@blamejs/pki 0.9.0 → 0.9.3

package/lib/schema-pkix.js

@@ -1811,6 +1811,12 @@ function _acceptExtensionRecord(ext, E, code, key) {
 function keyUsagePermits(ns, allowed) {
   var kuOid = ns.oid.byName("keyUsage");
   var decoders = certExtensionDecoders(ns).byOid;
+  /** @internal `allowed` may be a FUNCTION of the certificate, for a caller whose permitted set
+   *  depends on the subject key: an establishment bit authorizes nothing where the key's own family
+   *  cannot perform that establishment mechanism, and the certificate is the only place that says
+   *  which family it is. Every name the set names must be one the KeyUsage decoder defines, since
+   *  the record it answers from inherits nothing. */
+  var perCert = typeof allowed === "function";
   return function (parsedCert) {
     var exts = (parsedCert && parsedCert.extensions) || [];
     for (var i = 0; i < exts.length; i++) {
@@ -1818,13 +1824,60 @@ function keyUsagePermits(ns, allowed) {
       var ku;
       try { ku = decoders[kuOid](exts[i].value); }
       catch (e) { void e; return false; }
-      for (var a = 0; a < allowed.length; a++) if (ku[allowed[a]] === true) return true;
+      var names = perCert ? allowed(parsedCert) : allowed;
+      for (var a = 0; a < names.length; a++) if (ku[names[a]] === true) return true;
       return false;
     }
     return true;
   };
 }
 
+/** @internal Which key-establishment bit a subject key's own family can carry, as one table the
+ *  callers that read an establishment usage share. The governing documents state it per family:
+ *  RFC 3279 sec. 2.3.1 lists keyEncipherment for an RSA key and does not list keyAgreement; RFC 5480
+ *  sec. 3 lists keyAgreement for id-ecPublicKey, id-ecDH and id-ecMQV, and RFC 8813 sec. 3 makes
+ *  keyEncipherment and dataEncipherment a MUST NOT for all three; RFC 8410 sec. 5 makes keyAgreement
+ *  a MUST for id-X25519 and id-X448; and RFC 9935 sec. 5 has an ML-KEM certificate assert
+ *  keyEncipherment as its only usage.
+ *
+ *  A family in NEITHER column answers null, which is the refusing direction: an establishment bit
+ *  then authorizes nothing, and a signature bit is what the certificate has to assert. */
+var KEY_TRANSPORT_KEY_NAMES = ["rsaEncryption", "rsaesOaep"];
+/** @internal The three FIPS 203 sets and the composite KEM arms, matched by the prefix the registry
+ *  files them under rather than listed one at a time, so a set the registry gains later belongs to
+ *  this rule without a second edit. */
+var KEY_TRANSPORT_KEY_PREFIXES = ["id-ml-kem-", "id-MLKEM"];
+var KEY_AGREEMENT_KEY_NAMES = ["ecPublicKey", "X25519", "X448", "dhpublicnumber"];
+
+var _estabBitByNs = new _WeakMapI();
+
+function keyEstablishmentBit(ns) {
+  var table = _weakGet(_estabBitByNs, ns.oid);
+  if (table === undefined) {
+    table = _assign(_create(null), {});
+    var put = function (bit) {
+      return function (n) {
+        var dotted = ns.oid.byName(n);
+        if (dotted !== undefined && dotted !== null) table[dotted] = bit;
+      };
+    };
+    _forEach(KEY_TRANSPORT_KEY_NAMES, put("keyEncipherment"));
+    _forEach(KEY_AGREEMENT_KEY_NAMES, put("keyAgreement"));
+    var registry = ns.oid.all();
+    _forEach(intrinsic.keys(registry), function (dotted) {
+      var n = registry[dotted];
+      if (typeof n !== "string") return;
+      _forEach(KEY_TRANSPORT_KEY_PREFIXES, function (p) {
+        if (_strIndexOf(n, p) === 0) table[dotted] = "keyEncipherment";
+      });
+    });
+    _weakSet(_estabBitByNs, ns.oid, table);
+  }
+  return function (dotted) {
+    return typeof dotted === "string" && _hasOwn(table, dotted) ? table[dotted] : null;
+  };
+}
+
 /** @internal The subject-key algorithms that can only ever SIGN, as one table the linter and the verifier
  *  share. RFC 9883 sec. 6 states "The privateKeyPossessionStatement attribute MUST NOT be used to obtain a
  *  signature certificate", and sec. 4 states the same requirement as a property of the request: "the
@@ -1912,8 +1965,13 @@ function certExtensionDecoders(ns) {
     for (var z = 0; z < bs.bytes.length; z++) { if (bs.bytes[z] !== 0) { anyBit = true; break; } }
     if (!anyBit) throw ns.E(C, "KeyUsage must assert at least one bit (RFC 5280 sec. 4.2.1.3)");
     schema.assertMinimalNamedBits(bs.unusedBits, bs.bytes, function (m) { throw ns.E(C, m); });
-    // allow:registry-table-inherits-object-prototype -- the decoded KeyUsage record, whose keys are the fixed KU_BITS names the schema declares; the certificate supplies none of them
-    var out = {};
+    /** @internal The record inherits nothing. The exemption this carried rested on its keys being
+     *  the fixed KU_BITS names, and `keyUsagePermits` is called with a name that is NOT one of them:
+     *  `contentCommitment` is the X.509 spelling of the nonRepudiation bit and the BUILDER accepts
+     *  it, so an authorization gate asked for a name this decoder never defines and whatever
+     *  answered for it decided. Measured: a certificate confined to cRLSign went from maySign=false
+     *  to maySign=true under one assignment to `Object.prototype.contentCommitment`. */
+    var out = _create(null);
     _forEach(KU_BITS, function (nm, bit) {
       var byte = bit >> 3, mask = 0x80 >> (bit & 7);
       out[nm] = byte < bs.bytes.length && (bs.bytes[byte] & mask) !== 0;
@@ -2725,6 +2783,7 @@ module.exports = intrinsic.freeze({
   crlEntryFixedCriticality: crlEntryFixedCriticality,
   certExtensionDecoders: certExtensionDecoders,
   keyUsagePermits: keyUsagePermits,
+  keyEstablishmentBit: keyEstablishmentBit,
   signatureOnlyKeyOid: signatureOnlyKeyOid,
   scopedCertDecoder: scopedCertDecoder,
   crlExtensionDecoders: crlExtensionDecoders,

