@blamejs/pki 0.1.30 → 0.1.32

package/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.1.32 — 2026-07-11
+
+OCSP-backed revocation checking joins certification-path validation.
+
+### Added
+
+- pki.path.ocspChecker(responses) -> RevocationChecker builds an OCSP-backed revocation checker for pki.path.validate's revocationChecker option from a set of pre-fetched OCSP responses (DER Buffer, PEM string, or already-parsed). It matches the full CertID triple against the certificate under whichever hash algorithm the CertID declares, authorizes the responder (issuing CA or a CA-issued id-kp-OCSPSigning delegate), verifies the response signature over tbsResponseData, and enforces thisUpdate/nextUpdate currency, reporting good, revoked (with revocationReason), or unknown. A wrong-issuer CertID, an unauthorized responder, a stale, not-yet-valid, or nextUpdate-less response, a non-successful responseStatus, or any verification failure yields unknown, which the validator fails closed unless softFail is set. RFC 6960.
+
+## v0.1.31 — 2026-07-11
+
+The DER format cohort and the JOSE surface graduate to stable.
+
+### Changed
+
+- pki.schema.pkcs12 / attrcert / crmf / cmp / csrattrs (parse, pemDecode, pemEncode), pki.schema.all and pki.schema.parse, and the pki.jose signing / verification / thumbprint / base64url / JSON surface graduate from experimental to stable.
+- The LTS-CALENDAR graduation criterion now states that a settled, well-tested format no mainstream tool implements graduates on the toolkit's own conformance-vector round-trip plus coverage-guided fuzzing, rather than on a harness oracle that does not exist.
+
 ## v0.1.30 — 2026-07-11
 
 Fail-closed hardening of the byte-input and text-decode boundaries.

package/README.md

@@ -220,7 +220,7 @@ is callable today; nothing below is a stub.
 | `pki.acme` | RFC 8555 / 8737 / 8738 / 9773 ACME message layer over `pki.jose` — resource-object validators (closed status enums, conditional-required fields, unknown fields ignored), the three §7.1.6 state machines, request builders (newAccount + EAB, newOrder + `replaces`, finalize with CSR identifier-set match and account-key-reuse rejection, challenge responses, deactivation, revokeCert in both key modes, the keyChange nested JWS, POST-as-GET), the http-01 / dns-01 / tls-alpn-01 challenge computations, the dns/ip identifier validators, and the ARI certID (serial sign-padding preserved). A message layer, not an HTTP client — transport-injectable, fail-closed — `validate`, `identify`, `assertTransition`, the builders, `keyAuthorization`, `http01`, `dns01`, `tlsAlpn01Extension`, `verifyTlsAlpn01`, `ariCertId` |
 | `pki.schema.smime` | Decode S/MIME ESS signed-attribute values (RFC 5035 / RFC 8551) — `parseSigningCertificate` / `parseSigningCertificateV2` bind a signature to its signing certificate (cert hash, hash algorithm, issuer `GeneralNames` + serial), `parseSmimeCapabilities` decodes the ordered capability list, and `decodeAttribute` OID-dispatches a CMS attribute (enforcing the single-value rule, recognize-and-defer for unknown types). A companion decoder for CMS signed attributes, not an auto-routed format, fail-closed — `parseSigningCertificate`, `parseSigningCertificateV2`, `parseSmimeCapabilities`, `decodeAttribute` |
 | `pki.schema.engine` | The declarative ASN.1 structure-schema engine every format parser composes — `walk` / `encode` / `embeddedDer` plus the schema combinators |
-| `pki.path` | RFC 5280 §6 certification-path validation — `validate` runs the §6.1 state machine (signature chaining, validity windows, name chaining, basic constraints and path length, key usage, name constraints, the certificate-policy tree) over an ordered path and a trust anchor, returning a structured verdict with per-check reason codes; `crlChecker` supplies CRL-based revocation. Pure and re-entrant, fail-closed — `validate`, `crlChecker` |
+| `pki.path` | RFC 5280 §6 certification-path validation — `validate` runs the §6.1 state machine (signature chaining, validity windows, name chaining, basic constraints and path length, key usage, name constraints, the certificate-policy tree) over an ordered path and a trust anchor, returning a structured verdict with per-check reason codes; `crlChecker` supplies CRL-based revocation and `ocspChecker` supplies OCSP-based revocation (RFC 6960 — CertID binding, responder authorization, signature, currency) over the same pluggable hook. Pure and re-entrant, fail-closed — `validate`, `crlChecker`, `ocspChecker` |
 | `pki.ct` | Parse RFC 6962 Certificate Transparency SCT lists — `parseSctList` decodes the `SignedCertificateTimestampList` a certificate or OCSP response carries in the SCT extension (a TLS-presentation-language payload inside the §3.3 double DER wrap) into per-SCT log id, exact `timestamp` (BigInt), named signature algorithm, and raw signature; `reconstructSignedData` rebuilds the exact `digitally-signed` preimage for external verification. Structure decoded, crypto surfaced raw, bounded decode, fail-closed — `parseSctList`, `reconstructSignedData` |
 | `pki.merkle` | RFC 6962 / RFC 9162 Merkle-tree proof verification — `leafHash` / `nodeHash` / `emptyRootHash` build the domain-separated (0x00 leaf / 0x01 node) SHA-256 tree hashes; `verifyInclusion` folds an audit proof back to a root and `verifyConsistency` reconstructs both the old and new root (the append-only guarantee), each constant-time-compared to a trusted checkpoint root. Fail-closed on bad geometry, sync hashing, transport-free — `leafHash`, `nodeHash`, `emptyRootHash`, `verifyInclusion`, `verifyConsistency` |
 | `pki.C` / `pki.constants` | Version-stable constants — functional scale helpers (`C.TIME.*`, `C.BYTES.*`), codec `LIMITS`, `version` |

package/lib/guard-all.js

@@ -18,6 +18,9 @@
 //                                         (recursion / allocation DoS defence)
 //   guard.crypto.constantTimeEqual    -- length-checked constant-time compare
 //                                         (timing side-channel defence)
+//   guard.range.int / .uint31 / .positiveInt31
+//                                     -- bound a decoded integer before narrowing
+//                                        to Number (silent-narrowing defence)
 //
 // Each shape is enforced by a codebase-patterns detector: the characteristic
 // token of a guard (the Buffer.from(x.buffer, byteOffset) re-view, the
@@ -29,10 +32,14 @@ var bytes  = require("./guard-bytes");
 var text   = require("./guard-text");
 var limits = require("./guard-limits");
 var crypto = require("./guard-crypto");
+var range  = require("./guard-range");
+var name   = require("./guard-name");
 
 module.exports = {
   bytes:  bytes,
   text:   text,
   limits: limits,
   crypto: crypto,
+  range:  range,
+  name:   name,
 };

package/lib/guard-bytes.js

@@ -27,6 +27,8 @@
 // Accepts a Buffer / Uint8Array -- the DER / CBOR / CT / Merkle input contract.
 // ErrorClass MUST be a withCause PkiError subclass (the raw detach failure is
 // threaded as the cause).
+// @enforced-by guard-shape-reinlined
+// @guard-shape Buffer\.from\(\s*([A-Za-z_$][\w$]*)\.buffer\s*,\s*\1\.byteOffset
 function view(input, ErrorClass, code, label) {
   if (Buffer.isBuffer(input) || input instanceof Uint8Array) {
     try {
@@ -42,6 +44,7 @@ function view(input, ErrorClass, code, label) {
 // Accepts the full W3C BufferSource (Buffer / TypedArray view / raw ArrayBuffer)
 // -- the WebCrypto input contract. A raw ArrayBuffer is copied via Buffer.from,
 // which also throws on a detached backing store.
+// @enforced-by guard-shape-reinlined  (the re-view shape is declared on view above)
 function source(input, ErrorClass, code, label) {
   var isAb = input instanceof ArrayBuffer;
   if (isAb || ArrayBuffer.isView(input)) {

package/lib/guard-crypto.js

@@ -25,6 +25,8 @@ var nodeCrypto = require("node:crypto");
 
