@blamejs/pki 0.1.30 → 0.1.31

package/CHANGELOG.md

@@ -4,6 +4,15 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.1.31 — 2026-07-11
+
+The DER format cohort and the JOSE surface graduate to stable.
+
+### Changed
+
+- pki.schema.pkcs12 / attrcert / crmf / cmp / csrattrs (parse, pemDecode, pemEncode), pki.schema.all and pki.schema.parse, and the pki.jose signing / verification / thumbprint / base64url / JSON surface graduate from experimental to stable.
+- The LTS-CALENDAR graduation criterion now states that a settled, well-tested format no mainstream tool implements graduates on the toolkit's own conformance-vector round-trip plus coverage-guided fuzzing, rather than on a harness oracle that does not exist.
+
 ## v0.1.30 — 2026-07-11
 
 Fail-closed hardening of the byte-input and text-decode boundaries.

package/lib/guard-all.js

@@ -18,6 +18,9 @@
 //                                         (recursion / allocation DoS defence)
 //   guard.crypto.constantTimeEqual    -- length-checked constant-time compare
 //                                         (timing side-channel defence)
+//   guard.range.int / .uint31 / .positiveInt31
+//                                     -- bound a decoded integer before narrowing
+//                                        to Number (silent-narrowing defence)
 //
 // Each shape is enforced by a codebase-patterns detector: the characteristic
 // token of a guard (the Buffer.from(x.buffer, byteOffset) re-view, the
@@ -29,10 +32,14 @@ var bytes  = require("./guard-bytes");
 var text   = require("./guard-text");
 var limits = require("./guard-limits");
 var crypto = require("./guard-crypto");
+var range  = require("./guard-range");
+var name   = require("./guard-name");
 
 module.exports = {
   bytes:  bytes,
   text:   text,
   limits: limits,
   crypto: crypto,
+  range:  range,
+  name:   name,
 };

package/lib/guard-bytes.js

@@ -27,6 +27,8 @@
 // Accepts a Buffer / Uint8Array -- the DER / CBOR / CT / Merkle input contract.
 // ErrorClass MUST be a withCause PkiError subclass (the raw detach failure is
 // threaded as the cause).
+// @enforced-by guard-shape-reinlined
+// @guard-shape Buffer\.from\(\s*([A-Za-z_$][\w$]*)\.buffer\s*,\s*\1\.byteOffset
 function view(input, ErrorClass, code, label) {
   if (Buffer.isBuffer(input) || input instanceof Uint8Array) {
     try {
@@ -42,6 +44,7 @@ function view(input, ErrorClass, code, label) {
 // Accepts the full W3C BufferSource (Buffer / TypedArray view / raw ArrayBuffer)
 // -- the WebCrypto input contract. A raw ArrayBuffer is copied via Buffer.from,
 // which also throws on a detached backing store.
+// @enforced-by guard-shape-reinlined  (the re-view shape is declared on view above)
 function source(input, ErrorClass, code, label) {
   var isAb = input instanceof ArrayBuffer;
   if (isAb || ArrayBuffer.isView(input)) {

package/lib/guard-crypto.js

@@ -25,6 +25,8 @@ var nodeCrypto = require("node:crypto");
 
 // constantTimeEqual(a, b) -> boolean. Length-checked, then constant-time over
 // equal lengths. a and b are Buffers.
+// @enforced-by guard-shape-reinlined
+// @guard-shape \.timingSafeEqual\s*\(
 function constantTimeEqual(a, b) {
   return a.length === b.length && nodeCrypto.timingSafeEqual(a, b);
 }

