@blamejs/pki 0.8.25 → 0.8.27

package/lib/oid.js

@@ -608,6 +608,16 @@ var _PARAMS_ABSENT = new Set();
   "Ed25519", "Ed448", "X25519", "X448",
   "id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024",
   "hkdfWithSha256", "hkdfWithSha384", "hkdfWithSha512",
+  /** @internal RFC 3279 sec. 2.2.3: "When the ecdsa-with-SHA1 algorithm identifier appears as the
+   * algorithm field in an AlgorithmIdentifier, the encoding MUST omit the parameters field", and
+   * sec. 2.2.2 says SHALL for id-dsa-with-sha1. RFC 5758 sec. 3.2 repeats it for the SHA-2 set: "the
+   * encoding MUST omit the parameters field". Unlike the `*WithRSAEncryption` identifiers, which
+   * RFC 4055 requires to CARRY a NULL, these omit the field entirely. */
+  "ecdsaWithSHA1", "ecdsaWithSHA256", "ecdsaWithSHA384", "ecdsaWithSHA512", "dsaWithSha1",
+  /** @internal RFC 8702 sec. 2: "when using the id-shake128 or id-shake256 algorithm identifiers, the
+   * parameters MUST be absent", sec. 3.1 for the CMS digest fields, and sec. 3.2 for the two
+   * RSASSA-PSS-SHAKE signature identifiers. */
+  "shake128", "shake256", "id-RSASSA-PSS-SHAKE128", "id-RSASSA-PSS-SHAKE256",
   "id-alg-hss-lms-hashsig", "id-alg-xmss-hashsig", "id-alg-xmssmt-hashsig",
   "id-MLDSA44-RSA2048-PSS-SHA256", "id-MLDSA44-RSA2048-PKCS15-SHA256",
   "id-MLDSA44-Ed25519-SHA512", "id-MLDSA44-ECDSA-P256-SHA256",

package/lib/path-validate.js

@@ -458,7 +458,14 @@ function emailMatch(constraint, mailbox) {
   if (constraint.indexOf("@") !== -1) {
     var cb = splitMailbox(constraint);
     if (cb === "ambiguous" || cb === null || mb === null) return "unsupported";
-    return mb[0] === cb[0] && stripTrailingDot(mb[1].toLowerCase()) === stripTrailingDot(cb[1].toLowerCase());
+    /** @internal A constraint naming a whole mailbox asks the RFC 5280 sec. 7.5 question, so it is
+     * asked of the one place that holds that rule. A trailing dot on either domain is removed first,
+     * since sec. 4.2.1.10 compares a host and `a.example` and `a.example.` are one host. */
+    var verdict = guard.name.emailEqual(mb[0] + "@" + stripTrailingDot(mb[1]),
+      cb[0] + "@" + stripTrailingDot(cb[1]));
+    if (verdict === "match") return true;
+    if (verdict === "no-match") return false;
+    return "unsupported";
   }
   if (mb === null) return "unsupported";
   var host = stripTrailingDot(mb[1].toLowerCase());

package/lib/rfc3339.js

@@ -6,11 +6,18 @@
  * lib/rfc3339.js: RFC 3339 date-time parsing + validation, a fail-closed engine primitive shared by
  * pki.acme (a boolean field-validator over server-supplied JSON) and pki.ct (parse a CT log-list
  * timestamp / temporal-interval bound to a comparable Date). Beyond the grammar it enforces CALENDAR
- * validity: a syntactically well-formed but impossible instant (month 13, February 30, hour 25, a
- * :60 leap second, a +25:00 offset) is rejected, so a downstream expiry / window comparison never runs
- * on a value JS `Date` would silently roll over or `Date.parse` would NaN. Like the byte-reader / guard
- * family, `parse` takes the caller's `(code, message) -> error` factory so every consumer keeps its own
- * domain fault code.
+ * validity: a syntactically well-formed but impossible instant is rejected, so a downstream expiry or
+ * window comparison never runs on a value JS `Date` reads as a different instant.
+ * `2026-02-30T00:00:00Z` is the case that earns the check its keep: `new Date` reads it as
+ * `2026-03-02T00:00:00.000Z`, two days forward, and returns that instant without complaint. The
+ * runtime refuses month 13, hour 25 and a `+25:00` offset on its own, so the check agrees with it
+ * there and adds nothing.
+ * A `:60` second is well-formed: RFC 3339 sec. 5.7 permits `time-second` to be 60 at the end of a
+ * month in which a leap second occurs. Refusing it here is a decision, taken because JS cannot
+ * represent a leap second, so a caller that accepted one would hold either an invalid Date or an
+ * instant one second off; a typed error says so instead. Like the byte-reader / guard family, `parse`
+ * takes the caller's `(code, message) -> error` factory so every consumer keeps its own domain fault
+ * code.
  */
 
