@blamejs/pki 0.5.8 → 0.5.10

package/lib/guard-der.js

@@ -0,0 +1,152 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. The documented surface is the consumers
+// whose encoding integrity composes this guard (pki.schema.c509 reconstruct sites,
+// pki.x509.sign and its sibling builders on any subjectAltName otherName value).
+//
+// guard-der: the single choke point for "these raw bytes are exactly one strictly-valid
+// DER element", for every site that splices caller-supplied ANY bytes verbatim into
+// something it then signs or reconstructs.
+//
+// The bug class is framing mistaken for validation. asn1.decode checks TLV framing and
+// rejects trailing data, and stopping there feels sufficient. It is not: framing accepts
+// a BOOLEAN whose content octet is 0x01 where DER requires 0xFF, a NumericString holding
+// "@", and a SET whose members sit in no canonical order. None of those is DER. Spliced
+// into a certificate and signed, the issuer emits a structure that strict relying parties
+// reject, under a real signature, while the producing verb reported success (CWE-20).
+//
+// The rule is validate-or-refuse. A universal primitive runs through its strict content
+// reader, and a universal type with no reader here is REFUSED, so the table is exhaustive
+// by refusal and adding a type is a deliberate act. A non-universal element (a
+// legitimately context- or application-tagged ANY) passes on its framing because no
+// content rule is knowable for it, and its constructed children are still walked.
+//
+// Every entry point takes the CALLER's error factory and code, so a c509 splice reports in
+// the c509 domain and a certificate builder in the x509 domain.
+// asn1-der composes this guard family, so requiring the codec at module scope would read its
+// exports mid-initialization and see an empty object. The require and the table it builds are
+// therefore both deferred to first use -- the documented circular-load exception to top-of-file
+// requires. Guards sit BELOW the codec in the dependency order; this is the one place that
+// order is inverted, and it is inverted lazily.
+var asn1 = null;
+function _asn1() { if (asn1 === null) asn1 = require("./asn1-der"); return asn1; }
+
+// The strict content reader per universal primitive tag. A tag absent from this table has no
+// validator here and is refused by `element` below -- that refusal is the point.
+var VALUE_READERS = null;
+function _readers() {
+  if (VALUE_READERS !== null) return VALUE_READERS;
+  var asn1 = _asn1();
+  var m = {}, R = asn1.read, T = asn1.TAGS;
+  // ENUMERATED shares INTEGER's content rules and is NOT constrained to non-negative
+  // values. X.680 (02/2021) sec. 20.2 requires each NamedNumber's SignedNumber to be
+  // distinct, and sec. 19 defines SignedNumber ::= number | "-" number; the non-negativity
+  // in sec. 20.3 governs only an EnumerationItem written as a bare identifier, which is
+  // auto-assigned. `ENUMERATED { lowPriority(-1), normal(0) }` is well-formed, so rejecting
+  // a negative here would refuse valid input. This guard validates the ENCODING; which
+  // values a particular ENUMERATED admits lives in a type definition an opaque ANY does
+  // not carry.
+  m[T.BOOLEAN] = R.boolean; m[T.INTEGER] = R.integer; m[T.ENUMERATED] = R.enumerated;
+  m[T.BIT_STRING] = R.bitString; m[T.OCTET_STRING] = R.octetString; m[T.NULL] = R.nullValue;
+  m[T.OBJECT_IDENTIFIER] = R.oid; m[T.UTC_TIME] = R.time; m[T.GENERALIZED_TIME] = R.time;
+  // NumericString reads through its own reader: it is not a DirectoryString type, and routing
+  // it through read.string would fold it into the RFC 5280 sec. 7.1 name-comparison identity
+  // class (see asn1-der.js).
+  m[T.NUMERIC_STRING] = R.numericString;
+  [T.UTF8_STRING, T.PRINTABLE_STRING, T.IA5_STRING, T.TELETEX_STRING, T.VISIBLE_STRING,
+    T.BMP_STRING, T.UNIVERSAL_STRING].forEach(function (t) { m[t] = R.string; });
+  VALUE_READERS = m;
+  return VALUE_READERS;
+}
+
+// A universal SET's required member order depends on a type the ANY does not carry: X.690
+// sec. 11.6 orders a SET OF by the members' full encodings, while a structured SET is ordered
+// by TAG (X.680 sec. 8.6), and the two differ whenever the constructed bit does (a SEQUENCE
+// member, tag 16, sorts before a PrintableString, tag 19, by tag but after it by octets). A
+// structured SET cannot repeat a tag, so a repeated tag proves SET OF and the octet rule binds;
+// with all-distinct tags either reading is possible, so accept a value that satisfies EITHER