package/lib/guard-limits.js

@@ -27,6 +27,8 @@ var constants = require("./constants");
 // cap(value, key, dflt) -> a validated non-negative integer, or dflt when value
 // is undefined. A non-integer / non-finite / negative value is a config-time
 // TypeError (Number.isInteger already rejects non-numbers, NaN, and Infinity).
+// @enforced-by behavioral -- a config-time cap validator has no rename-proof code
+//   shape; the decode-rejects-a-bad-cap RED vectors (asn1/cbor) are the guard.
 function cap(value, key, dflt) {
   if (value === undefined) return dflt;
   if (!Number.isInteger(value) || value < 0) {
@@ -38,6 +40,11 @@ function cap(value, key, dflt) {
 // depthCap(value, key, dflt) -> a validated recursion-depth cap: cap() plus the
 // stack-safe ceiling, so a raised maxDepth cannot drive recursive descent into a
 // raw RangeError past the native frame limit.
+// @enforced-by guard-shape-reinlined
+// @guard-scope file
+// @guard-shape \bopts\.maxDepth\b
+// @guard-shape \bdepth\s*\+\s*1\b
+// @guard-via \.depthCap\s*\(
 function depthCap(value, key, dflt) {
   var n = cap(value, key, dflt);
   if (n > constants.LIMITS.MAX_DECODE_DEPTH_CEILING) {

package/lib/guard-name.js

@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. The documented surface is the
+// consumers whose name-string integrity composes this guard (pki.path.validate
+// DN chaining, pki.schema.x509 GeneralName / SAN decode).
+//
+// guard-name -- fail-closed rejection of an embedded control byte in a
+// distinguished-name / SAN string. Two policies over one concern.
+//
+// Defends the name-truncation / display-confusion class (CVE-2009-2408): a NUL
+// or control byte embedded in a decoded name lets an attacker make two different
+// names compare equal (or a UI truncate at the NUL), so a cert issued for
+// "good.example.com\0.evil.com" is treated as "good.example.com". CWE-158
+// (improper neutralization of null byte) / CWE-20. The reject is at decode, so a
+// truncation name never reaches a comparison or a display.
+
+// assertNoControlBytes(str, E, code, label) -> str | throws E(code, ...)
+// DirectoryString policy (a DN attribute value): reject NUL and C0 control bytes
+// in a DECODED name string. TAB (0x09) is exempt; printable non-ASCII (a
+// UTF8String CN carries accented / CJK characters) is allowed. `str` is assumed a
+// string (the caller guards typeof). E is the (code, message) typed-error factory.
+// @enforced-by behavioral -- the control-byte reject has no rename-proof code
+//   shape distinct from the ASN.1 charset readers; the CVE-2009-2408 RED vectors
+//   (a DN string with an embedded NUL / control byte rejects) are the guard.
+function assertNoControlBytes(str, E, code, label) {
+  for (var i = 0; i < str.length; i++) {
+    var c = str.charCodeAt(i);
+    if (c === 0 || (c < 0x20 && c !== 0x09)) {
+      throw E(code, label + " contains an embedded control byte (CVE-2009-2408)");
+    }
+  }
+  return str;
+}
+
+// assertPrintableIa5(buf, E, code, label) -> buf | throws E(code, ...)
+// IA5String policy (a dNSName / rfc822Name / URI GeneralName): every byte must be
+// printable 7-bit ASCII [0x20, 0x7e] -- an embedded NUL / control byte enables the
+// same name-truncation bypass downstream. `buf` is the raw GeneralName content.
+// @enforced-by behavioral -- the printable-IA5 byte-range reject has no rename-proof
+//   code shape distinct from the ASN.1 IA5 reader; the CVE-2009-2408 RED vectors
+//   (a SAN with a control byte rejects) are the guard.
+function assertPrintableIa5(buf, E, code, label) {
+  for (var i = 0; i < buf.length; i++) {
+    if (buf[i] < 0x20 || buf[i] > 0x7e) {
+      throw E(code, label + " must be a printable IA5String (no control bytes)");
+    }
+  }
+  return buf;
+}
+
+module.exports = { assertNoControlBytes: assertNoControlBytes, assertPrintableIa5: assertPrintableIa5 };

