@blamejs/pki 0.2.29 → 0.2.31

package/CHANGELOG.md

@@ -4,6 +4,31 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.2.31 — 2026-07-16
+
+X.509 certificates now decode the RFC 3739 / ETSI EN 319 412-5 qualified-certificate qcStatements extension, and the sigstore verifier gains a low-order EdDSA public-key gate.
+
+### Added
+
+- The toolkit decodes the RFC 3739 sec. 3.2.6 / ETSI EN 319 412-5 qualified-certificate qcStatements extension (id-pe-qcStatements). The decoded statements -- QcCompliance (EU-qualified), QcLimitValue (reliance limit), QcSSCD (key in a QSCD), QcType (certificate purpose: esign / eseal / web), QcRetentionPeriod, QcPDS (disclosure-statement URLs), QcCClegislation (country of qualification), QcIdentMethod, QcQSCDlegislation, and the PKIX SemanticsInformation -- are decoded and validated by the toolkit's certificate-extension decoders and rendered by pki.inspect. An unknown statementId is preserved opaque (its raw bytes, semantics not executed); a malformed shape fails closed with a typed error.
+
+### Security
+
+- The sigstore keyless-bundle verifier now routes an Ed25519/Ed448 Fulcio leaf or Rekor log public key through the shared full-order Edwards-point gate before verification. A low-order OKP key (which node imports without complaint and which can verify a forged EdDSA signature) is rejected at key-parse (sigstore/bad-key) instead of being handed to verify -- the same defense the webauthn and certification-path EdDSA verifiers already apply.
+- Certification-path validation rejects a CRITICAL qcStatements extension (RFC 5280 sec. 6.1.4). A critical qualified-certificate statement asserts semantics a relying party must enforce -- a QcLimitValue reliance limit, a QcType certificate purpose -- and the validator does not enforce them, so treating the extension as processed would let a caller rely on a certificate outside its asserted qualified-certificate constraints; it is left unprocessed and fails as an unrecognized critical extension. A non-critical qcStatements is informational and does not affect the verdict; the extension is still decoded for pki.inspect and lint, and the linter flags a critical qcStatements as an unrecognized critical extension for the same reason -- structural decodability is not validation processing.
+
+## v0.2.30 — 2026-07-16
+
+C509 CBOR-encoded certificates arrive as pki.schema.c509.parse: decode the compact CBOR profile of X.509 in both its natively-signed and X.509-re-encoded forms, reconstructing the original DER byte-for-byte so the original signature still verifies.
+
+### Added
+
+- pki.schema.c509.parse(bytes) decodes a C509 CBOR-encoded certificate (draft-ietf-cose-cbor-encoded-cert) into structured, validated fields. It reads both certificate forms -- natively-signed (c509CertificateType 2) and the CBOR re-encoding of a DER X.509 v3 certificate (type 3) -- over the strict deterministic-CBOR codec, fail-closed. For a type-3 certificate it reconstructs the original DER byte-for-byte (de-compressing the EC point, re-emitting each field as canonical DER, re-wrapping the ECDSA signature) so the original signature verifies and the certificate round-trips through pki.schema.x509.parse; a field it cannot invert byte-exactly fails closed. It decodes CBOR, not DER, so it is an explicit-call surface and is not auto-routed by pki.schema.parse.
+
+### Fixed
+
+- Certification-path validation now rejects a trust anchor whose per-purpose distrust-after date is an invalid Date at input (path/bad-input). Previously a malformed date value passed the Date type check but compared as not-a-number, silently disabling the distrust-after restriction it was meant to enforce.
+
 ## v0.2.29 — 2026-07-16
 
 Certificate Transparency log-list signature verification arrives as pki.ct.verifyLogListSignature: verify the detached signature published alongside the CT log list against a caller-pinned signer key, completing the offline log-list trust chain.

