@blamejs/pki 0.5.25 → 0.5.27

package/lib/guard-identifier.js

@@ -738,6 +738,41 @@ function _notAnOptionsBag(v) {
 // error and says so. A Buffer is excluded because it is an object and is never an options bag --
 // passing one is an argument-order mistake, which is worth naming rather than treating as empty.
 //
+// A built-in exotic whose data lives in internal slots rather than own enumerable keys, recognized by
+// identity so a cross-realm instance is caught too. `util.types` covers each such kind; an array is not
+// among them and is checked separately by the caller.
+function _isBuiltinExotic(v) {
+  var t = util.types;
+  return t.isDate(v) || t.isMap(v) || t.isSet(v) || t.isWeakMap(v) || t.isWeakSet(v) || t.isRegExp(v) ||
+    t.isPromise(v) || t.isArrayBuffer(v) || t.isSharedArrayBuffer(v) || t.isArrayBufferView(v) ||
+    t.isBoxedPrimitive(v) || t.isNativeError(v) || t.isArgumentsObject(v) || t.isGeneratorObject(v);
+}
+
+// assertPlainRecord(v, E, code, label): v MUST be a plain data record -- a non-null object that is not an
+// array, a Buffer, a Proxy, or a built-in exotic (a Date, Map, Set, boxed primitive, ...). A caller's
+// `typeof v === "object"` gate admits an array or a Date, which then passes assertKnownKeys with no own
+// key to reject and reads as a keyless record -- every field `undefined` and silently defaulted. This
+// door refuses that shape, so a malformed container is a refusal rather than a request assembled from
+// defaults. Composes BEFORE assertKnownKeys, which only
+// judges the keys that are present, not whether the value is a record at all.
+//
+// The prototype is NOT consulted, so a record built by a caller's own class, or one from another realm
+// (a vm context, a worker) whose prototype is a different Object.prototype, is accepted -- it holds its
+// fields as own enumerable properties like any record. Only a built-in exotic that keeps its data in
+// internal slots (a Date, Map, Set, boxed primitive, ...), an array (index-keyed), a Buffer, or a Proxy
+// is refused, each recognized by identity through `util.types` / `Array.isArray` so a cross-realm
+// instance is caught where an `instanceof` or a prototype check would miss it.
+//
+// @enforced-by behavioral -- a plain-record refusal has no single rename-proof code shape worth a
+// tree-wide detector; the RED vectors (an array, a Date, and a Proxy at each routed entry point, and a
+// cross-realm/subclass record that must still be ACCEPTED) are the guard.
+function assertPlainRecord(v, E, code, label) {
+  _requireFactory(E);
+  if (v === null || typeof v !== "object" || _isNodeBuffer(v) || _isArray(v)) throw E(code, label + " must be a plain object");
+  _refuseUnenumerable(v, E, code, label);   // a Proxy's reported keys need not match what it answers
+  if (_isBuiltinExotic(v)) throw E(code, label + " must be a plain object (a built-in exotic such as a Date or Map is refused)");
+}
+
 // @enforced-by behavioral -- the defect is an ordering, which has no rename-proof code shape; the
 // RED vector (a verb handed `false` accepting it as `{}`) is the guard.
 function optionsObject(opts, E, code, label) {
@@ -856,6 +891,7 @@ function _settle(opts, E, code, label) {
 module.exports = intrinsic.freeze({
   assertCanonicalOid: assertCanonicalOid,
   assertKnownKeys: assertKnownKeys,
+  assertPlainRecord: assertPlainRecord,
   optionsObject: optionsObject,
   refuseAccessorFields: refuseAccessorFields,
   // Exported so a caller that forwards an options bag copies the same surface this module

package/lib/guard-name.js

@@ -53,6 +53,12 @@ var _String = String;
 // matches, and it is captured for the same reason as the rest: what a guard does is settled before
 // a caller runs, or it is settled by the caller.
 var _isArray = Array.isArray;
+// Byte identity and the shape test that gates it, both captured for the reason above: a
+// distribution-point comparison asks whether two encodings are the same bytes, and an object
+// supplying its own `equals` would be answering that question about itself.
+var _isBuffer = intrinsic.isBuffer;
+var _bufferEquals = intrinsic.bufferEquals;
+var _getOwnPropertyDescriptor = intrinsic.getOwnPropertyDescriptor;
 
