@blamejs/core 0.18.13 → 0.18.14

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.18.x
 
+- v0.18.14 (2026-08-06) — **Broader offline test coverage across the error-page renderer, the request body parser, and the safe-YAML parser.** Error, edge, and fallback branches of b.errorPage, b.middleware.bodyParser, and b.parsers.yaml are now under explicit test — b.errorPage gains its first dedicated test suite. No behaviour changes: exercising every path confirmed each already behaves per its documented contract. One unreachable duplicate of the multipart parser's per-part reset — dead code that was never called — was removed. The vendored @noble/curves and @blamejs/pki bundles are refreshed. **Changed:** *Error- and edge-path tests for the error-page renderer, request body parser, and safe-YAML parser* — b.errorPage (classification of every recognized error class and the generic-500 fallback, JSON-vs-HTML content negotiation, the development-vs-production render difference, sensitive-header redaction, the write-response fallbacks when the response object lacks writeHead, and the audit record's redaction, outcome, stack-only-for-5xx, and trusted-proxy actor-IP invariants), b.middleware.bodyParser (RFC 5987 filename* decoding, multipart part-header and body framing split across socket reads, disk-mode temp-directory creation failure, repeated-field aggregation, and the request-stream-error refusal), and b.parsers.yaml (numeric-literal overflow falling back to the string form, block- and flow-collection edges, merge-key and duplicate-key refusals, block-scalar header parsing, and the prototype-pollution key guard across every decode path) now have explicit tests for their boundary branches. Alongside the tests, an unreachable duplicate of the multipart parser's per-part reset — a helper that was never called, its logic already performed inline where each part finalizes — was removed. Behaviour is unchanged. · *Vendored @noble/curves refreshed to 2.3.0* — The vendored @noble/curves bundle behind b.crypto.oprf is refreshed from 2.2.0 to 2.3.0. Upstream reworked the oblivious-pseudorandom-function batch path to a shared-doubling multi-scalar multiplication — applied only to values that are public by construction (hash-derived transcript weights, wire-decoded points, and proof scalars) — and now rejects a non-function rng option outright. The verified outputs are unchanged; no blamejs public API changes. · *Vendored @blamejs/pki refreshed to 0.3.33* — The vendored @blamejs/pki bundle behind the mutual-TLS CA engine is refreshed from 0.3.32 to 0.3.33, which adds the compact certificate-policies value form for C509 (CBOR-encoded) certificates and the accompanying certificate-policy and policy-qualifier identifiers to that toolkit's OID registry. The CA engine uses only the toolkit's X.509, PKCS#12, and CRL surfaces, so there is no behaviour change to the certificate-authority surface — this is a supply-chain currency refresh.
+
 - v0.18.13 (2026-08-06) — **`b.db.collection` no longer corrupts a BLOB overflow column (its bytes were spread as numeric keys, destroying the JSON payload); broader offline test coverage across db-collection, TLS, external-db residency, notify, and BIMI.** A schemaless collection with a BLOB overflow column read that column back as a byte array. Because a byte array is a JavaScript object, the collection treated it as an already-parsed overflow object and spread its bytes as numeric keys on read, on update, and on insert — silently destroying the stored JSON payload. The overflow value is now decoded as JSON at every one of those points. The release also closes offline test-coverage gaps and adds an explicit test that the external-database residency boundary is enforced. **Changed:** *Broader offline test coverage and an explicit external-database residency-enforcement test* — b.db.collection (BLOB overflow round-trips, introspection-error wrapping, overflow-as-jsonColumn), b.network.tls.connectWithEch (the connect success, timeout, unreachable-peer, and synchronous-throw paths driven against local servers), b.externalDb (the boot-time data-residency check now has an explicit test that a personal-data backend outside the declared region is refused and compliant backends are admitted), b.notify (the default HTTP client is bound at send time), and b.mail.bimi (a certificate chain deeper than the maximum is rejected) now have tests for these boundary paths. **Fixed:** *b.db.collection no longer corrupts a BLOB overflow column* — A collection configured with an overflow column (unknown fields folded into a JSON column) reads that column back as a byte array when the column is declared BLOB. A byte array's typeof is "object", so the collection took it to be an already-parsed overflow object and spread its raw bytes as numeric-index keys — on read (surfacing { "0": …, "1": … } onto the row), on a $set/$unset update (rewriting the column to the byte spread and destroying the original keys), and on an insert that supplied a Buffer overflow value. The overflow value is now decoded from its bytes as JSON at all three points, so the stored payload survives; a BLOB holding non-JSON bytes falls back to an empty object instead of corrupting, matching the existing non-JSON-string behaviour.
