@blamejs/pki 0.1.32 → 0.2.0

package/CHANGELOG.md

@@ -4,6 +4,31 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.2.0 — 2026-07-11
+
+Trust-store ingestion, sharded-CRL revocation, and a hardened input-guard layer.
+
+### Added
+
+- pki.trust.parseCertdata(text) and pki.trust.parseCcadbCsv(text) parse the Mozilla/NSS certdata.txt object stream and the CCADB All Certificate Records CSV into one Anchor shape carrying the exact { name, publicKey, algorithm, parameters } fields pki.path.validate consumes, plus per-purpose distrustAfter dates, delegator purposes (only CKT_NSS_TRUSTED_DELEGATOR grants a purpose), subjectDer, label, and mozillaCaPolicy. Certificate and trust objects are paired by byte-exact issuer + serial (never adjacency) and cross-checked against the parsed DER, so metadata can never attach to the wrong root. pki.trust.anchor(entry, { purpose }) hands the anchor to validate, failing fast when the entry does not delegate the purpose. Malformed octal, an oversized block or file, an unrecognized trust value, an undecodable distrust date, or a mispaired object throws a typed trust/* error. Offline and pure: the caller supplies the text; nothing fetches.
+- pki.path.validate gains opts.checkPurpose plus trust-anchor constraint enforcement: with an anchor carrying distrustAfter / purposes metadata, a leaf whose notBefore is strictly after the anchor's distrust date for the checked purpose fails with path/distrusted-after (the boundary instant stays trusted, matching Mozilla's enforcement), and a purpose the anchor does not delegate fails with path/purpose-not-trusted. Anchors without the metadata validate exactly as before.
+- cRLDistributionPoints and freshestCRL certificate-extension decoders, and RFC 5280 sec. 6.3.3 distribution-point correspondence in pki.path.crlChecker: a partitioned CRL whose critical issuing-distribution-point shares an identically-encoded name with one of the certificate's distribution points, carries no reason restriction on either side, is current, and verifies now establishes a good status for its shard. A non-corresponding, reason-restricted, non-critical-IDP, delta, or unverifiable shard keeps failing closed to undetermined -- and a listed serial still reports revoked regardless of correspondence.
+- pki.asn1.decode and pki.cbor.decode accept a maxItems option (default C.LIMITS.DER_MAX_ITEMS) capping the total decoded elements, so a small dense input cannot fan out into an unbounded node tree (asn1/too-many-items). OCSP responses are capped at C.LIMITS.OCSP_MAX_CERTS embedded certificates (ocsp/too-many-certs), bounding the pre-authentication signature work an attacker-supplied response can demand.
+- Strict JWK oct key-material decoding: importKey / unwrapKey reject a JWK oct key whose k member is missing, empty, padded, or non-canonical base64url instead of importing a wrong or empty key, and JSON key unwrap rejects duplicate members at every depth so a smuggled second parameter can no longer resolve last-wins. Unwrapped JWK text is bounded (size, nesting depth, strict UTF-8).
+
+### Changed
+
+- OID string handling is canonical everywhere: pki.asn1.build.oid and pki.oid.toDER reject a leading-zero arc (previously accepted and silently encoded as a DIFFERENT OID -- "2.05.29.15" emitted the DER of 2.5.29.15), and pki.oid.toArcs / register now enforce the X.660 arc bounds on the string form (a root above 2, or a second arc above 39 under roots 0 and 1, can never be DER-encoded and now throws oid/bad-arc). Error codes consolidated with the canonical form: a one-arc or non-numeric-arc string throws oid/bad-input (previously oid/too-short and oid/bad-arc; oid/too-short is removed).
+- pki.jose and WebCrypto JWK unwrap JSON limits are enforced through one shared bounded reader; an unwrapped-key JSON parse failure reports the typed webcrypto/data error without a nested SyntaxError cause.
+
+### Fixed
+
+- Signing via pki.jose over a payload backed by a detached ArrayBuffer now fails closed with a typed error instead of silently signing an empty payload; PEM encoding and EST transfer encoding reject a detached or non-buffer input the same way.
+- EST server-side key generation rejects an EnvelopedData whose encryptedContent is present but zero-length (est/bad-key-part); previously only the fully absent form was rejected, so an empty ciphertext could reach the caller's decrypt step. The same shared check now backs the CRMF encrypted-key proof-of-possession and PKCS#12 paths.
+- An attribute certificate whose objectDigestInfo digest is not octet-aligned is rejected at parse (attrcert/bad-object-digest-info) instead of surfacing a bit-truncated digest.
+- A malformed content-type attribute value inside AuthEnvelopedData authenticated attributes surfaces cms/bad-content-type-attr instead of a raw asn1/* codec error.
+- pki.path.validate rejects fractional maxPathCerts / maxPolicyNodes values (path/bad-input) instead of silently tolerating them, and validates requiredEku / userInitialPolicySet entries as canonical OID strings at the entry point -- a leading-zero or out-of-bounds key could never match decoder output and now fails at boot instead of silently never matching.
+
 ## v0.1.32 — 2026-07-11
 
 OCSP-backed revocation checking joins certification-path validation.

