@blamejs/pki 0.2.2 → 0.2.4

package/CHANGELOG.md

@@ -4,7 +4,24 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## v0.2.2 — 2026-07-12
+## v0.2.4 — 2026-07-12
+
+Human-readable certificate inspection joins the toolkit as pki.inspect.
+
+### Added
+
+- pki.inspect.certificate(input) renders a certificate (a PEM string, a DER Buffer, or a pki.schema.x509.parse result) as a human-readable OpenSSL-x509-text-style report, composed over the strict X.509 parser, the shared RFC 5280 extension decoders, and the two-way OID registry. Standard extensions (basic constraints, key usage, extended key usage with purpose names, subject/issuer alternative names, subject and authority key identifiers, and more) decode to their content; an extension with no decoder is named from the registry and shown as its string or a hex dump. A value that is not a certificate, DER, or PEM throws inspect/bad-input; malformed certificate bytes throw inspect/bad-certificate; a malformed single extension never sinks the report. The error taxonomy gains InspectError (inspect/*). RFC 5280.
+
+## v0.2.3 — 2026-07-12
+
+Offline Sigstore bundle verification joins the toolkit as pki.sigstore.
+
+### Added
+
+- pki.sigstore.verifyBundle(bundle, opts) verifies a Sigstore bundle offline against caller-supplied trust material (opts.fulcioRoots, the Fulcio CA certificates; opts.rekorKeys, the Rekor log public keys, each with an optional validFor window honored against the log time so a rotated-out key is not used; optional opts.identity policy and opts.time). It returns { verified: true, payload, statement, subjects, predicateType, predicate, identity, integratedTime } on success -- payload being the raw verified envelope bytes, never a re-serialization -- and throws a typed sigstore/* error on any leg's failure. The transparency-log entry is bound to both the bundle signature and its leaf certificate, and only the v0.1-v0.3 bundle versions this release verifies are accepted (a newer version is recognized and deferred). pki.sigstore.parseBundle(input) decodes and structurally validates a bundle (object, JSON string, or Buffer) fail-closed. pki.sigstore.pae(payloadType, payloadBytes) builds the DSSE Pre-Authentication Encoding a signature covers. DSSE / Sigstore bundle v0.3 / RFC 9162 / SLSA provenance v1.
+- The OID registry gains the Fulcio (Sigstore) certificate-extension arc 1.3.6.1.4.1.57264.1.* (the OIDC issuer, build-signer and source-repository identity claims), honoring the raw-string-vs-DER-UTF8String encoding split by member. The error taxonomy gains SigstoreError (sigstore/*): a malformed or oversize bundle (sigstore/bad-bundle), an unknown media type (sigstore/bad-bundle-version), an unsupported content arm (sigstore/unsupported-content), a DSSE signature that does not verify under the Fulcio leaf key (sigstore/dsse-verify-failed), an inclusion proof that does not reconstruct the tree root (sigstore/inclusion-proof-mismatch) or is malformed (sigstore/bad-inclusion-proof), a tree root not attested by the Rekor key (sigstore/unsigned-root), a log time not attested by the Rekor SET that signs it (sigstore/unattested-time, so an attacker cannot backdate the ephemeral Fulcio certificate into validity), a Fulcio chain that does not terminate at a caller-supplied trust anchor (sigstore/chain-incomplete) or fails validation as of the log time (sigstore/chain-invalid), an undecodable certificate identity (sigstore/bad-certificate), a malformed transparency-log entry (sigstore/bad-tlog-entry), a log entry that does not bind this signature (sigstore/entry-mismatch), an identity that fails the caller policy (sigstore/identity-mismatch), a payload that is not the expected in-toto statement (sigstore/bad-statement), and a predicateType that does not match a caller-pinned one (sigstore/predicate-mismatch). Fulcio CA anchors and Rekor keys honor their trusted-root validity windows so a rotated-out key or CA is not used, and every anchor sharing a subject DN is tried.
+
+## v0.2.2 — 2026-07-11
 
 Hybrid Public Key Encryption (RFC 9180) joins the toolkit as pki.hpke.
 