 
 - v0.18.12 (2026-08-05) — **Certificate Transparency SCT verification now works for real certificates (it previously rejected every embedded SCT); b.network.tls.ct.verifyScts / requireScts now require the issuing CA; broader Redis-client and TLS-verification test coverage.** b.network.tls.ct.verifyScts reconstructed the wrong RFC 6962 signed input for the SCTs embedded in a certificate — it built an x509_entry over the bare TBSCertificate instead of the precert_entry (issuer_key_hash + TBSCertificate) the log actually signed, and separately read the SCT's signature algorithm from a field the parser does not emit. Either alone made verification impossible: verifyScts and requireScts rejected every real embedded SCT. Verification now builds the RFC 6962 §3.2 precert_entry and requires the issuing CA so it can bind issuer_key_hash. This is a fail-closed fix — nothing invalid was ever trusted — but SCT enforcement now needs the issuer supplied. **Changed:** *b.network.tls.ct.verifyScts and requireScts now require the issuing CA* — Because an embedded SCT binds the issuing CA's key, verifying one needs that key. Pass the issuer to verifyScts as issuerCertDer (the issuer certificate DER), issuerSpkiDer (its SubjectPublicKeyInfo DER), or issuerKeyHash (the precomputed 32-byte SHA-256). Without it, verifyScts returns { ok: false, reason: "issuer-key-required" } and does not verify. requireScts derives the issuer from the peer's certificate chain automatically and accepts the same options; supply one explicitly only when the issuer is not present in the chain. verifyInclusion takes the same issuer options for embedded (precert_entry) leaves. · *Vendored @blamejs/pki refreshed to 0.3.32* — The vendored @blamejs/pki bundle behind the mutual-TLS CA engine is refreshed to 0.3.32, which adds C509 (CBOR-encoded certificate) extended-key-usage and extension registries (RFC 7633 TLS Feature, RFC 4556 PKINIT, and SSH/CMC/Bundle-Security purposes). No blamejs public API changes. · *Error- and edge-path tests for the Redis client and TLS-verification primitives* — b.redisClient (RESP framing and protocol-error edges, split replies, AUTH / SELECT on connect, push-message demux, connect/command timeouts, socket-error and close teardown) and b.network.tls (OCSP and Certificate-Transparency parse and verification branches, ECH config framing, and PKIX host/SAN matching) now have explicit tests for their boundary branches, driven through local fake servers and crafted certificates. **Fixed:** *Certificate Transparency SCT verification now works for certificate-embedded SCTs* — For an SCT embedded in a certificate's X.509v3 extension, the log computed its signature over the RFC 6962 §3.2 precert_entry — issuer_key_hash (SHA-256 of the issuing CA's SubjectPublicKeyInfo) followed by the TBSCertificate with the SCT extension removed. b.network.tls.ct.verifyScts instead reconstructed an x509_entry over just the stripped TBSCertificate, with no issuer binding, so the reconstructed input never matched what the log signed and no real embedded SCT could verify. It additionally read the SCT's signature-algorithm from a field name the parser does not emit, so the algorithm cross-check failed before the signature was even reached. verifyScts now builds the precert_entry and reads the parsed algorithm field, so a valid SCT verifies and a genuine mismatch is still refused. b.network.tls.ct.verifyInclusion builds the RFC 9162 §4.6 leaf the same way. The prior behaviour failed closed (it rejected rather than accepted), so no invalid certificate was ever trusted. **Security:** *SCT verification now binds each log key to the SCT's log ID* — An SCT's log ID is the SHA-256 of the log's public key (RFC 6962 §3.2). b.network.tls.ct.verifyScts now recomputes that hash from the configured key and refuses the SCT (reason "log-id-key-mismatch") when it does not equal the log ID the SCT names, before checking the signature. This prevents a misconfigured logKeys map from letting a key impersonate an approved log. · *SCT verification counts distinct logs, refuses future timestamps, and validates the minimum* — verifyScts now counts SCTs from distinct logs, so duplicate SCTs from a single log can no longer satisfy a "minimum 2 SCTs" diversity policy (verifiedCount reflects distinct logs). It refuses an SCT whose timestamp is in the future (RFC 6962 §5.2; opts.now / opts.clockSkewMs override the clock and the default five-minute skew). A minScts that is not a positive integer is rejected at the entry point rather than silently accepting an unverified certificate. Parsing an SCT extension from a peer certificate now fails closed on malformed DER — it returns no SCT instead of throwing, so a hostile certificate cannot raise an uncaught error out of verifyScts, parseScts, or the requireScts predicate.

