@blamejs/pki 0.5.29 → 0.5.31

package/CHANGELOG.md

@@ -4,6 +4,27 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.5.31 — 2026-08-25
+
+The signing verbs accept a WebCrypto CryptoKey as the signing key, and a subjectAltName entry may be a bare string classified into its GeneralName form.
+
+### Added
+
+- Every signing verb -- `pki.x509.sign`, `pki.csr.sign`, `pki.crl.sign`, `pki.cms.sign`, `pki.ocsp.sign`, `pki.attrcert.sign`, `pki.tsp.sign`, and `pki.crmf.build` -- accepts a WebCrypto `CryptoKey` as its signing key, so a key from `pki.key.generate` (or `pki.webcrypto.subtle`) signs directly without first being exported to PKCS#8. A PKCS#8 private key as DER (a `Buffer` or `Uint8Array`) or PEM (a string) continues to work exactly as before, with the signature algorithm resolved from the key's own SubjectPublicKeyInfo. A `CryptoKey`'s own algorithm must be compatible with that resolved scheme, because WebCrypto binds a key to one algorithm: an RSASSA-PSS `CryptoKey` signs RSASSA-PSS, so pass `opts.pss` for it, whereas a raw PKCS#8 RSA key defaults to RSASSA-PKCS1-v1_5.
+- A `subjectAltName` (and any other `GeneralName`) entry may be a bare string, classified fail-closed into its form: a hostname such as `"host.example.com"` (including a `*.` wildcard or an underscore label) becomes a `dNSName`, `"user@example.com"` an `rfc822Name`, an IPv4 or IPv6 literal such as `"192.0.2.1"` an `iPAddress`, and a `"https://host.example/path"` URL a `uniformResourceIdentifier`. Shorthand and object entries interoperate in the same array. A string that does not unambiguously match one form -- a host:port, an opaque `urn:`/`mailto:` URI, or an empty string -- is refused with a typed `bad-input` error rather than guessed; the explicit object form (`{ dNSName: "..." }`) still accepts any value, and a pre-encoded Extension DER passed through the escape-hatch array form is unaffected.
+
+### Changed
+
+- A signing key that is a public or secret `CryptoKey`, or a `node:crypto` KeyObject rather than a WebCrypto `CryptoKey`, is now refused with a message that names the specific problem -- the wrong key type, or a KeyObject that should be passed as a `CryptoKey` or exported to PKCS#8 -- instead of the generic "must be a CryptoKey or PKCS#8" message. The `"a signing key is required"` errors on `pki.x509.sign`, `pki.crl.sign`, and `pki.attrcert.sign` now name the `CryptoKey` option alongside PKCS#8.
+
+## v0.5.30 — 2026-08-24
+
+A CMP certReqTemplate keySpec that names an ISO/IEC 9796-2 RSA signature scheme is now refused, instead of being surfaced to the caller as a non-RSA algorithm requirement.
+
+### Security
+
+- `pki.cmp.session` refuses a certReqTemplate keySpec whose `id-regCtrl-algId` names an ISO/IEC 9796-2 RSA signature-with-message-recovery scheme, with `cmp/bad-info-value`, rather than surfacing it to the caller as a non-RSA algorithm requirement. RFC 9483 sec. 4.3.3 reserves an RSA key requirement for `id-regCtrl-rsaKeyLen`; the 9796-2 schemes are RSA, so a keySpec naming one is now rejected the same way an rsaEncryption or RSASSA-PSS algId already was. The classifier recognizes the deterministic (1.3.36.3.4.2) and randomized (1.3.36.3.4.3) sub-arcs by prefix -- so a hash variant registered later is caught without being listed -- and ISO/IEC 9796-1 (1.3.36.3.4.1) on the same registrant arc. The generic signatureScheme parent (1.3.36.3.4) and the sibling authentication arc (1.3.36.3.5, whose children include ECC) are not treated as RSA, so a non-RSA algorithm under either is still surfaced. Recognizing these OIDs classifies a keySpec requirement; it is not a claim that the toolkit produces or verifies a 9796-2 signature.
+
 ## v0.5.29 — 2026-08-24
 
 pki.path.validate refuses a mis-shaped trust anchor instead of returning a verdict against it, and accepts a parsed certificate directly.

package/lib/asn1-der.js

@@ -1041,6 +1041,10 @@ var build = {
   },
   raw:      function (buf) { return _asBuffer(buf, "build.raw"); },
 };
+// Frozen at load so a builder method cannot be replaced afterward: every format module captures `build`
+// and calls its methods to produce emitted DER, so a mutable `build.contextPrimitive` (or any builder)
+// would let co-resident code steer the bytes a certificate carries. Freezing closes that once, toolkit-wide.
+intrinsic.freeze(build);
 
 // A raw INTEGER/ENUMERATED content Buffer must satisfy the same DER shape
 // read.integer enforces: non-empty and minimally encoded (no redundant sign

package/lib/attrcert-sign.js

@@ -497,7 +497,7 @@ function _sign(spec, issuer, opts) {
   if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("attrcert/bad-input", "the attribute-certificate spec must be an object");
   guard.identifier.assertKnownKeys(spec, KNOWN_SPEC_KEYS, _err, "attrcert/bad-input", "unknown spec field ");
   issuer = issuer || {};
-  if (issuer.key == null) throw _err("attrcert/bad-input", "a signing key (issuer.key, the AA's PKCS#8 private key) is required");
+  if (issuer.key == null) throw _err("attrcert/bad-input", "a signing key (issuer.key, the AA's WebCrypto CryptoKey or PKCS#8 private key DER/PEM) is required");
 
   // Resolve the AA issuer DN + signing-key SPKI. An attribute certificate is NEVER self-signed. No CA
   // gate on issuer.cert -- an AA is NOT a certificate authority (its PKC MUST NOT assert keyCertSign,