 // assertNoControlBytes(str, E, code, label) -> str | throws E(code, ...)
 // DirectoryString policy (a DN attribute value): reject NUL and C0 control bytes
@@ -185,6 +191,89 @@ function dnEqual(rdnsA, rdnsB, E, code, label) {
   return true;
 }
 
+// dpnCorresponds(a, b, E, code, label) -> boolean. Do two DistributionPointNames name the
+// same CRL distribution point? RFC 5280 sec. 6.3.3(b)(2)(i) asks it of a certificate's
+// DistributionPoint against a shard CRL's issuingDistributionPoint, and RFC 9483 sec. 4.3.4
+// asks it of the dpn a CMP crlUpdate requested against the IDP of the CRL that came back.
+// The answer is "at least one name in common", compared by BYTE-IDENTICAL DER.
+//
+// The comparison key is pinned by sec. 5.2.5: "The identical encoding MUST be used in the
+// distributionPoint fields of the certificate and the CRL". This is therefore the one name
+// comparison in the toolkit that must NOT canonicalize. dnEqual's sec. 7.1 rule applied here
+// would equate two encodings the spec keeps distinct, and a CRL would be accepted as covering
+// a point it was never published for. Whole-set equality is the opposite error: a point
+// published under several names (a URI beside a directoryName) shares one of them with a
+// reference that lists only that one, and demanding all would reject its own CRL.
+//
+// Mixed forms never correspond, with fullName on one side and nameRelativeToCRLIssuer on the
+// other. Deciding that would mean resolving an RDN fragment against a CRL issuer DN this
+// comparison is not given, so the answer is no.
+//
+// @enforced-by behavioral -- the rule's identity is carried by the kind strings, which the
+// pattern walk strips before matching, so it has no rename-proof code shape. The RED vectors
+// in guard-name.test.js and the crlUpdate vectors in cmp-session.test.js are the guard.
+function dpnCorresponds(a, b, E, code, label) {
+  var x = _reduceDpn(a, E, code, label), y = _reduceDpn(b, E, code, label);
+  if (x.kind !== y.kind) return false;
+  if (x.kind === "rdn") return _bufferEquals(x.bytes, y.bytes);
+  for (var i = 0; i < x.names.length; i++) {
+    for (var j = 0; j < y.names.length; j++) {
+      if (_bufferEquals(x.names[i], y.names[j])) return true;
+    }
+  }
+  return false;
+}
+
+// The comparand, checked and REDUCED to the values that were checked. The reason _assertSequence
+// gives applies here in full: a comparison handed the wrong shape must refuse at the call site
+// instead of answering. Reading `names` off a value that has none would run a loop over
+// `i < undefined` zero times and report "no correspondence", which reads as a clean refusal of a
+// CRL and hides that nothing was compared; reading it off a sparse array would walk to
+// Array.prototype for the missing index and compare a name the reference never carried.
+//
+// Every field must be the comparand's OWN DATA property, and its value is taken FROM the property
+// descriptor. That is one reflective read per field, so the value the shape check validated is the
+// value the comparison is answered from: no second read is left for an accessor, or a Proxy trap,
+// to answer differently, and a field the decoder never produces (inherited, or reached through a
+// getter) is refused. Buffers, not caller byte-likes, for the same reason: the comparison is byte
+// identity, and an object answering `equals` or `length` for itself would be deciding the question
+// asked of it.
+function _reduceDpn(d, E, code, label) {
+  function refuse(why) { return E(code, "cannot compare " + label + ": " + why); }
+  function ownValue(o, k) {
+    // FromPropertyDescriptor hands back a fresh ordinary object, so `value` here is the value the
+    // object itself reported for that key, including through a Proxy's own-descriptor trap.
+    var desc = _getOwnPropertyDescriptor(o, k);
+    if (!desc || !_hasOwn(desc, "value")) throw refuse("a distribution-point comparison requires " + k + " to be the comparand's own value (RFC 5280 sec. 6.3.3 compares decoded names)");
+    return desc.value;
+  }
+  if (!d || typeof d !== "object") {
+    throw refuse("a distribution-point comparison requires the decoded DistributionPointName on both sides (kind fullName or rdn)");
+  }
+  var kind = ownValue(d, "kind");
+  if (kind !== "fullName" && kind !== "rdn") throw refuse("a DistributionPointName is fullName or nameRelativeToCRLIssuer, and this is neither");
+  if (kind === "rdn") {
+    var bytes = ownValue(d, "bytes");
+    if (!_isBuffer(bytes)) throw refuse("a nameRelativeToCRLIssuer distribution point must carry its encoded bytes");
+    return { kind: kind, bytes: bytes };
+  }
+  var names = ownValue(d, "names");
+  if (!_isArray(names)) throw refuse("a fullName distribution point must carry a sequence of encoded GeneralNames");
+  // The length is read once, into the bound the copy runs to. A hole and an inherited element are
+  // the same refusal as any other missing own value: indexing past a hole walks to Array.prototype,
+  // where a planted numeric property supplies a name the reference never carried.
+  var len = names.length;
+  // Indexed assignment, never a push: the accumulator must not be built by a method a caller can
+  // replace, since what it collects is what the comparison is answered from.
+  var taken = [];
+  for (var i = 0; i < len; i++) {
+    var n = ownValue(names, i);
+    if (!_isBuffer(n)) throw refuse("every fullName GeneralName must be its encoded bytes");
+    taken[i] = n;
+  }
+  return { kind: kind, names: taken };
+}
+
 // escapeControlBytes(str) -> str. The render-side sibling of assertNoControlBytes:
 // where a name string must still be DISPLAYED best-effort (a human-readable report,
 // a log line) instead of rejected, neutralize every C0 control byte and DEL by
@@ -316,7 +405,7 @@ function lowerAscii(s) {
 // call, so a writable export would let a caller replace the check rather than pass it.
 module.exports = intrinsic.freeze({
   assertNoControlBytes: assertNoControlBytes, assertPrintableIa5: assertPrintableIa5,
-  dnEqual: dnEqual, rdnEqual: rdnEqual, emailEqual: emailEqual,
+  dnEqual: dnEqual, rdnEqual: rdnEqual, emailEqual: emailEqual, dpnCorresponds: dpnCorresponds,
   escapeControlBytes: escapeControlBytes, escapeDnValue: escapeDnValue,
   lowerAscii: lowerAscii,
 });

