@blamejs/pki 0.1.15 → 0.1.17

package/lib/schema-pkix.js

@@ -166,6 +166,12 @@ function attrValueToString(ns) {
       }
       return "#" + node.bytes.toString("hex");
     }
+  }, function (value) {
+    // encode: a "#hex" escape (RFC 4514 §2.4) round-trips its raw DER verbatim; any
+    // other string encodes as UTF8String (the decode does not preserve the original
+    // string type, so this is the canonical re-encoding, not a byte-exact one).
+    if (typeof value === "string" && value.charAt(0) === "#") return Buffer.from(value.slice(1), "hex");
+    return asn1.build.utf8(value);
   });
 }
 
@@ -193,25 +199,34 @@ function relativeDistinguishedName(ns) {
   // RelativeDistinguishedName ::= SET SIZE (1..MAX) — an empty SET {} is malformed.
   return schema.setOf(attributeTypeAndValue(ns), { assert: "set", min: 1, code: ns.prefix + "/bad-rdn", what: "RelativeDistinguishedName" });
 }
-function name(ns) {
-  return schema.seqOf(relativeDistinguishedName(ns), {
-    assert: "sequence", code: ns.prefix + "/bad-name", what: "Name",
-    build: function (m) {
-      var rdns = [], parts = [];
-      m.items.forEach(function (rdnItem) {
-        var atvs = [], atvParts = [];
-        rdnItem.value.items.forEach(function (atvItem) {
-          var a = atvItem.value.result; // atvItem.value = the atv seq-match; .result = its build result
-          atvs.push(a);
-          var label = (a.name && DN_SHORT[a.name]) || a.name || a.type;
-          atvParts.push(label + "=" + _escapeDnValue(a.value));
-        });
-        rdns.push(atvs);
-        parts.push(atvParts.join("+"));
+// opts.implicitTag (optional): read the Name as a [tag] IMPLICIT RDNSequence — the
+// context tag REPLACES the universal SEQUENCE tag, so the node is a context-class
+// constructed [tag] whose children ARE the RDN SETs (the CRMF CertTemplate issuer
+// [3] / subject [5] IMPLICIT arm, RFC 4211 §5). With no opts the shape is a bare
+// universal SEQUENCE OF, byte-identical to every existing caller.
+function name(ns, opts) {
+  opts = opts || {};
+  function nameBuild(m) {
+    var rdns = [], parts = [];
+    m.items.forEach(function (rdnItem) {
+      var atvs = [], atvParts = [];
+      rdnItem.value.items.forEach(function (atvItem) {
+        var a = atvItem.value.result; // atvItem.value = the atv seq-match; .result = its build result
+        atvs.push(a);
+        var label = (a.name && DN_SHORT[a.name]) || a.name || a.type;
+        atvParts.push(label + "=" + _escapeDnValue(a.value));
       });
-      return { rdns: rdns, dn: parts.join(", ") };
-    },
-  });
+      rdns.push(atvs);
+      parts.push(atvParts.join("+"));
+    });
+    return { rdns: rdns, dn: parts.join(", ") };
+  }
+  if (opts.implicitTag != null) {
+    return schema.implicitSeqOf(opts.implicitTag, relativeDistinguishedName(ns), {
+      code: ns.prefix + "/bad-name", what: "Name", build: nameBuild });
+  }
+  return schema.seqOf(relativeDistinguishedName(ns), {
+    assert: "sequence", code: ns.prefix + "/bad-name", what: "Name", build: nameBuild });
 }
 
 // GeneralName ::= CHOICE (RFC 5280 §4.2.1.6). A validate-and-surface-raw leaf for a
@@ -224,11 +239,22 @@ function name(ns) {
 // OCTET STRING; registeredID [8] is a primitive OBJECT IDENTIFIER — then surfaces the
 // value RAW ({ bytes, tagClass, tagNumber }). `opts.code` is the caller's error code
 // (e.g. ocsp/bad-requestor-name, tsp/bad-tsa). Shared so the two parsers cannot drift.
+// opts.decodeValue (default false): in addition to the raw { bytes, tagClass,
+//   tagNumber }, surface the DECODED `value` per arm — IA5 text (string), an
+//   iPAddress Buffer, a directoryName { rdns, dn }, a registeredID OID string,
+//   or an otherName { typeId, valueBytes }. The path validator's name-constraint
+//   matcher needs the decoded value; the tsp/ocsp/attrcert consumers pass no
+//   flag and get the byte-identical raw-only shape.