package/README.md

@@ -220,9 +220,10 @@ is callable today; nothing below is a stub.
 | `pki.acme` | RFC 8555 / 8737 / 8738 / 9773 ACME message layer over `pki.jose` — resource-object validators (closed status enums, conditional-required fields, unknown fields ignored), the three §7.1.6 state machines, request builders (newAccount + EAB, newOrder + `replaces`, finalize with CSR identifier-set match and account-key-reuse rejection, challenge responses, deactivation, revokeCert in both key modes, the keyChange nested JWS, POST-as-GET), the http-01 / dns-01 / tls-alpn-01 challenge computations, the dns/ip identifier validators, and the ARI certID (serial sign-padding preserved). A message layer, not an HTTP client — transport-injectable, fail-closed — `validate`, `identify`, `assertTransition`, the builders, `keyAuthorization`, `http01`, `dns01`, `tlsAlpn01Extension`, `verifyTlsAlpn01`, `ariCertId` |
 | `pki.schema.smime` | Decode S/MIME ESS signed-attribute values (RFC 5035 / RFC 8551) — `parseSigningCertificate` / `parseSigningCertificateV2` bind a signature to its signing certificate (cert hash, hash algorithm, issuer `GeneralNames` + serial), `parseSmimeCapabilities` decodes the ordered capability list, and `decodeAttribute` OID-dispatches a CMS attribute (enforcing the single-value rule, recognize-and-defer for unknown types). A companion decoder for CMS signed attributes, not an auto-routed format, fail-closed — `parseSigningCertificate`, `parseSigningCertificateV2`, `parseSmimeCapabilities`, `decodeAttribute` |
 | `pki.schema.engine` | The declarative ASN.1 structure-schema engine every format parser composes — `walk` / `encode` / `embeddedDer` plus the schema combinators |
-| `pki.path` | RFC 5280 §6 certification-path validation — `validate` runs the §6.1 state machine (signature chaining, validity windows, name chaining, basic constraints and path length, key usage, name constraints, the certificate-policy tree) over an ordered path and a trust anchor, returning a structured verdict with per-check reason codes; `crlChecker` supplies CRL-based revocation and `ocspChecker` supplies OCSP-based revocation (RFC 6960 — CertID binding, responder authorization, signature, currency) over the same pluggable hook. Pure and re-entrant, fail-closed — `validate`, `crlChecker`, `ocspChecker` |
+| `pki.path` | RFC 5280 §6 certification-path validation — `validate` runs the §6.1 state machine (signature chaining, validity windows, name chaining, basic constraints and path length, key usage, name constraints, the certificate-policy tree) over an ordered path and a trust anchor, returning a structured verdict with per-check reason codes, and enforces a `pki.trust` anchor's per-purpose distrust-after dates and delegator purposes via `checkPurpose`; `crlChecker` supplies CRL-based revocation — including partitioned/sharded CRLs, whose §6.3.3 Distribution Point ↔ IDP correspondence lets a corresponding full-reason shard establish non-revocation — and `ocspChecker` supplies OCSP-based revocation (RFC 6960 — CertID binding, responder authorization, signature, currency) over the same pluggable hook. Pure and re-entrant, fail-closed — `validate`, `crlChecker`, `ocspChecker` |
 | `pki.ct` | Parse RFC 6962 Certificate Transparency SCT lists — `parseSctList` decodes the `SignedCertificateTimestampList` a certificate or OCSP response carries in the SCT extension (a TLS-presentation-language payload inside the §3.3 double DER wrap) into per-SCT log id, exact `timestamp` (BigInt), named signature algorithm, and raw signature; `reconstructSignedData` rebuilds the exact `digitally-signed` preimage for external verification. Structure decoded, crypto surfaced raw, bounded decode, fail-closed — `parseSctList`, `reconstructSignedData` |
 | `pki.merkle` | RFC 6962 / RFC 9162 Merkle-tree proof verification — `leafHash` / `nodeHash` / `emptyRootHash` build the domain-separated (0x00 leaf / 0x01 node) SHA-256 tree hashes; `verifyInclusion` folds an audit proof back to a root and `verifyConsistency` reconstructs both the old and new root (the append-only guarantee), each constant-time-compared to a trusted checkpoint root. Fail-closed on bad geometry, sync hashing, transport-free — `leafHash`, `nodeHash`, `emptyRootHash`, `verifyInclusion`, `verifyConsistency` |
+| `pki.trust` | Mozilla / CCADB trust-store ingestion — `parseCertdata` reads the NSS `certdata.txt` object stream and `parseCcadbCsv` the CCADB CSV export into one identical constraint-carrying anchor shape: the per-purpose trust bits (only `CKT_NSS_TRUSTED_DELEGATOR` grants) and the per-purpose distrust-after dates the bare root list omits. Certificate and trust objects pair by byte-exact issuer + serial (never adjacency) and are cross-checked against the parsed DER, so metadata can never attach to the wrong root; `anchor()` hands an entry to `pki.path.validate({ trustAnchor, checkPurpose })`. Offline, fail-closed, bounded — `parseCertdata`, `parseCcadbCsv`, `anchor` |
 | `pki.C` / `pki.constants` | Version-stable constants — functional scale helpers (`C.TIME.*`, `C.BYTES.*`), codec `LIMITS`, `version` |
 | `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError` / `Asn1Error` / `OidError` / `PemError` / `CertificateError` / `CrlError` / `CsrError` / `Pkcs8Error` / `CmsError` / `OcspError` / `TspError` / `AttrCertError` / `CrmfError` / `Pkcs12Error` / `CmpError` / `PathError` / `CtError` / `JoseError` / `AcmeError`, each carrying a stable `code` in `domain/reason` form |
 | `pki` CLI | `pki version`, `pki oid <dotted\|name>`, `pki parse <cert>` |

package/index.js

@@ -40,6 +40,7 @@ var merkle    = require("./lib/merkle");
 var est        = require("./lib/est");
 var jose       = require("./lib/jose");
 var acme       = require("./lib/acme");
+var trust      = require("./lib/trust");
 
 module.exports = {
   version:   constants.version,
@@ -87,6 +88,12 @@ module.exports = {
   // http-01 / dns-01 / tls-alpn-01 challenge math, and the ARI certID. A message
   // layer, not an HTTP client -- transport is the operator's to inject.
   acme:      acme,
+  // `trust` is Mozilla/NSS certdata.txt + CCADB CSV root-store ingestion --
+  // pki.trust.parseCertdata / parseCcadbCsv produce constraint-carrying trust
+  // anchors (per-purpose trust bits + per-purpose distrust-after dates the bare
+  // root list omits); pki.trust.anchor hands one to pki.path.validate. Offline:
+  // the operator supplies the text; no fetch.
+  trust:     trust,
   // A ready W3C Crypto instance (globalThis.crypto shape) with the classes for
   // constructing more attached under the same namespace (pki.webcrypto.CryptoKey,
   // .SubtleCrypto, .Crypto, .WebCryptoError). PQC-first, classical-capable, zero-dep.