 function _digitsAt(v, start, count) {

package/lib/schema-attrcert.js

@@ -119,9 +119,30 @@ var HOLDER = schema.seq([
   ], { minTag: 0, maxTag: 2, unexpectedCode: "attrcert/bad-holder", orderCode: "attrcert/bad-holder" }),
 ], {
   assert: "sequence", code: "attrcert/bad-holder", what: "Holder",
-  build: function (m) {
+  /** @internal Sec. 4.2.2 states three requirements for the holder's baseCertificateID issuer that
+   *  sec. 4.2.3 states in the same words for the AC issuer: "The PKC issuer MUST have a non-empty
+   *  distinguished name that is to be present as the single value of the
+   *  holder.baseCertificateID.issuer construct in the directoryName field." V2_FORM's build enforces
+   *  the AC issuer's copy, so the holder's is enforced here. It is checked in THIS build rather than
+   *  in ISSUER_SERIAL, because that schema also reads a targetInformation targetCertificate, which
+   *  sec. 4.2.2 says nothing about. */
+  build: function (m, ctx) {
+    var base = m.fields.baseCertificateID.present ? m.fields.baseCertificateID.value.result : null;
+    if (base !== null) {
+      var names = base.issuer.names;
+      if (names.length !== 1) {
+        throw ctx.E("attrcert/bad-holder", "the baseCertificateID issuer must contain one and only one GeneralName (RFC 5755 sec. 4.2.2)");
+      }
+      if (names[0].tagNumber !== 4) {
+        throw ctx.E("attrcert/bad-holder", "the baseCertificateID issuer GeneralName must be a directoryName [4] (RFC 5755 sec. 4.2.2)");
+      }
+      var dirName = pkix.decodeNested(names[0].bytes, ctx, "the baseCertificateID issuer directoryName").children[0];
+      if (!dirName.children || dirName.children.length < 1) {
+        throw ctx.E("attrcert/bad-holder", "the baseCertificateID issuer directoryName must be a non-empty distinguished name (RFC 5755 sec. 4.2.2)");
+      }
+    }
     return {
-      baseCertificateID: m.fields.baseCertificateID.present ? m.fields.baseCertificateID.value.result : null,
+      baseCertificateID: base,
       entityName: m.fields.entityName.present ? m.fields.entityName.value.result : null,
       objectDigestInfo: m.fields.objectDigestInfo.present ? m.fields.objectDigestInfo.value.result : null,
     };
@@ -605,18 +626,27 @@ function validateExtensionValue(extnOid, extnValueDer) {
 }
 
 /** @internal The criticality RFC 5755 fixes for each extension it profiles for an attribute
- *  certificate. The AC signer refuses to write an extension against this table and the extension
- *  door reports one that arrived against it, from this one row set. */
+ *  certificate: sec. 4.3's six, and the ProxyInfo whose criticality sec. 7.2 fixes the same way. The
+ *  AC signer refuses to write an extension against this table, the extension door reports one that
+ *  arrived against it, and the RFC 5755 lint profile takes its own view of it, from this one row set.
+ *  Each row carries the clause number and the citation is rendered from it, so a reader cannot be
+ *  given a clause that names a different section than the rule it states.
+ *  An extension whose clause says MAY has no row, because a MAY fixes no criticality. AAControls is
+ *  that case: sec. 7.4 states "criticality MAY be TRUE" and places it in "CA and AC issuer PKCs",
+ *  so for an attribute certificate it is one of the extensions sec. 4.2.9 governs, where a
+ *  non-critical one conforms and a critical one does not. That is profile membership, which the lint
+ *  profile answers from the keys of this table, and not a criticality to enforce here. */
 var AC_FIXED_CRITICALITY_ROWS = [
-  ["acAuditIdentity", true, "RFC 5755 sec. 4.3.1"], ["targetInformation", true, "RFC 5755 sec. 4.3.2"],
-  ["authorityKeyIdentifier", false, "RFC 5755 sec. 4.3.3"], ["authorityInfoAccess", false, "RFC 5755 sec. 4.3.4"],
-  ["cRLDistributionPoints", false, "RFC 5755 sec. 4.3.5"], ["noRevAvail", false, "RFC 5755 sec. 4.3.6"],
-  ["acProxying", true, "RFC 5755 sec. 7.3"], ["aaControls", true, "RFC 5755 sec. 7.4"],
+  ["acAuditIdentity", true, "4.3.1"], ["targetInformation", true, "4.3.2"],
+  ["authorityKeyIdentifier", false, "4.3.3"], ["authorityInfoAccess", false, "4.3.4"],
+  ["cRLDistributionPoints", false, "4.3.5"], ["noRevAvail", false, "4.3.6"],
+  ["acProxying", true, "7.2"],
 ];
 function extensionCriticality(oidRegistry) {
   var table = intrinsic.create(null);
   intrinsic.forEach(AC_FIXED_CRITICALITY_ROWS, function (r) {
-    table[oidRegistry.byName(r[0])] = { critical: r[1], citation: r[2] };
+    table[oidRegistry.byName(r[0])] =
+      { name: r[0], critical: r[1], clause: r[2], citation: "RFC 5755 sec. " + r[2] };
   });
   return table;
 }

