@blamejs/pki 0.2.30 → 0.2.32

package/CHANGELOG.md

@@ -4,6 +4,31 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.2.32 — 2026-07-16
+
+X.509 certificates now decode the Microsoft Active Directory Certificate Services enrollment extensions, and pki.lint's critical-extension check is aligned with certification-path validation.
+
+### Added
+
+- pki.schema.x509.parse decodes the Microsoft Active Directory Certificate Services enrollment extensions ([MS-WCCE] / [MS-CRTD]): the v2 certificate template (szOID-CERTIFICATE_TEMPLATE -- template OID plus major/minor version), the legacy v1 template name (szOID-ENROLL_CERTTYPE_EXTENSION), the CA version (szOID-CERTSRV_CA_VERSION, surfaced as the raw value and as the CA key index / certificate index split), the previous-CA-certificate hash (szOID-CERTSRV_PREVIOUS_CERT_HASH), and the application policies (szOID-APPLICATION_CERT_POLICIES, decoded as RFC 5280 certificate policies). Each is rendered by pki.inspect and fails closed with a typed error on a malformed shape. The version fields accept the full 32-bit range Active Directory uses, not a signed subset.
+
+### Changed
+
+- pki.lint's unrecognized-critical-extension check now mirrors certification-path validation: it reports a critical extension whose semantics the path validator does not process -- an authority/subject key identifier, a freshest-CRL pointer, an SCT list, a qualified-certificate statement, or a Microsoft enterprise-CA extension -- rather than treating any extension it can merely decode as processed. precertificatePoison, which RFC 6962 requires to be critical, is not reported. A conforming relying party must reject a critical extension it cannot process, so a certificate whose critical enterprise or qualified-certificate constraints this toolkit does not enforce is now surfaced by the linter.
+
+## v0.2.31 — 2026-07-16
+
+X.509 certificates now decode the RFC 3739 / ETSI EN 319 412-5 qualified-certificate qcStatements extension, and the sigstore verifier gains a low-order EdDSA public-key gate.
+
+### Added
+
+- The toolkit decodes the RFC 3739 sec. 3.2.6 / ETSI EN 319 412-5 qualified-certificate qcStatements extension (id-pe-qcStatements). The decoded statements -- QcCompliance (EU-qualified), QcLimitValue (reliance limit), QcSSCD (key in a QSCD), QcType (certificate purpose: esign / eseal / web), QcRetentionPeriod, QcPDS (disclosure-statement URLs), QcCClegislation (country of qualification), QcIdentMethod, QcQSCDlegislation, and the PKIX SemanticsInformation -- are decoded and validated by the toolkit's certificate-extension decoders and rendered by pki.inspect. An unknown statementId is preserved opaque (its raw bytes, semantics not executed); a malformed shape fails closed with a typed error.
+
+### Security
+
+- The sigstore keyless-bundle verifier now routes an Ed25519/Ed448 Fulcio leaf or Rekor log public key through the shared full-order Edwards-point gate before verification. A low-order OKP key (which node imports without complaint and which can verify a forged EdDSA signature) is rejected at key-parse (sigstore/bad-key) instead of being handed to verify -- the same defense the webauthn and certification-path EdDSA verifiers already apply.
+- Certification-path validation rejects a CRITICAL qcStatements extension (RFC 5280 sec. 6.1.4). A critical qualified-certificate statement asserts semantics a relying party must enforce -- a QcLimitValue reliance limit, a QcType certificate purpose -- and the validator does not enforce them, so treating the extension as processed would let a caller rely on a certificate outside its asserted qualified-certificate constraints; it is left unprocessed and fails as an unrecognized critical extension. A non-critical qcStatements is informational and does not affect the verdict; the extension is still decoded for pki.inspect and lint, and the linter flags a critical qcStatements as an unrecognized critical extension for the same reason -- structural decodability is not validation processing.
+
 ## v0.2.30 — 2026-07-16
 
 C509 CBOR-encoded certificates arrive as pki.schema.c509.parse: decode the compact CBOR profile of X.509 in both its natively-signed and X.509-re-encoded forms, reconstructing the original DER byte-for-byte so the original signature still verifies.