package/README.md

@@ -226,6 +226,8 @@ is callable today; nothing below is a stub.
 | `pki.trust` | Mozilla / CCADB trust-store ingestion — `parseCertdata` reads the NSS `certdata.txt` object stream and `parseCcadbCsv` the CCADB CSV export into one identical constraint-carrying anchor shape: the per-purpose trust bits (only `CKT_NSS_TRUSTED_DELEGATOR` grants) and the per-purpose distrust-after dates the bare root list omits. Certificate and trust objects pair by byte-exact issuer + serial (never adjacency) and are cross-checked against the parsed DER, so metadata can never attach to the wrong root; `anchor()` hands an entry to `pki.path.validate({ trustAnchor, checkPurpose })`. Offline, fail-closed, bounded — `parseCertdata`, `parseCcadbCsv`, `anchor` |
 | `pki.shbs` | Stateful hash-based signature **verification** — HSS/LMS (RFC 8554), carried in X.509 by RFC 9802 and CMS by RFC 9708, profiled by NIST SP 800-208 (CNSA 2.0 firmware signing). `verify` checks an HSS signature (every level must pass) and `verifyLms` a single-tree LMS, over the raw public-key / signature blobs the parsers already surface. Pure public-input SHA-256 / SHAKE256 hashing, a data-driven typecode registry, bounds-before-slice reads; a malformed blob throws a typed `ShbsError`, a well-formed-but-wrong signature returns `false`. **Verify only by design** — stateful signing needs atomic one-time-key state that belongs in an HSM — `verify`, `verifyLms` |
 | `pki.hpke` | Hybrid Public Key Encryption (RFC 9180) — the encrypt-to-a-public-key primitive behind TLS ECH, MLS, and OHTTP. `setupS`/`setupR` establish a sender/recipient context (KEM encapsulation + HKDF key schedule); the context's `seal`/`open` AEAD-encrypt with a sequence-counter nonce and `export` derives further secrets; `seal`/`open` are single-shot wrappers. DHKEM (P-256, P-521, X25519, X448) × HKDF-SHA256/SHA512 × AES-GCM/ChaCha20Poly1305/export-only × all four modes, proven against the RFC 9180 Appendix A vectors. DHKEM(P-384) and HKDF-SHA384 are RFC-registered but Appendix A ships no vector for them, so they fail closed until an authoritative KAT exists. Pure composition over `node:crypto`; ML-KEM / X-Wing are a registry data-row extension pending stable drafts — `suites`, `setupS`, `setupR`, `seal`, `open` |
+| `pki.sigstore` | Offline verifier for a Sigstore bundle — the exact artifact `npm publish --provenance` produces and the registry serves. `verifyBundle` composes five fail-closed legs against caller-pinned trust (Fulcio CA roots + Rekor log keys, never trusted from the bundle): the DSSE signature over its PAE preimage under the Fulcio leaf key; the ephemeral Fulcio certificate chain, validated as of the Rekor log time; the RFC 9162 inclusion proof folded to a Rekor-signed tree root; the log entry bound to this exact signature; and the in-toto SLSA subject digest the caller confirms against the published artifact. Zero runtime deps — reuses the X.509 parser, RFC 5280 path validator, and Merkle verifier; the net-new codecs are the DSSE PAE byte-builder and a fail-closed JSON reader. `pae`, `parseBundle`, `verifyBundle` |
+| `pki.inspect` | Human-readable certificate inspection — the pure-JS equivalent of `openssl x509 -text`. `certificate(pem | der | parsed)` renders a familiar OpenSSL-style report: version, serial, signature algorithm, issuer/subject distinguished names, validity, public-key details (curve or modulus size + the raw point/modulus), every decoded extension with its critical flag, and the signature. Built over the strict parser and the two-way OID registry, so it names extension and algorithm OIDs an OpenSSL build shows only as raw bytes. No OpenSSL dependency; the format is stable and OpenSSL-familiar rather than pinned to one OpenSSL version; a malformed extension falls back to a hex dump rather than throwing — `certificate` |
 | `pki.C` / `pki.constants` | Version-stable constants — functional scale helpers (`C.TIME.*`, `C.BYTES.*`), codec `LIMITS`, `version` |
 | `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError` / `Asn1Error` / `OidError` / `PemError` / `CertificateError` / `CrlError` / `CsrError` / `Pkcs8Error` / `CmsError` / `OcspError` / `TspError` / `AttrCertError` / `CrmfError` / `Pkcs12Error` / `CmpError` / `PathError` / `CtError` / `JoseError` / `AcmeError`, each carrying a stable `code` in `domain/reason` form |