package/lib/guard-range.js

@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. The documented surface is the
+// parsers whose decoded-integer bounds compose this guard (pki.schema.x509 /
+// crl / pkcs12 / cmp, pki.path.validate).
+//
+// guard-range -- fail-closed bound of an untrusted DECODED integer before it is
+// narrowed to a JS Number. Parse-time (Tier-2): the value is malformed content,
+// so it throws the caller's typed PkiError -- distinct from guard-limits, which
+// validates an operator-supplied option at config time (Tier-1, TypeError).
+//
+// Defends the silent-narrowing class (a decoded ASN.1 INTEGER past 2^53 rounds
+// when coerced to a Number, so a caller acting on the result -- a pathLen /
+// skipCerts / saltLength / iteration counter -- acts on the WRONG number;
+// CWE-190 integer overflow / CWE-681 incorrect conversion). The bound and the
+// narrow are ATOMIC here: a caller cannot obtain the Number without the range
+// having been enforced, so the value can never round silently and be acted on.
+
+// 2^31 - 1 -- the shared skip-cert / path-length / salt / iteration ceiling.
+// This literal lives ONLY here (a re-inline anywhere else is flagged: the
+// guard-shape walk anchors on the literal). 2^53 - 1 is the safe-narrow ceiling.
+var UINT31_MAX = 2147483647n;
+var SAFE_MAX   = 9007199254740991n;
+var SAFE_MIN   = -9007199254740991n;
+
+// int(value, min, max, E, code, label) -> a Number in [min, max].
+//   value : the BigInt result of an ASN.1 INTEGER / ENUMERATED read.
+//   min, max : inclusive BigInt bounds.
+//   E     : the (code, message, cause) typed-error factory in scope at the call
+//           site (ns.E / ctx.E / the module-local E) -- guard-range injects the
+//           caller's typed error through it, the tier-appropriate currency (a
+//           parse boundary carries a factory, not a bare ErrorClass).
+//   code  : the frozen domain/reason code this field rejects under.
+//   label : field phrase (+ optional RFC cite) for the message.
+// @enforced-by guard-shape-reinlined
+// @guard-shape 2147483647n
+function int(value, min, max, E, code, label) {
+  // Config-time authoring guard (Tier-1): narrowing to Number is lossless only
+  // when the WHOLE range sits inside the safe-integer band [-(2^53-1), 2^53-1].
+  // Both ends bind -- a min below the floor rounds a decoded value near it just
+  // as a max above the ceiling does. A wider range needs a BigInt-preserving
+  // guard, not this one (this is why the uint64 Merkle-coordinate domain must
+  // NOT route here).
+  if (max > SAFE_MAX) {
+    throw new TypeError("guard.range.int: max " + max + " exceeds the safe-integer ceiling; use a BigInt-preserving guard");
+  }
+  if (min < SAFE_MIN) {
+    throw new TypeError("guard.range.int: min " + min + " is below the safe-integer floor; use a BigInt-preserving guard");
+  }
+  // Parse-time reject (Tier-2): malformed / out-of-range decoded content.
+  if (typeof value !== "bigint" || value < min || value > max) {
+    throw E(code, label + " must be an integer within " + min + ".." + max);
+  }
+  return Number(value);
+}
+
+// uint31(value, E, code, label) -> Number in [0, 2^31-1]. The DER-INTEGER
+// non-negative skip/path/salt shape (RFC 5280 / 4211 / 9810).
+// @enforced-by guard-shape-reinlined  (shares the 2147483647n shape declared on int)
+function uint31(value, E, code, label) { return int(value, 0n, UINT31_MAX, E, code, label); }
+
+// positiveInt31(value, E, code, label) -> Number in [1, 2^31-1]. The PKCS#12
+// PBKDF2 / MAC iteration-count shape (a count of at least one).
+// @enforced-by guard-shape-reinlined  (shares the 2147483647n shape declared on int)
+function positiveInt31(value, E, code, label) { return int(value, 1n, UINT31_MAX, E, code, label); }
+
+module.exports = { int: int, uint31: uint31, positiveInt31: positiveInt31 };

package/lib/guard-text.js

@@ -35,6 +35,9 @@ var LATIN1 = "latin1";
 //                            (required only when fatal is set),
 //                 badInput: code for a non-Buffer/non-string reject,
 //                 label:    human phrase for the message }
+// @enforced-by behavioral -- cap-before-copy has no rename-proof code shape; the
+//   over-cap RED vectors + the detached re-view through guard.bytes.view (itself
+//   enforced) are the guard.
 function decode(input, maxBytes, ErrorClass, spec) {
   var charset = spec.charset || LATIN1;
   if (Buffer.isBuffer(input)) {