package/README.md

@@ -203,7 +203,7 @@ is callable today; nothing below is a stub.
 | `pki.oid` | Two-way OID ↔ name registry — `name`, `byName`, `register`, `toArcs`/`fromArcs`, `toDER`/`fromDER`; seeded with RFC 5280 + NIST PQC arcs |
 | `pki.webcrypto` | A W3C WebCrypto (`SubtleCrypto`) engine over `node:crypto` — `sign`/`verify`/`encrypt`/`decrypt`/`deriveBits`/`digest`/`generateKey`/`importKey`/`exportKey` across RSA, ECDSA, ECDH, Ed25519/Ed448, AES, HMAC, HKDF, PBKDF2, SHA — **and** post-quantum ML-DSA-44/65/87 and SLH-DSA signatures, plus ML-KEM-512/768/1024 key generation and certificate/PKCS#8 import — the RFC 9935 seed / expandedKey / both private-key CHOICE is validated fail-closed, so an OpenSSL-legacy bare-seed or an internally inconsistent key is rejected with a typed error (KEM encapsulation lands with CMS KEM-decrypt). Zero-dependency, OpenSSL-interoperable |
 | `pki.schema` | The schema family — `parse` detects which PKI format DER / PEM encodes and routes to the right parser, `all` enumerates the registered formats, and the engine + per-format members are grouped here |
-| `pki.schema.x509` | Parse DER / PEM certificates into structured, validated fields — `parse`, `pemDecode`, `pemEncode` |
+| `pki.schema.x509` | Parse DER / PEM certificates into structured, validated fields, with named + partly-decoded extensions — including the RFC 3739 / ETSI EN 319 412-5 qualified-certificate `qcStatements` (EU-qualified declaration, reliance limit, QSCD flag, certificate type, retention, PDS URLs, country of qualification; unknown statements preserved opaque) and the Microsoft Active Directory Certificate Services enrollment extensions (certificate template, CA version, previous-CA-certificate hash, application policies), fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.c509` | Parse C509 CBOR-encoded certificates (draft-ietf-cose-cbor-encoded-cert) — the compact CBOR profile of X.509, decoded fail-closed under deterministic CBOR; an explicit `parse` call (CBOR, not DER, so not auto-routed) |
 | `pki.schema.crl` | Parse DER / PEM X.509 CRLs per RFC 5280 §5 — revoked serials with real-`Date` revocation times, named + partly-decoded extensions, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.csr` | Parse DER / PEM PKCS#10 certification requests per RFC 2986 — subject DN, public key, requested attributes, signature, fail-closed — `parse`, `pemDecode`, `pemEncode` |

package/lib/inspect.js

@@ -317,6 +317,37 @@ var EXT_RENDERERS = {
     if (decoded.pathLenConstraint != null) s += ", pathlen:" + decoded.pathLenConstraint;
     return inner + s;
   },
+  qcStatements: function (decoded, inner) {
+    return decoded.map(function (s) {
+      var label = inner + (s.name || s.statementId), info = s.info;
+      if (!info) return label;                                                              // presence-only (QcCompliance / QcSSCD)
+      if (info.opaque) return label + " (opaque)";
+      if (typeof info.amount !== "undefined") return label + ": " + info.amount + " " + info.currency + (info.exponent ? " x10^" + info.exponent : "");   // QcLimitValue
+      if (typeof info.years !== "undefined") return label + ": " + info.years + " years";   // QcRetentionPeriod
+      if (info.typeNames) return label + ": " + info.typeNames.map(function (n, i) { return n || info.types[i]; }).join(", ");         // QcType
+      if (info.methodNames) return label + ": " + info.methodNames.map(function (n, i) { return n || info.methods[i]; }).join(", ");   // QcIdentMethod
+      if (info.locations) return label + ": " + info.locations.map(function (l) { return l.url + " (" + l.language + ")"; }).join(", "); // QcPDS
+      if (info.countries) return label + ": " + info.countries.join(", ");                  // QcCClegislation / QcQSCDlegislation
+      if (typeof info.semanticsIdentifier !== "undefined") {                                // SemanticsInformation (id-qcs)
+        var nra = info.nameRegistrationAuthorities && info.nameRegistrationAuthorities.length;
+        return label + (info.semanticsIdentifier ? ": " + info.semanticsIdentifier : "") + (nra ? " (" + nra + " NRA)" : "");
+      }
+      return label;
+    }).join("\n");
+  },
+  msCertificateTemplate: function (decoded, inner) {
+    var v = decoded.templateMajorVersion === null ? "" : " v" + decoded.templateMajorVersion + "." + (decoded.templateMinorVersion === null ? 0 : decoded.templateMinorVersion);
+    return inner + "Template: " + (decoded.name || decoded.templateID) + v;
+  },
+  msEnrollCertType: function (decoded, inner) {
+    return inner + "Cert Type: " + _clean(String(decoded));
+  },
+  msCaVersion: function (decoded, inner) {
+    return inner + "CA Version: V" + decoded.caKeyIndex + "." + decoded.certIndex;
+  },
+  msPreviousCertHash: function (decoded, inner) {
+    return inner + _hexColon(Buffer.isBuffer(decoded) ? decoded : Buffer.alloc(0), { upper: true });
+  },
   subjectAltName: _renderAltName,
   issuerAltName: _renderAltName,
   certificatePolicies: function (decoded, inner) {
@@ -404,6 +435,8 @@ var EXT_RENDERERS = {
     return akiLines.length ? akiLines.join("\n") : inner + "keyid:(none)";
   },
 };
+// [MS-WCCE] szOID-APPLICATION_CERT_POLICIES decodes as certificatePolicies, so it renders identically.
+EXT_RENDERERS.msApplicationPolicies = EXT_RENDERERS.certificatePolicies;
 