 | `pki` CLI | `pki version`, `pki oid <dotted\|name>`, `pki parse <cert>` |
@@ -261,34 +263,42 @@ reintroduce the bug class it prevents. Adding a format is a schema declaration
 plus a documentation comment block, not new parse logic.
 
 ```
-┌─ Detect + route ────────────────────────────────────────────────────────┐
-│  pki.schema.parse — inspect the DER root, route to the matching sibling │
-└─────────────────────────────────────────────────────────────────────────┘
+┌─ Detect + route ─────────────────────────────────────────────────────────┐
+│ pki.schema.parse — inspect the DER root, route to the matching sibling   │
+└──────────────────────────────────────────────────────────────────────────┘
                                      │
- ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐   Format
- │  x509  │ │  crl   │ │  csr   │ │ pkcs8  │   parsers
- └────────┘ └────────┘ └────────┘ └────────┘   (siblings)
  ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐
- │  cms   │ │  ocsp  │ │  tsp   │ │attrcert│
+ │  x509  │ │  crl   │ │  csr   │ │ pkcs8  │
  └────────┘ └────────┘ └────────┘ └────────┘
-                                     │  every sibling composes ↓
-┌─ Shared structure ──────────────────────────────────────────────────────┐
-│  pki.schema.engine — walk + combinators (positional reads, tag order,   │
-│  SET-OF uniqueness, arity, typed errors) · the PKIX sub-schemas —       │
-│  AlgorithmIdentifier · Name · Extension · a bounded version reader —    │
-│  and the one coerce → decode → walk parse-entry (PEM cap + DER wrap).   │
-└─────────────────────────────────────────────────────────────────────────┘
+ ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐
+ │  cms   │ │  ocsp  │ │  tsp   │ │  crmf  │
+ └────────┘ └────────┘ └────────┘ └────────┘
+ ┌────────┐ ┌────────┐ ┌────────┐ ┌────────┐
+ │ pkcs12 │ │  cmp   │ │ smime  │ │attrcert│
+ └────────┘ └────────┘ └────────┘ └────────┘
+                                     │  routed DER format parsers (siblings)
+┌─ Protocols · trust · supply chain  (reached by explicit call) ───────────┐
+│ pki.path RFC 5280 · pki.trust anchors · pki.ct SCTs · pki.hpke RFC 9180  │
+│ pki.shbs HSS/LMS · pki.merkle RFC 9162 · pki.sigstore npm provenance     │
+│ pki.jose · pki.acme · pki.est — compose the layers below directly.       │
+└──────────────────────────────────────────────────────────────────────────┘
+                                     │  every module composes ↓
+┌─ Shared structure ───────────────────────────────────────────────────────┐
+│ pki.schema.engine — walk + combinators (positional reads, tag order,     │
+│ SET-OF uniqueness, typed errors) · the PKIX sub-schemas · and the        │
+│ guard family (guard-*) — one fail-closed choke point per CVE class.      │
+└──────────────────────────────────────────────────────────────────────────┘
                                      │  built on ↓
-┌─ Foundation ────────────────────────────────────────────────────────────┐
-│  pki.asn1 — strict, bounded DER codec · pki.oid — two-way, PQC-seeded   │
-│  OID registry · pki.errors — the PkiError domain/reason taxonomy ·      │
-│  pki.C — version-stable LIMITS + scale constants.                       │
-└─────────────────────────────────────────────────────────────────────────┘
-
-┌─ Crypto ────────────────────────────────────────────────────────────────┐
-│  pki.webcrypto ──▶ node:crypto — a W3C SubtleCrypto engine: the         │
-│  classical set + post-quantum ML-DSA / SLH-DSA + ML-KEM key generation. │
-└─────────────────────────────────────────────────────────────────────────┘
+┌─ Foundation ─────────────────────────────────────────────────────────────┐
+│ pki.asn1 — strict bounded DER codec · pki.cbor — deterministic CBOR ·    │
+│ pki.oid — two-way PQC-seeded registry · pki.errors — PkiError taxonomy   │
+│ · pki.C — version-stable LIMITS + scale constants.                       │
+└──────────────────────────────────────────────────────────────────────────┘
+
+┌─ Crypto ─────────────────────────────────────────────────────────────────┐
+│ pki.webcrypto ─▶ node:crypto — a W3C SubtleCrypto engine: the            │
+│ classical set + post-quantum ML-DSA / SLH-DSA + ML-KEM key generation.   │
+└──────────────────────────────────────────────────────────────────────────┘
 ```
 
