@blamejs/pki 0.2.28 → 0.2.30

package/CHANGELOG.md

@@ -4,6 +4,26 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.2.30 — 2026-07-16
+
+C509 CBOR-encoded certificates arrive as pki.schema.c509.parse: decode the compact CBOR profile of X.509 in both its natively-signed and X.509-re-encoded forms, reconstructing the original DER byte-for-byte so the original signature still verifies.
+
+### Added
+
+- pki.schema.c509.parse(bytes) decodes a C509 CBOR-encoded certificate (draft-ietf-cose-cbor-encoded-cert) into structured, validated fields. It reads both certificate forms -- natively-signed (c509CertificateType 2) and the CBOR re-encoding of a DER X.509 v3 certificate (type 3) -- over the strict deterministic-CBOR codec, fail-closed. For a type-3 certificate it reconstructs the original DER byte-for-byte (de-compressing the EC point, re-emitting each field as canonical DER, re-wrapping the ECDSA signature) so the original signature verifies and the certificate round-trips through pki.schema.x509.parse; a field it cannot invert byte-exactly fails closed. It decodes CBOR, not DER, so it is an explicit-call surface and is not auto-routed by pki.schema.parse.
+
+### Fixed
+
+- Certification-path validation now rejects a trust anchor whose per-purpose distrust-after date is an invalid Date at input (path/bad-input). Previously a malformed date value passed the Date type check but compared as not-a-number, silently disabling the distrust-after restriction it was meant to enforce.
+
+## v0.2.29 — 2026-07-16
+
+Certificate Transparency log-list signature verification arrives as pki.ct.verifyLogListSignature: verify the detached signature published alongside the CT log list against a caller-pinned signer key, completing the offline log-list trust chain.
+
+### Added
+
+- pki.ct.verifyLogListSignature(json, signature, publicKey) verifies the detached signature over the Certificate Transparency log list (log_list.sig over log_list.json). The message is the raw json bytes, verified byte-for-byte with no canonicalization; publicKey is the caller-pinned signer SubjectPublicKeyInfo (there is no embedded key). The scheme is RSASSA-PKCS1-v1.5 with SHA-256 (an EC P-256 arm is accepted for future-proofing). It resolves true or false (a cryptographic verdict) and throws a typed CtError on a forgeable or unsupported key (an RSA exponent below 3, a sub-2048-bit RSA key, an unsupported key type or curve, a non-conformant ECDSA DER signature). Its verdict is cross-checked against OpenSSL's dgst -verify. Paired with pki.ct.parseLogList, this completes the offline CT log-list trust chain.
+
 ## v0.2.28 — 2026-07-16
 
 The Certificate Transparency log-list trust surface arrives as pki.ct.parseLogList and pki.ct.verifySctWithLogList: resolve a trusted CT log's key from an SCT's log id and verify it in one step, ingesting the CT log-list JSON into state- and temporal-interval-constrained trusted logs.

package/README.md

@@ -204,6 +204,7 @@ is callable today; nothing below is a stub.
 | `pki.webcrypto` | A W3C WebCrypto (`SubtleCrypto`) engine over `node:crypto` — `sign`/`verify`/`encrypt`/`decrypt`/`deriveBits`/`digest`/`generateKey`/`importKey`/`exportKey` across RSA, ECDSA, ECDH, Ed25519/Ed448, AES, HMAC, HKDF, PBKDF2, SHA — **and** post-quantum ML-DSA-44/65/87 and SLH-DSA signatures, plus ML-KEM-512/768/1024 key generation and certificate/PKCS#8 import — the RFC 9935 seed / expandedKey / both private-key CHOICE is validated fail-closed, so an OpenSSL-legacy bare-seed or an internally inconsistent key is rejected with a typed error (KEM encapsulation lands with CMS KEM-decrypt). Zero-dependency, OpenSSL-interoperable |
 | `pki.schema` | The schema family — `parse` detects which PKI format DER / PEM encodes and routes to the right parser, `all` enumerates the registered formats, and the engine + per-format members are grouped here |
 | `pki.schema.x509` | Parse DER / PEM certificates into structured, validated fields — `parse`, `pemDecode`, `pemEncode` |
+| `pki.schema.c509` | Parse C509 CBOR-encoded certificates (draft-ietf-cose-cbor-encoded-cert) — the compact CBOR profile of X.509, decoded fail-closed under deterministic CBOR; an explicit `parse` call (CBOR, not DER, so not auto-routed) |
 | `pki.schema.crl` | Parse DER / PEM X.509 CRLs per RFC 5280 §5 — revoked serials with real-`Date` revocation times, named + partly-decoded extensions, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.csr` | Parse DER / PEM PKCS#10 certification requests per RFC 2986 — subject DN, public key, requested attributes, signature, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.pkcs8` | Parse DER / PEM PKCS#8 private keys per RFC 5208 / 5958 — algorithm, raw key bytes, attributes, optional public key, fail-closed; encrypted keys recognized (not decrypted) — `parse`, `parseEncrypted`, `pemDecode`, `pemEncode` |
@@ -225,7 +226,7 @@ is callable today; nothing below is a stub.
 | `pki.smime` | RFC 8551 S/MIME message assembly, verification, encryption, and compression over the CMS layer — `sign(content, signers, opts)` wraps a MIME entity as a signed S/MIME message in either form: `multipart/signed` (clear-signed — the content stays readable in any MUA, a detached CMS SignedData rides alongside as `application/pkcs7-signature` with a matching `micalg`) or `application/pkcs7-mime; smime-type=signed-data` (opaque — the whole entity is a base64 CMS SignedData). The signed bytes are the entity's RFC 8551 §3.1.1 canonical form (CRLF line endings); `verify(message, opts)` unwraps both forms and recomputes over the same canonicalizer, so a transport that re-wraps line endings still verifies and a tampered part fails. `encrypt(content, recipients, opts)` envelopes a MIME entity as an opaque `application/pkcs7-mime` message and `decrypt(message, keyMaterial, opts)` opens one — `smime-type=authEnveloped-data` (AES-GCM, confidentiality and integrity, the default) or `smime-type=enveloped-data` (AES-CBC, confidentiality only, so `decrypt` reports `authenticated: false`, the §3.3 no-integrity caveat); the `smime-type` is derived from the CMS body, not the header, and decryption is fail-closed and oracle-free. The crypto is entirely `pki.cms.sign` / `verify` / `encrypt` / `decrypt` — any RSA / RSASSA-PSS / ECDSA / EdDSA / ML-DSA / SLH-DSA signer and any RSA-OAEP / ECDH / X25519 / X448 / AES-KW / PBKDF2 / ML-KEM recipient carries through (algorithm-agnostic). Like `cms.verify`, `verify` returns the per-signer cryptographic verdict plus the recovered content; chaining a signer to a trust anchor is the caller's `pki.path.validate` step. `compress(content, opts)` / `decompress(message, opts)` add the opaque `application/pkcs7-mime; smime-type=compressed-data; name=smime.p7z` frame (RFC 8551 §3.6, RFC 3274) — a size transform with no integrity/confidentiality (§2.4.5), decompress bounded against a bomb; the recovered content, which may itself be signed or enveloped, is returned for the caller to re-verify. Bidirectionally interoperable with `openssl smime` / `openssl cms`. Fail-closed with typed `smime/*` errors — `sign`, `verify`, `encrypt`, `decrypt`, `compress`, `decompress` |
 | `pki.tsp` | RFC 3161 Time-Stamp Protocol — `sign(messageImprint, tsa, opts)` produces a TimeStampToken: a CMS SignedData (over `pki.cms.sign`) whose content is a `TSTInfo` carrying the timestamped message imprint, the TSA policy, a serial number, and `genTime` (with optional accuracy / nonce / ordering), plus the RFC 3161 §2.4.2 signing-certificate attribute binding the token to the TSA certificate (SHA-2 imprints, any `pki.cms.sign` TSA key). `request` / `parseRequest` build and parse the TimeStampReq a client sends (imprint, requested policy, nonce, certReq), `response` / `parseResponse` the TimeStampResp a TSA returns — a granted status wrapping a token, or a rejection with PKIStatus and failure info, the §2.4.2 status↔token coupling enforced in both directions. `verify(token, data, opts)` verifies a token fail-closed: the CMS signature over the exact signed bytes, the message imprint recomputed from the data, the TSTInfo content type, the ESSCertID(V2) binding to the TSA certificate, the §2.3 critical timeStamping-only extendedKeyUsage, the request nonce when used, and — with a trust anchor supplied — full certification-path validation of the TSA certificate at the token's `genTime`, returning `{ valid, genTime, serialNumber, tstInfo, … }` — `sign`, `request`, `parseRequest`, `response`, `parseResponse`, `verify` |
 | `pki.ocsp` | RFC 6960 Online Certificate Status Protocol — the responder and relying-party surface. `buildRequest(query, opts)` builds an OCSPRequest for one or more `{ cert, issuer }` pairs (CertID hashed under SHA-1 by default per the RFC 5019 lightweight profile, or SHA-2; optional RFC 9654 nonce, optional requestor signature). `sign(responseData, responder, opts)` produces a signed BasicOCSPResponse over the exact `ResponseData` DER — the issuing CA directly or a delegated responder, any `pki.cms.sign` key including the post-quantum ML-DSA / SLH-DSA sets, with `good` / `revoked` (reason + time) / `unknown` per-certificate status, and `buildErrorResponse(status)` the unsigned §2.3 error (`tryLater` / `unauthorized` / …). `verify(response, opts)` verifies a response fail-closed against the same hardened gates `pki.path.ocspChecker` runs: the CertID binding, responder authorization (the issuing CA or a CA-issued delegate bearing id-kp-OCSPSigning **and** id-pkix-ocsp-nocheck, passing the full out-of-path certificate gates), the signature over `tbsResponseDataBytes`, currency (`thisUpdate`/`nextUpdate`), and the request-nonce echo — returning `{ status: "good" / "revoked" / "unknown", … }`, never a silent accept. Transport-free — `buildRequest`, `sign`, `buildErrorResponse`, `verify` |
-| `pki.ct` | RFC 6962 Certificate Transparency SCTs — `parseSctList` decodes the `SignedCertificateTimestampList` a certificate or OCSP response carries in the SCT extension (a TLS-presentation-language payload inside the §3.3 double DER wrap) into per-SCT log id, exact `timestamp` (BigInt), named signature algorithm, and raw signature; `reconstructSignedData` rebuilds the exact `digitally-signed` preimage; `verifySct` verifies an SCT signature against a log's public key by reconstructing the signed data, routing an ECDSA signature through the strict DER-conformance gate, and verifying through the crypto engine — resolving true or false, and throwing a typed error on a structural fault. The producing side: `encodeSctList` builds the extension value byte-for-byte (the exact inverse of `parseSctList`) and `signSct` performs a log's signing step (rebuilding the same signed-data preimage the verifier hashes and signing it with the log's ECDSA-P-256 / RSA key). The trust surface: `parseLogList` ingests the CT log-list JSON into constraint-carrying trusted logs — recomputing each log's id as SHA-256 of its key and refusing a disagreeing id (a swapped key, §3.2), decoding the state + temporal-interval constraints — and `verifySctWithLogList` resolves the log key from an SCT's log id, enforces the state (usable/qualified/readonly trusted; retired only before retirement; pending/rejected refused) and the temporal-interval window, then delegates the signature check to `verifySct`. Structure decoded, crypto fail-closed — `parseSctList`, `reconstructSignedData`, `verifySct`, `encodeSctList`, `signSct`, `parseLogList`, `verifySctWithLogList` |
+| `pki.ct` | RFC 6962 Certificate Transparency SCTs — `parseSctList` decodes the `SignedCertificateTimestampList` a certificate or OCSP response carries in the SCT extension (a TLS-presentation-language payload inside the §3.3 double DER wrap) into per-SCT log id, exact `timestamp` (BigInt), named signature algorithm, and raw signature; `reconstructSignedData` rebuilds the exact `digitally-signed` preimage; `verifySct` verifies an SCT signature against a log's public key by reconstructing the signed data, routing an ECDSA signature through the strict DER-conformance gate, and verifying through the crypto engine — resolving true or false, and throwing a typed error on a structural fault. The producing side: `encodeSctList` builds the extension value byte-for-byte (the exact inverse of `parseSctList`) and `signSct` performs a log's signing step (rebuilding the same signed-data preimage the verifier hashes and signing it with the log's ECDSA-P-256 / RSA key). The trust surface: `parseLogList` ingests the CT log-list JSON into constraint-carrying trusted logs — recomputing each log's id as SHA-256 of its key and refusing a disagreeing id (a swapped key, §3.2), decoding the state + temporal-interval constraints — and `verifySctWithLogList` resolves the log key from an SCT's log id, enforces the state (usable/qualified/readonly trusted; retired only before retirement; pending/rejected refused) and the temporal-interval window, then delegates the signature check to `verifySct`. `verifyLogListSignature(json, signature, publicKey)` verifies the detached `log_list.sig` over the raw log-list bytes against a caller-pinned signer key (RSASSA-PKCS1-v1.5/SHA-256, EC P-256 arm; forgeable-key defenses fail closed) — cross-checked against `openssl dgst`, completing the offline log-list trust chain. Structure decoded, crypto fail-closed — `parseSctList`, `reconstructSignedData`, `verifySct`, `encodeSctList`, `signSct`, `parseLogList`, `verifySctWithLogList`, `verifyLogListSignature` |
 | `pki.merkle` | RFC 6962 / RFC 9162 Merkle-tree proof verification — `leafHash` / `nodeHash` / `emptyRootHash` build the domain-separated (0x00 leaf / 0x01 node) SHA-256 tree hashes; `verifyInclusion` folds an audit proof back to a root and `verifyConsistency` reconstructs both the old and new root (the append-only guarantee), each constant-time-compared to a trusted checkpoint root. Fail-closed on bad geometry, sync hashing, transport-free — `leafHash`, `nodeHash`, `emptyRootHash`, `verifyInclusion`, `verifyConsistency` |
 | `pki.trust` | Mozilla / CCADB trust-store ingestion — `parseCertdata` reads the NSS `certdata.txt` object stream and `parseCcadbCsv` the CCADB CSV export into one identical constraint-carrying anchor shape: the per-purpose trust bits (only `CKT_NSS_TRUSTED_DELEGATOR` grants) and the per-purpose distrust-after dates the bare root list omits. Certificate and trust objects pair by byte-exact issuer + serial (never adjacency) and are cross-checked against the parsed DER, so metadata can never attach to the wrong root; `anchor()` hands an entry to `pki.path.validate({ trustAnchor, checkPurpose })`. Offline, fail-closed, bounded — `parseCertdata`, `parseCcadbCsv`, `anchor` |
 | `pki.shbs` | Stateful hash-based signature **verification** — HSS/LMS (RFC 8554), carried in X.509 by RFC 9802 and CMS by RFC 9708, profiled by NIST SP 800-208 (CNSA 2.0 firmware signing). `verify` checks an HSS signature (every level must pass) and `verifyLms` a single-tree LMS, over the raw public-key / signature blobs the parsers already surface. Pure public-input SHA-256 / SHAKE256 hashing, a data-driven typecode registry, bounds-before-slice reads; a malformed blob throws a typed `ShbsError`, a well-formed-but-wrong signature returns `false`. **Verify only by design** — stateful signing needs atomic one-time-key state that belongs in an HSM — `verify`, `verifyLms` |

