@blamejs/pki 0.4.14 → 0.4.15

package/CHANGELOG.md

@@ -4,6 +4,31 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.4.15 — 2026-08-11
+
+A CA that partitions revocations by reason code, or publishes a delta CRL alongside its base, now gets a real answer instead of "undetermined".
+
+### Added
+
+- Reason coverage ACCUMULATES. Each CRL that corresponds to one of the certificate's distribution points contributes its interim reason mask (RFC 5280 sec. 6.3.3(d)(1)-(4)), and the certificate reads good once the CRLs together cover all eight revocation reasons (sec. 6.3.3(l)). Previously only a CRL that covered every reason by itself could establish good, so a reason-partitioned CA could never be satisfied. Partial coverage still fails closed, and a shard that does not correspond to the certificate contributes nothing while still being consulted for revocation.
+- Delta CRLs are MERGED onto a complete CRL they may be combined with (sec. 5.2.4(a)-(d), sec. 6.3.3(c)): same issuer, byte-identical issuing distribution point and authority key identifier, and a base number the complete CRL's own number covers. The delta is searched first, the complete CRL only if the delta left the certificate unrevoked, and a removeFromCRL entry then releases it -- so a certificate placed on hold and later released reaches good rather than staying rejected. A delta is merged only when the certificate or the complete CRL carries a freshestCRL locator (sec. 6.3.3(a)(2)).
+- pki.path.crlChecker(crls, opts) takes opts.useDeltas (sec. 6.3.1(b)), default true. With it false a delta is never merged; it is still consulted for revocation.
+- A revoked verdict carries reasonCode -- the CRLReason integer, 0 for unspecified when the entry has no reasonCode extension -- and a reason naming it, so an operator learns that a certificate was revoked for keyCompromise rather than only that it was revoked.
+
+### Changed
+
+- Merging can only ever turn an undetermined verdict into good or revoked. A delta that combines with no complete CRL held locally is still consulted for the revocations it lists, and still withholds good, so an unmergeable delta -- including one naming a base the verifier does not have -- can never erase a revocation. Where several current deltas exist for one scope, which RFC 5280 sec. 5.2.4 permits, the one with the latest thisUpdate is selected rather than the set being treated as a fault.
+- The reasons field of a certificate's cRLDistributionPoints is now rejected unless minimally encoded, matching the rule already applied to keyUsage (X.690 sec. 11.2.2 named bit lists). Two encodings of one reason set previously both parsed, which would leave the reason intersection computed over an encoding the rules forbid.
+- A delta CRL indicator that is not marked critical, which RFC 5280 sec. 5.2.4 requires it to be, does not make the CRL mergeable. Such a CRL is still treated as a delta and still consulted for the revocations it lists, as before, but it cannot release a certificate its base revoked -- releasing rests on a conforming indicator.
+- An issuing distribution point that is not marked critical cannot contribute reason coverage at all. Such an extension is one a relying party may ignore entirely, so building a good verdict on the scope it declares would rest on something another verifier would not see -- the same fail-closed reasoning already applied to distribution-point correspondence. It still restricts nothing and withholds good, exactly as before this release.
+- A CRL number past the RFC 5280 sec. 5.2.3 twenty-octet ceiling does not make a CRL mergeable, matching the bound pki.crl.sign already enforces when emitting one. Such a CRL is still consulted for the revocations it lists; only the ability to release a certificate is withheld.
+
+### Fixed
+
+- Holding a delta CRL alongside its base is no longer worse than holding the base alone. Any authoritative delta previously forced the whole verdict to undetermined.
+- A CRL that covers no revocation reasons for the certificate -- a shard whose distribution point does not correspond to it -- is now checked for currency and signature before it is consulted at all. Such a CRL is still read for revocations, so without those checks an expired or forged one could have revoked a certificate it never legitimately covered, or, as a delta, released a certificate its base genuinely revoked.
+- A delta CRL superseded by a more recent one for the same scope no longer affects the verdict in either direction. It could previously contribute a revocation that the selected, later delta had released -- resurrecting a revocation the CA withdrew -- while its own release was correctly ignored.
+
 ## v0.4.14 — 2026-08-10
 
 Every key-establishment secret this library allocates is now wiped when it stops being needed -- the classical ones too, not only the post-quantum ones.