package/NOTICE

@@ -26,7 +26,7 @@ Used for:    XChaCha20-Poly1305 authenticated encryption (lib/crypto.js,
              Thank you to Paul Miller for the audited noble-ciphers suite.
 --------------------------------------------------------------------------------
 Component:   @noble/curves
-Version:     2.2.0
+Version:     2.3.0
 Source:      https://github.com/paulmillr/noble-curves
 License:     MIT
 Copyright:   Copyright (c) 2022 Paul Miller (https://paulmillr.com)
@@ -60,7 +60,7 @@ Used for:    WebAuthn / passkey registration + authentication response
              server.cjs).
 --------------------------------------------------------------------------------
 Component:   @blamejs/pki
-Version:     0.3.32
+Version:     0.3.33
 Source:      https://github.com/blamejs/pki
 License:     Apache-2.0
 Copyright:   Copyright (c) blamejs contributors

package/lib/middleware/body-parser.js

@@ -839,21 +839,6 @@ async function _parseMultipart(req, opts, ctParams) {
                                 // boundary) but never written to disk.
   var currentEffectiveLimit = 0; // per-field-or-global cap; recomputed at part start.
 
-  function _resetCurrent() {
-    currentHeaders = null;
-    currentField = null;
-    currentFilename = null;
-    currentMime = null;
-    currentTmpPath = null;
-    if (currentFd !== null) { try { nodeFs.closeSync(currentFd); } catch (_e) { /* fd already closed */ } currentFd = null; }
-    currentSize = 0;
-    currentHash = null;
-    currentBuf = null;
-    currentIsFile = false;
-    currentDiscarded = false;
-    currentEffectiveLimit = 0;
-  }
-
   function _emitRejection(field, filename, mimeType, code, message) {
     filesRejected.push({
       field:    field,

package/lib/vendor/MANIFEST.json

@@ -18,10 +18,10 @@
       "hashes": {
         "server": "sha256:2b30a26f728c5349f4c4b47834f862a4f77393b1224fc12b22abe3ce2cfab78f"
       },
-      "refreshedAt": "2026-08-06T00:01:44.784Z"
+      "refreshedAt": "2026-08-06T21:56:25.536Z"
     },
     "@noble/curves": {
-      "version": "2.2.0",
+      "version": "2.3.0",
       "license": "MIT",
       "author": "Paul Miller",
       "source": "https://github.com/paulmillr/noble-curves",
@@ -35,12 +35,12 @@
         "server": "lib/vendor/noble-curves.cjs"
       },
       "bundler": "esbuild --format=cjs --platform=node",
-      "bundledAt": "2026-07-13T00:00:00Z",
-      "cpe": "cpe:2.3:a:paulmillr:noble-curves:2.2.0:*:*:*:*:node.js:*:*",
+      "bundledAt": "2026-08-06T00:00:00Z",
+      "cpe": "cpe:2.3:a:paulmillr:noble-curves:2.3.0:*:*:*:*:node.js:*:*",
       "hashes": {
-        "server": "sha256:2880c288b1285ef51d356d057bee6f0c8a00de36638cf47b47617e8c1faf10d5"
+        "server": "sha256:b5fe88d1ea780d0581dee6145d666f89d46fc9531b5db35db2e5b16627840890"
       },
-      "refreshedAt": "2026-08-06T00:01:44.784Z"
+      "refreshedAt": "2026-08-06T21:56:25.536Z"
     },
     "@noble/post-quantum": {
       "version": "0.6.1",
@@ -71,7 +71,7 @@
       "hashes": {
         "server": "sha256:f9c94094b3c10fe73dac5343289da582454ea6053494fab2bf66099d9103d6c3"
       },
-      "refreshedAt": "2026-08-06T00:01:44.784Z"
+      "refreshedAt": "2026-08-06T21:56:25.536Z"
     },
