@blamejs/pki 0.8.49 → 0.8.51

package/lib/revocation-fetch.js

@@ -31,6 +31,14 @@ var OID_AD_OCSP = oid.byName("ocsp");
 var OID_OCSP_NONCE = oid.byName("ocspNonce");
 
 var _append = guard.list.append;
+/** @internal The URL parser, taken at load: the host it reports is the distribution point a fetch is
+ *  directed to. Its accessors are taken with it, since the constructor's capture does not cover the
+ *  prototype the value reads its parts off and the host read here is the one the filter applies to. */
+var _URL = intrinsic.URL;
+var _urlHref = intrinsic.urlHref;
+var _urlProtocol = intrinsic.urlProtocol;
+var _urlHostname = intrinsic.urlHostname;
+var _urlSetHash = intrinsic.urlSetHash;
 var LIMITS = constants.LIMITS;
 
 var CHECKER_OPTS = intrinsic.assign(intrinsic.create(null), {
@@ -162,18 +170,19 @@ function _ocspCandidates(descriptions, net_, skips) {
 function _acceptableUrl(value, net_) {
   if (typeof value !== "string" || value === "") return _no("is not one this client fetches");
   var u;
-  try { u = new URL(value); }
+  try { u = new _URL(value); }
   catch (_e) { return _no("is not one this client fetches"); }   // allow:swallow-unverified a value that is not a URL names no location
-  if (u.protocol !== "https:" && !(net_.allowHttp && u.protocol === "http:")) return _no("is not one this client fetches");
-  var host = u.hostname;
+  var scheme = _urlProtocol(u);
+  if (scheme !== "https:" && !(net_.allowHttp && scheme === "http:")) return _no("is not one this client fetches");
+  var host = _urlHostname(u);
   if (host.charAt(0) === "[" && host.charAt(host.length - 1) === "]") host = host.slice(1, -1);
   if (net.isIP(host) !== 0) {
     if (httpTransport.isBlockedIp(host)) return _no("is not one this client fetches");
   } else if (!net_.guardsAddresses) {
     return _no("names a host whose resolved address opts.transport does not declare it filters");
   }
-  u.hash = "";
-  return { url: u.href, why: null };
+  _urlSetHash(u, "");
+  return { url: _urlHref(u), why: null };
 }
 