package/lib/asn1-der.js

@@ -37,6 +37,14 @@ var guard = require("./guard-all");
 var Asn1Error = frameworkError.Asn1Error;
 var OidError = frameworkError.OidError;
 
+// (code, message) -> Asn1Error, the factory shape the composed guards throw
+// through so a malformed codec argument keeps the asn1/* typed verdict.
+function _asn1Error(c, m) { return new Asn1Error(c, m); }
+
+// (code, message) -> OidError, the factory the OID string guard throws through
+// so build.oid keeps its oid/* typed verdict (oid/bad-input, oid/bad-arc).
+function _oidErr(c, m) { return new OidError(c, m); }
+
 // ---- Tag constants (universal class) --------------------------------
 
 // L1 -- the ASN.1 universal-type descriptor registry: the single source of
@@ -158,20 +166,26 @@ function decode(input, opts) {
   // recursive descent into a bare RangeError instead of the typed asn1/too-deep.
   var maxBytes = guard.limits.cap(opts.maxBytes, "maxBytes", constants.LIMITS.DER_MAX_BYTES);
   var maxDepth = guard.limits.depthCap(opts.maxDepth, "maxDepth", constants.LIMITS.DER_MAX_DEPTH);
+  // Total decoded-node ceiling: the eager node tree lets a dense run of tiny TLVs
+  // amplify a small input into a huge tree, so a per-node counter fails closed at
+  // the cap (the memory-fanout class the CBOR codec closed with CBOR_MAX_ITEMS).
+  var maxItems = guard.limits.cap(opts.maxItems, "maxItems", constants.LIMITS.DER_MAX_ITEMS);
   if (buf.length > maxBytes) {
     throw new Asn1Error("asn1/too-large", "input " + buf.length + " bytes exceeds cap " + maxBytes);
   }
-  var r = _decodeTLV(buf, 0, buf.length, 0, maxDepth, opts.ber === true);
+  var ctr = guard.limits.counter(maxItems, _asn1Error, "asn1/too-many-items", "decoded DER node");
+  var r = _decodeTLV(buf, 0, buf.length, 0, maxDepth, opts.ber === true, undefined, ctr);
   if (!opts.allowTrailing && r.end !== buf.length) {
     throw new Asn1Error("asn1/trailing-bytes", (buf.length - r.end) + " trailing byte(s) after the top-level value");
   }
   return r.node;
 }
 
-function _decodeTLV(buf, start, limit, depth, maxDepth, ber, strDepth) {
+function _decodeTLV(buf, start, limit, depth, maxDepth, ber, strDepth, ctr) {
   if (depth > maxDepth) {
     throw new Asn1Error("asn1/too-deep", "nesting exceeds depth cap " + maxDepth);
   }
+  if (ctr) ctr.tick();   // one decoded node -> one tick (memory-fanout cap)
   var p = start;
   if (p >= limit) throw new Asn1Error("asn1/truncated", "expected an identifier octet");
   var first = buf[p]; p += 1;
@@ -271,7 +285,7 @@ function _decodeTLV(buf, start, limit, depth, maxDepth, ber, strDepth) {
       for (;;) {
         if (cp + 2 > limit) throw new Asn1Error("asn1/truncated", "indefinite-length value is missing its end-of-contents octets");
         if (buf[cp] === 0x00 && buf[cp + 1] === 0x00) break;
-        child = _decodeTLV(buf, cp, limit, depth + 1, maxDepth, ber, strDepth);
+        child = _decodeTLV(buf, cp, limit, depth + 1, maxDepth, ber, strDepth, ctr);
         children.push(child.node);
         cp = child.end;
       }
@@ -279,7 +293,7 @@ function _decodeTLV(buf, start, limit, depth, maxDepth, ber, strDepth) {
       end = cp + 2;
     } else {
       while (cp < contentEnd) {
-        child = _decodeTLV(buf, cp, contentEnd, depth + 1, maxDepth, ber, strDepth);
+        child = _decodeTLV(buf, cp, contentEnd, depth + 1, maxDepth, ber, strDepth, ctr);
         children.push(child.node);
         cp = child.end;
       }
@@ -793,7 +807,10 @@ function encodeIdentifier(classBits, constructed, tagNumber) {
  *   pki.asn1.encode(0x00, false, pki.asn1.TAGS.NULL, Buffer.alloc(0));
  */
 function encodeTLV(classBits, constructed, tagNumber, content) {
-  var body = Buffer.isBuffer(content) ? content : Buffer.from(content || []);
+  // A Buffer content is re-viewed so a detached backing store fails closed with a
+  // typed asn1/not-buffer instead of a raw TypeError out of Buffer.concat; an
+  // array / undefined content stays the normal builder path.
+  var body = Buffer.isBuffer(content) ? guard.bytes.view(content, Asn1Error, "asn1/not-buffer", "encodeTLV content") : Buffer.from(content || []);
   var id = encodeIdentifier(classBits, constructed, tagNumber);
   return Buffer.concat([id, encodeLength(body.length), body]);
 }
@@ -824,17 +841,12 @@ function intToDer(v) {
 }
 