package/lib/acme.js

@@ -1111,6 +1111,9 @@ function validateRenewalInfo(obj) {
   _validate("renewalInfo", obj);
   var w = obj.suggestedWindow;
   if (!_isObject(w) || !_isRfc3339(w.start) || !_isRfc3339(w.end)) throw E("acme/bad-renewal-window", "a renewalInfo suggestedWindow must carry RFC 3339 start and end (RFC 9773 sec. 4.2)");
+  // The line above already rejected any w.start/w.end that is not a grammar+calendar-valid
+  // RFC 3339 string, so neither Date.parse can be NaN here -- the comparison is source-validated.
+  // allow:nan-date-comparison-unguarded -- source-validated by the rfc3339.isValid check above.
   if (Date.parse(w.end) <= Date.parse(w.start)) throw E("acme/bad-renewal-window", "the renewal window end must be strictly after start (RFC 9773 sec. 4.2)");
   return obj;
 }

package/lib/cms-encrypt.js

@@ -240,7 +240,7 @@ function _assertIterations(n) {
 // Bound the PBKDF2 salt to the same cap the decryptor enforces, so a message we emit is always one we
 // can read back.
 function _assertSalt(salt) {
-  if (salt.length > C.LIMITS.PBKDF2_MAX_SALT) throw _err("cms/bad-input", "salt exceeds the " + C.LIMITS.PBKDF2_MAX_SALT + "-octet cap");
+  guard.limits.byteCap(salt, C.LIMITS.PBKDF2_MAX_SALT, _err, "cms/bad-input", "salt");
   return salt;
 }
 

package/lib/cms-sign.js

@@ -21,6 +21,7 @@ var pkix = require("./schema-pkix");
 var frameworkError = require("./framework-error");
 
 var signScheme = require("./sign-scheme");
+var guard = require("./guard-all");
 var CmsError = frameworkError.CmsError;
 var b = asn1.build;
 function _err(code, message, cause) { return new CmsError(code, message, cause); }
@@ -156,9 +157,7 @@ function sign(content, signers, opts) {
   }
   // A supplied signing-time MUST be a valid Date (or false to omit the attribute) -- never a
   // silently-ignored non-Date or an Invalid Date that would encode a garbage Time.
-  if (opts.signingTime != null && opts.signingTime !== false && (!(opts.signingTime instanceof Date) || isNaN(opts.signingTime.getTime()))) {
-    throw _err("cms/bad-input", "signingTime must be a valid Date, or false to omit it");
-  }
+  if (opts.signingTime != null && opts.signingTime !== false) guard.time.assertValid(opts.signingTime, _err, "cms/bad-input", "signingTime");
 
   return Promise.all(list.map(function (s) { return _buildSignerInfo(s, contentBuf, eContentType, opts); })).then(function (built) {
     // digestAlgorithms: the distinct SignerInfo digestAlgorithm AlgorithmIdentifiers, deduped.

package/lib/cms-verify.js

@@ -253,7 +253,9 @@ function _verifySignature(scheme, hashName, sigBytes, spki, signedBytes, curveOi
   if (scheme.kind === "ec") {
     var ec = EC_CURVE[curveOid];
     if (!ec) throw _err("cms/unsupported-algorithm", "the signer key is on an unsupported EC curve");
-    var raw = validator.sig.ecdsaSigToRaw(sigBytes, ec.coordLen, CmsError, "cms/bad-signature");
+    // The ORDER-AWARE gate: r,s in [1, n-1] per FIPS 186-5 sec. 6.4.2 (rejecting an out-of-range r/s >= the
+    // curve order n, not only the r=s=0 forgery) -- a verifier that knows the curve MUST use it.
+    var raw = validator.sig.ecdsaDerToP1363(sigBytes, ec.curve, CmsError, "cms/bad-signature");
     return subtle.importKey("spki", spki, { name: "ECDSA", namedCurve: ec.curve }, false, ["verify"])
       .then(function (k) { return subtle.verify({ name: "ECDSA", hash: hashName }, k, raw, signedBytes); });
   }

package/lib/ct.js

@@ -181,9 +181,7 @@ function _parseSct(r, sctLen) {
  */
 function parseSctList(extValue) {
   var blob = _peelInner(_toBuffer(extValue, "the SCT-list extension value"));
-  if (blob.length > C.LIMITS.SCT_MAX_BYTES) {
-    throw new CtError("ct/too-large", "SCT list " + blob.length + " bytes exceeds the cap " + C.LIMITS.SCT_MAX_BYTES);
-  }
+  guard.limits.byteCap(blob, C.LIMITS.SCT_MAX_BYTES, _ctErr, "ct/too-large", "SCT list");
   var outer = new TlsReader(blob, 0, blob.length);
   var listLen = outer.u16("ct/bad-list");
   if (listLen + 2 !== blob.length) {
@@ -396,9 +394,10 @@ async function verifySct(entry, sct, logPublicKey) {
     if (!ec) throw new CtError("ct/unsupported-algorithm", "unsupported SCT log EC curve (RFC 6962 sec. 2.1.4 mandates NIST P-256)");
     imp = { name: "ECDSA", namedCurve: ec.curve };
     ver = { name: "ECDSA", hash: hashName };
-    // The SCT signature is a DER ECDSA-Sig-Value; route it through the strict conformance
-    // gate (primitive, minimal, positive, bounded r/s) before converting to raw r||s.
-    sig = validator.sig.ecdsaSigToRaw(sig, ec.coordLen, CtError, "ct/bad-signature");
+    // The SCT signature is a DER ECDSA-Sig-Value; route it through the ORDER-AWARE conformance gate
+    // (primitive, minimal, and r,s in [1, n-1] per FIPS 186-5 sec. 6.4.2 -- rejecting an out-of-range
+    // r/s >= the curve order n, not only the r=s=0 shape) before converting to raw r||s.
+    sig = validator.sig.ecdsaDerToP1363(sig, ec.curve, CtError, "ct/bad-signature");
   } else if (sigInfo.signatureName === "rsa") {
     if (alg.algOid !== oid.byName("rsaEncryption")) throw new CtError("ct/bad-input", "the SCT declares an RSA signature but the log key is not an RSA key");
     if (!(alg.rsaBits >= 2048)) throw new CtError("ct/unsupported-algorithm", "the SCT log RSA key is below the RFC 6962 sec. 2.1.4 minimum of 2048 bits");
@@ -622,6 +621,7 @@ function _parseTemporalInterval(ti) {
   if (typeof ti !== "object") throw _ctErr("ct/bad-log-list", "a CT log temporal_interval must be an object");
   var start = rfc3339.parse(ti.start_inclusive, _ctErr, "ct/bad-date", "temporal_interval.start_inclusive");
   var end = rfc3339.parse(ti.end_exclusive, _ctErr, "ct/bad-date", "temporal_interval.end_exclusive");
+  // allow:nan-date-comparison-unguarded -- start/end are rfc3339.parse results, guaranteed non-NaN (rfc3339.isValid rejects a NaN date).
   if (start.getTime() >= end.getTime()) throw _ctErr("ct/bad-log-list", "a CT log temporal_interval start_inclusive must be strictly before end_exclusive");
   return { startInclusive: start, endExclusive: end };
 }
@@ -775,18 +775,74 @@ async function verifySctWithLogList(entry, sct, logList, opts) {
   // Temporal gate (fail-closed): the covered cert's notAfter must be in [start_inclusive, end_exclusive).
   if (log.temporalInterval) {
     var notAfter = _resolveNotAfter(entry, opts);
-    // An Invalid Date (getTime() === NaN) is still `instanceof Date`, and NaN < x / NaN >= x are both
-    // false, so it would silently BYPASS the window containment -- reject it fail-closed, exactly like
-    // the codec's readTime rejects a NaN instant (a caller may pass a lenient `new Date(badString)`).
-    if (!(notAfter instanceof Date) || isNaN(notAfter.getTime())) throw _ctErr("ct/temporal-interval", "the CT log has a temporal_interval but the covered certificate's notAfter is not available or not a valid date (pass a valid opts.certNotAfter)");
-    var t = notAfter.getTime();
-    if (t < log.temporalInterval.startInclusive.getTime() || t >= log.temporalInterval.endExclusive.getTime()) {
+    // within() validates notAfter (and the interval bounds) fail-closed before comparing: an Invalid
+    // Date is instanceof Date yet NaN, and NaN < x / NaN >= x are both false, so an unvalidated notAfter
+    // would silently BYPASS the [startInclusive, endExclusive) containment. A malformed notAfter throws
+    // inside within (pass a valid opts.certNotAfter); an out-of-window notAfter returns false here.
+    if (!guard.time.within(notAfter, log.temporalInterval.startInclusive, log.temporalInterval.endExclusive, _ctErr, "ct/temporal-interval", "the covered certificate notAfter (pass a valid opts.certNotAfter)")) {
       throw _ctErr("ct/temporal-interval", "the covered certificate's notAfter is outside the CT log's temporal_interval");
     }
   }
   return verifySct(entry, sct, log.key);   // the shipped crypto verdict (re-checks the logId binding)
 }
 