package/lib/cmp-session.js

@@ -135,10 +135,15 @@ var KNOWN_REVOKE_KEYS = { certificate: 1, certDetails: 1, reason: 1 };
 // "RSA" is decided by OID FAMILY, not a hand-list. An RSA-DEDICATED arc -- one whose members are RSA --
 // is matched by its prefix, so a standardized member this registry has not named is caught with the ones
 // it has: PKCS#1 (rsaEncryption, PSS, OAEP, every sha*/md*WithRSAEncryption), the TeleTrusT rsaSignature
-// arc (RSA with SHA-1 and the RIPEMD family), and the BSI TR-03110 id-TA-RSA arc (EAC Terminal
-// Authentication, RSA v1.5/PSS over SHA-1/256/512). Each prefix is the arc a registered member sits
-// directly under, read from the registry, so no dotted-decimal literal appears here and pki.oid.register
-// cannot move it. The PKCS#1 arc also carries two auxiliary identifiers that are NOT RSA algorithms --
+// arc (RSA with SHA-1 and the RIPEMD family), the TeleTrusT signatureScheme arc (the ISO/IEC 9796-2 RSA
+// signature-with-message-recovery schemes -- deterministic 1.3.36.3.4.2 and randomized .4.3 -- plus ISO/IEC
+// 9796-1 on .4.1), and the BSI TR-03110 id-TA-RSA arc (EAC Terminal Authentication, RSA v1.5/PSS over
+// SHA-1/256/512). Each prefix is the arc a registered member sits directly under, read from the registry,
+// so no dotted-decimal literal appears here and pki.oid.register cannot move it. The strict-descendant
+// match skips an arc NODE itself, so a scheme's bare arc node (the 9796 1.3.36.3.4.1/.2/.3 nodes) is named
+// off-arc below; the generic signatureScheme PARENT (1.3.36.3.4) and the sibling authentication arc
+// (1.3.36.3.5, whose .5.3 children are ECC) are NOT RSA-dedicated, so neither is prefix-matched. The PKCS#1
+// arc also carries two auxiliary identifiers that are NOT RSA algorithms --
 // mgf1 and pSpecified, the mask-generation and OAEP-label parameters -- so those are excluded from the
 // match by name (RSA_ARC_EXCLUDE) and surfaced. RSA also sits off those arcs on ones it SHARES with non-RSA
 // algorithms, where no prefix can isolate it, so those are listed by name: id-rsa-kem (S/MIME) and
@@ -151,7 +156,8 @@ var KNOWN_REVOKE_KEYS = { certificate: 1, certDetails: 1, reason: 1 };
 // Chinese GM/T sm3WithRSAEncryption (1.2.156.10197.1.504), an RSA-over-SM3 signature on the SM arc it
 // shares with SM2 and SM3. A composite signature naming RSA as one half is a composite key, not an RSA
 // one, and lives on the PKIX arc, so it is outside all of these.
-var RSA_ARCS = ["rsaEncryption", "rsaSignatureWithripemd160", "id-TA-RSA-v1-5-SHA-256"].map(function (n) {
+var RSA_ARCS = ["rsaEncryption", "rsaSignatureWithripemd160", "id-TA-RSA-v1-5-SHA-256",
+  "sigS-ISO9796-1-DFUE", "sigS-ISO9796-2Withrsa", "sigS-ISO9796-2rndWithrsa"].map(function (n) {
   return oid.toArcs(oid.byName(n)).slice(0, -1);   // the RSA-dedicated arc a registered member sits directly under
 });
 var RSA_OFF_ARC = Object.create(null);
@@ -165,6 +171,9 @@ var RSA_OFF_ARC = Object.create(null);
   "rsa",   // the X.509 directory rsa public-key OID (2.5.8.1.1), distinct from PKCS#1 rsaEncryption
   "sqMod-nWithRSA", "mdc2WithRSA",   // the X.500 directory signatureAlgorithm RSA OIDs (2.5.8.3.1, 2.5.8.3.100)
   "sm3WithRSAEncryption",   // the Chinese GM/T RSA-with-SM3 signature (1.2.156.10197.1.504)
+  // The TeleTrusT signatureScheme (ISO/IEC 9796-2) sub-arcs are prefix-matched in RSA_ARCS, but the strict-
+  // descendant match skips each arc NODE itself, so the three bare nodes are named here (1.3.36.3.4.1/.2/.3).
+  "sigS-ISO9796-1", "sigS-ISO9796-2", "sigS-ISO9796-2rnd",
 ].forEach(function (n) { var d = oid.byName(n); if (d) RSA_OFF_ARC[d] = 1; });
 // The PKCS#1 arc carries two identifiers that are NOT RSA algorithms: mgf1 (the mask-generation function
 // RSA-PSS and RSA-OAEP parametrize) and pSpecified (the OAEP label source). The prefix match would sweep

package/lib/crl-sign.js

@@ -463,7 +463,7 @@ function _sign(spec, issuer, opts) {
         : "explicit form; the issuer takes { key, name, publicKey }, or { key, cert } to take both from a certificate");
     });
   guard.identifier.assertKnownKeys(opts, KNOWN_SIGN_OPTS, _err, "crl/bad-input", "pki.crl.sign has an unknown option ");
-  if (issuer.key == null) throw _err("crl/bad-input", "a signing key (issuer.key, a PKCS#8 private key) is required");
+  if (issuer.key == null) throw _err("crl/bad-input", "a signing key (issuer.key, a WebCrypto CryptoKey or a PKCS#8 private key DER/PEM) is required");
 
   // Resolve the issuer name + signing-key SPKI. `{ cert }` supplies both; else `{ name|spec.issuer, publicKey }`.
   var issuerDer, issuerSpki, issuerCert = null;

package/lib/ip-utils.js

@@ -3,8 +3,8 @@
 "use strict";
 //
 // @internal -- no operator-facing namespace. Textual IP-literal validation, shared so a
-// consumer (pki.lint's commonName-in-SAN check today; a future SAN iPAddress / name-
-// constraint surface) does not hand-roll a partial regex that misses a valid IPv6 form.
+// consumer (pki.lint's commonName-in-SAN check today; the SAN iPAddress GeneralName shorthand
+// and name-constraint surfaces) does not hand-roll a partial regex that misses a valid IPv6 form.
 //
 // The IPv4 grammar is strict per-octet 0-255 (RFC 791); the IPv6 parser follows RFC 4291
 // sec. 2.2 (8 groups of 1-4 hex, one "::" run compressing a contiguous zero run) plus the
@@ -12,43 +12,116 @@
 // This mirrors the vetted validation in the sibling blamejs framework (lib/ip-utils.js);
 // this toolkit keeps its own copy, since Hard rule #1 rules out a runtime dependency.
 
-// Strict RFC 791 dotted-quad: four 0-255 octets. Anchored + per-octet repeat-capped (no
-// ReDoS on unbounded input).
-var IPV4_RE = /^(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)(?:\.(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)){3}$/;
-function isIPv4(s) { return typeof s === "string" && IPV4_RE.test(s); }
+// This parser uses no regular expression. packIpLiteral gates a GeneralName form decision (iPAddress
+// vs dNSName), and a regex is matched through a live, replaceable protocol -- RegExp.prototype.exec /
+// test and String.prototype.match / split consult the regex's own `exec` and the `[Symbol.match]` /
+// `[Symbol.split]` hooks, and RegExp.prototype.compile can mutate a pattern in place -- so co-resident
+// code could steer the decision after load. Instead every byte is read directly through captured string
+// primitives, and separation on a literal is done by scanning with captured indexOf/slice, so nothing the
+// decision rests on is re-dispatchable.
+var intrinsic = require("./guard-intrinsic");
+var _slice = intrinsic.uncurry(String.prototype.slice);
+var _padStart = intrinsic.uncurry(String.prototype.padStart);
+var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
+var _lastIndexOf = intrinsic.uncurry(String.prototype.lastIndexOf);
+var _toLowerCase = intrinsic.toLowerCase;
+var _indexOf = intrinsic.stringIndexOf;
+var _numToString = intrinsic.numberToString;
+var _bufferFrom = intrinsic.bufferFrom;
+var _bufferAlloc = intrinsic.bufferAlloc;
+var _defineProperty = intrinsic.defineProperty;
+var _Number = intrinsic.Number;
+// Every array here is built and read as own elements only. Appending through a captured Object.defineProperty
+// (not `arr[i] = v`) creates an own element, so a co-resident Array.prototype numeric setter is never invoked
+// and the own element shadows any inherited getter on read; and no Array.prototype.map / concat runs, so
+// Array[Symbol.species] is never consulted. Both are routes a hostile prototype could otherwise use to
+// rewrite a packed octet and make a certificate carry an attacker-chosen address. The emitted octets are
+// written straight into a Buffer, whose integer-indexed store bypasses the prototype entirely.
+function _push(arr, v) { _defineProperty(arr, arr.length, { value: v, writable: true, enumerable: true, configurable: true }); }
+// Split on a literal string separator without String.prototype.split, which consults the separator's
+// `[Symbol.split]`; this scans with captured indexOf/slice only.
+function _splitOn(str, sep) {
+  var out = [], from = 0, at;
+  while ((at = _indexOf(str, sep, from)) !== -1) { _push(out, _slice(str, from, at)); from = at + sep.length; }
+  _push(out, _slice(str, from));
+  return out;
+}
+
+function _isDigitCode(c) { return c >= 48 && c <= 57; }                                      // 0-9
+function _isHexCode(c) { return (c >= 48 && c <= 57) || (c >= 97 && c <= 102) || (c >= 65 && c <= 70); }
+
+// A strict RFC 791 dotted-quad octet: 1-3 digits, value 0-255, no leading zero beyond "0" itself.
+function _isOctet(p) {
+  var n = p.length, i, c;
+  if (n < 1 || n > 3) return false;
+  for (i = 0; i < n; i += 1) { c = _charCodeAt(p, i); if (!_isDigitCode(c)) return false; }
+  if (n > 1 && _charCodeAt(p, 0) === 48) return false;   // a leading zero is not the canonical form
+  return _Number(p) <= 255;
+}
+
+// Strict RFC 791 dotted quad: four 0-255 octets, nothing else.
+function isIPv4(s) {
+  if (typeof s !== "string") return false;
+  var parts = _splitOn(s, ".");
+  if (parts.length !== 4) return false;
+  for (var i = 0; i < 4; i += 1) { if (!_isOctet(parts[i])) return false; }
+  return true;
+}
+
+// A single 1-4 hex-digit IPv6 group.
+function _isHexGroup(g) {
+  var n = g.length, i;
+  if (n < 1 || n > 4) return false;
+  for (i = 0; i < n; i += 1) { if (!_isHexCode(_charCodeAt(g, i))) return false; }
+  return true;
+}
+
+// The RFC 4291 sec. 2.5.5.2 dual-stack tail SHAPE: exactly four 1-3 digit groups joined by dots. Validity
+// (0-255 per octet) is a separate isIPv4 check, matching the historical two-step (shape then value).
+function _isDottedQuadShape(t) {
+  var q = _splitOn(t, "."), i, p, j;
+  if (q.length !== 4) return false;
+  for (i = 0; i < 4; i += 1) {
+    p = q[i];
+    if (p.length < 1 || p.length > 3) return false;
+    for (j = 0; j < p.length; j += 1) { if (!_isDigitCode(_charCodeAt(p, j))) return false; }
+  }
+  return true;
+}
 