 function encodeOidContent(dotted) {
-  if (typeof dotted !== "string" || dotted.length === 0) throw new OidError("oid/bad-input", "OID must be a dotted-decimal string");
-  var parts = dotted.split(".");
-  if (parts.length < 2) throw new OidError("oid/too-short", "OID needs at least two arcs");
-  var arcs = [];
-  for (var i = 0; i < parts.length; i++) {
-    if (!/^\d+$/.test(parts[i])) throw new OidError("oid/bad-arc", "arc " + JSON.stringify(parts[i]) + " is not a non-negative integer");
-    arcs.push(BigInt(parts[i]));
-  }
+  // Canonical dotted-decimal + X.660 arc bounds live in the one string-OID guard,
+  // so build.oid cannot emit bytes that decode to a DIFFERENT OID than the string
+  // names (a leading-zero arc) or an arc that can never DER-encode.
+  guard.identifier.assertCanonicalOid(dotted, _oidErr, "oid/bad-input", "OID", "oid/bad-arc");
+  var arcs = dotted.split(".").map(function (p) { return BigInt(p); });
   var a1 = arcs[0], a2 = arcs[1];
-  if (a1 > 2n) throw new OidError("oid/bad-arc", "first arc must be 0, 1, or 2");
-  if (a1 < 2n && a2 >= 40n) throw new OidError("oid/bad-arc", "second arc must be < 40 when the first arc is 0 or 1");
   var subids = [a1 * 40n + a2].concat(arcs.slice(2));
   var out = [];
   for (var s = 0; s < subids.length; s++) {
@@ -905,14 +917,11 @@ var build = {
   oid:      function (dotted) { return _universal(TAGS.OBJECT_IDENTIFIER, false, encodeOidContent(dotted)); },
   octetString: function (buf) { return _universal(TAGS.OCTET_STRING, false, _asBuffer(buf, "build.octetString")); },
   bitString: function (buf, unusedBits) {
-    var u = unusedBits == null ? 0 : unusedBits;
     // An integer in 0..7 (X.690 sec. 8.6.2.2). A fractional / non-finite count
-    // would be silently bit-truncated into a DIFFERENT value when written
-    // into the leading octet -- reject it like the other numeric builder
-    // inputs (encodeLength, the tag number).
-    if (typeof u !== "number" || !Number.isInteger(u) || u < 0 || u > 7) {
-      throw new Asn1Error("asn1/bad-bit-string", "unusedBits must be an integer 0..7");
-    }
+    // would be silently bit-truncated into a DIFFERENT value when written into
+    // the leading octet -- the shared integer cap rejects it like the other
+    // numeric builder inputs (encodeLength, the tag number).
+    var u = guard.limits.cap(unusedBits == null ? 0 : unusedBits, "unusedBits", 0, { E: _asn1Error, code: "asn1/bad-bit-string", min: 0, max: 7 });
     var body = _asBuffer(buf, "build.bitString");
     // X.690 8.6.2.3: an empty BIT STRING has no content octets, so its
     // unused-bit count must be zero -- there are no bits to leave unused.

package/lib/constants.js

@@ -132,6 +132,14 @@ var BYTES = {
 var LIMITS = {
   DER_MAX_BYTES: BYTES.mib(16),
   DER_MAX_DEPTH: 64,
+  // Total decoded-node ceiling: the DER decoder builds an eager node tree, so a
+  // dense run of tiny TLVs (a 2-byte NULL is a node) fans a small input into a
+  // huge tree -- ~350 B/node, so a 16 MiB input of NULLs is ~8M nodes ~= 2.8 GiB.
+  // 4M sits well above the largest realistic structure (a full 16 MiB CRL carries
+  // ~500k revoked entries ~= 2.5M nodes) and below the dense-bomb count; the
+  // operator may override via opts.maxItems. (The CBOR sibling caps at 1M, too
+  // low for DER's legitimate large CRLs.)
+  DER_MAX_ITEMS: 4000000,
   // Hard stack-safe ceiling on the recursion depth of the DER / CBOR
   // decoders, independent of the (operator-tunable) maxDepth. Both decoders
   // are recursive descent; a maxDepth raised above the engine's native call-
@@ -222,6 +230,27 @@ var LIMITS = {
   // ACME challenge token entropy floor (RFC 8555 sec. 8, errata 6950): >= 128
   // bits of base64url is >= 22 characters. A shorter token is refused before use.
   ACME_TOKEN_MIN_CHARS: 22,
+  // OCSP embedded-certificate ceiling. A BasicOCSPResponse (or an OCSP request
+  // Signature) carries the responder / requestor certificate plus at most a short
+  // chain; the delegated-responder authorization loop verifies each candidate
+  // BEFORE the response signature is checked, so an attacker-crafted stapled /
+  // relayed response with a huge certs list would drive unbounded pre-auth
+  // signature verifies. 32 is generous headroom over a real chain.
+  OCSP_MAX_CERTS: 32,
+  // Trust-store ingestion ceilings (Mozilla/NSS certdata.txt + CCADB CSV).
+  // Every cap is refused BEFORE the offending allocation with a typed trust/*
+  // error -- never a silent truncate. A live certdata.txt is a few MiB and a
+  // CCADB all-records export a few MiB more, so 16 MiB whole-input headroom
+  // matches the codec siblings. A root certificate (or a CCADB PEM cell) is a
+  // few KiB; a MULTILINE_OCTAL blob or CSV field past 64 KiB is amplification,
+  // not a root. The real store is ~150 roots x 2 object blocks (and one CCADB
+  // row per root), so 10000 objects / rows is generous headroom while bounding
+  // a block/row bomb.
+  TRUST_MAX_BYTES: BYTES.mib(16),
+  TRUST_MAX_OCTAL_BYTES: BYTES.kib(64),
+  TRUST_MAX_OBJECTS: 10000,
+  TRUST_MAX_CSV_ROWS: 10000,
+  TRUST_MAX_CSV_FIELD_BYTES: BYTES.kib(64),
 };
 