package/README.md

@@ -203,7 +203,8 @@ is callable today; nothing below is a stub.
 | `pki.oid` | Two-way OID ↔ name registry — `name`, `byName`, `register`, `toArcs`/`fromArcs`, `toDER`/`fromDER`; seeded with RFC 5280 + NIST PQC arcs |
 | `pki.webcrypto` | A W3C WebCrypto (`SubtleCrypto`) engine over `node:crypto` — `sign`/`verify`/`encrypt`/`decrypt`/`deriveBits`/`digest`/`generateKey`/`importKey`/`exportKey` across RSA, ECDSA, ECDH, Ed25519/Ed448, AES, HMAC, HKDF, PBKDF2, SHA — **and** post-quantum ML-DSA-44/65/87 and SLH-DSA signatures, plus ML-KEM-512/768/1024 key generation and certificate/PKCS#8 import — the RFC 9935 seed / expandedKey / both private-key CHOICE is validated fail-closed, so an OpenSSL-legacy bare-seed or an internally inconsistent key is rejected with a typed error (KEM encapsulation lands with CMS KEM-decrypt). Zero-dependency, OpenSSL-interoperable |
 | `pki.schema` | The schema family — `parse` detects which PKI format DER / PEM encodes and routes to the right parser, `all` enumerates the registered formats, and the engine + per-format members are grouped here |
-| `pki.schema.x509` | Parse DER / PEM certificates into structured, validated fields — `parse`, `pemDecode`, `pemEncode` |
+| `pki.schema.x509` | Parse DER / PEM certificates into structured, validated fields, with named + partly-decoded extensions — including the RFC 3739 / ETSI EN 319 412-5 qualified-certificate `qcStatements` (EU-qualified declaration, reliance limit, QSCD flag, certificate type, retention, PDS URLs, country of qualification; unknown statements preserved opaque), fail-closed — `parse`, `pemDecode`, `pemEncode` |
+| `pki.schema.c509` | Parse C509 CBOR-encoded certificates (draft-ietf-cose-cbor-encoded-cert) — the compact CBOR profile of X.509, decoded fail-closed under deterministic CBOR; an explicit `parse` call (CBOR, not DER, so not auto-routed) |
 | `pki.schema.crl` | Parse DER / PEM X.509 CRLs per RFC 5280 §5 — revoked serials with real-`Date` revocation times, named + partly-decoded extensions, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.csr` | Parse DER / PEM PKCS#10 certification requests per RFC 2986 — subject DN, public key, requested attributes, signature, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.pkcs8` | Parse DER / PEM PKCS#8 private keys per RFC 5208 / 5958 — algorithm, raw key bytes, attributes, optional public key, fail-closed; encrypted keys recognized (not decrypted) — `parse`, `parseEncrypted`, `pemDecode`, `pemEncode` |

package/lib/acme.js

@@ -1111,6 +1111,9 @@ function validateRenewalInfo(obj) {
   _validate("renewalInfo", obj);
   var w = obj.suggestedWindow;
   if (!_isObject(w) || !_isRfc3339(w.start) || !_isRfc3339(w.end)) throw E("acme/bad-renewal-window", "a renewalInfo suggestedWindow must carry RFC 3339 start and end (RFC 9773 sec. 4.2)");
+  // The line above already rejected any w.start/w.end that is not a grammar+calendar-valid
+  // RFC 3339 string, so neither Date.parse can be NaN here -- the comparison is source-validated.
+  // allow:nan-date-comparison-unguarded -- source-validated by the rfc3339.isValid check above.
   if (Date.parse(w.end) <= Date.parse(w.start)) throw E("acme/bad-renewal-window", "the renewal window end must be strictly after start (RFC 9773 sec. 4.2)");
   return obj;
 }

package/lib/cms-encrypt.js

@@ -240,7 +240,7 @@ function _assertIterations(n) {
 // Bound the PBKDF2 salt to the same cap the decryptor enforces, so a message we emit is always one we
 // can read back.
 function _assertSalt(salt) {
-  if (salt.length > C.LIMITS.PBKDF2_MAX_SALT) throw _err("cms/bad-input", "salt exceeds the " + C.LIMITS.PBKDF2_MAX_SALT + "-octet cap");
+  guard.limits.byteCap(salt, C.LIMITS.PBKDF2_MAX_SALT, _err, "cms/bad-input", "salt");
   return salt;
 }
 

