@blamejs/pki 0.1.18 → 0.1.19

package/lib/schema-cms.js

@@ -132,12 +132,11 @@ function rawElement(item) {
 // [3], a v2AttrCert [2], a v1AttrCert [1]; a RevocationInfoChoice `other` is [1]),
 // the SignerInfo versions, and whether the content type is id-data.
 function _expectedSignedDataVersion(certificates, crls, signerInfos, eContentType) {
-  function ctx(el, n) { return el.tagClass === "context" && el.tagNumber === n; }
-  var otherCert = certificates.some(function (c) { return ctx(c, 3); });
-  var otherCrl = crls.some(function (c) { return ctx(c, 1); });
+  var otherCert = certificates.some(function (c) { return schema.isContext(c, 3); });
+  var otherCrl = crls.some(function (c) { return schema.isContext(c, 1); });
   if (otherCert || otherCrl) return 5;
-  if (certificates.some(function (c) { return ctx(c, 2); })) return 4;   // v2AttrCert [2]
-  if (certificates.some(function (c) { return ctx(c, 1); }) ||           // v1AttrCert [1]
+  if (certificates.some(function (c) { return schema.isContext(c, 2); })) return 4;   // v2AttrCert [2]
+  if (certificates.some(function (c) { return schema.isContext(c, 1); }) ||           // v1AttrCert [1]
       signerInfos.some(function (si) { return si.version === 3; }) ||
       eContentType !== OID_DATA) return 3;
   return 1;
@@ -528,12 +527,11 @@ var ORIGINATOR_INFO = schema.seq([
 // [2]; a crl `other` is [1]; a pwri or ori forces v3; all-ktri-IAS with no
 // originatorInfo/unprotectedAttrs is v0; everything else v2).
 function _expectedEnvelopedDataVersion(originatorInfo, recipientInfos, hasUnprotectedAttrs) {
-  function ctx(el, n) { return el.tagClass === "context" && el.tagNumber === n; }
   var hasOrig = !!originatorInfo;
   var certs = hasOrig ? originatorInfo.certs : [];
   var crls = hasOrig ? originatorInfo.crls : [];
-  if (hasOrig && (certs.some(function (c) { return ctx(c, 3); }) || crls.some(function (c) { return ctx(c, 1); }))) return 4;
-  if ((hasOrig && certs.some(function (c) { return ctx(c, 2); })) ||
+  if (hasOrig && (certs.some(function (c) { return schema.isContext(c, 3); }) || crls.some(function (c) { return schema.isContext(c, 1); }))) return 4;
+  if ((hasOrig && certs.some(function (c) { return schema.isContext(c, 2); })) ||
       recipientInfos.some(function (r) { return r.type === "pwri" || r.type === "ori"; })) return 3;
   if (!hasOrig && !hasUnprotectedAttrs &&
       recipientInfos.every(function (r) { return r.type === "ktri" && r.ridType === "issuerAndSerialNumber"; })) return 0;
@@ -676,11 +674,10 @@ function pemEncode(der, label) { return pkix.pemEncode(der, label || "CMS", PemE
 // registry order.
 function matches(root) {
   var TAGS = asn1.TAGS;
-  if (!root || root.tagClass !== "universal" || root.tagNumber !== TAGS.SEQUENCE) return false;
-  var k = root.children;
-  if (!k || k.length !== 2) return false;
-  if (!(k[0].tagClass === "universal" && k[0].tagNumber === TAGS.OBJECT_IDENTIFIER)) return false;
-  if (!(k[1].tagClass === "context" && k[1].tagNumber === 0 && k[1].children)) return false;
+  var k = pkix.rootSequenceChildren(root, 2, 2);
+  if (!k) return false;
+  if (!schema.isUniversal(k[0], TAGS.OBJECT_IDENTIFIER)) return false;
+  if (!(schema.isContext(k[1], 0) && k[1].children)) return false;
   return true;
 }
 

package/lib/schema-crl.js

@@ -238,10 +238,10 @@ function matches(root) {
   // version, then signature (SEQUENCE) + issuer (SEQUENCE); the next element is
   // thisUpdate (Time) for a CRL, Validity (SEQUENCE) for a certificate.
   var i = 0;
-  if (tbs.children[i] && tbs.children[i].tagClass === "universal" && tbs.children[i].tagNumber === TAGS.INTEGER) i++;
+  if (schema.isUniversal(tbs.children[i], TAGS.INTEGER)) i++;
   i += 2; // signature + issuer
   var pos = tbs.children[i];
-  return !!pos && pos.tagClass === "universal" && (pos.tagNumber === TAGS.UTC_TIME || pos.tagNumber === TAGS.GENERALIZED_TIME);
+  return schema.isUniversalOneOf(pos, [TAGS.UTC_TIME, TAGS.GENERALIZED_TIME]);
 }
 