package/lib/schema-cms.js

@@ -1092,8 +1092,31 @@ function parseCertsOnly(der, E, prefix, maxCerts, requireCert) {
   };
 }
 
+/** @internal The DER encoding of ASN.1 NULL, which RFC 5754 sec. 2 makes interchangeable with absent
+ *  parameters on a digest AlgorithmIdentifier: "Implementations MUST accept SHA2 AlgorithmIdentifiers
+ *  with absent parameters. Implementations MUST accept SHA2 AlgorithmIdentifiers with NULL
+ *  parameters." */
+var DIGEST_DER_NULL = Buffer.from([0x05, 0x00]);
+function digestParamsAbsentOrNull(p) {
+  if (p === null || p === undefined) return true;
+  return Buffer.isBuffer(p) && p.equals(DIGEST_DER_NULL);
+}
+/** @internal Whether two digest AlgorithmIdentifiers name one algorithm, under the rule above. Two
+ *  identifiers carrying the same OID and different parameters are different digests, so the
+ *  parameters are read rather than ignored; absent and an explicit NULL are the one exception the
+ *  clause grants. Every place that compares or LISTS a digest answers from here, so a set cannot be
+ *  written under one rule and read under another. */
+function sameDigestAlgorithm(a, c) {
+  if (!a || !c || a.oid !== c.oid) return false;
+  if (digestParamsAbsentOrNull(a.parameters)) return digestParamsAbsentOrNull(c.parameters);
+  if (digestParamsAbsentOrNull(c.parameters)) return false;
+  return Buffer.isBuffer(a.parameters) && Buffer.isBuffer(c.parameters) &&
+    a.parameters.equals(c.parameters);
+}
+
 module.exports = {
   parse: parse,
+  sameDigestAlgorithm: sameDigestAlgorithm,   // @internal
   pemDecode: pemDecode,
   pemEncode: pemEncode,
   matches: matches,

package/lib/schema-tsp.js

@@ -34,10 +34,12 @@
  *   inputs, single-signer token composition over CMS, fail-closed.
  */
 
+var nodeCrypto = require("crypto");
 var asn1 = require("./asn1-der");
 var schema = require("./schema-engine");
 var pkix = require("./schema-pkix");
 var oid = require("./oid");
+var smime = require("./schema-smime");
 var cms = require("./schema-cms");
 var frameworkError = require("./framework-error");
 