package/README.md

@@ -223,7 +223,7 @@ is callable today; nothing below is a stub.
 | `pki.acme` | RFC 8555 / 8737 / 8738 / 9773 ACME — `client(directoryUrl, opts)` is a stateful client that drives a live CA directory over `pki.transport` (inject your own, or the fail-closed default): `newAccount` / `newOrder` / `newAuthz` / `getOrder` / `getAuthorization` / `getChallenge` / `respondToChallenge` / `finalize` / `pollOrder` / `pollAuthorization` / `downloadCertificate` walk the issuance flow — `newAuthz` pre-authorizes a single identifier (§7.4.1) and `downloadCertificate` picks among alternate issuance chains (`Link rel="alternate"`, §7.4.2, via a `selectChain` predicate bounded by `maxAlternates`) — and `revokeCert` (account-key or certificate-key signed), `keyChange` (account key rotation), `deactivateAccount` / `deactivateAuthorization`, `renewalInfo` (ARI), and `renewalWindow` (the RFC 9773 §4.2/4.3 renewal decision) round out the lifecycle — https-only for every URL, an explicit trust anchor required, a fresh single-use nonce per request with a bounded badNonce retry, POST-as-GET reads, bounded polling that sleeps on a Retry-After via an injectable sleeper (capped by a poll count and a total-wait budget), and every response body size-capped. Over the message layer it composes: resource-object validators (closed status enums, conditional-required fields, unknown fields ignored), the three §7.1.6 state machines, request builders (newAccount + EAB, newOrder + `replaces`, finalize with CSR identifier-set match and account-key-reuse rejection, challenge responses, deactivation, revokeCert in both key modes, the keyChange nested JWS, POST-as-GET), the http-01 / dns-01 / tls-alpn-01 challenge computations, the dns/ip identifier validators, and the ARI certID (serial sign-padding preserved), fail-closed — `client`, `validate`, `identify`, `assertTransition`, the builders, `keyAuthorization`, `http01`, `dns01`, `tlsAlpn01Extension`, `verifyTlsAlpn01`, `ariCertId` |
 | `pki.schema.smime` | Decode S/MIME ESS signed-attribute values (RFC 5035 / RFC 8551) — `parseSigningCertificate` / `parseSigningCertificateV2` bind a signature to its signing certificate (cert hash, hash algorithm, issuer `GeneralNames` + serial), `parseSmimeCapabilities` decodes the ordered capability list, and `decodeAttribute` OID-dispatches a CMS attribute (enforcing the single-value rule, recognize-and-defer for unknown types). A companion decoder for CMS signed attributes, not an auto-routed format, fail-closed — `parseSigningCertificate`, `parseSigningCertificateV2`, `parseSmimeCapabilities`, `decodeAttribute` |
 | `pki.schema.engine` | The declarative ASN.1 structure-schema engine every format parser composes — `walk` / `encode` / `embeddedDer` plus the schema combinators |
-| `pki.path` | RFC 5280 §6 certification-path validation — `validate` runs the §6.1 state machine (signature chaining across RSA, ECDSA, EdDSA, ML-DSA, SLH-DSA and hybrid composite ML-DSA signatures — a composite is accepted only when **both** its post-quantum and traditional components verify; validity windows, name chaining, basic constraints and path length, key usage, name constraints, the certificate-policy tree) over an ordered path and a trust anchor, returning a structured verdict with per-check reason codes, and enforces a `pki.trust` anchor's per-purpose distrust-after dates and delegator purposes via `checkPurpose`; `crlChecker` supplies CRL-based revocation — including partitioned/sharded CRLs, whose §6.3.3 Distribution Point ↔ IDP correspondence lets a corresponding full-reason shard establish non-revocation — and `ocspChecker` supplies OCSP-based revocation (RFC 6960 — CertID binding, responder authorization, signature, currency) over the same pluggable hook. `build(leaf, opts)` is the discovering complement (RFC 4158): from a leaf, an untrusted pool of candidate CA certificates, and a trust store, it finds the ordered leaf→anchor path `validate` accepts — name chaining plus the RFC 4158 §3.5 sort hints (AKI/SKI match, anchor-adjacent issuer, CA + keyCertSign, validity), a depth-first search with backtracking so the first path `validate` accepts wins, and a bounded search (chain-length cap, candidate-expansion cap, identity-tuple visited-set) so a cross-certificate cycle or Bridge-CA fan-out terminates deterministically; every accept flows through `validate` and its verdict is cross-checked against `openssl verify`. **Opt-in AIA `caIssuers` fetching** (`opts.fetchAia: true`) discovers a *missing* intermediate from a certificate's Authority Information Access URL (RFC 5280 §4.2.2.1) over `pki.transport`, triggered only on a pool miss — SSRF/amplification-bounded (https-only, a total fetch budget that silently caps fetching rather than throwing, a per-cert URL cap, a build-wide URL dedupe, a response-size + certificate-count cap, no redirect following; every fault a silent skip), with the TLS trust (`opts.tls`) kept distinct from the PKI `trustAnchors` and every fetched certificate remaining untrusted pool material that still flows through `validate` (never a trust anchor). Off by default — the default build is byte-identical offline. Pure and re-entrant, fail-closed — `validate`, `build`, `crlChecker`, `ocspChecker` |
+| `pki.path` | RFC 5280 §6 certification-path validation — `validate` runs the §6.1 state machine (signature chaining across RSA, ECDSA, EdDSA, ML-DSA, SLH-DSA and hybrid composite ML-DSA signatures — a composite is accepted only when **both** its post-quantum and traditional components verify; validity windows, name chaining, basic constraints and path length, key usage, name constraints, the certificate-policy tree) over an ordered path and a trust anchor, returning a structured verdict with per-check reason codes, and enforces a `pki.trust` anchor's per-purpose distrust-after dates and delegator purposes via `checkPurpose`; `crlChecker` supplies CRL-based revocation — including partitioned/sharded CRLs, whose §6.3.3 Distribution Point ↔ IDP correspondence lets corresponding shards ACCUMULATE reason coverage until all eight revocation reasons are covered, and delta CRLs, merged onto the complete CRL they may be combined with (sec. 5.2.4) so a held certificate its delta releases reads good, while a delta that merges with nothing still reports what it lists and still withholds good — and `ocspChecker` supplies OCSP-based revocation (RFC 6960 — CertID binding, responder authorization, signature, currency) over the same pluggable hook. `build(leaf, opts)` is the discovering complement (RFC 4158): from a leaf, an untrusted pool of candidate CA certificates, and a trust store, it finds the ordered leaf→anchor path `validate` accepts — name chaining plus the RFC 4158 §3.5 sort hints (AKI/SKI match, anchor-adjacent issuer, CA + keyCertSign, validity), a depth-first search with backtracking so the first path `validate` accepts wins, and a bounded search (chain-length cap, candidate-expansion cap, identity-tuple visited-set) so a cross-certificate cycle or Bridge-CA fan-out terminates deterministically; every accept flows through `validate` and its verdict is cross-checked against `openssl verify`. **Opt-in AIA `caIssuers` fetching** (`opts.fetchAia: true`) discovers a *missing* intermediate from a certificate's Authority Information Access URL (RFC 5280 §4.2.2.1) over `pki.transport`, triggered only on a pool miss — SSRF/amplification-bounded (https-only, a total fetch budget that silently caps fetching rather than throwing, a per-cert URL cap, a build-wide URL dedupe, a response-size + certificate-count cap, no redirect following; every fault a silent skip), with the TLS trust (`opts.tls`) kept distinct from the PKI `trustAnchors` and every fetched certificate remaining untrusted pool material that still flows through `validate` (never a trust anchor). Off by default — the default build is byte-identical offline. Pure and re-entrant, fail-closed — `validate`, `build`, `crlChecker`, `ocspChecker` |
 | `pki.x509` | X.509 certificate issuance (RFC 5280 §4) — `sign(spec, issuer, opts)` builds and signs a certificate: a `spec` of subject (a common-name string, an array of RDNs, or raw Name DER), the public key being certified, the validity window, an optional serial, and an optional `extensions` object; an `issuer` that is a key alone (self-signed — issuer equals subject, signed with that key) or a name + public key + key, or an issuing certificate + key (CA-signed). The signature algorithm is resolved from the signing key through the shared registry, so RSA (PKCS#1 v1.5 / PSS via `opts.pss`), ECDSA P-256/384/521, Ed25519, Ed448, ML-DSA-44/65/87, the twelve SLH-DSA sets, and the composite arms all issue without a per-algorithm branch. It encodes basic constraints, key usage, extended key usage, subject and authority key identifiers (the SKI auto-derived by SHA-1 of the subject key), subject alternative names, and certificate policies from the spec — any other extension supplied as pre-encoded DER — derives the version from the field set, and enforces the serial bounds, the UTCTime/GeneralizedTime cutover, the DER default omissions, and the CA cross-field rules; a violation throws a typed `CertificateError`. Returns DER, or a PEM `CERTIFICATE` with `opts.pem`; every arm is independently verified by OpenSSL. Parsing stays at `pki.schema.x509.parse` — `sign` |
 | `pki.csr` | PKCS#10 certification-request issuance (RFC 2986 / RFC 2985) — `sign(spec, key, opts)` builds and signs a `CertificationRequest`: a `spec` of subject (a common-name string, an array of RDNs, or raw Name DER; may be empty), the public key being certified, an optional `extensionRequest` (requested v3 extensions — subject alternative names, key usage, extended key usage, basic constraints, certificate policies, subject key identifier, or an array of pre-encoded Extension DER — that a CA copies into the issued certificate), and an optional `challengePassword`. `key` (or `{ key }`) is the subject's own private key: the request is self-signed to prove possession of the private half of `subjectPublicKey`, and that proof is verified before the request is returned (what `openssl req -verify` checks). The signature algorithm is resolved from the subject key, so RSA (PKCS#1 v1.5 / PSS via `opts.pss`), ECDSA, EdDSA, ML-DSA, SLH-DSA, and the composite arms all sign without a per-algorithm branch. Returns DER, or a PEM `CERTIFICATE REQUEST` with `opts.pem`; malformed input throws a typed `CsrError`. Parsing stays at `pki.schema.csr.parse` — `sign` |
 | `pki.attrcert` | RFC 5755 attribute-certificate issuance — `sign(spec, issuer, opts)` builds and signs an `AttributeCertificate` as an Attribute Authority: a `spec` of `holder` (exactly one of an entity name, a `baseCertificateID` public-key-certificate reference, a `fromCertificate` binding derived from a certificate, or an object digest), the validity window (GeneralizedTime), an optional serial (positive, ≤ 20 octets; randomly generated when omitted), the `attributes` (the privilege syntaxes — role, clearance, group, chargingIdentity, accessIdentity, authenticationInfo — or pre-encoded Attribute DER), and optional `extensions` (auditIdentity, targetInformation, noRevAvail, aaControls, acProxying, authorityKeyIdentifier, or pre-encoded Extension DER, each with its RFC 5755 criticality). An attribute certificate is never self-signed — the `issuer` is the signing AA, supplied as `{ cert, key }` or `{ name, publicKey, key }`. The signature algorithm is resolved from the AA key, so RSA (PKCS#1 v1.5 / PSS via `opts.pss`), ECDSA, EdDSA, ML-DSA, SLH-DSA, and the composite arms all sign without a per-algorithm branch, and the signature is verified under the AA public key before the certificate is returned. Returns DER, or a PEM `ATTRIBUTE CERTIFICATE` with `opts.pem`; malformed input throws a typed `AttrCertError`. Parsing stays at `pki.schema.attrcert.parse` — `sign` |