package/lib/jose.js

@@ -53,7 +53,7 @@ var B64U_ALPHABET = /^[A-Za-z0-9_-]*$/;
  * @primitive  pki.jose.base64url.encode
  * @signature  pki.jose.base64url.encode(bytes) -> string
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7515, RFC 4648
  * @related    pki.jose.base64url.decode
  *
@@ -72,7 +72,7 @@ function b64uEncode(bytes) {
  * @primitive  pki.jose.base64url.decode
  * @signature  pki.jose.base64url.decode(text) -> Buffer
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7515, RFC 4648, RFC 8555
  * @related    pki.jose.base64url.encode
  *
@@ -214,7 +214,7 @@ function _jsonReader(str) {
  * @primitive  pki.jose.parseJson
  * @signature  pki.jose.parseJson(input) -> value
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7515, RFC 8259
  * @related    pki.jose.base64url.decode
  *
@@ -408,7 +408,7 @@ var PRIVATE_JWK_MEMBERS = ["d", "p", "q", "dp", "dq", "qi", "k", "priv"];
  * @primitive  pki.jose.assertPublicJwk
  * @signature  pki.jose.assertPublicJwk(jwk) -> jwk
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7517, RFC 7518
  * @related    pki.jose.sign, pki.jose.thumbprint
  *
@@ -435,7 +435,7 @@ function assertPublicJwk(jwk) {
  * @primitive  pki.jose.verify
  * @signature  pki.jose.verify(jws, opts) -> Promise<{ header, payload }>
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7515, RFC 7518, RFC 8555
  * @related    pki.jose.sign, pki.jose.parseJson
  *
@@ -488,7 +488,7 @@ async function verify(jws, opts) {
  * @primitive  pki.jose.sign
  * @signature  pki.jose.sign(opts) -> Promise<{ protected, payload, signature }>
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7515, RFC 7518, RFC 8555
  * @related    pki.jose.verify
  *
@@ -574,7 +574,7 @@ var THUMBPRINT_MEMBERS = {
  * @primitive  pki.jose.thumbprint
  * @signature  pki.jose.thumbprint(jwk) -> Promise<string>
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7638, RFC 8037, RFC 9964
  * @related    pki.jose.verify
  *

package/lib/path-validate.js

@@ -37,6 +37,7 @@ var asn1 = require("./asn1-der");
 var schema = require("./schema-engine");
 var x509 = require("./schema-x509");
 var crl = require("./schema-crl");
+var guard = require("./guard-all");
 var constants = require("./constants");
 
 var PathError = errors.PathError;
@@ -226,14 +227,11 @@ function resolveRsaPss(paramsBytes) {
       // verifier binds to the salt length the certificate states, so a value
       // that would round is not verifiable material (no real salt exceeds the
       // modulus size, let alone this).
-      if (sl < 0n || sl > 2147483647n) throw E("path/unsupported-algorithm", "RSASSA-PSS saltLength must be a non-negative integer within the salt-length range");
-      saltLength = Number(sl);
+      saltLength = guard.range.uint31(sl, E, "path/unsupported-algorithm", "RSASSA-PSS saltLength");
     } else if (f.tagNumber === 3) {
       // Compared for equality with 1 below -- bound before conversion so an
       // oversized value cannot round on its way to the comparison.
-      var tf = asn1.read.integer(f.children[0]);
-      if (tf < 0n || tf > 2147483647n) throw E("path/unsupported-algorithm", "unsupported RSASSA-PSS trailerField " + tf.toString());
-      trailer = Number(tf);
+      trailer = guard.range.uint31(asn1.read.integer(f.children[0]), E, "path/unsupported-algorithm", "RSASSA-PSS trailerField");
     }
   });
   if (hash === null) throw E("path/unsupported-algorithm", "RSASSA-PSS hashAlgorithm must be stated explicitly (the SHA-1 default is rejected)");
@@ -347,10 +345,7 @@ function normalizeAttrValue(v) {
   // Reject embedded NUL / control bytes so a truncation attack (CVE-2009-2408)
   // cannot make two different names compare equal.
   if (typeof v !== "string") return v;
-  for (var i = 0; i < v.length; i++) {
-    var c = v.charCodeAt(i);
-    if (c === 0 || (c < 0x20 && c !== 0x09)) throw E("path/name-chaining", "distinguished name contains an embedded control byte (CVE-2009-2408)");
-  }
+  guard.name.assertNoControlBytes(v, E, "path/name-chaining", "distinguished name");
   return v.trim().replace(/\s+/g, " ").toLowerCase();
 }
 