 // Expand an IPv6 textual address to its 32-hex-character form, or null on any parse failure
 // (bad hex group, group count != 8, more than one "::", an over-length group). Accepts the
 // IPv4-mapped / dual-stack ".d.d.d.d" tail.
 var IPV6_TEXT_MAX_LEN = 45;   // 8 groups x4 hex + 7 colons + a dotted-quad tail headroom
 function expandIpv6Hex(ip) {
-  if (typeof ip !== "string" || ip.length > IPV6_TEXT_MAX_LEN || ip.indexOf(":") === -1) return null;
-  // RFC 4291 sec. 2.5.5.2 IPv4-mapped / dual-stack: fold a trailing dotted-quad into two
-  // 16-bit hex groups before the pure-hex parse.
-  var dual = ip.match(/^(.*):(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
-  if (dual) {
-    if (!isIPv4(dual[2])) return null;
-    var v4 = dual[2].split(".").map(Number);
-    ip = dual[1] + ":" + (((v4[0] << 8) | v4[1]).toString(16)) + ":" + (((v4[2] << 8) | v4[3]).toString(16));
+  if (typeof ip !== "string" || ip.length > IPV6_TEXT_MAX_LEN || _indexOf(ip, ":") === -1) return null;
+  // RFC 4291 sec. 2.5.5.2 IPv4-mapped / dual-stack: fold a trailing dotted-quad (the suffix after the
+  // last colon, when it carries a dot) into two 16-bit hex groups before the pure-hex parse.
+  var lastColon = _lastIndexOf(ip, ":");
+  var tail = _slice(ip, lastColon + 1);
+  if (_indexOf(tail, ".") !== -1) {
+    if (!_isDottedQuadShape(tail) || !isIPv4(tail)) return null;
+    var q = _splitOn(tail, "."), o0 = _Number(q[0]), o1 = _Number(q[1]), o2 = _Number(q[2]), o3 = _Number(q[3]);
+    ip = _slice(ip, 0, lastColon) + ":" + _numToString((o0 << 8) | o1, 16) + ":" + _numToString((o2 << 8) | o3, 16);
   }
-  var dbl = ip.split("::");
+  var dbl = _splitOn(ip, "::");
   if (dbl.length > 2) return null;
-  var left = dbl[0] === "" ? [] : dbl[0].split(":");
-  var right = dbl.length === 2 ? (dbl[1] === "" ? [] : dbl[1].split(":")) : [];
+  var left = dbl[0] === "" ? [] : _splitOn(dbl[0], ":");
+  var right = dbl.length === 2 ? (dbl[1] === "" ? [] : _splitOn(dbl[1], ":")) : [];
   if (dbl.length === 1 && left.length !== 8) return null;
   var fill = 8 - left.length - right.length;
   // A "::" run MUST compress at least one zero group (RFC 4291 sec. 2.2 / RFC 5952 sec.
   // 4.2.2): a "::" with fill 0 is a full 8-group address that must not use compression.
   if (dbl.length === 2 ? fill < 1 : fill !== 0) return null;
-  var groups = left, i;
-  for (i = 0; i < fill; i += 1) groups = groups.concat(["0"]);
-  groups = groups.concat(right);
+  var groups = left, i;   // `left` is a fresh own-element array; append through _push (no inherited setter)
+  for (i = 0; i < fill; i += 1) _push(groups, "0");
+  for (i = 0; i < right.length; i += 1) _push(groups, right[i]);
   if (groups.length !== 8) return null;
   var hex = "";
   for (i = 0; i < 8; i += 1) {
     var g = groups[i];
-    if (g.length < 1 || g.length > 4 || !/^[0-9a-f]+$/i.test(g)) return null;
-    hex += g.toLowerCase().padStart(4, "0");
+    if (!_isHexGroup(g)) return null;
+    hex += _padStart(_toLowerCase(g), 4, "0");
   }
   return hex;
 }
@@ -61,9 +134,13 @@ function isIpLiteral(s) { return isIPv4(s) || expandIpv6Hex(s) !== null; }
 // expandIpv6Hex validate, so a SAN/GeneralName iPAddress (RFC 5280 sec. 4.2.1.6, always a bare
 // host address of 4 or 16 octets) can be given as a string instead of a pre-packed Buffer.
 function packIpLiteral(s) {
-  if (isIPv4(s)) return Buffer.from(s.split(".").map(Number));   // each octet already range-checked by IPV4_RE
+  if (isIPv4(s)) {
+    var parts = _splitOn(s, "."), buf = _bufferAlloc(4), i;
+    for (i = 0; i < 4; i += 1) buf[i] = _Number(parts[i]);   // Buffer integer-index store; each octet range-checked by _isOctet
+    return buf;
+  }
   var hex = expandIpv6Hex(s);
-  return hex === null ? null : Buffer.from(hex, "hex");
+  return hex === null ? null : _bufferFrom(hex, "hex");
 }
 