+// (rejecting only what is non-canonical under both readings: sound in both directions, never a
+// guess).
+//
+// KNOWN LIMITATION, and the two consumers do not weigh it identically. The either-reading rule
+// admits a SET OF that is tag-ordered but not octet-ordered, which is not canonical DER. On a
+// RECONSTRUCT path the input already exists and the alternative would refuse a valid structured
+// SET, so accepting is the sound direction. On a SIGNING path the caller composes the bytes and
+// could be held to octet order, so the same permissiveness lets a signer emit a non-canonical
+// SET under a real signature. Tightening it for signers alone would mean a mode flag on a
+// security posture, which this family avoids, and tightening it for both would reject valid
+// structured SETs that c509 round-trips today. The rule is therefore unchanged and the cost is
+// written down rather than discovered later.
+var TAG_CLASS_RANK = { universal: 0, application: 1, context: 2, private: 3 };
+function setOrderOk(kids) {
+  var i, dup = false, seen = {};
+  for (i = 0; i < kids.length; i++) {
+    var key = kids[i].tagClass + ":" + kids[i].tagNumber;
+    if (seen[key]) { dup = true; break; }
+    seen[key] = true;
+  }
+  var octetAsc = true, tagAsc = true;
+  for (i = 1; i < kids.length; i++) {
+    if (Buffer.compare(kids[i - 1].bytes, kids[i].bytes) > 0) octetAsc = false;
+    // Tag order ranks by CLASS first (universal < application < context < private, X.680
+    // sec. 8.6), then by tag number. Compare the class's NUMBER: the names do not sort in
+    // class order.
+    var pc = TAG_CLASS_RANK[kids[i - 1].tagClass], cc = TAG_CLASS_RANK[kids[i].tagClass];
+    if (pc !== cc ? pc > cc : kids[i - 1].tagNumber > kids[i].tagNumber) tagAsc = false;
+  }
+  return dup ? octetAsc : (octetAsc || tagAsc);
+}
+
+// element(node, E, code, label). Strict-validate an already-decoded DER element at ANY depth.
+// Rejects the reserved EOC tag 0; runs a universal primitive through its strict content reader
+// (or refuses a type with none); recurses into a constructed element's children; holds a
+// universal SET to a canonical order. Only SEQUENCE and SET are accepted as universal
+// CONSTRUCTED types -- an EXTERNAL / EMBEDDED PDV / CHARACTER STRING has mandatory components
+// this gate cannot verify (the degenerate empty form is not a valid encoding of any of them),
+// so it is refused for the same reason an unvalidatable primitive is.
+//
+// @enforced-by guard-shape-reinlined
+// @guard-shape _ANY_VALUE_READERS\[
+function element(node, E, code, label) {
+  if (node.tagClass === "universal" && node.tagNumber === 0) {
+    throw E(code, label + " must not use the reserved end-of-contents encoding (tag 0)");
+  }
+  var T = _asn1().TAGS;
+  if (node.constructed) {
+    if (node.tagClass === "universal" && node.tagNumber !== T.SEQUENCE && node.tagNumber !== T.SET) {
+      throw E(code, label + " of universal constructed type " + node.tagNumber + " has no strict DER structure validator here");
+    }
+    var kids = node.children;   // asn1.decode always sets a (possibly empty) children array
+    for (var i = 0; i < kids.length; i++) element(kids[i], E, code, label);
+    if (node.tagClass === "universal" && node.tagNumber === T.SET && !setOrderOk(kids)) {
+      throw E(code, label + " has a SET whose members are in no canonical DER order (X.690 sec. 11.6 / X.680 sec. 8.6)");
+    }
+    return;
+  }
+  if (node.tagClass === "universal") {
+    var reader = _readers()[node.tagNumber];
+    if (!reader) throw E(code, label + " of universal type " + node.tagNumber + " has no strict DER content validator here");
+    try { reader(node); }
+    catch (e) { throw E(code, label + " is not a valid DER element for its type", e); }
+  }
+}
+
+// tlv(content, E, code, label) -> content. Raw ANY bytes about to be spliced verbatim must be
+// exactly one non-empty, well-formed AND strictly-valid DER element: framing + no-trailing-data
+// via asn1.decode, then content / structure / SET order via `element`. Returns the bytes so a
+// call site can wrap a splice inline.
+//
+// @enforced-by guard-shape-reinlined
+// @guard-shape must be exactly one well-formed DER element
+function tlv(content, E, code, label) {
+  if (!content || content.length === 0) throw E(code, label + " must be a non-empty DER element");
+  var node;
+  try { node = _asn1().decode(content); }
+  catch (e) { throw E(code, label + " must be exactly one well-formed DER element (no trailing data)", e); }
+  element(node, E, code, label);
+  return content;
+}
+
+module.exports = { element: element, tlv: tlv };