 // constantTimeEqual(a, b) -> boolean. Length-checked, then constant-time over
 // equal lengths. a and b are Buffers.
+// @enforced-by guard-shape-reinlined
+// @guard-shape \.timingSafeEqual\s*\(
 function constantTimeEqual(a, b) {
   return a.length === b.length && nodeCrypto.timingSafeEqual(a, b);
 }

package/lib/guard-limits.js

@@ -27,6 +27,8 @@ var constants = require("./constants");
 // cap(value, key, dflt) -> a validated non-negative integer, or dflt when value
 // is undefined. A non-integer / non-finite / negative value is a config-time
 // TypeError (Number.isInteger already rejects non-numbers, NaN, and Infinity).
+// @enforced-by behavioral -- a config-time cap validator has no rename-proof code
+//   shape; the decode-rejects-a-bad-cap RED vectors (asn1/cbor) are the guard.
 function cap(value, key, dflt) {
   if (value === undefined) return dflt;
   if (!Number.isInteger(value) || value < 0) {
@@ -38,6 +40,11 @@ function cap(value, key, dflt) {
 // depthCap(value, key, dflt) -> a validated recursion-depth cap: cap() plus the
 // stack-safe ceiling, so a raised maxDepth cannot drive recursive descent into a
 // raw RangeError past the native frame limit.
+// @enforced-by guard-shape-reinlined
+// @guard-scope file
+// @guard-shape \bopts\.maxDepth\b
+// @guard-shape \bdepth\s*\+\s*1\b
+// @guard-via \.depthCap\s*\(
 function depthCap(value, key, dflt) {
   var n = cap(value, key, dflt);
   if (n > constants.LIMITS.MAX_DECODE_DEPTH_CEILING) {

package/lib/guard-name.js

@@ -0,0 +1,111 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. The documented surface is the
+// consumers whose name-string integrity composes this guard (pki.path.validate
+// DN chaining, pki.schema.x509 GeneralName / SAN decode).
+//
+// guard-name -- fail-closed name integrity: reject an embedded control byte in a
+// distinguished-name / SAN string, and compare two distinguished names by their
+// RFC 5280 sec. 7.1 canonical identity rather than their raw bytes.
+//
+// Defends the name-truncation / display-confusion class (CVE-2009-2408): a NUL
+// or control byte embedded in a decoded name lets an attacker make two different
+// names compare equal (or a UI truncate at the NUL), so a cert issued for
+// "good.example.com\0.evil.com" is treated as "good.example.com". CWE-158
+// (improper neutralization of null byte) / CWE-20. The reject is at decode, so a
+// truncation name never reaches a comparison or a display.
+//
+// Defends the DN identity-vs-bytes class (CWE-706): a distinguished name has many
+// RFC 5280 sec. 7.1-equal DER encodings (case, whitespace, PrintableString vs
+// UTF8String). Binding identity to raw bytes -- a byte compare, or hashing
+// name.bytes as a lookup key -- silently treats two equal names as different, so
+// certificate chaining breaks, a revocation issuer / OCSP responder fails to
+// match, or (the mirror risk) a name constraint is escaped. Every DN identity
+// decision routes through the one canonical comparison here.
+
+// assertNoControlBytes(str, E, code, label) -> str | throws E(code, ...)
+// DirectoryString policy (a DN attribute value): reject NUL and C0 control bytes
+// in a DECODED name string. TAB (0x09) is exempt; printable non-ASCII (a
+// UTF8String CN carries accented / CJK characters) is allowed. `str` is assumed a
+// string (the caller guards typeof). E is the (code, message) typed-error factory.
+// @enforced-by behavioral -- the control-byte reject has no rename-proof code
+//   shape distinct from the ASN.1 charset readers; the CVE-2009-2408 RED vectors
+//   (a DN string with an embedded NUL / control byte rejects) are the guard.
+function assertNoControlBytes(str, E, code, label) {
+  for (var i = 0; i < str.length; i++) {
+    var c = str.charCodeAt(i);
+    if (c === 0 || (c < 0x20 && c !== 0x09)) {
+      throw E(code, label + " contains an embedded control byte (CVE-2009-2408)");
+    }
+  }
+  return str;
+}
+
+// assertPrintableIa5(buf, E, code, label) -> buf | throws E(code, ...)
+// IA5String policy (a dNSName / rfc822Name / URI GeneralName): every byte must be
+// printable 7-bit ASCII [0x20, 0x7e] -- an embedded NUL / control byte enables the
+// same name-truncation bypass downstream. `buf` is the raw GeneralName content.
+// @enforced-by behavioral -- the printable-IA5 byte-range reject has no rename-proof
+//   code shape distinct from the ASN.1 IA5 reader; the CVE-2009-2408 RED vectors
+//   (a SAN with a control byte rejects) are the guard.
+function assertPrintableIa5(buf, E, code, label) {
+  for (var i = 0; i < buf.length; i++) {
+    if (buf[i] < 0x20 || buf[i] > 0x7e) {
+      throw E(code, label + " must be a printable IA5String (no control bytes)");
+    }
+  }
+  return buf;
+}
+
+// Canonical form of a single DN attribute value (RFC 5280 sec. 7.1): reject an
+// embedded control byte (CVE-2009-2408) then case-fold and collapse internal
+// whitespace. Every standard X.520 attribute uses caseIgnoreMatch, and this form
+// matches OpenSSL's X509_NAME_cmp, so a chain OpenSSL accepts is not rejected. This
+// canonicalization is the shape the guard-shape-reinlined detector keys on
+// (declared on dnEqual): a boundary hand-rolling it is re-implementing DN identity.
+function _canonAttrValue(v, E, code, label) {
+  if (typeof v !== "string") return v;
+  assertNoControlBytes(v, E, code, label);
+  return v.trim().replace(/\s+/g, " ").toLowerCase();
+}
+// rdnEqual(a, b, E, code, label) -> boolean. Canonical comparison of a single
+// RelativeDistinguishedName (an unordered SET of type/value pairs, compared as a
+// multiset). The RDN-level primitive a name-constraint directoryName prefix match
+// composes; dnEqual composes it over the RDN sequence. Comparing an RDN by raw DER
+// would treat two RFC 5280-equal names as different (or let a truncation name
+// compare equal).
+// @enforced-by guard-shape-reinlined  (shares the canonicalization shape declared on dnEqual)
+function rdnEqual(a, b, E, code, label) {
+  if (a.length !== b.length) return false;
+  var used = [];
+  for (var i = 0; i < a.length; i++) {
+    var found = false;
+    for (var j = 0; j < b.length; j++) {
+      if (used[j]) continue;
+      if (a[i].type === b[j].type && _canonAttrValue(a[i].value, E, code, label) === _canonAttrValue(b[j].value, E, code, label)) {
+        used[j] = true; found = true; break;
+      }
+    }
+    if (!found) return false;
+  }
+  return true;
+}
+// dnEqual(rdnsA, rdnsB, E, code, label) -> boolean. RFC 5280 sec. 7.1 canonical
+// distinguished-name comparison over the RDN sequence -- the ONE place a DN identity
+// is decided, so no caller binds identity to raw DER (a byte compare, or hashing
+// name.bytes, would treat two RFC 5280-equal names as different, breaking a chain /
+// a revocation match, or -- the mirror risk -- escaping a name constraint). The
+// per-RDN canonicalization + control-byte reject is in rdnEqual / _canonAttrValue.
+// @enforced-by guard-shape-reinlined
+// @guard-shape replace\(/\\s\+/g,
+function dnEqual(rdnsA, rdnsB, E, code, label) {
+  if (rdnsA.length !== rdnsB.length) return false;
+  for (var i = 0; i < rdnsA.length; i++) {
+    if (!rdnEqual(rdnsA[i], rdnsB[i], E, code, label)) return false;
+  }
+  return true;
+}
+
+module.exports = { assertNoControlBytes: assertNoControlBytes, assertPrintableIa5: assertPrintableIa5, dnEqual: dnEqual, rdnEqual: rdnEqual };