+// opts.subtreeBase (default false): the GeneralSubtree.base form (RFC 5280
+//   §4.2.1.10) — an iPAddress base is an address+mask (8 octets IPv4 / 32 IPv6),
+//   NOT the 4/16-octet SAN address form. Only the iPAddress size rule changes.
 var GN_CONSTRUCTED = { 0: 1, 3: 1, 4: 1, 5: 1 };
 var GN_IA5 = { 1: 1, 2: 1, 6: 1 };
 function generalName(ns, opts) {
   opts = opts || {};
   var code = opts.code || (ns.prefix + "/bad-general-name");
+  var decodeValue = opts.decodeValue === true;
+  var subtreeBase = opts.subtreeBase === true;
   var NAME = name(ns);
   return schema.decode(function (n, ctx) {
     if (n.tagClass !== "context" || n.tagNumber < 0 || n.tagNumber > 8) {
@@ -236,45 +262,66 @@ function generalName(ns, opts) {
     }
     var t = n.tagNumber;
     var constructed = !!n.children;
+    var value;
     if (GN_CONSTRUCTED[t]) {
       if (!constructed || n.children.length < 1) throw ctx.E(code, "GeneralName [" + t + "] must be a non-empty constructed value (RFC 5280 §4.2.1.6)");
       if (t === 0) {
         // otherName ::= SEQUENCE { type-id OBJECT IDENTIFIER, value [0] EXPLICIT ANY }.
         if (n.children.length !== 2) throw ctx.E(code, "GeneralName otherName [0] must be a SEQUENCE { type-id, value [0] }");
-        try { asn1.read.oid(n.children[0]); }
+        var typeId;
+        try { typeId = asn1.read.oid(n.children[0]); }
         catch (e) { throw ctx.E(code, "GeneralName otherName [0] must lead with a type-id OBJECT IDENTIFIER", e); }
-        var v = n.children[1];
-        if (!(v.tagClass === "context" && v.tagNumber === 0 && v.children && v.children.length === 1)) {
+        var ov = n.children[1];
+        if (!(ov.tagClass === "context" && ov.tagNumber === 0 && ov.children && ov.children.length === 1)) {
           throw ctx.E(code, "GeneralName otherName [0] value must be a [0] EXPLICIT wrapper carrying exactly one value");
         }
+        if (decodeValue) value = { typeId: typeId, valueBytes: ov.children[0].bytes };
       } else if (t === 4) {
         // directoryName [4] EXPLICIT Name — validate the wrapped RDNSequence.
         if (n.children.length !== 1) throw ctx.E(code, "GeneralName directoryName [4] must wrap exactly one Name");
-        schema.walk(NAME, n.children[0], ctx);
+        var dnMatch = schema.walk(NAME, n.children[0], ctx);
+        if (decodeValue) value = dnMatch.result;
       }
     } else {
       if (constructed) throw ctx.E(code, "GeneralName [" + t + "] must be primitive (X.690 §10.2)");
       if (GN_IA5[t]) {
         if (n.content.length === 0) throw ctx.E(code, "GeneralName [" + t + "] must be a non-empty IA5String");
         for (var i = 0; i < n.content.length; i++) {
-          if (n.content[i] > 0x7f) throw ctx.E(code, "GeneralName [" + t + "] must be an IA5String (7-bit)");
+          // 7-bit IA5, and no C0/DEL control byte — an embedded NUL/control in a
+          // dNSName/rfc822Name/URI enables a name-truncation/confusion bypass
+          // (CVE-2009-2408 class) downstream, so reject it at decode.
+          if (n.content[i] < 0x20 || n.content[i] > 0x7e) throw ctx.E(code, "GeneralName [" + t + "] must be a printable IA5String (no control bytes)");
         }
+        if (decodeValue) value = n.content.toString("latin1");
       } else if (t === 7) {
-        if (n.content.length !== 4 && n.content.length !== 16) throw ctx.E(code, "GeneralName iPAddress [7] must be a 4- or 16-octet address");
+        if (subtreeBase) {
+          if (n.content.length !== 8 && n.content.length !== 32) throw ctx.E(code, "GeneralName iPAddress [7] subtree base must be an 8- or 32-octet address+mask (RFC 5280 §4.2.1.10)");
+        } else if (n.content.length !== 4 && n.content.length !== 16) {
+          throw ctx.E(code, "GeneralName iPAddress [7] must be a 4- or 16-octet address");
+        }
+        // n.content is proven non-null here (the primitive-form guard above
+        // threw on a constructed node); copy the octets out.