 **Foundation.** The strict, bounded DER codec (`pki.asn1`), the two-way OID
@@ -302,12 +312,24 @@ bounded version reader, and the single coerce → decode → walk parse-entry th
 every format's `parse` is bound to. Because input coercion, the PEM size cap, and
 the DER-decode wrapping live here once, a format cannot diverge on a guard.
 
-**Format parsers.** `x509`, `crl`, `csr`, `pkcs8`, `cms`, `ocsp`, `tsp`, and `attrcert` are siblings:
-each is a schema declaration composed from the shared pieces, emitting its own
-typed `domain/reason` error codes. `pki.schema.parse` inspects a decoded root and
+**Format parsers.** `x509`, `crl`, `csr`, `pkcs8`, `cms`, `ocsp`, `tsp`, `attrcert`,
+`crmf`, `pkcs12`, `cmp`, `smime`, and `csrattrs` are siblings: each is a schema
+declaration composed from the shared pieces, emitting its own typed
+`domain/reason` error codes. `pki.schema.parse` inspects a decoded root and
 detect-and-routes to the matching sibling; the detectors are mutually exclusive by
 construction, so routing is unambiguous regardless of registration order.
 
+**Protocols, trust, and supply chain.** Above the format parsers sit the domain
+modules reached by explicit call rather than DER routing: `pki.path` (RFC 5280
+path validation), `pki.trust` (trust anchors), `pki.ct` (Certificate Transparency
+SCTs), `pki.hpke` (RFC 9180), `pki.shbs` (HSS/LMS stateful hash signatures),
+`pki.merkle` (RFC 9162 transparency proofs), `pki.sigstore` (offline npm-provenance
+verification), and the `jose` / `acme` / `est` enrollment surfaces. Each composes
+the shared structure, foundation, and crypto layers directly. Alongside the schema
+engine, the fail-closed **guard family** (`guard-*`) centralizes each CVE-class
+defense — detached-buffer re-view, resource caps, constant-time compares,
+canonical-DN comparison — as one choke point a format cannot re-inline.
+
 **Crypto.** `pki.webcrypto` is a W3C `SubtleCrypto` engine over `node:crypto`,
 carrying the classical suite plus post-quantum ML-DSA / SLH-DSA signatures and
 ML-KEM key generation. Sign/verify resolves algorithms through the same OID

package/index.js

@@ -39,10 +39,12 @@ var ct        = require("./lib/ct");
 var merkle    = require("./lib/merkle");
 var shbs      = require("./lib/shbs");
 var hpke      = require("./lib/hpke");
+var sigstore  = require("./lib/sigstore");
 var est        = require("./lib/est");
 var jose       = require("./lib/jose");
 var acme       = require("./lib/acme");
 var trust      = require("./lib/trust");
+var inspect    = require("./lib/inspect");
 