+/**
+ * @primitive  pki.ct.verifyLogListSignature
+ * @signature  pki.ct.verifyLogListSignature(json, signature, publicKey) -> Promise<boolean>
+ * @since      0.2.29
+ * @status     experimental
+ * @spec       RFC 6962, RFC 8017
+ * @related    pki.ct.parseLogList, pki.ct.verifySct
+ *
+ * Verify the detached signature published alongside the Certificate Transparency log list (the
+ * `log_list.sig` over `log_list.json`). `json` is the RAW log-list bytes (a Buffer, or the fetched text
+ * as a string -- verified byte-for-byte, never re-serialized), `signature` is the detached signature, and
+ * `publicKey` is the caller-PINNED signer SubjectPublicKeyInfo (DER; there is no baked-in key). The scheme
+ * is RSASSA-PKCS1-v1.5 with SHA-256 over an RSA key (the deployed scheme; an EC P-256 / ECDSA-SHA-256 arm
+ * is accepted for future-proofing). Resolves `true` for a valid signature, `false` on a cryptographic
+ * mismatch (a verdict). Fail-closed forgery defenses throw before any verify: an RSA public exponent below
+ * 3 or even (`ct/bad-input`), a sub-2048-bit RSA key or an unsupported key type / curve
+ * (`ct/unsupported-algorithm`), a non-conformant ECDSA DER Sig-Value (`ct/bad-signature`); a structural
+ * evaluation failure is `ct/verify-error`. Offline: the caller fetches and pins; the toolkit only verifies.
+ *
+ * @example
+ *   var ok = await pki.ct.verifyLogListSignature(logListJsonBytes, logListSig, googleSignerSpki);
+ */
+async function verifyLogListSignature(json, signature, publicKey) {
+  var message = typeof json === "string" ? Buffer.from(json) : _toBuffer(json, "the CT log list JSON");
+  // Bound the signed message before the digest/verify (the same cap parseLogList enforces) so a hostile
+  // caller cannot force unbounded hashing work on an oversized input (CWE-400).
+  guard.limits.byteCap(message, C.LIMITS.CT_LOG_LIST_MAX_BYTES, _ctErr, "ct/too-large", "the CT log list");
+  var sig = _toBuffer(signature, "the CT log list signature");
+  var spki = _toBuffer(publicKey, "the CT log list signer public key (SPKI)");
+  var alg = _spkiAlg(spki);   // fail-closed: a non-SPKI key or a forgeable RSA e < 3 throws ct/bad-input
+  var imp, ver;
+  if (alg.algOid === oid.byName("rsaEncryption")) {
+    if (!(alg.rsaBits >= 2048)) throw new CtError("ct/unsupported-algorithm", "the CT log-list signer RSA key is below the 2048-bit minimum");
+    imp = { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" };
+    ver = { name: "RSASSA-PKCS1-v1_5" };
+  } else if (alg.algOid === oid.byName("ecPublicKey")) {
+    var ec = CT_EC_CURVE[alg.curveOid];
+    if (!ec) throw new CtError("ct/unsupported-algorithm", "unsupported CT log-list signer EC curve (only NIST P-256)");
+    imp = { name: "ECDSA", namedCurve: ec.curve };
+    ver = { name: "ECDSA", hash: "SHA-256" };
+    // A DER ECDSA-Sig-Value: route through the ORDER-AWARE conformance gate (primitive, minimal, and
+    // r,s in [1, n-1] per FIPS 186-5 sec. 6.4.2 -- defeating the CVE-2022-21449 r=s=0 forgery AND an
+    // out-of-range r/s >= the curve order n) before the raw r||s conversion.
+    sig = validator.sig.ecdsaDerToP1363(sig, ec.curve, CtError, "ct/bad-signature");
+  } else {
+    throw new CtError("ct/unsupported-algorithm", "unsupported CT log-list signer key algorithm (only rsaEncryption / ecPublicKey P-256)");
+  }
+  // A wrong signature resolves false from subtle.verify (a verdict); a structural failure -- an
+  // unimportable key -- is re-thrown fail-closed.
+  try {
+    var key = await subtle.importKey("spki", spki, imp, false, ["verify"]);
+    return await subtle.verify(ver, key, sig, message);
+  } catch (e) {
+    throw new CtError("ct/verify-error", "the CT log-list signature could not be evaluated", e);
+  }
+}
+
 module.exports = {
   parseSctList: parseSctList,
   reconstructSignedData: reconstructSignedData,
@@ -795,6 +851,7 @@ module.exports = {
   signSct: signSct,
   parseLogList: parseLogList,
   verifySctWithLogList: verifySctWithLogList,
+  verifyLogListSignature: verifyLogListSignature,
   HASH_ALGORITHMS: HASH_ALGORITHMS,
   SIGNATURE_ALGORITHMS: SIGNATURE_ALGORITHMS,
 };

package/lib/framework-error.js

@@ -231,6 +231,14 @@ var SmimeError = defineClass("SmimeError", { withCause: true });
 // inner `asn1/*` decode error) as `.cause`.
 var CtError = defineClass("CtError", { withCause: true });
 
+// C509Error -- a CBOR byte sequence that is not a well-formed C509 certificate
+// (draft-ietf-cose-cbor-encoded-cert): a root that is not the 11-element array, a
+// c509CertificateType outside {2,3}, a field encoded against its ~biguint/~time/~oid
+// contract, an algorithm/attribute/extension int with no registry row, or a type-3
+// cert that does not invert byte-for-byte to its original DER. Carries the underlying
+// leaf fault (the inner `cbor/*` or `asn1/*` decode error) as `.cause`.
+var C509Error = defineClass("C509Error", { withCause: true });
+
 // MerkleError -- a malformed input to the RFC 6962 / RFC 9162 Merkle-tree
 // proof-verification core: a tree coordinate that is not a non-negative integer
 // (or a Number above 2^53 where an exact BigInt is required), a leafIndex
@@ -333,6 +341,7 @@ module.exports = {
   CmpError:         CmpError,
   PathError:        PathError,
   CtError:          CtError,
+  C509Error:        C509Error,
   ShbsError:        ShbsError,
   HpkeError:        HpkeError,
   SigstoreError:    SigstoreError,

package/lib/guard-all.js

@@ -21,6 +21,8 @@
 //   guard.range.int / .uint31 / .positiveInt31
 //                                     -- bound a decoded integer before narrowing
 //                                        to Number (silent-narrowing defence)
+//   guard.time.assertValid / .within  -- validate a Date-instant before a temporal
+//                                        comparison (NaN-Date fail-open defence)
 //   guard.name.dnEqual / .rdnEqual / .assertNoControlBytes / .assertPrintableIa5
 //                                     -- canonical DN identity + name-string integrity
 //   guard.name.escapeControlBytes / .escapeDnValue
@@ -44,6 +46,7 @@ var text   = require("./guard-text");
 var limits = require("./guard-limits");
 var crypto = require("./guard-crypto");
 var range  = require("./guard-range");
+var time   = require("./guard-time");
 var name   = require("./guard-name");
 var encoding = require("./guard-encoding");
 var json   = require("./guard-json");
@@ -55,6 +58,7 @@ module.exports = {
   limits: limits,
   crypto: crypto,
   range:  range,
+  time:   time,
   name:   name,
   encoding: encoding,
   json:   json,

package/lib/guard-limits.js

@@ -103,4 +103,29 @@ function counter(max, E, code, label) {
   };
 }
 
-module.exports = { cap: cap, depthCap: depthCap, counter: counter };
+// byteCap(buf, max, E, code, label) -> the same buffer, once proven within `max`
+// bytes. Bounds a caller-supplied buffer BEFORE an expensive hash / verify / parse
+// materializes over it (CWE-400 uncontrolled resource consumption / CWE-770
+// allocation without limits -- the class guard.text.decode closes for a decoded
+// string and counter closes for element fanout, here for a raw byte input). Tier-2:
+// an over-size input is hostile / malformed content, so it throws the caller's typed
+// PkiError via the E(code, message) factory. `max` is the caller's ceiling (a
+// C.LIMITS.* constant, or an operator max already run through cap()).
+// @enforced-by behavioral -- a `buf.length > cap` size gate has no rename-proof code
+//   shape distinct from an arity / field-width check (children.length > 2,
+//   ext.length > 0xffff), so a codebase-patterns detector would false-fire; the
+//   over-size RED vectors driving the composing verifiers are the guard.
+function byteCap(buf, max, E, code, label) {
+  // The ceiling is an authoring input: an undefined / NaN / fractional / negative
+  // max makes `length > max` never fire -- a silently dead size defence. Reject at
+  // config time (TypeError), regardless of the value currency E selects.
+  if (!Number.isInteger(max) || max < 0) {
+    throw new TypeError("guard.limits.byteCap: max must be a non-negative integer");
+  }
+  if (buf.length > max) {
+    throw E(code, (label || "input") + " is " + buf.length + " bytes, over the " + max + "-byte cap");
+  }
+  return buf;
+}
+
+module.exports = { cap: cap, depthCap: depthCap, counter: counter, byteCap: byteCap };