package/lib/guard-identifier.js

@@ -84,9 +84,9 @@ function assertCanonicalOid(str, E, code, label, boundsCode) {
 // The shape this replaces was hand-written in a dozen callers, and it is worth one home because
 // getting it wrong fails open in the quietest possible way: an options object whose key is
 // misspelled silently carries the default, so a caller who asked for a stricter check gets the
-// looser behaviour and no error. Two details are easy to lose in a re-inline and are fixed here.
+// looser behavior and no error. Two details are easy to lose in a re-inline and are fixed here.
 // `known` is consulted with hasOwnProperty and not a truthiness test, so an inherited Object
-// member ("constructor", "toString") cannot read as a recognised key; and the walk is over own
+// member ("constructor", "toString") cannot read as a recognized key; and the walk is over own
 // enumerable keys, so a `__proto__` arriving from JSON is inspected instead of skipped.
 //
 // @enforced-by behavioral -- an options-shape walk has no rename-proof code shape; the RED vectors
@@ -99,7 +99,7 @@ function assertCanonicalOid(str, E, code, label, boundsCode) {
 //
 // @enforced-by guard-shape-reinlined
 // The shape requires the throw: an identical walk whose body filters on the same table (copying the
-// recognised keys onward instead of rejecting the unrecognised ones) is a different operation with
+// recognized keys onward instead of rejecting the unrecognized ones) is a different operation with
 // no fail-open risk, and must not be dragged through a guard that only knows how to reject.
 // @guard-shape Object\.keys\(\w+(?:\.\w+)*\)\.forEach\(function \((\w+)\) \{\s*if \(![\w.]+\[\1\]\) (?:\{\s*)?throw
 function assertKnownKeys(obj, known, E, code, message) {

package/lib/guard-limits.js

@@ -90,7 +90,7 @@ function depthCap(value, key, dflt) {
 function counter(max, E, code, label) {
   // The ceiling is an authoring input: an undefined / NaN / fractional max
   // builds a counter whose `n > max` never fires, leaving a silently dead fanout
-  // defence. Reject at construction (config-time TypeError).
+  // defense. Reject at construction (config-time TypeError).
   if (!Number.isInteger(max) || max < 0) {
     throw new TypeError("guard.limits.counter: max must be a non-negative integer");
   }
@@ -117,7 +117,7 @@ function counter(max, E, code, label) {
 //   over-size RED vectors driving the composing verifiers are the guard.
 function byteCap(buf, max, E, code, label) {
   // The ceiling is an authoring input: an undefined / NaN / fractional / negative
-  // max makes `length > max` never fire, and the size defence is then silently
+  // max makes `length > max` never fire, and the size defense is then silently
   // dead. Reject at config time (TypeError), regardless of the value currency E selects.
   if (!Number.isInteger(max) || max < 0) {
     throw new TypeError("guard.limits.byteCap: max must be a non-negative integer");