 // Coverage residual -- the EXT_RENDERERS entry fallbacks are unreachable because each shared
 // decoder (and asn1.read.oid) already narrows the shape before the renderer runs:

package/lib/lint.js

@@ -29,6 +29,7 @@ var guard = require("./guard-all");
 var oid = require("./oid");
 var x509 = require("./schema-x509");
 var pkix = require("./schema-pkix");
+var path = require("./path-validate");
 var C = require("./constants");
 var ipUtils = require("./ip-utils");
 
@@ -237,14 +238,32 @@ function _subjectCNs(cert) {
   return out;
 }
 
-// An extension is "recognized" (RFC 5280 4.2: a consumer MUST reject a critical extension
-// it does NOT recognize / cannot process) when the toolkit has a DECODER for it -- the
-// shared certExtensionDecoders table IS the set of extensions this toolkit processes. This
-// is registry-driven (no curated list to omit a legitimately-critical extension such as
-// policyMappings, which the table decodes) and correctly scoped to EXTENSION OIDs: an
-// algorithm / EKU-purpose OID the name registry happens to resolve is NOT in the decoder
-// table, so a critical extension carrying such an OID is still flagged.
-function _isUnknownExtension(extOid) { return !EXT_DECODERS[extOid]; }
+// An extension's CRITICALITY is honoured (RFC 5280 4.2: a consumer MUST reject a critical extension
+// it cannot PROCESS) only when this toolkit actually processes its semantics. That authority is
+// path-validate's PROCESSED_EXTENSIONS (the RFC 5280 sec. 6.1 path-processing set), NOT the decoder
+// table: certExtensionDecoders also DECODES many extensions purely for display (qcStatements, the MS
+// enterprise-CA extensions, the SCT list, the *KeyIdentifiers, freshestCRL, issuerAltName) whose
+// critical semantics are not enforced -- path-validate rejects a critical instance of any of those
+// as unrecognized-critical, so the linter flags them too (structural decodability is not validation
+// processing). The one decode-only extension that is LEGITIMATELY critical is precertificatePoison
+// (RFC 6962 sec. 3.1 REQUIRES it critical), so it is allow-listed. Everything else -- a processed
+// extension, or an unregistered OID (algorithm / EKU-purpose OID the name registry resolves but that
+// is no extension) -- falls out correctly: processed -> recognized, unregistered -> unknown. Driving
+// this off the validator's set (not the decoder table) means a newly-decoded extension is
+// flagged-when-critical automatically until its semantics are actually processed.
+var _CRITICAL_LEGIT = {};
+_CRITICAL_LEGIT[oid.byName("precertificatePoison")] = true;
+// Mirrors path-validate's unrecognizedCriticalExtension. An extension not in PROCESSED_EXTENSIONS is
+// unknown everywhere (precertificatePoison is the one legitimately-critical exception). An extension
+// that IS processed for an intermediate but is unprocessed on the TARGET (policyMappings) is also
+// flagged: path-validate decides target status purely by path position (i === n), so ANY certificate
+// -- a CA included -- can be validated as the final/target certificate, where a critical instance is
+// rejected. A linter has no path context and cannot rule that out, so it flags these regardless of
+// cA-ness (policyMappings is SHOULD-be-non-critical everywhere, so this never mis-flags conformant input).
+function _isUnknownExtension(extOid) {
+  if (path.PROCESSED_EXTENSIONS[extOid] !== true) return _CRITICAL_LEGIT[extOid] !== true;
+  return path.TARGET_UNPROCESSED_IF_CRITICAL[extOid] === true;
+}
 
 // RSA-modulus / EC-curve helpers for the weak-key lint. Each returns null when the key
 // material cannot be read as expected (a malformed RSA modulus, or EC parameters that are

package/lib/oid.js

@@ -80,7 +80,27 @@ var FAMILIES = {
   // aaControls sec. 7.4, ac-proxying sec. 7.2).
   pkixAccess: { base: [1, 3, 6, 1, 5, 5, 7, 1], of: {
     authorityInfoAccess: 1, acAuditIdentity: 4, aaControls: 6, acProxying: 10,
-    acmeIdentifier: 31 } },
+    acmeIdentifier: 31,
+    // id-pe-qcStatements (RFC 3739 sec. 3.2.6) -- the qualified-certificate-statements extension.
+    qcStatements: 3 } },
+
+  // RFC 3739 sec. 3.2.6.1 id-qcs -- the PKIX QCStatement statementIds carrying SemanticsInformation.
+  pkixQcSyntax: { base: [1, 3, 6, 1, 5, 5, 7, 11], of: { qcsPkixQCSyntaxV1: 1, qcsPkixQCSyntaxV2: 2 } },
+
+  // ETSI EN 319 412-5 qualified-certificate statements (esi4-qcStatement-N) on the id-etsi-qcs arc.
+  etsiQcs: { base: [0, 4, 0, 1862, 1], of: {
+    qcCompliance: 1, qcLimitValue: 2, qcRetentionPeriod: 3, qcSSCD: 4, qcPDS: 5,
+    qcType: 6, qcCClegislation: 7, qcIdentMethod: 8, qcQSCDlegislation: 9 } },
+
+  // ETSI EN 319 412-5 QcType member OIDs (the certificate-purpose types) on the id-etsi-qct arc.
+  etsiQcType: { base: [0, 4, 0, 1862, 1, 6], of: { qctEsign: 1, qctEseal: 2, qctWeb: 3 } },
+
+  // [MS-WCCE] AD CS enrollment extensions on the id-microsoft-21 arc (szOID-CERTSRV / szOID-CERTIFICATE_TEMPLATE / szOID-APPLICATION_CERT_POLICIES).
+  msEnrollment: { base: [1, 3, 6, 1, 4, 1, 311, 21], of: {
+    msCaVersion: 1, msPreviousCertHash: 2, msCertificateTemplate: 7, msApplicationPolicies: 10 } },
+
+  // [MS-CRTD] legacy v1 enroll cert-type name on the id-microsoft-20 arc (szOID-ENROLL_CERTTYPE_EXTENSION).
+  msEnrollmentLegacy: { base: [1, 3, 6, 1, 4, 1, 311, 20], of: { msEnrollCertType: 2 } },
 