+        if (decodeValue) value = Buffer.concat([n.content]);
       } else if (t === 8) {
-        try { asn1.decodeOidContent(n.content); }
+        var regId;
+        try { regId = asn1.decodeOidContent(n.content); }
         catch (e) { throw ctx.E(code, "GeneralName registeredID [8] must be a valid OBJECT IDENTIFIER", e); }
+        if (decodeValue) value = regId;
       }
     }
-    return { bytes: n.bytes, tagClass: n.tagClass, tagNumber: n.tagNumber };
+    var out = { bytes: n.bytes, tagClass: n.tagClass, tagNumber: n.tagNumber };
+    if (decodeValue) out.value = value === undefined ? null : value;
+    return out;
   });
 }
 
 // GeneralNames ::= SEQUENCE OF GeneralName (RFC 5280 §4.2.1.6), SIZE (1..MAX). Every
 // element is validated by generalName (its CHOICE alternative's form + content) and
 // surfaced raw, so a caller carrying a GeneralNames field cannot accept a malformed
-// element by treating the whole sequence as opaque bytes. Returns { names: [{ bytes,
-// tagClass, tagNumber }], bytes } (the decoded element list + the raw outer DER).
+// element by treating the whole sequence as opaque bytes. Returns { names, bytes }
+// where each `names[i]` is the generalName leaf's return — { bytes, tagClass,
+// tagNumber } and, when opts.decodeValue is set, the decoded `value` — and `bytes`
+// is the raw outer DER.
 // `opts.implicitTag` handles a [tag] IMPLICIT GeneralNames — the context tag REPLACES
 // the universal SEQUENCE tag (RFC 5755 Holder.entityName [1]); otherwise it is a bare
 // universal SEQUENCE OF. `opts.code` is the caller's error code. Shared so the x509 /
@@ -282,7 +329,9 @@ function generalName(ns, opts) {
 function generalNames(ns, opts) {
   opts = opts || {};
   var code = opts.code || (ns.prefix + "/bad-general-names");
-  var gn = generalName(ns, { code: code });
+  // decodeValue / subtreeBase thread through to each element (the path
+  // validator's constraint matcher passes decodeValue:true).
+  var gn = generalName(ns, { code: code, decodeValue: opts.decodeValue === true, subtreeBase: opts.subtreeBase === true });
   function build(m) { return { names: m.items.map(function (it) { return it.value; }), bytes: m.node.bytes }; }
   if (opts.implicitTag != null) {
     return schema.implicitSeqOf(opts.implicitTag, gn, { min: 1, code: code, what: opts.what || "GeneralNames", build: build });
@@ -290,6 +339,276 @@ function generalNames(ns, opts) {
   return schema.seqOf(gn, { assert: "sequence", min: 1, code: code, what: opts.what || "GeneralNames", build: build });
 }
 
+// certExtensionDecoders(ns) — the ns-parameterized RFC 5280 §4.2.1 extension
+// VALUE decoders. `x509.parse` surfaces each extension as { oid, name, critical,
+// value } with `value` the raw inner OCTET-STRING content (a Buffer); the path
+// validator and the future complete-extension-set surface need the STRUCTURE
+// inside. Each decoder takes that raw Buffer and returns the decoded value, or
+// throws a typed `<prefix>/bad-*` code, mirroring the CRL's fail-closed
+// `decodeExt` pattern (asn1.decode → read.* / schema.walk, wrapped). Returns
+// { byOid } keyed by dotted OID so a consumer dispatches by ext.oid.