package/lib/guard-range.js

@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. The documented surface is the
+// parsers whose decoded-integer bounds compose this guard (pki.schema.x509 /
+// crl / pkcs12 / cmp, pki.path.validate).
+//
+// guard-range -- fail-closed bound of an untrusted DECODED integer before it is
+// narrowed to a JS Number. Parse-time (Tier-2): the value is malformed content,
+// so it throws the caller's typed PkiError -- distinct from guard-limits, which
+// validates an operator-supplied option at config time (Tier-1, TypeError).
+//
+// Defends the silent-narrowing class (a decoded ASN.1 INTEGER past 2^53 rounds
+// when coerced to a Number, so a caller acting on the result -- a pathLen /
+// skipCerts / saltLength / iteration counter -- acts on the WRONG number;
+// CWE-190 integer overflow / CWE-681 incorrect conversion). The bound and the
+// narrow are ATOMIC here: a caller cannot obtain the Number without the range
+// having been enforced, so the value can never round silently and be acted on.
+
+// 2^31 - 1 -- the shared skip-cert / path-length / salt / iteration ceiling.
+// This literal lives ONLY here (a re-inline anywhere else is flagged: the
+// guard-shape walk anchors on the literal). 2^53 - 1 is the safe-narrow ceiling.
+var UINT31_MAX = 2147483647n;
+var SAFE_MAX   = 9007199254740991n;
+var SAFE_MIN   = -9007199254740991n;
+
+// int(value, min, max, E, code, label) -> a Number in [min, max].
+//   value : the BigInt result of an ASN.1 INTEGER / ENUMERATED read.
+//   min, max : inclusive BigInt bounds.
+//   E     : the (code, message, cause) typed-error factory in scope at the call
+//           site (ns.E / ctx.E / the module-local E) -- guard-range injects the
+//           caller's typed error through it, the tier-appropriate currency (a
+//           parse boundary carries a factory, not a bare ErrorClass).
+//   code  : the frozen domain/reason code this field rejects under.
+//   label : field phrase (+ optional RFC cite) for the message.
+// @enforced-by guard-shape-reinlined
+// @guard-shape 2147483647n
+function int(value, min, max, E, code, label) {
+  // Config-time authoring guard (Tier-1): narrowing to Number is lossless only
+  // when the WHOLE range sits inside the safe-integer band [-(2^53-1), 2^53-1].
+  // Both ends bind -- a min below the floor rounds a decoded value near it just
+  // as a max above the ceiling does. A wider range needs a BigInt-preserving
+  // guard, not this one (this is why the uint64 Merkle-coordinate domain must
+  // NOT route here).
+  if (max > SAFE_MAX) {
+    throw new TypeError("guard.range.int: max " + max + " exceeds the safe-integer ceiling; use a BigInt-preserving guard");
+  }
+  if (min < SAFE_MIN) {
+    throw new TypeError("guard.range.int: min " + min + " is below the safe-integer floor; use a BigInt-preserving guard");
+  }
+  // Parse-time reject (Tier-2): malformed / out-of-range decoded content.
+  if (typeof value !== "bigint" || value < min || value > max) {
+    throw E(code, label + " must be an integer within " + min + ".." + max);
+  }
+  return Number(value);
+}
+
+// uint31(value, E, code, label) -> Number in [0, 2^31-1]. The DER-INTEGER
+// non-negative skip/path/salt shape (RFC 5280 / 4211 / 9810).
+// @enforced-by guard-shape-reinlined  (shares the 2147483647n shape declared on int)
+function uint31(value, E, code, label) { return int(value, 0n, UINT31_MAX, E, code, label); }
+
+// positiveInt31(value, E, code, label) -> Number in [1, 2^31-1]. The PKCS#12
+// PBKDF2 / MAC iteration-count shape (a count of at least one).
+// @enforced-by guard-shape-reinlined  (shares the 2147483647n shape declared on int)
+function positiveInt31(value, E, code, label) { return int(value, 1n, UINT31_MAX, E, code, label); }
+
+module.exports = { int: int, uint31: uint31, positiveInt31: positiveInt31 };

package/lib/guard-text.js

@@ -35,6 +35,9 @@ var LATIN1 = "latin1";
 //                            (required only when fatal is set),
 //                 badInput: code for a non-Buffer/non-string reject,
 //                 label:    human phrase for the message }
+// @enforced-by behavioral -- cap-before-copy has no rename-proof code shape; the
+//   over-cap RED vectors + the detached re-view through guard.bytes.view (itself
+//   enforced) are the guard.
 function decode(input, maxBytes, ErrorClass, spec) {
   var charset = spec.charset || LATIN1;
   if (Buffer.isBuffer(input)) {

package/lib/jose.js

@@ -53,7 +53,7 @@ var B64U_ALPHABET = /^[A-Za-z0-9_-]*$/;
  * @primitive  pki.jose.base64url.encode
  * @signature  pki.jose.base64url.encode(bytes) -> string
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7515, RFC 4648
  * @related    pki.jose.base64url.decode
  *
@@ -72,7 +72,7 @@ function b64uEncode(bytes) {
  * @primitive  pki.jose.base64url.decode
  * @signature  pki.jose.base64url.decode(text) -> Buffer
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7515, RFC 4648, RFC 8555
  * @related    pki.jose.base64url.encode
  *
@@ -214,7 +214,7 @@ function _jsonReader(str) {
  * @primitive  pki.jose.parseJson
  * @signature  pki.jose.parseJson(input) -> value
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7515, RFC 8259
  * @related    pki.jose.base64url.decode
  *
@@ -408,7 +408,7 @@ var PRIVATE_JWK_MEMBERS = ["d", "p", "q", "dp", "dq", "qi", "k", "priv"];
  * @primitive  pki.jose.assertPublicJwk
  * @signature  pki.jose.assertPublicJwk(jwk) -> jwk
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7517, RFC 7518
  * @related    pki.jose.sign, pki.jose.thumbprint
  *
@@ -435,7 +435,7 @@ function assertPublicJwk(jwk) {
  * @primitive  pki.jose.verify
  * @signature  pki.jose.verify(jws, opts) -> Promise<{ header, payload }>
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7515, RFC 7518, RFC 8555
  * @related    pki.jose.sign, pki.jose.parseJson
  *
@@ -488,7 +488,7 @@ async function verify(jws, opts) {
  * @primitive  pki.jose.sign
  * @signature  pki.jose.sign(opts) -> Promise<{ protected, payload, signature }>
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7515, RFC 7518, RFC 8555
  * @related    pki.jose.verify
  *
@@ -574,7 +574,7 @@ var THUMBPRINT_MEMBERS = {
  * @primitive  pki.jose.thumbprint
  * @signature  pki.jose.thumbprint(jwk) -> Promise<string>
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7638, RFC 8037, RFC 9964
  * @related    pki.jose.verify
  *

package/lib/path-validate.js

@@ -37,6 +37,8 @@ var asn1 = require("./asn1-der");
 var schema = require("./schema-engine");
 var x509 = require("./schema-x509");
 var crl = require("./schema-crl");
+var ocsp = require("./schema-ocsp");
+var guard = require("./guard-all");
 var constants = require("./constants");
 