 function _no(why) { return { url: null, why: why }; }

package/lib/scep.js

@@ -37,6 +37,21 @@
 
 var frameworkError = require("./framework-error");
 var ScepError = frameworkError.ScepError;
+var intrinsic = require("./guard-intrinsic");
+/** @internal The URL parser, taken at load: what it returns names the host an operation is sent to,
+ *  and a redirect is resolved against the current operation URL with it. The conversion the parser is
+ *  handed is taken with it, since a replacement answers with a host of its own. */
+var _URL = intrinsic.URL;
+var _stringOf = intrinsic.String;
+/** @internal And the accessors its result is read through: capturing the constructor does not capture
+ *  the prototype the value reads its parts off, and the scheme here decides whether a redirect may
+ *  be followed while the origin decides whether it is a cross-origin one. */
+var _urlHref = intrinsic.urlHref;
+var _urlOrigin = intrinsic.urlOrigin;
+var _urlProtocol = intrinsic.urlProtocol;
+var _urlSearchParams = intrinsic.urlSearchParams;
+var _urlHash = intrinsic.urlHash;
+var _searchSet = intrinsic.uncurry(URLSearchParams.prototype.set);
 var oid = require("./oid");
 var asn1 = require("./asn1-der");
 var b = asn1.build;
@@ -661,28 +676,34 @@ function _responseLen(body) {
   if (Buffer.isBuffer(body)) return guard.bytes.lengthOf(body);
   return guard.bytes.lengthOf(guard.bytes.source(body, ScepError, "scep/bad-response", "the response body"));
 }
+/** @internal The settings this client forwards to its transport. */
+var TLS_SETTINGS = ["anchors", "useSystemStore", "cert", "key", "minVersion", "servername", "checkServerIdentity"];
 function _tlsForRequest(opts) {
-  var t = opts.tls || {};
-  return { anchors: t.anchors, useSystemStore: t.useSystemStore, cert: t.cert, key: t.key, minVersion: t.minVersion, servername: t.servername, checkServerIdentity: t.checkServerIdentity };
+  return guard.identifier.pickSettings(opts.tls, TLS_SETTINGS);
 }
 function _redirectTarget(current, location, method, allowCrossOrigin) {
   if (location == null || _trim(String(location)) === "") throw _err("scep/bad-response", "a redirect response carried no Location header");
   var resolved;
-  try { resolved = new URL(String(location), current.href); }
+  try { resolved = new _URL(_stringOf(location), _urlHref(current)); }
   catch (e) { throw _err("scep/bad-url", "a redirect Location did not parse: " + location, e); }
-  if (resolved.protocol !== "http:" && resolved.protocol !== "https:") throw _err("scep/bad-url", "a redirect to a non-HTTP scheme is refused: " + resolved.protocol);
-  if (current.protocol === "https:" && resolved.protocol !== "https:") throw _err("scep/insecure-redirect", "a redirect from https to " + resolved.protocol + " is refused");
+  /** @internal Each scheme read ONCE: the first test decides whether the target is HTTP at all and
+   *  the second whether it is a downgrade, and those two have to be answered about one value. */
+  var toScheme = _urlProtocol(resolved);
+  var fromScheme = _urlProtocol(current);
+  if (toScheme !== "http:" && toScheme !== "https:") throw _err("scep/bad-url", "a redirect to a non-HTTP scheme is refused: " + toScheme);