package/lib/cms-sign.js

@@ -21,6 +21,7 @@ var pkix = require("./schema-pkix");
 var frameworkError = require("./framework-error");
 
 var signScheme = require("./sign-scheme");
+var guard = require("./guard-all");
 var CmsError = frameworkError.CmsError;
 var b = asn1.build;
 function _err(code, message, cause) { return new CmsError(code, message, cause); }
@@ -156,9 +157,7 @@ function sign(content, signers, opts) {
   }
   // A supplied signing-time MUST be a valid Date (or false to omit the attribute) -- never a
   // silently-ignored non-Date or an Invalid Date that would encode a garbage Time.
-  if (opts.signingTime != null && opts.signingTime !== false && (!(opts.signingTime instanceof Date) || isNaN(opts.signingTime.getTime()))) {
-    throw _err("cms/bad-input", "signingTime must be a valid Date, or false to omit it");
-  }
+  if (opts.signingTime != null && opts.signingTime !== false) guard.time.assertValid(opts.signingTime, _err, "cms/bad-input", "signingTime");
 
   return Promise.all(list.map(function (s) { return _buildSignerInfo(s, contentBuf, eContentType, opts); })).then(function (built) {
     // digestAlgorithms: the distinct SignerInfo digestAlgorithm AlgorithmIdentifiers, deduped.

package/lib/ct.js

@@ -181,9 +181,7 @@ function _parseSct(r, sctLen) {
  */
 function parseSctList(extValue) {
   var blob = _peelInner(_toBuffer(extValue, "the SCT-list extension value"));
-  if (blob.length > C.LIMITS.SCT_MAX_BYTES) {
-    throw new CtError("ct/too-large", "SCT list " + blob.length + " bytes exceeds the cap " + C.LIMITS.SCT_MAX_BYTES);
-  }
+  guard.limits.byteCap(blob, C.LIMITS.SCT_MAX_BYTES, _ctErr, "ct/too-large", "SCT list");
   var outer = new TlsReader(blob, 0, blob.length);
   var listLen = outer.u16("ct/bad-list");
   if (listLen + 2 !== blob.length) {
@@ -777,12 +775,11 @@ async function verifySctWithLogList(entry, sct, logList, opts) {
   // Temporal gate (fail-closed): the covered cert's notAfter must be in [start_inclusive, end_exclusive).
   if (log.temporalInterval) {
     var notAfter = _resolveNotAfter(entry, opts);
-    // An Invalid Date (getTime() === NaN) is still `instanceof Date`, and NaN < x / NaN >= x are both
-    // false, so it would silently BYPASS the window containment -- reject it fail-closed, exactly like
-    // the codec's readTime rejects a NaN instant (a caller may pass a lenient `new Date(badString)`).
-    if (!(notAfter instanceof Date) || isNaN(notAfter.getTime())) throw _ctErr("ct/temporal-interval", "the CT log has a temporal_interval but the covered certificate's notAfter is not available or not a valid date (pass a valid opts.certNotAfter)");
-    var t = notAfter.getTime();
-    if (t < log.temporalInterval.startInclusive.getTime() || t >= log.temporalInterval.endExclusive.getTime()) {
+    // within() validates notAfter (and the interval bounds) fail-closed before comparing: an Invalid
+    // Date is instanceof Date yet NaN, and NaN < x / NaN >= x are both false, so an unvalidated notAfter
+    // would silently BYPASS the [startInclusive, endExclusive) containment. A malformed notAfter throws
+    // inside within (pass a valid opts.certNotAfter); an out-of-window notAfter returns false here.
+    if (!guard.time.within(notAfter, log.temporalInterval.startInclusive, log.temporalInterval.endExclusive, _ctErr, "ct/temporal-interval", "the covered certificate notAfter (pass a valid opts.certNotAfter)")) {
       throw _ctErr("ct/temporal-interval", "the covered certificate's notAfter is outside the CT log's temporal_interval");
     }
   }
@@ -815,7 +812,7 @@ async function verifyLogListSignature(json, signature, publicKey) {
   var message = typeof json === "string" ? Buffer.from(json) : _toBuffer(json, "the CT log list JSON");
   // Bound the signed message before the digest/verify (the same cap parseLogList enforces) so a hostile
   // caller cannot force unbounded hashing work on an oversized input (CWE-400).
-  if (message.length > C.LIMITS.CT_LOG_LIST_MAX_BYTES) throw new CtError("ct/too-large", "the CT log list exceeds the " + C.LIMITS.CT_LOG_LIST_MAX_BYTES + "-byte cap");
+  guard.limits.byteCap(message, C.LIMITS.CT_LOG_LIST_MAX_BYTES, _ctErr, "ct/too-large", "the CT log list");
   var sig = _toBuffer(signature, "the CT log list signature");
   var spki = _toBuffer(publicKey, "the CT log list signer public key (SPKI)");
   var alg = _spkiAlg(spki);   // fail-closed: a non-SPKI key or a forgeable RSA e < 3 throws ct/bad-input