-module.exports = { isIPv4: isIPv4, expandIpv6Hex: expandIpv6Hex, isIpLiteral: isIpLiteral, packIpLiteral: packIpLiteral, IPV4_RE: IPV4_RE };
+module.exports = { isIPv4: isIPv4, expandIpv6Hex: expandIpv6Hex, isIpLiteral: isIpLiteral, packIpLiteral: packIpLiteral };

package/lib/oid.js

@@ -456,6 +456,30 @@ var FAMILIES = {
   // registered here so that prefix can be derived from the registry rather than a dotted-decimal literal.
   teletrustRsaSig: { base: [1, 3, 36, 3, 3, 1], of: { "rsaSignatureWithripemd160": 2 } },
 
+  // TeleTrusT (BSI) signatureScheme arc (1.3.36.3.4) -- the ISO/IEC 9796-2 RSA signatures giving message
+  // recovery (schemes 1/2/3: two deterministic, one randomized). ISO/IEC 9796-2 is titled "integer
+  // factorization based mechanisms", so EVERY scheme it defines is RSA and the standard has no non-RSA
+  // member; each node is registered so a consumer can name it -- e.g. the CMP keySpec RSA exclusion, which
+  // must recognize RSA wherever it is standardized. ISO/IEC 9796-2 assigns no algorithm OIDs of its own;
+  // this registrant tree is the de-facto registry. The .2 (deterministic) and .3 (randomized) sub-arcs are
+  // RSA-dedicated in full -- every descendant is RSA -- so a consumer prefix-matches each to catch a hash
+  // variant added later; the per-hash leaves are registered for readability. The `...Withrsa-even-exp`
+  // nodes (.2.1 / .3.1) are the even-public-exponent RSA variants the registrant marks "not used"; they are
+  // RSA (the registrant names them `sigS_ISO9796-2Withrsa_even-exp`), so the sub-arc prefix classifies them
+  // correctly, not wrongly. .1 is ISO/IEC 9796-1, also RSA, on the same arc. The PARENT node (.4) is generic
+  // "signatureScheme" and the sibling authentication arc (.5) is mixed (its .5.3 children are ECC), so
+  // neither is RSA-dedicated -- a consumer must not prefix-match the parent or .5.
+  teletrustSigScheme: { base: [1, 3, 36, 3, 4], of: {
+    "sigS-ISO9796-1": 1, "sigS-ISO9796-1-DFUE": [1, 1],
+    "sigS-ISO9796-2": 2, "sigS-ISO9796-2Withrsa-even-exp": [2, 1], "sigS-ISO9796-2Withrsa": [2, 2],
+    "sigS-ISO9796-2Withrsa-sha1": [2, 2, 1], "sigS-ISO9796-2Withrsa-ripemd160": [2, 2, 2],
+    "sigS-ISO9796-2Withrsa-sha224": [2, 2, 3], "sigS-ISO9796-2Withrsa-sha256": [2, 2, 4],
+    "sigS-ISO9796-2Withrsa-sha384": [2, 2, 5], "sigS-ISO9796-2Withrsa-sha512": [2, 2, 6],
+    "sigS-ISO9796-2rnd": 3, "sigS-ISO9796-2rndWithrsa-even-exp": [3, 1], "sigS-ISO9796-2rndWithrsa": [3, 2],
+    "sigS-ISO9796-2rndWithrsa-sha1": [3, 2, 1], "sigS-ISO9796-2rndWithrsa-ripemd160": [3, 2, 2],
+    "sigS-ISO9796-2rndWithrsa-sha224": [3, 2, 3], "sigS-ISO9796-2rndWithrsa-sha256": [3, 2, 4],
+    "sigS-ISO9796-2rndWithrsa-sha384": [3, 2, 5], "sigS-ISO9796-2rndWithrsa-sha512": [3, 2, 6] } },
+
   // X.509 directory encryptionAlgorithm arc (2.5.8.1). id-ea-rsa (.1) is the X.509 `rsa` public-key
   // identifier, distinct from PKCS#1 rsaEncryption. Registered so a consumer can name it -- e.g. the
   // CMP keySpec RSA exclusion, which must recognize RSA wherever it is standardized.

package/lib/pki-build.js

@@ -25,16 +25,279 @@ var _bufferFrom = intrinsic.bufferFrom;
 var _bufferEquals = intrinsic.bufferEquals;
 var oid = require("./oid");
 var ipUtils = require("./ip-utils");
+// packIpLiteral decides a GeneralName form (a bare string -> iPAddress or not), so its binding is taken at
+// load: calling it through the exports object would be a live property read, and code that reassigned that
+// property could steer the form decision without touching a regex.
+var _packIpLiteral = ipUtils.packIpLiteral;
 var nodeCrypto = require("crypto");
 // The key-material comparison, taken at load like every other operation a decision here rests on.
 var _keyEquals = intrinsic.uncurry(nodeCrypto.KeyObject.prototype.equals);
+// The bare-string GeneralName classifier (_classifyBareGeneralName) decides which name FORM a SAN string
+// becomes. It uses no regular expression: a regex is matched through a live, replaceable protocol
+// (RegExp.prototype.exec / test, String.prototype.match / split consult the regex's own `exec` and the
+// `[Symbol.match]` / `[Symbol.split]` hooks, and RegExp.prototype.compile can mutate a pattern in place),
+// so co-resident code could steer a form decision without our seeing it -- and the structural URI/email
+// rules a regex cannot state cleanly are what kept drawing edge-case escapes. Instead every form is
+// decided by scanning the string one character code at a time through these captured string primitives,
+// which read the value directly and have no per-character dispatch to replace.
+var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
+var _stringIndexOf = intrinsic.stringIndexOf;
+var _stringLastIndexOf = intrinsic.uncurry(String.prototype.lastIndexOf);
+var _sliceStr = intrinsic.uncurry(String.prototype.slice);
+var _String = intrinsic.String;
+var _objectKeys = intrinsic.keys;
+var _isBufferChk = intrinsic.isBuffer;
+var _stringify = intrinsic.stringify;
 