     "@simplewebauthn/server": {
       "version": "13.3.2",
@@ -94,7 +94,7 @@
       "hashes": {
         "server": "sha256:e83195dc9f189385da9c856ef38843f4466f93ea8f3d7fc2efcb1e1b18da6f20"
       },
-      "refreshedAt": "2026-08-06T00:01:44.784Z"
+      "refreshedAt": "2026-08-06T21:56:25.536Z"
     },
     "SecLists-common-passwords-top-10000": {
       "version": "10k-most-common (master)",
@@ -114,7 +114,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-06T00:01:44.784Z"
+      "refreshedAt": "2026-08-06T21:56:25.536Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -139,7 +139,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-06T00:01:44.784Z"
+      "refreshedAt": "2026-08-06T21:56:25.536Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -159,10 +159,10 @@
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-06T00:01:44.784Z"
+      "refreshedAt": "2026-08-06T21:56:25.536Z"
     },
     "@blamejs/pki": {
-      "version": "0.3.32",
+      "version": "0.3.33",
       "license": "Apache-2.0",
       "author": "blamejs",
       "source": "https://github.com/blamejs/pki",
@@ -182,12 +182,12 @@
         "server": "lib/vendor/blamejs-pki.cjs"
       },
       "bundler": "esbuild --format=cjs --platform=node --external:crypto --external:node:crypto",
-      "bundledAt": "2026-08-05T00:00:00Z",
-      "cpe": "cpe:2.3:a:blamejs:pki:0.3.32:*:*:*:*:node.js:*:*",
+      "bundledAt": "2026-08-06T00:00:00Z",
+      "cpe": "cpe:2.3:a:blamejs:pki:0.3.33:*:*:*:*:node.js:*:*",
       "hashes": {
-        "server": "sha256:275a0ef678a74e9ce035658ae95b18c05dcf69200bf934f609f149d1c8e739e3"
+        "server": "sha256:2c297ccbbb48e04306bd6cb681e80f41549fd12267dde9db2a771d55d688745b"
       },
-      "refreshedAt": "2026-08-06T00:01:44.784Z"
+      "refreshedAt": "2026-08-06T21:56:25.536Z"
     }
   }
 }

package/lib/vendor/blamejs-pki.cjs

@@ -1,4 +1,4 @@
-// @blamejs/pki v0.3.32 — vendored (Apache-2.0). Zero-dep pure CJS.
+// @blamejs/pki v0.3.33 — vendored (Apache-2.0). Zero-dep pure CJS.
 // https://github.com/blamejs/pki  Exports: x509, crl, pkcs12, key, webcrypto, schema, csr, cms, ...
 // Backs lib/mtls-engine-default.js (PQC-capable CA + PKCS#12 engine).
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -137,7 +137,7 @@ var require_package = __commonJS({
   "node_modules/@blamejs/pki/package.json"(exports2, module2) {
     module2.exports = {
       name: "@blamejs/pki",
-      version: "0.3.32",
+      version: "0.3.33",
       description: "Pure-JavaScript PKI toolkit that owns its stack \u2014 X.509, ASN.1/DER, CMS, PQC-first.",
       license: "Apache-2.0",
       author: "blamejs contributors",
@@ -2561,6 +2561,38 @@ var require_oid = __commonJS({
       // negative ints: id-on-hardwareModuleName (RFC 4108), id-on-SmtpUTF8Mailbox (RFC 9598),
       // id-on-MACAddress (I-D.ietf-lamps-macaddress-on) on the id-pkix 8 arc.
       pkixOn: { base: [1, 3, 6, 1, 5, 5, 7, 8], of: { hardwareModuleName: 4, smtpUtf8Mailbox: 9, macAddress: 12 } },
+      // CA/Browser Forum certificate policies (draft-ietf-cose-cbor-encoded-cert sec. 8.9 ints 1-4) on the
+      // 2.23.140.1 arc: the id-cabf validation levels under .2, ev-guidelines under .1.
