@blamejs/pki 0.3.32 → 0.4.0

package/CHANGELOG.md

@@ -4,6 +4,36 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.4.0 — 2026-08-06
+
+CRL issuance and verification, PKCS#12 build and open, attribute-certificate issuance, and the key-material lifecycle graduate to stable, and pki.schema.c509 adds the compact policyMappings and policyConstraints value forms -- a C509 certificate's policy mappings and policy constraints now ride their specific draft-20 CBOR shape and interoperate with a conformant C509 implementation rather than only this decoder.
+
+### Added
+
+- pki.schema.c509 encodes and decodes the compact value forms for the policyMappings and policyConstraints extensions (draft-ietf-cose-cbor-encoded-cert-20 sec. 3.3): a policy mapping's issuerDomainPolicy and subjectDomainPolicy each ride the sec. 8.9 registry-integer / unwrapped-OID policy space the certificatePolicies extension uses (a policy mapping to or from the special anyPolicy is preserved, matching what a certificate's own decoder accepts), and a policy constraints value rides the fixed two-element [requireExplicitPolicy, inhibitPolicyMapping] array, each field a non-negative skip count or absent. Both directions invert to the DER extnValue byte-for-byte, so a certificate carrying either extension is the specific compact shape a conformant C509 implementation reads rather than an opaque DER byte string. The encoder is guarded: a value the compact form cannot hold falls the whole extension back to the unwrapped-OID byte-string form instead of encoding lossily; a malformed compact value -- an empty or both-absent policy constraints, an odd-length or empty policy-mappings array, a policy mapping member that is not a two-policy pair, or an unregistered policy integer -- fails closed with a typed C509Error.
+
+### Changed
+
+- pki.crl.sign / verify / isRevoked (RFC 5280 sec. 5), pki.pkcs12.build / open / verifyMac (RFC 7292 / RFC 9579), pki.attrcert.sign (RFC 5755), and the key-material lifecycle pki.key.encrypt / decrypt / export / import / generate / publicFromPrivate (PKCS#8 / RFC 5958, RFC 8018) graduate from experimental to stable. Their governing standards are settled and each is proven against an independent implementation in the integration harness (OpenSSL), or for the attribute-certificate format through the toolkit's own conformance-vector round-trip plus coverage-guided fuzzing. They are now covered by the stability contract: a breaking change to any of them ships only after a prior deprecation cycle, never silently in a minor (the published LTS support window itself takes effect at v1.0).
+- A C509 certificate carrying policyMappings or policyConstraints now encodes to -- and decodes from -- its compact CBOR value shape rather than the unwrapped-OID byte-string form an earlier release emitted; both reconstruct the same DER, but the CBOR bytes differ, so re-encode any C509 produced by an earlier release.
+
+### Fixed
+
+- The C509 encoder now bounds the basicConstraints path length and the inhibitAnyPolicy and policyConstraints skip counts to the same non-negative 31-bit range the toolkit's own certificate decoders enforce. A native C509 carrying one of these counts past that range now fails closed with a typed C509Error rather than reconstructing a DER an X.509 decoder -- this toolkit's included -- would then reject.
+
+## v0.3.33 — 2026-08-05
+
+pki.schema.c509 encodes and decodes the compact certificatePolicies value form -- a C509 certificate's policy identifiers ride their draft-20 registry integers (or unwrapped OIDs) and their CPS-URI and UserNotice qualifiers ride the specific compact CBOR shape, interoperating with a conformant C509 implementation rather than only this decoder.
+
+### Added
+
+- pki.schema.c509 encodes and decodes the compact value form for the certificatePolicies extension (draft-ietf-cose-cbor-encoded-cert-20 sec. 3.3): each policy identifier is a sec. 8.9 registry integer -- the CA/Browser Forum validation levels, the RFC 3779 id-cp-ipAddr resource-certificate policies, and the GSMA SGP.22 id-rspRole roles -- or an unwrapped OID for a policy outside the registry; each policy qualifier is a sec. 8.10 integer (id-qt-cps / id-qt-unotice) with its text, reconstructing the CPS pointer as a URI IA5String and the UserNotice as an explicit-text UTF8String. Both directions invert to the DER extnValue byte-for-byte, so a certificate carrying policies is the specific compact shape a conformant C509 implementation reads rather than an opaque DER byte string. The encoder is guarded: a UserNotice with a noticeRef, a non-UTF8String explicit text, or a policy-qualifier identifier outside the sec. 8.10 registry is not compact-representable and falls the whole extension back to the unwrapped-OID byte-string form instead of encoding lossily; a malformed compact value (an empty UserNotice text, a control-byte CPS URI, an unregistered policy or qualifier integer) fails closed with a typed C509Error.
+- The OID registry gains the CA/Browser Forum certificate-policy identifiers (domain-, organization-, individual-validated, ev-guidelines), the RFC 3779 id-cp-ipAddr-asNumber policies, the GSMA SGP.22 id-rspRole roles, and the RFC 5280 id-qt policy qualifiers (cps, unotice), resolvable through pki.oid.byName / pki.oid.name.
+
+### Changed
+
+- A C509 certificate carrying certificatePolicies now encodes to -- and decodes from -- its compact CBOR value shape rather than the unwrapped-OID byte-string form an earlier release emitted; both reconstruct the same DER, but the CBOR bytes differ, so re-encode any C509 produced by an earlier release.
+
 ## v0.3.32 — 2026-08-05
 
 pki.schema.c509 encodes and decodes the compact general-name extension values -- a C509 certificate's subjectAltName, issuer alternative name, name constraints, CRL distribution points, authority/subject information access, and the authority key identifier issuer form now ride their specific draft-20 CBOR shape and interoperate with a conformant C509 implementation, not only this decoder.