package/lib/guard-parsed.js

@@ -44,7 +44,7 @@ var bytes = require("./guard-bytes");
 // ArrayBuffer. Testing `Buffer.isBuffer(x) || x instanceof Uint8Array` is narrower than what the
 // verbs document, and the narrowness is invisible in the good case: an ArrayBuffer would fall
 // through to the object branch and be refused as a rebuilt structure, which reads to the caller as
-// "your certificate is malformed" when what happened is that their container was not recognised.
+// "your certificate is malformed" when what happened is that their container was not recognized.
 // guard.bytes is what finally reads them, and it accepts all four, so the door has to as well.
 function _isBytes(x) {
   return Buffer.isBuffer(x) || ArrayBuffer.isView(x) || x instanceof ArrayBuffer;

package/lib/guard-range.js

@@ -105,7 +105,7 @@ function uint64(value, E, code, label) {
 // take. Accepts a bigint, or a Number that is a safe integer (isSafeInteger, not
 // isInteger, because a Number above 2^53 has already lost precision by the time it
 // arrives), so a large identifier MUST come as a bigint and cannot be silently
-// rounded to a neighbour. Everything else is a config-time reject.
+// rounded to a neighbor. Everything else is a config-time reject.
 //
 // Distinct from int() on purpose: int() BOUNDS a value the wire decoded and narrows
 // it to Number; this one is unbounded and returns BigInt, because the field has no

package/lib/guard-secret.js

@@ -72,7 +72,7 @@ function zeroize(value, ErrorClass, code, label) {
 // @enforced-by behavioral -- this is a loop over zeroize, which carries the family's only
 // rename-proof shape (the `.fill(0)` above). It introduces no shape of its own, so a lexical
 // detector here would anchor on a renameable symbol and go silently green (drift rule sec. 3).
-// The behavioural guards are guard-secret.test.js (holes tolerated, every member cleared) and the
+// The behavioral guards are guard-secret.test.js (holes tolerated, every member cleared) and the
 // CMS vectors that assert the shared secret and KEK are wiped on both the success and failure paths.
 function zeroizeAll(list, ErrorClass, code, label) {
   if (!list) return list;

package/lib/guard-text.js

@@ -50,7 +50,7 @@ function decode(input, maxBytes, ErrorClass, spec) {
   if (Buffer.isBuffer(input)) {
     // Re-view through the byte guard first so a detached backing ArrayBuffer (a
     // transferred / structuredClone'd Buffer, which reads as zero-length) fails
-    // closed here -- the same detached-buffer defence the byte boundaries get --
+    // closed here -- the same detached-buffer defense the byte boundaries get --
     // instead of being decoded as an empty string. Then cap, then decode.
     input = bytes.view(input, ErrorClass, spec.badInput, spec.label);
     if (input.length > maxBytes) throw new ErrorClass(spec.tooLarge, spec.label + " exceeds the size cap");

package/lib/hpke.js

@@ -390,7 +390,7 @@ function _recipPrivate(suite, sk) {
 // psk / auth / auth-psk. An unknown mode must fail closed, never key-schedule
 // with an out-of-registry mode byte.
 // The sender and the recipient read the same option object from OPPOSITE ends, so each direction
-// gets its own table. A shared union recognises every name at both ends and so accepts the one that
+// gets its own table. A shared union recognizes every name at both ends and so accepts the one that
 // cannot do anything there: `senderPublicKey` handed to setupS, or
 // `senderKey` handed to setupR, is silently ignored, which is the exact silence these tables exist
 // to remove, in a wider form. An option that means nothing where it was passed is a misunderstanding