   // id-aca -- RFC 5755 attribute-certificate attribute types on the id-pkix 10 arc:
   // authenticationInfo sec. 4.4.1 .. group sec. 4.4.4, plus encAttrs sec. 7.1 (the encrypted-

package/lib/path-validate.js

@@ -91,10 +91,21 @@ var PROCESSED_EXTENSIONS = {};
 // validateCriticalExtensionStructure via the registered decoder. freshestCRL
 // stays OUT: sec. 4.2.1.15 requires it non-critical and the validator does not
 // consult it (no delta merge), so a critical instance fails unrecognized.
+// qcStatements is deliberately NOT processed: a critical QC statement (QcLimitValue reliance limit,
+// QcType certificate purpose) asserts qualified-certificate semantics a relying party MUST enforce, and
+// this validator does not enforce them (nor expose a handler to). Marking it processed would let a caller
+// treat a certificate as valid outside its asserted critical QC constraints, so a critical qcStatements
+// fails as an unrecognized-critical extension (RFC 5280 sec. 6.1.4); a non-critical instance is
+// informational and does not affect the verdict. The extension is still decoded for pki.inspect / lint.
 [OID.basicConstraints, OID.keyUsage, OID.nameConstraints, OID.certificatePolicies,
  OID.policyMappings, OID.policyConstraints, OID.inhibitAnyPolicy, OID.subjectAltName,
  OID.extKeyUsage, OID.cRLDistributionPoints].
   forEach(function (o) { PROCESSED_EXTENSIONS[o] = true; });
+// Frozen after seeding: this exact object is both consulted by the critical-extension check here and
+// exported (for pki.lint to stay consistent). A caller must not be able to add an OID -- doing so
+// would make an attacker's critical, decoder-less extension pass as "processed" and skip both the
+// unrecognized-critical check and structural validation. Freezing makes any such write a no-op.
+Object.freeze(PROCESSED_EXTENSIONS);
 
 // ---- signature verify bridge (NEW 6) ---------------------------------------
 
@@ -1055,6 +1066,7 @@ function applyPolicyMappings(state, mappings, i) {
 // a terminal CA cert is conforming and is NOT treated as unprocessed here.)
 var TARGET_UNPROCESSED_IF_CRITICAL = {};
 TARGET_UNPROCESSED_IF_CRITICAL[OID.policyMappings] = true;
+Object.freeze(TARGET_UNPROCESSED_IF_CRITICAL);
 
 function unrecognizedCriticalExtension(cert, isTarget) {
   for (var i = 0; i < cert.extensions.length; i++) {
@@ -2017,4 +2029,13 @@ module.exports = {
   crlChecker: crlChecker,
   ocspChecker: ocspChecker,
   verifyOcspResponse: verifyOcspResponse,
+  // The set of extension OIDs whose CRITICAL semantics this validator processes (RFC 5280 sec. 6.1).
+  // Exposed so a linter can distinguish "processed" from "merely decoded" and stay consistent with
+  // the path-validation verdict on a critical extension -- a decoder in certExtensionDecoders is NOT
+  // by itself proof the criticality is honoured. Both sets are frozen so a caller cannot mutate them.
+  PROCESSED_EXTENSIONS: PROCESSED_EXTENSIONS,
+  // Extensions that ARE processed for an intermediate CA but are unprocessed on the target/leaf, so a
+  // critical instance on the target fails closed (RFC 5280 sec. 6.1.5(f)) -- policyMappings is
+  // prepare-next-only and SHOULD-be-non-critical. A linter mirrors this for a leaf certificate.
+  TARGET_UNPROCESSED_IF_CRITICAL: TARGET_UNPROCESSED_IF_CRITICAL,
 };

package/lib/schema-pkix.js

@@ -571,7 +571,10 @@ function distributionPointName(ns, node, code) {
 // inside. Each decoder takes that raw Buffer and returns the decoded value, or
 // throws a typed `<prefix>/bad-*` code, mirroring the CRL's fail-closed
 // `decodeExt` pattern (asn1.decode -> read.* / schema.walk, wrapped). Returns
-// { byOid } keyed by dotted OID so a consumer dispatches by ext.oid.
+// { byOid } keyed by dotted OID so a consumer dispatches by ext.oid. The decoded
+// set spans the RFC 5280 sec. 4.2.1 extensions plus the RFC 3739 sec. 3.2.6 /
+// ETSI EN 319 412-5 qualified-certificate `qcStatements` extension (each known
+// statement decoded, an unknown statementId preserved opaque).
 var _T = asn1.TAGS;
 