package/lib/schema-all.js

@@ -249,7 +249,7 @@ var FORMATS = [
  * @primitive  pki.schema.all
  * @signature  pki.schema.all() -> string[]
  * @since      0.1.7
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5280
  * @related    pki.schema.parse
  *
@@ -264,7 +264,7 @@ function all() { return FORMATS.map(function (f) { return f.name; }); }
  * @primitive  pki.schema.parse
  * @signature  pki.schema.parse(input) -> parsed
  * @since      0.1.7
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5280
  * @related    pki.schema.x509, pki.schema.all
  *

package/lib/schema-attrcert.js

@@ -299,7 +299,7 @@ var ATTRIBUTE_CERTIFICATE = pkix.signedEnvelope(NS, ACINFO, {
  * @primitive  pki.schema.attrcert.parse
  * @signature  pki.schema.attrcert.parse(input) -> attributeCertificate
  * @since      0.1.14
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5755, X.509
  * @related    pki.schema.parse, pki.schema.x509.parse
  *
@@ -348,7 +348,7 @@ function parseV1(input) {
  * @primitive  pki.schema.attrcert.pemDecode
  * @signature  pki.schema.attrcert.pemDecode(text, label?) -> Buffer
  * @since      0.1.14
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468, RFC 5755
  * @related    pki.schema.attrcert.parse
  *
@@ -367,7 +367,7 @@ function pemDecode(text, label) { return pkix.pemDecode(text, label === null ? n
  * @primitive  pki.schema.attrcert.pemEncode
  * @signature  pki.schema.attrcert.pemEncode(der, label?) -> string
  * @since      0.1.23
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468, RFC 5755
  * @related    pki.schema.attrcert.pemDecode
  *

package/lib/schema-cmp.js

@@ -42,6 +42,7 @@ var pkix = require("./schema-pkix.js");
 var cms = require("./schema-cms.js");
 var crmf = require("./schema-crmf.js");
 var frameworkError = require("./framework-error.js");
+var guard = require("./guard-all.js");
 
 var CmpError = frameworkError.CmpError;
 var PemError = frameworkError.PemError;
@@ -99,9 +100,7 @@ var PKI_FAILURE_INFO = schema.decode(function (n, ctx) {
 // PollRep checkAfter is a delay in seconds -- negative poisons scheduling, and
 // the value surfaces as an exact number or not at all.
 var CHECK_AFTER = schema.decode(function (n, ctx) {
-  var v = asn1.read.integer(n);
-  if (v < 0n || v > 2147483647n) throw ctx.E("cmp/bad-poll-rep", "checkAfter must be a non-negative delay in seconds (RFC 9810 sec. 5.3.22)");
-  return Number(v);
+  return guard.range.uint31(asn1.read.integer(n), ctx.E, "cmp/bad-poll-rep", "checkAfter delay in seconds (RFC 9810 sec. 5.3.22)");
 });
 
 // A raw certificate / CRL / publication-info element -- surfaced byte-exact for
@@ -841,7 +840,7 @@ var PKI_MESSAGE = schema.seq([
  * @primitive  pki.schema.cmp.parse
  * @signature  pki.schema.cmp.parse(input) -> pkiMessage
  * @since      0.1.19
- * @status     experimental
+ * @status     stable
  * @spec       RFC 9810, RFC 9483, RFC 9481
  * @related    pki.schema.parse, pki.schema.crmf.parse, pki.schema.cms.parse
  *
@@ -895,7 +894,7 @@ var parse = pkix.makeParser({
  * @primitive  pki.schema.cmp.pemDecode
  * @signature  pki.schema.cmp.pemDecode(text, label?) -> Buffer
  * @since      0.1.19
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468, RFC 9810
  * @related    pki.schema.cmp.parse
  *
@@ -912,7 +911,7 @@ function pemDecode(text, label) { return pkix.pemDecode(text, label || "CMP", Pe
  * @primitive  pki.schema.cmp.pemEncode
  * @signature  pki.schema.cmp.pemEncode(der, label?) -> string
  * @since      0.1.19
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468
  * @related    pki.schema.cmp.pemDecode
  *