 // Single-sourced from the package manifest so the reported version can

package/lib/ct.js

@@ -46,6 +46,10 @@ var guard = require("./guard-all.js");
 var CtError = frameworkError.CtError;
 var C = constants;
 
+// (code, message) -> CtError, the factory the composed guards throw through so a
+// malformed value keeps the ct/* typed verdict.
+function _ctErr(c, m) { return new CtError(c, m); }
+
 // RFC 5246 sec. 7.4.1.4.1 code points -- 1-byte, NOT OIDs. Surfaced named; an
 // unknown code surfaces as its numeric byte with a null name (never rejected --
 // off-profile-pair rejection is a verifier-tier log-conformance concern).
@@ -211,6 +215,9 @@ function parseSctList(extValue) {
     throw new CtError("ct/empty-list", "an SCT list must contain at least one SCT (RFC 6962 sec. 3.3)");
   }
   var scts = [], unknownScts = [];
+  // The shared item counter bounds the TOTAL element count (known + preserved-
+  // unknown) before it can drive unbounded per-element work (RFC 6962 sec. 3.3).
+  var sctCount = guard.limits.counter(C.LIMITS.SCT_MAX_COUNT, _ctErr, "ct/too-many-scts", "SCT");
   while (!outer.atEnd()) {
     if (outer.remaining() < 2) {
       throw new CtError("ct/list-trailing-bytes", "a dangling partial element after the last complete SCT (RFC 6962 sec. 3.3)");
@@ -222,14 +229,10 @@ function parseSctList(extValue) {
     if (outer.remaining() < sctLen) {
       throw new CtError("ct/list-trailing-bytes", "a SerializedSCT length " + sctLen + " overruns the list (RFC 6962 sec. 3.3)");
     }
+    sctCount.tick();
     var one = _parseSct(outer.subReader(sctLen, "ct/list-trailing-bytes"), sctLen);
     if (one.unknown) unknownScts.push({ version: one.version, rawSct: one.rawSct });
     else scts.push(one);
-    // The cap bounds the TOTAL element count (known + preserved-unknown) before it
-    // can drive unbounded per-element work.
-    if (scts.length + unknownScts.length > C.LIMITS.SCT_MAX_COUNT) {
-      throw new CtError("ct/too-many-scts", "SCT count exceeds the cap " + C.LIMITS.SCT_MAX_COUNT);
-    }
   }
   return { scts: scts, unknownScts: unknownScts };
 }
@@ -283,16 +286,14 @@ function reconstructSignedData(entry, sct) {
   if (!sct || typeof sct.timestamp !== "bigint" || sct.version !== 0) {
     throw new CtError("ct/bad-input", "reconstructSignedData expects a decoded v1 SCT from parseSctList().scts[]");
   }
-  // RFC 6962 3.2: the timestamp is a uint64. A hand-built value outside
-  // 0..2^64-1 cannot fill the fixed 8-byte field -- refused typed here rather
-  // than escaping as a raw RangeError from the Buffer write.
-  if (sct.timestamp < 0n || sct.timestamp > 0xffffffffffffffffn) {
-    throw new CtError("ct/bad-input", "sct.timestamp must be a uint64 (0..2^64-1), got " + sct.timestamp.toString() + " (RFC 6962 3.2)");
-  }
+  // RFC 6962 3.2: the timestamp is a uint64. The BigInt-preserving range guard
+  // refuses a value that cannot fill the fixed 8-byte field, typed, rather than
+  // letting it escape as a raw RangeError from the Buffer write.
+  var tsVal = guard.range.uint64(sct.timestamp, _ctErr, "ct/bad-input", "sct.timestamp (RFC 6962 3.2)");
   var parts = [];
   parts.push(Buffer.from([sct.version & 0xff]));                          // Version -- v1(0)
   parts.push(Buffer.from([0]));                                          // SignatureType -- certificate_timestamp(0)
-  var ts = Buffer.alloc(8); ts.writeBigUInt64BE(sct.timestamp); parts.push(ts);   // uint64 timestamp
+  var ts = Buffer.alloc(8); ts.writeBigUInt64BE(tsVal); parts.push(ts);   // uint64 timestamp
   parts.push(Buffer.from([(entryType >> 8) & 0xff, entryType & 0xff]));  // LogEntryType (2 bytes BE)
   if (entryType === 0) {
     var cert = _toBuffer(entry.leafCert, "leafCert");