package/lib/oid.js

@@ -234,8 +234,11 @@ var FAMILIES = {
   // id-pkip arc (id-pkix 5). id-regCtrl (id-pkip 1) names the control types a
   // CertRequest carries; id-regInfo (id-pkip 2) names the registration-info types.
   // The parser surfaces each control/info value raw, keyed by these names.
+  // altCertTemplate (7) and the two keySpec controls algId (11) / rsaKeyLen (12) are the RFC 9480
+  // sec. 2.16 additions; a CertReqTemplate response states its key requirements with the latter two.
   regCtrl: { base: [1, 3, 6, 1, 5, 5, 7, 5, 1], of: {
-    regToken: 1, authenticator: 2, pkiPublicationInfo: 3, pkiArchiveOptions: 4, oldCertID: 5, protocolEncrKey: 6 } },
+    regToken: 1, authenticator: 2, pkiPublicationInfo: 3, pkiArchiveOptions: 4, oldCertID: 5, protocolEncrKey: 6,
+    altCertTemplate: 7, algId: 11, rsaKeyLen: 12 } },
   regInfo: { base: [1, 3, 6, 1, 5, 5, 7, 5, 2], of: { utf8Pairs: 1, certReq: 2 } },
 
   // PKIX extended key purposes (id-kp, RFC 5280 sec. 4.2.1.12). timeStamping is required,
@@ -376,6 +379,9 @@ var FAMILIES = {
     // SignerInfo carries a MAC-based proof instead. Registered so a decoder can
     // name it and refuse it deliberately.
     "id-alg-noSignature": 2,
+    // RSASSA-PSS with SHAKE (RFC 8692): RSA signature algorithms on the PKIX arc.
+    // Registered so a consumer can name them -- e.g. the CMP keySpec RSA exclusion.
+    "id-RSASSA-PSS-SHAKE128": 30, "id-RSASSA-PSS-SHAKE256": 31,
     "id-alg-xmss-hashsig": 34, "id-alg-xmssmt-hashsig": 35,
     // Composite ML-DSA signature algorithms (draft-ietf-lamps-pq-composite-sigs
     // sec. 6): a PQ ML-DSA paired with a traditional RSA / ECDSA / EdDSA so the
@@ -432,7 +438,49 @@ var FAMILIES = {
 