 var PathError = errors.PathError;
@@ -226,14 +228,11 @@ function resolveRsaPss(paramsBytes) {
       // verifier binds to the salt length the certificate states, so a value
       // that would round is not verifiable material (no real salt exceeds the
       // modulus size, let alone this).
-      if (sl < 0n || sl > 2147483647n) throw E("path/unsupported-algorithm", "RSASSA-PSS saltLength must be a non-negative integer within the salt-length range");
-      saltLength = Number(sl);
+      saltLength = guard.range.uint31(sl, E, "path/unsupported-algorithm", "RSASSA-PSS saltLength");
     } else if (f.tagNumber === 3) {
       // Compared for equality with 1 below -- bound before conversion so an
       // oversized value cannot round on its way to the comparison.
-      var tf = asn1.read.integer(f.children[0]);
-      if (tf < 0n || tf > 2147483647n) throw E("path/unsupported-algorithm", "unsupported RSASSA-PSS trailerField " + tf.toString());
-      trailer = Number(tf);
+      trailer = guard.range.uint31(asn1.read.integer(f.children[0]), E, "path/unsupported-algorithm", "RSASSA-PSS trailerField");
     }
   });
   if (hash === null) throw E("path/unsupported-algorithm", "RSASSA-PSS hashAlgorithm must be stated explicitly (the SHA-1 default is rejected)");
@@ -338,45 +337,17 @@ function builtinVerify(state, cert) {
 
 // ---- 7.1 name comparison ---------------------------------------------------
 
-function normalizeAttrValue(v) {
-  // RFC 5280 7.1 canonical DN comparison: case-fold + collapse internal
-  // whitespace. Every standard X.520 DN attribute (CN/O/OU/L/ST/C/serialNumber/
-  // dnQualifier) uses caseIgnoreMatch, and this canonical form matches OpenSSL's
-  // X509_NAME_cmp -- applying it uniformly is the interoperable behavior, not a
-  // per-attribute caseExact rule that would reject a chain OpenSSL accepts.
-  // Reject embedded NUL / control bytes so a truncation attack (CVE-2009-2408)
-  // cannot make two different names compare equal.
-  if (typeof v !== "string") return v;
-  for (var i = 0; i < v.length; i++) {
-    var c = v.charCodeAt(i);
-    if (c === 0 || (c < 0x20 && c !== 0x09)) throw E("path/name-chaining", "distinguished name contains an embedded control byte (CVE-2009-2408)");
-  }
-  return v.trim().replace(/\s+/g, " ").toLowerCase();
+// RFC 5280 sec. 7.1 canonical DN / RDN comparison, via the shared name guard: the
+// canonical form (case-fold + internal-whitespace collapse) and the embedded
+// control-byte reject (CVE-2009-2408 -> path/name-chaining) live once in
+// guard-name, so no path-validation caller can reintroduce a raw-byte DN
+// comparison that treats two RFC 5280-equal names as different.
+function dnEqual(rdnsA, rdnsB) {
+  return guard.name.dnEqual(rdnsA, rdnsB, E, "path/name-chaining", "distinguished name");
 }
 
 function rdnEqual(a, b) {
-  if (a.length !== b.length) return false;
-  // An RDN is an unordered SET of type/value pairs; compare as multisets.
-  var used = [];
-  for (var i = 0; i < a.length; i++) {
-    var found = false;
-    for (var j = 0; j < b.length; j++) {
-      if (used[j]) continue;
-      if (a[i].type === b[j].type && normalizeAttrValue(a[i].value) === normalizeAttrValue(b[j].value)) {
-        used[j] = true; found = true; break;
-      }
-    }
-    if (!found) return false;
-  }
-  return true;
-}
-
-function dnEqual(rdnsA, rdnsB) {
-  if (rdnsA.length !== rdnsB.length) return false;
-  for (var i = 0; i < rdnsA.length; i++) {
-    if (!rdnEqual(rdnsA[i], rdnsB[i])) return false;
-  }
-  return true;
+  return guard.name.rdnEqual(a, b, E, "path/name-chaining", "distinguished name");
 }
 
 // ---- extension access ------------------------------------------------------
@@ -1588,23 +1559,295 @@ function crlEntryReason(entry) {
   return null;
 }
 
-function verifyCrlSignature(theCrl, issuer) {
+// Verify a raw signature over tbsBytes with an SPKI public key -- the shared core
+// of every certificate / CRL / OCSP signature check. Resolve the algorithm
+// descriptor, enforce the key-OID <-> sig-OID binding (the algorithm-confusion
+// guard, RFC 9814 sec. 4), import the SPKI, bridge an ECDSA DER signature to
+// P1363, and verify. Any fault -- an unresolvable/forbidden algorithm, a
+// key/sig mismatch, an import or verify failure -- resolves false: a signature
+// check never throws out of this path, it fails closed. `rawSig` is the raw
+// signature octets (the caller has already unwrapped any BIT STRING and rejected
+// a non-octet-aligned one).
+function _verifyWithSpki(sigAlg, rawSig, spkiBytes, tbsBytes) {
   var d;
   try {
-    d = resolveDescriptor(theCrl.signatureAlgorithm);
-    assertKeyMatchesSigAlg(issuer.workingPublicKey, theCrl.signatureAlgorithm.oid, d);
+    d = resolveDescriptor(sigAlg);
+    assertKeyMatchesSigAlg(spkiBytes, sigAlg.oid, d);
   } catch (_e) { return Promise.resolve(false); }
-  if (theCrl.signatureValue.unusedBits !== 0) return Promise.resolve(false);   // non-octet-aligned signature
-  var key;
-  return subtle.importKey("spki", issuer.workingPublicKey, d.imp, false, ["verify"]).then(function (k) {
-    key = k;
-    var sig = theCrl.signatureValue.bytes;
+  return subtle.importKey("spki", spkiBytes, d.imp, false, ["verify"]).then(function (key) {
+    var sig = rawSig;
     if (d.ecdsa) sig = ecdsaDerToP1363(sig, key.algorithm.namedCurve);
-    return subtle.verify(d.verify, key, sig, theCrl.tbsBytes);
+    return subtle.verify(d.verify, key, sig, tbsBytes);
   }).then(function (ok) { return ok === true; }, function () { return false; });
 }
 