package/lib/path-validate.js

@@ -1469,6 +1469,9 @@ function userConstrainedPolicies(state, n) {
 
 var OID_IDP = oid.byName("issuingDistributionPoint");
 var OID_DELTA_CRL = oid.byName("deltaCRLIndicator");
+var OID_AUTHORITY_KEY_ID = oid.byName("authorityKeyIdentifier");
+var OID_CRL_NUMBER = oid.byName("cRLNumber");
+var OID_FRESHEST_CRL = oid.byName("freshestCRL");
 
 // IssuingDistributionPoint ::= SEQUENCE { distributionPoint [0] OPTIONAL,
 // onlyContainsUserCerts [1] DEFAULT FALSE, onlyContainsCACerts [2] DEFAULT FALSE,
@@ -1489,6 +1492,58 @@ var IDP_SCHEMA = schema.seq([
   ], { minTag: 0, maxTag: 5, unexpectedCode: "path/bad-idp", orderCode: "path/bad-idp" }),
 ], { assert: "sequence", code: "path/bad-idp", what: "IssuingDistributionPoint" });
 
+// RFC 5280 sec. 6.3.2(a): the legal members of reasons_mask are exactly the eight
+// named ReasonFlags bits, 1..8 (`unused` bit 0 is not a reason, and `unspecified`
+// has no ReasonFlags bit at all). 0x1FE is bits 1..8 set.
+//
+// NOTE the numbering divergence, which is the trap in this area: a ReasonFlags BIT
+// is not a CRLReason VALUE. Bits 1..6 coincide with codes 1..6, but bit 7 is
+// privilegeWithdrawn (code 9) and bit 8 is aACompromise (code 10). sec. 6.3.3 never
+// needs a mapping between them -- the mask comes only from IDP/DP ReasonFlags and
+// cert_status only from an entry's CRLReason -- so no bit<->code table exists here,
+// deliberately. constants.NAMES.REASON_FLAGS and NAMES.CRL_REASON stay separate.
+var ALL_REASONS = 0x1FE;
+
+// A ReasonFlags BIT STRING { unusedBits, bytes } -> a bit mask, or null when the
+// encoding is not minimal DER (X.690 sec. 11.2.2 NamedBitList: trailing zero bits
+// MUST be dropped). A null tells the caller the CRL's scope is unknown, which is
+// the same fail-closed posture decodeIdp already takes for a malformed IDP.
+//
+// Bits at or above 9 are undefined by sec. 4.2.1.13. They are IGNORED rather than
+// rejected: an undefined bit can never help reach all-reasons, so ignoring it can
+// only withhold coverage, never grant it. Reading a bounded prefix also means a
+// hostile multi-kilobyte ReasonFlags costs nothing.
+function reasonMaskFromBitString(bs) {
+  if (!bs || !bs.bytes) return null;
+  try { schema.assertMinimalNamedBits(bs.unusedBits, bs.bytes, function (msg) { throw E("path/bad-idp", msg); }); }
+  catch (_e) { return null; }
+  var mask = 0;
+  // From bit 1: sec. 6.3.2(a) defines the legal members as the eight NAMED reasons, and ReasonFlags
+  // bit 0 is  -- not a reason at all. Admitting it could not grant coverage (the completeness
+  // test masks with ALL_REASONS) but would make a shard that asserts ONLY bit 0 look like partial
+  // coverage rather than none, which is the wrong verdict to report.
+  for (var bit = 1; bit <= 8; bit++) {
+    var byteI = bit >> 3;
+    if (byteI >= bs.bytes.length) break;
+    if (bs.bytes[byteI] & (0x80 >> (bit & 7))) mask |= (1 << bit);
+  }
+  return mask;
+}
+
+// RFC 5280 sec. 6.3.3(d)(1)-(4) -- the interim_reasons_mask, in ONE place.
+//   (1) both present            -> intersection
+//   (2) IDP present, DP absent  -> the IDP's reasons
+//   (3) IDP absent, DP present  -> the DP's reasons
+//   (4) both absent             -> all-reasons
+// A null mask means "present but unreadable"; the caller has already marked such a
+// CRL unusable, so treating it as 0 here is belt-and-braces, never a coverage grant.
+function interimReasonMask(idpMask, dpMask) {
+  if (idpMask != null && dpMask != null) return idpMask & dpMask;      // (d)(1)
+  if (idpMask != null) return idpMask;                                  // (d)(2)
+  if (dpMask != null) return dpMask;                                    // (d)(3)
+  return ALL_REASONS;                                                   // (d)(4)
+}
+
 function decodeIdp(ext) {
   // Surface the scope flags the checker gates on. ANY structural or value fault
   // -- non-SEQUENCE, unknown/duplicate/out-of-order field tag, a non-DER BOOLEAN,
@@ -1523,6 +1578,15 @@ function decodeIdp(ext) {
   out.onlyUser = flag(m.fields.onlyContainsUserCerts);
   out.onlyCa = flag(m.fields.onlyContainsCACerts);
   out.onlySomeReasons = m.fields.onlySomeReasons.present ? true : null;
+  // The reason BITS, not just their presence: sec. 6.3.3(d)(1)/(d)(2) need the
+  // value. A present-but-non-minimal ReasonFlags leaves the CRL's scope unknown,
+  // which is the same unusable posture every other IDP fault takes -- otherwise
+  // the (d)(1) intersection would be computed over an encoding DER forbids.
+  out.onlySomeReasonsMask = null;
+  if (m.fields.onlySomeReasons.present) {
+    out.onlySomeReasonsMask = reasonMaskFromBitString(m.fields.onlySomeReasons.value);
+    if (out.onlySomeReasonsMask === null) out.malformed = true;
+  }
   out.indirect = flag(m.fields.indirectCRL);
   out.onlyAttr = flag(m.fields.onlyContainsAttributeCerts);
   return out;
@@ -1582,9 +1646,128 @@ function crlIssuerNamesIssuer(cRLIssuer, issuerRdns) {
   return false;
 }
 