 module.exports = {

package/lib/schema-crmf.js

@@ -296,30 +296,27 @@ var CERT_TEMPLATE = schema.seq([
   assert: "sequence", code: "crmf/bad-cert-template", what: "CertTemplate",
   build: function (m, ctx) {
     var f = m.fields;
-    // RFC 4211 §5 — serialNumber, signingAlg, issuerUID, and subjectUID MUST be
-    // omitted from a CertTemplate: serialNumber and signingAlg are assigned by the
-    // CA, and the UID pair is deprecated. A requester must not dictate a
-    // CA-assigned value (a requester-chosen serialNumber is a real hazard), so a
-    // template that sets any of them is rejected fail-closed, not surfaced as
-    // acceptable. They stay in the field map (parsed, then rejected) so the
-    // diagnostic names the offending field rather than a bare tag number.
-    var caAssigned = ["serialNumber", "signingAlg", "issuerUID", "subjectUID"];
-    for (var i = 0; i < caAssigned.length; i++) {
-      if (f[caAssigned[i]].present) {
-        throw ctx.E("crmf/bad-cert-template", "CertTemplate " + caAssigned[i] + " MUST be omitted — it is CA-assigned or deprecated (RFC 4211 §5)");
-      }
-    }
-    // version MUST be 2 (v3) when supplied; SHOULD be omitted (RFC 4211 §5).
+    // version MUST be 2 (v3) when supplied; SHOULD be omitted (RFC 4211 §5). This
+    // is a structural CertTemplate rule (it holds wherever the template appears);
+    // the CA-assigned-field omission rule is REQUEST-context-specific and lives in
+    // CERT_REQUEST.build, because the same CertTemplate structure identifies an
+    // existing certificate — serialNumber and issuer present — inside a CMP
+    // RevDetails (RFC 9810 §5.3.9). Every field is surfaced so both the request
+    // omission check and the revocation consumer read them off one result.
     if (f.version.present && f.version.value !== 2n) {
       throw ctx.E("crmf/bad-version", "CertTemplate version MUST be 2 (v3) if supplied (RFC 4211 §5)");
     }
     return {
-      version:    f.version.present ? f.version.value : null,
-      issuer:     f.issuer.present ? f.issuer.value : null,
-      validity:   f.validity.present ? f.validity.value.result : null,
-      subject:    f.subject.present ? f.subject.value : null,
-      publicKey:  f.publicKey.present ? f.publicKey.value.result : null,
-      extensions: f.extensions.present ? f.extensions.value.result : null,
+      version:     f.version.present ? f.version.value : null,
+      serialNumber: f.serialNumber.present ? f.serialNumber.value : null,
+      signingAlg:  f.signingAlg.present ? f.signingAlg.value.result : null,
+      issuer:      f.issuer.present ? f.issuer.value : null,
+      validity:    f.validity.present ? f.validity.value.result : null,
+      subject:     f.subject.present ? f.subject.value : null,
+      publicKey:   f.publicKey.present ? f.publicKey.value.result : null,
+      issuerUID:   f.issuerUID.present ? f.issuerUID.value : null,
+      subjectUID:  f.subjectUID.present ? f.subjectUID.value : null,
+      extensions:  f.extensions.present ? f.extensions.value.result : null,
     };
   },
 });
@@ -334,11 +331,32 @@ var CERT_REQUEST = schema.seq([
   schema.optional("controls", CONTROLS, { whenUniversal: [TAGS.SEQUENCE] }),
 ], {
   assert: "sequence", code: "crmf/bad-cert-request", what: "CertRequest",
-  build: function (m) {
+  build: function (m, ctx) {
+    var tpl = m.fields.certTemplate.value.result;
+    // RFC 4211 §5 — serialNumber, signingAlg, issuerUID, and subjectUID MUST be
+    // omitted from a REQUEST's CertTemplate: serialNumber and signingAlg are
+    // assigned by the CA, and the UID pair is deprecated. A requester must not
+    // dictate a CA-assigned value (a requester-chosen serialNumber is a real