+function verifyCrlSignature(theCrl, issuer) {
+  if (theCrl.signatureValue.unusedBits !== 0) return Promise.resolve(false);   // non-octet-aligned signature
+  return _verifyWithSpki(theCrl.signatureAlgorithm, theCrl.signatureValue.bytes, issuer.workingPublicKey, theCrl.tbsBytes);
+}
+
+// ---- the OCSP revocation checker (RFC 6960) -------------------------------
+
+// CertID identity-hash algorithms (RFC 6960 sec. 4.1.1). Kept SEPARATE from the
+// signature SIG_ALGS/HASH_BY_OID set (which omits SHA-1 -- a SHA-1 *signature* is
+// refused, SHAttered): a CertID hash is an identity binding of an already-known
+// issuer, not a signature, so collision resistance is irrelevant to the lookup
+// and RFC 6960's default SHA-1 CertID MUST interoperate. A hash OID outside this
+// set cannot be reproduced -> no CertID match (fail closed), never an assumption.
+var OCSP_CERTID_HASHES = {};
+OCSP_CERTID_HASHES[oid.byName("sha1")] = "SHA-1";
+OCSP_CERTID_HASHES[oid.byName("sha256")] = "SHA-256";
+OCSP_CERTID_HASHES[oid.byName("sha384")] = "SHA-384";
+OCSP_CERTID_HASHES[oid.byName("sha512")] = "SHA-512";
+var OID_OCSP_SIGNING = oid.byName("ocspSigning");
+var OID_OCSP_NOCHECK = oid.byName("ocspNoCheck");
+
+// The subjectPublicKey BIT STRING VALUE (excluding the unused-bits octet) of an
+// SPKI DER -- the exact bytes an OCSP CertID issuerKeyHash / byKey KeyHash hash
+// over (RFC 6960 sec. 4.1.1). Throws on a malformed SPKI; the caller fails closed.
+function ocspKeyValue(spkiDer) {
+  return asn1.read.bitString(asn1.decode(spkiDer).children[1]).bytes;
+}
+
+// The delegate responder's importable SPKI. If its key omits algorithm parameters
+// and inherits them from the issuing CA (same key algorithm -- an EC public key
+// whose SPKI omits the namedCurve, RFC 5280 sec. 4.1.2.7), splice the issuer's
+// parameters in so importKey("spki", ...) has a complete key; otherwise a valid
+// response would verify as unknown. Mirrors updateWorkingKey's inheritance.
+function ocspResponderSpki(rc, issuer) {
+  var keyAlg = rc.subjectPublicKeyInfo.algorithm;
+  if (!isNullOrAbsentParams(keyAlg.parameters)) return rc.subjectPublicKeyInfo.bytes;
+  var issuerOid, issuerParams;
+  try {
+    var alg = asn1.decode(issuer.workingPublicKey).children[0];
+    issuerOid = asn1.read.oid(alg.children[0]);
+    issuerParams = alg.children[1] ? alg.children[1].bytes : null;
+  } catch (_e) { return rc.subjectPublicKeyInfo.bytes; }
+  if (issuerOid === keyAlg.oid && !isNullOrAbsentParams(issuerParams)) {
+    return spliceSpkiParameters(rc.subjectPublicKeyInfo, keyAlg.oid, issuerParams);
+  }
+  return rc.subjectPublicKeyInfo.bytes;
+}
+function ocspDigest(alg, buf) { return subtle.digest(alg, buf).then(function (h) { return Buffer.from(h); }); }
+
+// The checker implements NO OCSP response-extension semantics (the nonce is the
+// live client's, RFC 6960 sec. 4.4.1; CRL References / Archive Cutoff / Service
+// Locator are not consulted), so a CRITICAL responseExtension / singleExtension
+// may change a response's meaning in a way this code cannot honor -- treat it as
+// unusable (RFC 6960 sec. 4.4 / the RFC 5280 critical-extension contract, the OCSP
+// analogue of the crlChecker unhandled-critical skip). Returns true if `extList`
+// carries any critical extension.
+function ocspHasCriticalExtension(extList) {
+  if (!extList) return false;
+  for (var i = 0; i < extList.length; i++) if (extList[i].critical) return true;
+  return false;
+}
+
+// A SingleResponse's CertID names the target cert IFF its serial equals the
+// target's AND issuerNameHash + issuerKeyHash, recomputed under the CertID's OWN
+// hashAlgorithm, match the issuer (RFC 6960 sec. 4.1.1). A serial-only match would
+// let a "good" for issuer A serial N answer a query for issuer B serial N
+// (cross-CA substitution), so BOTH issuer hashes must match under the responder's
+// chosen algorithm -- never an assumed SHA-1.
+//
+// `issuerNameCandidates` is every byte encoding of the (name-chaining-validated)
+// issuer DN to try: the checked cert's issuer field (RFC 6960 sec. 4.1.1) plus,
+// when available, the issuer certificate's own subject encoding. These are RFC
+// 5280 sec. 7.1-equal (they chained) but MAY differ in DER -- case, whitespace, a
+// PrintableString-vs-UTF8String DirectoryString choice -- and a responder MAY have
+// hashed any of them; matching the CertID against any is still the SAME validated
+// issuer, because the issuerKeyHash + serial + authorized signature carry the
+// binding. The key (raw octets, no encoding variance) is matched once.
+async function ocspCertIdMatches(certID, cert, issuerNameCandidates, issuerKeyBits) {
+  if (certID.serialNumberHex !== cert.serialNumberHex) return false;
+  var hashName = OCSP_CERTID_HASHES[certID.hashAlgorithm.oid];
+  if (!hashName) return false;   // an unreproducible hash -> the match cannot be confirmed
+  var keyHash = await ocspDigest(hashName, issuerKeyBits);
+  if (!certID.issuerKeyHash.equals(keyHash)) return false;
+  for (var i = 0; i < issuerNameCandidates.length; i++) {
+    if (certID.issuerNameHash.equals(await ocspDigest(hashName, issuerNameCandidates[i]))) return true;
+  }
+  return false;
+}
+
+// Resolve the signer of a BasicOCSPResponse to an AUTHORIZED responder's SPKI DER,
+// or null when none is authorized (RFC 6960 sec. 4.2.2.2). Two models: the issuing
+// CA signing directly (responderID identifies the issuer), or a CA-delegated
+// responder -- a certificate in `certs` issued by the SAME CA, valid at `time`,
+// bearing id-kp-OCSPSigning in its extendedKeyUsage. anyExtendedKeyUsage and an
+// ABSENT EKU do NOT authorize an OCSP delegate (the opposite of the path-validation
+// EKU default), so an ordinary leaf the CA issued cannot forge revocation status.
+// Fails closed at every branch (a malformed delegate, a control-byte DN, an
+// unreadable EKU -> skip that candidate).
+async function ocspAuthorizeResponder(basicResponse, cert, issuer, issuerKeyBits, time) {
+  var rid = basicResponse.responderID;
+  var matchesIssuer = false;
+  try {
+    if (rid.byName) matchesIssuer = dnEqual(rid.byName.rdns, cert.issuer.rdns);
+    else if (rid.byKey) matchesIssuer = rid.byKey.equals(await ocspDigest("SHA-1", issuerKeyBits));
+  } catch (_e) { matchesIssuer = false; }
+  if (matchesIssuer) return issuer.workingPublicKey;
+
+  for (var i = 0; i < basicResponse.certs.length; i++) {
+    var rc;
+    try { rc = x509.parse(basicResponse.certs[i]); }
+    catch (_e) { continue; }
+    var identifies = false;
+    try {
+      if (rid.byName) identifies = dnEqual(rid.byName.rdns, rc.subject.rdns);
+      else if (rid.byKey) identifies = rid.byKey.equals(await ocspDigest("SHA-1", ocspKeyValue(rc.subjectPublicKeyInfo.bytes)));
+    } catch (_e) { identifies = false; }
+    if (!identifies) continue;
+    // The delegate MUST be issued directly by the CA that issued the target.
+    var issuedByCa;
+    try { issuedByCa = dnEqual(rc.issuer.rdns, cert.issuer.rdns); }
+    catch (_e) { continue; }
+    if (!issuedByCa) continue;
+    if (rc.signatureValue.unusedBits !== 0) continue;
+    if (!(await _verifyWithSpki(rc.signatureAlgorithm, rc.signatureValue.bytes, issuer.workingPublicKey, rc.tbsBytes))) continue;
+    // The delegate certificate MUST itself be valid at the validation instant.
+    if (time < rc.validity.notBefore || time > rc.validity.notAfter) continue;
+    // The delegate MUST assert id-kp-OCSPSigning; anyEKU / an absent EKU do not.
+    var eku;
+    try { eku = decodeExt(rc, OID.extKeyUsage); }
+    catch (_e) { continue; }
+    if (!eku || eku.value.indexOf(OID_OCSP_SIGNING) === -1) continue;