+      cabfPolicy: { base: [2, 23, 140, 1], of: {
+        "ev-guidelines": 1,
+        "domain-validated": [2, 1],
+        "organization-validated": [2, 2],
+        "individual-validated": [2, 3]
+      } },
+      // id-cp-ipAddr-asNumber (RFC 3779 / RFC 8360) on the id-pkix 14 arc -- the RPKI resource-certificate
+      // policy OIDs (sec. 8.9 ints 7-8).
+      idCp: { base: [1, 3, 6, 1, 5, 5, 7, 14], of: { "id-cp-ipAddr-asNumber": 2, "id-cp-ipAddr-asNumber-v2": 3 } },
+      // GSMA SGP.22 Remote SIM Provisioning roles (sec. 8.9 ints 24-38) on the 2.23.146.1.2.1 id-rspRole arc.
+      // The -v2 roles are shallow leaves .{1..7}; the non-v2 roles descend into deeper sub-arcs (draft-20).
+      gsmaRspRole: { base: [2, 23, 146, 1, 2, 1], of: {
+        "id-rspRole-ci": 0,
+        "id-rspRole-euicc-v2": 1,
+        "id-rspRole-euicc": [0, 0, 0, 0, 0],
+        "id-rspRole-eum-v2": 2,
+        "id-rspRole-eum": [0, 0, 0],
+        "id-rspRole-dp-tls-v2": 3,
+        "id-rspRole-dp-tls": [0, 0, 1, 0],
+        "id-rspRole-dp-auth-v2": 4,
+        "id-rspRole-dp-auth": [0, 0, 1, 1],
+        "id-rspRole-dp-pb-v2": 5,
+        "id-rspRole-dp-pb": [0, 0, 1, 2],
+        "id-rspRole-ds-tls-v2": 6,
+        "id-rspRole-ds-tls": [0, 0, 2, 0],
+        "id-rspRole-ds-auth-v2": 7,
+        "id-rspRole-ds-auth": [0, 0, 2, 1]
+      } },
+      // id-qt policy qualifiers (RFC 5280 sec. 4.2.1.4) on the id-pkix 2 arc -- the C509 sec. 8.10 registry.
+      pkixQt: { base: [1, 3, 6, 1, 5, 5, 7, 2], of: { cps: 1, unotice: 2 } },
       // OCSP (RFC 6960) on the id-pkix-ocsp arc (= id-ad-ocsp). id-pkix-ocsp-basic is
       // the ResponseBytes.responseType this build decodes; id-pkix-ocsp-nonce (sec. 4.4.1)
       // names the nonce extension; the remaining members name the other OCSP extensions
@@ -7503,6 +7535,7 @@ var require_schema_c509 = __commonJS({
       3: _name("subjectAltName"),
       4: _name("basicConstraints"),
       5: _name("cRLDistributionPoints"),
+      6: _name("certificatePolicies"),
       7: _name("authorityKeyIdentifier"),
       8: _name("extKeyUsage"),
       9: _name("authorityInfoAccess"),
@@ -7529,7 +7562,8 @@ var require_schema_c509 = __commonJS({
       cRLDistributionPoints: 1,
       freshestCRL: 1,
       authorityInfoAccess: 1,
-      subjectInfoAccess: 1
+      subjectInfoAccess: 1,
+      certificatePolicies: 1
     };
     var EKU_BY_INT = {
       0: _name("anyExtendedKeyUsage"),
@@ -7575,6 +7609,39 @@ var require_schema_c509 = __commonJS({
     Object.keys(IA_BY_INT).forEach(function(k) {
       IA_TO_INT[oid.byName(IA_BY_INT[k])] = Number(k);
     });
+    var CP_BY_INT = {
+      0: _name("anyPolicy"),
+      1: _name("domain-validated"),
+      2: _name("organization-validated"),
+      3: _name("individual-validated"),
+      4: _name("ev-guidelines"),
+      7: _name("id-cp-ipAddr-asNumber"),
+      8: _name("id-cp-ipAddr-asNumber-v2"),
+      24: _name("id-rspRole-ci"),
+      25: _name("id-rspRole-euicc-v2"),
+      26: _name("id-rspRole-euicc"),
+      27: _name("id-rspRole-eum-v2"),
+      28: _name("id-rspRole-eum"),
+      29: _name("id-rspRole-dp-tls-v2"),
+      30: _name("id-rspRole-dp-tls"),
+      31: _name("id-rspRole-dp-auth-v2"),
+      32: _name("id-rspRole-dp-auth"),
+      33: _name("id-rspRole-dp-pb-v2"),
+      34: _name("id-rspRole-dp-pb"),
+      35: _name("id-rspRole-ds-tls-v2"),
+      36: _name("id-rspRole-ds-tls"),
+      37: _name("id-rspRole-ds-auth-v2"),
+      38: _name("id-rspRole-ds-auth")
+    };
+    var CP_TO_INT = {};
+    Object.keys(CP_BY_INT).forEach(function(k) {
+      CP_TO_INT[oid.byName(CP_BY_INT[k])] = Number(k);
+    });