package/lib/framework-error.js

@@ -231,6 +231,14 @@ var SmimeError = defineClass("SmimeError", { withCause: true });
 // inner `asn1/*` decode error) as `.cause`.
 var CtError = defineClass("CtError", { withCause: true });
 
+// C509Error -- a CBOR byte sequence that is not a well-formed C509 certificate
+// (draft-ietf-cose-cbor-encoded-cert): a root that is not the 11-element array, a
+// c509CertificateType outside {2,3}, a field encoded against its ~biguint/~time/~oid
+// contract, an algorithm/attribute/extension int with no registry row, or a type-3
+// cert that does not invert byte-for-byte to its original DER. Carries the underlying
+// leaf fault (the inner `cbor/*` or `asn1/*` decode error) as `.cause`.
+var C509Error = defineClass("C509Error", { withCause: true });
+
 // MerkleError -- a malformed input to the RFC 6962 / RFC 9162 Merkle-tree
 // proof-verification core: a tree coordinate that is not a non-negative integer
 // (or a Number above 2^53 where an exact BigInt is required), a leafIndex
@@ -333,6 +341,7 @@ module.exports = {
   CmpError:         CmpError,
   PathError:        PathError,
   CtError:          CtError,
+  C509Error:        C509Error,
   ShbsError:        ShbsError,
   HpkeError:        HpkeError,
   SigstoreError:    SigstoreError,

package/lib/guard-all.js

@@ -21,6 +21,8 @@
 //   guard.range.int / .uint31 / .positiveInt31
 //                                     -- bound a decoded integer before narrowing
 //                                        to Number (silent-narrowing defence)
+//   guard.time.assertValid / .within  -- validate a Date-instant before a temporal
+//                                        comparison (NaN-Date fail-open defence)
 //   guard.name.dnEqual / .rdnEqual / .assertNoControlBytes / .assertPrintableIa5
 //                                     -- canonical DN identity + name-string integrity
 //   guard.name.escapeControlBytes / .escapeDnValue
@@ -44,6 +46,7 @@ var text   = require("./guard-text");
 var limits = require("./guard-limits");
 var crypto = require("./guard-crypto");
 var range  = require("./guard-range");
+var time   = require("./guard-time");
 var name   = require("./guard-name");
 var encoding = require("./guard-encoding");
 var json   = require("./guard-json");
@@ -55,6 +58,7 @@ module.exports = {
   limits: limits,
   crypto: crypto,
   range:  range,
+  time:   time,
   name:   name,
   encoding: encoding,
   json:   json,