   // OIW Secsig SHA-1 (1.3.14.3.2.26) -- the most common OCSP CertID hashAlgorithm;
   // nistHash covers only SHA-256 and above.
-  oiwSecsig: { base: [1, 3, 14, 3, 2], of: { sha1: 26 } },
+  // OIW Secsig arc (1.3.14.3.2). id-SHA1 (.26) plus every RSA identifier the OIW SIG assigned under the
+  // arc: md4WithRSA (.2), md5WithRSA (.3), md4WithRSAEncryption (.4), rsaSignature (.11, the ISO 9796 RSA
+  // scheme), mdc2WithRSASignature (.14), shaWithRSAEncryption (.15), rsaKeyTransport (.22), and the
+  // md2/md5/sha1-WithRSASignature set (.24/.25/.29) -- pre-PKCS#1 RSA algorithms still seen in old certs.
+  // This is the arc's complete RSA membership per the OIW SIG assignments. Registered so a consumer can
+  // name them -- e.g. the CMP keySpec RSA exclusion, which recognizes RSA wherever it is standardized.
+  // The arc is shared with DES, DSA, DH, and the hashes, so no prefix isolates RSA; each is named.
+  oiwSecsig: { base: [1, 3, 14, 3, 2], of: {
+    sha1: 26,
+    "md4WithRSA": 2, "md5WithRSA": 3, "md4WithRSAEncryption": 4, "rsaSignature": 11,
+    "mdc2WithRSASignature": 14, "shaWithRSAEncryption": 15, "rsaKeyTransport": 22,
+    "md2WithRSASignature": 24, "md5WithRSASignature": 25, "sha1WithRSASignature": 29 } },
+
+  // TeleTrusT (BSI) RSA signature arc (1.3.36.3.3.1) -- RSA signatures with SHA-1 and the RIPEMD family.
+  // The arc is RSA-dedicated, so a consumer can classify the whole family by its prefix; one member is
+  // registered here so that prefix can be derived from the registry rather than a dotted-decimal literal.
+  teletrustRsaSig: { base: [1, 3, 36, 3, 3, 1], of: { "rsaSignatureWithripemd160": 2 } },
+
+  // X.509 directory encryptionAlgorithm arc (2.5.8.1). id-ea-rsa (.1) is the X.509 `rsa` public-key
+  // identifier, distinct from PKCS#1 rsaEncryption. Registered so a consumer can name it -- e.g. the
+  // CMP keySpec RSA exclusion, which must recognize RSA wherever it is standardized.
+  x509EncAlg: { base: [2, 5, 8, 1], of: { "rsa": 1 } },
+
+  // X.500 directory signatureAlgorithm arc (2.5.8.3). Its RSA members are sqMod-nWithRSA (.1, the
+  // ITU-T X.509 / ISO 9594-8 square-mod-n-with-RSA signature) and mdc2WithRSA (.100, MDC-2-with-RSA).
+  // Registered so the CMP keySpec RSA exclusion can name them; the arc is not RSA-dedicated, so each
+  // member is named individually rather than prefix-matched.
+  x509SigAlg: { base: [2, 5, 8, 3], of: { "sqMod-nWithRSA": 1, "mdc2WithRSA": 100 } },
+
+  // Chinese GM/T (SCA) SM algorithm arc (1.2.156.10197.1). Its one RSA member is sm3WithRSAEncryption
+  // (.504, a PKCS#1 v1.5 RSA signature over an SM3 digest); sm2 (.301), sm3 (.401), and SM2-with-SM3
+  // (.501) on the arc are not RSA. Registered so the CMP keySpec RSA exclusion can name it -- the arc is
+  // mixed, so the RSA member is named individually rather than prefix-matched.
+  smAlg: { base: [1, 2, 156, 10197, 1], of: { "sm3WithRSAEncryption": 504 } },
+
+  // BSI TR-03110 EAC Terminal Authentication RSA arc (0.4.0.127.0.7.2.2.2.1, id-TA-RSA). Every child is an
+  // RSA signature scheme -- PKCS#1 v1.5 or PSS over SHA-1/256/512 -- and the sibling id-TA-ECDSA arc
+  // (0.4.0.127.0.7.2.2.2.2) is EC, so this arc is RSA-dedicated. The members are registered so a consumer
+  // can derive the arc prefix from the registry rather than a dotted-decimal literal and classify the
+  // whole family, including a variant BSI adds later, by that prefix.
+  bsiTaRsa: { base: [0, 4, 0, 127, 0, 7, 2, 2, 2, 1], of: {
+    "id-TA-RSA-v1-5-SHA-1": 1, "id-TA-RSA-v1-5-SHA-256": 2, "id-TA-RSA-PSS-SHA-1": 3,
+    "id-TA-RSA-PSS-SHA-256": 4, "id-TA-RSA-v1-5-SHA-512": 5, "id-TA-RSA-PSS-SHA-512": 6 } },
 