+    var PQ_BY_INT = { 1: _name("cps"), 2: _name("unotice") };
+    var PQ_TO_INT = {};
+    Object.keys(PQ_BY_INT).forEach(function(k) {
+      PQ_TO_INT[oid.byName(PQ_BY_INT[k])] = Number(k);
+    });
     function _biguint(node, code, label) {
       if (!node || node.majorType !== 2) throw _err(code, label + " must be an unwrapped CBOR byte string (~biguint)");
       var b2 = node.content;
@@ -7908,6 +7975,61 @@ var require_schema_c509 = __commonJS({
       if (mag.length === 0) return Buffer.from([0]);
       return mag[0] & 128 ? Buffer.concat([Buffer.from([0]), mag]) : mag;
     }
+    function _ia5Universal(text, label) {
+      if (text.length === 0) throw _err("c509/bad-extensions", label + " must be non-empty");
+      for (var i = 0; i < text.length; i++) {
+        if (text.charCodeAt(i) > 127) throw _err("c509/bad-extensions", label + " must be a 7-bit IA5String");
+      }
+      guard.name.assertPrintableIa5(Buffer.from(text, "latin1"), _err, "c509/bad-extensions", label);
+      return b.ia5(text);
+    }
+    function _policyIdToDerOid(node) {
+      if (node.majorType === 0 || node.majorType === 1) {
+        var i = Number(cbor.read.int(node)), nm = CP_BY_INT[i];
+        if (nm === void 0) throw _err("c509/bad-extensions", "a certificatePolicies policy int " + i + " has no C509 sec. 8.9 registry row");
+        return oid.byName(nm);
+      }
+      return _oidName(node, "c509/bad-extensions", "a certificatePolicies policyIdentifier").oid;
+    }
+    function _policyIdFromDer(dotted) {
+      var i = CP_TO_INT[dotted];
+      return i !== void 0 ? cbor.build.int(BigInt(i)) : _oidCbor(dotted);
+    }
+    function _qualifierToDer(qidNode, qtextNode) {
+      if (qidNode.majorType !== 0 && qidNode.majorType !== 1) throw _err("c509/bad-extensions", "a policyQualifierId must be a C509 sec. 8.10 int (a ~oid qualifier is not compact-representable)");
+      var qi = Number(cbor.read.int(qidNode)), nm = PQ_BY_INT[qi];
+      if (nm === void 0) throw _err("c509/bad-extensions", "a policyQualifierId int " + qi + " has no C509 sec. 8.10 registry row");
+      if (qtextNode.majorType !== 3) throw _err("c509/bad-extensions", "a policyQualifier value must be a CBOR text string");
+      var text = cbor.read.textString(qtextNode);
+      if (qi === 1) return b.sequence([b.oid(oid.byName("cps")), _ia5Universal(text, "a CPSuri")]);
+      if (text.length === 0) throw _err("c509/bad-extensions", "a UserNotice explicitText must be non-empty (DisplayText SIZE 1..200)");
+      return b.sequence([b.oid(oid.byName("unotice")), b.sequence([b.utf8(text)])]);
+    }
+    function _qualifierFromDer(pq) {
+      var qid = asn1.read.oid(pq.children[0]), qi = PQ_TO_INT[qid];
+      if (qi === void 0) return null;
+      var q = pq.children[1];
+      if (qi === 1) {
+        if (q.tagClass !== "universal" || q.tagNumber !== asn1.TAGS.IA5_STRING) return null;
+        var uri;
+        try {
+          uri = asn1.read.string(q);
+        } catch (_e) {
+          return null;
+        }
+        return [cbor.build.int(1n), cbor.build.textString(uri)];
+      }
+      if (q.tagClass !== "universal" || q.tagNumber !== asn1.TAGS.SEQUENCE || !q.children || q.children.length !== 1) return null;
+      var dt = q.children[0];
+      if (dt.tagClass !== "universal" || dt.tagNumber !== asn1.TAGS.UTF8_STRING) return null;
+      var txt;
+      try {
+        txt = asn1.read.string(dt);
+      } catch (_e2) {
+        return null;
+      }
+      return [cbor.build.int(2n), cbor.build.textString(txt)];
+    }
     function _dpToDer(dpNode) {
       if (dpNode.majorType !== 4 || !dpNode.children || dpNode.children.length !== 3) throw _err("c509/bad-extensions", "a DistributionPoint must be a CBOR [ fullName, reasons, cRLIssuer ] array");