+  if (fromScheme === "https:" && toScheme !== "https:") throw _err("scep/insecure-redirect", "a redirect from https to " + toScheme + " is refused");
   var safe = method === "GET" || method === "HEAD";
-  if (resolved.origin !== current.origin && !safe && !allowCrossOrigin) throw _err("scep/cross-origin-redirect", "a cross-origin redirect on a " + method + " needs opts.allowCrossOriginRedirect");
+  if (_urlOrigin(resolved) !== _urlOrigin(current) && !safe && !allowCrossOrigin) throw _err("scep/cross-origin-redirect", "a cross-origin redirect on a " + method + " needs opts.allowCrossOriginRedirect");
   return resolved;
 }
 function _scepUrl(baseUrl, operation) {
   var url;
-  try { url = new URL(String(baseUrl)); }
+  try { url = new _URL(_stringOf(baseUrl)); }
   catch (e) { throw _err("scep/bad-url", "the SCEP base URL did not parse: " + _showValue(baseUrl), e); }
-  if (url.protocol !== "http:" && url.protocol !== "https:") throw _err("scep/bad-url", "the SCEP base URL must be http or https, got " + url.protocol);
-  if (url.hash) throw _err("scep/bad-url", "the SCEP base URL must not carry a fragment");
-  url.searchParams.set("operation", operation);
+  var baseScheme = _urlProtocol(url);
+  if (baseScheme !== "http:" && baseScheme !== "https:") throw _err("scep/bad-url", "the SCEP base URL must be http or https, got " + baseScheme);
+  if (_urlHash(url)) throw _err("scep/bad-url", "the SCEP base URL must not carry a fragment");
+  _searchSet(_urlSearchParams(url), "operation", operation);
   return url;
 }
 function _pkiMethod(opts) {
@@ -693,27 +714,27 @@ function _pkiMethod(opts) {
 }
 function _pkiRequest(method, opUrl, reqMsg, clientOpts) {
   if (method === "GET") {
-    var getUrl = new URL(opUrl.href);
-    getUrl.searchParams.set("message", Buffer.from(reqMsg).toString("base64"));
+    var getUrl = new _URL(_urlHref(opUrl));
+    _searchSet(_urlSearchParams(getUrl), "message", Buffer.from(reqMsg).toString("base64"));
     return _client("GET", getUrl, null, {}, clientOpts);
   }
   return _client("POST", opUrl, reqMsg, { "content-type": CT_PKI_MESSAGE }, clientOpts);
 }
 function _drive(method, url, body, headers, opts, transport, budgets) {
-  var redirects = 0, curMethod = method, curBody = body, initialOrigin = url.origin;
+  var redirects = 0, curMethod = method, curBody = body, initialOrigin = _urlOrigin(url);
   var proxySnap = _snapshotProxy(opts.proxy);
   var tlsBase = _tlsForRequest(opts);
   var allowCrossOrigin = !!opts.allowCrossOriginRedirect;
   function _hopTls(current) {
     var t = tlsBase;
-    if (current.origin !== initialOrigin) {
+    if (_urlOrigin(current) !== initialOrigin) {
       t = Object.assign({}, t);
       t.cert = null; t.key = null; t.servername = null;
     }
     return t;
   }
   function step(current) {
-    var req = { method: curMethod, url: current.href, headers: headers, tls: _hopTls(current), timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes };
+    var req = { method: curMethod, url: _urlHref(current), headers: headers, tls: _hopTls(current), timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes };
     if (proxySnap != null) req.proxy = proxySnap;
     if (curBody != null) req.body = curBody;
     return guard.async.invoked(transport, [req], _err, "scep/bad-input", "opts.transport").then(function (res) {

