIs(s, "https")) return "https";
+  return null;
+}
 function isLdapUrl(s) { return typeof s === "string" && guard.name.uriSchemeIs(s, "ldap") && _uriShape(s, _LDAP_URL_SHAPE); }
 
 function _uriShape(s, shape) {
@@ -1378,4 +1453,4 @@ function samePublicKey(spkiA, spkiB) {
   return _keyEquals(ka, kb) === true;
 }
 
-module.exports = intrinsic.freeze({ makeBuilder: makeBuilder, reqDenseArray: reqDenseArrayImpl, KU_BIT: KU_BIT, tbsNameField: tbsNameField, tbsSerialNumber: tbsSerialNumber, randomSerial: randomSerial, skiValueOf: skiValueOf, isHttpUrl: isHttpUrl, isLdapUrl: isLdapUrl });
+module.exports = intrinsic.freeze({ makeBuilder: makeBuilder, reqDenseArray: reqDenseArrayImpl, KU_BIT: KU_BIT, tbsNameField: tbsNameField, tbsSerialNumber: tbsSerialNumber, randomSerial: randomSerial, skiValueOf: skiValueOf, isHttpUrl: isHttpUrl, httpUrlScheme: httpUrlScheme, isLdapUrl: isLdapUrl });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.17",
+  "version": "0.8.19",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:1b8d2783-3d1c-49be-ad22-5e029717a170",
+  "serialNumber": "urn:uuid:226c63e5-3f86-43a6-a5bd-ad58867e4706",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-24T06:15:30.953Z",
+    "timestamp": "2026-09-24T10:24:04.955Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.17",
+      "bom-ref": "@blamejs/pki@0.8.19",
       "type": "application",
       "name": "pki",
-      "version": "0.8.17",
+      "version": "0.8.19",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.17",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.19",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.17",
+      "ref": "@blamejs/pki@0.8.19",
       "dependsOn": []
     }
   ]