-var b = asn1.build;
+// --- bare-string GeneralName form detection, by character-code scan (no regex) ---
+// Each predicate answers "is this string syntactically THIS name form", reading the string one code unit
+// at a time; a caller cannot steer the answer by replacing a prototype method. The classifier below tries
+// the forms in a fixed precedence and refuses anything none of them accepts (the object form is the escape).
+function _isAlphaCode(c) { return (c >= 65 && c <= 90) || (c >= 97 && c <= 122); }          // A-Z a-z
+function _isDigitCode(c) { return c >= 48 && c <= 57; }                                      // 0-9
+function _isHexCode(c) { return (c >= 48 && c <= 57) || (c >= 97 && c <= 102) || (c >= 65 && c <= 70); }
+
+// RFC 3986 sec. 2.3 unreserved: ALPHA / DIGIT / "-" / "." / "_" / "~".
+function _isUnreserved(c) { return _isAlphaCode(c) || _isDigitCode(c) || c === 45 || c === 46 || c === 95 || c === 126; }
+// RFC 3986 sec. 2.2 sub-delims: ! $ & ' ( ) * + , ; =
+function _isSubDelim(c) {
+  switch (c) {
+    case 33: case 36: case 38: case 39: case 40: case 41: case 42: case 43: case 44: case 59: case 61: return true;
+    default: return false;
+  }
+}
+// A userinfo byte: unreserved / sub-delim / ":" (percent-encoding handled separately). No "@".
+function _isUserinfoByte(c) { return _isUnreserved(c) || _isSubDelim(c) || c === 58; }
+// A path/query/fragment byte: unreserved / sub-delim / a non-bracket gen-delim (":" "/" "?" "#" "@").
+// "%" is handled separately (it must open a "%HEXHEX" triplet); the IP-literal brackets "[" "]" are
+// excluded, so an IPv6-literal host is refused by the shorthand and uses the object form.
+function _isUriByte(c) {
+  return _isUnreserved(c) || _isSubDelim(c) || c === 58 || c === 47 || c === 63 || c === 35 || c === 64;
+}
+
+// An RFC 5322 sec. 3.2.3 "atext" byte: ALPHA / DIGIT and a fixed set of specials, used for an unquoted
+// email local part. "." is deliberately excluded so the dot-atom structure is enforced by the scan.
+function _isAtextByte(c) {
+  if (_isAlphaCode(c) || _isDigitCode(c)) return true;
+  switch (c) {
+    case 33: case 35: case 36: case 37: case 38: case 39:         // ! # $ % & '
+    case 42: case 43: case 45: case 47: case 61: case 63:         // * + - / = ?
+    case 94: case 95: case 96: case 123: case 124: case 125: case 126:   // ^ _ ` { | } ~
+      return true;
+    default: return false;
+  }
+}
+
+// IPv4 SHAPE: one or more digit groups joined by single dots (only digits and dots, no leading/trailing/
+// doubled dot, at least one dot). This is the "looks like an address" test, not a valid-address test --
+// packIpLiteral decides validity; a shape match that is not a valid address is refused as ambiguous.
+function _looksLikeIPv4Shape(s) {
+  var n = s.length, i, c, sawDot = false, atomEmpty = true;
+  if (n === 0) return false;
+  for (i = 0; i < n; i += 1) {
+    c = _charCodeAt(s, i);
+    if (c === 46) { if (atomEmpty) return false; sawDot = true; atomEmpty = true; }   // "."
+    else if (_isDigitCode(c)) { atomEmpty = false; }
+    else return false;
+  }
+  return sawDot && !atomEmpty;
+}
+
+// Every byte in [from,to) is an allowed component byte (per `byteOk`) or opens a "%HEXHEX" triplet.
+function _componentBytesOk(s, from, to, byteOk) {
+  var i = from, c;
+  while (i < to) {
+    c = _charCodeAt(s, i);
+    if (c === 37) {                                                                    // "%" -> %HEXHEX
+      if (i + 2 >= to || !_isHexCode(_charCodeAt(s, i + 1)) || !_isHexCode(_charCodeAt(s, i + 2))) return false;
+      i += 3;
+    } else if (byteOk(c)) { i += 1; }
+    else return false;
+  }
+  return true;
+}
+
+// The URI host in [from,to): RFC 5280 sec. 4.2.1.6 requires a URI SAN authority to carry a fully-qualified
+// domain name or IP host, stricter than an RFC 3986 reg-name. So the host is either a valid IPv4 literal,
+// or an FQDN of strict-LDH labels (the email-domain grammar: no underscore, no hyphen at a label edge) with
+// at least one dot -- a single-label host such as "localhost" is not fully qualified and uses the object
+// form, matching the email domain. An IPv4-SHAPED host that is not a valid address is refused as ambiguous
+// (the same rule the top-level classifier uses), and an IPv6-literal host -- needing the excluded "[" "]"
+// -- uses the object form.
+function _validUriHost(s, from, to) {
+  if (to <= from) return false;                                                        // empty host
+  var host = _sliceStr(s, from, to), len = host.length;
+  if (_looksLikeIPv4Shape(host)) return _packIpLiteral(host) !== null;                  // IPv4 (first-match-wins)
+  var end = _charCodeAt(host, len - 1) === 46 ? len - 1 : len;                          // ignore an absolute-root "."
+  if (end > 253) return false;                                                         // RFC 1035 name length (root dot excluded)
+  var firstDot = _stringIndexOf(host, ".", 0);
+  if (firstDot === -1 || firstDot >= end) return false;                                // multi-label FQDN ("localhost" is not)
+  return _labelsValid(host, 0, len, _isHostLabelRange, true);                           // strict-LDH FQDN, root "." allowed
+}
+
+// The authority in [from,to) is "[ userinfo "@" ] host [ ":" port ]" (RFC 3986 sec. 3.2): at most one "@"
+// (userinfo and reg-name each exclude it), a host validated by _validUriHost (RFC 5280 FQDN or IPv4), and
+// an all-digit -- possibly empty -- port after the host's single ":" (a reg-name has no ":"). The userinfo
+// bytes are validated against the RFC 3986 userinfo class.
+function _validUriAuthority(s, from, to) {
+  var i, c, at = -1;
+  for (i = from; i < to; i += 1) {
+    c = _charCodeAt(s, i);
+    if (c === 64) { if (at !== -1) return false; at = i; }                             // "@" -- at most one
+  }
+  var hostStart = at === -1 ? from : at + 1;
+  if (at !== -1 && !_componentBytesOk(s, from, at, _isUserinfoByte)) return false;      // userinfo
+  var colon = -1;
+  for (i = hostStart; i < to; i += 1) { if (_charCodeAt(s, i) === 58) { colon = i; break; } }   // ":" -> port
+  var hostEnd = colon === -1 ? to : colon;
+  if (!_validUriHost(s, hostStart, hostEnd)) return false;                              // FQDN or IPv4 host
+  if (colon !== -1) {
+    for (i = colon + 1; i < to; i += 1) { if (!_isDigitCode(_charCodeAt(s, i))) return false; }   // port = *DIGIT
+  }
+  return true;
+}
+
+// scheme "://" authority [ path ] [ "?" query ] [ "#" fragment ], parsed by RFC 3986 component. The
+// authority is validated by _validUriAuthority; the remainder is path/query/fragment bytes with at most
+// one "#" (its single fragment delimiter). A structurally malformed URL is refused; the object form is
+// the escape for one the shorthand does not accept.
+function _looksLikeUri(s) {
+  var n = s.length, i, c;
+  if (n === 0 || !_isAlphaCode(_charCodeAt(s, 0))) return false;                       // scheme starts ALPHA
+  i = 1;
+  while (i < n) {
+    c = _charCodeAt(s, i);
+    if (_isAlphaCode(c) || _isDigitCode(c) || c === 43 || c === 45 || c === 46) i += 1;   // + - . in scheme
+    else break;
+  }
+  if (i + 3 > n || _charCodeAt(s, i) !== 58 || _charCodeAt(s, i + 1) !== 47 || _charCodeAt(s, i + 2) !== 47) return false;
+  i += 3;
+  var authStart = i, authEnd = n;
+  for (; i < n; i += 1) { c = _charCodeAt(s, i); if (c === 47 || c === 63 || c === 35) { authEnd = i; break; } }
+  if (authEnd === authStart) return false;                                             // empty authority
+  if (!_validUriAuthority(s, authStart, authEnd)) return false;
+  var sawHash = false;                                                                 // path / query / fragment
+  i = authEnd;
+  while (i < n) {
+    c = _charCodeAt(s, i);
+    if (c === 37) {                                                                    // "%" -> %HEXHEX
+      if (i + 2 >= n || !_isHexCode(_charCodeAt(s, i + 1)) || !_isHexCode(_charCodeAt(s, i + 2))) return false;
+      i += 3;
+      continue;
+    }
+    if (c === 35) { if (sawHash) return false; sawHash = true; }                        // one "#" fragment delimiter
+    if (!_isUriByte(c)) return false;
+    i += 1;
+  }
+  return true;
+}
+
+// A single dNSName label over [from,to): 1-63 bytes, LDH plus a LEADING or EMBEDDED underscore, no hyphen
+// at either edge, and no underscore at the trailing edge. The underscore tolerance is deliberate and
+// leading/embedded only: the real forms are _acme-challenge, _dmarc, _25._tcp (a label-initial "_"); a
+// label ending in "_" has no such use. An email DOMAIN is stricter still -- see _isHostLabelRange.
+function _isDnsLabelRange(s, from, to) {
+  var len = to - from, i, c;
+  if (len < 1 || len > 63) return false;
+  for (i = from; i < to; i += 1) {
+    c = _charCodeAt(s, i);
+    if (_isAlphaCode(c) || _isDigitCode(c)) continue;                                  // A-Z a-z 0-9 anywhere
+    if (i === to - 1) return false;                                                    // last byte must be alnum
+    if (c === 95) continue;                                                            // "_" leading or embedded
+    if (c === 45 && i !== from) continue;                                              // "-" embedded (not leading)
+    return false;
+  }
+  return true;
+}
+
+// A single RFC 5321 sec. 2.3.5 hostname label over [from,to): the strict letter-digit-hyphen grammar with
+// no hyphen at either edge and NO underscore. This is the email-domain label rule (a mail domain is a real
+// hostname), stricter than the underscore-tolerant dNSName label above.
+function _isHostLabelRange(s, from, to) {
+  var len = to - from, i, c, edge;
+  if (len < 1 || len > 63) return false;
+  for (i = from; i < to; i += 1) {
+    c = _charCodeAt(s, i);
+    edge = (i === from || i === to - 1);
+    if (_isAlphaCode(c) || _isDigitCode(c)) continue;                                  // A-Z a-z 0-9
+    if (c === 45 && !edge) continue;                                                   // "-" not at an edge
+    return false;
+  }
+  return true;
+}
+
+// Every dot-separated label in [from,to) satisfies `labelFn`. Scans with indexOf; no split allocation. When
+// `allowRootDot` is set, a single trailing "." (the absolute-FQDN root) is stripped before validating, so
+// "example.com." checks as "example.com"; an interior empty label (a doubled or leading dot) still fails.
+function _labelsValid(s, from, to, labelFn, allowRootDot) {
+  if (allowRootDot && to - from >= 1 && _charCodeAt(s, to - 1) === 46) to -= 1;         // an absolute-root "."
+  if (to <= from) return false;                                                        // nothing (a lone ".")
+  var start = from, dot;
+  for (;;) {
+    dot = _stringIndexOf(s, ".", start);
+    var end = (dot === -1 || dot >= to) ? to : dot;
+    if (!labelFn(s, start, end)) return false;
+    if (end === to) return true;
+    start = end + 1;
+  }
+}
 