+    // hazard), so a request template that sets any of them is rejected
+    // fail-closed. The check lives HERE, not in CERT_TEMPLATE, because the same
+    // structure legitimately carries serialNumber/issuer in a CMP RevDetails.
+    // A cross-certification request (ccr) is the ONE exception: RFC 9810 Appendix
+    // D.6 profiles its template with signingAlg PRESENT (the requesting CA states
+    // the algorithm it wants the cross-certificate signed with), so the caller
+    // relaxes that single field via ctx.allowSigningAlg; serialNumber and the UID
+    // pair stay forbidden.
+    var caAssigned = ctx.allowSigningAlg
+      ? ["serialNumber", "issuerUID", "subjectUID"]
+      : ["serialNumber", "signingAlg", "issuerUID", "subjectUID"];
+    for (var i = 0; i < caAssigned.length; i++) {
+      if (tpl[caAssigned[i]] !== null) {
+        throw ctx.E("crmf/bad-cert-template", "CertTemplate " + caAssigned[i] + " MUST be omitted — it is CA-assigned or deprecated (RFC 4211 §5)");
+      }
+    }
     return {
       certReqId:     m.fields.certReqId.value,
       certReqIdHex:  m.fields.certReqId.node.content.toString("hex"),
-      certTemplate:  m.fields.certTemplate.value.result,
+      certTemplate:  tpl,
       controls:      m.fields.controls.present ? m.fields.controls.value.result : null,
       certReqBytes:  m.node.bytes,   // the exact CertRequest TLV the POP signature covers (§4.1)
     };
@@ -466,20 +484,36 @@ function pemDecode(text, label) { return pkix.pemDecode(text, label || null, Pem
 // ocsp-request: an OCSPRequest's tbsRequest never leads with the INTEGER-then-
 // SEQUENCE pair (its children[0] is a context [0] version or a requestList).
 function matches(root) {
-  if (!root || root.tagClass !== "universal" || root.tagNumber !== TAGS.SEQUENCE || !root.children || root.children.length < 1) return false;
-  var msg = root.children[0];
-  if (!msg.children || msg.tagClass !== "universal" || msg.tagNumber !== TAGS.SEQUENCE || msg.children.length < 1) return false;
+  var k = pkix.rootSequenceChildren(root, 1);
+  if (!k) return false;
+  var msg = k[0];
+  if (!(msg.children && schema.isUniversal(msg, TAGS.SEQUENCE) && msg.children.length >= 1)) return false;
   var certReq = msg.children[0];
-  if (!certReq.children || certReq.tagClass !== "universal" || certReq.tagNumber !== TAGS.SEQUENCE || certReq.children.length < 2) return false;
+  if (!(certReq.children && schema.isUniversal(certReq, TAGS.SEQUENCE) && certReq.children.length >= 2)) return false;
   var id = certReq.children[0], tpl = certReq.children[1];
-  return id.tagClass === "universal" && id.tagNumber === TAGS.INTEGER &&
-    tpl.tagClass === "universal" && tpl.tagNumber === TAGS.SEQUENCE && !!tpl.children;
+  return schema.isUniversal(id, TAGS.INTEGER) &&
+    schema.isUniversal(tpl, TAGS.SEQUENCE) && !!tpl.children;
+}
+
+// Validate a bare, already-decoded CertReqMessages / CertTemplate node — for a
+// composer that carries these structures inside its own envelope (an RFC 9810
+// CMP PKIBody's ir/cr/kur/krr/ccr arms; a RevDetails.certDetails). NS-bound to
+// crmf so an interior failure throws CrmfError with a crmf/* code, never the
+// composer's class wearing a foreign code. Same contract as the CMS walkers.
+// opts.allowSigningAlg relaxes the request-template signingAlg-omission rule for
+// the CMP cross-certification (ccr) arm only (RFC 9810 Appendix D.6).
+function walkCertReqMessages(node, opts) {
+  var ctx = (opts && opts.allowSigningAlg) ? Object.assign({}, NS, { allowSigningAlg: true }) : NS;
+  return schema.walk(CERT_REQ_MESSAGES, node, ctx).result;
 }
+function walkCertTemplate(node) { return schema.walk(CERT_TEMPLATE, node, NS).result; }
 