+    // A delegate asserting keyUsage MUST permit digitalSignature -- signing an OCSP
+    // response is a digitalSignature operation (RFC 5280 sec. 4.2.1.3); an absent
+    // keyUsage is unrestricted, an unreadable one is not authoritative.
+    var ku;
+    try { ku = decodeExt(rc, OID.keyUsage); }
+    catch (_e) { continue; }
+    if (ku && ku.value.digitalSignature !== true) continue;
+    // A delegate carrying a critical extension this code does not process is
+    // unusable, the same fail-closed rule the path validator applies to any cert
+    // (RFC 5280 sec. 6.1.4(o)) -- an unknown critical constraint must not be ignored
+    // while its key is trusted to authenticate revocation status. A RECOGNIZED
+    // critical extension whose value is malformed is likewise rejected via the
+    // shared structure validation, exactly as the path validator rejects it.
+    if (unrecognizedCriticalExtension(rc, false)) continue;
+    if (validateCriticalExtensionStructure(rc)) continue;
+    // The delegate MUST carry id-pkix-ocsp-nocheck (RFC 6960 sec. 4.2.2.2.1): a
+    // transport-free checker cannot otherwise confirm the responder certificate has
+    // not itself been revoked, and a revoked OCSP-signing certificate would keep
+    // signing "good" until its notAfter. A deployment that instead supplies the
+    // responder's own status opts in through a future checker; absent nocheck, fail
+    // closed (unknown) rather than trust an unvalidated responder.
+    if (!findExt(rc, OID_OCSP_NOCHECK)) continue;
+    return ocspResponderSpki(rc, issuer);
+  }
+  return null;
+}
+
+/**
+ * @primitive  pki.path.ocspChecker
+ * @signature  pki.path.ocspChecker(responses) -> RevocationChecker
+ * @since      0.1.32
+ * @status     experimental
+ * @spec       RFC 6960
+ * @related    pki.path.validate, pki.schema.ocsp.parseResponse, pki.path.crlChecker
+ *
+ * Build an OCSP-backed `RevocationChecker` for `pki.path.validate`'s
+ * `revocationChecker` option from a set of pre-fetched OCSP responses (DER/PEM
+ * or already-parsed). For each certificate it locates a SingleResponse whose
+ * CertID binds this cert's serial to its issuer -- recomputing `issuerNameHash`
+ * and `issuerKeyHash` under the CertID's own hashAlgorithm (SHA-1 or SHA-2), so
+ * a response using either matches -- confirms the responder is authorized (the
+ * issuing CA directly, or a valid CA-issued delegate bearing both id-kp-OCSPSigning
+ * and id-pkix-ocsp-nocheck), verifies the response signature over
+ * `tbsResponseDataBytes`, checks currency
+ * (`thisUpdate`/`nextUpdate`), and reports `{ status: "good"|"revoked"|
+ * "unknown" }`. A wrong-issuer CertID, an unauthorized responder, a stale,
+ * not-yet-valid, nextUpdate-less, non-successful, or unverifiable response
+ * yields `unknown`, which the validator fails closed unless `softFail` is set;
+ * a `revoked` status surfaces its `revocationReason`. It is transport-free: the
+ * caller supplies bytes it collected (an OCSP fetch or a stapled response), so
+ * nonce anti-replay is the live client's responsibility and the residual replay
+ * defense is the `thisUpdate`/`nextUpdate` currency window.
+ *
+ * @example
+ *   var checker = pki.path.ocspChecker([]);   // no responses -> every cert is "unknown"
+ *   typeof checker.check;                       // "function"
+ */
+function ocspChecker(responses) {
+  var parsed = (responses || []).map(function (r) { return (r && r.responseStatus) ? r : ocsp.parseResponse(r); });
+  return {
+    check: async function (cert, issuer, ctx) {
+      var time = ctx.time;
+      var historical = ctx.historicalMode === true;
+      // Issuer DN candidates to match the CertID against (RFC 6960 sec. 4.1.1 names
+      // the checked cert's issuer field; a response MAY instead carry the issuer
+      // certificate's own subject encoding -- sec. 7.1-equal but not byte-identical).
+      var issuerNameCandidates = [cert.issuer.bytes];
+      function addNameCandidate(nm) {
+        if (nm && nm.bytes && !issuerNameCandidates.some(function (e) { return e.equals(nm.bytes); })) issuerNameCandidates.push(nm.bytes);
+      }
+      if (issuer.issuerCert) addNameCandidate(issuer.issuerCert.subject);
+      addNameCandidate(issuer.workingIssuerName);
+      var issuerKeyBits;
+      try { issuerKeyBits = ocspKeyValue(issuer.workingPublicKey); }
+      catch (_e) { return { status: "unknown", reason: "the issuer public key could not be read to recompute the OCSP CertID" }; }
+
+      // A serial is revoked if ANY authoritative, verified, current response says
+      // so -- a clean response must never shadow a revoking one (the crlChecker
+      // fail-closed law). "good" needs at least one authoritative match; every
+      // other outcome is undetermined.
+      var revokedResult = null;
+      var sawGood = false;
+      var sawUnknownStatus = false;
+
+      for (var k = 0; k < parsed.length; k++) {
+        var resp = parsed[k];
+        if (resp.responseStatus.code !== 0) continue;   // non-successful -> conveys no status
+        var br = resp.basicResponse;
+        if (!br) continue;
+        var signerSpki = await ocspAuthorizeResponder(br, cert, issuer, issuerKeyBits, time);
+        if (!signerSpki) continue;                       // unauthorized responder
+        if (!(await _verifyWithSpki(br.signatureAlgorithm, br.signature, signerSpki, br.tbsResponseDataBytes))) continue;
+        // A critical responseExtension changes the meaning of the WHOLE response
+        // and this code processes none -> the response is unusable.
+        if (ocspHasCriticalExtension(br.responseExtensions)) continue;
+        for (var s = 0; s < br.responses.length; s++) {
+          var sr = br.responses[s];
+          if (!(await ocspCertIdMatches(sr.certID, cert, issuerNameCandidates, issuerKeyBits))) continue;   // not about this cert
+          if (ocspHasCriticalExtension(sr.singleExtensions)) continue;   // a critical per-response extension this code cannot process -> skip
+          if (sr.thisUpdate > time) continue;                    // not yet valid
+          if (!sr.nextUpdate || sr.nextUpdate < time) continue;  // no bounded validity / stale -> fail closed
+          var st = sr.certStatus;
+          if (st.type === "revoked") {
+            // A revocation is effective as of its revocationTime. Present-time
+            // validation revokes regardless (a future revocationTime is
+            // post-dating/skew, never "good"); only an EXPLICIT historical
+            // validation defers a strictly-future revocation.
+            if (historical && st.revocationTime instanceof Date && st.revocationTime.getTime() > time.getTime()) { sawGood = true; }
+            else {
+              revokedResult = {
+                status: "revoked",
+                revocationReason: st.revocationReason || null,
+                reason: "certificate reported revoked by an authorized OCSP responder" + (st.revocationReason ? " (" + st.revocationReason + ")" : ""),
+              };
+            }
+          } else if (st.type === "good") {
+            sawGood = true;
+          } else {
+            sawUnknownStatus = true;   // an explicit responder "unknown"
+          }
+        }
+      }
+      if (revokedResult) return revokedResult;
+      if (sawGood) return { status: "good" };
+      return {
+        status: "unknown",
+        reason: sawUnknownStatus
+          ? "the OCSP responder reported certStatus unknown for this certificate"
+          : "no authoritative, current, in-scope OCSP response covers this certificate",
+      };
+    },
+  };
+}
+
 module.exports = {
   validate: validate,
   crlChecker: crlChecker,
+  ocspChecker: ocspChecker,
 };