+var _T = asn1.TAGS;
+function certExtensionDecoders(ns) {
+  var GN_SUBTREE = generalName(ns, { decodeValue: true, subtreeBase: true, code: ns.prefix + "/bad-name-constraints" });
+
+  function decodeTop(buf, code, what) {
+    var n;
+    try { n = asn1.decode(buf); }
+    catch (e) { throw ns.E(code, "malformed " + what + " extension value: " + ((e && e.message) || String(e)), e); }
+    return n;
+  }
+  function seqChildren(buf, code, what) {
+    var n = decodeTop(buf, code, what);
+    if (n.tagClass !== "universal" || n.tagNumber !== _T.SEQUENCE || !n.children) {
+      throw ns.E(code, what + " must be a SEQUENCE (RFC 5280 §4.2.1)");
+    }
+    return n.children;
+  }
+  function readInt(node, code, what) {
+    try { return asn1.read.integer(node); }
+    catch (e) { throw ns.E(code, what + " must be an INTEGER", e); }
+  }
+
+  // basicConstraints ::= SEQUENCE { cA BOOLEAN DEFAULT FALSE, pathLen INTEGER (0..MAX) OPTIONAL }
+  function basicConstraints(buf) {
+    var C = ns.prefix + "/bad-basic-constraints";
+    var kids = seqChildren(buf, C, "BasicConstraints");
+    var i = 0, cA = false, pathLen = null;
+    if (kids[i] && kids[i].tagClass === "universal" && kids[i].tagNumber === _T.BOOLEAN) {
+      var v;
+      try { v = asn1.read.boolean(kids[i]); } catch (e) { throw ns.E(C, "BasicConstraints cA must be a BOOLEAN", e); }
+      if (v !== true) throw ns.E(C, "BasicConstraints cA DEFAULT FALSE must be omitted, not an explicit FALSE (X.690 §11.5)");
+      cA = true; i++;
+    }
+    if (kids[i] && kids[i].tagClass === "universal" && kids[i].tagNumber === _T.INTEGER) {
+      if (!cA) throw ns.E(C, "BasicConstraints pathLenConstraint is only permitted when cA is TRUE (RFC 5280 §4.2.1.9)");
+      var pl = readInt(kids[i], C, "pathLenConstraint");
+      if (pl < 0n) throw ns.E(C, "BasicConstraints pathLenConstraint must be non-negative");
+      pathLen = Number(pl); i++;
+    }
+    if (i !== kids.length) throw ns.E(C, "BasicConstraints has unexpected trailing fields");
+    return { cA: cA, pathLenConstraint: pathLen };
+  }
+
+  // keyUsage ::= BIT STRING (named bits). At least one bit MUST be set.
+  var KU_BITS = ["digitalSignature", "nonRepudiation", "keyEncipherment", "dataEncipherment",
+    "keyAgreement", "keyCertSign", "cRLSign", "encipherOnly", "decipherOnly"];
+  function keyUsage(buf) {
+    var C = ns.prefix + "/bad-key-usage";
+    var n = decodeTop(buf, C, "KeyUsage");
+    if (n.tagClass !== "universal" || n.tagNumber !== _T.BIT_STRING) throw ns.E(C, "KeyUsage must be a BIT STRING (RFC 5280 §4.2.1.3)");
+    var bs;
+    try { bs = asn1.read.bitString(n); } catch (e) { throw ns.E(C, "KeyUsage must be a well-formed BIT STRING", e); }
+    // At least one bit MUST be set (RFC 5280 §4.2.1.3) — an all-zero value (a
+    // non-empty byte run of only zero bits, e.g. 03 02 07 00) is malformed too.
+    var anyBit = false;
+    for (var z = 0; z < bs.bytes.length; z++) { if (bs.bytes[z] !== 0) { anyBit = true; break; } }
+    if (!anyBit) throw ns.E(C, "KeyUsage must assert at least one bit (RFC 5280 §4.2.1.3)");
+    // KeyUsage is a NamedBitList: DER (X.690 §11.2.2) strips all trailing zero
+    // bits, so the last content octet must be non-zero and the lowest USED bit
+    // (at position unusedBits) must be set — one canonical encoding per value.
+    var last = bs.bytes[bs.bytes.length - 1];
+    if (last === 0 || ((last >> bs.unusedBits) & 1) !== 1) {
+      throw ns.E(C, "KeyUsage must use the minimal DER NamedBitList encoding (no trailing zero bits, X.690 §11.2.2)");
+    }
+    var out = {};
+    KU_BITS.forEach(function (nm, bit) {
+      var byte = bit >> 3, mask = 0x80 >> (bit & 7);
+      out[nm] = byte < bs.bytes.length && (bs.bytes[byte] & mask) !== 0;
+    });
+    return out;
+  }
+
+  // GeneralSubtree ::= SEQUENCE { base GeneralName, minimum [0] DEFAULT 0, maximum [1] OPTIONAL }
+  function subtreeList(node, C) {
+    // node is the [0]/[1] IMPLICIT SEQUENCE OF GeneralSubtree (context-constructed).
+    // GeneralSubtrees is SIZE(1..MAX) — an explicitly present but empty subtree
+    // list (a0 00) absorbs no constraint and is malformed, not a no-op.