+// The raw extnValue octets of a CRL extension, or null. sec. 6.3.3(c)(2)/(c)(3)
+// compare the IDP and authorityKeyIdentifier of a delta and its base for identity;
+// the comparison is over the exact encoded octets (the sec. 5.2.5 @3648
+// "identical encoding" discipline already used for distributionPoint matching),
+// never over a re-normalized decode.
+function crlExtValue(theCrl, wantOid) {
+  for (var i = 0; i < theCrl.crlExtensions.length; i++) {
+    if (theCrl.crlExtensions[i].oid === wantOid) return theCrl.crlExtensions[i].value;
+  }
+  return null;
+}
+
+// One pass over the bundle: split complete CRLs from deltas and decode, per CRL,
+// the values the merge preconditions compare. A delta whose BaseCRLNumber will not
+// decode as a non-negative INTEGER is unusable AS A DELTA but stays consultable for
+// revocation -- dropping it wholesale would lose a revocation it lists (T1).
+// RFC 5280 sec. 5.2.3 @3404 bounds a CRL number at 20 octets, and pki.crl.sign enforces that on
+// emission. A number past it is non-conforming, so it does not earn the merge -- which can RELEASE
+// a certificate. The value still decodes and the CRL is still consulted for revocation; only the
+// new capability is withheld. Measured on the ENCODED length, matching the producer-side check
+// rather than a re-derived numeric bound.
+function crlNumberWithinBound(n) {
+  if (typeof n !== "bigint" || n < 0n) return false;
+  try { return asn1.decode(asn1.build.integer(n)).content.length <= 20; }
+  catch (_e) { return false; }
+}
+
+function classifyCrls(parsed) {
+  var completes = [], deltas = [];
+  for (var i = 0; i < parsed.length; i++) {
+    var theCrl = parsed[i];
+    var deltaRaw = crlExtValue(theCrl, OID_DELTA_CRL);
+    var deltaCritical = false;
+    for (var dz = 0; dz < theCrl.crlExtensions.length; dz++) {
+      if (theCrl.crlExtensions[dz].oid === OID_DELTA_CRL) { deltaCritical = theCrl.crlExtensions[dz].critical === true; break; }
+    }
+    // schema-crl already decoded cRLNumber to a non-negative BigInt; the IDP,
+    // authorityKeyIdentifier and deltaCRLIndicator values stay RAW octets there,
+    // which is exactly what the byte-identical compares below need.
+    var num = crlExtValue(theCrl, OID_CRL_NUMBER);
+    var rec = {
+      crl: theCrl,
+      crlNumber: crlNumberWithinBound(num) ? num : null,
+      idpRaw: crlExtValue(theCrl, OID_IDP),
+      akiRaw: crlExtValue(theCrl, OID_AUTHORITY_KEY_ID),
+      baseCrlNumber: null,
+      mergeable: false,
+    };
+    if (deltaRaw === null) { completes.push(rec); continue; }
+    try {
+      var n = asn1.read.integer(asn1.decode(deltaRaw));
+      // sec. 5.2.3 @3404: a CRL number may be up to 20 octets. It stays a BigInt
+      // through every comparison below -- narrowing through Number would collapse
+      // large values and make 5.2.4(c)/(d) compare the wrong things.
+      // sec. 5.2.4 @3447 makes deltaCRLIndicator a MUST-be-critical extension. A non-critical one
+      // is non-conforming, so it does not earn the NEW capability of being merged -- merging can
+      // RELEASE a certificate, and that must rest on a conforming indicator. It is still classified
+      // as a delta and still consulted for revocation, which is the shipped behaviour and the
+      // conservative direction.
+      if (crlNumberWithinBound(n) && deltaCritical) { rec.baseCrlNumber = n; rec.mergeable = true; }
+    } catch (_e) {
+      // Unusable AS A DELTA, but still scanned for revocation. That is the conservative direction:
+      // the CRL is still the issuer's, signed and current (it must pass every gate before it is
+      // consulted), so a serial it lists is a genuine revocation and dropping it wholesale could
+      // lose one. Consulting it can only ever find MORE revocations, never grant coverage -- a
+      // delta contributes no reason mask.
+    }
+    deltas.push(rec);
+  }
+  return { completes: completes, deltas: deltas };
+}
+
+// RFC 5280 sec. 6.3.3(c)(1)-(3) + sec. 5.2.4(a)-(d), as one predicate. Every
+// comparison is BigInt or byte-exact: no narrowing, no canonicalization. An
+// extension ABSENT on both sides matches; present on one side only does not.
+function deltaMergesWith(delta, complete) {
+  if (!delta.mergeable) return false;
+  // Both numbers are required: 5.2.4(c)/(d) are ordering rules, and a missing
+  // cRLNumber on either side leaves the ordering unknowable -- fail closed.
+  if (complete.crlNumber === null || delta.crlNumber === null) return false;
+  if (!dnEqualUsable(delta.crl.issuer.rdns, complete.crl.issuer.rdns)) return false;  // (c)(1)
+  if (!sameRawExt(delta.idpRaw, complete.idpRaw)) return false; // (c)(2) / 5.2.4(b)
+  if (!sameRawExt(delta.akiRaw, complete.akiRaw)) return false; // (c)(3)
+  if (!(complete.crlNumber >= delta.baseCrlNumber)) return false;  // 5.2.4(c)
+  if (!(complete.crlNumber < delta.crlNumber)) return false;      // 5.2.4(d)
+  return true;
+}
+// dnEqual THROWS on a DN carrying an embedded NUL/control byte (CVE-2009-2408).
+// For the merge preconditions a DN that cannot be compared is simply not a match:
+// the delta and the base are not shown to share an issuer, so they are not merged.
+// The throw is contained here rather than at the call site so the predicate itself
+// stays a straight-line sequence of comparisons.
+function dnEqualUsable(a, b) {
+  try { return dnEqual(a, b); }
+  catch (_e) { return false; }
+}
+
+function sameRawExt(a, b) {
+  if (a === null && b === null) return true;
+  if (a === null || b === null) return false;
+  return a.equals(b);
+}
+
+// sec. 5.2.4 @3580 makes MULTIPLE current deltas for one scope legal and says the
+// application SHOULD take the one with the latest thisUpdate. Selection, never
+// rejection: treating two current deltas as a fault would refuse a conforming
+// publication. Ties break on the greater cRLNumber, then first-wins.
+function selectDelta(candidates) {
+  var best = null;
+  for (var i = 0; i < candidates.length; i++) {
+    var c = candidates[i];
+    if (best === null) { best = c; continue; }
+    var t = c.crl.thisUpdate.getTime(), bt = best.crl.thisUpdate.getTime();
+    if (t > bt) { best = c; continue; }
+    if (t === bt && c.crlNumber !== null && best.crlNumber !== null && c.crlNumber > best.crlNumber) best = c;
+  }
+  return best;
+}
+
 /**
  * @primitive  pki.path.crlChecker
- * @signature  pki.path.crlChecker(crls) -> RevocationChecker
+ * @signature  pki.path.crlChecker(crls, opts?) -> RevocationChecker
  * @since      0.1.16
  * @status     experimental
  * @spec       RFC 5280
@@ -1599,17 +1782,38 @@ function crlIssuerNamesIssuer(cRLIssuer, issuerRdns) {
  * "unknown" }`. A partitioned/sharded CRL (a critical IDP naming a
  * distribution point) establishes "good" when it corresponds to one of the
  * certificate's own cRLDistributionPoints -- at least one identically-encoded
- * name in common (RFC 5280 sec. 6.3.3) -- and neither side restricts reason
- * codes; a non-corresponding or reason-restricted shard is consulted for
- * revocation only. An out-of-scope, stale, unauthorized, or unverifiable CRL
- * yields `unknown`, which the validator fails closed unless `softFail` is set.
+ * name in common (RFC 5280 sec. 6.3.3). Reason-sharded CRLs ACCUMULATE: each
+ * corresponding CRL contributes its interim reason mask (sec. 6.3.3(d)) and the
+ * certificate is "good" once the shards together cover all eight revocation
+ * reasons, so a CA that partitions by reason code is served. A DELTA CRL is
+ * merged onto a complete CRL it may be combined with (sec. 5.2.4 / 6.3.3(c)):
+ * the delta is searched first, the complete CRL only if the delta left the
+ * status unrevoked, and `removeFromCRL` then releases the certificate -- so a
+ * base+delta pair reports a real verdict where the base alone could not. A
+ * delta that merges with nothing is still consulted for revocation and still
+ * blocks "good": merging may turn undetermined into good or revoked, never a
+ * revoked into a good. A non-corresponding shard is consulted for revocation
+ * only. An out-of-scope, stale, unauthorized, or unverifiable CRL yields
+ * `unknown`, which the validator fails closed unless `softFail` is set.
+ *
+ * A `revoked` verdict carries `reasonCode` (the CRLReason integer, 0 for
+ * `unspecified`) and a `reason` naming it.
+ *
+ * @opts
+ *   useDeltas  boolean  merge delta CRLs onto their base (RFC 5280 sec. 6.3.1(b)).
+ *                       Default true. When false a delta is never merged; it is
+ *                       still consulted for revocation.
  *
  * @example
  *   var checker = pki.path.crlChecker([]);   // no CRLs -> every cert is "unknown"
  *   typeof checker.check;                     // "function"
  */
-function crlChecker(crls) {
+function crlChecker(crls, opts) {
   var parsed = (crls || []).map(function (c) { return (c && c.tbsBytes) ? c : crl.parse(c); });
+  // RFC 5280 sec. 6.3.1(b): use-deltas is an INPUT to the algorithm. Default ON --
+  // a caller holding a delta wants it used -- and turning it off never makes a
+  // verdict weaker, only less determined.
+  var useDeltas = !(opts && opts.useDeltas === false);
   return {
     check: async function (cert, issuer, ctx) {
       var time = ctx.time;
@@ -1660,42 +1864,58 @@ function crlChecker(crls) {
       }
 