-// A well-formed dotted-decimal OID: a first arc 0-2 followed by one or more non-leading-zero arcs. Used to
-// accept a raw OID string (an unregistered KeyPurposeId / policy OID) where a registered name would go; the
-// encoder (encodeOidContent) remains the authoritative validator of the arc-value bounds.
-var DOTTED_OID_RE = /^[0-2](?:\.(?:0|[1-9]\d*))+$/;
+// A dNSName: at most 253 bytes, an optional single leading "*." wildcard, then dot-separated dNSName labels
+// (underscore-tolerant), with an optional trailing absolute-root ".".
+function _looksLikeDnsName(s) {
+  var n = s.length, start = 0;
+  if (n < 1) return false;
+  var end = _charCodeAt(s, n - 1) === 46 ? n - 1 : n;                                   // exclude an absolute-root "."
+  if (end < 1 || end > 253) return false;                                              // RFC 1035 name length (root dot excluded)
+  if (end >= 2 && _charCodeAt(s, 0) === 42 && _charCodeAt(s, 1) === 46) start = 2;      // "*."
+  if (start >= end) return false;
+  return _labelsValid(s, start, n, _isDnsLabelRange, true);
+}
+
+// An rfc822Name: an unquoted RFC 5321 dot-atom local part (atext runs joined by single dots), one "@",
+// and a dotted hostname domain (at least one dot -- an FQDN, no wildcard, strict LDH labels, no underscore).
+function _looksLikeEmail(s) {
+  if (s.length > 254) return false;                                                    // the whole mailbox <= 254 octets (RFC 5321 sec. 4.5.3.1.3)
+  var at = _stringIndexOf(s, "@", 0);
+  if (at < 1 || at > 64 || _stringLastIndexOf(s, "@") !== at) return false;            // one "@", a 1-64 octet local part (RFC 5321 sec. 4.5.3.1.1)
+  var i, c, atomEmpty = true;
+  for (i = 0; i < at; i += 1) {                                                        // local part = dot-atom
+    c = _charCodeAt(s, i);
+    if (c === 46) { if (atomEmpty) return false; atomEmpty = true; }                   // no leading/doubled dot
+    else if (_isAtextByte(c)) { atomEmpty = false; }
+    else return false;
+  }
+  if (atomEmpty) return false;                                                         // no trailing dot / empty
+  var dStart = at + 1, dLen = s.length - dStart;
+  if (dLen < 1 || dLen > 253 || _stringIndexOf(s, ".", dStart) === -1) return false;   // domain must be dotted
+  return _labelsValid(s, dStart, s.length, _isHostLabelRange, false);                   // strict LDH, no underscore or root dot
+}
+
+// A well-formed dotted-decimal OID SHAPE (no regex, by the same character scan the name forms use): a first
+// arc 0-2, then one or more arcs each introduced by "." and written without a leading zero ("0" alone, or a
+// non-zero digit followed by more digits). Used to accept a raw OID string (an unregistered KeyPurposeId /
+// policy OID) where a registered name would go; the encoder (encodeOidContent) remains the authoritative
+// validator of the arc-value bounds.
+function _isDottedOid(s) {
+  var n = s.length, i, c, d0, arcs = 0;
+  if (n < 3) return false;                              // shortest is "X.Y"
+  c = _charCodeAt(s, 0);
+  if (c < 48 || c > 50) return false;                  // first arc is a single digit 0-2
+  i = 1;
+  while (i < n) {
+    if (_charCodeAt(s, i) !== 46) return false;         // every following arc is introduced by "."
+    i += 1;
+    if (i >= n) return false;                           // a trailing "." has no arc
+    d0 = _charCodeAt(s, i);
+    if (d0 === 48) { i += 1; }                           // "0" is a complete arc; a leading zero is refused
+    else if (d0 >= 49 && d0 <= 57) { i += 1; while (i < n && _isDigitCode(_charCodeAt(s, i))) i += 1; }
+    else { return false; }                              // an arc must start with a digit
+    arcs += 1;
+  }
+  return arcs >= 1;
+}
+
+var b = asn1.build;
 
 // KeyUsage named-bit positions (RFC 5280 sec. 4.2.1.3); contentCommitment is the RFC 5280 rename of the
 // X.509 nonRepudiation bit (1).
@@ -112,15 +375,51 @@ function makeBuilder(ctx) {
 