+    if (!node.children || node.children.length < 1) throw ns.E(C, "NameConstraints permittedSubtrees/excludedSubtrees must be a non-empty GeneralSubtrees (SIZE 1..MAX, RFC 5280 §4.2.1.10)");
+    return node.children.map(function (st) {
+      if (st.tagClass !== "universal" || st.tagNumber !== _T.SEQUENCE || !st.children || st.children.length < 1) {
+        throw ns.E(C, "GeneralSubtree must be a SEQUENCE { base, minimum?, maximum? }");
+      }
+      var base = schema.walk(GN_SUBTREE, st.children[0], ns);
+      for (var j = 1; j < st.children.length; j++) {
+        var f = st.children[j];
+        if (f.tagClass !== "context" || (f.tagNumber !== 0 && f.tagNumber !== 1)) throw ns.E(C, "GeneralSubtree has an unexpected field");
+        if (f.tagNumber === 0) throw ns.E(C, "GeneralSubtree minimum DEFAULT 0 must be omitted (RFC 5280 §4.2.1.10 requires minimum = 0)");
+        if (f.tagNumber === 1) throw ns.E(C, "GeneralSubtree maximum is not permitted in the RFC 5280 profile (§4.2.1.10)");
+      }
+      return { base: base };
+    });
+  }
+  function nameConstraints(buf) {
+    var C = ns.prefix + "/bad-name-constraints";
+    var kids = seqChildren(buf, C, "NameConstraints");
+    var permitted = [], excluded = [], sawP = false, sawE = false, ncLastTag = -1;
+    kids.forEach(function (k) {
+      if (k.tagClass !== "context" || !k.children) throw ns.E(C, "NameConstraints fields are [0] permittedSubtrees / [1] excludedSubtrees");
+      if (k.tagNumber <= ncLastTag) throw ns.E(C, "NameConstraints fields must be unique and in ascending order (DER)");
+      ncLastTag = k.tagNumber;
+      if (k.tagNumber === 0) { if (sawP) throw ns.E(C, "duplicate permittedSubtrees"); sawP = true; permitted = subtreeList(k, C); }
+      else if (k.tagNumber === 1) { if (sawE) throw ns.E(C, "duplicate excludedSubtrees"); sawE = true; excluded = subtreeList(k, C); }
+      else throw ns.E(C, "NameConstraints has an unexpected field [" + k.tagNumber + "]");
+    });
+    if (!sawP && !sawE) throw ns.E(C, "NameConstraints must contain permittedSubtrees or excludedSubtrees (RFC 5280 §4.2.1.10)");
+    return { permittedSubtrees: permitted, excludedSubtrees: excluded };
+  }
+
+  // certificatePolicies ::= SEQUENCE SIZE(1..MAX) OF PolicyInformation
+  function certificatePolicies(buf) {
+    var C = ns.prefix + "/bad-policy";
+    var kids = seqChildren(buf, C, "CertificatePolicies");
+    if (kids.length < 1) throw ns.E(C, "CertificatePolicies must contain at least one PolicyInformation (RFC 5280 §4.2.1.4)");
+    var seen = {};
+    return kids.map(function (pi) {
+      // PolicyInformation ::= SEQUENCE { policyIdentifier, policyQualifiers
+      // SEQUENCE SIZE(1..MAX) OPTIONAL } — exactly one or two fields; a second
+      // field, if present, MUST be a SEQUENCE. Extra/mis-typed fields are malformed.
+      if (pi.tagClass !== "universal" || pi.tagNumber !== _T.SEQUENCE || !pi.children || pi.children.length < 1 || pi.children.length > 2) {
+        throw ns.E(C, "PolicyInformation must be a SEQUENCE { policyIdentifier, policyQualifiers? }");
+      }
+      var pid;
+      try { pid = asn1.read.oid(pi.children[0]); } catch (e) { throw ns.E(C, "PolicyInformation policyIdentifier must be an OBJECT IDENTIFIER", e); }
+      if (seen[pid]) throw ns.E(C, "duplicate policy OID " + pid + " (RFC 5280 §4.2.1.4)");
+      seen[pid] = true;
+      var qualifiers = null;
+      if (pi.children.length > 1) {
+        var q = pi.children[1];
+        if (q.tagClass !== "universal" || q.tagNumber !== _T.SEQUENCE || !q.children || !q.children.length) {
+          throw ns.E(C, "PolicyInformation policyQualifiers must be a non-empty SEQUENCE (RFC 5280 §4.2.1.4)");
+        }
+        // Each element is a PolicyQualifierInfo ::= SEQUENCE { policyQualifierId
+        // OID, qualifier ANY DEFINED BY policyQualifierId } — EXACTLY two members
+        // (qualifier is not OPTIONAL). A SEQUENCE missing the qualifier or
+        // carrying trailing extra fields is malformed; the qualifier body itself
+        // stays opaque.