package/lib/est.js

@@ -140,13 +140,10 @@ function transferDecode(body) {
     charset: "latin1", tooLarge: "est/too-large", badInput: "est/bad-input", label: "the EST payload",
   });
   var stripped = s.replace(/[\r\n \t]/g, "");
-  if (!/^[A-Za-z0-9+/]*={0,2}$/.test(stripped)) throw E("est/bad-base64", "the EST payload is not RFC 4648 base64 (RFC 8951 sec. 3.1)");
-  var der = Buffer.from(stripped, "base64");
-  // Buffer.from silently truncates a non-canonical body (a length not a multiple
-  // of 4, e.g. "A", or non-zero trailing bits). Re-encode and require an exact
-  // round-trip so a malformed payload fails closed instead of decoding to a
-  // different, shorter DER (the PEM decoder applies the same canonical check).
-  if (der.toString("base64") !== stripped) throw E("est/bad-base64", "the EST payload is not canonical RFC 4648 base64 (RFC 8951 sec. 3.1)");
+  // Strict canonical RFC 4648 base64 (RFC 8951 sec. 3.1) via the shared encoding
+  // guard: the alphabet + whole-4-group + canonical round-trip fail a malformed
+  // body closed instead of silently truncating to a shorter, different DER.
+  var der = guard.encoding.base64(stripped, null, E, "est/bad-base64", "the EST payload");
   if (der.length > constants.LIMITS.DER_MAX_BYTES) throw E("est/too-large", "the decoded EST DER exceeds the size cap");
   return der;
 }
@@ -167,6 +164,8 @@ function transferDecode(body) {
  */
 function transferEncode(der) {
   if (!Buffer.isBuffer(der)) throw E("est/bad-input", "transferEncode requires a DER Buffer");
+  // Re-view: a detached-backed Buffer reads as zero-length and would encode "".
+  der = guard.bytes.view(der, EstError, "est/bad-input", "transferEncode DER input");
   return der.toString("base64");
 }
 
@@ -414,9 +413,10 @@ function parseServerKeygenResponse(body, contentType, opts) {
     // not just the outer ContentInfo, so a key wrapped around id-data or anything
     // else fails closed before the caller decrypts it.
     if (!parsedKey.encryptedContentInfo || parsedKey.encryptedContentInfo.contentType !== ID_SIGNED_DATA) throw E("est/bad-key-part", "a server-generated encrypted key's EnvelopedData must encapsulate a CMS SignedData (RFC 7030 sec. 4.4.2)");
-    // A detached EnvelopedData (encryptedContent omitted) carries no ciphertext to
-    // decrypt -- there is no key to recover, so it is not a valid key response.
-    if (parsedKey.encryptedContentInfo.encryptedContent === null) throw E("est/bad-key-part", "a server-generated encrypted key's EnvelopedData must carry its encrypted content, not be detached (RFC 7030 sec. 4.4.2)");
+    // A detached OR empty EnvelopedData carries no ciphertext to decrypt -- there is
+    // no key to recover, so it is not a valid key response (the shared CMS assert
+    // rejects both null and zero-length, matching the CRMF / PKCS#12 siblings).
+    cms.assertAttachedCiphertext(parsedKey.encryptedContentInfo, E, "est/bad-key-part", "a server-generated encrypted key's EnvelopedData");
     if (Buffer.isBuffer(opts.expectedRecipientKeyId) || opts.expectedRecipientIssuerSerial) {
       if (!_recipientMatches(parsedKey.recipientInfos, opts)) throw E("est/recipient-mismatch", "the server-generated key is not encrypted to the advertised recipient (RFC 7030 sec. 4.4.2)");
     }

package/lib/framework-error.js

@@ -272,6 +272,16 @@ var JoseError = defineClass("JoseError", { withCause: true });
 // Carries the delegated jose/* or a DER leaf fault as `.cause`.
 var AcmeError = defineClass("AcmeError", { withCause: true });
 
+// TrustError -- a Mozilla/NSS certdata.txt or CCADB CSV root-store input that
+// fails ingestion: a malformed or oversized object block, a bad \ooo octal
+// escape, an unrecognized CK_TRUST value, a certificate/trust-object pairing
+// disagreement (metadata must never attach to the wrong root), an undecodable
+// distrust-after time, a CSV framing / required-column violation, a CKA_VALUE
+// or PEM cell that is not a well-formed certificate, or a purpose the entry is
+// not a trusted delegator for. Carries the underlying leaf fault (an x509/* or
+// asn1/* error) as `.cause`.
+var TrustError = defineClass("TrustError", { withCause: true });
+
 module.exports = {
   PkiError:         PkiError,
   defineClass:      defineClass,
@@ -300,4 +310,5 @@ module.exports = {
   EstError:         EstError,
   JoseError:        JoseError,
   AcmeError:        AcmeError,
+  TrustError:       TrustError,
 };

package/lib/guard-all.js

@@ -21,6 +21,15 @@
 //   guard.range.int / .uint31 / .positiveInt31
 //                                     -- bound a decoded integer before narrowing
 //                                        to Number (silent-narrowing defence)
+//   guard.name.dnEqual / .rdnEqual / .assertNoControlBytes / .assertPrintableIa5
+//                                     -- canonical DN identity + name-string integrity
+//                                        (CVE-2009-2408 truncation / identity defence)
+//   guard.encoding.base64url / .base64 / .hex
+//                                     -- strict textual-encoding decode, canonical
+//                                        + capped (encoding-malleability defence)
+//   guard.identifier.assertCanonicalOid
+//                                     -- canonical dotted-decimal OID string form
+//                                        (canonicalization-divergence defence)
 //
 // Each shape is enforced by a codebase-patterns detector: the characteristic
 // token of a guard (the Buffer.from(x.buffer, byteOffset) re-view, the
@@ -34,6 +43,9 @@ var limits = require("./guard-limits");
 var crypto = require("./guard-crypto");
 var range  = require("./guard-range");
 var name   = require("./guard-name");
+var encoding = require("./guard-encoding");
+var json   = require("./guard-json");
+var identifier = require("./guard-identifier");
 
 module.exports = {
   bytes:  bytes,
@@ -42,4 +54,7 @@ module.exports = {
   crypto: crypto,
   range:  range,
   name:   name,
+  encoding: encoding,
+  json:   json,
+  identifier: identifier,
 };

package/lib/guard-crypto.js

@@ -20,6 +20,12 @@
 // lengths, so the gate must precede it) then a single timingSafeEqual over the
 // equal-length buffers -- both operands are always read, no data-dependent
 // branch. A length mismatch is an honest false, never a throw.
+//
+// Also defends the signature-malleability class (CWE-347 / CWE-20): a signature /
+// MAC / digest BIT STRING with a non-zero unused-bits count is not whole octets,
+// so trailing sub-octet bits let two encodings carry "one" signature. Every RFC
+// 9481/4211/6960/5280 signature output is a whole number of octets, so a value
+// with unusedBits !== 0 fails closed BEFORE its bytes reach a verifier.
 