package/lib/schema-all.js

@@ -249,7 +249,7 @@ var FORMATS = [
  * @primitive  pki.schema.all
  * @signature  pki.schema.all() -> string[]
  * @since      0.1.7
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5280
  * @related    pki.schema.parse
  *
@@ -264,7 +264,7 @@ function all() { return FORMATS.map(function (f) { return f.name; }); }
  * @primitive  pki.schema.parse
  * @signature  pki.schema.parse(input) -> parsed
  * @since      0.1.7
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5280
  * @related    pki.schema.x509, pki.schema.all
  *

package/lib/schema-attrcert.js

@@ -299,7 +299,7 @@ var ATTRIBUTE_CERTIFICATE = pkix.signedEnvelope(NS, ACINFO, {
  * @primitive  pki.schema.attrcert.parse
  * @signature  pki.schema.attrcert.parse(input) -> attributeCertificate
  * @since      0.1.14
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5755, X.509
  * @related    pki.schema.parse, pki.schema.x509.parse
  *
@@ -348,7 +348,7 @@ function parseV1(input) {
  * @primitive  pki.schema.attrcert.pemDecode
  * @signature  pki.schema.attrcert.pemDecode(text, label?) -> Buffer
  * @since      0.1.14
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468, RFC 5755
  * @related    pki.schema.attrcert.parse
  *
@@ -367,7 +367,7 @@ function pemDecode(text, label) { return pkix.pemDecode(text, label === null ? n
  * @primitive  pki.schema.attrcert.pemEncode
  * @signature  pki.schema.attrcert.pemEncode(der, label?) -> string
  * @since      0.1.23
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468, RFC 5755
  * @related    pki.schema.attrcert.pemDecode
  *

package/lib/schema-cmp.js

@@ -42,6 +42,7 @@ var pkix = require("./schema-pkix.js");
 var cms = require("./schema-cms.js");
 var crmf = require("./schema-crmf.js");
 var frameworkError = require("./framework-error.js");
+var guard = require("./guard-all.js");
 
 var CmpError = frameworkError.CmpError;
 var PemError = frameworkError.PemError;
@@ -99,9 +100,7 @@ var PKI_FAILURE_INFO = schema.decode(function (n, ctx) {
 // PollRep checkAfter is a delay in seconds -- negative poisons scheduling, and
 // the value surfaces as an exact number or not at all.
 var CHECK_AFTER = schema.decode(function (n, ctx) {
-  var v = asn1.read.integer(n);
-  if (v < 0n || v > 2147483647n) throw ctx.E("cmp/bad-poll-rep", "checkAfter must be a non-negative delay in seconds (RFC 9810 sec. 5.3.22)");
-  return Number(v);
+  return guard.range.uint31(asn1.read.integer(n), ctx.E, "cmp/bad-poll-rep", "checkAfter delay in seconds (RFC 9810 sec. 5.3.22)");
 });
 
 // A raw certificate / CRL / publication-info element -- surfaced byte-exact for
@@ -841,7 +840,7 @@ var PKI_MESSAGE = schema.seq([
  * @primitive  pki.schema.cmp.parse
  * @signature  pki.schema.cmp.parse(input) -> pkiMessage
  * @since      0.1.19
- * @status     experimental
+ * @status     stable
  * @spec       RFC 9810, RFC 9483, RFC 9481
  * @related    pki.schema.parse, pki.schema.crmf.parse, pki.schema.cms.parse
  *
@@ -895,7 +894,7 @@ var parse = pkix.makeParser({
  * @primitive  pki.schema.cmp.pemDecode
  * @signature  pki.schema.cmp.pemDecode(text, label?) -> Buffer
  * @since      0.1.19
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468, RFC 9810
  * @related    pki.schema.cmp.parse
  *
@@ -912,7 +911,7 @@ function pemDecode(text, label) { return pkix.pemDecode(text, label || "CMP", Pe
  * @primitive  pki.schema.cmp.pemEncode
  * @signature  pki.schema.cmp.pemEncode(der, label?) -> string
  * @since      0.1.19
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468
  * @related    pki.schema.cmp.pemDecode
  *

package/lib/schema-crmf.js

@@ -455,7 +455,7 @@ var CERT_REQ_MESSAGES = schema.seqOf(CERT_REQ_MSG, {
  * @primitive  pki.schema.crmf.parse
  * @signature  pki.schema.crmf.parse(input) -> certReqMessages
  * @since      0.1.17
- * @status     experimental
+ * @status     stable
  * @spec       RFC 4211
  * @related    pki.schema.parse, pki.schema.csr.parse
  *
@@ -496,7 +496,7 @@ var parse = pkix.makeParser({
  * @primitive  pki.schema.crmf.pemDecode
  * @signature  pki.schema.crmf.pemDecode(text, label?) -> Buffer
  * @since      0.1.17
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468, RFC 4211
  * @related    pki.schema.crmf.parse
  *
@@ -513,7 +513,7 @@ function pemDecode(text, label) { return pkix.pemDecode(text, label || null, Pem
  * @primitive  pki.schema.crmf.pemEncode
  * @signature  pki.schema.crmf.pemEncode(der, label) -> string
  * @since      0.1.23
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468, RFC 4211
  * @related    pki.schema.crmf.pemDecode
  *

package/lib/schema-csrattrs.js

@@ -320,7 +320,7 @@ var CSR_ATTRS = schema.seqOf(ATTR_OR_OID, {
  * @primitive  pki.schema.csrattrs.parse
  * @signature  pki.schema.csrattrs.parse(der) -> { items }
  * @since      0.1.24
- * @status     experimental
+ * @status     stable
  * @spec       RFC 8951, RFC 9908, RFC 7030
  * @related    pki.schema.parse, pki.est.buildEnrollAttributes
  *

package/lib/schema-pkcs12.js

@@ -46,6 +46,7 @@ var pkix = require("./schema-pkix.js");
 var cms = require("./schema-cms.js");
 var pkcs8 = require("./schema-pkcs8.js");
 var frameworkError = require("./framework-error.js");
+var guard = require("./guard-all.js");
 
 var Pkcs12Error = frameworkError.Pkcs12Error;
 var PemError = frameworkError.PemError;
@@ -102,16 +103,10 @@ var PBKDF2_PARAMS = schema.seq([
     if (!m.fields.keyLength.present) {
       throw ctx.E("pkcs12/bad-mac-data", "PBMAC1 PBKDF2-params must carry keyLength (RFC 9579 sec. 5)");
     }
-    // Both counters surface as exact JS numbers -- a value past the bound
-    // would round silently on conversion and hand a verifier wrong inputs.
-    var iterations = m.fields.iterationCount.value;
-    if (iterations < 1n || iterations > 2147483647n) {
-      throw ctx.E("pkcs12/bad-mac-data", "PBKDF2 iterationCount must be a positive integer within the iteration-count range");
-    }
-    var keyLength = m.fields.keyLength.value;
-    if (keyLength < 1n || keyLength > 2147483647n) {
-      throw ctx.E("pkcs12/bad-mac-data", "PBKDF2 keyLength must be a positive integer within the key-length range");
-    }
+    // guard.range.positiveInt31 bounds + narrows each counter atomically -- a
+    // value past the bound would round silently and hand a verifier wrong inputs.
+    var iterationCount = guard.range.positiveInt31(m.fields.iterationCount.value, ctx.E, "pkcs12/bad-mac-data", "PBKDF2 iterationCount");
+    var keyLength = guard.range.positiveInt31(m.fields.keyLength.value, ctx.E, "pkcs12/bad-mac-data", "PBKDF2 keyLength");
     var prf = m.fields.prf.present ? m.fields.prf.value.result : null;
     // X.690 sec. 11.5 -- a DEFAULT-valued component must be omitted from a DER
     // encoding, and the prf DEFAULT is algid-hmacWithSHA1: hmacWithSHA1 with
@@ -124,8 +119,8 @@ var PBKDF2_PARAMS = schema.seq([
     }
     return {
       salt: m.fields.salt.value,
-      iterationCount: Number(iterations),
-      keyLength: Number(keyLength),
+      iterationCount: iterationCount,
+      keyLength: keyLength,
       prfOid: prf ? prf.oid : OID_HMAC_SHA1,
       prfName: prf ? prf.name : "hmacWithSHA1",
     };
@@ -172,8 +167,7 @@ var MAC_DATA = schema.seq([
     if (it.present) {
       var v = it.value;
       if (v === 1n) throw ctx.E("pkcs12/bad-mac-iterations", "iterations equal to its DEFAULT 1 must be omitted (X.690 sec. 11.5)");
-      if (v < 1n || v > 2147483647n) throw ctx.E("pkcs12/bad-mac-iterations", "iterations must be a positive integer within the iteration-count range");
-      iterations = Number(v);
+      iterations = guard.range.positiveInt31(v, ctx.E, "pkcs12/bad-mac-iterations", "MacData iterations");
     }
     var di = m.fields.mac.value.result;
     var pbmac1 = null;
@@ -529,7 +523,7 @@ function _buildBag(rec, state, ctx) {
  * @primitive  pki.schema.pkcs12.parse
  * @signature  pki.schema.pkcs12.parse(input) -> pfx
  * @since      0.1.18
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7292, RFC 9579
  * @defends    ASN.1-parser-DoS (CWE-400)
  * @related    pki.schema.parse, pki.schema.pkcs8.parse, pki.schema.cms.parse
@@ -577,7 +571,7 @@ var parse = pkix.makeParser({
  * @primitive  pki.schema.pkcs12.pemDecode
  * @signature  pki.schema.pkcs12.pemDecode(text, label?) -> Buffer
  * @since      0.1.18
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468, RFC 7292
  * @related    pki.schema.pkcs12.parse
  *
@@ -594,7 +588,7 @@ function pemDecode(text, label) { return pkix.pemDecode(text, label || "PKCS12",
  * @primitive  pki.schema.pkcs12.pemEncode
  * @signature  pki.schema.pkcs12.pemEncode(der, label?) -> string
  * @since      0.1.18
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468
  * @related    pki.schema.pkcs12.pemDecode
  *