package/lib/schema-crmf.js

@@ -455,7 +455,7 @@ var CERT_REQ_MESSAGES = schema.seqOf(CERT_REQ_MSG, {
  * @primitive  pki.schema.crmf.parse
  * @signature  pki.schema.crmf.parse(input) -> certReqMessages
  * @since      0.1.17
- * @status     experimental
+ * @status     stable
  * @spec       RFC 4211
  * @related    pki.schema.parse, pki.schema.csr.parse
  *
@@ -496,7 +496,7 @@ var parse = pkix.makeParser({
  * @primitive  pki.schema.crmf.pemDecode
  * @signature  pki.schema.crmf.pemDecode(text, label?) -> Buffer
  * @since      0.1.17
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468, RFC 4211
  * @related    pki.schema.crmf.parse
  *
@@ -513,7 +513,7 @@ function pemDecode(text, label) { return pkix.pemDecode(text, label || null, Pem
  * @primitive  pki.schema.crmf.pemEncode
  * @signature  pki.schema.crmf.pemEncode(der, label) -> string
  * @since      0.1.23
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468, RFC 4211
  * @related    pki.schema.crmf.pemDecode
  *

package/lib/schema-csrattrs.js

@@ -320,7 +320,7 @@ var CSR_ATTRS = schema.seqOf(ATTR_OR_OID, {
  * @primitive  pki.schema.csrattrs.parse
  * @signature  pki.schema.csrattrs.parse(der) -> { items }
  * @since      0.1.24
- * @status     experimental
+ * @status     stable
  * @spec       RFC 8951, RFC 9908, RFC 7030
  * @related    pki.schema.parse, pki.est.buildEnrollAttributes
  *

package/lib/schema-pkcs12.js

@@ -46,6 +46,7 @@ var pkix = require("./schema-pkix.js");
 var cms = require("./schema-cms.js");
 var pkcs8 = require("./schema-pkcs8.js");
 var frameworkError = require("./framework-error.js");
+var guard = require("./guard-all.js");
 