 // assertPolicyQualifiers(qNode, fail) -- RFC 5280 sec. 4.2.1.4: a PolicyInformation's
@@ -916,7 +919,171 @@ function certExtensionDecoders(ns) {
     if (typeof d !== "string") throw new TypeError("certExtensionDecoders: " + JSON.stringify(nm) + " is not a registered OID name");
     return d;
   }
+  // qcStatements ::= SEQUENCE OF QCStatement (RFC 3739 sec. 3.2.6). QCStatement ::= SEQUENCE {
+  // statementId OBJECT IDENTIFIER, statementInfo ANY DEFINED BY statementId OPTIONAL }. Known statementIds
+  // (RFC 3739 id-qcs + the ETSI EN 319 412-5 esi4 catalog) decode their statementInfo; an unknown statementId
+  // is preserved OPAQUE (the RFC 3739 open type), never rejected. The DEFINED-BY selection is an OID re-dispatch.
+  function _qcStr(node, tag, C, what) {
+    if (!node || node.tagClass !== "universal" || node.tagNumber !== tag) throw ns.E(C, what);
+    try { return asn1.read.string(node); } catch (e) { throw ns.E(C, what, e); }
+  }
+  function _qcOidSeq(node, C, what) {   // a non-empty SEQUENCE OF OBJECT IDENTIFIER
+    if (!node || node.tagClass !== "universal" || node.tagNumber !== _T.SEQUENCE || !node.children || !node.children.length) throw ns.E(C, what + " must be a non-empty SEQUENCE OF OBJECT IDENTIFIER");
+    return node.children.map(function (c) {
+      if (c.tagClass !== "universal" || c.tagNumber !== _T.OBJECT_IDENTIFIER) throw ns.E(C, what + " members must be OBJECT IDENTIFIERs");
+      try { return asn1.read.oid(c); } catch (e) { throw ns.E(C, what + " member is not a valid OID", e); }
+    });
+  }
+  function _qcPresenceOnly(nm) { return function (node, C) { if (node) throw ns.E(C, nm + " carries no statementInfo (ETSI EN 319 412-5)"); return null; }; }
+  function _qcSemantics(node, C) {   // SemanticsInformation, WITH COMPONENTS at least one field present
+    if (node === null) return null;   // statementInfo OPTIONAL for id-qcs syntax statements
+    if (node.tagClass !== "universal" || node.tagNumber !== _T.SEQUENCE || !node.children || !node.children.length) throw ns.E(C, "SemanticsInformation must be a SEQUENCE with at least one field (RFC 3739 sec. 3.2.6.1)");
+    var sid = null, i = 0;
+    if (node.children[0].tagClass === "universal" && node.children[0].tagNumber === _T.OBJECT_IDENTIFIER) {
+      try { sid = asn1.read.oid(node.children[0]); } catch (e) { throw ns.E(C, "SemanticsInformation semanticsIdentifier must be an OID", e); }
+      i++;
+    }
+    var nras = [];
+    if (node.children[i]) {
+      // nameRegistrationAuthorities ::= SEQUENCE SIZE (1..MAX) OF GeneralName -- decode + fully validate
+      // each element through the shared GeneralName decoder (context tag [0]..[8] + per-alternative
+      // structure), rather than surfacing arbitrary bytes as a name-registration authority.
+      nras = schema.walk(generalNames(ns, { decodeValue: true, code: C }), node.children[i], ns).result.names;
+      i++;
+    }
+    if (i !== node.children.length) throw ns.E(C, "SemanticsInformation has unexpected trailing fields");
+    return { semanticsIdentifier: sid, nameRegistrationAuthorities: nras };
+  }
+  var qcInfoByOid = {};
+  qcInfoByOid[O("qcCompliance")] = _qcPresenceOnly("QcCompliance");
+  qcInfoByOid[O("qcSSCD")] = _qcPresenceOnly("QcSSCD");
+  qcInfoByOid[O("qcsPkixQCSyntaxV1")] = _qcSemantics;
+  qcInfoByOid[O("qcsPkixQCSyntaxV2")] = _qcSemantics;
+  qcInfoByOid[O("qcType")] = function (node, C) {
+    var oids = _qcOidSeq(node, C, "QcType");   // SIZE(1) in EN 319 412-5 V2.5.1; accept >=1 for legacy certs
+    return { types: oids, typeNames: oids.map(function (d) { return ns.oid.name(d) || null; }) };
+  };
+  qcInfoByOid[O("qcRetentionPeriod")] = function (node, C) {
+    if (!node) throw ns.E(C, "QcRetentionPeriod requires an INTEGER statementInfo");
+    return { years: guard.range.uint31(readInt(node, C, "QcRetentionPeriod"), ns.E, C, "QcRetentionPeriod (years)") };
+  };
+  qcInfoByOid[O("qcLimitValue")] = function (node, C) {   // MonetaryValue ::= SEQUENCE { currency, amount, exponent }
+    if (!node || node.tagClass !== "universal" || node.tagNumber !== _T.SEQUENCE || !node.children || node.children.length !== 3) throw ns.E(C, "QcLimitValue must be a MonetaryValue SEQUENCE { currency, amount, exponent }");
+    var cur = node.children[0], currency;
+    if (cur.tagClass === "universal" && cur.tagNumber === _T.PRINTABLE_STRING) {
+      // Route through _qcStr so a disallowed PrintableString byte surfaces the decoder's typed
+      // bad-qc-statement error, not a leaked asn1/bad-printable-string from the raw leaf read.
+      currency = _qcStr(cur, _T.PRINTABLE_STRING, C, "QcLimitValue alphabetic currency must be a PrintableString");