   // NIST AES content-encryption algorithms (arc 2.16.840.1.101.3.4.1) -- the
   // modern PBES2 / CMS content ciphers a PKCS#12 or EnvelopedData names.
@@ -451,6 +499,11 @@ var FAMILIES = {
   // sets .35-.46, each pairing a parameter set with its message-digest hash. The
   // parameters MUST be absent for every one of them (enforced via paramsMustBeAbsent).
   nistSig: { base: [2, 16, 840, 1, 101, 3, 4, 3], of: {
+    // RSASSA-PKCS1-v1_5 with SHA-3 (NIST CSOR): RSA signature algorithms on the NIST
+    // signature arc, alongside the ML-DSA / SLH-DSA sets. Registered so a consumer can
+    // name them -- e.g. the CMP keySpec check that must recognize RSA to exclude it.
+    "id-rsassa-pkcs1-v1_5-with-sha3-224": 13, "id-rsassa-pkcs1-v1_5-with-sha3-256": 14,
+    "id-rsassa-pkcs1-v1_5-with-sha3-384": 15, "id-rsassa-pkcs1-v1_5-with-sha3-512": 16,
     "id-ml-dsa-44": 17, "id-ml-dsa-65": 18, "id-ml-dsa-87": 19,
     "id-slh-dsa-sha2-128s": 20, "id-slh-dsa-sha2-128f": 21,
     "id-slh-dsa-sha2-192s": 22, "id-slh-dsa-sha2-192f": 23,