package/lib/guard-time.js

@@ -0,0 +1,68 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. The documented surface is the
+// verifiers whose validity / currency / temporal gates compose this guard
+// (pki.path.validate, pki.ocsp.verify, pki.tsp.*, pki.ct.*, pki.cms.sign).
+//
+// guard-time -- fail-closed Date-instant validation before a temporal comparison.
+//
+// Defends the NaN-Date fail-open class (CWE-20 improper input validation feeding
+// a silent security-gate bypass). An Invalid Date is still `instanceof Date`, and
+// EVERY relational comparison against its NaN getTime() (NaN < x, NaN >= x) is
+// false -- so a validity / not-before / not-after / currency window built on an
+// unvalidated Date silently ACCEPTS when it should reject. The class recurred at
+// three independent boundaries (TSP genTime, OCSP producedAt/thisUpdate, CT
+// temporal-interval) before it was centralized here; the sibling
+// nan-date-comparison-unguarded codebase-patterns detector flags any lib function
+// that re-inlines a `.getTime()` comparison WITHOUT first rejecting a NaN, so a
+// new boundary is routed to this guard rather than re-growing the bug.
+//
+// Tier split: `value instanceof Date` with a NaN time is malformed CALLER input
+// (a config-time / entry-point Date -- an operator-supplied distrustAfter, a
+// caller `opts.time`), so assertValid throws the caller's typed error rather than
+// returning a silent default. within() is the fail-closed window primitive: it
+// THROWS on a malformed operand but RETURNS a boolean for in/out-of-window, so the
+// OCSP / CRL currency callers that treat out-of-window as a `continue` skip keep
+// their control flow while a NaN operand can never slip through as a false.
+
+// assertValid(value, E, code, label) -> the same Date, once proven valid.
+//   value : a Date (or an alleged one) from a caller boundary.
+//   E     : the (code, message[, cause]) typed-error FACTORY in scope at the call
+//           site (ns.E / the module-local _err) -- NEVER a defineClass class, which
+//           would crash `class cannot be invoked without new` on the error path.
+//   code  : the frozen domain/reason code this boundary rejects malformed time under.
+//   label : field phrase for the message.
+// @enforced-by nan-date-comparison-unguarded
+function assertValid(value, E, code, label) {
+  if (!(value instanceof Date) || isNaN(value.getTime())) {
+    throw E(code, (label || "value") + " must be a valid Date");
+  }
+  return value;
+}
+
+// within(instant, lower, upper, E, code, label, opts) -> boolean (instant in window).
+//   Rejects a malformed instant / lower / upper by THROWING (assertValid), then
+//   answers containment as a boolean. Half-open [lower, upper) by default (a CT
+//   temporal-interval / an OCSP-CRL currency window); pass opts.upperInclusive for
+//   the closed [notBefore, notAfter] certificate-validity shape.
+// @enforced-by nan-date-comparison-unguarded
+function within(instant, lower, upper, E, code, label, opts) {
+  // assertValid rejects a non-Date / Invalid Date operand up front, so t/lo/hi below are
+  // guaranteed non-NaN -- the containment comparisons can never be a silent NaN-false. The
+  // getTime() results are bound to locals (not compared inline), so this home carries no
+  // unguarded `.getTime()`-in-a-comparison shape for the nan-date-comparison-unguarded detector.
+  assertValid(instant, E, code, label);
+  assertValid(lower, E, code, (label || "window") + " lower bound");
+  assertValid(upper, E, code, (label || "window") + " upper bound");
+  var t = instant.getTime();
+  var lo = lower.getTime();
+  var hi = upper.getTime();
+  return t >= lo && (opts && opts.upperInclusive ? t <= hi : t < hi);
+}
+
+module.exports = {
+  assertValid: assertValid,
+  within: within,
+};

package/lib/lint.js

@@ -156,6 +156,7 @@ function _makeCtx(cert, profile) {
 function _effective(rule, cert) {
   if (!rule.effectiveDate) return true;
   var nb = cert.validity && cert.validity.notBefore;
+  // allow:nan-date-comparison-unguarded -- nb is a codec-parsed cert notBefore (asn1 readTime rejects a NaN instant); effectiveDate is a Date literal.
   return (nb instanceof Date) && nb.getTime() >= rule.effectiveDate.getTime();
 }
 
@@ -296,6 +297,7 @@ var RFC5280_RULES = [
     message: "the certificate notBefore must not be later than notAfter",
     check: function (cert) {
       var v = cert.validity;
+      // allow:nan-date-comparison-unguarded -- notBefore/notAfter are codec-parsed cert dates (asn1 readTime rejects a NaN instant).
       return (v.notBefore instanceof Date && v.notAfter instanceof Date && v.notBefore.getTime() > v.notAfter.getTime()) ? true : null;
     },
   },
@@ -375,6 +377,7 @@ var VALIDITY_SCHEDULE = [
 var VALIDITY_SCHEDULE_START = VALIDITY_SCHEDULE[VALIDITY_SCHEDULE.length - 1].from;
 function _validityCeilingDays(notBefore) {
   for (var i = 0; i < VALIDITY_SCHEDULE.length; i++) {
+    // allow:nan-date-comparison-unguarded -- notBefore is a codec-parsed cert date (NaN-rejected); the schedule bounds are Date literals.
     if (notBefore.getTime() >= VALIDITY_SCHEDULE[i].from.getTime()) return VALIDITY_SCHEDULE[i].maxDays;
   }
   // Unreachable: the rule's effectiveDate (VALIDITY_SCHEDULE_START) reports NE for any cert

package/lib/ocsp-verify.js

@@ -206,6 +206,7 @@ function makeOcspVerify(deps) {
       if (st.type === "revoked") {
         // Present-time validation revokes regardless of a future revocationTime (skew/post-dating);
         // only explicit historical validation defers a strictly-future revocation (reports good).
+        // allow:nan-date-comparison-unguarded -- revocationTime is codec-parsed (NaN-rejected); a NaN check time makes this FAIL CLOSED (sawGood stays unset -> not treated good), and `time` is validated at the pki.ocsp.verify / path.verifyOcspResponse entry points.
         if (historical && st.revocationTime instanceof Date && st.revocationTime.getTime() > time.getTime()) { out.sawGood = true; }
         else if (!out.revoked) { out.revoked = { revocationReason: st.revocationReason || null, reason: "certificate reported revoked by an authorized OCSP responder" + (st.revocationReason ? " (" + st.revocationReason + ")" : "") }; }
       } else if (st.type === "good") { out.sawGood = true; }

package/lib/path-validate.js

@@ -1133,9 +1133,7 @@ async function validate(path, opts) {
   if (!opts.trustAnchor) throw E("path/bad-input", "validate: a trustAnchor is required");
   // The validity-window check is always on (6.1.3(a)(2)); a missing/invalid
   // check date must fail closed, never silently disable it.
-  if (!(opts.time instanceof Date) || isNaN(opts.time.getTime())) {
-    throw E("path/bad-input", "validate: opts.time must be a Date (the always-on validity-window check date)");
-  }
+  guard.time.assertValid(opts.time, E, "path/bad-input", "validate: opts.time (the always-on validity-window check date)");
   // Entry-point tier for the remaining 6.1.1 user-initial inputs: a bad value
   // throws here rather than silently disabling the behavior it configures.
   // Validate-if-present (the default is applied where the policy state is built);
@@ -1355,13 +1353,20 @@ async function validate(path, opts) {
       // per-purpose distrust-after date and delegator purposes apply to the
       // end-entity leaf it ultimately certifies.
       var ta = opts.trustAnchor;
-      if (checkPurpose && ta.distrustAfter && ta.distrustAfter[checkPurpose] instanceof Date &&
-          cert.validity.notBefore > ta.distrustAfter[checkPurpose]) {
+      // A PRESENT-but-malformed distrustAfter (an Invalid Date: instanceof Date yet a
+      // NaN time) would make `notBefore > it` NaN-false and SILENTLY drop the distrust
+      // restriction -- the NaN-Date fail-open. Validate a present date fail-closed
+      // before the comparison; an absent (undefined/null) date is no restriction.
+      var distrustDate = (checkPurpose && ta.distrustAfter) ? ta.distrustAfter[checkPurpose] : null;
+      if (distrustDate != null) {
+        distrustDate = guard.time.assertValid(distrustDate, E, "path/bad-input", "trustAnchor.distrustAfter." + checkPurpose);
         // STRICTLY > : a leaf whose notBefore == the distrust date stays trusted
         // (Mozilla certverifier isDistrustedCertificateChain: endEntityNotBefore
         // <= distrustAfterTime -> not distrusted; the end-of-day ...235959Z
         // convention keeps the whole boundary day trusted).
-        checks.push({ name: "distrustAfter", ok: false, code: "path/distrusted-after" }); failed = true;
+        if (cert.validity.notBefore > distrustDate) {
+          checks.push({ name: "distrustAfter", ok: false, code: "path/distrusted-after" }); failed = true;
+        }
       }
       if (checkPurpose && ta.purposes && ta.purposes[checkPurpose] !== true) {
         checks.push({ name: "purposeTrust", ok: false, code: "path/purpose-not-trusted" }); failed = true;
@@ -1766,6 +1771,7 @@ function crlChecker(crls) {
           // validation (opts.historicalMode) -- validating as of a past instant,
           // e.g. a timestamped signature -- does an entry dated AFTER the
           // validation time not yet apply.
+          // allow:nan-date-comparison-unguarded -- revocationDate is codec-parsed (NaN-rejected); a NaN check time makes this FAIL CLOSED (the skip is not taken -> the entry is treated as revoked), and `time` is validated at the path.validate / crlChecker entry points.
           if (historical && entry.revocationDate instanceof Date && entry.revocationDate.getTime() > time.getTime()) continue;
           // Record the revocation but keep scanning: a delta removeFromCRL for the
           // same serial (in another CRL) overrides it (base/delta not merged).

package/lib/schema-all.js

@@ -33,6 +33,7 @@
 var engine = require("./schema-engine");
 var pkix = require("./schema-pkix");
 var x509 = require("./schema-x509");
+var c509 = require("./schema-c509");
 var crl = require("./schema-crl");
 var csr = require("./schema-csr");
 var pkcs8 = require("./schema-pkcs8");
@@ -295,6 +296,9 @@ function parse(input) {
 module.exports = {
   engine: engine,
   x509: { parse: x509.parse, pemDecode: x509.pemDecode, pemEncode: x509.pemEncode },
+  // C509 is CBOR, not DER: an explicit-call surface only, NOT added to FORMATS / the detect-and-route
+  // parse() below (which detect DER shapes). No pemDecode/pemEncode -- C509 is binary CBOR.
+  c509: { parse: c509.parse },
   crl:  { parse: crl.parse,  pemDecode: crl.pemDecode, pemEncode: crl.pemEncode },
   csr:  { parse: csr.parse,  pemDecode: csr.pemDecode, pemEncode: csr.pemEncode },
   pkcs8: { parse: pkcs8.parse, parseEncrypted: pkcs8.parseEncrypted, pemDecode: pkcs8.pemDecode, pemEncode: pkcs8.pemEncode },