       // Consult EVERY CRL issued by the cert's issuer -- a clean CRL must not
-      // shadow a revoking one (RFC 5280 6.3.3). A serial listed in ANY
+      // shadow a revoking one (RFC 5280 sec. 6.3.3). A serial listed in ANY
       // authoritative, in-scope, current, verified CRL is revoked; the cert is
-      // "good" only if at least one such CRL was consulted and none list it;
-      // otherwise the status is undetermined.
-      var sawAuthoritative = false;
-      var sawDelta = false;
-      var sawDeltaRemoval = false;   // a delta released this serial from hold
-      var revokedResult = null;      // a base/full CRL revocation, decided at the end
-      for (var k = 0; k < parsed.length; k++) {
-        var theCrl = parsed[k];
+      // "good" only when the CRLs consulted together cover ALL EIGHT revocation
+      // reasons (sec. 6.3.3(l) + the termination rule at @5291) and none list it.
+      //
+      // Note there is deliberately no early exit once the mask is complete: the
+      // shipped checker scans every CRL so a clean one cannot shadow a revoking
+      // one, and stopping at full coverage would reintroduce exactly that.
+      var certStatus = null;          // sec. 6.3.2(b) cert_status; null = UNREVOKED
+      var reasonsMask = 0;            // sec. 6.3.2(a) reasons_mask; the empty set
+      var releasedByUnmergedDelta = false;
+      // A CURRENT, authoritative delta that merged with nothing means the local
+      // revocation picture is incomplete: the base it names may be newer than any
+      // complete CRL held here, so a clean base proves less than it appears to.
+      // The shipped checker blocks  on exactly this, and the merge must only
+      // ever turn undetermined INTO good -- never make an unmerged delta weaker
+      // than it was before this feature existed.
+      var sawUnmergedDelta = false;
+      var classified = classifyCrls(parsed);
+      var consumedDeltas = [];
+
+      // Every gate a CRL must pass before it may speak for this certificate, in
+      // the shipped order. Returns null when the CRL is unusable, otherwise the
+      // interim_reasons_mask it may contribute -- 0 meaning "consulted for
+      // revocation only", which is how a non-corresponding shard is honestly
+      // encoded (it can reveal a revocation but can never establish coverage).
+      async function gateCrl(rec) {
+        // Memoized per RECORD, and the records are rebuilt by classifyCrls on every check(), so the
+        // cache is per-call and the checker stays re-entrant. Without it the base-by-delta pairing
+        // below would repeat an asynchronous public-key signature verification for every pair --
+        // O(completes x deltas) verifications where the shipped loop did O(crls).
+        if (rec._gated) return rec._gate;
+        rec._gate = await gateCrlUncached(rec);
+        rec._gated = true;
+        return rec._gate;
+      }
+      async function gateCrlUncached(rec) {
+        var theCrl = rec.crl;
         // dnEqual throws on a DN carrying an embedded NUL/control byte (CVE-2009-2408).
         // A single malformed CRL in the bundle must NOT abort the whole check (which
         // would mask a later authoritative CRL and pass under softFail) -- treat it
         // as unusable and skip it, consulting the remaining CRLs.
         var issuerMatches;
         try { issuerMatches = dnEqual(theCrl.issuer.rdns, cert.issuer.rdns); }
-        catch (_e) { continue; }
-        if (!issuerMatches) continue;
-        if (!signerAuthorized) continue;
-
-        // A CRL carrying deltaCRLIndicator is a DELTA CRL: it lists only the
-        // CHANGES since a base CRL (RFC 5280 sec. 5.2.4). deltaCRLIndicator is a
-        // RECOGNIZED extension (so a critical one is not "unhandled"); the delta
-        // is acted on only AFTER it passes the currency + signature checks below,
-        // so a stale, malformed, or unverifiable delta cannot spuriously block a
-        // good result. An AUTHORITATIVE delta blocks "good" (its base is not
-        // merged here) and can still reveal a revocation for a serial it lists.
-        var isDelta = false;
-        for (var dz = 0; dz < theCrl.crlExtensions.length; dz++) {
-          if (theCrl.crlExtensions[dz].oid === OID_DELTA_CRL) { isDelta = true; break; }
-        }
+        catch (_e) { return null; }
+        if (!issuerMatches) return null;
+        if (!signerAuthorized) return null;
 