 module.exports = {
   parse: parse,
   pemDecode: pemDecode,
   matches: matches,
+  walkCertReqMessages: walkCertReqMessages,
+  walkCertTemplate: walkCertTemplate,
   // The top schema, exposed (not on the curated pki.schema.crmf surface) so a
   // round-trip test can prove schema.encode(schema, v) -> decode -> parse recovers
   // v — the invariant that structurally validates the IMPLICIT/EXPLICIT tag handling.

package/lib/schema-csr.js

@@ -171,10 +171,10 @@ function matches(root) {
   if (!cri) return false;
   var k = cri.children;
   if (k.length !== 4) return false;
-  return k[0].tagClass === "universal" && k[0].tagNumber === TAGS.INTEGER &&
-    k[1].tagClass === "universal" && k[1].tagNumber === TAGS.SEQUENCE &&
-    k[2].tagClass === "universal" && k[2].tagNumber === TAGS.SEQUENCE &&
-    k[3].tagClass === "context" && k[3].tagNumber === 0;
+  return schema.isUniversal(k[0], TAGS.INTEGER) &&
+    schema.isUniversal(k[1], TAGS.SEQUENCE) &&
+    schema.isUniversal(k[2], TAGS.SEQUENCE) &&
+    schema.isContext(k[3], 0);
 }
 
 module.exports = {

package/lib/schema-engine.js

@@ -160,10 +160,10 @@ function optional(name, schema, opts) {
   var match = opts.whenAny
     ? function () { return true; }
     : opts.whenUniversal
-      ? function (n) { return n.tagClass === "universal" && opts.whenUniversal.indexOf(n.tagNumber) !== -1; }
+      ? function (n) { return isUniversalOneOf(n, opts.whenUniversal); }
       : opts.tags
-        ? function (n) { return n.tagClass === "context" && opts.tags.indexOf(n.tagNumber) !== -1; }
-        : function (n) { return n.tagClass === "context" && n.tagNumber === opts.tag; };
+        ? function (n) { return isContextOneOf(n, opts.tags); }
+        : function (n) { return isContext(n, opts.tag); };
   return { fkind: "optional", name: name, schema: schema, tag: opts.tag, match: match,
            explicit: !!opts.explicit, emptyCode: opts.emptyCode, hasDefault: ("default" in opts), def: opts.default };
 }
@@ -587,6 +587,45 @@ function embeddedDer(schema, bytes, ctx, opts) {
   return walk(schema, node, ctx);
 }
 
+// X.690 §11.2.2 — a NamedBitList BIT STRING (KeyUsage, PKIFailureInfo, and the
+// like) MUST drop every trailing zero bit under DER, giving one canonical
+// encoding per value: an empty value carries 0 unused bits; a non-empty value's
+// last content octet is non-zero AND its lowest USED bit (at position
+// `unusedBits`) is set. `fail(message)` throws the caller's typed domain error,
+// so the reject code stays per-format. Centralized so no format re-derives — and
+// silently diverges on — the minimal-encoding rule (a DER-canonicalization
+// bypass class); see the named-bitlist-minimal-encoding-inlined gate.
+// ASN.1 node tag predicates — the per-node `tagClass`/`tagNumber` test every
+// format's matches() detector (and the engine's own optional/choice walkers)
+// would otherwise re-inline. Centralized so a detector composes one predicate
+// instead of hand-rolling the comparison (and drifting); see the
+// detector-reinlines-root-tag-guard gate.
+function isUniversal(node, tagNumber) {
+  return !!node && node.tagClass === "universal" && node.tagNumber === tagNumber;
+}
+function isContext(node, tagNumber) {
+  return !!node && node.tagClass === "context" && node.tagNumber === tagNumber;
+}
+function isUniversalOneOf(node, tagNumbers) {
+  return !!node && node.tagClass === "universal" && tagNumbers.indexOf(node.tagNumber) !== -1;
+}
+function isContextOneOf(node, tagNumbers) {
+  return !!node && node.tagClass === "context" && tagNumbers.indexOf(node.tagNumber) !== -1;
+}
+function isContextInRange(node, min, max) {
+  return !!node && node.tagClass === "context" && node.tagNumber >= min && node.tagNumber <= max;
+}
+
+function assertMinimalNamedBits(unusedBits, bytes, fail) {
+  if (bytes.length === 0) {
+    if (unusedBits !== 0) fail("an empty NamedBitList must encode with 0 unused bits (X.690 §11.2.2)");
+    return;
+  }
+  var last = bytes[bytes.length - 1];
+  if (last === 0) fail("a NamedBitList must not carry a trailing all-zero octet (X.690 §11.2.2)");
+  if (((last >> unusedBits) & 1) !== 1) fail("a NamedBitList must drop all trailing zero bits (X.690 §11.2.2)");
+}
+
 module.exports = {
   // structural
   seq: seq, field: field, optional: optional, explicit: explicit, trailing: trailing,
@@ -597,5 +636,8 @@ module.exports = {
   implicitNull: implicitNull, implicitInteger: implicitInteger,
   any: any, decode: decode, time: time,
   // engine
-  walk: walk, encode: encode, embeddedDer: embeddedDer,
+  walk: walk, encode: encode, embeddedDer: embeddedDer, assertMinimalNamedBits: assertMinimalNamedBits,
+  // node tag predicates
+  isUniversal: isUniversal, isContext: isContext,
+  isUniversalOneOf: isUniversalOneOf, isContextOneOf: isContextOneOf, isContextInRange: isContextInRange,
 };