package/lib/schema-c509.js

@@ -0,0 +1,479 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * @module pki.schema.c509
+ * @nav    Schema
+ * @title  C509
+ * @intro  C509 CBOR-encoded certificates (draft-ietf-cose-cbor-encoded-cert). A compact CBOR
+ *   re-encoding of an X.509 v3 certificate: a deterministic-CBOR array of exactly 11 elements
+ *   (10 TBS fields + the issuer signature). Two modes -- c509CertificateType 2 = natively-signed
+ *   C509, 3 = a CBOR re-encoding of a DER X.509 certificate that inverts byte-for-byte to the
+ *   original DER (so the original signature still verifies). It decodes CBOR, not DER, so it is
+ *   reached by an explicit pki.schema.c509.parse call and is NOT auto-routed by pki.schema.parse.
+ * @card  Composes the shipped pki.cbor codec (core-deterministic, fail-closed) + the X.509 model.
+ */
+
+var cbor = require("./cbor-det");
+var asn1 = require("./asn1-der");
+var oid = require("./oid");
+var constants = require("./constants");
+var frameworkError = require("./framework-error");
+var validator = require("./validator-all");
+var webcrypto = require("./webcrypto");
+
+var b = asn1.build;
+
+var C = constants;
+var C509Error = frameworkError.C509Error;
+function _err(code, message, cause) { return new C509Error(code, message, cause); }
+// The ECMAScript Date window is +/- 8.64e15 ms = +/- 8.64e12 seconds; a C509 ~time is an unsigned
+// epoch-seconds value, so only the upper bound can be exceeded (mirrors cbor-det read.time).
+var MAX_EPOCH_SECONDS = 8640000000000n;
+
+// The C509 integer registries (draft-20 sec. 8.6/sec. 8.8/sec. 8.14/sec. 8.15): a C509 int is a compact ALIAS of an
+// OID, resolved to the SAME name oid.byName returns for the DER form. Declared as int -> registered
+// OID NAME (never a dotted-decimal literal -- the oid-dotted-decimal-literal gate); oid.byName then
+// yields the dotted string. A row whose target name is not registered fails closed at module load.
+function _name(n) { var d = oid.byName(n); if (!d) { throw new Error("schema-c509: unregistered OID name " + JSON.stringify(n)); } return n; }
+
+// sec. 8.14 issuerSignatureAlgorithm / signature (the subset v1 covers; negative = legacy SHA-1 values).
+var SIG_ALG_BY_INT = {
+  0: _name("ecdsaWithSHA256"),
+  1: _name("ecdsaWithSHA384"),
+  2: _name("ecdsaWithSHA512"),
+};
+// sec. 8.15 subjectPublicKeyAlgorithm (int -> {alg, curve?} so the reconstruction can rebuild the SPKI).
+var PK_ALG_BY_INT = {
+  0: { alg: _name("rsaEncryption") },
+  1: { alg: _name("ecPublicKey"), curve: _name("prime256v1") },
+  2: { alg: _name("ecPublicKey"), curve: _name("secp384r1") },
+  3: { alg: _name("ecPublicKey"), curve: _name("secp521r1") },
+};
+// EC curve -> field size in bytes (the SEC1 coordinate width), for point-length validation.
+var EC_FIELD_BYTES = { "prime256v1": 32, "secp384r1": 48, "secp521r1": 66 };
+
+// sec. 8.6 attribute types (abs(int) -> name; the sign selects the X.509 string type).
+var ATTR_BY_INT = {
+  1: _name("commonName"),
+  2: _name("surname"),
+  3: _name("serialNumber"),
+  4: _name("countryName"),
+  6: _name("localityName"),
+  7: _name("stateOrProvinceName"),
+  8: _name("organizationName"),
+  9: _name("organizationalUnitName"),
+  10: _name("title"),
+};
+// sec. 8.8 extension types (abs(int) -> name; the sign selects criticality).
+var EXT_BY_INT = {
+  1: _name("subjectKeyIdentifier"),
+  2: _name("keyUsage"),
+  3: _name("subjectAltName"),
+  4: _name("basicConstraints"),
+  7: _name("keyUsage"),
+  10: _name("authorityKeyIdentifier"),
+};
+
+// ---- field readers (the unwrapped ~biguint / ~time / ~oid contracts; draft-20 sec. 3.1) ----
+
+// ~biguint (sec. 3.1.2): a BARE byte string (major type 2), big-endian magnitude, the non-negative
+// leading 0x00 OMITTED. NOT the shipped read.biguint (which requires the tag-2 wrapper and rejects
+// <= 8-byte content). A leading 0x00 is non-minimal; content over the cap is rejected.
+function _biguint(node, code, label) {
+  if (!node || node.majorType !== 2) throw _err(code, label + " must be an unwrapped CBOR byte string (~biguint)");
+  var b = node.content;
+  if (b.length > C.LIMITS.CBOR_MAX_BIGUINT_BYTES) throw _err(code, label + " exceeds the ~biguint byte cap");
+  if (b.length > 1 && b[0] === 0x00) throw _err("c509/non-minimal-serial", label + " has a redundant leading 0x00 (~biguint omits the sign octet)");
+  return b.length ? BigInt("0x" + b.toString("hex")) : 0n;
+}
+
+// ~time (sec. 3.1.5): a BARE unsigned integer (major type 0), epoch seconds. A major-type-1 / tag / float
+// MUST reject. Bound to the Date window; the CBOR simple null (permitted only for notAfter) -> null.
+function _time(node, allowNull, label) {
+  if (allowNull && node.majorType === 7 && node.ai === 22) return null;   // CBOR simple null (0xF6)
+  if (!node || node.majorType !== 0) throw _err("c509/bad-validity", label + " must be an unwrapped CBOR epoch integer (~time)");
+  var secs = node.argument;
+  if (secs > MAX_EPOCH_SECONDS) throw _err("c509/bad-validity", label + " is outside the representable Date range");
+  return new Date(C.TIME.seconds(Number(secs)));
+}
+
+// ~oid (sec. 3.1.3 etc.): a BARE byte string carrying the BER OID content octets (RFC 9090), no tag-111
+// head. Compose asn1.decodeOidContent -> dotted -> oid.name (the same the tag reader does internally).
+function _oidName(node, code, label) {
+  if (!node || node.majorType !== 2) throw _err(code, label + " must be an unwrapped CBOR byte string (~oid)");
+  var dotted;
+  try { dotted = asn1.decodeOidContent(node.content); }
+  catch (e) { throw _err(code, label + " is not a valid BER OID content encoding", e); }
+  return { oid: dotted, name: oid.name(dotted) || dotted };
+}
+
+// AlgorithmIdentifier (sec. 3.1.3/sec. 3.1.7): int (registry) | ~oid (bare bytes) | [ ~oid, params ].
+function _algorithm(node, byInt, code, label) {
+  if (node.majorType === 0 || node.majorType === 1) {
+    var i = Number(cbor.read.int(node));
+    var mapped = byInt[i];   // registry keyed by the signed int (negatives are legacy SHA-1 rows)
+    if (mapped === undefined) throw _err("c509/unknown-algorithm", label + " integer " + i + " has no C509 registry row");
+    if (typeof mapped === "string") return { name: mapped, oid: oid.byName(mapped) };
+    return { name: mapped.alg, oid: oid.byName(mapped.alg), curve: mapped.curve || null };
+  }
+  if (node.majorType === 2) { var r = _oidName(node, code, label); return { name: r.name, oid: r.oid }; }
+  if (node.majorType === 4 && node.children && node.children.length === 2) {
+    var a = _oidName(node.children[0], code, label);
+    // The [~oid, params] form carries the DER parameters as a CBOR byte string; a non-byte-string here
+    // is malformed and cannot be reconstructed (b.raw would append garbage) -- fail closed.
+    if (node.children[1].majorType !== 2) throw _err(code, label + " algorithm parameters must be a CBOR byte string");
+    return { name: a.name, oid: a.oid, parameters: node.children[1].content };
+  }
+  throw _err(code, label + " is not a C509 AlgorithmIdentifier (int / ~oid / [~oid, params])");
+}
+
+// SpecialText attribute value (sec. 3.1.4/sec. 3.1.6): text | bytes (even-length-hex optimization) | tag-48
+// (a MAC address, RFC 9542). v1 surfaces the value; the DN string uses the text form.
+function _specialText(node) {
+  if (node.majorType === 3) return { text: cbor.read.textString(node) };
+  if (node.majorType === 2) return { hex: node.content.toString("hex") };
+  if (node.majorType === 6 && Number(node.argument) === 48) {
+    // A tag-48 MAC address (RFC 9542) MUST wrap a CBOR byte string of 6 (EUI-48/MAC-48) or 8 (EUI-64)
+    // bytes; anything else is malformed and cannot reconstruct a well-formed EUI-64 commonName.
+    if (!node.children || !node.children[0] || node.children[0].majorType !== 2) {
+      throw _err("c509/bad-name", "a tag-48 MAC-address value must wrap a CBOR byte string");
+    }
+    var euiBytes = node.children[0].content;
+    if (euiBytes.length !== 6 && euiBytes.length !== 8) throw _err("c509/bad-name", "a tag-48 MAC address must be 6 (EUI-48) or 8 (EUI-64) bytes");
+    return { eui64: euiBytes };
+  }
+  throw _err("c509/bad-name", "an attribute value is not a C509 SpecialText (text / bytes / tag-48)");
+}
+
+// A single Name (sec. 3.1.4/sec. 3.1.6): the CBOR simple null (issuer only) | a bare SpecialText single
+// commonName | an array of RDNAttributes. Surfaces { dn, rdns, eui64? } shape-compatible with x509.
+function _name509(node, isSubject) {
+  if (!isSubject && node.majorType === 7 && node.ai === 22) return null;   // issuer == subject (self-signed)
+  // A bare SpecialText (not an array) is a single commonName attribute (attributeType == +1).
+  if (node.majorType === 3 || node.majorType === 2 || node.majorType === 6) {
+    var sv = _specialText(node);
+    if (sv.eui64) return { rdns: [{ type: "commonName", eui64: sv.eui64 }], eui64: sv.eui64, dn: "CN=" + _macToEui64String(sv.eui64) };
+    var val = sv.text !== undefined ? sv.text : sv.hex;
+    return { rdns: [{ type: "commonName", value: val }], dn: "CN=" + val };
+  }
+  if (node.majorType !== 4) throw _err("c509/bad-name", "a C509 Name must be null, a SpecialText, or an array of RDN attributes");
+  var rdns = [];
+  var parts = [];
+  var kids = node.children || [];
+  // Each RDN attribute is an (attributeType, attributeValue) pair; an odd-length array is a dangling
+  // attribute type with no value -- reject rather than silently drop the trailing element.
+  if (kids.length % 2 !== 0) throw _err("c509/bad-name", "a C509 Name array must be attribute-type/value pairs (dangling attribute type)");
+  for (var i = 0; i + 1 < kids.length; i += 2) {
+    var ti = Number(cbor.read.int(kids[i]));
+    var tname = ATTR_BY_INT[Math.abs(ti)];
+    if (tname === undefined) throw _err("c509/bad-name", "attribute type integer " + ti + " has no C509 registry row");
+    var v = _specialText(kids[i + 1]);
+    var vv = v.text !== undefined ? v.text : (v.hex !== undefined ? v.hex : _macToEui64String(v.eui64));
+    rdns.push({ type: tname, value: vv, printable: ti < 0 });
+    parts.push(_shortName(tname) + "=" + vv);
+  }
+  return { rdns: rdns, dn: parts.join(",") };
+}
+function _shortName(n) { return n === "commonName" ? "CN" : n === "countryName" ? "C" : n === "organizationName" ? "O" : n === "organizationalUnitName" ? "OU" : n === "localityName" ? "L" : n === "stateOrProvinceName" ? "ST" : n; }
+
+// extensions (sec. 3.1.10/sec. 3.3/sec. 8.8): [ * Extension ] | a single keyUsage int-shortcut.
+function _extensions(node) {
+  // The keyUsage int-shortcut (sec. 3.1.10): a bare int -> one keyUsage extension, criticality from the
+  // sign, value = abs(int) (Appendix A.1.1: the single int 1 -> non-critical keyUsage digitalSignature).
+  if (node.majorType === 0 || node.majorType === 1) {
+    var iv = Number(cbor.read.int(node));
+    return [{ name: "keyUsage", oid: oid.byName("keyUsage"), critical: iv < 0, keyUsageBits: Math.abs(iv) }];
+  }
+  if (node.majorType !== 4) throw _err("c509/bad-extensions", "C509 extensions must be an array or a keyUsage int shortcut");
+  var out = [];
+  var kids = node.children || [];
+  // Each extension is an (extensionID, extensionValue) pair; an odd-length array is a dangling
+  // extension identifier with no value -- reject rather than silently drop the trailing element.
+  if (kids.length % 2 !== 0) throw _err("c509/bad-extensions", "a C509 extensions array must be id/value pairs (dangling extension identifier)");
+  for (var i = 0; i + 1 < kids.length; i += 2) {
+    var idNode = kids[i], valNode = kids[i + 1];
+    var name, extOid, critical, valContent;
+    if (idNode.majorType === 0 || idNode.majorType === 1) {
+      var ei = Number(cbor.read.int(idNode));
+      name = EXT_BY_INT[Math.abs(ei)];
+      if (name === undefined) throw _err("c509/bad-extensions", "extension type integer " + ei + " has no C509 registry row");
+      extOid = oid.byName(name); critical = ei < 0;
+      // An int extension value is a Defined CBOR item; v1 reconstructs only a byte-string value (a
+      // non-byte-string value surfaces as null and fails closed at the type-3 reconstruction).
+      valContent = valNode.content;
+    } else {
+      var r = _oidName(idNode, "c509/bad-extensions", "an extension id");
+      name = r.name; extOid = r.oid;
+      // ~oid extension (sec. 3.1.10): the extnValue is a byte string -- BARE (non-critical) or wrapped in a
+      // single-element array (critical). Validate the shape so a malformed value fails closed at decode.
+      critical = valNode.majorType === 4;
+      if (critical) {
+        if (!valNode.children || valNode.children.length !== 1 || valNode.children[0].majorType !== 2) {
+          throw _err("c509/bad-extensions", "a critical ~oid extension value must wrap a single byte string");
+        }
+        valContent = valNode.children[0].content;
+      } else {
+        if (valNode.majorType !== 2) throw _err("c509/bad-extensions", "a non-critical ~oid extension value must be a byte string");
+        valContent = valNode.content;
+      }
+    }
+    out.push({ name: name, oid: extOid, critical: critical, value: valContent || null });
+  }
+  return out;
+}
+
+// ---- type-3 DER reconstruction (byte-exact inversion; draft-20 sec. 3 / sec. 5) ----
+// Type 3 is an INVERTIBLE transform: the reconstruction reproduces the ORIGINAL DER Certificate
+// byte-for-byte (so the original signature verifies). A field outside the covered set fails closed
+// (c509/non-invertible) -- never a partial or best-effort DER.
+
+// A C509 tag-48 MAC (RFC 9542) reconstructs to the commonName EUI-64 string: a 6-byte value is a 48-bit
+// MAC expanded to the EUI-64 HH-HH-HH-FF-FE-HH-HH-HH by inserting FF-FE; an 8-byte value is the EUI-64.
+function _macToEui64String(buf) {
+  var bytes = buf.length === 6 ? Buffer.concat([buf.subarray(0, 3), Buffer.from([0xff, 0xfe]), buf.subarray(3)]) : buf;
+  var s = [];
+  for (var i = 0; i < bytes.length; i++) { var h = bytes[i].toString(16).toUpperCase(); if (h.length < 2) h = "0" + h; s.push(h); }
+  return s.join("-");
+}
+
+// One RDN attribute value -> its DER string. The C509 sign convention: a positive attribute int ->
+// utf8String, a negative -> printableString; countryName / serialNumber are PrintableString-restricted.
+function _reconAttrValue(rdn) {