package/lib/schema-pkix.js

@@ -500,12 +500,9 @@ function generalName(ns, opts) {
       if (constructed) throw ctx.E(code, "GeneralName [" + t + "] must be primitive (X.690 sec. 10.2)");
       if (GN_IA5[t]) {
         if (n.content.length === 0) throw ctx.E(code, "GeneralName [" + t + "] must be a non-empty IA5String");
-        for (var i = 0; i < n.content.length; i++) {
-          // 7-bit IA5, and no C0/DEL control byte -- an embedded NUL/control in a
-          // dNSName/rfc822Name/URI enables a name-truncation/confusion bypass
-          // (CVE-2009-2408 class) downstream, so reject it at decode.
-          if (n.content[i] < 0x20 || n.content[i] > 0x7e) throw ctx.E(code, "GeneralName [" + t + "] must be a printable IA5String (no control bytes)");
-        }
+        // 7-bit IA5, no C0/DEL control byte -- an embedded NUL/control in a
+        // dNSName/rfc822Name/URI enables a name-truncation bypass (CVE-2009-2408).
+        guard.name.assertPrintableIa5(n.content, ctx.E, code, "GeneralName [" + t + "]");
         if (decodeValue) value = n.content.toString("latin1");
       } else if (t === 7) {
         if (subtreeBase) {
@@ -619,11 +616,10 @@ function certExtensionDecoders(ns) {
     if (kids[i] && kids[i].tagClass === "universal" && kids[i].tagNumber === _T.INTEGER) {
       if (!cA) throw ns.E(C, "BasicConstraints pathLenConstraint is only permitted when cA is TRUE (RFC 5280 sec. 4.2.1.9)");
       var pl = readInt(kids[i], C, "pathLenConstraint");
-      // Bounded before Number() narrowing -- a value past the safe-integer range
-      // would round silently and be compared as a path-length ceiling, so it is
-      // exact-or-rejected (the same rule the RSASSA-PSS/PKCS#12 counters follow).
-      if (pl < 0n || pl > 2147483647n) throw ns.E(C, "BasicConstraints pathLenConstraint must be a non-negative integer within range");
-      pathLen = Number(pl); i++;
+      // guard.range.uint31 bounds the decoded BigInt and narrows atomically -- a
+      // value past the safe-integer range would otherwise round silently and be
+      // compared as a path-length ceiling.
+      pathLen = guard.range.uint31(pl, ns.E, C, "BasicConstraints pathLenConstraint (RFC 5280 sec. 4.2.1.9)"); i++;
     }
     if (i !== kids.length) throw ns.E(C, "BasicConstraints has unexpected trailing fields");
     return { cA: cA, pathLenConstraint: pathLen };
@@ -746,11 +742,11 @@ function certExtensionDecoders(ns) {
       pcLastTag = k.tagNumber;
       var v;
       try { v = asn1.read.integerImplicit(k, k.tagNumber); } catch (e) { throw ns.E(C, "PolicyConstraints field must be an INTEGER", e); }
-      // Bounded before Number() narrowing (a skip count past the safe-integer
-      // range would round silently) -- exact-or-rejected.
-      if (v < 0n || v > 2147483647n) throw ns.E(C, "PolicyConstraints skip count must be a non-negative integer within range");
-      if (k.tagNumber === 0) rep = Number(v);
-      else if (k.tagNumber === 1) ipm = Number(v);
+      // guard.range.uint31 bounds + narrows atomically (a skip count past the
+      // safe-integer range would round silently).
+      var skip = guard.range.uint31(v, ns.E, C, "PolicyConstraints skip count (RFC 5280 sec. 4.2.1.11)");
+      if (k.tagNumber === 0) rep = skip;
+      else if (k.tagNumber === 1) ipm = skip;
       else throw ns.E(C, "PolicyConstraints has an unexpected field [" + k.tagNumber + "]");
     });
     return { requireExplicitPolicy: rep, inhibitPolicyMapping: ipm };
@@ -762,10 +758,9 @@ function certExtensionDecoders(ns) {
     var n = decodeTop(buf, C, "InhibitAnyPolicy");
     if (n.tagClass !== "universal" || n.tagNumber !== _T.INTEGER) throw ns.E(C, "InhibitAnyPolicy must be an INTEGER (RFC 5280 sec. 4.2.1.14)");
     var v = readInt(n, C, "InhibitAnyPolicy");
-    // Bounded before Number() narrowing (a skip count past the safe-integer
-    // range would round silently) -- exact-or-rejected.
-    if (v < 0n || v > 2147483647n) throw ns.E(C, "InhibitAnyPolicy skip count must be a non-negative integer within range");
-    return Number(v);
+    // guard.range.uint31 bounds + narrows atomically (a skip count past the
+    // safe-integer range would round silently).
+    return guard.range.uint31(v, ns.E, C, "InhibitAnyPolicy skip count (RFC 5280 sec. 4.2.1.14)");
   }
 
   // subjectAltName / issuerAltName ::= GeneralNames -- decoded values surfaced.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.1.30",
+  "version": "0.1.32",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",
@@ -72,6 +72,6 @@
   "devDependencies": {
     "c8": "11.0.0",
     "esbuild": "0.28.1",
-    "eslint": "10.3.0"
+    "eslint": "10.7.0"
   }
 }

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:9b3c1a14-9eb9-492b-a652-b6fa68d6b4b4",
+  "serialNumber": "urn:uuid:87ae1f84-9b42-4b45-820b-1323915f3fbe",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-11T07:38:46.451Z",
+    "timestamp": "2026-07-11T18:49:24.325Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.1.30",
+      "bom-ref": "@blamejs/pki@0.1.32",
       "type": "application",
       "name": "pki",
-      "version": "0.1.30",
+      "version": "0.1.32",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.1.30",
+      "purl": "pkg:npm/%40blamejs/pki@0.1.32",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.1.30",
+      "ref": "@blamejs/pki@0.1.32",
       "dependsOn": []
     }
   ]