package/lib/schema-ocsp.js

@@ -489,11 +489,10 @@ function pemDecode(text, label) { return pkix.pemDecode(text, label || "OCSP RES
 // unconditionally exclusive.
 function matchesResponse(root) {
   var T = asn1.TAGS;
-  if (!root || root.tagClass !== "universal" || root.tagNumber !== T.SEQUENCE || !root.children) return false;
-  var k = root.children;
-  if (k.length < 1 || k.length > 2) return false;
-  if (!(k[0].tagClass === "universal" && k[0].tagNumber === T.ENUMERATED)) return false;
-  if (k.length === 2 && !(k[1].tagClass === "context" && k[1].tagNumber === 0 && k[1].children)) return false;
+  var k = pkix.rootSequenceChildren(root, 1, 2);
+  if (!k) return false;
+  if (!schema.isUniversal(k[0], T.ENUMERATED)) return false;
+  if (k.length === 2 && !(schema.isContext(k[1], 0) && k[1].children)) return false;
   return true;
 }
 
@@ -503,11 +502,10 @@ function matchesResponse(root) {
 // signed-envelope trio), while an OCSPRequest is 1-2 — so it is excluded by arity.
 function matchesRequest(root) {
   var T = asn1.TAGS;
-  if (!root || root.tagClass !== "universal" || root.tagNumber !== T.SEQUENCE || !root.children) return false;
-  var k = root.children;
-  if (k.length < 1 || k.length > 2) return false;
-  if (!(k[0].tagClass === "universal" && k[0].tagNumber === T.SEQUENCE && k[0].children)) return false;
-  if (k.length === 2 && !(k[1].tagClass === "context" && k[1].tagNumber === 0 && k[1].children)) return false;
+  var k = pkix.rootSequenceChildren(root, 1, 2);
+  if (!k) return false;
+  if (!(schema.isUniversal(k[0], T.SEQUENCE) && k[0].children)) return false;
+  if (k.length === 2 && !(schema.isContext(k[1], 0) && k[1].children)) return false;
   return true;
 }
 

package/lib/schema-pkcs12.js

@@ -595,15 +595,14 @@ function pemEncode(der, label) { return pkix.pemEncode(der, label || "PKCS12", P
 // a shape a PrivateKeyInfo's AlgorithmIdentifier never presents) and
 // children[2] (a SEQUENCE MacData or absent, never PKCS#8's OCTET STRING).
 function matches(root) {
-  if (!root || root.tagClass !== "universal" || root.tagNumber !== TAGS.SEQUENCE) return false;
-  var k = root.children;
-  if (!k || k.length < 2 || k.length > 3) return false;
-  if (!(k[0].tagClass === "universal" && k[0].tagNumber === TAGS.INTEGER)) return false;
+  var k = pkix.rootSequenceChildren(root, 2, 3);
+  if (!k) return false;
+  if (!schema.isUniversal(k[0], TAGS.INTEGER)) return false;
   var ci = k[1];
-  if (!ci.children || ci.tagClass !== "universal" || ci.tagNumber !== TAGS.SEQUENCE || ci.children.length !== 2) return false;
-  if (!(ci.children[0].tagClass === "universal" && ci.children[0].tagNumber === TAGS.OBJECT_IDENTIFIER)) return false;
-  if (!(ci.children[1].tagClass === "context" && ci.children[1].tagNumber === 0 && ci.children[1].children)) return false;
-  if (k.length === 3 && !(k[2].tagClass === "universal" && k[2].tagNumber === TAGS.SEQUENCE && k[2].children)) return false;
+  if (!(ci.children && schema.isUniversal(ci, TAGS.SEQUENCE) && ci.children.length === 2)) return false;
+  if (!schema.isUniversal(ci.children[0], TAGS.OBJECT_IDENTIFIER)) return false;
+  if (!(schema.isContext(ci.children[1], 0) && ci.children[1].children)) return false;
+  if (k.length === 3 && !(schema.isUniversal(k[2], TAGS.SEQUENCE) && k[2].children)) return false;
   return true;
 }
 