 var Pkcs12Error = frameworkError.Pkcs12Error;
 var PemError = frameworkError.PemError;
@@ -102,16 +103,10 @@ var PBKDF2_PARAMS = schema.seq([
     if (!m.fields.keyLength.present) {
       throw ctx.E("pkcs12/bad-mac-data", "PBMAC1 PBKDF2-params must carry keyLength (RFC 9579 sec. 5)");
     }
-    // Both counters surface as exact JS numbers -- a value past the bound
-    // would round silently on conversion and hand a verifier wrong inputs.
-    var iterations = m.fields.iterationCount.value;
-    if (iterations < 1n || iterations > 2147483647n) {
-      throw ctx.E("pkcs12/bad-mac-data", "PBKDF2 iterationCount must be a positive integer within the iteration-count range");
-    }
-    var keyLength = m.fields.keyLength.value;
-    if (keyLength < 1n || keyLength > 2147483647n) {
-      throw ctx.E("pkcs12/bad-mac-data", "PBKDF2 keyLength must be a positive integer within the key-length range");
-    }
+    // guard.range.positiveInt31 bounds + narrows each counter atomically -- a
+    // value past the bound would round silently and hand a verifier wrong inputs.
+    var iterationCount = guard.range.positiveInt31(m.fields.iterationCount.value, ctx.E, "pkcs12/bad-mac-data", "PBKDF2 iterationCount");
+    var keyLength = guard.range.positiveInt31(m.fields.keyLength.value, ctx.E, "pkcs12/bad-mac-data", "PBKDF2 keyLength");
     var prf = m.fields.prf.present ? m.fields.prf.value.result : null;
     // X.690 sec. 11.5 -- a DEFAULT-valued component must be omitted from a DER
     // encoding, and the prf DEFAULT is algid-hmacWithSHA1: hmacWithSHA1 with
@@ -124,8 +119,8 @@ var PBKDF2_PARAMS = schema.seq([
     }
     return {
       salt: m.fields.salt.value,
-      iterationCount: Number(iterations),
-      keyLength: Number(keyLength),
+      iterationCount: iterationCount,
+      keyLength: keyLength,
       prfOid: prf ? prf.oid : OID_HMAC_SHA1,
       prfName: prf ? prf.name : "hmacWithSHA1",
     };
@@ -172,8 +167,7 @@ var MAC_DATA = schema.seq([
     if (it.present) {
       var v = it.value;
       if (v === 1n) throw ctx.E("pkcs12/bad-mac-iterations", "iterations equal to its DEFAULT 1 must be omitted (X.690 sec. 11.5)");
-      if (v < 1n || v > 2147483647n) throw ctx.E("pkcs12/bad-mac-iterations", "iterations must be a positive integer within the iteration-count range");
-      iterations = Number(v);
+      iterations = guard.range.positiveInt31(v, ctx.E, "pkcs12/bad-mac-iterations", "MacData iterations");
     }
     var di = m.fields.mac.value.result;
     var pbmac1 = null;
@@ -529,7 +523,7 @@ function _buildBag(rec, state, ctx) {
  * @primitive  pki.schema.pkcs12.parse
  * @signature  pki.schema.pkcs12.parse(input) -> pfx
  * @since      0.1.18
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7292, RFC 9579
  * @defends    ASN.1-parser-DoS (CWE-400)
  * @related    pki.schema.parse, pki.schema.pkcs8.parse, pki.schema.cms.parse
@@ -577,7 +571,7 @@ var parse = pkix.makeParser({
  * @primitive  pki.schema.pkcs12.pemDecode
  * @signature  pki.schema.pkcs12.pemDecode(text, label?) -> Buffer
  * @since      0.1.18
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468, RFC 7292
  * @related    pki.schema.pkcs12.parse
  *
@@ -594,7 +588,7 @@ function pemDecode(text, label) { return pkix.pemDecode(text, label || "PKCS12",
  * @primitive  pki.schema.pkcs12.pemEncode
  * @signature  pki.schema.pkcs12.pemEncode(der, label?) -> string
  * @since      0.1.18
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468
  * @related    pki.schema.pkcs12.pemDecode
  *