package/README.md

@@ -204,7 +204,7 @@ is callable today; nothing below is a stub.
 | `pki.webcrypto` | A W3C WebCrypto (`SubtleCrypto`) engine over `node:crypto` — `sign`/`verify`/`encrypt`/`decrypt`/`deriveBits`/`digest`/`generateKey`/`importKey`/`exportKey` across RSA, ECDSA, ECDH, Ed25519/Ed448, AES, HMAC, HKDF, PBKDF2, SHA — **and** post-quantum ML-DSA-44/65/87 and SLH-DSA signatures, plus ML-KEM-512/768/1024 key generation and certificate/PKCS#8 import — the RFC 9935 seed / expandedKey / both private-key CHOICE is validated fail-closed, so an OpenSSL-legacy bare-seed or an internally inconsistent key is rejected with a typed error (KEM encapsulation lands with CMS KEM-decrypt). Zero-dependency, OpenSSL-interoperable |
 | `pki.schema` | The schema family — `parse` detects which PKI format DER / PEM encodes and routes to the right parser, `all` enumerates the registered formats, and the engine + per-format members are grouped here |
 | `pki.schema.x509` | Parse DER / PEM certificates into structured, validated fields, with named + partly-decoded extensions — including the RFC 3739 / ETSI EN 319 412-5 qualified-certificate `qcStatements` (EU-qualified declaration, reliance limit, QSCD flag, certificate type, retention, PDS URLs, country of qualification; unknown statements preserved opaque) and the Microsoft Active Directory Certificate Services enrollment extensions (certificate template, CA version, previous-CA-certificate hash, application policies), fail-closed — `parse`, `pemDecode`, `pemEncode` |
-| `pki.schema.c509` | Parse **and encode** C509 CBOR-encoded certificates (draft-ietf-cose-cbor-encoded-cert) — the compact CBOR profile of X.509, decoded fail-closed under deterministic CBOR; an explicit `parse` call (CBOR, not DER, so not auto-routed). `encode(input)` is the byte-exact inverse: a DER X.509 v3 certificate forward-transforms to a compact type-3 C509 whose reconstruction reproduces the original DER byte for byte (so the original signature still verifies), or a `parse` result re-emits its native array — canonical deterministic CBOR with the registry integer shorthands, the C509 compressions, and the compact draft-20 per-extension value forms — the scalar extensions (keyUsage, basicConstraints, extended key usage, subject key identifier, and more) and the general-name-bearing extensions (subjectAltName, issuer alt name, name constraints, CRL distribution points, authority/subject information access, and the full authority key identifier) over one shared GeneralNames value codec; a certificate outside the invertible set throws a typed `C509Error` |
+| `pki.schema.c509` | Parse **and encode** C509 CBOR-encoded certificates (draft-ietf-cose-cbor-encoded-cert) — the compact CBOR profile of X.509, decoded fail-closed under deterministic CBOR; an explicit `parse` call (CBOR, not DER, so not auto-routed). `encode(input)` is the byte-exact inverse: a DER X.509 v3 certificate forward-transforms to a compact type-3 C509 whose reconstruction reproduces the original DER byte for byte (so the original signature still verifies), or a `parse` result re-emits its native array — canonical deterministic CBOR with the registry integer shorthands, the C509 compressions, and the compact draft-20 per-extension value forms — the scalar extensions (keyUsage, basicConstraints, extended key usage, subject key identifier, and more), the general-name-bearing extensions (subjectAltName, issuer alt name, name constraints, CRL distribution points, authority/subject information access, and the full authority key identifier) over one shared GeneralNames value codec, certificate policies (registry-integer or OID policy identifiers with their CPS-URI and UserNotice qualifiers), and policy mappings and policy constraints; a certificate outside the invertible set throws a typed `C509Error` |
 | `pki.schema.crl` | Parse DER / PEM X.509 CRLs per RFC 5280 §5 — revoked serials with real-`Date` revocation times, named + partly-decoded extensions, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.csr` | Parse DER / PEM PKCS#10 certification requests per RFC 2986 — subject DN, public key, requested attributes, signature, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.pkcs8` | Parse DER / PEM PKCS#8 private keys per RFC 5208 / 5958 — algorithm, raw key bytes, attributes, optional public key, fail-closed; encrypted keys recognized (not decrypted) — `parse`, `parseEncrypted`, `pemDecode`, `pemEncode` |

package/lib/attrcert-sign.js

@@ -408,7 +408,7 @@ function _buildExtensions(extSpec, aaSpki) {
  * @primitive pki.attrcert.sign
  * @signature pki.attrcert.sign(spec, issuer, opts?) -> Promise<Buffer|string>
  * @since 0.3.2
- * @status experimental
+ * @status stable
  * @spec RFC 5755
  * @defends forged-attribute-certificate (CWE-347)
  * @related pki.schema.attrcert.parse, pki.x509.sign