 module.exports = {
   version:   constants.version,
@@ -84,6 +86,10 @@ module.exports = {
   // schedule + AEAD context construction behind TLS ECH / MLS / OHTTP. Pure
   // composition over node:crypto; the classical DHKEM suites, all four modes.
   hpke:      hpke,
+  // `sigstore` verifies a Sigstore bundle (the npm --provenance artifact): a
+  // keyless Fulcio signature over a DSSE-wrapped in-toto SLSA attestation with a
+  // Rekor inclusion proof -- offline, zero-dep, against caller-pinned trust.
+  sigstore:  sigstore,
   // `est` is RFC 7030 / 8951 / 9908 Enrollment over Secure Transport -- the
   // transport-agnostic client codecs (base64 transfer, multipart splitter),
   // certs-only + serverkeygen validators over CMS, the enroll-attribute builders,
@@ -105,6 +111,11 @@ module.exports = {
   // root list omits); pki.trust.anchor hands one to pki.path.validate. Offline:
   // the operator supplies the text; no fetch.
   trust:     trust,
+  // `inspect` is human-readable inspection -- pki.inspect.certificate(pem|der|parsed)
+  // renders an OpenSSL-familiar `x509 -text`-style report from the strict parser +
+  // OID registry, naming extension/algorithm OIDs OpenSSL shows only as raw bytes.
+  // Pure, no OpenSSL dependency; best-effort (a bad extension falls back to hex).
+  inspect:   inspect,
   // A ready W3C Crypto instance (globalThis.crypto shape) with the classes for
   // constructing more attached under the same namespace (pki.webcrypto.CryptoKey,
   // .SubtleCrypto, .Crypto, .WebCryptoError). PQC-first, classical-capable, zero-dep.

package/lib/constants.js

@@ -257,6 +257,101 @@ var LIMITS = {
   TRUST_MAX_CSV_FIELD_BYTES: BYTES.kib(64),
 };
 