package/lib/path-validate.js

@@ -1695,38 +1695,23 @@ function decodeIdp(ext) {
 }
 
 // RFC 5280 sec. 6.3.3(b)(2)(i): find the certificate DistributionPoint that
-// CORRESPONDS to a shard CRL's IDP distribution point name -- at least one
-// name in common between the two DistributionPointNames, compared by
-// BYTE-IDENTICAL DER encoding (Buffer.equals on the raw GeneralName / RDN
-// TLVs). sec. 5.2.5 pins the comparison key: "The identical encoding MUST be
-// used in the distributionPoint fields of the certificate and the CRL" -- so
-// a canonicalized or semantic comparison (which would equate two
-// differently-encoded names) is forbidden, and whole-set equality (which
-// would falsely reject a legitimate multi-URI DP sharing one name) is
-// over-strict. Mixed forms -- fullName on one side, nameRelativeToCRLIssuer
-// on the other -- never correspond here: resolving an RDN fragment against
-// the issuer DN is not attempted (fail closed). Per sec. 6.3.3(b)(1), a DP
-// naming a cRLIssuer participates only when that cRLIssuer is the certificate
-// issuer itself: the checker only consults CRLs issued BY the certificate
-// issuer and rejects indirect CRLs, so a DP delegated to another CRL issuer
-// is out of play. Returns the matched DP (its `reasons` feeds the coarse
-// reason-mask rule) or null.
+// CORRESPONDS to a shard CRL's IDP distribution point name. The correspondence
+// rule itself -- at least one name in common, compared by BYTE-IDENTICAL DER,
+// mixed name forms never corresponding -- is guard.name.dpnCorresponds, which
+// is also what a CMP crlUpdate answer is held to, so one definition decides
+// whether a CRL speaks for a point wherever the question is asked. Per sec.
+// 6.3.3(b)(1), a DP naming a cRLIssuer participates only when that cRLIssuer
+// is the certificate issuer itself: the checker only consults CRLs issued BY
+// the certificate issuer and rejects indirect CRLs, so a DP delegated to
+// another CRL issuer is out of play. Returns the matched DP (its `reasons`
+// feeds the coarse reason-mask rule) or null.
 function correspondingCertDp(idpDpn, certDPs, issuerRdns) {
   if (!idpDpn || !certDPs) return null;
   for (var i = 0; i < certDPs.length; i++) {
     var dp = certDPs[i];
     if (!dp.distributionPoint) continue;
     if (dp.cRLIssuer && !crlIssuerNamesIssuer(dp.cRLIssuer, issuerRdns)) continue;
-    var cdpn = dp.distributionPoint;
-    if (idpDpn.kind === "fullName" && cdpn.kind === "fullName") {
-      for (var a = 0; a < idpDpn.names.length; a++) {
-        for (var c = 0; c < cdpn.names.length; c++) {
-          if (idpDpn.names[a].equals(cdpn.names[c])) return dp;
-        }
-      }
-    } else if (idpDpn.kind === "rdn" && cdpn.kind === "rdn") {
-      if (idpDpn.bytes.equals(cdpn.bytes)) return dp;
-    }
+    if (guard.name.dpnCorresponds(idpDpn, dp.distributionPoint, E, "path/bad-idp", "a CRL distribution point")) return dp;
   }
   return null;
 }
@@ -2332,7 +2317,10 @@ var ocspCore = ocspVerify.makeOcspVerify({
 // of it on the public pki.path surface (index.js exports the whole path-validate module).
 cmpVerify.setEngine({ verifyWithSpki: _verifyWithSpki, build: build, validate: validate });
 // pki.cmp.session validates the ISSUED leaf certificate (its signature + chain) through the same engine.
-cmpSession.setEngine({ build: build, validate: validate, toAnchor: toAnchor, coerceCert: coerceCert });
+// `verifyWithSpki` so a root CA key update's rollover signatures are checked by the same signature
+// engine (with its EdDSA low-order-point and algorithm-confusion gates) that verifies a message's
+// protection, rather than a second, weaker check inside the session.
+cmpSession.setEngine({ build: build, validate: validate, toAnchor: toAnchor, coerceCert: coerceCert, verifyWithSpki: _verifyWithSpki });
 // pki.cms.verify chains a SignedData's signer certificate to the anchors the CALLER named, so its
 // `trusted` is decided by this one path engine rather than a second, weaker walk of its own.
 // `toAnchor` so cms.verify can validate the caller's anchors ONCE at entry, before any signer is

package/lib/schema-cmp.js

@@ -836,6 +836,99 @@ var PKI_MESSAGE = schema.seq([
   },
 });
 