package/lib/crl-sign.js

@@ -454,7 +454,7 @@ function _sign(spec, issuer, opts) {
  * @primitive pki.crl.sign
  * @signature pki.crl.sign(spec, issuer, opts?) -> Promise<Buffer|string>
  * @since 0.3.9
- * @status experimental
+ * @status stable
  * @spec RFC 5280 sec. 5, RFC 9882, RFC 9814
  * @defends crl-forgery (CWE-347)
  * @related pki.schema.crl.parse, pki.crl.verify, pki.path.crlChecker
@@ -510,7 +510,7 @@ function _resolveIssuerSpki(issuer) {
  * @primitive pki.crl.verify
  * @signature pki.crl.verify(crl, issuer) -> Promise<boolean>
  * @since 0.3.9
- * @status experimental
+ * @status stable
  * @spec RFC 5280 sec. 5.1.1.3, RFC 9814
  * @defends crl-signature-bypass (CWE-347)
  * @related pki.crl.sign, pki.path.crlChecker, pki.schema.crl.parse
@@ -549,7 +549,7 @@ function _serialHexOf(serial) {
  * @primitive pki.crl.isRevoked
  * @signature pki.crl.isRevoked(crl, serialNumber) -> entry | null
  * @since 0.3.9
- * @status experimental
+ * @status stable
  * @spec RFC 5280 sec. 5.1.2.6
  * @related pki.crl.verify, pki.schema.crl.parse
  *

package/lib/key.js

@@ -81,7 +81,7 @@ async function _toPrivateKeyDer(input) {
  * @primitive pki.key.encrypt
  * @signature pki.key.encrypt(privateKey, password, opts?) -> Promise<Buffer|string>
  * @since 0.3.10
- * @status experimental
+ * @status stable
  * @spec RFC 5958 sec. 3, RFC 8018
  * @related pki.key.decrypt, pki.schema.pkcs8.parseEncrypted, pki.cms.encrypt
  *
@@ -132,7 +132,7 @@ async function encrypt(privateKey, password, opts) {
  * @primitive pki.key.decrypt
  * @signature pki.key.decrypt(encrypted, password, opts?) -> Promise<Buffer|string>
  * @since 0.3.10
- * @status experimental
+ * @status stable
  * @spec RFC 5958 sec. 3, RFC 8018 sec. 6.2, RFC 8018 sec. 8
  * @defends pbes2-padding-oracle (CWE-208), pbkdf2-work-dos (CWE-400)
  * @related pki.key.encrypt, pki.schema.pkcs8.parse
@@ -187,7 +187,7 @@ function _decryptPbes2(encAlg, ciphertext, password, opts) {
  * @primitive pki.key.export
  * @signature pki.key.export(key, opts?) -> Promise<Buffer|string>
  * @since 0.3.10
- * @status experimental
+ * @status stable
  * @spec RFC 5958, RFC 5280 sec. 4.1.2.7, RFC 8410 sec. 3
  * @related pki.key.import, pki.key.publicFromPrivate, pki.schema.pkcs8.parse
  *
@@ -222,7 +222,7 @@ async function export_(key, opts) {
  * @primitive pki.key.import
  * @signature pki.key.import(input, opts?) -> Promise<CryptoKey>
  * @since 0.3.10
- * @status experimental
+ * @status stable
  * @spec RFC 5958, RFC 5280 sec. 4.1.2.7, RFC 8018
  * @related pki.key.export, pki.key.decrypt
  *
@@ -265,7 +265,7 @@ async function import_(input, opts) {
  * @primitive pki.key.generate
  * @signature pki.key.generate(algorithm, opts?) -> Promise<{ privateKey, publicKey }>
  * @since 0.3.10
- * @status experimental
+ * @status stable
  * @spec W3C WebCrypto, FIPS 203, FIPS 204
  * @related pki.key.export, pki.key.publicFromPrivate
  *
@@ -296,7 +296,7 @@ async function generate(algorithm, opts) {
  * @primitive pki.key.publicFromPrivate
  * @signature pki.key.publicFromPrivate(privateKey, opts?) -> Promise<Buffer|string>
  * @since 0.3.10
- * @status experimental
+ * @status stable
  * @spec RFC 5280 sec. 4.1.2.7, RFC 8410 sec. 3
  * @related pki.key.export, pki.key.import
  *

package/lib/oid.js

@@ -134,6 +134,29 @@ var FAMILIES = {
   // id-on-MACAddress (I-D.ietf-lamps-macaddress-on) on the id-pkix 8 arc.
   pkixOn: { base: [1, 3, 6, 1, 5, 5, 7, 8], of: { hardwareModuleName: 4, smtpUtf8Mailbox: 9, macAddress: 12 } },
 