package/lib/schema-trustanchor.js

@@ -359,7 +359,7 @@ var TRUST_ANCHOR_LIST = schema.seqOf(TRUST_ANCHOR_CHOICE, {
  *   var pair = await pki.key.generate("Ed25519");
  *   var spki = await pki.key.export(pair.publicKey);
  *   var der = pki.trustanchor.build({ anchors: [{ taInfo: {
- *     pubKey: spki, keyId: Buffer.alloc(20, 1), certPath: { taName: "CN=Example Root" } } }] });
+ *     pubKey: spki, keyId: Buffer.alloc(20, 1), certPath: { taName: "Example Root" } } }] });
  *   pki.schema.trustanchor.parse(der).anchors[0].kind;   // -> "taInfo"
  */
 var parse = pkix.makeParser({
@@ -385,7 +385,7 @@ var parse = pkix.makeParser({
  *   var pair = await pki.key.generate("Ed25519");
  *   var spki = await pki.key.export(pair.publicKey);
  *   var list = pki.schema.trustanchor.parse(pki.trustanchor.build({ anchors: [{ taInfo: {
- *     pubKey: spki, keyId: Buffer.alloc(20, 1), certPath: { taName: "CN=Example Root" } } }] }));
+ *     pubKey: spki, keyId: Buffer.alloc(20, 1), certPath: { taName: "Example Root" } } }] }));
  *   list.anchors[0].taInfo.certPath.taName.dn;   // -> "CN=Example Root"
  */
 var parseInfo = pkix.makeParser({
@@ -407,7 +407,7 @@ var parseInfo = pkix.makeParser({
  *   var pair = await pki.key.generate("Ed25519");
  *   var der = pki.trustanchor.build({ anchors: [{ taInfo: {
  *     pubKey: await pki.key.export(pair.publicKey), keyId: Buffer.alloc(20, 1),
- *     certPath: { taName: "CN=Example Root" } } }] });
+ *     certPath: { taName: "Example Root" } } }] });
  *   pki.schema.trustanchor.pemDecode(pki.schema.trustanchor.pemEncode(der)).equals(der);  // -> true
  */
 function pemDecode(text, label) { return pkix.pemDecode(text, label || "TRUST ANCHOR LIST", PemError); }
@@ -426,7 +426,7 @@ function pemDecode(text, label) { return pkix.pemDecode(text, label || "TRUST AN
  *   var pair = await pki.key.generate("Ed25519");
  *   var der = pki.trustanchor.build({ anchors: [{ taInfo: {
  *     pubKey: await pki.key.export(pair.publicKey), keyId: Buffer.alloc(20, 1),
- *     certPath: { taName: "CN=Example Root" } } }] });
+ *     certPath: { taName: "Example Root" } } }] });
  *   pki.schema.trustanchor.pemEncode(der).indexOf("-----BEGIN TRUST ANCHOR LIST-----");  // -> 0
  */
 function pemEncode(der, label) { return pkix.pemEncode(der, label || "TRUST ANCHOR LIST", PemError); }