package/lib/guard-limits.js

@@ -103,4 +103,29 @@ function counter(max, E, code, label) {
   };
 }
 
-module.exports = { cap: cap, depthCap: depthCap, counter: counter };
+// byteCap(buf, max, E, code, label) -> the same buffer, once proven within `max`
+// bytes. Bounds a caller-supplied buffer BEFORE an expensive hash / verify / parse
+// materializes over it (CWE-400 uncontrolled resource consumption / CWE-770
+// allocation without limits -- the class guard.text.decode closes for a decoded
+// string and counter closes for element fanout, here for a raw byte input). Tier-2:
+// an over-size input is hostile / malformed content, so it throws the caller's typed
+// PkiError via the E(code, message) factory. `max` is the caller's ceiling (a
+// C.LIMITS.* constant, or an operator max already run through cap()).
+// @enforced-by behavioral -- a `buf.length > cap` size gate has no rename-proof code
+//   shape distinct from an arity / field-width check (children.length > 2,
+//   ext.length > 0xffff), so a codebase-patterns detector would false-fire; the
+//   over-size RED vectors driving the composing verifiers are the guard.
+function byteCap(buf, max, E, code, label) {
+  // The ceiling is an authoring input: an undefined / NaN / fractional / negative
+  // max makes `length > max` never fire -- a silently dead size defence. Reject at
+  // config time (TypeError), regardless of the value currency E selects.
+  if (!Number.isInteger(max) || max < 0) {
+    throw new TypeError("guard.limits.byteCap: max must be a non-negative integer");
+  }
+  if (buf.length > max) {
+    throw E(code, (label || "input") + " is " + buf.length + " bytes, over the " + max + "-byte cap");
+  }
+  return buf;
+}
+
+module.exports = { cap: cap, depthCap: depthCap, counter: counter, byteCap: byteCap };

package/lib/guard-time.js

@@ -0,0 +1,68 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. The documented surface is the
+// verifiers whose validity / currency / temporal gates compose this guard
+// (pki.path.validate, pki.ocsp.verify, pki.tsp.*, pki.ct.*, pki.cms.sign).
+//
+// guard-time -- fail-closed Date-instant validation before a temporal comparison.
+//
+// Defends the NaN-Date fail-open class (CWE-20 improper input validation feeding
+// a silent security-gate bypass). An Invalid Date is still `instanceof Date`, and
+// EVERY relational comparison against its NaN getTime() (NaN < x, NaN >= x) is
+// false -- so a validity / not-before / not-after / currency window built on an
+// unvalidated Date silently ACCEPTS when it should reject. The class recurred at
+// three independent boundaries (TSP genTime, OCSP producedAt/thisUpdate, CT
+// temporal-interval) before it was centralized here; the sibling
+// nan-date-comparison-unguarded codebase-patterns detector flags any lib function
+// that re-inlines a `.getTime()` comparison WITHOUT first rejecting a NaN, so a
+// new boundary is routed to this guard rather than re-growing the bug.
+//
+// Tier split: `value instanceof Date` with a NaN time is malformed CALLER input
+// (a config-time / entry-point Date -- an operator-supplied distrustAfter, a
+// caller `opts.time`), so assertValid throws the caller's typed error rather than
+// returning a silent default. within() is the fail-closed window primitive: it
+// THROWS on a malformed operand but RETURNS a boolean for in/out-of-window, so the
+// OCSP / CRL currency callers that treat out-of-window as a `continue` skip keep
+// their control flow while a NaN operand can never slip through as a false.
+
+// assertValid(value, E, code, label) -> the same Date, once proven valid.
+//   value : a Date (or an alleged one) from a caller boundary.
+//   E     : the (code, message[, cause]) typed-error FACTORY in scope at the call
+//           site (ns.E / the module-local _err) -- NEVER a defineClass class, which
+//           would crash `class cannot be invoked without new` on the error path.
+//   code  : the frozen domain/reason code this boundary rejects malformed time under.
+//   label : field phrase for the message.
+// @enforced-by nan-date-comparison-unguarded
+function assertValid(value, E, code, label) {
+  if (!(value instanceof Date) || isNaN(value.getTime())) {
+    throw E(code, (label || "value") + " must be a valid Date");
+  }
+  return value;
+}
+
+// within(instant, lower, upper, E, code, label, opts) -> boolean (instant in window).
+//   Rejects a malformed instant / lower / upper by THROWING (assertValid), then
+//   answers containment as a boolean. Half-open [lower, upper) by default (a CT
+//   temporal-interval / an OCSP-CRL currency window); pass opts.upperInclusive for
+//   the closed [notBefore, notAfter] certificate-validity shape.
+// @enforced-by nan-date-comparison-unguarded
+function within(instant, lower, upper, E, code, label, opts) {
+  // assertValid rejects a non-Date / Invalid Date operand up front, so t/lo/hi below are
+  // guaranteed non-NaN -- the containment comparisons can never be a silent NaN-false. The
+  // getTime() results are bound to locals (not compared inline), so this home carries no
+  // unguarded `.getTime()`-in-a-comparison shape for the nan-date-comparison-unguarded detector.
+  assertValid(instant, E, code, label);
+  assertValid(lower, E, code, (label || "window") + " lower bound");
+  assertValid(upper, E, code, (label || "window") + " upper bound");
+  var t = instant.getTime();
+  var lo = lower.getTime();
+  var hi = upper.getTime();
+  return t >= lo && (opts && opts.upperInclusive ? t <= hi : t < hi);
+}
+
+module.exports = {
+  assertValid: assertValid,
+  within: within,
+};