+  // CA/Browser Forum certificate policies (draft-ietf-cose-cbor-encoded-cert sec. 8.9 ints 1-4) on the
+  // 2.23.140.1 arc: the id-cabf validation levels under .2, ev-guidelines under .1.
+  cabfPolicy: { base: [2, 23, 140, 1], of: {
+    "ev-guidelines": 1, "domain-validated": [2, 1], "organization-validated": [2, 2], "individual-validated": [2, 3] } },
+
+  // id-cp-ipAddr-asNumber (RFC 3779 / RFC 8360) on the id-pkix 14 arc -- the RPKI resource-certificate
+  // policy OIDs (sec. 8.9 ints 7-8).
+  idCp: { base: [1, 3, 6, 1, 5, 5, 7, 14], of: { "id-cp-ipAddr-asNumber": 2, "id-cp-ipAddr-asNumber-v2": 3 } },
+
+  // GSMA SGP.22 Remote SIM Provisioning roles (sec. 8.9 ints 24-38) on the 2.23.146.1.2.1 id-rspRole arc.
+  // The -v2 roles are shallow leaves .{1..7}; the non-v2 roles descend into deeper sub-arcs (draft-20).
+  gsmaRspRole: { base: [2, 23, 146, 1, 2, 1], of: {
+    "id-rspRole-ci": 0, "id-rspRole-euicc-v2": 1, "id-rspRole-euicc": [0, 0, 0, 0, 0],
+    "id-rspRole-eum-v2": 2, "id-rspRole-eum": [0, 0, 0],
+    "id-rspRole-dp-tls-v2": 3, "id-rspRole-dp-tls": [0, 0, 1, 0],
+    "id-rspRole-dp-auth-v2": 4, "id-rspRole-dp-auth": [0, 0, 1, 1],
+    "id-rspRole-dp-pb-v2": 5, "id-rspRole-dp-pb": [0, 0, 1, 2],
+    "id-rspRole-ds-tls-v2": 6, "id-rspRole-ds-tls": [0, 0, 2, 0],
+    "id-rspRole-ds-auth-v2": 7, "id-rspRole-ds-auth": [0, 0, 2, 1] } },
+
+  // id-qt policy qualifiers (RFC 5280 sec. 4.2.1.4) on the id-pkix 2 arc -- the C509 sec. 8.10 registry.
+  pkixQt: { base: [1, 3, 6, 1, 5, 5, 7, 2], of: { cps: 1, unotice: 2 } },
+
   // OCSP (RFC 6960) on the id-pkix-ocsp arc (= id-ad-ocsp). id-pkix-ocsp-basic is
   // the ResponseBytes.responseType this build decodes; id-pkix-ocsp-nonce (sec. 4.4.1)
   // names the nonce extension; the remaining members name the other OCSP extensions

package/lib/pkcs12-build.js

@@ -403,7 +403,7 @@ function _normalizeSpec(spec, opts) {
  * @primitive pki.pkcs12.build
  * @signature pki.pkcs12.build(spec, opts?) -> Promise<Buffer|string>
  * @since 0.3.11
- * @status experimental
+ * @status stable
  * @spec RFC 7292, RFC 9579, RFC 8018
  * @related pki.schema.pkcs12.parse, pki.pkcs12.verifyMac
  *
@@ -468,7 +468,7 @@ async function build(spec, opts) {
  * @primitive pki.pkcs12.verifyMac
  * @signature pki.pkcs12.verifyMac(pfx, password, opts?) -> Promise<boolean>
  * @since 0.3.11
- * @status experimental
+ * @status stable
  * @spec RFC 7292 sec. 5.1, RFC 9579
  * @defends pkcs12-mac-forgery (CWE-347)
  * @related pki.pkcs12.build, pki.schema.pkcs12.parse
@@ -533,7 +533,7 @@ function _capWork(iterations, salt, opts, keyLength, hardCap) {
  * @primitive pki.pkcs12.open
  * @signature pki.pkcs12.open(pfx, password, opts?) -> Promise<OpenResult>
  * @since 0.3.12
- * @status experimental
+ * @status stable
  * @spec RFC 7292 sec. 5.1, RFC 9579, RFC 8018
  * @defends pkcs12-unauthenticated-decrypt (CWE-347), pbes2-padding-oracle (CWE-208)
  * @related pki.pkcs12.build, pki.pkcs12.verifyMac, pki.schema.pkcs12.parse

package/lib/schema-c509.js

@@ -83,11 +83,14 @@ var EXT_BY_INT = {
   3: _name("subjectAltName"),
   4: _name("basicConstraints"),
   5: _name("cRLDistributionPoints"),
+  6: _name("certificatePolicies"),
   7: _name("authorityKeyIdentifier"),
   8: _name("extKeyUsage"),
   9: _name("authorityInfoAccess"),
   25: _name("issuerAltName"),
   26: _name("nameConstraints"),
+  27: _name("policyMappings"),
+  28: _name("policyConstraints"),
   29: _name("freshestCRL"),
   30: _name("inhibitAnyPolicy"),
   31: _name("subjectInfoAccess"),
@@ -100,7 +103,8 @@ var EXT_COMPACT = {
   subjectKeyIdentifier: 1, keyUsage: 1, basicConstraints: 1, authorityKeyIdentifier: 1,
   extKeyUsage: 1, inhibitAnyPolicy: 1, ocspNoCheck: 1, tlsFeature: 1,
   subjectAltName: 1, issuerAltName: 1, nameConstraints: 1, cRLDistributionPoints: 1,
-  freshestCRL: 1, authorityInfoAccess: 1, subjectInfoAccess: 1,
+  freshestCRL: 1, authorityInfoAccess: 1, subjectInfoAccess: 1, certificatePolicies: 1,
+  policyMappings: 1, policyConstraints: 1,
 };
 // sec. 8.12 Extended Key Usages registry (C509 int -> registered id-kp purpose name). A KeyPurposeId
 // outside this set encodes as an unwrapped ~oid; a C509 int outside it fails closed on decode.
@@ -141,6 +145,28 @@ var IA_BY_INT = {
 var IA_TO_INT = {};
 Object.keys(IA_BY_INT).forEach(function (k) { IA_TO_INT[oid.byName(IA_BY_INT[k])] = Number(k); });
 