package/lib/sigstore.js

@@ -1383,7 +1383,7 @@ async function _verifyEmbeddedScts(leaf, leafDer, issuer, logs, timeMs, atMs) {
 /** @internal A receipt the verifier refuses structurally counted as verified would be the whole leg
  * lost, so a fault is an unverified receipt and the next one is still tried. */
 function _sctVerifies(entry, sct, spki) {
-  return _ctVerifySct(entry, sct, spki).then(function (ok) { return ok === true; }, function () { return false; });
+  return intrinsic.chain(_ctVerifySct(entry, sct, spki), function (ok) { return ok === true; }, function () { return false; });
 }
 
 /** @internal A receipt's own instant, in milliseconds. The parser's `timestampMs` is this same value

package/lib/smime.js

@@ -269,7 +269,6 @@ function _declaresHp(content) {
 
 function _noneSurface() { return { protectedHeaders: null, headerProtection: { present: false, mode: null, fromMismatch: null, confidential: [], legacy: null } }; }
 
-function _contentTypeCount(headers) { var n = 0; headers.forEach(function (h) { if (h.lname === "content-type") n++; }); return n; }
 
 var RFC5322_SINGLETON = new Set(["date", "from", "sender", "reply-to", "to", "cc", "bcc", "message-id", "in-reply-to", "references", "subject", "return-path"]);
 