+// ---- support-message infoValue structures (RFC 9480 sec. 2.14-2.17) -----
+//
+// A genm / genp carries its payload as an ANY, so the InfoTypeAndValue leaf above
+// surfaces it as raw bytes. These are the strict decoders for the four values RFC 9483
+// sec. 4.3 defines, each a standalone parser so a malformed payload is refused with the
+// same caps, minimal-encoding and trailing-byte rules the message itself is held to.
+// The CMP module is EXPLICIT TAGS, so every context tag here wraps its value.
+
+// CACertsValue ::= SEQUENCE SIZE (1..MAX) OF CMPCertificate. An absent infoValue is how
+// "no CA certificate is available" is said (sec. 4.3.1), so an EMPTY sequence is malformed
+// rather than a second spelling of the same answer.
+var CA_CERTS_VALUE = schema.seqOf(rawSequence("cmp/bad-info-value"), {
+  min: 1, code: "cmp/bad-info-value", what: "CACertsValue",
+  build: function (m) { return m.items.map(function (it) { return it.value; }); },
+});
+
+// RootCaKeyUpdateContent ::= SEQUENCE { newWithNew CMPCertificate,
+//   newWithOld [0] CMPCertificate OPTIONAL, oldWithNew [1] CMPCertificate OPTIONAL }
+// (RFC 9480 sec. 2.15). Both optionals are OPTIONAL in the syntax; RFC 9483 sec. 4.3.2
+// requires newWithOld of a response, which the caller of this decoder enforces.
+var ROOT_CA_KEY_UPDATE = schema.seq([
+  schema.field("newWithNew", rawSequence("cmp/bad-info-value")),
+  schema.trailing([
+    { tag: 0, name: "newWithOld", schema: rawSequence("cmp/bad-info-value"), explicit: true, emptyCode: "cmp/bad-info-value" },
+    { tag: 1, name: "oldWithNew", schema: rawSequence("cmp/bad-info-value"), explicit: true, emptyCode: "cmp/bad-info-value" },
+  ], { minTag: 0, maxTag: 1, unexpectedCode: "cmp/bad-info-value", orderCode: "cmp/bad-info-value" }),
+], {
+  assert: "sequence", code: "cmp/bad-info-value", what: "RootCaKeyUpdateContent",
+  build: function (m) {
+    return {
+      newWithNew: m.fields.newWithNew.value,
+      newWithOld: m.fields.newWithOld.present ? m.fields.newWithOld.value : null,
+      oldWithNew: m.fields.oldWithNew.present ? m.fields.oldWithNew.value : null,
+    };
+  },
+});
+
+// AttributeTypeAndValue ::= SEQUENCE { type OBJECT IDENTIFIER, value ANY }, the element of
+// the Controls that carries a CertReqTemplate keySpec (RFC 9480 sec. 2.16). The value stays
+// raw here: which syntax it must have depends on the type, which sec. 4.3.3 constrains.
+var ATTR_TYPE_AND_VALUE = schema.seq([
+  schema.field("type", schema.oidLeaf()),
+  schema.field("value", schema.any()),
+], {
+  assert: "sequence", code: "cmp/bad-info-value", what: "AttributeTypeAndValue",
+  build: function (m, ctx) {
+    var t = m.fields.type.value;
+    return { type: t, name: ctx.oid.name(t) || null, value: m.fields.value.value.bytes };
+  },
+});
+
+// CertReqTemplateContent ::= SEQUENCE { certTemplate CertTemplate, keySpec Controls OPTIONAL }
+// (RFC 9480 sec. 2.16). keySpec is untagged, so it is recognized by its universal SEQUENCE tag
+// following the CertTemplate, which is itself IMPLICIT [tagged] by the CRMF module.
+var CERT_REQ_TEMPLATE_VALUE = schema.seq([
+  schema.field("certTemplate", CERT_TEMPLATE_LEAF),
+  schema.optional("keySpec", schema.seqOf(ATTR_TYPE_AND_VALUE, {
+    min: 1, code: "cmp/bad-info-value", what: "CertReqTemplate keySpec",
+    build: function (m) { return m.items.map(function (it) { return it.value.result; }); },
+  }), { whenUniversal: [TAGS.SEQUENCE] }),
+], {
+  assert: "sequence", code: "cmp/bad-info-value", what: "CertReqTemplateValue",
+  build: function (m) {
+    return {
+      certTemplate: m.fields.certTemplate.value,
+      keySpec: m.fields.keySpec.present ? m.fields.keySpec.value.result : null,
+    };
+  },
+});
+
+// CRLsValue ::= SEQUENCE SIZE (1..MAX) OF CertificateList (RFC 9480 sec. 2.17).
+var CRLS_VALUE = schema.seqOf(rawSequence("cmp/bad-info-value"), {
+  min: 1, code: "cmp/bad-info-value", what: "CRLsValue",
+  build: function (m) { return m.items.map(function (it) { return it.value; }); },
+});
+
+function _valueParser(what, topSchema) {
+  return pkix.makeParser({ pemLabel: "CMP", PemError: PemError, ErrorClass: CmpError, prefix: "cmp", what: what, topSchema: topSchema, ns: NS });
+}
+// @internal -- pki.cmp.session reads a support-message response through these.
+var readCaCerts = _valueParser("CACertsValue", CA_CERTS_VALUE);
+var readRootCaKeyUpdate = _valueParser("RootCaKeyUpdateContent", ROOT_CA_KEY_UPDATE);
+var readCertReqTemplate = _valueParser("CertReqTemplateValue", CERT_REQ_TEMPLATE_VALUE);
+var readCrls = _valueParser("CRLsValue", CRLS_VALUE);
+// A CertReqTemplate keySpec states a key requirement as an AlgorithmIdentifier (RFC 9480 sec. 2.16),
+// which is the shared sub-schema every format already reads one with: `SEQUENCE { algorithm OID,
+// parameters ANY OPTIONAL }` and nothing after it. Reading it through the same definition is what
+// keeps a third field from passing as a well-formed one.
+var readAlgorithmIdentifier = _valueParser("AlgorithmIdentifier", ALG_ID);
+// A bare Name, so a caller-encoded issuer can be read back into the RDN sequence that guard-name's
+// canonical comparison takes. pki.cmp.session binds a returned CRL to the issuer it asked for.
+var readName = _valueParser("Name", pkix.name(NS));
+
 /**
  * @primitive  pki.schema.cmp.parse
  * @signature  pki.schema.cmp.parse(input) -> pkiMessage
@@ -970,4 +1063,11 @@ module.exports = {
   pemDecode: pemDecode,
   pemEncode: pemEncode,
   matches: matches,
+  // @internal -- the RFC 9483 sec. 4.3 support-message values, read strictly from a genp.
+  readCaCerts: readCaCerts,
+  readRootCaKeyUpdate: readRootCaKeyUpdate,
+  readCertReqTemplate: readCertReqTemplate,
+  readCrls: readCrls,
+  readAlgorithmIdentifier: readAlgorithmIdentifier,
+  readName: readName,
 };