+// sec. 8.9 C509 Certificate Policies registry (int -> registered policy OID name; the CA/Browser Forum
+// levels, the RFC 3779 id-cp-ipAddr policies, and the GSMA SGP.22 id-rspRole roles). A policy OID outside
+// this set encodes as ~oid; a C509 policy int outside it fails closed. CP_TO_INT is the derived inverse.
+var CP_BY_INT = {
+  0: _name("anyPolicy"), 1: _name("domain-validated"), 2: _name("organization-validated"),
+  3: _name("individual-validated"), 4: _name("ev-guidelines"),
+  7: _name("id-cp-ipAddr-asNumber"), 8: _name("id-cp-ipAddr-asNumber-v2"),
+  24: _name("id-rspRole-ci"), 25: _name("id-rspRole-euicc-v2"), 26: _name("id-rspRole-euicc"),
+  27: _name("id-rspRole-eum-v2"), 28: _name("id-rspRole-eum"),
+  29: _name("id-rspRole-dp-tls-v2"), 30: _name("id-rspRole-dp-tls"),
+  31: _name("id-rspRole-dp-auth-v2"), 32: _name("id-rspRole-dp-auth"),
+  33: _name("id-rspRole-dp-pb-v2"), 34: _name("id-rspRole-dp-pb"),
+  35: _name("id-rspRole-ds-tls-v2"), 36: _name("id-rspRole-ds-tls"),
+  37: _name("id-rspRole-ds-auth-v2"), 38: _name("id-rspRole-ds-auth"),
+};
+var CP_TO_INT = {};
+Object.keys(CP_BY_INT).forEach(function (k) { CP_TO_INT[oid.byName(CP_BY_INT[k])] = Number(k); });
+// sec. 8.10 C509 Policies Qualifiers registry (int -> id-qt qualifier OID name; the derived inverse).
+var PQ_BY_INT = { 1: _name("cps"), 2: _name("unotice") };
+var PQ_TO_INT = {};
+Object.keys(PQ_BY_INT).forEach(function (k) { PQ_TO_INT[oid.byName(PQ_BY_INT[k])] = Number(k); });
+
 // ---- field readers (the unwrapped ~biguint / ~time / ~oid contracts; draft-20 sec. 3.1) ----
 
 // ~biguint (sec. 3.1.2): a BARE byte string (major type 2), big-endian magnitude, the non-negative
@@ -266,6 +292,14 @@ function _cborIntVal(node, label) {
   if (node.majorType !== 0 && node.majorType !== 1) throw _err("c509/bad-extensions", "a " + label + " value must be a CBOR integer");
   return cbor.read.int(node);
 }
+// A non-negative reconstruct-side count (a policyConstraints / inhibitAnyPolicy SkipCerts, a basicConstraints
+// pathLenConstraint) narrowed to [0, 2^31-1] via the SAME guard.range.uint31 the toolkit's own DER decoders
+// (schema-pkix) bound these INTEGER (0..MAX) counts through. A native CBOR value past 2^31-1 fails closed here
+// rather than reconstructing a DER the toolkit's own decoder would then reject -- the reconstruct path must
+// produce nothing that decoder rejects. Returns a Number; b.integer narrows it to the minimal DER INTEGER.
+function _boundCount(value, label) {
+  return guard.range.uint31(value, _err, "c509/bad-extensions", label + " (0..2^31-1)");
+}
 // A C509 KeyPurposeId (int registry alias OR unwrapped ~oid) -> the dotted extended-key-usage OID.
 function _ekuPurposeOid(node) {
   if (node.majorType === 0 || node.majorType === 1) {
@@ -531,6 +565,66 @@ function _serialIntContent(node) {
   return (mag[0] & 0x80) ? Buffer.concat([Buffer.from([0x00]), mag]) : mag;
 }
 