+      if (currency.length !== 3) throw ns.E(C, "QcLimitValue alphabetic currency must be a 3-letter ISO 4217 code");
+    } else if (cur.tagClass === "universal" && cur.tagNumber === _T.INTEGER) {
+      currency = guard.range.int(readInt(cur, C, "QcLimitValue numeric currency"), 1n, 999n, ns.E, C, "QcLimitValue numeric currency (ISO 4217, 1..999)");
+    } else throw ns.E(C, "QcLimitValue currency must be a PrintableString(3) or INTEGER(1..999)");
+    return {
+      currency: currency,
+      // MonetaryValue amount and exponent are unconstrained INTEGERs (the amount non-negative in practice);
+      // bound each only to the safe-integer range so it narrows to a Number losslessly -- an artificial
+      // tighter bound (uint31, or a small exponent window) would false-reject a valid MonetaryValue, and a
+      // wider one would round silently and mis-state the limit.
+      amount: guard.range.int(readInt(node.children[1], C, "QcLimitValue amount"), 0n, 9007199254740991n, ns.E, C, "QcLimitValue amount"),
+      exponent: guard.range.int(readInt(node.children[2], C, "QcLimitValue exponent"), -9007199254740991n, 9007199254740991n, ns.E, C, "QcLimitValue exponent"),
+    };
+  };
+  qcInfoByOid[O("qcCClegislation")] = function (node, C) {   // SEQUENCE OF CountryName (PrintableString SIZE 2)
+    if (!node || node.tagClass !== "universal" || node.tagNumber !== _T.SEQUENCE || !node.children || !node.children.length) throw ns.E(C, "QcCClegislation must be a non-empty SEQUENCE OF CountryName");
+    return { countries: node.children.map(function (c) { var v = _qcStr(c, _T.PRINTABLE_STRING, C, "QcCClegislation CountryName must be a PrintableString"); if (v.length !== 2) throw ns.E(C, "QcCClegislation CountryName must be a 2-letter ISO 3166-1 code"); return v; }) };
+  };
+  qcInfoByOid[O("qcPDS")] = function (node, C) {   // PdsLocations ::= SEQUENCE OF PdsLocation { url IA5, language Printable(2) }
+    if (!node || node.tagClass !== "universal" || node.tagNumber !== _T.SEQUENCE || !node.children || !node.children.length) throw ns.E(C, "QcPDS must be a non-empty SEQUENCE OF PdsLocation");
+    return { locations: node.children.map(function (loc) {
+      if (loc.tagClass !== "universal" || loc.tagNumber !== _T.SEQUENCE || !loc.children || loc.children.length !== 2) throw ns.E(C, "a QcPDS PdsLocation must be a SEQUENCE { url, language }");
+      var lang = _qcStr(loc.children[1], _T.PRINTABLE_STRING, C, "a QcPDS language must be a PrintableString");
+      if (lang.length !== 2) throw ns.E(C, "a QcPDS language must be a 2-letter ISO 639-1 code");
+      return { url: _qcStr(loc.children[0], _T.IA5_STRING, C, "a QcPDS url must be an IA5String"), language: lang };
+    }) };
+  };
+  // ETSI EN 319 412-5 V2.5.1 additions: QcIdentMethod (SEQUENCE OF OID, like QcType) and
+  // QcQSCDlegislation (SEQUENCE OF CountryName, like QcCClegislation) -- registered ids, decoded.
+  qcInfoByOid[O("qcIdentMethod")] = function (node, C) {
+    var oids = _qcOidSeq(node, C, "QcIdentMethod");
+    return { methods: oids, methodNames: oids.map(function (d) { return ns.oid.name(d) || null; }) };
+  };
+  qcInfoByOid[O("qcQSCDlegislation")] = function (node, C) {
+    if (!node || node.tagClass !== "universal" || node.tagNumber !== _T.SEQUENCE || !node.children || !node.children.length) throw ns.E(C, "QcQSCDlegislation must be a non-empty SEQUENCE OF CountryName");
+    return { countries: node.children.map(function (c) { var v = _qcStr(c, _T.PRINTABLE_STRING, C, "QcQSCDlegislation CountryName must be a PrintableString"); if (v.length !== 2) throw ns.E(C, "QcQSCDlegislation CountryName must be a 2-letter ISO 3166-1 code"); return v; }) };
+  };
+  function qcStatements(buf) {
+    var C = ns.prefix + "/bad-qc-statements", CS = ns.prefix + "/bad-qc-statement";
+    var kids = seqChildren(buf, C, "QCStatements");
+    if (!kids.length) throw ns.E(C, "QCStatements must contain at least one QCStatement (RFC 3739 sec. 3.2.6)");
+    var out = [];   // QCStatements ::= SEQUENCE OF QCStatement -- RFC 3739 imposes no statementId uniqueness; decode every statement in wire order (a linter may flag a repeat, the decoder must not drop it)
+    for (var i = 0; i < kids.length; i++) {
+      var st = kids[i];
+      if (st.tagClass !== "universal" || st.tagNumber !== _T.SEQUENCE || !st.children || st.children.length < 1 || st.children.length > 2) {
+        throw ns.E(CS, "each QCStatement must be a SEQUENCE of a statementId and an OPTIONAL statementInfo");
+      }
+      var id;
+      try { id = asn1.read.oid(st.children[0]); } catch (e) { throw ns.E(CS, "a QCStatement statementId must be an OBJECT IDENTIFIER", e); }