package/lib/http-digest.js

@@ -144,7 +144,7 @@ function _validateDigest(paramText, E, code) {
     ? p.domain.value.replace(/^\s+|\s+$/g, "").split(/\s+/) : null;
   // charset (RFC 7616 sec. 3.3): the one permitted value is the unquoted token "UTF-8". A quoted charset, or any
   // other value, is malformed, since answering it would hash the credentials in the wrong encoding, so it is
-  // rejected (and thus skipped during multi-offer selection in favour of a conforming offer).
+  // rejected (and thus skipped during multi-offer selection in favor of a conforming offer).
   if (p.charset && (p.charset.quoted || String(p.charset.value).toUpperCase() !== "UTF-8")) throw E(code, "the Digest charset must be the unquoted token UTF-8 (RFC 7616 sec. 3.3)");
   // stale (RFC 7616 sec. 3.3) is the unquoted token "true" or "false". A quoted or otherwise invalid value
   // (stale=maybe) is malformed and rejected (thus skipped in selection), never parsed as a false flag that

package/lib/jose.js

@@ -368,7 +368,7 @@ function assertPublicJwk(jwk) {
 // `key` NAMES the key this message must be signed under and `profile` selects which header rules
 // apply -- both narrow what verifies, so a misspelling of either silently widens it back to the
 // default. That is the shape this check exists for: the caller asked for something stricter and got
-// the looser behaviour, with nothing said.
+// the looser behavior, with nothing said.
 var _VERIFY_KEYS = { key: 1, profile: 1 };
 async function verify(jws, opts) {
   opts = opts || {};

package/lib/lint.js

@@ -231,7 +231,7 @@ function _subjectCNs(cert) {
   return out;
 }
 
-// An extension's criticality is honoured (RFC 5280 4.2: a consumer MUST reject a critical extension
+// An extension's criticality is honored (RFC 5280 4.2: a consumer MUST reject a critical extension
 // it cannot process) only when this toolkit actually processes its semantics. That authority is
 // path-validate's PROCESSED_EXTENSIONS (the RFC 5280 sec. 6.1 path-processing set), never the decoder
 // table: certExtensionDecoders also decodes many extensions purely for display (qcStatements, the MS

package/lib/ocsp.js

@@ -530,7 +530,7 @@ function verify(response, opts) {
     // the closed direction for `revoked`: revocation does not expire the way
     // non-revocation does, so discarding a signed, current, authorized revoked
     // verdict because it was replayed would hand a soft-fail caller the certificate
-    // the responder just refused -- turning the anti-replay defence into the thing
+    // the responder just refused -- turning the anti-replay defense into the thing
     // that accepts a revoked certificate. `nonceMatched: false` still reports that
     // this response was not bound to this request.
     if (!matched && verdict.status === "good") {

package/lib/oid.js

@@ -22,7 +22,7 @@
  *   attribute types, `2.5.29` for the extensions, `2.16.840.1.101.3.4` for
  *   the NIST algorithms), and each member names only its trailing arc. The
  *   full OID is derived from base + leaf at load, so the arc hierarchy that
- *   IS the OID namespace is modelled directly instead of re-spelled per
+ *   IS the OID namespace is modeled directly instead of re-spelled per
  *   entry. It covers the RFC 5280 attribute types and extensions, the
  *   classical signature / public-key / digest algorithms, and the
  *   NIST-assigned post-quantum arcs (ML-DSA, ML-KEM, SLH-DSA). Operators