package/lib/inspect.js

@@ -317,6 +317,24 @@ var EXT_RENDERERS = {
     if (decoded.pathLenConstraint != null) s += ", pathlen:" + decoded.pathLenConstraint;
     return inner + s;
   },
+  qcStatements: function (decoded, inner) {
+    return decoded.map(function (s) {
+      var label = inner + (s.name || s.statementId), info = s.info;
+      if (!info) return label;                                                              // presence-only (QcCompliance / QcSSCD)
+      if (info.opaque) return label + " (opaque)";
+      if (typeof info.amount !== "undefined") return label + ": " + info.amount + " " + info.currency + (info.exponent ? " x10^" + info.exponent : "");   // QcLimitValue
+      if (typeof info.years !== "undefined") return label + ": " + info.years + " years";   // QcRetentionPeriod
+      if (info.typeNames) return label + ": " + info.typeNames.map(function (n, i) { return n || info.types[i]; }).join(", ");         // QcType
+      if (info.methodNames) return label + ": " + info.methodNames.map(function (n, i) { return n || info.methods[i]; }).join(", ");   // QcIdentMethod
+      if (info.locations) return label + ": " + info.locations.map(function (l) { return l.url + " (" + l.language + ")"; }).join(", "); // QcPDS
+      if (info.countries) return label + ": " + info.countries.join(", ");                  // QcCClegislation / QcQSCDlegislation
+      if (typeof info.semanticsIdentifier !== "undefined") {                                // SemanticsInformation (id-qcs)
+        var nra = info.nameRegistrationAuthorities && info.nameRegistrationAuthorities.length;
+        return label + (info.semanticsIdentifier ? ": " + info.semanticsIdentifier : "") + (nra ? " (" + nra + " NRA)" : "");
+      }
+      return label;
+    }).join("\n");
+  },
   subjectAltName: _renderAltName,
   issuerAltName: _renderAltName,
   certificatePolicies: function (decoded, inner) {