+  if (rdn.eui64) return b.utf8(_macToEui64String(rdn.eui64));
+  if (rdn.type === "countryName" || rdn.type === "serialNumber") return b.printable(String(rdn.value));
+  return rdn.printable ? b.printable(String(rdn.value)) : b.utf8(String(rdn.value));
+}
+
+// A Name -> the DER RDNSequence (SEQUENCE OF SET OF SEQUENCE{ type, value }); one attribute per RDN.
+function _reconName(name) {
+  return b.sequence(name.rdns.map(function (rdn) {
+    return b.set([b.sequence([b.oid(oid.byName(rdn.type)), _reconAttrValue(rdn)])]);
+  }));
+}
+
+// A validity instant -> UTCTime (RFC 5280 sec. 4.1.2.5: year < 2050) or GeneralizedTime. A null notAfter
+// -> the no-well-defined-expiry sentinel 99991231235959Z.
+function _reconTime(date) {
+  if (date === null) return b.generalizedTime(new Date(Date.UTC(9999, 11, 31, 23, 59, 59)));
+  return date.getUTCFullYear() < 2050 ? b.utcTime(date) : b.generalizedTime(date);
+}
+
+// subjectPublicKeyInfo -> DER. EC: rebuild AlgorithmIdentifier{ ecPublicKey, namedCurve } + the BIT
+// STRING point, de-compressing a C509 0xFE/0xFD marker back to the original uncompressed 0x04||X||Y.
+function _reconSpki(spkAlg, keyBytes, rsaKey) {
+  if (spkAlg.name === "ecPublicKey") {
+    var fieldSize = EC_FIELD_BYTES[spkAlg.curve];
+    if (!fieldSize) throw _err("c509/non-invertible", "unsupported EC curve " + spkAlg.curve);
+    if (!keyBytes || keyBytes.length === 0) throw _err("c509/non-invertible", "the EC subjectPublicKey byte string is empty");
+    var head = keyBytes[0], point;
+    // The point length must match the curve field size for its encoding -- an uncompressed 0x04 point is
+    // 1 + 2*fieldSize, a compressed 0x02/0x03/0xFE/0xFD point is 1 + fieldSize -- so a truncated / padded
+    // point cannot be re-emitted as a valid (or byte-exact) SubjectPublicKeyInfo.
+    if (head === 0x04) {
+      if (keyBytes.length !== 1 + 2 * fieldSize) throw _err("c509/non-invertible", "uncompressed EC point length " + keyBytes.length + " does not match " + spkAlg.curve);
+      point = keyBytes;
+    } else if (head === 0x02 || head === 0x03) {
+      if (keyBytes.length !== 1 + fieldSize) throw _err("c509/non-invertible", "compressed EC point length " + keyBytes.length + " does not match " + spkAlg.curve);
+      point = keyBytes;
+    } else if (head === 0xfe || head === 0xfd) {                                // C509 marker -> de-compress
+      if (keyBytes.length !== 1 + fieldSize) throw _err("c509/non-invertible", "C509-marked EC point length " + keyBytes.length + " does not match " + spkAlg.curve);
+      var sec1 = Buffer.concat([Buffer.from([head === 0xfe ? 0x02 : 0x03]), keyBytes.subarray(1)]);
+      point = webcrypto.decompressEcPoint(sec1, spkAlg.curve, _err, "c509/non-invertible");
+    } else throw _err("c509/non-invertible", "unrecognized EC point encoding 0x" + head.toString(16));
+    return b.sequence([b.sequence([b.oid(oid.byName("ecPublicKey")), b.oid(oid.byName(spkAlg.curve))]), b.bitString(point, 0)]);
+  }
+  if (spkAlg.name === "rsaEncryption") {
+    // draft-20 sec. 3.2.1: the RSA key is [modulus, exponent] ~biguints, OR just the modulus ~biguint
+    // when the exponent is 65537 (parse has already resolved rsaKey to { modulus, exponent }). Reconstruct
+    // AlgorithmIdentifier{ rsaEncryption, NULL } + the BIT STRING wrapping RSAPublicKey ::= SEQUENCE {
+    // modulus INTEGER, publicExponent INTEGER }.
+    var rsaPk = b.sequence([b.integer(rsaKey.modulus), b.integer(rsaKey.exponent)]);
+    return b.sequence([b.sequence([b.oid(oid.byName("rsaEncryption")), b.nullValue()]), b.bitString(rsaPk, 0)]);
+  }
+  throw _err("c509/non-invertible", "subjectPublicKey algorithm " + spkAlg.name + " is not in the type-3 reconstruction covered set");
+}
+
+// The keyUsage int value -> the DER KeyUsage BIT STRING (RFC 5280 sec. 4.2.1.3): bit i of the value ->
+// BIT STRING named bit i (bit 0 = digitalSignature = the MSB of the first content octet).
+function _reconKeyUsageBits(value) {
+  // The keyUsage value indexes the 9 named bits of RFC 5280 sec. 4.2.1.3 (digitalSignature..decipherOnly);
+  // a non-positive, non-integer, or > 0x1FF value is not a valid KeyUsage and would also corrupt the
+  // 32-bit bitwise re-encoding below (a value past 2^31 wraps). Fail closed before the bit walk.
+  if (!Number.isInteger(value) || value <= 0 || value > 0x1ff) throw _err("c509/non-invertible", "a keyUsage value must be a positive integer within the 9 defined bits");
+  var hi = 0; for (var t = value; t; t >>= 1) hi++;   // number of significant bits
+  hi -= 1;                                             // highest set bit index
+  var nbytes = (hi >> 3) + 1;
+  var buf = Buffer.alloc(nbytes);
+  for (var bit = 0; bit <= hi; bit++) { if (value & (1 << bit)) buf[bit >> 3] |= 0x80 >> (bit & 7); }
+  return b.bitString(buf, 7 - (hi & 7));
+}
+
+// extensions -> the [3] EXPLICIT SEQUENCE OF Extension DER.
+function _reconExtensions(exts) {
+  var items = exts.map(function (ext) {
+    var extnValue;
+    if (ext.name === "keyUsage" && typeof ext.keyUsageBits === "number") extnValue = _reconKeyUsageBits(ext.keyUsageBits);
+    else if (Buffer.isBuffer(ext.value)) extnValue = ext.value;   // raw DER extnValue bytes
+    else throw _err("c509/non-invertible", "extension " + ext.name + " has no reconstructable value in the covered set");
+    var fields = [b.oid(ext.oid || oid.byName(ext.name))];
+    if (ext.critical) fields.push(b.boolean(true));
+    fields.push(b.octetString(extnValue));
+    return b.sequence(fields);
+  });
+  return b.explicit(3, b.sequence(items));
+}
+
+// An AlgorithmIdentifier -> DER SEQUENCE { algorithm OID, parameters? }. A C509 [~oid, params]
+// algorithm carries its DER parameters bytes, which MUST be reproduced so the reconstruction inverts
+// byte-exact (silently dropping them would change the signed bytes); the int / ~oid forms carry no
+// parameters (ecdsaWith* and the like omit them).
+function _reconAlgId(alg) {
+  var fields = [b.oid(alg.oid)];
+  if (alg.parameters && alg.parameters.length) {
+    // AlgorithmIdentifier.parameters is ANY -- exactly one well-formed DER element. Validate the supplied
+    // bytes decode as a single element (the strict decoder rejects trailing bytes / malformed encodings)
+    // before re-emitting them, so a malformed or multi-element parameter blob fails closed rather than
+    // producing an invalid reconstructed AlgorithmIdentifier.
+    try { asn1.decode(alg.parameters); }
+    catch (e) { throw _err("c509/non-invertible", "algorithm parameters are not a single well-formed DER element", e); }
+    fields.push(b.raw(alg.parameters));
+  }
+  return b.sequence(fields);
+}
+
+// The full type-3 -> DER Certificate reconstruction, byte-for-byte.
+function _reconstructDer(r, sigNode) {
+  var sigAlgSeq = _reconAlgId(r.signatureAlgorithm);
+  var tbsFields = [
+    b.explicit(0, b.integer(2n)),                                  // version v3 (type-3 is X.509 v3)
+    b.integer(r.serialNumber),
+    sigAlgSeq,
+    _reconName(r.issuer && r.issuer.rdns ? r.issuer : r.subject),  // null issuer -> issuer == subject
+    b.sequence([_reconTime(r.validity.notBefore), _reconTime(r.validity.notAfter)]),
+    _reconName(r.subject),
+    _reconSpki(r.subjectPublicKeyAlgorithm, r.subjectPublicKey, r.rsaPublicKey),
+  ];
+  // RFC 5280 sec. 4.1: the [3] extensions field is OPTIONAL and, when present, SHALL contain at least one
+  // extension -- an empty C509 extensions array reconstructs to an OMITTED field, not an empty SEQUENCE.
+  if (r.extensions.length) tbsFields.push(_reconExtensions(r.extensions));
+  var tbs = b.sequence(tbsFields);
+  // The signature is re-wrapped as a DER ECDSA-Sig-Value from the fixed-width r||s, so only an ECDSA
+  // signature algorithm is in the type-3 reconstruction covered set (an RSA/EdDSA signature is raw bytes,
+  // not r||s -- rejected rather than mis-wrapped). A wrong-length r||s surfaces the caller's typed code.
+  if (!/^ecdsa/i.test(r.signatureAlgorithm.name || "")) {
+    throw _err("c509/non-invertible", "type-3 signature reconstruction covers only ECDSA; got " + r.signatureAlgorithm.name);
+  }
+  // The fixed-width r||s must split at a real curve field width -- P-256/384/521 = 64/96/132 bytes
+  // (RFC 9053 sec. 2.1). A width that is not 2x a supported field size is not a valid ECDSA signature and
+  // cannot be re-wrapped byte-exact; surface the caller's typed code rather than split at a bogus offset.
+  var coordLen = r.signatureValue.length / 2;
+  if (coordLen !== 32 && coordLen !== 48 && coordLen !== 66) {
+    throw _err("c509/bad-signature", "the type-3 ECDSA signature width " + r.signatureValue.length + " is not a valid fixed-width r||s (expected 64/96/132 for P-256/384/521)");
+  }
+  var sigValue = validator.sig.rawToEcdsaDer(r.signatureValue, coordLen);
+  return b.sequence([tbs, sigAlgSeq, b.bitString(sigValue, 0)]);
+}
+
+// ---- the parse ----
+
+/**
+ * @primitive  pki.schema.c509.parse
+ * @signature  pki.schema.c509.parse(bytes) -> { certificateType, serialNumber, serialNumberHex, ... }
+ * @since      0.2.30
+ * @status     experimental
+ * @spec       draft-ietf-cose-cbor-encoded-cert, RFC 8949, RFC 9090, RFC 5280
+ *
+ * Decode a C509 certificate (draft-ietf-cose-cbor-encoded-cert) from its deterministic-CBOR bytes.
+ * Returns the decoded fields (c509CertificateType 2 native or 3 re-encoded); a malformed shape throws a
+ * typed C509Error carrying the inner cbor/asn1 fault as .cause. It decodes CBOR, not DER, so it is
+ * reached by an explicit call and is not auto-routed by pki.schema.parse. The type-2 signedData and the
+ * raw signature are surfaced RAW (a native verifier hashes them without re-serialization).
+ *
+ * @example
+ *   // the RFC 7925 profiled certificate from draft-ietf-cose-cbor-encoded-cert Appendix A.1 (type 3)
+ *   var bytes = Buffer.from(
+ *     "8b03" + "4301f50d" + "00" + "6b52464320746573742043" + "41" + "1a63b0cd00" + "1a6955b900" +
+ *     "d830460123456789ab" + "01" + "5821feb1216ab96e5b3b3340f5bdf02e693f16213a04525ed44450b1019c2dfd3838ab" +
+ *     "01" + "5840d4320b1d6849e309219d30037e138166f2508247dddae76ccceea55053c108e90d551f6d60106f1abb484cfbe6256c178e4ac3314ea19191e8b607da5ae3bda16",
+ *     "hex");
+ *   var c = pki.schema.c509.parse(bytes);
+ *   c.certificateType; // 3
+ */
+function parse(input) {
+  var root;
+  try { root = cbor.decode(input); }
+  catch (e) { throw _err("c509/not-a-certificate", "the input is not well-formed deterministic CBOR", e); }
+  if (root.majorType !== 4 || !root.children) throw _err("c509/not-a-certificate", "a C509 certificate must be a CBOR array");
+  var f = root.children;
+  if (f.length !== 11) throw _err("c509/bad-tbs", "a C509 certificate must be an array of exactly 11 elements, got " + f.length);
+
+  var type = Number(cbor.read.int(f[0]));
+  if (type !== 2 && type !== 3) throw _err("c509/bad-certificate-type", "c509CertificateType must be 2 (native) or 3 (re-encoded), got " + type);
+
+  var serialBytes = f[1];
+  var serial = _biguint(serialBytes, "c509/bad-serial", "certificateSerialNumber");
+  var sHex = serialBytes.content.toString("hex");
+
+  var sigAlg = _algorithm(f[2], SIG_ALG_BY_INT, "c509/unknown-algorithm", "issuerSignatureAlgorithm");
+  var issuer = _name509(f[3], false);
+  var notBefore = _time(f[4], false, "validityNotBefore");
+  var notAfter = _time(f[5], true, "validityNotAfter");
+  var subject = _name509(f[6], true);
+  var spkAlg = _algorithm(f[7], PK_ALG_BY_INT, "c509/unknown-algorithm", "subjectPublicKeyAlgorithm");
+  var subjectPublicKey = null, rsaKey = null;
+  if (spkAlg.name === "rsaEncryption") {
+    // draft-20 sec. 3.2.1: [modulus, exponent] ~biguints, OR a bare modulus ~biguint (exponent = 65537).
+    if (f[8].majorType === 2) rsaKey = { modulus: _biguint(f[8], "c509/bad-spki", "RSA modulus"), exponent: 65537n };
+    else if (f[8].majorType === 4 && f[8].children && f[8].children.length === 2) {
+      rsaKey = { modulus: _biguint(f[8].children[0], "c509/bad-spki", "RSA modulus"), exponent: _biguint(f[8].children[1], "c509/bad-spki", "RSA exponent") };
+    } else throw _err("c509/bad-spki", "an RSA subjectPublicKey must be a ~biguint modulus or [modulus, exponent]");
+    if (rsaKey.modulus < 1n || rsaKey.exponent < 1n) throw _err("c509/bad-spki", "an RSA modulus and public exponent must be positive");
+  } else {
+    if (f[8].majorType !== 2) throw _err("c509/bad-spki", "subjectPublicKey must be a CBOR byte string");
+    subjectPublicKey = f[8].content;
+  }
+  var extensions = _extensions(f[9]);
+  if (f[10].majorType !== 2) throw _err("c509/bad-signature", "issuerSignatureValue must be a CBOR byte string");
+  var signatureValue = f[10].content;
+
+  var result = {
+    certificateType: type,
+    serialNumber: serial,
+    serialNumberHex: sHex,
+    signatureAlgorithm: sigAlg,
+    issuer: issuer,
+    validity: { notBefore: notBefore, notAfter: notAfter },
+    subject: subject,
+    subjectPublicKeyAlgorithm: spkAlg,
+    subjectPublicKey: subjectPublicKey,
+    rsaPublicKey: rsaKey,
+    extensions: extensions,
+    signatureValue: signatureValue,
+  };
+
+  // Native (type-2) signed region (sec. 3.1.12): the RAW bytes of the CBOR-sequence elements 0..9 (NOT
+  // the outer array head, NOT the signature) -- a zero-copy subarray a native verifier hashes.
+  if (type === 2) {
+    var b0 = f[0].bytes, b9 = f[9].bytes;
+    var start = b0.byteOffset - input.byteOffset;
+    var end = b9.byteOffset - input.byteOffset + b9.length;
+    result.signedData = input.subarray(start, end);
+  }
+
+  // Type-3 is an invertible re-encoding of a DER X.509 certificate: reconstruct the original DER
+  // byte-for-byte so the original signature verifies and x509.parse recovers the certificate.
+  if (type === 3) result.reconstructedDer = _reconstructDer(result, f[10]);
+
+  return result;
+}
+
+// matches(node) -- a STRUCTURAL probe over a DECODED CBOR node: an array of 11 whose first element is
+// a major-type-0/1 int equal to 2 or 3. Not wired into the DER orchestrator (C509 is CBOR, not DER).
+function matches(node) {
+  return !!node && node.majorType === 4 && !!node.children && node.children.length === 11 &&
+    (node.children[0].majorType === 0 || node.children[0].majorType === 1) &&
+    (Number(node.children[0].argument) === 2 || Number(node.children[0].argument) === 3);
+}
+
+module.exports = { parse: parse, matches: matches };