+      var infoNode = st.children.length === 2 ? st.children[1] : null;
+      var decoder = qcInfoByOid[id];
+      var info = decoder ? decoder(infoNode, CS) : { opaque: true, bytes: infoNode ? infoNode.bytes : null };
+      out.push({ statementId: id, name: ns.oid.name(id) || null, info: info });
+    }
+    return out;
+  }
+
+  // [MS-WCCE] szOID-CERTIFICATE_TEMPLATE -- CertificateTemplateOID ::= SEQUENCE {
+  //   templateID OID, templateMajorVersion INTEGER OPTIONAL, templateMinorVersion INTEGER OPTIONAL }.
+  // The two versions are DWORDs (0..2^32-1), NOT uint31 -- a CA key/template revision with bit 31
+  // set is a legal DWORD, so bound to the whole safe-integer range, never guard.range.uint31.
+  function msCertificateTemplate(buf) {
+    var C = ns.prefix + "/bad-ms-certificate-template";
+    var kids = seqChildren(buf, C, "CertificateTemplate");
+    if (!kids.length || kids.length > 3) throw ns.E(C, "CertificateTemplateOID must be a SEQUENCE of a templateID and up to two version INTEGERs");
+    if (kids[0].tagClass !== "universal" || kids[0].tagNumber !== _T.OBJECT_IDENTIFIER) throw ns.E(C, "CertificateTemplateOID templateID must be an OBJECT IDENTIFIER");
+    var id;
+    try { id = asn1.read.oid(kids[0]); } catch (e) { throw ns.E(C, "CertificateTemplateOID templateID must be an OBJECT IDENTIFIER", e); }
+    function ver(i, what) {
+      if (!kids[i]) return null;
+      if (kids[i].tagClass !== "universal" || kids[i].tagNumber !== _T.INTEGER) throw ns.E(C, what + " must be an INTEGER");
+      return guard.range.int(readInt(kids[i], C, what), 0n, 4294967295n, ns.E, C, what);
+    }
+    return { templateID: id, name: ns.oid.name(id) || null, templateMajorVersion: ver(1, "templateMajorVersion"), templateMinorVersion: ver(2, "templateMinorVersion") };
+  }
+
+  // [MS-CRTD] szOID-ENROLL_CERTTYPE_EXTENSION -- the legacy v1 template name as a BARE BMPString.
+  // asn1.read.string accepts any universal string tag, so the explicit BMP_STRING assert is the guard.
+  function msEnrollCertType(buf) {
+    var C = ns.prefix + "/bad-ms-enroll-cert-type";
+    var n = decodeTop(buf, C, "EnrollCertType");
+    if (n.tagClass !== "universal" || n.tagNumber !== _T.BMP_STRING) throw ns.E(C, "the enroll cert-type name must be a BMPString");
+    try { return asn1.read.string(n); } catch (e) { throw ns.E(C, "the enroll cert-type name must be a well-formed BMPString", e); }
+  }
+
+  // [MS-WCCE] szOID-CERTSRV_CA_VERSION -- INTEGER (0..2^32-1) = (caKeyIndex << 16) | certIndex.
+  function msCaVersion(buf) {
+    var C = ns.prefix + "/bad-ms-ca-version";
+    var n = decodeTop(buf, C, "CACertVersion");
+    if (n.tagClass !== "universal" || n.tagNumber !== _T.INTEGER) throw ns.E(C, "CACertVersion must be an INTEGER");
+    var v = guard.range.int(readInt(n, C, "CACertVersion"), 0n, 4294967295n, ns.E, C, "CACertVersion (DWORD)");
+    return { caVersion: v, caKeyIndex: v >>> 16, certIndex: v & 0xffff };
+  }
+
+  // [MS-WCCE] szOID-CERTSRV_PREVIOUS_CERT_HASH -- the SHA-1 thumbprint of the prior CA certificate.
+  // AD CS stamps the Windows certificate THUMBPRINT here, which Windows computes with SHA-1 regardless
+  // of the certificate's signature algorithm, so the OCTET STRING is exactly 20 octets. An empty or
+  // other-length value is malformed renewal metadata and fails closed.
+  function msPreviousCertHash(buf) {
+    var C = ns.prefix + "/bad-ms-previous-cert-hash";
+    var n = decodeTop(buf, C, "CAPrevCertHash");
+    var hash;
+    try { hash = Buffer.concat([asn1.read.octetString(n)]); }
+    catch (e) { throw ns.E(C, "CAPrevCertHash must be an OCTET STRING", e); }
+    if (hash.length !== 20) throw ns.E(C, "CAPrevCertHash must be a 20-octet SHA-1 certificate thumbprint");
+    return hash;
+  }
+
   var byOid = {};
+  byOid[O("qcStatements")] = qcStatements;
   byOid[O("basicConstraints")] = basicConstraints;
   byOid[O("keyUsage")] = keyUsage;
   byOid[O("nameConstraints")] = nameConstraints;
@@ -933,6 +1100,11 @@ function certExtensionDecoders(ns) {
   byOid[O("precertificatePoison")] = precertPoison;
   byOid[O("cRLDistributionPoints")] = crlDistributionPoints;
   byOid[O("freshestCRL")] = crlDistributionPoints;
+  byOid[O("msCertificateTemplate")] = msCertificateTemplate;
+  byOid[O("msEnrollCertType")] = msEnrollCertType;
+  byOid[O("msCaVersion")] = msCaVersion;
+  byOid[O("msPreviousCertHash")] = msPreviousCertHash;
+  byOid[O("msApplicationPolicies")] = certificatePolicies;   // [MS-WCCE] = RFC 5280 certificatePolicies, reused not re-implemented
   return { byOid: byOid };
 }
 