package/lib/lint.js

@@ -244,7 +244,17 @@ function _subjectCNs(cert) {
 // policyMappings, which the table decodes) and correctly scoped to EXTENSION OIDs: an
 // algorithm / EKU-purpose OID the name registry happens to resolve is NOT in the decoder
 // table, so a critical extension carrying such an OID is still flagged.
-function _isUnknownExtension(extOid) { return !EXT_DECODERS[extOid]; }
+//
+// The one exception: an extension the table DECODES for display but whose CRITICAL semantics
+// the toolkit does not enforce. qcStatements decodes (for pki.inspect / this linter) yet a
+// critical instance asserts qualified-certificate constraints (a reliance limit, a certificate
+// purpose) no consumer here processes -- path-validate rejects a critical qcStatements as
+// unrecognized-critical for exactly that reason. Structural decodability is not validation
+// processing, so a critical qcStatements is still flagged here, keeping lint consistent with
+// certification-path validation.
+var _DECODE_ONLY_UNPROCESSED_CRITICAL = {};
+_DECODE_ONLY_UNPROCESSED_CRITICAL[oid.byName("qcStatements")] = true;
+function _isUnknownExtension(extOid) { return !EXT_DECODERS[extOid] || _DECODE_ONLY_UNPROCESSED_CRITICAL[extOid] === true; }
 
 // RSA-modulus / EC-curve helpers for the weak-key lint. Each returns null when the key
 // material cannot be read as expected (a malformed RSA modulus, or EC parameters that are

package/lib/oid.js

@@ -80,7 +80,20 @@ var FAMILIES = {
   // aaControls sec. 7.4, ac-proxying sec. 7.2).
   pkixAccess: { base: [1, 3, 6, 1, 5, 5, 7, 1], of: {
     authorityInfoAccess: 1, acAuditIdentity: 4, aaControls: 6, acProxying: 10,
-    acmeIdentifier: 31 } },
+    acmeIdentifier: 31,
+    // id-pe-qcStatements (RFC 3739 sec. 3.2.6) -- the qualified-certificate-statements extension.
+    qcStatements: 3 } },
+
+  // RFC 3739 sec. 3.2.6.1 id-qcs -- the PKIX QCStatement statementIds carrying SemanticsInformation.
+  pkixQcSyntax: { base: [1, 3, 6, 1, 5, 5, 7, 11], of: { qcsPkixQCSyntaxV1: 1, qcsPkixQCSyntaxV2: 2 } },
+
+  // ETSI EN 319 412-5 qualified-certificate statements (esi4-qcStatement-N) on the id-etsi-qcs arc.
+  etsiQcs: { base: [0, 4, 0, 1862, 1], of: {
+    qcCompliance: 1, qcLimitValue: 2, qcRetentionPeriod: 3, qcSSCD: 4, qcPDS: 5,
+    qcType: 6, qcCClegislation: 7, qcIdentMethod: 8, qcQSCDlegislation: 9 } },
+
+  // ETSI EN 319 412-5 QcType member OIDs (the certificate-purpose types) on the id-etsi-qct arc.
+  etsiQcType: { base: [0, 4, 0, 1862, 1, 6], of: { qctEsign: 1, qctEseal: 2, qctWeb: 3 } },
 
   // id-aca -- RFC 5755 attribute-certificate attribute types on the id-pkix 10 arc:
   // authenticationInfo sec. 4.4.1 .. group sec. 4.4.4, plus encAttrs sec. 7.1 (the encrypted-