package/lib/smime.js

@@ -168,7 +168,7 @@ async function sign(content, signers, opts) {
 // Coverage residual: the throw only fires on a >16 MiB assembled message -- a real cap, exercised by no
 // unit vector (driving it would sign 16 MiB).
 function _capped(msg) {
-  if (msg.length > C.LIMITS.MIME_MAX_BYTES) throw _err("smime/too-large", "the assembled S/MIME message (" + msg.length + " bytes) exceeds the " + C.LIMITS.MIME_MAX_BYTES + "-byte cap that verify enforces");
+  guard.limits.byteCap(msg, C.LIMITS.MIME_MAX_BYTES, _err, "smime/too-large", "the assembled S/MIME message");
   return msg;
 }
 

package/lib/tsp-sign.js

@@ -119,9 +119,7 @@ function sign(messageImprint, tsa, opts) {
   var imprint = b.sequence([_hashAlgId(mi.hashAlgorithm), b.octetString(Buffer.from(mi.hashedMessage))]);
   // genTime defaults to now; a supplied value MUST be a valid Date (never a silently-ignored
   // non-Date or an Invalid Date that would encode a garbage GeneralizedTime).
-  if (opts.genTime != null && (!(opts.genTime instanceof Date) || isNaN(opts.genTime.getTime()))) {
-    throw _err("tsp/bad-input", "genTime must be a valid Date");
-  }
+  if (opts.genTime != null) guard.time.assertValid(opts.genTime, _err, "tsp/bad-input", "genTime");
   var genTime = opts.genTime instanceof Date ? opts.genTime : new Date();
   var fields = [b.integer(1n), _policy(opts.policy), imprint, b.integer(BigInt(opts.serialNumber)), b.generalizedTime(genTime)];
   if (opts.accuracy) fields.push(_accuracy(opts.accuracy));

package/lib/validator-all.js

@@ -15,8 +15,9 @@
 //                                     -- the COMPLETE WebAuthn credential COSE_Key rule
 //                                        set (RFC 9052/9053 + WebAuthn sec. 6.5.1 +
 //                                        CTAP2 canonical + on-curve), one home
-//   validator.sig.ecdsaSigToRaw       -- the COMPLETE DER ECDSA-Sig-Value conformance
-//                                        (RFC 3279 + X.690 strict-DER) + raw r||s conversion
+//   validator.sig.ecdsaDerToP1363     -- the COMPLETE order-aware DER ECDSA-Sig-Value
+//                                        conformance (RFC 3279 + X.690 strict-DER +
+//                                        FIPS 186-5 [1,n-1], CVE-2022-21449) + raw r||s
 //   validator.attcert.packedCert / .aikCert / .aaguidExt / .requireV3 / .assertNotCa
 //                                     -- the WebAuthn attestation-certificate profile
 //                                        (sec. 8.2.1 packed, sec. 8.3.1 TPM AIK), one home

package/lib/validator-sig.js

@@ -25,42 +25,13 @@
 
 var asn1 = require("./asn1-der");
 
