@blamejs/pki 0.8.28 → 0.8.31

package/lib/ocsp.js

@@ -197,9 +197,16 @@ function _buildRequest(query, opts) {
     var issuer = _certOf(q.issuer, "the issuer certificate");
     return _buildCertID(cert, issuer, hashName).then(function (certID) {
       var reqChildren = [certID];
-      if (q.singleRequestExtensions && q.singleRequestExtensions.length) {
-        if (lightweight) throw _err("ocsp/bad-input", "the lightweight profile permits no singleRequestExtensions (RFC 5019 sec. 2.1.1)");
-        reqChildren.push(b.explicit(0, b.sequence(q.singleRequestExtensions)));
+      if (q.singleRequestExtensions != null) {
+        /** @internal Read through the same door the sibling lists in this module use, so a value that is
+         *  not an array is refused rather than passed over: read as truthy-and-has-length, an object or a
+         *  number produced a Request carrying none of the extensions the caller asked for, and nothing in
+         *  the result said so. */
+        var singles = pkiBuild.reqDenseArray(q.singleRequestExtensions, "singleRequestExtensions", _err, "ocsp/bad-input");
+        if (singles.length) {
+          if (lightweight) throw _err("ocsp/bad-input", "the lightweight profile permits no singleRequestExtensions (RFC 5019 sec. 2.1.1)");
+          reqChildren.push(b.explicit(0, b.sequence(singles)));
+        }
       }
       return b.sequence(reqChildren);
     });

package/lib/schema-pkix.js

@@ -479,11 +479,44 @@ function coerceToDer(input, opts) {
      * would otherwise be read end to end on the way to being refused for its size. */
     guard.limits.byteCap(buf, _COERCE_MAX_BYTES, function (c, m) { return new opts.ErrorClass(c, m); },
       opts.prefix + "/too-large", "parse input");
-    return _isPemArmor(buf) ? pemDecode(buf, opts.pemLabel, opts.PemError) : buf;
+    if (!_isPemArmor(buf)) return buf;
+    /** @internal A DER header short enough for the short form can be entirely text bytes, so the
+     * probe alone cannot separate armor from a DER value carrying an armor line in its content: an
+     * APPLICATION 3 primitive is identifier 0x43 and any content length from 32 to 126 is a
+     * printable length octet. Bytes that do not decode as one complete DER value are armor, which is
+     * the resolution `pki convert` takes and keeps every PEM file a caller reads into a Buffer on the
+     * PEM path. The decode runs only where the probe already said armor, so DER input reaches its
+     * parser without it. */
+    if (!_isCompleteDer(buf)) return pemDecode(buf, opts.pemLabel, opts.PemError);
+    /** @internal A primitive tag makes any content valid, so bytes can satisfy both readings at once
+     * and no rule chooses between them: a caller handed the wrong one would be handed the other
+     * reading's bytes, silently. The argument is what is ambiguous, not the file, so the message
+     * names the two unambiguous ways to say which was meant. */
+    if (_isPemBlock(buf, opts)) {
+      throw new opts.ErrorClass(opts.prefix + "/bad-input",
+        "parse input is both one complete DER value and a well-formed PEM block, so which was meant " +
+        "cannot be read from the bytes: pass PEM as a string, or pass the DER value on its own");
+    }
+    return buf;
   }
   throw new opts.ErrorClass(opts.prefix + "/bad-input", "parse expects a DER BufferSource (Buffer, typed array, DataView, or ArrayBuffer) or a PEM string");
 }
 
+/** @internal Whether a buffer also holds a well-formed PEM block, asked only to detect that both
+ * readings hold. The decoded bytes are discarded: the caller refuses rather than choosing one. */
+function _isPemBlock(buf, opts) {
+  try { pemDecode(buf, opts.pemLabel, opts.PemError); return true; }
+  catch (_e) { return false; }
+}
+
+/** @internal Whether a buffer is exactly one complete DER value. Trailing bytes disqualify it, so a
+ * PEM file whose leading text happened to decode cannot be taken for DER on that prefix alone. */
+function _isCompleteDer(buf) {
+  // allow:bare-decode classifies bytes AT the door, before a parse context exists to carry caps; the buffer is byte-capped above and the decode holds the codec's own caps.
+  try { asn1.decode(buf); return true; }
+  catch (_e) { return false; }
+}
+
 /** @internal Whether a buffer is armored text rather than DER. Read from a fixed window at the
  * front, the answer is wrong for a file whose explanatory text is longer than the window, and the
  * caller then hands PEM to the DER decoder and reports the DER as malformed. So the whole buffer is
@@ -493,7 +526,11 @@ function _isPemArmor(buf) {
   var n = buf.length;
   for (var i = 0; i < n; i++) {
     var c = buf[i];
-    var textByte = (c >= 0x20 && c < 0x7f) || c === 0x09 || c === 0x0a || c === 0x0d ||
+    /** @internal ASCII whitespace has six members and a text file carries all six, so the walk
+     * passes tab, line feed, vertical tab, form feed, carriage return and space, plus the printable
+     * range and the byte-order mark. Every other byte ends the walk: a boundary behind one means the
+     * buffer is not text, and DER is binary. A PEM file that does carry one is passed as a string. */
+    var textByte = (c >= 0x20 && c < 0x7f) || (c >= 0x09 && c <= 0x0d) ||
       c === 0xef || c === 0xbb || c === 0xbf;
     if (!textByte) return false;
     if (c === 0x2d && _bufToString(_subarray(buf, i, i + 10), "latin1") === "-----BEGIN") return true;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.28",
+  "version": "0.8.31",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3eb9063d-93f7-4a44-bdff-52a992c9a1e7",
+  "serialNumber": "urn:uuid:ea5fc812-c57e-4508-9ef7-3dc7126381e6",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-28T21:19:37.849Z",
+    "timestamp": "2026-09-29T06:11:34.254Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.28",
+      "bom-ref": "@blamejs/pki@0.8.31",
       "type": "application",
       "name": "pki",
-      "version": "0.8.28",
+      "version": "0.8.31",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.28",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.31",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.28",
+      "ref": "@blamejs/pki@0.8.31",
       "dependsOn": []
     }
   ]