package/lib/schema-pkcs8.js

@@ -179,15 +179,14 @@ function pemEncode(der, label) { return pkix.pemEncode(der, label || "PRIVATE KE
 // order.
 function matches(root) {
   var TAGS = asn1.TAGS;
-  if (!root || root.tagClass !== "universal" || root.tagNumber !== TAGS.SEQUENCE) return false;
-  var k = root.children;
-  if (!k || k.length < 3 || k.length > 5) return false;
-  if (!(k[0].tagClass === "universal" && k[0].tagNumber === TAGS.INTEGER)) return false;
-  if (!(k[1].tagClass === "universal" && k[1].tagNumber === TAGS.SEQUENCE)) return false;
-  if (!(k[2].tagClass === "universal" && k[2].tagNumber === TAGS.OCTET_STRING)) return false;
+  var k = pkix.rootSequenceChildren(root, 3, 5);
+  if (!k) return false;
+  if (!schema.isUniversal(k[0], TAGS.INTEGER)) return false;
+  if (!schema.isUniversal(k[1], TAGS.SEQUENCE)) return false;
+  if (!schema.isUniversal(k[2], TAGS.OCTET_STRING)) return false;
   var last = -1;
   for (var i = 3; i < k.length; i++) {
-    if (k[i].tagClass !== "context" || k[i].tagNumber <= last || k[i].tagNumber > 1) return false;
+    if (!schema.isContextInRange(k[i], 0, 1) || k[i].tagNumber <= last) return false;
     last = k[i].tagNumber;
   }
   return true;

package/lib/schema-pkix.js

@@ -392,7 +392,10 @@ function certExtensionDecoders(ns) {
     if (kids[i] && kids[i].tagClass === "universal" && kids[i].tagNumber === _T.INTEGER) {
       if (!cA) throw ns.E(C, "BasicConstraints pathLenConstraint is only permitted when cA is TRUE (RFC 5280 §4.2.1.9)");
       var pl = readInt(kids[i], C, "pathLenConstraint");
-      if (pl < 0n) throw ns.E(C, "BasicConstraints pathLenConstraint must be non-negative");
+      // Bounded before Number() narrowing — a value past the safe-integer range
+      // would round silently and be compared as a path-length ceiling, so it is
+      // exact-or-rejected (the same rule the RSASSA-PSS/PKCS#12 counters follow).
+      if (pl < 0n || pl > 2147483647n) throw ns.E(C, "BasicConstraints pathLenConstraint must be a non-negative integer within range");
       pathLen = Number(pl); i++;
     }
     if (i !== kids.length) throw ns.E(C, "BasicConstraints has unexpected trailing fields");
@@ -413,13 +416,8 @@ function certExtensionDecoders(ns) {
     var anyBit = false;
     for (var z = 0; z < bs.bytes.length; z++) { if (bs.bytes[z] !== 0) { anyBit = true; break; } }
     if (!anyBit) throw ns.E(C, "KeyUsage must assert at least one bit (RFC 5280 §4.2.1.3)");
-    // KeyUsage is a NamedBitList: DER (X.690 §11.2.2) strips all trailing zero
-    // bits, so the last content octet must be non-zero and the lowest USED bit
-    // (at position unusedBits) must be set — one canonical encoding per value.
-    var last = bs.bytes[bs.bytes.length - 1];
-    if (last === 0 || ((last >> bs.unusedBits) & 1) !== 1) {
-      throw ns.E(C, "KeyUsage must use the minimal DER NamedBitList encoding (no trailing zero bits, X.690 §11.2.2)");
-    }
+    // KeyUsage is a NamedBitList — enforce the shared X.690 §11.2.2 minimal-DER rule.
+    schema.assertMinimalNamedBits(bs.unusedBits, bs.bytes, function (m) { throw ns.E(C, m); });
     var out = {};
     KU_BITS.forEach(function (nm, bit) {
       var byte = bit >> 3, mask = 0x80 >> (bit & 7);
@@ -532,7 +530,9 @@ function certExtensionDecoders(ns) {
       pcLastTag = k.tagNumber;
       var v;
       try { v = asn1.read.integerImplicit(k, k.tagNumber); } catch (e) { throw ns.E(C, "PolicyConstraints field must be an INTEGER", e); }
-      if (v < 0n) throw ns.E(C, "PolicyConstraints skip count must be non-negative");
+      // Bounded before Number() narrowing (a skip count past the safe-integer
+      // range would round silently) — exact-or-rejected.
+      if (v < 0n || v > 2147483647n) throw ns.E(C, "PolicyConstraints skip count must be a non-negative integer within range");
       if (k.tagNumber === 0) rep = Number(v);
       else if (k.tagNumber === 1) ipm = Number(v);
       else throw ns.E(C, "PolicyConstraints has an unexpected field [" + k.tagNumber + "]");
@@ -546,7 +546,9 @@ function certExtensionDecoders(ns) {
     var n = decodeTop(buf, C, "InhibitAnyPolicy");
     if (n.tagClass !== "universal" || n.tagNumber !== _T.INTEGER) throw ns.E(C, "InhibitAnyPolicy must be an INTEGER (RFC 5280 §4.2.1.14)");
     var v = readInt(n, C, "InhibitAnyPolicy");
-    if (v < 0n) throw ns.E(C, "InhibitAnyPolicy skip count must be non-negative");
+    // Bounded before Number() narrowing (a skip count past the safe-integer
+    // range would round silently) — exact-or-rejected.
+    if (v < 0n || v > 2147483647n) throw ns.E(C, "InhibitAnyPolicy skip count must be a non-negative integer within range");
     return Number(v);
   }
 