@@ -334,7 +333,6 @@ function _legacyHpSurface(canon, outerEnt, mode, enabled) {
     if (partC.contentType.type !== "message/rfc822") return _noneSurface();
     partD = mime.parse(partC.body, SmimeError, "smime/bad-header-protection");
   } catch (_e) { return _noneSurface(); }
-  if (_contentTypeCount(partC.headers) > 1 || _contentTypeCount(partD.headers) > 1) return _noneSurface();
   if (mime.hasParam(partD.contentType.value, "hp")) return _noneSurface();
   if (_isCryptoLayer(partD.contentType.type)) return _noneSurface();
   var ex = _extractProtected(partD.headers);
@@ -459,8 +457,24 @@ function _readDescriptor(s, position) {
       var names = Object.getOwnPropertyNames(proto);
       for (var n = 0; n < names.length; n++) {
         var name = names[n];
-        if ((name === "constructor" && proto !== s) || seen[name] === 1) continue;
-        if (proto !== s && _isMethod(proto, name)) continue;
+        if (seen[name] === 1) continue;
+        /** @internal The three names this walk declines: a prototype level's `constructor`, which is
+         * the class rather than a field; a prototype level's method, likewise; and a callable
+         * descriptor's own function machinery, which `guard.identifier` knows the names of and which
+         * copying turned a legitimate callable into a descriptor `pki.cms.sign`'s own unknown-field
+         * door then refused.
+         *
+         * A declined name is marked SEEN, because the value `s[name]` reads is the one the NEAREST
+         * level holds and a deeper property of that name is shadowed and unreadable. Measured before
+         * the marking: a derived class's own `length` was declined and then read off the base class
+         * as a field; a generator's own `prototype` was declined and then its generator-prototype
+         * OBJECT was walked, which read as a signer nested too deeply to copy; and a prototype-level
+         * method was declined and then a data property of the same name one level up was copied,
+         * which set the field to the method shadowing it and reached the digest resolver as
+         * `unsupported RSA digest algorithm undefined`. */
+        if ((name === "constructor" && proto !== s) ||
+            (proto !== s && _isMethod(proto, name)) ||
+            (proto === s && guard.identifier.isOwnMachineryName(s, name))) { seen[name] = 1; continue; }
         seen[name] = 1;
         if (++fields > DESCRIPTOR_MAX_FIELDS) throw _err("smime/bad-input", "signer " + position + " carries more than " + DESCRIPTOR_MAX_FIELDS + " fields");
         copy[name] = s[name];
@@ -553,9 +567,6 @@ function _hpSurface(content, outerEnt, expectedMode, authenticated, legacyEnable
   var canon = mime.canonicalizeText(content);
   if (!_declaresHp(canon)) return _legacyHpSurface(canon, outerEnt, expectedMode, legacyEnabled);
   var inner = mime.parse(canon, SmimeError, "smime/bad-header-protection");
-  var ctCount = _contentTypeCount(inner.headers);
-  if (ctCount > 1) throw _err("smime/bad-header-protection", "a header-protected payload must carry exactly one Content-Type field (found " + ctCount + ")");
-  if (mime.paramNameCount(inner.contentType.value, "hp") > 1) throw _err("smime/bad-header-protection", "a header-protected payload declares the hp parameter more than once");
   var raw = inner.contentType.params.hp;
   if (raw === undefined) throw _err("smime/bad-header-protection", "a header-protected payload declares a bare hp parameter with no value (expected hp=\"clear\" or hp=\"cipher\")");
   var hp = raw.toLowerCase();

package/lib/trust.js

@@ -1156,7 +1156,7 @@ function _subtreeOf(st) { return { tag: st.base.tagNumber, base: st.base.value }
  *   var pair = await pki.key.generate("Ed25519");
  *   var der = pki.trustanchor.build({ anchors: [{ taInfo: {
  *     pubKey: await pki.key.export(pair.publicKey), keyId: Buffer.alloc(20, 1),
- *     certPath: { taName: "CN=Example Root" } } }] });
+ *     certPath: { taName: "Example Root" } } }] });
  *   pki.trust.parseTrustAnchorList(der).anchors.length;   // -> 1
  */
 function parseTrustAnchorList(input, opts) {

package/lib/trustanchor-build.js

@@ -249,7 +249,7 @@ function _anchorDer(spec, i) {
  *     pubKey: await pki.key.export(pair.publicKey),
  *     keyId: Buffer.alloc(20, 1),
  *     taTitle: "Example Root CA",
- *     certPath: { taName: "CN=Example Root", pathLenConstraint: 2 } } }] });
+ *     certPath: { taName: "Example Root", pathLenConstraint: 2 } } }] });
  *   pki.schema.trustanchor.parse(der).anchors[0].taInfo.certPath.pathLenConstraint;  // -> 2
  */
 function build(spec, opts) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.9.0",
+  "version": "0.9.3",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:f52bf92f-41f7-4879-bff9-6077f2cf84f5",
+  "serialNumber": "urn:uuid:a3e510f1-a551-49fe-aabf-02db532556c6",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-08T01:34:26.318Z",
+    "timestamp": "2026-10-09T01:08:02.322Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.9.0",
+      "bom-ref": "@blamejs/pki@0.9.3",
       "type": "application",
       "name": "pki",
-      "version": "0.9.0",
+      "version": "0.9.3",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.9.0",
+      "purl": "pkg:npm/%40blamejs/pki@0.9.3",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.9.0",
+      "ref": "@blamejs/pki@0.9.3",
       "dependsOn": []
     }
   ]