   // ---- GeneralName encoding (RFC 5280 sec. 4.2.1.6) ----
   function ia5Content(s) {
-    s = String(s);
+    // Captured String / charCodeAt / bufferFrom: this converts a GeneralName value (a classified bare
+    // string or an object-form value) to the emitted IA5String bytes, so co-resident code replacing any of
+    // them after load could otherwise change which host the certificate names from the one that was checked.
+    s = _String(s);
     for (var i = 0; i < s.length; i++) {
-      if (s.charCodeAt(i) > 0x7F) throw E("bad-input", "value requires 7-bit ASCII (IA5String): " + JSON.stringify(s));
+      if (_charCodeAt(s, i) > 0x7F) throw E("bad-input", "value requires 7-bit ASCII (IA5String): " + _stringify(s));
     }
-    return Buffer.from(s, "latin1");
+    return _bufferFrom(s, "latin1");
+  }
+  // A bare-string GeneralName shorthand: classify a string into exactly one form, FAIL-CLOSED. RFC 5280
+  // sec. 4.2.1.6 GeneralName is a CHOICE, so an input that does not UNAMBIGUOUSLY match one form throws
+  // rather than being guessed -- the explicit object form ({ dNSName: s } etc.) is always the escape. The
+  // per-form syntax is decided by the character-scan predicates above (no regex). Precedence resolves the
+  // overlaps of the later tests: an IP literal is also LDH-with-dots (so it is tested first), and a
+  // scheme://authority URL can carry userinfo that reads like an email (so URI is tested before rfc822Name).
+  // Form detection only -- IA5String (7-bit) enforcement stays at ia5Content, so a non-ASCII value still
+  // throws at encode.
+  function _classifyBareGeneralName(s) {
+    if (_packIpLiteral(s) !== null) return { iPAddress: s };
+    // A string of only digit groups separated by dots is an IPv4 ATTEMPT; if packIpLiteral rejected it,
+    // it is a MALFORMED address, not a dNSName. It reads two ways (an invalid IP and a syntactically
+    // valid all-numeric name), so it is ambiguous and refused rather than silently encoded as a name the
+    // caller did not intend -- a genuine all-numeric name uses the explicit { dNSName: ... } form.
+    if (_looksLikeIPv4Shape(s)) {
+      throw E("bad-input", "the bare GeneralName string " + _stringify(s) + " looks like an IPv4 address but is not a valid one; pass { iPAddress: ... } for an address or { dNSName: ... } for a name");
+    }
+    if (_looksLikeUri(s)) return { uniformResourceIdentifier: s };
+    if (_looksLikeEmail(s)) return { rfc822Name: s };
+    if (_looksLikeDnsName(s)) return { dNSName: s };
+    var _qs = _stringify(s);
+    throw E("bad-input", "cannot classify the bare GeneralName string " + _qs +
+      " as a dNSName, rfc822Name, iPAddress, or URI; pass an explicit form object, e.g. { dNSName: " + _qs + " }");
   }
   function encodeGeneralName(entry) {
-    if (!entry || typeof entry !== "object" || Buffer.isBuffer(entry)) throw E("bad-input", "a GeneralName must be an object with exactly one name form");
-    var keys = Object.keys(entry);
+    // A bare non-empty string is shorthand -- normalized to its single-key object form, fail-closed,
+    // before the object checks below; an empty string is refused here (never classified).
+    if (typeof entry === "string") {
+      if (entry === "") throw E("bad-input", "an empty GeneralName value is not permitted (RFC 5280 sec. 4.2.1.6)");
+      entry = _classifyBareGeneralName(entry);
+    }
+    if (!entry || typeof entry !== "object" || _isBufferChk(entry)) throw E("bad-input", "a GeneralName must be an object with exactly one name form");
+    // Captured Object.keys / property read: this reads which form and value the certificate will emit for a
+    // GeneralName (a freshly classified bare string, or a caller object), so a replaced Object.keys must not
+    // be able to relabel the classified result into a different, attacker-chosen form after validation.
+    var keys = _objectKeys(entry);
     if (keys.length !== 1) throw E("bad-input", "a GeneralName entry must have exactly one form, got " + keys.length);
     var k = keys[0], v = entry[k];
     if (v == null || v === "") throw E("bad-input", "an empty GeneralName value is not permitted (RFC 5280 sec. 4.2.1.6)");
@@ -134,10 +433,10 @@ function makeBuilder(ctx) {
         // octets by hand (a GeneralName iPAddress is a bare host address, RFC 5280 sec. 4.2.1.6).
         var ipBuf = v;
         if (typeof v === "string") {
-          ipBuf = ipUtils.packIpLiteral(v);
-          if (ipBuf === null) throw E("bad-input", "iPAddress string is not a valid IPv4 or IPv6 literal: " + JSON.stringify(v));
+          ipBuf = _packIpLiteral(v);
+          if (ipBuf === null) throw E("bad-input", "iPAddress string is not a valid IPv4 or IPv6 literal: " + _stringify(v));
         }
-        if (!Buffer.isBuffer(ipBuf) || (ipBuf.length !== 4 && ipBuf.length !== 16)) throw E("bad-input", "iPAddress must be a 4- or 16-octet Buffer or an IPv4/IPv6 string");
+        if (!_isBufferChk(ipBuf) || (ipBuf.length !== 4 && ipBuf.length !== 16)) throw E("bad-input", "iPAddress must be a 4- or 16-octet Buffer or an IPv4/IPv6 string");
         return b.contextPrimitive(7, ipBuf);
       case "directoryName": return b.explicit(4, encodeName(v));   // Name is a CHOICE -> the context tag is EXPLICIT
       case "otherName":
@@ -187,8 +486,8 @@ function makeBuilder(ctx) {
   function _resolveOid(n, label) {
     var dotted = O(n);
     if (dotted != null) return dotted;
-    if (typeof n === "string" && DOTTED_OID_RE.test(n)) {
-      // The regex fixes the general shape; b.oid's encoder is the authoritative X.660 arc-bounds check
+    if (typeof n === "string" && _isDottedOid(n)) {
+      // The shape scan fixes the general form; b.oid's encoder is the authoritative X.660 arc-bounds check
       // (a first arc 0/1 caps the second at 39; an arc must DER-encode). A failure there is this producer's
       // bad-input, not a leaked oid/* code, so every shared-builder consumer keeps its own error contract.
       try { b.oid(n); }