package/lib/x509-sign.js

@@ -71,6 +71,7 @@ var KNOWN_EXT_KEYS = intrinsic.assign(intrinsic.create(null), {
   authorityInfoAccess: 1, cRLDistributionPoints: 1, freshestCRL: 1,
   policyConstraints: 1, inhibitAnyPolicy: 1, policyMappings: 1, policyMappingsCritical: 1,
   issuerAltName: 1, qcStatements: 1, qcStatementsCritical: 1,
+  tlsFeature: 1, tlsFeatureCritical: 1,
   precertificatePoison: 1, signedCertificateTimestampList: 1,
   msCertificateTemplate: 1, msEnrollCertType: 1, msCaVersion: 1, msPreviousCertHash: 1,
   msApplicationPolicies: 1,
@@ -279,6 +280,9 @@ function _buildExtensions(extSpec, ctx) {
    *  unrecognized critical extension; the default is the form that validates and the knob reaches
    *  the other, as policyMappings and certificatePolicies do. */
   if (extSpec.qcStatements != null) guard.list.append(out, _ext(O("qcStatements"), !!extSpec.qcStatementsCritical, _extQcStatements(extSpec.qcStatements)));
+  /** @internal RFC 7633 sec. 4: SHOULD NOT be critical, and the clause names the case where critical
+   *  is the desired behavior, so the knob exists and the default is the compatible form. */
+  if (extSpec.tlsFeature != null) guard.list.append(out, _ext(O("tlsFeature"), !!extSpec.tlsFeatureCritical, _b.extTlsFeature(extSpec.tlsFeature)));
   if (extSpec.nameConstraints != null) {
     if (!caTrue) throw _err("x509/bad-input", "nameConstraints appears only in a CA certificate, so it requires basicConstraints cA=TRUE (RFC 5280 sec. 4.2.1.10)");
     guard.list.append(out, _ext(O("nameConstraints"), true, _extNameConstraints(extSpec.nameConstraints)));
@@ -628,6 +632,18 @@ function _hasCriticalSan(extSpec) {
  * know an unknown syntax. `pki.path.validate` does not process this extension, so it is emitted
  * non-critical unless `qcStatementsCritical` is set.
  *
+ * `extensions.tlsFeature` builds the RFC 7633 TLS Feature extension, the "must-staple" declaration,
+ * from a list of TLS ExtensionType values. Each is a number, a bigint, or one of the registry names
+ * this build knows, `status_request` and `status_request_v2`. The values come from the IANA TLS
+ * Extensions registry that RFC 7633 sec. 4.1 points at, and the type states no range, so a value
+ * outside that registry's width encodes and `pki.lint.certificate(der, { profile: "rfc7633" })`
+ * reports it rather than the encoder refusing it; the same holds for a repeated value, which the
+ * syntax permits. An EMPTY list is refused, because the extension it would emit advertises nothing.
+ * Emitted non-critical unless `tlsFeatureCritical` is set: sec. 4 says it SHOULD NOT be critical and
+ * names the case where critical is the caller's intent. `pki.path.validate` enforces sec. 4.2.2 over
+ * a built path, so a certificate issued under a CA that advertises features must offer the same set
+ * or a superset.
+ *
  * `extensions.subjectInfoAccess` takes the same `{ accessMethod, accessLocation }` list
  * `authorityInfoAccess` takes, since RFC 5280 sec. 4.2.2.2 gives it sec. 4.2.2.1's syntax; the two
  * access methods that section defines are the registered names `id-ad-caRepository` and
@@ -910,6 +926,10 @@ var EXTENSION_ROWS = [
   ["cRLDistributionPoints", "cRLDistributionPoints", { fixed: false, cite: "RFC 5280 sec. 4.2.1.13" }, function (v) { return _extCrlDp(v, "cRLDistributionPoints"); }],
   ["freshestCRL", "freshestCRL", { fixed: false, cite: "RFC 5280 sec. 4.2.1.15" }, function (v) { return _extCrlDp(v, "freshestCRL"); }],
   ["qcStatements", "qcStatements", { knob: true, dflt: false }, function (v) { return _extQcStatements(v); }],
+  /** @internal RFC 7633 sec. 4 reads "SHOULD NOT be marked critical" and then names the case where
+   *  the critical form is what the caller wants, so this takes a knob defaulting to the compatible
+   *  form rather than refusing one: `fixed: false` would promote that SHOULD NOT into a refusal. */
+  ["tlsFeature", "tlsFeature", { knob: true, dflt: false }, function (v) { return _b.extTlsFeature(v); }],
   ["subjectDirectoryAttributes", "subjectDirectoryAttributes", { fixed: false, cite: "RFC 5280 sec. 4.2.1.8" }, function (v) { return _b.extSubjectDirectoryAttributes(v); }],
   ["msCertificateTemplate", "msCertificateTemplate", { fixed: false, cite: "the toolkit issues the form its readers accept" }, function (v) { return _b.extMsCertificateTemplate(v); }],
   ["msEnrollCertType", "msEnrollCertType", { fixed: false, cite: "the toolkit issues the form its readers accept" }, function (v) { return _b.extMsEnrollCertType(v); }],
@@ -971,8 +991,8 @@ function _extensionCritical(row, opts) {
  * (the key identifiers, the constraint and policy-constraint extensions, the access and
  * distribution extensions), or the toolkit issues one form only, `opts.critical` may only restate
  * that value. `keyUsage` (default critical), `extendedKeyUsage`, `certificatePolicies`,
- * `policyMappings`, `qcStatements` (default non-critical), and `subjectAltName` (critical exactly
- * when the subject is empty, which the caller knows) take `opts.critical`; `basicConstraints`
+ * `policyMappings`, `qcStatements` and `tlsFeature` (default non-critical), and `subjectAltName`
+ * (critical exactly when the subject is empty, which the caller knows) take `opts.critical`; `basicConstraints`
  * carries `critical` inside its value. An unregistered OID takes `opts.critical` as stated.
  *
  * @opts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.49",
+  "version": "0.8.51",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:850d86e8-9f55-4854-9b3a-89ed4e16dfd5",
+  "serialNumber": "urn:uuid:3a1ddfe7-c71b-4cb4-8bd0-256c3b6075ba",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-05T08:10:11.062Z",
+    "timestamp": "2026-10-05T13:17:14.754Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.49",
+      "bom-ref": "@blamejs/pki@0.8.51",
       "type": "application",
       "name": "pki",
-      "version": "0.8.49",
+      "version": "0.8.51",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.49",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.51",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.49",
+      "ref": "@blamejs/pki@0.8.51",
       "dependsOn": []
     }
   ]