+// NAMES -- display-naming conventions shared by the human-readable renderers
+// (pki.inspect today; a future lint / CLI report tomorrow). Centralized so every
+// consumer speaks ONE convention -- the OpenSSL-familiar labels an operator expects
+// -- rather than each renderer copying a table that silently drifts. These are
+// DISPLAY strings, not wire identifiers (those resolve through pki.oid): a value here
+// never affects parse or verify, only how a decoded field is titled in a report.
+var NAMES = {
+  // ==== Distinguished-name attribute short names (RFC 4514 sec. 3 + RFC 4519 / CABF) ==
+  // The single source of truth: this table was previously copied in both
+  // lib/inspect.js and lib/schema-pkix.js and had already drifted (STREET vs street,
+  // SERIALNUMBER vs serialNumber). An entry whose type the OID registry does not yet
+  // resolve is simply never hit -- forward entries (jurisdiction*, organizationIdentifier)
+  // are harmless until their arc is registered.
+  DN_SHORT: {
+    commonName: "CN", surname: "SN", serialNumber: "SERIALNUMBER", countryName: "C",
+    localityName: "L", stateOrProvinceName: "ST", streetAddress: "STREET",
+    organizationName: "O", organizationalUnitName: "OU", title: "title", givenName: "GN",
+    initials: "initials", generationQualifier: "generationQualifier", distinguishedNameQualifier: "dnQualifier",
+    pseudonym: "pseudonym", domainComponent: "DC", userId: "UID", emailAddress: "emailAddress",
+    businessCategory: "businessCategory", postalCode: "postalCode", name: "name",
+    jurisdictionCountryName: "jurisdictionC", jurisdictionStateOrProvinceName: "jurisdictionST",
+    jurisdictionLocalityName: "jurisdictionL", organizationIdentifier: "organizationIdentifier",
+  },
+  // ==== X.509v3 extension section titles (OpenSSL-familiar); an extension absent
+  // here is titled from the OID registry name / dotted OID ====
+  EXTENSION: {
+    basicConstraints: "X509v3 Basic Constraints", keyUsage: "X509v3 Key Usage",
+    extKeyUsage: "X509v3 Extended Key Usage", subjectAltName: "X509v3 Subject Alternative Name",
+    issuerAltName: "X509v3 Issuer Alternative Name", subjectKeyIdentifier: "X509v3 Subject Key Identifier",
+    authorityKeyIdentifier: "X509v3 Authority Key Identifier", certificatePolicies: "X509v3 Certificate Policies",
+    policyMappings: "X509v3 Policy Mappings", policyConstraints: "X509v3 Policy Constraints",
+    inhibitAnyPolicy: "X509v3 Inhibit Any Policy", nameConstraints: "X509v3 Name Constraints",
+    cRLDistributionPoints: "X509v3 CRL Distribution Points", freshestCRL: "X509v3 Freshest CRL",
+    subjectInfoAccess: "Subject Information Access", authorityInfoAccess: "Authority Information Access",
+    cRLNumber: "X509v3 CRL Number", deltaCRLIndicator: "X509v3 Delta CRL Indicator",
+    issuingDistributionPoint: "X509v3 Issuing Distribution Point", cRLReason: "X509v3 CRL Reason Code",
+    invalidityDate: "Invalidity Date", certificateIssuer: "X509v3 Certificate Issuer",
+    signedCertificateTimestampList: "CT Precertificate SCTs", precertificatePoison: "CT Precertificate Poison",
+  },
+  // ==== KeyUsage bits (RFC 5280 sec. 4.2.1.3, bit order) ====
+  KEY_USAGE: {
+    digitalSignature: "Digital Signature", nonRepudiation: "Non Repudiation", keyEncipherment: "Key Encipherment",
+    dataEncipherment: "Data Encipherment", keyAgreement: "Key Agreement", keyCertSign: "Certificate Sign",
+    cRLSign: "CRL Sign", encipherOnly: "Encipher Only", decipherOnly: "Decipher Only",
+  },
+  // ==== ExtendedKeyUsage purposes (RFC 5280 sec. 4.2.1.12 + common); an unlisted
+  // purpose shows its registry name / OID ====
+  EXT_KEY_USAGE: {
+    anyExtendedKeyUsage: "Any Extended Key Usage", serverAuth: "TLS Web Server Authentication",
+    clientAuth: "TLS Web Client Authentication", codeSigning: "Code Signing",
+    emailProtection: "E-mail Protection", timeStamping: "Time Stamping", ocspSigning: "OCSP Signing",
+  },
+  // ==== GeneralName CHOICE labels, by context tag number (RFC 5280 sec. 4.2.1.6) ====
+  GENERAL_NAME: { 0: "othername", 1: "email", 2: "DNS", 3: "X400Name", 4: "DirName", 5: "EdiPartyName", 6: "URI", 7: "IP Address", 8: "Registered ID" },
+  // ==== Named-curve -> NIST alias, for the EC key line ====
+  NIST_CURVE: { prime256v1: "P-256", secp384r1: "P-384", secp521r1: "P-521" },
+  // ==== ReasonFlags BIT STRING bit -> name (RFC 5280 sec. 4.2.1.13, a CRL
+  // distribution point's revocation scope; bit 0 is "unused"). Distinct from the
+  // CRLReason ENUMERATED below -- a BIT STRING of scopes, not a single code. ====
+  REASON_FLAGS: {
+    1: "Key Compromise", 2: "CA Compromise", 3: "Affiliation Changed", 4: "Superseded",
+    5: "Cessation Of Operation", 6: "Certificate Hold", 7: "Privilege Withdrawn", 8: "AA Compromise",
+  },
+  // ==== CRLReason ENUMERATED value names (RFC 5280 sec. 5.3.1; value 7 is unused) ====
+  CRL_REASON: {
+    "0": "unspecified", "1": "keyCompromise", "2": "cACompromise", "3": "affiliationChanged",
+    "4": "superseded", "5": "cessationOfOperation", "6": "certificateHold",
+    "8": "removeFromCRL", "9": "privilegeWithdrawn", "10": "aACompromise",
+  },
+  // ==== OCSPResponseStatus value names (RFC 6960 sec. 4.2.1; value 4 is unassigned) ====
+  OCSP_STATUS: { "0": "successful", "1": "malformedRequest", "2": "internalError", "3": "tryLater", "5": "sigRequired", "6": "unauthorized" },
+  // ==== Attribute-cert objectDigestInfo digested-object types (RFC 5755 sec. 4.4.2) ====
+  OBJECT_DIGEST_TYPE: { "0": "publicKey", "1": "publicKeyCert", "2": "otherObjectTypes" },
+  // ==== Public-key / signature algorithm display names, classical + PQC. Forward-
+  // looking: the toolkit is PQC-first, so the FIPS 203/204/205 names render as-is;
+  // a consumer that finds no entry shows the OID registry name / dotted OID ====
+  ALGORITHM: {
+    rsaEncryption: "rsaEncryption", rsassaPss: "rsassaPss", rsaesOaep: "rsaesOaep", ecPublicKey: "id-ecPublicKey",
+    ed25519: "ED25519", ed448: "ED448", x25519: "X25519", x448: "X448",
+    "ML-DSA-44": "ML-DSA-44", "ML-DSA-65": "ML-DSA-65", "ML-DSA-87": "ML-DSA-87",
+    "ML-KEM-512": "ML-KEM-512", "ML-KEM-768": "ML-KEM-768", "ML-KEM-1024": "ML-KEM-1024",
+    "SLH-DSA-SHA2-128s": "SLH-DSA-SHA2-128s", "SLH-DSA-SHA2-128f": "SLH-DSA-SHA2-128f",
+    "SLH-DSA-SHA2-192s": "SLH-DSA-SHA2-192s", "SLH-DSA-SHA2-256s": "SLH-DSA-SHA2-256s",
+  },
+};
+
+// NAMES is BOTH a display table (pki.inspect) and the strict parsers' legal-value
+// allow-list: the CRL reasonCode, OCSP response-status, and attribute-cert object-
+// digest decoders check membership against CRL_REASON / OCSP_STATUS / OBJECT_DIGEST_TYPE
+// to fail closed on an RFC-reserved / undefined value. Deep-freeze it so a caller can
+// NEVER widen what those decoders accept by mutating the "display-only" table (e.g.
+// adding CRLReason 7, RFC-reserved, which would otherwise make the decoders fail open).
+Object.keys(NAMES).forEach(function (k) { Object.freeze(NAMES[k]); });
+Object.freeze(NAMES);
+
 // Single-sourced from the package manifest so the reported version can
 // never drift from the published package (package.json is always present
 // in the installed tarball). A hand-maintained literal here silently
@@ -267,5 +362,6 @@ module.exports = {
   TIME:    TIME,
   BYTES:   BYTES,
   LIMITS:  LIMITS,
+  NAMES:   NAMES,
   version: VERSION,
 };