package/lib/path-validate.js

@@ -306,7 +306,7 @@ function resolveDescriptor(sigAlg) {
 // defense). For the one-shot families whose public key shares the signature OID
 // (EdDSA, ML-DSA, SLH-DSA), Node's WebCrypto imports an SPKI of a DIFFERENT type
 // under the requested name and verifies with the real key, so an Ed25519-signed
-// certificate labelled SLH-DSA would otherwise validate. Enforce structurally:
+// certificate labeled SLH-DSA would otherwise validate. Enforce structurally:
 // the issuer SPKI's algorithm OID MUST equal the signature algorithm OID. (For
 // RSA/ECDSA -- different key vs signature OIDs -- WebCrypto's import already rejects
 // a mismatched key type, so `sameKeyOid` is not set and this is a no-op.)
@@ -1753,7 +1753,7 @@ function classifyCrls(parsed) {
       // sec. 5.2.4 @3447 makes deltaCRLIndicator a MUST-be-critical extension. A non-critical one
       // is non-conforming, so it does not earn the NEW capability of being merged -- merging can
       // RELEASE a certificate, and that must rest on a conforming indicator. It is still classified
-      // as a delta and still consulted for revocation, which is the shipped behaviour and the
+      // as a delta and still consulted for revocation, which is the shipped behavior and the
       // conservative direction.
       if (crlNumberWithinBound(n) && deltaCritical) { rec.baseCrlNumber = n; rec.mergeable = true; }
     } catch (_e) {
@@ -2393,7 +2393,7 @@ function ocspChecker(responses) {
  * `pki.schema.ocsp.parseResponse` result. A REBUILT parsed response is refused. A
  * signature check has three parts -- the signature, the algorithm that verifies it,
  * and the bytes it covers -- and on a parsed object all three are separate properties:
- * a genuine CA signature over a certificate that CA issued, relabelled, verifies as a
+ * a genuine CA signature over a certificate that CA issued, relabeled, verifies as a
  * ResponseData signature for a response that never existed. The parser marks what it
  * returns, so those three are known to have been derived together from one byte
  * string; `Object.assign`, spread and a JSON round-trip all drop the mark, which is
@@ -2795,7 +2795,7 @@ async function _fetchAiaIssuers(current, aia) {
     for (var c = 0; c < certs.length; c++) {
       var parsed;
       try { parsed = coerceCert(certs[c]); }
-      catch (_e3) { /* allow:swallow-unverified verified-unreachable: every cert here already passed the IDENTICAL x509.parse in _aiaParseBody (single-DER validates `body`; certs-only validates each via parseCertsOnly), so coerceCert re-parsing the same bytes cannot throw -- the guard stays as defence-in-depth */ continue; }
+      catch (_e3) { /* allow:swallow-unverified verified-unreachable: every cert here already passed the IDENTICAL x509.parse in _aiaParseBody (single-DER validates `body`; certs-only validates each via parseCertsOnly), so coerceCert re-parsing the same bytes cannot throw -- the guard stays as defense-in-depth */ continue; }
       out.push(parsed);
     }
   }
@@ -3111,7 +3111,7 @@ module.exports = {
   // The set of extension OIDs whose CRITICAL semantics this validator processes (RFC 5280 sec. 6.1).
   // Exposed so a linter can distinguish "processed" from "merely decoded" and stay consistent with
   // the path-validation verdict on a critical extension -- a decoder in certExtensionDecoders is NOT
-  // by itself proof the criticality is honoured. Both sets are frozen so a caller cannot mutate them.
+  // by itself proof the criticality is honored. Both sets are frozen so a caller cannot mutate them.
   PROCESSED_EXTENSIONS: PROCESSED_EXTENSIONS,
   // Extensions that ARE processed for an intermediate CA but are unprocessed on the target/leaf, so a
   // critical instance on the target fails closed (RFC 5280 sec. 6.1.5(f)) -- policyMappings is