package/lib/trust.js

@@ -629,6 +629,9 @@ function _csvDate(cell, label) {
   if (!m) throw E("trust/bad-csv", label + " must be a Y-M-D date, got " + JSON.stringify(s));
   var pad = function (x) { return x.length === 1 ? "0" + x : x; };
   var payload = Buffer.from(m[1] + pad(m[2]) + pad(m[3]) + "235959Z", "latin1");
+  // _strictTime tags every rejection (a rolled-over month/day among them) with the code passed here,
+  // so the re-throw carries it unchanged; the wrap normalizes any other failure to the same typed code
+  // so a bad row is always trust/bad-csv, never an untyped exception escaping parseCcadbCsv.
   try { return _strictTime(payload, "trust/bad-csv", label); }
   catch (e) {
     if (e && e.code === "trust/bad-csv") throw e;
@@ -774,11 +777,16 @@ function parseCcadbCsv(text) {
  *   await pki.path.validate([pki.schema.x509.parse(der)],
  *     { time: new Date("2026-06-01T00:00:00Z"), trustAnchor: anchor, checkPurpose: "serverAuth" });
  */
+// `purpose` is the only option, and it gates the authorization itself, so a near-miss spelling must not
+// pass silently: a caller who wrote the plural `purposes` (or carried a sibling's word) would otherwise get
+// the anchor with NO purpose restriction rather than an error naming the option they meant.
+var _ANCHOR_OPTS = { purpose: 1 };
 function anchor(entry, opts) {
   if (!entry || typeof entry !== "object") {
     throw E("trust/bad-input", "anchor expects a trust-store entry ({ name, publicKey, algorithm, ... })");
   }
-  opts = opts || {};
+  opts = guard.identifier.optionsObject(opts, E, "trust/bad-input", "pki.trust.anchor options");
+  guard.identifier.assertKnownKeys(opts, _ANCHOR_OPTS, E, "trust/bad-input", "unknown pki.trust.anchor option ");
   // Where this entry came from a store, everything the anchor asserts is read from the record the
   // store minted, not from the entry -- the entry is a plain object the caller holds and can write
   // to. `purposes` is the authorization itself, so an entry whose serverAuth bit was flipped after

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.5.25",
+  "version": "0.5.27",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:119ff1fc-7d17-4f0b-8f84-06c75f1e6ac1",
+  "serialNumber": "urn:uuid:3e85b1a0-56f6-459d-a525-da732c14e1d6",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-21T13:36:35.267Z",
+    "timestamp": "2026-08-23T02:01:07.534Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.5.25",
+      "bom-ref": "@blamejs/pki@0.5.27",
       "type": "application",
       "name": "pki",
-      "version": "0.5.25",
+      "version": "0.5.27",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.5.25",
+      "purl": "pkg:npm/%40blamejs/pki@0.5.27",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.5.25",
+      "ref": "@blamejs/pki@0.5.27",
       "dependsOn": []
     }
   ]