package/lib/sigstore.js

@@ -33,6 +33,7 @@ var x509 = require("./schema-x509");
 var pathValidate = require("./path-validate");
 var merkle = require("./merkle");
 var oid = require("./oid");
+var edwardsPoint = require("./edwards-point");
 
 var C = constants;
 var SigstoreError = frameworkError.SigstoreError;
@@ -184,8 +185,18 @@ function _rawVerify(keyObj, data, derSig) {
   return nodeCrypto.verify(hash, data, { key: keyObj, dsaEncoding: "der" }, derSig);
 }
 function _pubFromSpki(spkiDer, label) {
-  try { return nodeCrypto.createPublicKey({ key: spkiDer, format: "der", type: "spki" }); }
+  var key;
+  try { key = nodeCrypto.createPublicKey({ key: spkiDer, format: "der", type: "spki" }); }
   catch (e) { throw _err("sigstore/bad-key", "invalid " + label + " public key", e); }
+  // node imports a low-order (e.g. all-zeroes) OKP public key without complaint, and such a key
+  // verifies a FORGED EdDSA signature -- route an Ed25519/Ed448 SPKI through the shared full-order,
+  // on-curve Edwards-point gate (as the webauthn and path-validation EdDSA paths already do) before it
+  // can be handed to verify.
+  var t = key.asymmetricKeyType;
+  if (t === "ed25519" || t === "ed448") {
+    edwardsPoint.validateSpki(spkiDer, t === "ed25519" ? 6 : 7, SigstoreError, "sigstore/bad-key");
+  }
+  return key;
 }
 // Parse a certificate, re-typing a malformed-DER fault to a sigstore/* error so
 // the caller never sees a raw certificate/* / asn1/* leak from this boundary.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.2.30",
+  "version": "0.2.32",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:fcac8430-97c8-4f4c-a497-dc2f02fb3c6f",
+  "serialNumber": "urn:uuid:c1caa29b-a81a-443d-9296-76988e159993",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-16T18:34:40.509Z",
+    "timestamp": "2026-07-16T23:57:14.646Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.2.30",
+      "bom-ref": "@blamejs/pki@0.2.32",
       "type": "application",
       "name": "pki",
-      "version": "0.2.30",
+      "version": "0.2.32",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.2.30",
+      "purl": "pkg:npm/%40blamejs/pki@0.2.32",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.2.30",
+      "ref": "@blamejs/pki@0.2.32",
       "dependsOn": []
     }
   ]