package/lib/sign-scheme.js

@@ -222,7 +222,13 @@ function _assertKeyMatchesScheme(key, imp, E) {
   var ka = key.algorithm || {};
   // WebCrypto algorithm names are ASCII-case-insensitive (RSASSA-PKCS1-v1_5 and RSASSA-PKCS1-V1_5 are one
   // algorithm), so compare case-folded; a genuine mismatch (e.g. RSASSA-PKCS1-v1_5 vs ECDSA) still fails.
-  if (_toUpperCase(_String(ka.name)) !== _toUpperCase(_String(imp.name))) throw E("bad-input", "the signer CryptoKey algorithm (" + ka.name + ") does not match the certificate's key algorithm (" + imp.name + ")");
+  if (_toUpperCase(_String(ka.name)) !== _toUpperCase(_String(imp.name))) {
+    // A WebCrypto RSA-PSS CryptoKey is bound to PSS and cannot produce the default RSASSA-PKCS1-v1_5
+    // signature (which a raw PKCS#8 RSA key can), so name the fix rather than only the mismatch.
+    var hint = (_toUpperCase(_String(ka.name)) === "RSA-PSS" && _toUpperCase(_String(imp.name)) === "RSASSA-PKCS1-V1_5")
+      ? "; this CryptoKey is bound to RSASSA-PSS -- pass opts.pss to sign with RSASSA-PSS" : "";
+    throw E("bad-input", "the signer CryptoKey algorithm (" + ka.name + ") does not match the certificate's key algorithm (" + imp.name + ")" + hint);
+  }
   if (imp.hash && (!ka.hash || ka.hash.name !== imp.hash)) throw E("bad-input", "the signer CryptoKey hash (" + (ka.hash && ka.hash.name) + ") does not match the signing digest (" + imp.hash + ")");
   if (imp.namedCurve && ka.namedCurve !== imp.namedCurve) throw E("bad-input", "the signer CryptoKey curve (" + ka.namedCurve + ") does not match the certificate curve (" + imp.namedCurve + ")");
 }
@@ -242,11 +248,21 @@ function _normCompositeKeys(key, comp, E) {
   return { mldsa: _normPkcs8(key.mldsa, "the composite ML-DSA component key", E), trad: _normPkcs8(key.trad, "the composite traditional component key", E) };
 }
 function _importKey(key, imp, E) {
-  if (key && typeof key === "object" && !_isBuffer(key) && !(_isU8(key)) && key.type === "private") {
+  // A WebCrypto CryptoKey is detected structurally (a `.type` string + an `.algorithm` object, and not
+  // a byte view), never by instanceof (cross-realm / a second installed copy) or util.types.isCryptoKey
+  // (false for this engine's own keys). The gate is broader than webcrypto.isCryptoKeyLike on purpose:
+  // an incomplete CryptoKey-shaped object (e.g. one missing its `usages`) still routes here so adoptKey
+  // reports the specific reason (usages / not-exportable) rather than the generic byte-form message. It
+  // signs, so it must be a PRIVATE key: a public or secret CryptoKey cannot produce a signature and is
+  // refused precisely.
+  if (key && typeof key === "object" && !_isBuffer(key) && !_isU8(key) && typeof key.type === "string" && key.algorithm != null) {
+    if (key.type !== "private") {
+      throw E("bad-input", "the signing key is a WebCrypto CryptoKey of type " + _stringify(key.type) + "; a signing key must be a private key (type \"private\")");
+    }
     _assertKeyMatchesScheme(key, imp, E);
-    // `key` is documented as taking a CryptoKey, so one created outside this engine signs here too --
-    // it is re-imported through this engine, because it carries none of the key material this engine
-    // signs with. One whose material this process cannot reach is refused with that as the reason.
+    // A CryptoKey created outside this engine signs here too -- it is re-imported through this engine,
+    // because it carries none of the key material this engine signs with. One whose material this
+    // process cannot reach is refused with that as the reason.
     return webcrypto.adoptKey(key, imp, ["sign"], E, "bad-input");
   }
   // A Uint8Array is copied here and a PEM string is decoded here, so both leave a second copy of a
@@ -260,7 +276,11 @@ function _importKey(key, imp, E) {
     try { der = pkcs8.pemDecode(key); }
     catch (e) { throw E("bad-input", "the signer PEM private key could not be decoded", e); }
     owned = true;
-  } else throw E("bad-input", "a signer key must be a CryptoKey, a PKCS#8 DER Buffer, or a PKCS#8 PEM string");
+  } else if (intrinsic.types.isKeyObject(key)) {
+    // A node:crypto KeyObject carries a `.type` but not the WebCrypto surface (algorithm / usages), so
+    // it fails the CryptoKey gate above and would otherwise land on the generic message -- name it precisely.
+    throw E("bad-input", "the signing key is a node:crypto KeyObject, not a WebCrypto CryptoKey; pass a CryptoKey (e.g. from pki.key.generate) or export it to a PKCS#8 DER Buffer or PEM string");
+  } else throw E("bad-input", "a signer key must be a WebCrypto CryptoKey, a PKCS#8 DER Buffer, or a PKCS#8 PEM string");
   var imported = subtle.importKey("pkcs8", der, imp, false, ["sign"]);
   if (!owned) return imported;
   // Wiped on the reject path too: a malformed key is not a way to leave the copy in memory.

package/lib/x509-sign.js

@@ -264,7 +264,12 @@ function _hasCriticalSan(extSpec) {
  * key being certified), `notBefore` / `notAfter` (`Date`s), an optional `serialNumber`, and an optional
  * `extensions` object. `issuer` is the signing side: `{ key }` alone issues a self-signed certificate
  * (issuer = subject, signed with the subject's own key); `{ name, publicKey, key }` or `{ cert, key }`
- * issues a CA-signed one. The signature algorithm is resolved from the signing key: RSA (PKCS#1 v1.5
+ * issues a CA-signed one. The signing key `key` is a WebCrypto `CryptoKey` -- a `pki.key.generate`
+ * private key passed directly, without exporting -- or a PKCS#8 private key as DER (`Buffer`) or PEM
+ * (`string`); a public or secret CryptoKey, or a `node:crypto` KeyObject, is refused. A `subjectAltName`
+ * (or any `GeneralName`) entry may be a form object (`{ dNSName: "..." }`) or a bare string classified
+ * fail-closed into its form (`"host.example"`, `"a@b.example"`, `"10.0.0.1"`, `"https://host.example/"`).
+ * The signature algorithm is resolved from the signing key: RSA (PKCS#1 v1.5
  * or PSS via `opts.pss`), ECDSA, EdDSA, ML-DSA, SLH-DSA, or a composite arm, so every algorithm the
  * toolkit signs with is available here without a per-algorithm branch.
  *
@@ -283,12 +288,11 @@ function _hasCriticalSan(extSpec) {
  * @example
  *   var pair = await pki.key.generate("Ed25519");
  *   var signerSpki = await pki.key.export(pair.publicKey);
- *   var signerKeyPkcs8 = await pki.key.export(pair.privateKey);
  *   var root = await pki.x509.sign(
  *     { subject: "Example Root CA", subjectPublicKey: signerSpki,
  *       notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z"),
  *       extensions: { basicConstraints: { cA: true }, keyUsage: ["keyCertSign", "cRLSign"], subjectKeyIdentifier: true } },
- *     { key: signerKeyPkcs8 });
+ *     { key: pair.privateKey });   // a WebCrypto CryptoKey signs directly (or pass a PKCS#8 DER Buffer / PEM string)
  *   pki.schema.x509.parse(root).subject.dn;   // "CN=Example Root CA"
  */
 function sign(spec, issuer, opts) {
@@ -324,7 +328,7 @@ function _sign(spec, issuer, opts) {
         : "explicit form; the issuer takes { key, name, publicKey }, or { key, cert } to take both from a certificate");
     });
   guard.identifier.assertKnownKeys(opts, KNOWN_SIGN_OPTS, _err, "x509/bad-input", "pki.x509.sign has an unknown option ");
-  if (issuer.key == null) throw _err("x509/bad-input", "a signing key (issuer.key, a PKCS#8 private key) is required");
+  if (issuer.key == null) throw _err("x509/bad-input", "a signing key (issuer.key, a WebCrypto CryptoKey or a PKCS#8 private key DER/PEM) is required");
 
   var spki = _reqDer(spec.subjectPublicKey, "spec.subjectPublicKey (the SPKI DER of the certified key)");
   _assertValidSpki(spki, "spec.subjectPublicKey");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.5.29",
+  "version": "0.5.31",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:6fc4808e-4377-42ae-a5a4-080dbff3e1df",
+  "serialNumber": "urn:uuid:ebd39ca0-3971-47df-8cbe-c00499f2e5c6",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-24T18:48:42.954Z",
+    "timestamp": "2026-08-25T04:07:42.047Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.5.29",
+      "bom-ref": "@blamejs/pki@0.5.31",
       "type": "application",
       "name": "pki",
-      "version": "0.5.29",
+      "version": "0.5.31",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.5.29",
+      "purl": "pkg:npm/%40blamejs/pki@0.5.31",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.5.29",
+      "ref": "@blamejs/pki@0.5.31",
       "dependsOn": []
     }
   ]