-// ecdsaSigToRaw(der, coordLen, E, code) -> the validated signature as raw r||s, each
-// coordinate left-padded to coordLen bytes, or throws new E(code, ...). The complete DER
-// ECDSA-Sig-Value conformance gate; a verifier MUST route an ECDSA signature through here,
-// never hand-decode the SEQUENCE and read r/s content raw (which skips minimality).
-// @enforced-by behavioral -- a DER ECDSA-Sig-Value decode has no rename-proof code shape
-// distinct from generic 2-child-SEQUENCE content access; the RED conformance vectors
-// (non-minimal / negative / zero / over-size r or s rejected) and the webauthn ECDSA KATs
-// are the guard.
-function ecdsaSigToRaw(der, coordLen, E, code) {
-  var node;
-  try { node = asn1.decode(der); } catch (e) { throw new E(code, "ECDSA signature is not a DER SEQUENCE", e); }
-  if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children || node.children.length !== 2) {
-    throw new E(code, "ECDSA signature must be a DER SEQUENCE { r, s }");
-  }
-  function coord(c, label) {
-    // The strict DER integer reader enforces PRIMITIVE + MINIMAL encoding (a constructed
-    // child, an empty INTEGER, or a redundant 0x00/0xFF sign octet all throw). The value
-    // is then range-checked: r and s MUST be positive (>= 1) and fit the curve field size.
-    var v;
-    try { v = asn1.read.integer(c); } catch (e) { throw new E(code, "ECDSA signature " + label + " is not a minimally-encoded DER INTEGER", e); }
-    if (v <= 0n) throw new E(code, "ECDSA signature " + label + " must be a positive integer");
-    var hex = v.toString(16); if (hex.length % 2) hex = "0" + hex;
-    var b = Buffer.from(hex, "hex");
-    if (b.length > coordLen) throw new E(code, "ECDSA signature " + label + " exceeds the curve field size");
-    var out = Buffer.alloc(coordLen); b.copy(out, coordLen - b.length); return out;
-  }
-  return Buffer.concat([coord(node.children[0], "r"), coord(node.children[1], "s")]);
-}
-
 // rawToEcdsaDer(raw, coordLen) -> the canonical DER ECDSA-Sig-Value SEQUENCE { r, s } for a raw
-// r||s signature (IEEE P1363, the WebCrypto sign() output). The inverse of ecdsaSigToRaw: a
+// r||s signature (IEEE P1363, the WebCrypto sign() output). The inverse of ecdsaDerToP1363: a
 // signer composes this so the emitted ECDSA signature is canonical DER (minimally-encoded
 // INTEGERs via the build layer), never a hand-built SEQUENCE that could re-introduce a
 // non-minimal encoding. A config-time TypeError guards a mis-sized raw signature at entry.
 // @enforced-by behavioral -- a DER ECDSA-Sig-Value BUILD has no rename-proof code shape distinct
-// from generic sequence([integer,integer]); the round-trip vectors (build -> ecdsaSigToRaw
+// from generic sequence([integer,integer]); the round-trip vectors (build -> ecdsaDerToP1363
 // identity) and the cms.sign ECDSA KATs are the guard.
 function rawToEcdsaDer(raw, coordLen) {
   if (!Buffer.isBuffer(raw) || typeof coordLen !== "number" || coordLen <= 0 || raw.length !== coordLen * 2) {
@@ -82,12 +53,15 @@ var CURVE_ORDER = {
 // ecdsaDerToP1363(der, curve, E, code) -> the DER ECDSA-Sig-Value converted to raw r||s (P1363),
 // each coordinate left-padded to the curve field width, rejecting r or s outside [1, n-1] against
 // the curve ORDER (CVE-2022-21449 "Psychic Signatures" -- the r/s = 0 case AND the >= n upper
-// bound). `curve` is a WebCrypto namedCurve (P-256/384/521). This is the ORDER-AWARE gate a
-// verifier that knows the curve order MUST use; it is STRICTER than ecdsaSigToRaw above, which
-// bounds r/s only by the field SIZE (>= 1, <= coordLen bytes) and does not know the order. A
-// signature whose r or s is >= n is rejected here but passes ecdsaSigToRaw -- do not conflate them.
-// @enforced-by behavioral -- the RED conformance vectors (r/s = 0, r/s >= n, non-minimal, over-size)
-// and the composite-signature + path-validation KATs are the guard.
+// bound). `curve` is a WebCrypto namedCurve (P-256/384/521). This is the SINGLE ECDSA-Sig-Value
+// conformance gate every curve-aware verifier routes through: it enforces the complete strict-DER
+// rule set (2-INTEGER SEQUENCE, minimal encoding) AND the order bound, so a verifier never
+// hand-decodes the SEQUENCE (skipping minimality) nor bounds r/s only by the field size (missing
+// the order). A non-minimal, negative, zero, over-size, or >= n coordinate fails closed.
+// @enforced-by behavioral -- a DER ECDSA-Sig-Value decode has no rename-proof code shape distinct
+// from generic 2-child-SEQUENCE content access; the RED conformance vectors (r/s = 0, r/s >= n,
+// non-minimal, negative, over-size) and the cms / ct / composite / path / webauthn ECDSA KATs are
+// the guard.
 function ecdsaDerToP1363(der, curve, E, code) {
   var width = CURVE_FIELD_BYTES[curve];
   var order = CURVE_ORDER[curve];
@@ -98,8 +72,12 @@ function ecdsaDerToP1363(der, curve, E, code) {
   if (n.tagClass !== "universal" || n.tagNumber !== asn1.TAGS.SEQUENCE || !n.children || n.children.length !== 2) {
     throw new E(code, "ECDSA signature must be a SEQUENCE of exactly two INTEGERs");
   }
-  var r = asn1.read.integer(n.children[0]);
-  var s = asn1.read.integer(n.children[1]);
+  // Wrap the strict DER integer reads (they enforce PRIMITIVE + MINIMAL encoding) so a non-minimal /
+  // constructed / empty INTEGER surfaces the CALLER's typed code, not a raw asn1/* -- the complete DER
+  // conformance rule set, gated together with the order bound below.
+  var r, s;
+  try { r = asn1.read.integer(n.children[0]); } catch (e) { throw new E(code, "ECDSA signature r is not a minimally-encoded DER INTEGER", e); }
+  try { s = asn1.read.integer(n.children[1]); } catch (e) { throw new E(code, "ECDSA signature s is not a minimally-encoded DER INTEGER", e); }
   if (r < 1n || s < 1n || r >= order || s >= order) {
     throw new E(code, "ECDSA signature component out of range [1, n-1] (CVE-2022-21449)");
   }
@@ -118,4 +96,4 @@ function ecdsaDerToP1363(der, curve, E, code) {
   return Buffer.concat([pad(r), pad(s)]);
 }
 
-module.exports = { ecdsaSigToRaw: ecdsaSigToRaw, rawToEcdsaDer: rawToEcdsaDer, ecdsaDerToP1363: ecdsaDerToP1363 };
+module.exports = { rawToEcdsaDer: rawToEcdsaDer, ecdsaDerToP1363: ecdsaDerToP1363 };

package/lib/webauthn.js

@@ -169,9 +169,9 @@ var COSE_ALG = {
 };
 
 // DER ECDSA-Sig-Value { r, s } -> raw r||s (the ieee-p1363 form WebCrypto verify expects).
-// validator-sig owns the complete strict-DER conformance (primitive, minimal, positive,
-// bounded r/s), composed here.
-function _derEcdsaToRaw(der, coordLen) { return validator.sig.ecdsaSigToRaw(der, coordLen, WebauthnError, "webauthn/bad-signature"); }
+// validator-sig owns the complete strict-DER conformance PLUS the FIPS 186-5 sec. 6.4.2 order bound
+// (r,s in [1, n-1] -- the order-aware gate a curve-aware verifier MUST use), composed here.
+function _derEcdsaToRaw(der, curve) { return validator.sig.ecdsaDerToP1363(der, curve, WebauthnError, "webauthn/bad-signature"); }
 
 // Verify `sig` over `message` with the SPKI public key `spkiBytes` under COSE `alg`.
 // A wrong signature resolves `false` from subtle.verify without throwing (a false
@@ -189,7 +189,7 @@ function _verifySig(alg, sig, spkiBytes, message, E) {
   // point before verify. This covers EVERY key that signs a WebAuthn statement: the x5c
   // attestation-certificate key (packed/tpm/apple) AND the self-attestation credential key.
   if (imp.name === "Ed25519" || imp.name === "Ed448") _requireValidEdPoint(spkiBytes, imp.name, E);
-  var s = d.ecdsa ? _derEcdsaToRaw(sig, d.ecdsa) : sig;
+  var s = d.ecdsa ? _derEcdsaToRaw(sig, d.imp.namedCurve) : sig;
   return subtle.importKey("spki", spkiBytes, imp, false, ["verify"])
     .then(function (key) { return subtle.verify(ver, key, s, message); })
     .catch(function (e) { throw _err("webauthn/verify-error", "the attestation signature could not be evaluated", e); });

package/lib/webcrypto.js

@@ -1000,10 +1000,27 @@ Crypto.prototype.getRandomValues = function getRandomValues(typedArray) {
 
 Crypto.prototype.randomUUID = function randomUUID() { return nodeCrypto.randomUUID(); };
 
+// decompressEcPoint(sec1Compressed, nodeCurve) -> the uncompressed SEC1 point 0x04||X||Y for a
+// compressed 0x02/0x03||X input, computing Y on-curve via node's ECDH.convertKey. The crypto-engine
+// home for EC point de-compression (Hard rule #8: EC key material is webcrypto's domain). Fail-closed:
+// convertKey throws on an off-curve X or an unsupported curve, surfaced as the caller's typed error.
+// `nodeCurve` is the OpenSSL curve name (prime256v1 / secp384r1 / secp521r1). The C509-specific
+// 0xFE/0xFD marker -> 0x02/0x03 parity translation stays in the C509 layer (this takes a real SEC1 point).
+function decompressEcPoint(sec1Compressed, nodeCurve, E, code) {
+  var head = sec1Compressed[0];
+  if (head !== 0x02 && head !== 0x03) throw E(code, "EC point de-compression expects a compressed SEC1 point (0x02/0x03)");
+  try {
+    return nodeCrypto.ECDH.convertKey(sec1Compressed, nodeCurve, undefined, undefined, "uncompressed");
+  } catch (e) {
+    throw E(code, "EC point is not on curve " + nodeCurve + " (de-compression failed)", e);
+  }
+}
+
 module.exports = {
   webcrypto:     new Crypto(),
   Crypto:        Crypto,
   SubtleCrypto:  SubtleCrypto,
   CryptoKey:     CryptoKey,
   WebCryptoError: WebCryptoError,
+  decompressEcPoint: decompressEcPoint,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.2.28",
+  "version": "0.2.30",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:517b8e6e-813e-4f65-9d63-651831e57f82",
+  "serialNumber": "urn:uuid:fcac8430-97c8-4f4c-a497-dc2f02fb3c6f",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-16T14:06:47.411Z",
+    "timestamp": "2026-07-16T18:34:40.509Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.2.28",
+      "bom-ref": "@blamejs/pki@0.2.30",
       "type": "application",
       "name": "pki",
-      "version": "0.2.28",
+      "version": "0.2.30",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.2.28",
+      "purl": "pkg:npm/%40blamejs/pki@0.2.30",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.2.28",
+      "ref": "@blamejs/pki@0.2.30",
       "dependsOn": []
     }
   ]