package/lib/pki-build.js

@@ -129,7 +129,33 @@ function makeBuilder(ctx) {
         if (!Buffer.isBuffer(ipBuf) || (ipBuf.length !== 4 && ipBuf.length !== 16)) throw E("bad-input", "iPAddress must be a 4- or 16-octet Buffer or an IPv4/IPv6 string");
         return b.contextPrimitive(7, ipBuf);
       case "directoryName": return b.explicit(4, encodeName(v));   // Name is a CHOICE -> the context tag is EXPLICIT
-      default: throw E("bad-input", "unsupported GeneralName form " + JSON.stringify(k) + " (supported: rfc822Name, dNSName, uniformResourceIdentifier, iPAddress, directoryName)");
+      case "otherName":
+        // otherName ::= SEQUENCE { type-id OBJECT IDENTIFIER, value [0] EXPLICIT ANY }, tagged
+        // [0] IMPLICIT (RFC 5280 sec. 4.2.1.6). The value is EXPLICIT because ANY carries no tag
+        // of its own, so the wrapper is what makes the encoding unambiguous -- the same shape the
+        // decoder requires, and without it an SmtpUTF8Mailbox (RFC 8398 sec. 3) could be read but
+        // never written.
+        if (typeof v !== "object" || Buffer.isBuffer(v)) throw E("bad-input", "otherName must be an object { typeId, value }");
+        if (typeof v.typeId !== "string" || !v.typeId) throw E("bad-input", "otherName requires a `typeId` OID string");
+        if (!Buffer.isBuffer(v.value) || v.value.length === 0) {
+          throw E("bad-input", "otherName requires a `value` Buffer holding one DER element");
+        }
+        // The value is spliced in raw and this verb SIGNS the result, so it is strictly
+        // validated rather than taken on the caller's word. Framing alone is not DER: a
+        // BOOLEAN whose content octet is 0x01, a NumericString holding "@", or a SET in no
+        // canonical order all frame cleanly and would ship inside a [0] EXPLICIT wrapper
+        // under a real signature. guard.der.tlv is the one place that rule lives.
+        guard.der.tlv(v.value, E, "bad-input", "otherName `value`");
+        // [0] IMPLICIT on a SEQUENCE replaces the SEQUENCE tag, so the content is the two
+        // members concatenated -- build.contextConstructed takes content bytes, not elements.
+        // The type-id encode is wrapped so a malformed OID reports in the CALLER's namespace
+        // (x509/bad-input, csr/bad-input, ...) like every other raw-OID path here, rather than
+        // surfacing the codec's own oid/* code from a shared builder the caller never named.
+        var typeIdDer;
+        try { typeIdDer = b.oid(v.typeId); }
+        catch (e) { throw E("bad-input", "invalid otherName type-id OID " + JSON.stringify(v.typeId) + " (violates the X.660 arc bounds)", e); }
+        return b.contextConstructed(0, Buffer.concat([typeIdDer, b.explicit(0, v.value)]));
+      default: throw E("bad-input", "unsupported GeneralName form " + JSON.stringify(k) + " (supported: rfc822Name, dNSName, uniformResourceIdentifier, iPAddress, directoryName, otherName)");
     }
   }
 

package/lib/schema-c509.js

@@ -1594,17 +1594,9 @@ function _extValueFromDer(name, der) {
 // and RFC 3161 timestamping, and must not creep into a third consumer). On the ENCODE path such a value simply
 // degrades to the byte-exact ~oid + byte-string form, losing nothing; on the DECODE path it is a fail-closed
 // verdict.
-var _ANY_VALUE_READERS = (function () {
-  var m = {}, R = asn1.read, T = asn1.TAGS;
-  m[T.BOOLEAN] = R.boolean; m[T.INTEGER] = R.integer; m[T.ENUMERATED] = R.enumerated;
-  m[T.BIT_STRING] = R.bitString; m[T.OCTET_STRING] = R.octetString; m[T.NULL] = R.nullValue;
-  m[T.OBJECT_IDENTIFIER] = R.oid; m[T.UTC_TIME] = R.time; m[T.GENERALIZED_TIME] = R.time;
-  // NumericString reads through its own reader: it is not a DirectoryString type, and routing it through
-  // read.string would fold it into the RFC 5280 sec. 7.1 name-comparison identity class (see asn1-der.js).
-  m[T.NUMERIC_STRING] = R.numericString;
-  [T.UTF8_STRING, T.PRINTABLE_STRING, T.IA5_STRING, T.TELETEX_STRING, T.VISIBLE_STRING, T.BMP_STRING, T.UNIVERSAL_STRING].forEach(function (t) { m[t] = R.string; });
-  return m;
-})();
+// The per-type strict content readers, the SET canonical-order rule and the recursive element
+// walk all moved to guard.der, so this module and pki-build cannot drift on what "one strictly
+// valid DER element" means.
 