package/lib/path-validate.js

@@ -91,6 +91,12 @@ var PROCESSED_EXTENSIONS = {};
 // validateCriticalExtensionStructure via the registered decoder. freshestCRL
 // stays OUT: sec. 4.2.1.15 requires it non-critical and the validator does not
 // consult it (no delta merge), so a critical instance fails unrecognized.
+// qcStatements is deliberately NOT processed: a critical QC statement (QcLimitValue reliance limit,
+// QcType certificate purpose) asserts qualified-certificate semantics a relying party MUST enforce, and
+// this validator does not enforce them (nor expose a handler to). Marking it processed would let a caller
+// treat a certificate as valid outside its asserted critical QC constraints, so a critical qcStatements
+// fails as an unrecognized-critical extension (RFC 5280 sec. 6.1.4); a non-critical instance is
+// informational and does not affect the verdict. The extension is still decoded for pki.inspect / lint.
 [OID.basicConstraints, OID.keyUsage, OID.nameConstraints, OID.certificatePolicies,
  OID.policyMappings, OID.policyConstraints, OID.inhibitAnyPolicy, OID.subjectAltName,
  OID.extKeyUsage, OID.cRLDistributionPoints].
@@ -1133,9 +1139,7 @@ async function validate(path, opts) {
   if (!opts.trustAnchor) throw E("path/bad-input", "validate: a trustAnchor is required");
   // The validity-window check is always on (6.1.3(a)(2)); a missing/invalid
   // check date must fail closed, never silently disable it.
-  if (!(opts.time instanceof Date) || isNaN(opts.time.getTime())) {
-    throw E("path/bad-input", "validate: opts.time must be a Date (the always-on validity-window check date)");
-  }
+  guard.time.assertValid(opts.time, E, "path/bad-input", "validate: opts.time (the always-on validity-window check date)");
   // Entry-point tier for the remaining 6.1.1 user-initial inputs: a bad value
   // throws here rather than silently disabling the behavior it configures.
   // Validate-if-present (the default is applied where the policy state is built);
@@ -1355,13 +1359,20 @@ async function validate(path, opts) {
       // per-purpose distrust-after date and delegator purposes apply to the
       // end-entity leaf it ultimately certifies.
       var ta = opts.trustAnchor;
-      if (checkPurpose && ta.distrustAfter && ta.distrustAfter[checkPurpose] instanceof Date &&
-          cert.validity.notBefore > ta.distrustAfter[checkPurpose]) {
+      // A PRESENT-but-malformed distrustAfter (an Invalid Date: instanceof Date yet a
+      // NaN time) would make `notBefore > it` NaN-false and SILENTLY drop the distrust
+      // restriction -- the NaN-Date fail-open. Validate a present date fail-closed
+      // before the comparison; an absent (undefined/null) date is no restriction.
+      var distrustDate = (checkPurpose && ta.distrustAfter) ? ta.distrustAfter[checkPurpose] : null;
+      if (distrustDate != null) {
+        distrustDate = guard.time.assertValid(distrustDate, E, "path/bad-input", "trustAnchor.distrustAfter." + checkPurpose);
         // STRICTLY > : a leaf whose notBefore == the distrust date stays trusted
         // (Mozilla certverifier isDistrustedCertificateChain: endEntityNotBefore
         // <= distrustAfterTime -> not distrusted; the end-of-day ...235959Z
         // convention keeps the whole boundary day trusted).
-        checks.push({ name: "distrustAfter", ok: false, code: "path/distrusted-after" }); failed = true;
+        if (cert.validity.notBefore > distrustDate) {
+          checks.push({ name: "distrustAfter", ok: false, code: "path/distrusted-after" }); failed = true;
+        }
       }
       if (checkPurpose && ta.purposes && ta.purposes[checkPurpose] !== true) {
         checks.push({ name: "purposeTrust", ok: false, code: "path/purpose-not-trusted" }); failed = true;

package/lib/schema-all.js

@@ -33,6 +33,7 @@
 var engine = require("./schema-engine");
 var pkix = require("./schema-pkix");
 var x509 = require("./schema-x509");
+var c509 = require("./schema-c509");
 var crl = require("./schema-crl");
 var csr = require("./schema-csr");
 var pkcs8 = require("./schema-pkcs8");
@@ -295,6 +296,9 @@ function parse(input) {
 module.exports = {
   engine: engine,
   x509: { parse: x509.parse, pemDecode: x509.pemDecode, pemEncode: x509.pemEncode },
+  // C509 is CBOR, not DER: an explicit-call surface only, NOT added to FORMATS / the detect-and-route
+  // parse() below (which detect DER shapes). No pemDecode/pemEncode -- C509 is binary CBOR.
+  c509: { parse: c509.parse },
   crl:  { parse: crl.parse,  pemDecode: crl.pemDecode, pemEncode: crl.pemEncode },
   csr:  { parse: csr.parse,  pemDecode: csr.pemDecode, pemEncode: csr.pemEncode },
   pkcs8: { parse: pkcs8.parse, parseEncrypted: pkcs8.parseEncrypted, pemDecode: pkcs8.pemDecode, pemEncode: pkcs8.pemEncode },