         // A validly-signed CRL carrying a CRITICAL extension this checker does
         // not understand (anything but issuingDistributionPoint / deltaCRLIndicator)
         // may change the CRL's scope or meaning -- treat it as unusable (RFC 5280
-        // 5.2 critical-extension semantics), never authoritative.
+        // sec. 5.2 critical-extension semantics), never authoritative.
         var unhandledCritical = false;
         for (var x = 0; x < theCrl.crlExtensions.length; x++) {
           var xe = theCrl.crlExtensions[x];
@@ -1715,28 +1935,38 @@ function crlChecker(crls) {
             if (ees[ex].critical && ees[ex].oid !== OID_REASON_CODE) { unhandledCritical = true; break; }
           }
         }
-        if (unhandledCritical) continue;
-
-        // A partition-scoped CRL (a specific distributionPoint, or reason-sharded
-        // via onlySomeReasons) covers only part of the issuer's revocations, so it
-        // cannot by itself establish "good" (full coverage is unconfirmed). But a
-        // serial it LISTS is a genuine revocation of this certificate (serials are
-        // unique per issuer), so such a CRL must still be consulted for revocation
-        // -- dropping it wholesale would let a revoked cert slip under softFail.
-        var scopeRevocationOnly = false;
-        var idpExt = null;
-        for (var e = 0; e < theCrl.crlExtensions.length; e++) if (theCrl.crlExtensions[e].oid === OID_IDP) idpExt = theCrl.crlExtensions[e];
-        if (idpExt) {
-          var idp = decodeIdp(idpExt);
-          if (idp.malformed) continue;                       // scope unknown -> unusable
+        if (unhandledCritical) return null;
+
+        // sec. 6.3.3(d): the interim reason mask this CRL contributes. Its two
+        // inputs are the IDP's onlySomeReasons and the CORRESPONDING certificate
+        // DistributionPoint's reasons -- never an entry's reasonCode (sec. 5.2.5
+        // @3628 explicitly permits a shard entry to omit one).
+        // Set when the shard covers no reasons for this certificate. It is recorded rather than
+        // RETURNED here: the currency and signature gates below still have to run, or an expired,
+        // not-yet-valid or FORGED shard could be scanned for revocations and falsely revoke.
+        var noCoverage = false;
+        var idpMask = null, dpMask = null, sawIdp = false;
+        var idpExtension = null;
+        for (var e = 0; e < theCrl.crlExtensions.length; e++) if (theCrl.crlExtensions[e].oid === OID_IDP) idpExtension = theCrl.crlExtensions[e];
+        if (idpExtension) {
+          sawIdp = true;
+          var idp = decodeIdp(idpExtension);
+          if (idp.malformed) return null;                    // scope unknown -> unusable
           // An indirect CRL carries entries for other issuers keyed by the
           // per-entry certificateIssuer attribute (not tracked here) -- matching
           // by serial alone could revoke the wrong cert or falsely cover it, so
           // treat an indirect CRL as unusable until certificateIssuer is honored.
-          if (idp.indirect) continue;
-          if (idp.onlyAttr) continue;                        // scoped to attribute certs, not this public-key cert
-          if (idp.onlyCa && certIsCa !== true) continue;     // out of scope (or CA-ness undeterminable)
-          if (idp.onlyUser && certIsCa !== false) continue;
+          if (idp.indirect) return null;
+          if (idp.onlyAttr) return null;                     // scoped to attribute certs, not this public-key cert
+          if (idp.onlyCa && certIsCa !== true) return null;   // out of scope (or CA-ness undeterminable)
+          if (idp.onlyUser && certIsCa !== false) return null;
+          // The same fail-closed decision the distributionPoint correspondence rests on (sec. 5.2.5
+          // @3601 lets a relying party not support the IDP at all): a scope a non-supporting
+          // verifier would IGNORE is not a scope to build coverage on. So a non-critical IDP's
+          // onlySomeReasons contributes nothing -- which also preserves the shipped property that
+          // an onlySomeReasons shard could only ever WITHHOLD good, never establish it.
+          if (idpExtension.critical === true) idpMask = idp.onlySomeReasonsMask;
+          else if (idp.onlySomeReasons) noCoverage = true;
           if (idp.hasDistributionPoint) {
             // RFC 5280 sec. 6.3.3(b)(2)(i): a partition shard speaks for this
             // certificate only when the IDP's distribution point shares at
@@ -1744,50 +1974,50 @@ function crlChecker(crls) {
             // own DistributionPoints (sec. 5.2.5: "The identical encoding MUST
             // be used in the distributionPoint fields of the certificate and
             // the CRL"). The IDP must also be CRITICAL to be relied on for
-            // scope: sec. 5.2.5 defines the IDP as "a critical CRL extension"
-            // (descriptive phrasing, not an imperative MUST), and a partition
-            // scope a non-supporting relying party would ignore is not a scope
-            // to build "good" on -- a deliberate fail-closed decision. A
-            // non-corresponding shard cannot establish "good" but is still
-            // consulted for revocation below: serials are unique per issuer,
-            // so a listed serial is a genuine revocation (fail closed toward
-            // revoked).
-            var matchedDp = idpExt.critical === true
+            // scope: sec. 5.2.5 describes the IDP as "a critical CRL extension"
+            // (descriptive phrasing, not an imperative MUST -- and @3601 lets a
+            // relying party not support it at all), so building coverage on a
+            // scope a non-supporting verifier would ignore is a deliberate
+            // fail-closed decision. A non-corresponding shard contributes NO
+            // coverage but is still consulted for revocation below: serials are
+            // unique per issuer, so a listed serial is a genuine revocation.
+            var matchedDp = idpExtension.critical === true
               ? correspondingCertDp(idp.distributionPoint, certDPs, cert.issuer.rdns)
               : null;
-            if (!matchedDp) scopeRevocationOnly = true;
-            // sec. 6.3.3(d)(3): a matched DP carrying `reasons` bounds the
-            // interim reason mask below all-reasons -- under the coarse rule
-            // ("good" only at the (d)(4) all-reasons case) that shard is
-            // revocation-only.
-            else if (matchedDp.reasons) scopeRevocationOnly = true;
+            if (!matchedDp) noCoverage = true;
+            // sec. 6.3.3(d)(1)/(d)(3): a matched DP carrying `reasons` bounds the
+            // interim mask. A present-but-unreadable value cannot bound anything
+            // safely, so it contributes nothing rather than defaulting open.
+            else if (matchedDp.reasons) {
+              dpMask = reasonMaskFromBitString(matchedDp.reasons);
+              if (dpMask === null) noCoverage = true;
+            }
           }
-          // sec. 6.3.3(d)(1)/(d)(2): any onlySomeReasons restriction keeps the
-          // interim reason mask below all-reasons -- revocation-only (coarse).
-          if (idp.onlySomeReasons) scopeRevocationOnly = true;
         }
-        if (theCrl.thisUpdate > time) continue;              // not yet valid
+        if (theCrl.thisUpdate > time) return null;            // not yet valid
         // A CRL with no nextUpdate has no bounded validity -- its currency
         // cannot be confirmed (RFC 5280 sec. 5.1.2.5 requires nextUpdate), so a
         // replayed old CRL must not read "good". Treat it as unusable.
-        if (!theCrl.nextUpdate || theCrl.nextUpdate < time) continue;   // stale / no bound
+        if (!theCrl.nextUpdate || theCrl.nextUpdate < time) return null;   // stale / no bound
 