package/lib/framework-error.js

@@ -283,6 +283,21 @@ var AcmeError = defineClass("AcmeError", { withCause: true });
 var TrustError = defineClass("TrustError", { withCause: true });
 var ShbsError = defineClass("ShbsError", { withCause: true });
 var HpkeError = defineClass("HpkeError", { withCause: true });
+// SigstoreError -- a Sigstore bundle (npm --provenance artifact) that is not a
+// well-formed / verifiable keyless signature: a malformed or oversize JSON
+// bundle, an unknown media type or content arm, a DSSE envelope missing a
+// required field or whose signature does not verify under the Fulcio leaf key, a
+// Rekor inclusion proof that does not reconstruct the signed tree root, an
+// unsigned/attacker-supplied root, an entry that does not bind this signature, a
+// Fulcio identity that fails the caller policy, or a payload that is not the
+// expected in-toto Statement. Carries the underlying leaf fault (an x509/*,
+// merkle/*, or asn1/* error) as `.cause`.
+var SigstoreError = defineClass("SigstoreError", { withCause: true });
+// InspectError -- a bad input to the human-readable inspector (pki.inspect): a
+// value that is neither a parsed structure, DER Buffer, nor PEM string, or a PEM
+// whose label does not decode. Rendering itself is best-effort and never throws on
+// a malformed field -- an undecodable extension falls back to a hex dump.
+var InspectError = defineClass("InspectError", { withCause: true });
 
 module.exports = {
   PkiError:         PkiError,
@@ -308,6 +323,8 @@ module.exports = {
   CtError:          CtError,
   ShbsError:        ShbsError,
   HpkeError:        HpkeError,
+  SigstoreError:    SigstoreError,
+  InspectError:     InspectError,
   MerkleError:      MerkleError,
   SmimeError:       SmimeError,
   CsrattrsError:    CsrattrsError,

package/lib/guard-all.js

@@ -23,6 +23,8 @@
 //                                        to Number (silent-narrowing defence)
 //   guard.name.dnEqual / .rdnEqual / .assertNoControlBytes / .assertPrintableIa5
 //                                     -- canonical DN identity + name-string integrity
+//   guard.name.escapeControlBytes / .escapeDnValue
+//                                     -- render-side name safety: control-byte + RFC 4514 escaping
 //                                        (CVE-2009-2408 truncation / identity defence)
 //   guard.encoding.base64url / .base64 / .hex
 //                                     -- strict textual-encoding decode, canonical

package/lib/guard-name.js

@@ -108,4 +108,53 @@ function dnEqual(rdnsA, rdnsB, E, code, label) {
   return true;
 }
 