@@ -500,6 +502,85 @@ function matches(root) {
   return true;
 }
 
+/** @internal The output length RFC 8702 sec. 2 fixes for each XOF where it names a message digest.
+ *  A certHash of any other length is not that digest, and the length comparison below refuses it. */
+var ESS_XOF_BYTES = Object.assign(Object.create(null), { shake128: 32, shake256: 64 });
+
+/** @internal Which digest an ESS certHash names. RFC 5035 sec. 4's ESSCertIDv2 carries a hashAlgorithm
+ *  AlgorithmIdentifier and fixes no set of algorithms for it, and RFC 2634 sec. 5.4's ESSCertID carries
+ *  no such field at all, where SHA-1 is implied. Both attributes satisfy RFC 3161 sec. 2.4.2, so both
+ *  are read here, and each name comes from the OID registry rather than the token, so the registry is
+ *  the set of names this is asked about. A hand-kept table of four names left the signer of a token
+ *  naming any other registered digest unresolved and every row that reads the signer certificate
+ *  silent, so the question asked is whether this build computes the digest.
+ *  The digest answers WHICH of the certificates a token already carries the token says signed it,
+ *  which is a different question from whether that binding is strong enough to trust: a sender who
+ *  could find a collision here also chose the certificates it would collide, and `pki.tsp.verify`
+ *  keeps its own narrower table for the binding it accepts. */
+var ESS_NODE_DIGESTS = Object.create(null);
+nodeCrypto.getHashes().forEach(function (n) { ESS_NODE_DIGESTS[n] = true; });
+function essDigest(name) {
+  if (typeof name !== "string" || ESS_NODE_DIGESTS[name] !== true) return null;
+  var xof = ESS_XOF_BYTES[name];
+  /** @internal One read of the name answers both whether the digest can be computed and how to
+   *  compute it, so the hash every candidate is put through is the one that read settled. */
+  return function () {
+    return xof ? nodeCrypto.createHash(name, { outputLength: xof }) : nodeCrypto.createHash(name);
+  };
+}
+
+/** @internal Which of the certificates a token embeds is the one that signed it. RFC 3161 sec. 2.4.2
+ *  requires the ESS SigningCertificate or SigningCertificateV2 signed attribute and `parseToken`
+ *  refuses a token carrying neither, so the certHash is present, and it names exactly one
+ *  certificate. The SignerInfo sid names no certificate uniquely: an issuer with a serial, and a
+ *  subject key identifier, are both values an issuer wrote, two certificates can carry either, and
+ *  the `certificates` SET is outside the signature, so a reader that takes the first sid match
+ *  answers from an order the sender chose. Returns the signer's DER, or null when no embedded
+ *  certificate hashes to the ESS value, which is the answer a token supplying its certificate out of
+ *  band gets, and when two attributes name two different embedded certificates. The hash is a public
+ *  value and is compared by content. */
+function signerCertificateDer(token) {
+  var attrs = (token.signerInfo && token.signerInfo.signedAttrs) || [];
+  if (!Array.isArray(attrs)) return null;
+  var found = null;
+  for (var i = 0; i < attrs.length; i++) {
+    if (attrs[i].type !== OID_SIGNING_CERT_V2 && attrs[i].type !== OID_SIGNING_CERT) continue;
+    var named = _essNamedCertificate(token, attrs[i]);
+    if (named === null) continue;
+    /** @internal RFC 5035 sec. 7: the two attributes "are generated and evaluated independently" and
+     * "the contents could conceivably be in conflict", where a signer holds several certificates over
+     * one key. Two that name two different certificates leave which of them signed the token
+     * unsettled, so this answers with nothing and the caller says so, rather than taking one of
+     * them. */
+    if (found !== null) return Buffer.compare(found, named) === 0 ? found : null;
+    found = named;
+  }
+  return found;
+}
+
+/** @internal The certificate one ESS attribute names, or null when the token embeds none that hashes
+ *  to its value. Each attribute is read on its own, so a token carrying both, which RFC 5035 sec. 7
+ *  permits so that a legacy reader keeps its protection against certificate substitution, resolves
+ *  from whichever of them names a certificate it carries. */
+function _essNamedCertificate(token, attr) {
+  var decoded;
+  // allow:swallow-unverified no token reaches here with an unreadable ESS attribute, since parseToken refuses one as tsp/bad-token; this answers for a caller that resolves against a token it parsed elsewhere
+  try { decoded = smime.decodeAttribute(attr); } catch (_e) { return null; }
+  var essCert = decoded && decoded.certs && decoded.certs[0];
+  if (!essCert || !essCert.hashAlgorithm || !essCert.certHash) return null;
+  var digest = essDigest(essCert.hashAlgorithm.name);
+  if (digest === null) return null;
+  var want = Buffer.from(essCert.certHash);
+  var certs = Array.isArray(token.certificates) ? token.certificates : [];
+  for (var j = 0; j < certs.length; j++) {
+    var element = certs[j];
+    if (!element || element.tagClass !== "universal" || !Buffer.isBuffer(element.bytes)) continue;
+    var actual = digest().update(element.bytes).digest();
+    if (actual.length === want.length && Buffer.compare(actual, want) === 0) return element.bytes;
+  }
+  return null;
+}
+
 module.exports = {
   parse: parse,
   parseResponse: parse,
@@ -507,6 +588,7 @@ module.exports = {
   decodeGeneralName: decodeGeneralName,   // @internal
   parseTstInfo: parseTstInfo,
   parseToken: parseToken,
+  signerCertificateDer: signerCertificateDer,   // @internal
   pemDecode: pemDecode,
   pemEncode: pemEncode,
   matches: matches,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.25",
+  "version": "0.8.27",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",
@@ -86,6 +86,6 @@
   "devDependencies": {
     "c8": "12.0.0",
     "esbuild": "0.28.2",
-    "eslint": "10.10.0"
+    "eslint": "10.11.0"
   }
 }

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:34f30267-88dd-4bb6-b35e-f48345fa4997",
+  "serialNumber": "urn:uuid:0dc52d70-7641-471f-98fe-c06068d7838f",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-24T17:21:10.581Z",
+    "timestamp": "2026-09-28T19:32:41.570Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.25",
+      "bom-ref": "@blamejs/pki@0.8.27",
       "type": "application",
       "name": "pki",
-      "version": "0.8.25",
+      "version": "0.8.27",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.25",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.27",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.25",
+      "ref": "@blamejs/pki@0.8.27",
       "dependsOn": []
     }
   ]