@blamejs/pki 0.1.3 → 0.1.4

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.1.4 — 2026-07-04
+
+The ASN.1 codec's universal-type metadata moves to a single descriptor registry.
+
+### Changed
+
+- The ASN.1/DER codec's universal-type metadata is now defined once in a descriptor registry (each entry carries the type's tag and its required DER encoding form). pki.asn1.TAGS, the primitive-only set (a type DER requires primitive, encoded constructed, is rejected) and the constructed-only set (a SEQUENCE/SET encoded primitive is rejected) are all derived from it, so registering a universal type is a single data entry. This is an internal refactor: the public surface and every decode/encode result are unchanged, and it lays the groundwork for schema-driven format parsers.
+
 ## v0.1.3 — 2026-07-04
 
 WebCrypto EC key import validates the curve against the key material.

package/lib/asn1-der.js

@@ -38,46 +38,56 @@ var OidError = frameworkError.OidError;
 
 // ---- Tag constants (universal class) --------------------------------
 
-var TAGS = {
-  BOOLEAN:           0x01,
-  INTEGER:           0x02,
-  BIT_STRING:        0x03,
-  OCTET_STRING:      0x04,
-  NULL:              0x05,
-  OBJECT_IDENTIFIER: 0x06,
-  ENUMERATED:        0x0a,
-  UTF8_STRING:       0x0c,
-  SEQUENCE:          0x10,
-  SET:               0x11,
-  PRINTABLE_STRING:  0x13,
-  TELETEX_STRING:    0x14,
-  IA5_STRING:        0x16,
-  UTC_TIME:          0x17,
-  GENERALIZED_TIME:  0x18,
-  VISIBLE_STRING:    0x1a,
-  UNIVERSAL_STRING:  0x1c,
-  BMP_STRING:        0x1e,
+// L1 — the ASN.1 universal-type descriptor registry: the single source of
+// truth for the codec's type metadata. Each entry is DECLARATIVE DATA —
+// { tag, form } where form is the DER encoding form ("primitive" or
+// "constructed", X.690 §8/§10.2). TAGS and the two structural type-sets below
+// are all DERIVED from it, so registering a universal type is one descriptor
+// entry and the decoder's form checks (below) cover it automatically.
+var UNIVERSAL_TYPES = {
+  BOOLEAN:           { tag: 0x01, form: "primitive" },
+  INTEGER:           { tag: 0x02, form: "primitive" },
+  BIT_STRING:        { tag: 0x03, form: "primitive" },
+  OCTET_STRING:      { tag: 0x04, form: "primitive" },
+  NULL:              { tag: 0x05, form: "primitive" },
+  OBJECT_IDENTIFIER: { tag: 0x06, form: "primitive" },
+  ENUMERATED:        { tag: 0x0a, form: "primitive" },
+  UTF8_STRING:       { tag: 0x0c, form: "primitive" },
+  SEQUENCE:          { tag: 0x10, form: "constructed" },
+  SET:               { tag: 0x11, form: "constructed" },
+  PRINTABLE_STRING:  { tag: 0x13, form: "primitive" },
+  TELETEX_STRING:    { tag: 0x14, form: "primitive" },
+  IA5_STRING:        { tag: 0x16, form: "primitive" },
+  UTC_TIME:          { tag: 0x17, form: "primitive" },
+  GENERALIZED_TIME:  { tag: 0x18, form: "primitive" },
+  VISIBLE_STRING:    { tag: 0x1a, form: "primitive" },
+  UNIVERSAL_STRING:  { tag: 0x1c, form: "primitive" },
+  BMP_STRING:        { tag: 0x1e, form: "primitive" },
 };
 
+// TAGS { name: tag } — derived from the registry; the public constant consumers
+// read (pki.asn1.TAGS.INTEGER, ...).
+var TAGS = {};
+Object.keys(UNIVERSAL_TYPES).forEach(function (k) { TAGS[k] = UNIVERSAL_TYPES[k].tag; });
+
 var CLASS_UNIVERSAL   = 0x00;
 var CLASS_APPLICATION = 0x40;
 var CLASS_CONTEXT     = 0x80;
 var CLASS_PRIVATE     = 0xc0;
 var CONSTRUCTED_BIT   = 0x20;
 