@@ -725,13 +727,25 @@ function attribute(ns) {
 // detectors cannot drift on it (the CRL detector historically omitted the
 // tbs-is-universal check this recovers).
 function signedEnvelopeTbs(root) {
-  if (!root || root.tagClass !== "universal" || root.tagNumber !== asn1.TAGS.SEQUENCE) return null;
+  if (!schema.isUniversal(root, asn1.TAGS.SEQUENCE)) return null;
   if (!root.children || root.children.length !== 3) return null;
   var tbs = root.children[0];
-  if (!tbs.children || tbs.tagClass !== "universal" || tbs.tagNumber !== asn1.TAGS.SEQUENCE) return null;
+  if (!tbs.children || !schema.isUniversal(tbs, asn1.TAGS.SEQUENCE)) return null;
   return tbs;
 }
 
+// rootSequenceChildren(root, minLen, maxLen) — the shared root-shape guard the
+// format matches() detectors re-inline: returns root.children when root is a
+// NON-EMPTY universal SEQUENCE whose child count is within [minLen, maxLen]
+// (maxLen optional/Infinity), else null. Sibling of signedEnvelopeTbs.
+function rootSequenceChildren(root, minLen, maxLen) {
+  if (!schema.isUniversal(root, asn1.TAGS.SEQUENCE) || !root.children) return null;
+  var n = root.children.length;
+  if (n < (minLen || 0)) return null;
+  if (maxLen != null && n > maxLen) return null;
+  return root.children;
+}
+
 // Every format's `parse` is the shared runParse bound to that format's identity
 // (PEM label, error class, error-code prefix, top-level schema). This returns the
 // bound parser so a format declares its configuration once and never re-writes the
@@ -785,6 +799,7 @@ module.exports = {
   spki: spki,
   makeParser: makeParser,
   signedEnvelopeTbs: signedEnvelopeTbs,
+  rootSequenceChildren: rootSequenceChildren,
   signedEnvelope: signedEnvelope,
   attrValueToString: attrValueToString,
   attributeTypeAndValue: attributeTypeAndValue,

package/lib/schema-tsp.js

@@ -217,13 +217,7 @@ var PKI_STATUS_INFO = schema.seq([
 // declared unusedBits must sit exactly below the lowest set bit of the last octet (so
 // the encoding is minimal). The empty value encodes as 0 content octets, 0 unusedBits.
 function _assertMinimalNamedBits(unusedBits, bytes) {
-  if (bytes.length === 0) {
-    if (unusedBits !== 0) throw NS.E("tsp/bad-failinfo", "an empty PKIFailureInfo must encode with 0 unused bits (X.690 §11.2.2)");
-    return;
-  }
-  var last = bytes[bytes.length - 1];
-  if (last === 0) throw NS.E("tsp/bad-failinfo", "PKIFailureInfo NamedBitList must not have a trailing all-zero octet (X.690 §11.2.2)");
-  if (((last >> unusedBits) & 1) !== 1) throw NS.E("tsp/bad-failinfo", "PKIFailureInfo NamedBitList must have all trailing zero bits removed (X.690 §11.2.2)");
+  schema.assertMinimalNamedBits(unusedBits, bytes, function (m) { throw NS.E("tsp/bad-failinfo", m); });
 }
 