       var fullName = dpNode.children[0], reasons = dpNode.children[1], crlIssuer = dpNode.children[2];
@@ -8052,6 +8174,28 @@ var require_schema_c509 = __commonJS({
           return b.sequence(node.children.map(function(dp) {
             return _dpToDer(dp);
           }));
+        case "certificatePolicies": {
+          if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "a certificatePolicies value must be a CBOR array");
+          var cpKids = node.children;
+          if (cpKids.length === 0 || cpKids.length % 2 !== 0) throw _err("c509/bad-extensions", "a certificatePolicies array must be non-empty (policyIdentifier, qualifiers) pairs (sec. 3.3)");
+          var polInfos = [], seenPolicy = {};
+          for (var cpi = 0; cpi + 1 < cpKids.length; cpi += 2) {
+            var quals = cpKids[cpi + 1];
+            if (quals.majorType !== 4 || !quals.children) throw _err("c509/bad-extensions", "a certificatePolicies qualifiers slot must be a CBOR array");
+            var policyOid = _policyIdToDerOid(cpKids[cpi]);
+            if (seenPolicy[policyOid]) throw _err("c509/bad-extensions", "a certificatePolicies policy OID must not appear more than once (RFC 5280 sec. 4.2.1.4)");
+            seenPolicy[policyOid] = true;
+            var polFields = [b.oid(policyOid)];
+            if (quals.children.length) {
+              if (quals.children.length % 2 !== 0) throw _err("c509/bad-extensions", "a policyQualifiers array must be (policyQualifierId, qualifier) pairs");
+              var pqDers = [];
+              for (var qk = 0; qk + 1 < quals.children.length; qk += 2) pqDers.push(_qualifierToDer(quals.children[qk], quals.children[qk + 1]));
+              polFields.push(b.sequence(pqDers));
+            }
+            polInfos.push(b.sequence(polFields));
+          }
+          return b.sequence(polInfos);
+        }
         default:
           throw _err("c509/bad-extensions", "extension " + name + " has no compact value decoder");
       }
@@ -8167,6 +8311,30 @@ var require_schema_c509 = __commonJS({
               return r.triple;
             }));
           }
+          case "certificatePolicies": {
+            if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children || node.children.length < 1) return null;
+            var cpOut = [];
+            for (var pli = 0; pli < node.children.length; pli++) {
+              var pol = node.children[pli];
+              if (pol.tagClass !== "universal" || pol.tagNumber !== asn1.TAGS.SEQUENCE || !pol.children || pol.children.length < 1 || pol.children.length > 2) return null;
+              cpOut.push(_policyIdFromDer(asn1.read.oid(pol.children[0])));
+              var qArr = [];
+              if (pol.children.length === 2) {
+                var qseq = pol.children[1];
+                if (qseq.tagClass !== "universal" || qseq.tagNumber !== asn1.TAGS.SEQUENCE || !qseq.children || !qseq.children.length) return null;
+                for (var qj = 0; qj < qseq.children.length; qj++) {
+                  var pq = qseq.children[qj];
+                  if (pq.tagClass !== "universal" || pq.tagNumber !== asn1.TAGS.SEQUENCE || !pq.children || pq.children.length !== 2) return null;
+                  var qpair = _qualifierFromDer(pq);
+                  if (qpair == null) return null;
+                  qArr.push(qpair[0]);
+                  qArr.push(qpair[1]);
+                }
+              }
+              cpOut.push(cbor.build.array(qArr));
+            }
+            return cbor.build.array(cpOut);
+          }
           default:
             return null;
         }