         var sigOk = await crlVerify.verifyCrlSignature(theCrl, issuer.workingPublicKey);
-        if (!sigOk) continue;                                // unverifiable -> not authoritative
-
-        // The CRL is now authoritative + current + verified. An authoritative
-        // delta blocks a "good" result (its base is not merged here) and can only
-        // reveal a revocation -- never establish "good" on its own.
-        if (isDelta) { sawDelta = true; scopeRevocationOnly = true; }
+        if (!sigOk) return null;                              // unverifiable -> not authoritative
+
+        // sec. 6.3.3 @5295: a CRL not named by any distribution point is processed
+        // as though under a DP whose `reasons` and `cRLIssuer` are absent -- i.e.
+        // all-reasons. That is why a full-scope CRL still covers a certificate
+        // that happens to carry a cRLDistributionPoints extension.
+        void sawIdp;
+        return { interim: noCoverage ? 0 : interimReasonMask(idpMask, dpMask) };
+      }
 
+      // sec. 6.3.3(i)/(j): the certificate's entry on one CRL, as a CRLReason
+      // value, or null for UNREVOKED. sec. 6.3.3(i)(2): an entry with no
+      // reasonCode extension is `unspecified` (0), which is a revocation.
+      function scanCrl(theCrl) {
         for (var r = 0; r < theCrl.revokedCertificates.length; r++) {
           var entry = theCrl.revokedCertificates[r];
           if (entry.serialNumberHex !== cert.serialNumberHex) continue;
-          // reasonCode removeFromCRL (8) means the entry was un-revoked. In a
-          // DELTA this releases the serial from hold; because the base is not
-          // merged here, a definitive "revoked" is no longer possible for it -- a
-          // base CRL that still lists it must not override the delta removal.
-          if (crlEntryReason(entry) === 8) { if (isDelta) sawDeltaRemoval = true; continue; }
           // A revocation is effective as of its revocationDate (RFC 5280 sec. 5.3).
           // In the DEFAULT present-time validation a listed serial is revoked
           // regardless of that date -- a future revocationDate is post-dating or
@@ -1797,28 +2027,113 @@ function crlChecker(crls) {
           // validation time not yet apply.
           // allow:nan-date-comparison-unguarded -- revocationDate is codec-parsed (NaN-rejected); a NaN check time makes this FAIL CLOSED (the skip is not taken -> the entry is treated as revoked), and `time` is validated at the path.validate / crlChecker entry points.
           if (historical && entry.revocationDate instanceof Date && entry.revocationDate.getTime() > time.getTime()) continue;
-          // Record the revocation but keep scanning: a delta removeFromCRL for the
-          // same serial (in another CRL) overrides it (base/delta not merged).
-          revokedResult = { status: "revoked", reason: "serial listed in a CRL" };
-          break;
+          var rc = crlEntryReason(entry);
+          return rc === null ? 0 : rc;
+        }
+        return null;
+      }
+
+      // sec. 6.3.3(a)(2): a delta is obtained only when use-deltas is set AND a
+      // locator exists -- freshestCRL on the certificate or on the complete CRL.
+      // sec. 5.2.6 @3719: the locator's CONTENTS are only ever used to find a
+      // delta, never to validate one, so its presence is the whole gate.
+      // PRESENCE only, deliberately. sec. 5.2.6 @3719 says the freshestCRL contents are used to
+      // LOCATE a delta and never to validate one, so decoding them would be using a value the RFC
+      // says not to use. It is also not a security control: enabling the merge grants nothing on its
+      // own, because a delta still has to pass every gate -- issuer, authorization, criticality,
+      // scope, currency and SIGNATURE -- plus the sec. 5.2.4 merge preconditions. An attacker who
+      // could satisfy those already controls the issuing key.
+      var certHasFreshest = !!findExt(cert, OID_FRESHEST_CRL);
+      function deltaLocatorPresent(completeRec) {
+        return certHasFreshest || crlExtValue(completeRec.crl, OID_FRESHEST_CRL) !== null;
+      }
+
+      for (var ci = 0; ci < classified.completes.length; ci++) {
+        var rec = classified.completes[ci];
+        var gate = await gateCrl(rec);
+        if (!gate) continue;
+
+        // sec. 6.3.3(c): pair this complete CRL with a delta it may be combined
+        // with. The delta passes its OWN gates first -- sec. 6.3.3(h) requires
+        // its signature verified and (f) its issuer authorized, exactly as for a
+        // complete CRL -- so a stale, unverifiable or out-of-scope delta is never
+        // merged.
+        var chosenDelta = null;
+        if (useDeltas && deltaLocatorPresent(rec)) {
+          var candidates = [];
+          for (var di = 0; di < classified.deltas.length; di++) {
+            var cand = classified.deltas[di];
+            if (!deltaMergesWith(cand, rec)) continue;
+            if (!(await gateCrl(cand))) continue;
+            // Mergeable and usable: this delta's scope IS covered by a merge, even
+            // if sec. 5.2.4 @3580 selection prefers a sibling with a later
+            // thisUpdate. Only a delta that pairs with NO complete CRL leaves the
+            // picture incomplete -- a losing candidate must not block a good result,
+            // or publishing two current deltas (which the RFC permits) would be
+            // worse than publishing one.
+            cand.accounted = true;
+            candidates.push(cand);
+          }
+          chosenDelta = selectDelta(candidates);
+        }
+
+        var status;
+        if (chosenDelta) {
+          consumedDeltas.push(chosenDelta);
+          status = scanCrl(chosenDelta.crl);                   // (i) search the delta FIRST
+          if (status === null) status = scanCrl(rec.crl);      // (j) the complete CRL only if still UNREVOKED
+        } else {
+          status = scanCrl(rec.crl);
         }
-        // A partition-scoped CRL that did not list this serial does NOT prove the
-        // cert is unrevoked (another shard/reason may revoke it) -- only a
-        // full-scope CRL can establish "good".
-        if (!scopeRevocationOnly) sawAuthoritative = true;   // covered this cert, not listed