+        q.children.forEach(function (pq) {
+          if (pq.tagClass !== "universal" || pq.tagNumber !== _T.SEQUENCE || !pq.children || pq.children.length !== 2) {
+            throw ns.E(C, "policyQualifiers element must be a PolicyQualifierInfo SEQUENCE { policyQualifierId, qualifier } (RFC 5280 §4.2.1.4)");
+          }
+          try { asn1.read.oid(pq.children[0]); } catch (e) { throw ns.E(C, "PolicyQualifierInfo must lead with a policyQualifierId OID", e); }
+        });
+        qualifiers = q.bytes;
+      }
+      return { policyIdentifier: pid, qualifiersBytes: qualifiers };
+    });
+  }
+
+  // policyMappings ::= SEQUENCE SIZE(1..MAX) OF SEQUENCE { issuerDomainPolicy, subjectDomainPolicy }
+  function policyMappings(buf) {
+    var C = ns.prefix + "/bad-policy";
+    var kids = seqChildren(buf, C, "PolicyMappings");
+    if (kids.length < 1) throw ns.E(C, "PolicyMappings must contain at least one mapping (RFC 5280 §4.2.1.5)");
+    return kids.map(function (mp) {
+      if (mp.tagClass !== "universal" || mp.tagNumber !== _T.SEQUENCE || !mp.children || mp.children.length !== 2) {
+        throw ns.E(C, "policy mapping must be a SEQUENCE { issuerDomainPolicy, subjectDomainPolicy }");
+      }
+      var idp, sdp;
+      try { idp = asn1.read.oid(mp.children[0]); sdp = asn1.read.oid(mp.children[1]); }
+      catch (e) { throw ns.E(C, "policy mapping members must be OBJECT IDENTIFIERs", e); }
+      return { issuerDomainPolicy: idp, subjectDomainPolicy: sdp };
+    });
+  }
+
+  // policyConstraints ::= SEQUENCE { requireExplicitPolicy [0] INTEGER OPT, inhibitPolicyMapping [1] INTEGER OPT }
+  function policyConstraints(buf) {
+    var C = ns.prefix + "/bad-policy";
+    var kids = seqChildren(buf, C, "PolicyConstraints");
+    if (kids.length < 1) throw ns.E(C, "PolicyConstraints must contain at least one field (RFC 5280 §4.2.1.11)");
+    var rep = null, ipm = null, pcLastTag = -1;
+    kids.forEach(function (k) {
+      if (k.tagClass !== "context") throw ns.E(C, "PolicyConstraints fields are context-tagged [0]/[1]");
+      if (k.tagNumber <= pcLastTag) throw ns.E(C, "PolicyConstraints fields must be unique and in ascending order (DER)");
+      pcLastTag = k.tagNumber;
+      var v;
+      try { v = asn1.read.integerImplicit(k, k.tagNumber); } catch (e) { throw ns.E(C, "PolicyConstraints field must be an INTEGER", e); }
+      if (v < 0n) throw ns.E(C, "PolicyConstraints skip count must be non-negative");
+      if (k.tagNumber === 0) rep = Number(v);
+      else if (k.tagNumber === 1) ipm = Number(v);
+      else throw ns.E(C, "PolicyConstraints has an unexpected field [" + k.tagNumber + "]");
+    });
+    return { requireExplicitPolicy: rep, inhibitPolicyMapping: ipm };
+  }
+
+  // inhibitAnyPolicy ::= INTEGER (0..MAX)
+  function inhibitAnyPolicy(buf) {
+    var C = ns.prefix + "/bad-policy";
+    var n = decodeTop(buf, C, "InhibitAnyPolicy");
+    if (n.tagClass !== "universal" || n.tagNumber !== _T.INTEGER) throw ns.E(C, "InhibitAnyPolicy must be an INTEGER (RFC 5280 §4.2.1.14)");
+    var v = readInt(n, C, "InhibitAnyPolicy");
+    if (v < 0n) throw ns.E(C, "InhibitAnyPolicy skip count must be non-negative");
+    return Number(v);
+  }
+
+  // subjectAltName / issuerAltName ::= GeneralNames — decoded values surfaced.