 var nodeCrypto = require("node:crypto");
 
@@ -31,4 +37,28 @@ function constantTimeEqual(a, b) {
   return a.length === b.length && nodeCrypto.timingSafeEqual(a, b);
 }
 
-module.exports = { constantTimeEqual: constantTimeEqual };
+// isOctetAligned(bitString) -> boolean. True when a decoded BIT STRING (a
+// { bytes, unusedBits } node) is whole octets. For the never-throw verify paths
+// (a boolean/continue verdict) so a malleable signature is skipped, not honored.
+// @enforced-by behavioral -- shares the octet-alignment rule below; a bare
+//   .unusedBits check has legitimate non-signature siblings, so the RED vectors
+//   (a non-octet-aligned signature is skipped / rejected) are the guard.
+function isOctetAligned(bitString) {
+  return !!bitString && bitString.unusedBits === 0;
+}
+
+// assertOctetAligned(bitString, E, code, label) -> bitString | throws E(code,...).
+// The throwing form for a parse boundary: a signature / MAC / digest BIT STRING
+// MUST be octet-aligned, else the malleable value is rejected fail-closed.
+// @enforced-by behavioral -- .unusedBits !== 0 is a per-field RFC rule, and the
+//   same token legitimately tests a DIFFERENT invariant (NamedBitList minimality,
+//   schema-engine assertMinimalNamedBits), so a blanket detector would false-fire;
+//   the RED vectors (a non-octet-aligned signature/digest rejects) are the guard.
+function assertOctetAligned(bitString, E, code, label) {
+  if (!isOctetAligned(bitString)) {
+    throw E(code, (label || "signature") + " BIT STRING must be octet-aligned (0 unused bits)");
+  }
+  return bitString;
+}
+
+module.exports = { constantTimeEqual: constantTimeEqual, isOctetAligned: isOctetAligned, assertOctetAligned: assertOctetAligned };

package/lib/guard-encoding.js

@@ -0,0 +1,90 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. The documented surface is the
+// consumers whose textual-encoding integrity composes this guard (pki.jose
+// base64url, pki.schema.* PEM bodies, pki.webcrypto JWK key material, pki.acme
+// / pki.est transfer encodings).
+//
+// guard-encoding -- strict decode of an untrusted base64 / base64url / hex text
+// to bytes. Node's Buffer.from(x, "base64"|"base64url"|"hex") is LENIENT: it
+// silently drops the first invalid character (and everything after a stray one),
+// accepts non-canonical trailing bits, and tolerates missing/extra padding, so
+// two distinct texts alias one byte string -- or a malformed text decodes to a
+// SHORTER, different value than intended. And it allocates the whole decode
+// before any size is checked. This is CWE-172 (encoding-transformation error) /
+// CWE-20 (canonicalization malleability) + CWE-770 (allocate-before-cap): RFC
+// 4648 sec. 3.5 / sec. 5 and RFC 8555 sec. 6.1 require the UNIQUE canonical
+// encoding. Each decoder here gates the alphabet, rejects an impossible length,
+// enforces the byte cap BEFORE the copy, decodes, and verifies canonicality by a
+// re-encode round-trip -- so a value that is not the one canonical encoding of
+// its bytes fails closed with the caller's typed error.
+//
+// E is the caller's (code, message) typed-error factory; `code` the frozen
+// domain/reason; `label` the field phrase; `maxBytes` an optional decoded-size
+// cap (null/undefined = uncapped, for a PEM cert body already bounded upstream).
+
+var B64URL_ALPHABET = /^[A-Za-z0-9_-]*$/;
+var B64_ALPHABET = /^[A-Za-z0-9+/]*={0,2}$/;
+var HEX_ALPHABET = /^[0-9A-Fa-f]*$/;
+
+// Reject before Buffer.from allocates: a base64 text of N chars decodes to at
+// most floor(N*3/4) bytes, a hex text to N/2.
+function _capBefore(nChars, perByteChars, maxBytes, E, code, label) {
+  if (maxBytes == null) return;   // documented uncapped mode (bounded upstream)
+  // The cap is an authoring input: a NaN / fractional / negative maxBytes makes
+  // the comparison below always false -- the cap silently disabled. Config-time
+  // TypeError instead (null/undefined stays the documented uncapped mode).
+  if (!Number.isInteger(maxBytes) || maxBytes < 0) {
+    throw new TypeError("guard.encoding: maxBytes must be a non-negative integer or null");
+  }
+  if (Math.floor(nChars / perByteChars) > maxBytes) {
+    throw E(code, label + " exceeds the maximum decoded size of " + maxBytes + " bytes");
+  }
+}
+
+// base64url(text, maxBytes, E, code, label) -> Buffer. Unpadded base64url (RFC
+// 4648 sec. 5 / RFC 7515): no "=" padding, no "+"/"/", canonical final char.
+// @enforced-by base64-decode-not-via-guard
+function base64url(text, maxBytes, E, code, label) {
+  if (typeof text !== "string") throw E(code, label + " must be a string");
+  if (!B64URL_ALPHABET.test(text)) throw E(code, label + " is not base64url (padding or a non-alphabet character)");
+  if (text.length % 4 === 1) throw E(code, label + " has an impossible base64url length");
+  _capBefore(text.length * 3, 4, maxBytes, E, code, label);
+  var buf = Buffer.from(text, "base64url");
+  if (buf.toString("base64url") !== text) throw E(code, label + " is not canonical base64url");
+  return buf;
+}
+
+// base64(text, maxBytes, E, code, label) -> Buffer. Padded base64 (RFC 4648
+// sec. 4): whole 4-character groups, canonical padding + trailing bits.
+// @enforced-by base64-decode-not-via-guard
+function base64(text, maxBytes, E, code, label) {
+  if (typeof text !== "string") throw E(code, label + " must be a string");
+  if (!B64_ALPHABET.test(text)) throw E(code, label + " is not base64 (a non-alphabet character)");
+  if (text.length % 4 !== 0) throw E(code, label + " must be whole 4-character base64 groups (RFC 4648 sec. 3.5)");
+  _capBefore(text.length * 3, 4, maxBytes, E, code, label);
+  var buf = Buffer.from(text, "base64");
+  if (buf.toString("base64") !== text) throw E(code, label + " is not canonical base64 (RFC 4648 sec. 3.5)");
+  return buf;
+}
+
+// hex(text, maxBytes, E, code, label) -> Buffer. Even-length hex; canonical via
+// a lower-case re-encode round-trip (RFC 4514 sec. 2.4 hex-string values).
+// @enforced-by behavioral -- the hex Buffer.from token has legitimate non-decode
+//   siblings in the tree (a hard-coded AES-KW IV constant, an internal
+//   parser-emitted canonical serial, an internal BigInt->hex), so a blanket
+//   Buffer.from(x,"hex") detector would false-fire; the RED conformance vectors
+//   (a non-canonical / odd-length / non-hex #hex attribute value rejects) guard it.
+function hex(text, maxBytes, E, code, label) {
+  if (typeof text !== "string") throw E(code, label + " must be a string");
+  if (!HEX_ALPHABET.test(text)) throw E(code, label + " is not hexadecimal");
+  if (text.length % 2 !== 0) throw E(code, label + " must have an even number of hex digits");
+  _capBefore(text.length, 2, maxBytes, E, code, label);
+  var buf = Buffer.from(text, "hex");
+  if (buf.toString("hex") !== text.toLowerCase()) throw E(code, label + " is not canonical hexadecimal");
+  return buf;
+}
+
+module.exports = { base64url: base64url, base64: base64, hex: hex };