+        // (k): removeFromCRL means the certificate is no longer revoked. It is
+        // normalized wherever it appears -- sec. 5.3.1's "only in delta CRLs" binds
+        // the CA that emits it, not this consumer, and rejecting a complete CRL
+        // that carries one would make an unusual-but-harmless CRL unusable.
+        if (status === 8) status = null;
+
+        if (status !== null && certStatus === null) certStatus = status;
+        else if (status === null) reasonsMask |= gate.interim;  // (l): only a clean scope covers
       }
-      // A delta released this serial from hold: without merging its base we cannot
-      // return a definitive revoked (else a released cert stays rejected) -- the
+
+      // An unmerged delta still speaks, under the shipped fail-closed posture: a
+      // serial it lists is a genuine revocation (serials are unique per issuer),
+      // and a removeFromCRL it carries blocks a definitive revoked without being
+      // able to establish good. This is what keeps the merge MONOTONIC -- it may
+      // turn undetermined into good or revoked, but a delta that merges with
+      // nothing can never erase a revocation the checker would otherwise report.
+      for (var dj = 0; dj < classified.deltas.length; dj++) {
+        var dRec = classified.deltas[dj];
+        if (consumedDeltas.indexOf(dRec) !== -1) continue;
+        // A delta that was MERGEABLE with some complete CRL but lost the sec. 5.2.4 @3580 selection
+        // does not speak for its scope at all -- the selected delta does, and it was evaluated
+        // against the base. Letting a superseded delta contribute its revocation while ignoring its
+        // release would be incoherent: an older delta revoking a certificate that the newer one
+        // releases would resurrect the revocation the CA withdrew.
+        if (dRec.accounted) continue;
+        if (!(await gateCrl(dRec))) continue;
+        sawUnmergedDelta = true;
+        var dStatus = scanCrl(dRec.crl);
+        if (dStatus === null) continue;
+        if (dStatus === 8) { releasedByUnmergedDelta = true; continue; }
+        if (certStatus === null) certStatus = dStatus;
+      }
+
+      // A delta released this serial from hold but its base was not merged: a
+      // definitive revoked would leave a released certificate rejected, so the
       // status is undetermined. This outranks a base CRL's revocation.
-      if (sawDeltaRemoval) return { status: "unknown", reason: "a delta CRL released this serial from hold; without merging its base CRL the revocation status is undetermined" };
-      if (revokedResult) return revokedResult;
-      // A delta CRL for this issuer was seen but cannot be merged with its base,
-      // so the current revocation picture is incomplete -- never report "good".
-      if (sawDelta) return { status: "unknown", reason: "a delta CRL cannot be evaluated without combining it with its base CRL, so the revocation status is undetermined" };
-      if (sawAuthoritative) return { status: "good" };
+      if (releasedByUnmergedDelta) return { status: "unknown", reason: "a delta CRL released this serial from hold; without merging its base CRL the revocation status is undetermined" };
+      if (certStatus !== null) {
+        var reasonName = constants.NAMES.CRL_REASON[String(certStatus)] || "unspecified";
+        return { status: "revoked", reasonCode: certStatus, reason: "serial listed in a CRL (" + reasonName + ")" };
+      }
+      if (sawUnmergedDelta) return { status: "unknown", reason: "a delta CRL cannot be combined with any complete CRL held here, so the revocation picture is incomplete" };
+      if ((reasonsMask & ALL_REASONS) === ALL_REASONS) return { status: "good" };
       if (certScopeFault) {
         return { status: "unknown", reason: "no authoritative in-scope CRL covers this certificate; its basicConstraints extension is unreadable (" + certScopeFault + "), so scope-limited CRLs were skipped" };
       }
+      if (reasonsMask !== 0) {
+        return { status: "unknown", reason: "the CRLs available cover only some revocation reasons for this certificate; no combination covers all of them" };
+      }
       return { status: "unknown", reason: "no authoritative in-scope CRL covers this certificate" };
     },
   };

package/lib/schema-pkix.js

@@ -1141,6 +1141,12 @@ function certExtensionDecoders(ns) {
           var bs;
           try { bs = asn1.read.bitStringImplicit(f, 1); }
           catch (e) { throw ns.E(C, "DistributionPoint reasons [1] must be an IMPLICIT ReasonFlags BIT STRING", e); }
+          // ReasonFlags is a NamedBitList, so DER requires trailing zero bits be
+          // dropped (X.690 sec. 11.2.2) -- the same rule the keyUsage decoder
+          // enforces above. Without it two different encodings of one reason set
+          // both parse, and RFC 5280 sec. 6.3.3(d)(1) would intersect the CRL's
+          // onlySomeReasons against a value the encoding rules forbid.
+          schema.assertMinimalNamedBits(bs.unusedBits, bs.bytes, function (msg) { throw ns.E(C, "DistributionPoint reasons: " + msg); });
           out.reasons = { unusedBits: bs.unusedBits, bytes: bs.bytes };
         } else if (f.tagNumber === 2) {
           out.cRLIssuer = schema.walk(generalNames(ns, { implicitTag: 2, decodeValue: true, code: C, what: "DistributionPoint cRLIssuer" }), f, ns).result;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.4.14",
+  "version": "0.4.15",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:a5caa56c-cfae-4869-93f2-4e8984c7c32f",
+  "serialNumber": "urn:uuid:7595bce4-18d5-4ef0-a2a1-6be18d59782d",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-10T23:24:00.079Z",
+    "timestamp": "2026-08-11T01:35:46.496Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.4.14",
+      "bom-ref": "@blamejs/pki@0.4.15",
       "type": "application",
       "name": "pki",
-      "version": "0.4.14",
+      "version": "0.4.15",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.4.14",
+      "purl": "pkg:npm/%40blamejs/pki@0.4.15",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.4.14",
+      "ref": "@blamejs/pki@0.4.15",
       "dependsOn": []
     }
   ]