-module.exports = { assertNoControlBytes: assertNoControlBytes, assertPrintableIa5: assertPrintableIa5, dnEqual: dnEqual, rdnEqual: rdnEqual };
+// escapeControlBytes(str) -> str. The render-side sibling of assertNoControlBytes:
+// where a name string must still be DISPLAYED best-effort (a human-readable report,
+// a log line) rather than rejected, neutralize every C0 control byte and DEL by
+// rendering it as \xHH. A bare CR / LF / NUL in a decoded dNSName or DN value would
+// otherwise forge or overwrite report lines in a terminal or log (CWE-117 output-log
+// injection / CWE-116 improper output encoding). Non-control bytes pass through.
+// Written as a charCodeAt scan, not a /[\x00-\x1f]/ regex: eslint's no-control-regex
+// (correctly) refuses control characters in a regex literal, and the control-byte
+// range test is the rename-proof shape the detector keys on regardless.
+// @enforced-by guard-shape-reinlined
+// @guard-shape < 0x20 \|\| \w+ === 0x7f
+function escapeControlBytes(str) {
+  var s = String(str), out = "";
+  for (var i = 0; i < s.length; i++) {
+    var c = s.charCodeAt(i);
+    out += (c < 0x20 || c === 0x7f) ? "\\x" + (c < 16 ? "0" : "") + c.toString(16).toUpperCase() : s.charAt(i);
+  }
+  return out;
+}
+
+// escapeDnValue(v) -> str. RFC 4514 sec. 2.4 string-representation escaping of a DN
+// attribute value (the input is the already-unwrapped semantic string): backslash-
+// escape the always-specials , + " \ < > ; and a NUL (as \00), then the positional
+// rules -- a trailing space as '\ ' and a leading '#' or space as '\#' / '\ '. Without
+// this a value like `foo, CN=admin` renders as two RDNs, and a literal `#05` collides
+// with the hexstring form, so the report misstates a subject/issuer name (CWE-116).
+// The one place a DN attribute value is made display-safe; pki.schema.pkix's DN
+// rendering composes it, and pki.inspect reuses that parser output (name.dn).
+// @enforced-by behavioral -- the RFC 4514 separator class carries a quote inside a
+//   regex literal, which the codebase-patterns literal-stripper mis-tokenizes, so no
+//   rename-proof shape is detectable; the guard-name RED vectors + the schema-pkix DN
+//   round-trip vectors (a comma / plus / leading '#' renders backslash-escaped) are the guard.
+function escapeDnValue(v) {
+  var s = String(v).replace(/([,+"\\<>;])/g, "\\$1"), out = "";
+  // RFC 4514 sec. 2.4: a NUL / control octet -> '\' + two hex digits, so an embedded
+  // CR / LF / NUL in a decoded DN value can never forge a report line when displayed.
+  for (var i = 0; i < s.length; i++) {
+    var c = s.charCodeAt(i);
+    out += (c < 0x20 || c === 0x7f) ? "\\" + (c < 16 ? "0" : "") + c.toString(16).toUpperCase() : s.charAt(i);
+  }
+  if (out.length && out.charAt(out.length - 1) === " ") out = out.slice(0, -1) + "\\ ";
+  if (out.charAt(0) === "#" || out.charAt(0) === " ") out = "\\" + out;
+  return out;
+}
+
+module.exports = {
+  assertNoControlBytes: assertNoControlBytes, assertPrintableIa5: assertPrintableIa5,
+  dnEqual: dnEqual, rdnEqual: rdnEqual,
+  escapeControlBytes: escapeControlBytes, escapeDnValue: escapeDnValue,
+};