package/lib/schema-pkix.js

@@ -500,12 +500,9 @@ function generalName(ns, opts) {
       if (constructed) throw ctx.E(code, "GeneralName [" + t + "] must be primitive (X.690 sec. 10.2)");
       if (GN_IA5[t]) {
         if (n.content.length === 0) throw ctx.E(code, "GeneralName [" + t + "] must be a non-empty IA5String");
-        for (var i = 0; i < n.content.length; i++) {
-          // 7-bit IA5, and no C0/DEL control byte -- an embedded NUL/control in a
-          // dNSName/rfc822Name/URI enables a name-truncation/confusion bypass
-          // (CVE-2009-2408 class) downstream, so reject it at decode.
-          if (n.content[i] < 0x20 || n.content[i] > 0x7e) throw ctx.E(code, "GeneralName [" + t + "] must be a printable IA5String (no control bytes)");
-        }
+        // 7-bit IA5, no C0/DEL control byte -- an embedded NUL/control in a
+        // dNSName/rfc822Name/URI enables a name-truncation bypass (CVE-2009-2408).
+        guard.name.assertPrintableIa5(n.content, ctx.E, code, "GeneralName [" + t + "]");
         if (decodeValue) value = n.content.toString("latin1");
       } else if (t === 7) {
         if (subtreeBase) {
@@ -619,11 +616,10 @@ function certExtensionDecoders(ns) {
     if (kids[i] && kids[i].tagClass === "universal" && kids[i].tagNumber === _T.INTEGER) {
       if (!cA) throw ns.E(C, "BasicConstraints pathLenConstraint is only permitted when cA is TRUE (RFC 5280 sec. 4.2.1.9)");
       var pl = readInt(kids[i], C, "pathLenConstraint");
-      // Bounded before Number() narrowing -- a value past the safe-integer range
-      // would round silently and be compared as a path-length ceiling, so it is
-      // exact-or-rejected (the same rule the RSASSA-PSS/PKCS#12 counters follow).
-      if (pl < 0n || pl > 2147483647n) throw ns.E(C, "BasicConstraints pathLenConstraint must be a non-negative integer within range");
-      pathLen = Number(pl); i++;
+      // guard.range.uint31 bounds the decoded BigInt and narrows atomically -- a
+      // value past the safe-integer range would otherwise round silently and be
+      // compared as a path-length ceiling.
+      pathLen = guard.range.uint31(pl, ns.E, C, "BasicConstraints pathLenConstraint (RFC 5280 sec. 4.2.1.9)"); i++;
     }
     if (i !== kids.length) throw ns.E(C, "BasicConstraints has unexpected trailing fields");
     return { cA: cA, pathLenConstraint: pathLen };
@@ -746,11 +742,11 @@ function certExtensionDecoders(ns) {
       pcLastTag = k.tagNumber;
       var v;
       try { v = asn1.read.integerImplicit(k, k.tagNumber); } catch (e) { throw ns.E(C, "PolicyConstraints field must be an INTEGER", e); }
-      // Bounded before Number() narrowing (a skip count past the safe-integer
-      // range would round silently) -- exact-or-rejected.
-      if (v < 0n || v > 2147483647n) throw ns.E(C, "PolicyConstraints skip count must be a non-negative integer within range");
-      if (k.tagNumber === 0) rep = Number(v);
-      else if (k.tagNumber === 1) ipm = Number(v);
+      // guard.range.uint31 bounds + narrows atomically (a skip count past the
+      // safe-integer range would round silently).
+      var skip = guard.range.uint31(v, ns.E, C, "PolicyConstraints skip count (RFC 5280 sec. 4.2.1.11)");
+      if (k.tagNumber === 0) rep = skip;
+      else if (k.tagNumber === 1) ipm = skip;
       else throw ns.E(C, "PolicyConstraints has an unexpected field [" + k.tagNumber + "]");
     });
     return { requireExplicitPolicy: rep, inhibitPolicyMapping: ipm };
@@ -762,10 +758,9 @@ function certExtensionDecoders(ns) {
     var n = decodeTop(buf, C, "InhibitAnyPolicy");
     if (n.tagClass !== "universal" || n.tagNumber !== _T.INTEGER) throw ns.E(C, "InhibitAnyPolicy must be an INTEGER (RFC 5280 sec. 4.2.1.14)");
     var v = readInt(n, C, "InhibitAnyPolicy");
-    // Bounded before Number() narrowing (a skip count past the safe-integer
-    // range would round silently) -- exact-or-rejected.
-    if (v < 0n || v > 2147483647n) throw ns.E(C, "InhibitAnyPolicy skip count must be a non-negative integer within range");
-    return Number(v);
+    // guard.range.uint31 bounds + narrows atomically (a skip count past the
+    // safe-integer range would round silently).
+    return guard.range.uint31(v, ns.E, C, "InhibitAnyPolicy skip count (RFC 5280 sec. 4.2.1.14)");
   }
 
   // subjectAltName / issuerAltName ::= GeneralNames -- decoded values surfaced.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.1.30",
+  "version": "0.1.31",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:9b3c1a14-9eb9-492b-a652-b6fa68d6b4b4",
+  "serialNumber": "urn:uuid:2ed2aa23-5194-4472-96f3-c4013f134834",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-11T07:38:46.451Z",
+    "timestamp": "2026-07-11T16:09:44.713Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.1.30",
+      "bom-ref": "@blamejs/pki@0.1.31",
       "type": "application",
       "name": "pki",
-      "version": "0.1.30",
+      "version": "0.1.31",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.1.30",
+      "purl": "pkg:npm/%40blamejs/pki@0.1.31",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.1.30",
+      "ref": "@blamejs/pki@0.1.31",
       "dependsOn": []
     }
   ]