+  function altName(buf) {
+    var C = ns.prefix + "/bad-extension-value";
+    var n = decodeTop(buf, C, "GeneralNames");
+    return schema.walk(generalNames(ns, { decodeValue: true, code: C }), n, ns).result;
+  }
+
+  // extKeyUsage ::= SEQUENCE SIZE(1..MAX) OF KeyPurposeId (OID)
+  function extKeyUsage(buf) {
+    var C = ns.prefix + "/bad-extension-value";
+    var kids = seqChildren(buf, C, "ExtKeyUsage");
+    if (kids.length < 1) throw ns.E(C, "ExtKeyUsage must contain at least one KeyPurposeId (RFC 5280 §4.2.1.12)");
+    return kids.map(function (k) {
+      try { return asn1.read.oid(k); } catch (e) { throw ns.E(C, "ExtKeyUsage KeyPurposeId must be an OBJECT IDENTIFIER", e); }
+    });
+  }
+
+  // authorityKeyIdentifier ::= SEQUENCE { keyIdentifier [0] OPT, authorityCertIssuer [1] OPT, authorityCertSerialNumber [2] OPT }
+  function authorityKeyIdentifier(buf) {
+    var C = ns.prefix + "/bad-extension-value";
+    var kids = seqChildren(buf, C, "AuthorityKeyIdentifier");
+    var out = { keyIdentifier: null, authorityCertIssuer: null, authorityCertSerialNumber: null };
+    var lastTag = -1;
+    kids.forEach(function (k) {
+      if (k.tagClass !== "context") throw ns.E(C, "AuthorityKeyIdentifier fields are context-tagged");
+      // DER: the OPTIONAL fields appear at most once and in ascending tag order.
+      if (k.tagNumber <= lastTag) throw ns.E(C, "AuthorityKeyIdentifier fields must be unique and in ascending order (DER)");
+      lastTag = k.tagNumber;
+      // keyIdentifier [0] IMPLICIT OCTET STRING and authorityCertSerialNumber
+      // [2] IMPLICIT INTEGER are primitive leaves; the readers enforce the
+      // primitive form fail-closed (a constructed context node is rejected,
+      // never dereferenced for its absent content).
+      if (k.tagNumber === 0) { try { out.keyIdentifier = Buffer.from(asn1.read.octetStringImplicit(k, 0)); } catch (e) { throw ns.E(C, "AuthorityKeyIdentifier keyIdentifier [0] must be an IMPLICIT OCTET STRING", e); } }
+      else if (k.tagNumber === 1) out.authorityCertIssuer = schema.walk(generalNames(ns, { implicitTag: 1, decodeValue: true, code: C }), k, ns).result;
+      else if (k.tagNumber === 2) { try { out.authorityCertSerialNumber = asn1.read.integerImplicit(k, 2); } catch (e) { throw ns.E(C, "authorityCertSerialNumber must be an INTEGER", e); } }
+      else throw ns.E(C, "AuthorityKeyIdentifier has an unexpected field [" + k.tagNumber + "]");
+    });
+    if ((out.authorityCertIssuer === null) !== (out.authorityCertSerialNumber === null)) {
+      throw ns.E(C, "AuthorityKeyIdentifier authorityCertIssuer and authorityCertSerialNumber must both be present or both absent (RFC 5280 §4.2.1.1)");
+    }
+    return out;
+  }
+
+  // subjectKeyIdentifier ::= OCTET STRING
+  function subjectKeyIdentifier(buf) {
+    var C = ns.prefix + "/bad-extension-value";
+    var n = decodeTop(buf, C, "SubjectKeyIdentifier");
+    try { return Buffer.concat([asn1.read.octetString(n)]); }
+    catch (e) { throw ns.E(C, "SubjectKeyIdentifier must be an OCTET STRING (RFC 5280 §4.2.1.2)", e); }
+  }
+
+  function O(nm) { return ns.oid.byName(nm); }
+  var byOid = {};
+  byOid[O("basicConstraints")] = basicConstraints;
+  byOid[O("keyUsage")] = keyUsage;
+  byOid[O("nameConstraints")] = nameConstraints;
+  byOid[O("certificatePolicies")] = certificatePolicies;
+  byOid[O("policyMappings")] = policyMappings;
+  byOid[O("policyConstraints")] = policyConstraints;
+  byOid[O("inhibitAnyPolicy")] = inhibitAnyPolicy;
+  byOid[O("subjectAltName")] = altName;
+  byOid[O("issuerAltName")] = altName;
+  byOid[O("extKeyUsage")] = extKeyUsage;
+  byOid[O("authorityKeyIdentifier")] = authorityKeyIdentifier;
+  byOid[O("subjectKeyIdentifier")] = subjectKeyIdentifier;
+  return { byOid: byOid };
+}
+
 // Extension ::= SEQUENCE { extnID OID, critical BOOLEAN DEFAULT FALSE,
 // extnValue OCTET STRING }. `critical` is a universal BOOLEAN present-by-count
 // (not context-tagged), so the per-extension decode handles the 2-vs-3-child
@@ -319,12 +638,20 @@ function extension(ns) {
     return { oid: extnID, name: ns.oid.name(extnID) || null, critical: critical, value: asn1.read.octetString(valueNode) };
   });
 }
-function extensions(ns) {
-  return schema.seqOf(extension(ns), {
-    assert: "sequence", min: 1, code: ns.prefix + "/bad-extensions", what: "Extensions",
-    unique: function (item) { return item.value.oid; }, dupCode: ns.prefix + "/duplicate-extension",
+// opts.implicitTag (optional): read Extensions as a [tag] IMPLICIT SEQUENCE OF
+// Extension — the context tag REPLACES the universal SEQUENCE tag, for the CRMF
+// CertTemplate extensions [9] (RFC 4211 §5). With no opts the shape is a bare
+// universal SEQUENCE OF, byte-identical to every existing caller.