+// ---- certificatePolicies (draft-20 sec. 3.3 / sec. 8.9 / sec. 8.10; RFC 5280 sec. 4.2.1.4) ----
+// A CBOR text -> a UNIVERSAL IA5String TLV, running the same 7-bit + CVE-2009-2408 control-byte guard the
+// general-name IA5 arms use (never the bare b.ia5, which permits control bytes). Non-empty (the general-name
+// IA5 arms reject empty too; a CPSuri parity tightening -- RFC 5280 sets no SIZE floor on CPSuri).
+function _ia5Universal(text, label) {
+  if (text.length === 0) throw _err("c509/bad-extensions", label + " must be non-empty");
+  for (var i = 0; i < text.length; i++) { if (text.charCodeAt(i) > 0x7f) throw _err("c509/bad-extensions", label + " must be a 7-bit IA5String"); }
+  guard.name.assertPrintableIa5(Buffer.from(text, "latin1"), _err, "c509/bad-extensions", label);
+  return b.ia5(text);
+}
+// A CBOR policyIdentifier (a sec. 8.9 registry int, or an unwrapped ~oid) -> the dotted policy OID.
+function _policyIdToDerOid(node) {
+  if (node.majorType === 0 || node.majorType === 1) {
+    var i = Number(cbor.read.int(node)), nm = CP_BY_INT[i];
+    if (nm === undefined) throw _err("c509/bad-extensions", "a certificatePolicies policy int " + i + " has no C509 sec. 8.9 registry row");
+    return oid.byName(nm);
+  }
+  return _oidName(node, "c509/bad-extensions", "a certificatePolicies policyIdentifier").oid;
+}
+// The inverse: a dotted policy OID -> CBOR (a sec. 8.9 int if registered, else an unwrapped ~oid).
+function _policyIdFromDer(dotted) {
+  var i = CP_TO_INT[dotted];
+  return i !== undefined ? cbor.build.int(BigInt(i)) : _oidCbor(dotted);
+}
+// (qualifierId CBOR, qualifier-text CBOR) -> one DER PolicyQualifierInfo SEQUENCE { policyQualifierId OID,
+// qualifier ANY DEFINED BY }. The qualifierId resolves to a sec. 8.10 int ONLY: a ~oid / unregistered
+// qualifierId has no defined qualifier:text semantics, so it is not compact-representable (fail closed, never
+// guess the ANY type). id-qt-cps -> CPSuri IA5String; id-qt-unotice -> UserNotice { explicitText utf8String }.
+function _qualifierToDer(qidNode, qtextNode) {
+  if (qidNode.majorType !== 0 && qidNode.majorType !== 1) throw _err("c509/bad-extensions", "a policyQualifierId must be a C509 sec. 8.10 int (a ~oid qualifier is not compact-representable)");
+  var qi = Number(cbor.read.int(qidNode)), nm = PQ_BY_INT[qi];
+  if (nm === undefined) throw _err("c509/bad-extensions", "a policyQualifierId int " + qi + " has no C509 sec. 8.10 registry row");
+  if (qtextNode.majorType !== 3) throw _err("c509/bad-extensions", "a policyQualifier value must be a CBOR text string");
+  var text = cbor.read.textString(qtextNode);
+  if (qi === 1) return b.sequence([b.oid(oid.byName("cps")), _ia5Universal(text, "a CPSuri")]);   // CPSuri ::= IA5String
+  // id-qt-unotice: UserNotice ::= SEQUENCE { explicitText utf8String } -- noticeRef omitted, DisplayText SIZE 1..200 floor.
+  if (text.length === 0) throw _err("c509/bad-extensions", "a UserNotice explicitText must be non-empty (DisplayText SIZE 1..200)");
+  return b.sequence([b.oid(oid.byName("unotice")), b.sequence([b.utf8(text)])]);
+}
+// One DER PolicyQualifierInfo node -> [ qidCbor, qtextCbor ], or null when not compact-representable: an
+// unregistered qualifierId, a cps qualifier whose value is not a plain IA5String, or a UserNotice that is
+// anything but SEQUENCE { explicitText utf8String } (a noticeRef, a non-UTF8String DisplayText arm, or more
+// than the one explicitText child) -> whole-extension ~oid fallback.
+function _qualifierFromDer(pq) {
+  var qid = asn1.read.oid(pq.children[0]), qi = PQ_TO_INT[qid];
+  if (qi === undefined) return null;
+  var q = pq.children[1];
+  if (qi === 1) {                                                      // CPSuri ::= IA5String
+    if (q.tagClass !== "universal" || q.tagNumber !== asn1.TAGS.IA5_STRING) return null;
+    var uri; try { uri = asn1.read.string(q); } catch (_e) { return null; }
+    return [cbor.build.int(1n), cbor.build.textString(uri)];
+  }
+  // id-qt-unotice: SEQUENCE { explicitText utf8String } ONLY (noticeRef absent).
+  if (q.tagClass !== "universal" || q.tagNumber !== asn1.TAGS.SEQUENCE || !q.children || q.children.length !== 1) return null;
+  var dt = q.children[0];
+  if (dt.tagClass !== "universal" || dt.tagNumber !== asn1.TAGS.UTF8_STRING) return null;
+  var txt; try { txt = asn1.read.string(dt); } catch (_e2) { return null; }
+  return [cbor.build.int(2n), cbor.build.textString(txt)];
+}
+
 // One CBOR DistributionPointName [ fullName, reasons, cRLIssuer ] -> one DER DistributionPoint SEQUENCE.
 // distributionPoint [0] is EXPLICIT (it wraps the DistributionPointName CHOICE); fullName [0], reasons [1],
 // cRLIssuer [2] are IMPLICIT (RFC 5280 sec. 4.2.1.13) -- mixing these is the classic byte-exactness trap.
@@ -603,7 +697,7 @@ function _extValueToDer(name, node) {
       var iv = _cborIntVal(node, "basicConstraints");
       if (iv === -2n) return b.sequence([]);                                  // cA false (omitted)
       if (iv === -1n) return b.sequence([b.boolean(true)]);                   // cA true, no pathLen
-      if (iv >= 0n) return b.sequence([b.boolean(true), b.integer(iv)]);      // cA true, pathLen