package/lib/guard-identifier.js

@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. The documented surface is the
+// consumers whose identifier-string integrity composes this guard (pki.oid
+// name/arc resolution, pki.asn1 OID encoding, pki.path.validate requiredEku /
+// userInitialPolicySet key checking).
+//
+// guard-identifier -- fail-closed canonicalization of the structured-identifier
+// STRINGS the toolkit compares and encodes. An identifier used as a lookup /
+// comparison key must be in one canonical form, or the string form and the
+// decoded form of the same identifier silently disagree.
+//
+// Defends the canonicalization-divergence class (CWE-20): a dotted-decimal OID
+// with a leading-zero arc ("2.05.29.15") round-trips to a DIFFERENT OID
+// ("2.5.29.15"), and an arc outside the X.660 bounds can never DER-encode at all.
+// A hand-rolled string check that accepts either lets `build.oid` emit bytes that
+// decode to a different OID than the string names, or lets a non-canonical policy /
+// EKU key compare unequal to the canonical decoder output it is matched against (a
+// silent false-reject). Every string-form identifier check routes through here so
+// the string and DER forms cannot diverge.
+
+// assertCanonicalOid(str, E, code, label, boundsCode) -> str | throws
+// A canonical dotted-decimal object identifier string: two or more arcs, each a
+// non-negative decimal integer with no leading zero (the SYNTAX), and -- unless
+// bounds are waived -- the root arc 0..2 with the second arc 0..39 under roots 0
+// and 1 (the X.660 ENCODABILITY bounds: the first two arcs pack into a single
+// sub-identifier as 40*root+second). E is the (code, message) typed-error factory:
+//   - a syntax fault always throws E(code, ...).
+//   - boundsCode === null waives the arc-bound check -- for a LOOKUP key (oid.name
+//     / oid.has), where a well-formed but non-encodable OID is simply not
+//     registered (a miss), not an error.
+//   - otherwise an out-of-range arc throws E(boundsCode, ...) (boundsCode defaults
+//     to code), so a caller distinguishing the two reasons (oid.js: oid/bad-input
+//     syntax vs oid/bad-arc bounds) keeps both codes.
+// @enforced-by behavioral -- string-form OID canonicalization has no rename-proof
+//   code shape distinct from the arc-based bounds check oid.js legitimately keeps
+//   for the arc path; the divergence RED vectors (build.oid / oid.toArcs / requiredEku
+//   reject a non-canonical OID) driving the composing consumers are the guard.
+function assertCanonicalOid(str, E, code, label, boundsCode) {
+  var who = label || "OID";
+  if (typeof str !== "string" || !/^(0|[1-9]\d*)(\.(0|[1-9]\d*))+$/.test(str)) {
+    throw E(code, who + " must be a canonical dotted-decimal OID string of two or more arcs with no leading-zero component");
+  }
+  if (boundsCode === null) return str;
+  var bcode = boundsCode === undefined ? code : boundsCode;
+  var parts = str.split(".");
+  var root = BigInt(parts[0]);
+  var second = BigInt(parts[1]);
+  if (root > 2n) throw E(bcode, who + " root arc must be 0, 1, or 2 (X.660)");
+  if (root < 2n && second > 39n) throw E(bcode, who + " second arc must be 0..39 under roots 0 and 1 (X.660)");
+  return str;
+}
+
+module.exports = { assertCanonicalOid: assertCanonicalOid };