 // Decode the set NamedBitList bits to their RFC 3161 names (bit 0 = MSB of byte 0).
@@ -277,7 +271,7 @@ var TIME_STAMP_RESP = schema.seq([
  * @primitive  pki.schema.tsp.parseTstInfo
  * @signature  pki.schema.tsp.parseTstInfo(input) -> tstInfo
  * @since      0.1.13
- * @status     experimental
+ * @status     stable
  * @spec       RFC 3161
  * @related    pki.schema.tsp.parseToken, pki.schema.tsp.parse
  *
@@ -299,7 +293,7 @@ var parseTstInfo = pkix.makeParser({ pemLabel: null, PemError: PemError, ErrorCl
  * @primitive  pki.schema.tsp.parse
  * @signature  pki.schema.tsp.parse(input) -> timeStampResp
  * @since      0.1.13
- * @status     experimental
+ * @status     stable
  * @spec       RFC 3161
  * @related    pki.schema.tsp.parseToken, pki.schema.parse
  *
@@ -320,7 +314,7 @@ var parse = pkix.makeParser({ pemLabel: null, PemError: PemError, ErrorClass: Ts
  * @primitive  pki.schema.tsp.parseToken
  * @signature  pki.schema.tsp.parseToken(input) -> tstInfo
  * @since      0.1.13
- * @status     experimental
+ * @status     stable
  * @spec       RFC 3161, RFC 5652
  * @related    pki.schema.tsp.parse, pki.schema.cms.parse
  *
@@ -374,7 +368,7 @@ function parseToken(input) {
  * @primitive  pki.schema.tsp.pemDecode
  * @signature  pki.schema.tsp.pemDecode(text, label?) -> Buffer
  * @since      0.1.13
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468, RFC 3161
  * @related    pki.schema.tsp.parse
  *
@@ -392,13 +386,12 @@ function pemDecode(text, label) { return pkix.pemDecode(text, label || null, Pem
 // CMS ContentInfo, the INTEGER-first PKCS#8 key, and the exactly-3 signed-envelope
 // trio, so it detects unambiguously regardless of registry order.
 function matches(root) {
-  if (!root || root.tagClass !== "universal" || root.tagNumber !== TAGS.SEQUENCE || !root.children) return false;
-  var k = root.children;
-  if (k.length < 1 || k.length > 2) return false;
+  var k = pkix.rootSequenceChildren(root, 1, 2);
+  if (!k) return false;
   var si = k[0];
-  if (!(si.tagClass === "universal" && si.tagNumber === TAGS.SEQUENCE && si.children && si.children.length >= 1)) return false;
-  if (!(si.children[0].tagClass === "universal" && si.children[0].tagNumber === TAGS.INTEGER)) return false;
-  if (k.length === 2 && !(k[1].tagClass === "universal" && k[1].tagNumber === TAGS.SEQUENCE)) return false;
+  if (!(schema.isUniversal(si, TAGS.SEQUENCE) && si.children && si.children.length >= 1)) return false;
+  if (!schema.isUniversal(si.children[0], TAGS.INTEGER)) return false;
+  if (k.length === 2 && !schema.isUniversal(k[1], TAGS.SEQUENCE)) return false;
   return true;
 }
 

package/lib/schema-x509.js

@@ -220,12 +220,12 @@ function matches(root) {
   var tbs = pkix.signedEnvelopeTbs(root);
   if (!tbs) return false;
   var kids = tbs.children;
-  var i = (kids[0] && kids[0].tagClass === "context" && kids[0].tagNumber === 0) ? 1 : 0; // optional [0] version
+  var i = schema.isContext(kids[0], 0) ? 1 : 0; // optional [0] version
   var validity = kids[i + 3]; // serial(i), signature(i+1), issuer(i+2), validity(i+3)
-  return !!validity && validity.tagClass === "universal" && validity.tagNumber === TAGS.SEQUENCE &&
+  return schema.isUniversal(validity, TAGS.SEQUENCE) &&
     !!validity.children && validity.children.length === 2 &&
     validity.children.every(function (t) {
-      return t.tagClass === "universal" && (t.tagNumber === TAGS.UTC_TIME || t.tagNumber === TAGS.GENERALIZED_TIME);
+      return schema.isUniversalOneOf(t, [TAGS.UTC_TIME, TAGS.GENERALIZED_TIME]);
     });
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.1.18",
+  "version": "0.1.19",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:a14a33cf-8c68-40d3-92b0-6f17ef343543",
+  "serialNumber": "urn:uuid:c8d0b092-58fa-4019-9da1-b2b636e61608",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-09T03:55:56.855Z",
+    "timestamp": "2026-07-09T11:21:47.988Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.1.18",
+      "bom-ref": "@blamejs/pki@0.1.19",
       "type": "application",
       "name": "pki",
-      "version": "0.1.18",
+      "version": "0.1.19",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.1.18",
+      "purl": "pkg:npm/%40blamejs/pki@0.1.19",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.1.18",
+      "ref": "@blamejs/pki@0.1.19",
       "dependsOn": []
     }
   ]