+      if (iv >= 0n) return b.sequence([b.boolean(true), b.integer(_boundCount(iv, "a basicConstraints pathLenConstraint"))]);   // cA true, pathLen (0..2^31-1, as the DER decoder bounds it)
       throw _err("c509/bad-extensions", "a basicConstraints int " + iv + " is outside the -2/-1/pathLen range");
     }
     case "authorityKeyIdentifier":   // keyId-only bytes, or [ keyId, authorityCertIssuer, serial ] (sec. 3.3)
@@ -627,8 +721,8 @@ function _extValueToDer(name, node) {
       }
       return b.sequence(items.map(function (it) { return b.oid(_ekuPurposeOid(it)); }));
     }
-    case "inhibitAnyPolicy":       // uint -> INTEGER SkipCerts
-      return b.integer(_cborUint(node, "inhibitAnyPolicy"));
+    case "inhibitAnyPolicy":       // uint -> INTEGER SkipCerts (0..2^31-1, as the DER decoder bounds it)
+      return b.integer(_boundCount(_cborUint(node, "inhibitAnyPolicy"), "an inhibitAnyPolicy SkipCerts"));
     case "ocspNoCheck":            // null -> NULL
       if (node.majorType !== 7 || !(Buffer.isBuffer(node.bytes) && node.bytes.length === 1 && node.bytes[0] === 0xf6)) throw _err("c509/bad-extensions", "an ocspNoCheck value must be the CBOR simple value null");
       return b.nullValue();
@@ -662,6 +756,52 @@ function _extValueToDer(name, node) {
       if (node.majorType === 3) return b.sequence([b.sequence([b.explicit(0, b.contextConstructed(0, b.contextPrimitive(6, _ia5Bytes(node, 6))))])]);
       if (node.majorType !== 4 || !node.children || node.children.length < 1) throw _err("c509/bad-extensions", "a " + name + " value must be a CBOR array of DistributionPoints or a bare URI text (sec. 3.3)");
       return b.sequence(node.children.map(function (dp) { return _dpToDer(dp); }));
+    case "certificatePolicies": {   // [ pid, [ *(qid, qtext) ], ... ] -> SEQUENCE OF PolicyInformation
+      if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "a certificatePolicies value must be a CBOR array");
+      var cpKids = node.children;
+      if (cpKids.length === 0 || cpKids.length % 2 !== 0) throw _err("c509/bad-extensions", "a certificatePolicies array must be non-empty (policyIdentifier, qualifiers) pairs (sec. 3.3)");
+      var polInfos = [], seenPolicy = {};
+      for (var cpi = 0; cpi + 1 < cpKids.length; cpi += 2) {
+        var quals = cpKids[cpi + 1];
+        if (quals.majorType !== 4 || !quals.children) throw _err("c509/bad-extensions", "a certificatePolicies qualifiers slot must be a CBOR array");
+        // A policy OID MUST NOT appear more than once (RFC 5280 sec. 4.2.1.4); the toolkit's own DER decoder
+        // rejects a duplicate (schema-pkix certExtensionDecoders), so reconstruct fails closed rather than
+        // producing a certificatePolicies extension that decoder would reject.
+        var policyOid = _policyIdToDerOid(cpKids[cpi]);
+        if (seenPolicy[policyOid]) throw _err("c509/bad-extensions", "a certificatePolicies policy OID must not appear more than once (RFC 5280 sec. 4.2.1.4)");
+        seenPolicy[policyOid] = true;
+        var polFields = [b.oid(policyOid)];
+        if (quals.children.length) {
+          if (quals.children.length % 2 !== 0) throw _err("c509/bad-extensions", "a policyQualifiers array must be (policyQualifierId, qualifier) pairs");
+          var pqDers = [];
+          for (var qk = 0; qk + 1 < quals.children.length; qk += 2) pqDers.push(_qualifierToDer(quals.children[qk], quals.children[qk + 1]));
+          polFields.push(b.sequence(pqDers));   // policyQualifiers SEQUENCE OF PolicyQualifierInfo
+        }
+        polInfos.push(b.sequence(polFields));
+      }
+      return b.sequence(polInfos);
+    }
+    case "policyMappings": {        // [ idp, sdp, idp, sdp, ... ] -> SEQUENCE OF SEQUENCE { OID, OID } (sec. 3.3)
+      if (node.majorType !== 4 || !node.children) throw _err("c509/bad-extensions", "a policyMappings value must be a CBOR array");
+      var pmKids = node.children;
+      if (pmKids.length === 0 || pmKids.length % 2 !== 0) throw _err("c509/bad-extensions", "a policyMappings array must be non-empty (issuerDomainPolicy, subjectDomainPolicy) pairs (sec. 3.3)");
+      var maps = [];
+      // each member is a CertPolicyId -- the same sec. 8.9 int/~oid policy space as certificatePolicies (an int
+      // outside sec. 8.9 fails closed in _policyIdToDerOid). anyPolicy is accepted: RFC 5280 sec. 4.2.1.5's
+      // "MUST NOT map to/from anyPolicy" is a generation rule the toolkit's own DER decoder does not reject.
+      for (var mi = 0; mi + 1 < pmKids.length; mi += 2) maps.push(b.sequence([b.oid(_policyIdToDerOid(pmKids[mi])), b.oid(_policyIdToDerOid(pmKids[mi + 1]))]));
+      return b.sequence(maps);
+    }
+    case "policyConstraints": {      // [ requireExplicitPolicy: uint/null, inhibitPolicyMapping: uint/null ] -> SEQUENCE { [0]?, [1]? }
+      if (node.majorType !== 4 || !node.children || node.children.length !== 2) throw _err("c509/bad-extensions", "a policyConstraints value must be a 2-element CBOR array [ requireExplicitPolicy, inhibitPolicyMapping ] (sec. 3.3)");
+      var pcFields = [], repN = node.children[0], ipmN = node.children[1];
+      if (!_isCborNull(repN)) pcFields.push(b.implicit(0, b.integer(_boundCount(_cborUint(repN, "a policyConstraints requireExplicitPolicy"), "a policyConstraints requireExplicitPolicy"))));   // requireExplicitPolicy [0] IMPLICIT SkipCerts