-// X.690 §8.x / §10.2 (DER) — every universal type the codec handles other than
-// SEQUENCE and SET is a primitive-only type: it MUST be encoded primitive, and
-// a constructed encoding (BOOLEAN, INTEGER, OID, the restricted strings,
-// UTC/GeneralizedTime, and — DER-strict — BIT STRING / OCTET STRING) is not
-// valid DER. Derived from TAGS so a newly-registered primitive type is covered
-// automatically. This is the mirror of the primitive-SEQUENCE/SET rejection.
-var PRIMITIVE_ONLY_UNIVERSAL_TAGS = (function () {
-  var s = Object.create(null);
-  Object.keys(TAGS).forEach(function (k) {
-    if (k !== "SEQUENCE" && k !== "SET") s[TAGS[k]] = true;
-  });
-  return s;
-})();
+// X.690 §8.9.1 / §8.11.1 / §10.2 (DER), the mirror rules — a constructed-only
+// universal type (SEQUENCE/SET) MUST be encoded constructed, and a
+// primitive-only type (every other universal type the codec handles) MUST be
+// encoded primitive. Both sets are DERIVED from the registry above and keyed by
+// tag for an O(1) decode-time form check; a new descriptor is covered with no
+// code change here.
+var PRIMITIVE_ONLY_UNIVERSAL_TAGS   = Object.create(null);
+var CONSTRUCTED_ONLY_UNIVERSAL_TAGS = Object.create(null);
+Object.keys(UNIVERSAL_TYPES).forEach(function (k) {
+  var d = UNIVERSAL_TYPES[k];
+  (d.form === "constructed" ? CONSTRUCTED_ONLY_UNIVERSAL_TAGS : PRIMITIVE_ONLY_UNIVERSAL_TAGS)[d.tag] = true;
+});
 
 function _className(bits) {
   switch (bits) {
@@ -172,11 +182,12 @@ function _decodeTLV(buf, start, limit, depth, maxDepth) {
     }
   }
 
-  // X.690 8.9.1 / 8.11.1 — a universal SEQUENCE or SET is always constructed;
-  // a primitive-tagged 0x10 / 0x11 is not valid DER (and would decode to a
-  // leaf that constructed-structure consumers dereference as a parent).
-  if (tagClassBits === CLASS_UNIVERSAL && (tagNumber === TAGS.SEQUENCE || tagNumber === TAGS.SET) && !constructed) {
-    throw new Asn1Error("asn1/bad-tlv", "SEQUENCE/SET must be constructed");
+  // X.690 8.9.1 / 8.11.1 — a universal constructed-only type (SEQUENCE / SET)
+  // is always constructed; a primitive-tagged one is not valid DER (and would
+  // decode to a leaf that constructed-structure consumers dereference as a
+  // parent). Driven by the registry-derived set, not a hardcoded tag list.
+  if (tagClassBits === CLASS_UNIVERSAL && CONSTRUCTED_ONLY_UNIVERSAL_TAGS[tagNumber] && !constructed) {
+    throw new Asn1Error("asn1/bad-tlv", "a universal constructed-only type (SEQUENCE/SET) must be constructed");
   }
 
   // X.690 §8.x / §10.2 — the mirror rule: a universal primitive-only type

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:2e1fe0ea-94e8-4271-ae62-9f7de0920674",
+  "serialNumber": "urn:uuid:d25ccb6d-af2d-4b1f-b300-f756dc788762",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-04T19:30:56.018Z",
+    "timestamp": "2026-07-04T19:57:57.512Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.1.3",
+      "bom-ref": "@blamejs/pki@0.1.4",
       "type": "application",
       "name": "pki",
-      "version": "0.1.3",
+      "version": "0.1.4",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.1.3",
+      "purl": "pkg:npm/%40blamejs/pki@0.1.4",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.1.3",
+      "ref": "@blamejs/pki@0.1.4",
       "dependsOn": []
     }
   ]