+function extensions(ns, opts) {
+  opts = opts || {};
+  var EXT = extension(ns);
+  var extOpts = {
+    min: 1, code: ns.prefix + "/bad-extensions", what: "Extensions",
+    unique: function (it) { return it.value.oid; }, dupCode: ns.prefix + "/duplicate-extension",
     build: function (m) { return m.items.map(function (it) { return it.value; }); },
-  });
+  };
+  if (opts.implicitTag != null) return schema.implicitSeqOf(opts.implicitTag, EXT, extOpts);
+  return schema.seqOf(EXT, Object.assign({ assert: "sequence" }, extOpts));
 }
 
 // SubjectPublicKeyInfo ::= SEQUENCE { algorithm AlgorithmIdentifier,
@@ -332,17 +659,26 @@ function extensions(ns) {
 // universal SEQUENCE — a context-tagged or SET-tagged constructed node carrying
 // two well-formed children is NOT a SubjectPublicKeyInfo. Shared by the
 // certificate and CSR parsers.
-function spki(ns) {
+// opts.implicitTag (optional): read the SubjectPublicKeyInfo as a [tag] IMPLICIT
+// SEQUENCE (a context-class constructed node whose children are algorithm +
+// subjectPublicKey), for the CRMF CertTemplate publicKey [6] (RFC 4211 §5). With no
+// opts the shape is a universal SEQUENCE, byte-identical to every existing caller.
+function spki(ns, opts) {
+  opts = opts || {};
   return schema.seq([
     schema.field("algorithm", algorithmIdentifier(ns)),
     schema.field("subjectPublicKey", schema.bitString()),
   ], {
-    assert: "sequence", arity: { exact: 2 }, code: ns.prefix + "/bad-spki", what: "SubjectPublicKeyInfo",
+    assert: opts.implicitTag != null ? "implicit" : "sequence", implicitTag: opts.implicitTag,
+    arity: { exact: 2 }, code: ns.prefix + "/bad-spki", what: "SubjectPublicKeyInfo",
     build: function (m) {
       return {
         algorithm: m.fields.algorithm.value.result,
         publicKey: { unusedBits: m.fields.subjectPublicKey.value.unusedBits, bytes: m.fields.subjectPublicKey.value.bytes },
-        bytes: m.node.bytes,
+        // `bytes` is the importable SubjectPublicKeyInfo DER. In IMPLICIT [tag]
+        // mode the wire node leads with the context tag, so recover the SEQUENCE
+        // encoding a consumer imports / hashes rather than the [tag] wire form.
+        bytes: opts.implicitTag != null ? asn1.sequenceTlv(m.node) : m.node.bytes,
       };
     },
   });
@@ -446,6 +782,7 @@ module.exports = {
   name: name,
   generalName: generalName,
   generalNames: generalNames,
+  certExtensionDecoders: certExtensionDecoders,
   attribute: attribute,
   extension: extension,
   extensions: extensions,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:d18de1ff-7ebd-406f-91cb-801da4286f4f",
+  "serialNumber": "urn:uuid:b6db5d53-2a3e-46f9-9187-9c2f6fd9249b",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-06T08:32:53.685Z",
+    "timestamp": "2026-07-07T05:30:55.753Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.1.15",
+      "bom-ref": "@blamejs/pki@0.1.17",
       "type": "application",
       "name": "pki",
-      "version": "0.1.15",
+      "version": "0.1.17",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.1.15",
+      "purl": "pkg:npm/%40blamejs/pki@0.1.17",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.1.15",
+      "ref": "@blamejs/pki@0.1.17",
       "dependsOn": []
     }
   ]