+      if (!_isCborNull(ipmN)) pcFields.push(b.implicit(1, b.integer(_boundCount(_cborUint(ipmN, "a policyConstraints inhibitPolicyMapping"), "a policyConstraints inhibitPolicyMapping"))));   // inhibitPolicyMapping [1] IMPLICIT SkipCerts
+      // both-null is the empty-SEQUENCE case RFC 5280 sec. 4.2.1.11 forbids ("either ... MUST be present"); the
+      // toolkit's own DER decoder rejects the empty PolicyConstraints, so the reconstruct fails closed too.
+      if (pcFields.length === 0) throw _err("c509/bad-extensions", "policyConstraints must contain requireExplicitPolicy or inhibitPolicyMapping (RFC 5280 sec. 4.2.1.11)");
+      return b.sequence(pcFields);   // positional slot -> tag makes [0] < [1] unique + ascending by construction
+    }
     default:
       throw _err("c509/bad-extensions", "extension " + name + " has no compact value decoder");
   }
@@ -775,6 +915,55 @@ function _extValueFromDer(name, der) {
       if (dpResults.length === 1 && dpResults[0].oneUri != null && dpResults[0].noReasons && dpResults[0].noIssuer) return cbor.build.textString(dpResults[0].oneUri);
       return cbor.build.array(dpResults.map(function (r) { return r.triple; }));
     }
+    case "certificatePolicies": {                                  // SEQUENCE OF PolicyInformation -> [ pid, [ *(qid, qtext) ], ... ]
+      if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children || node.children.length < 1) return null;
+      var cpOut = [];
+      for (var pli = 0; pli < node.children.length; pli++) {
+        var pol = node.children[pli];
+        if (pol.tagClass !== "universal" || pol.tagNumber !== asn1.TAGS.SEQUENCE || !pol.children || pol.children.length < 1 || pol.children.length > 2) return null;
+        cpOut.push(_policyIdFromDer(asn1.read.oid(pol.children[0])));
+        var qArr = [];
+        if (pol.children.length === 2) {
+          var qseq = pol.children[1];
+          if (qseq.tagClass !== "universal" || qseq.tagNumber !== asn1.TAGS.SEQUENCE || !qseq.children || !qseq.children.length) return null;   // policyQualifiers SIZE 1..MAX
+          for (var qj = 0; qj < qseq.children.length; qj++) {
+            var pq = qseq.children[qj];
+            if (pq.tagClass !== "universal" || pq.tagNumber !== asn1.TAGS.SEQUENCE || !pq.children || pq.children.length !== 2) return null;
+            var qpair = _qualifierFromDer(pq);
+            if (qpair == null) return null;                        // any non-cps/unotice qualifier -> whole-ext fallback
+            qArr.push(qpair[0]); qArr.push(qpair[1]);
+          }
+        }
+        cpOut.push(cbor.build.array(qArr));                        // empty [] when policyQualifiers absent
+      }
+      return cbor.build.array(cpOut);
+    }
+    case "policyMappings": {                                        // SEQUENCE OF SEQUENCE { OID, OID } -> [ idp, sdp, ... ]
+      if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children || node.children.length < 1) return null;
+      var pmOut = [];
+      for (var pm = 0; pm < node.children.length; pm++) {
+        var mp = node.children[pm];
+        if (mp.tagClass !== "universal" || mp.tagNumber !== asn1.TAGS.SEQUENCE || !mp.children || mp.children.length !== 2) return null;
+        pmOut.push(_policyIdFromDer(asn1.read.oid(mp.children[0])));
+        pmOut.push(_policyIdFromDer(asn1.read.oid(mp.children[1])));
+      }
+      return cbor.build.array(pmOut);
+    }
+    case "policyConstraints": {                                     // SEQUENCE { [0] rep?, [1] ipm? } -> [ rep/null, ipm/null ]
+      if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children || node.children.length < 1 || node.children.length > 2) return null;
+      var repC = cbor.build.nullValue(), ipmC = cbor.build.nullValue(), pcLast = -1;
+      for (var pci = 0; pci < node.children.length; pci++) {
+        var f = node.children[pci];
+        if (f.tagClass !== "context" || f.tagNumber <= pcLast) return null;   // DER: unique + ascending [0] < [1]
+        pcLast = f.tagNumber;
+        var sv = asn1.read.integerImplicit(f, f.tagNumber);
+        if (sv < 0n) return null;                                             // SkipCerts (0..MAX) -- a negative is non-compact
+        if (f.tagNumber === 0) repC = cbor.build.uint(sv);
+        else if (f.tagNumber === 1) ipmC = cbor.build.uint(sv);
+        else return null;
+      }
+      return cbor.build.array([repC, ipmC]);
+    }
     default:
       return null;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.3.32",
+  "version": "0.4.0",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:0d0e1498-d791-4209-890f-c1d837673a21",
+  "serialNumber": "urn:uuid:40b5fc50-7b82-41d2-9e80-f01b6be97878",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-05T23:30:49.498Z",
+    "timestamp": "2026-08-06T23:41:09.454Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.3.32",
+      "bom-ref": "@blamejs/pki@0.4.0",
       "type": "application",
       "name": "pki",
-      "version": "0.3.32",
+      "version": "0.4.0",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.3.32",
+      "purl": "pkg:npm/%40blamejs/pki@0.4.0",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.3.32",
+      "ref": "@blamejs/pki@0.4.0",
       "dependsOn": []
     }
   ]