 // A universal SET's required member order depends on a type the ANY does not carry: X.690 sec. 11.6 orders a
 // SET OF by the members' full encodings, while a structured SET is ordered by TAG (X.680 sec. 8.6), and the two
@@ -1612,24 +1604,6 @@ var _ANY_VALUE_READERS = (function () {
 // tag but after it by octets). A structured SET cannot repeat a tag, so a repeated tag proves SET OF and the
 // octet rule binds; with all-distinct tags either reading is possible, so accept a value that satisfies EITHER
 // (rejecting only what is non-canonical under both readings: sound in both directions, never a guess).
-var _TAG_CLASS_RANK = { universal: 0, application: 1, context: 2, private: 3 };
-function _setOrderOk(kids) {
-  var i, dup = false, seen = {};
-  for (i = 0; i < kids.length; i++) {
-    var key = kids[i].tagClass + ":" + kids[i].tagNumber;
-    if (seen[key]) { dup = true; break; }
-    seen[key] = true;
-  }
-  var octetAsc = true, tagAsc = true;
-  for (i = 1; i < kids.length; i++) {
-    if (Buffer.compare(kids[i - 1].bytes, kids[i].bytes) > 0) octetAsc = false;
-    // Tag order ranks by CLASS first (universal < application < context < private, X.680 sec. 8.6), then by tag
-    // number. Compare the class's NUMBER: the names do not sort in class order.
-    var pc = _TAG_CLASS_RANK[kids[i - 1].tagClass], cc = _TAG_CLASS_RANK[kids[i].tagClass];
-    if (pc !== cc ? pc > cc : kids[i - 1].tagNumber > kids[i].tagNumber) tagAsc = false;
-  }
-  return dup ? octetAsc : (octetAsc || tagAsc);
-}
 
 // Strict-validate a decoded DER element at ANY depth, in the caller's error domain. Rejects the reserved EOC tag
 // 0; runs a universal primitive through its strict content reader (or rejects a type with none); recurses into a
@@ -1638,37 +1612,13 @@ function _setOrderOk(kids) {
 // components this gate cannot verify (the degenerate empty form is not a valid encoding of any of them), so it is
 // refused for the same reason an unvalidatable primitive is. A NON-universal element (a legitimately context- or
 // application-tagged ANY) passes on its framing, but its constructed children are still walked.
-function _strictDerElement(node, code, label) {
-  if (node.tagClass === "universal" && node.tagNumber === 0) throw _err(code, label + " must not use the reserved end-of-contents encoding (tag 0)");
-  if (node.constructed) {
-    if (node.tagClass === "universal" && node.tagNumber !== asn1.TAGS.SEQUENCE && node.tagNumber !== asn1.TAGS.SET) {
-      throw _err(code, label + " of universal constructed type " + node.tagNumber + " has no strict DER structure validator here");
-    }
-    var kids = node.children;   // asn1.decode always sets a (possibly empty) children array on a constructed node
-    for (var i = 0; i < kids.length; i++) _strictDerElement(kids[i], code, label);
-    if (node.tagClass === "universal" && node.tagNumber === asn1.TAGS.SET && !_setOrderOk(kids)) {
-      throw _err(code, label + " has a SET whose members are in no canonical DER order (X.690 sec. 11.6 / X.680 sec. 8.6)");
-    }
-    return;
-  }
-  if (node.tagClass === "universal") {
-    // Validate-or-reject: a universal primitive with no strict content reader is never accepted on framing alone
-    // (asn1.decode frames a malformed NumericString "12 01 40" happily), so the map is exhaustive by refusal.
-    var reader = _ANY_VALUE_READERS[node.tagNumber];
-    if (!reader) throw _err(code, label + " of universal type " + node.tagNumber + " has no strict DER content validator here");
-    try { reader(node); } catch (e) { throw _err(code, label + " is not a valid DER element for its type", e); }
-  }
-}
 // Raw ANY bytes about to be spliced verbatim must be exactly one non-empty, well-formed AND strictly-valid DER
-// element: framing + no-trailing-data via asn1.decode, then content / structure / SET order via
-// _strictDerElement, both reported in the CALLER's error domain. Returns the bytes so a call site can wrap a
-// splice inline. Used by every reconstruct site that emits caller-supplied ANY bytes verbatim.
+// element. The rule itself lives in guard.der -- framing + no-trailing-data, then content / structure / SET
+// order -- so this module and the certificate builder cannot drift apart on what "one DER element" means. This
+// stays as a named local because every reconstruct site here reads better naming the intent than the guard.
+
 function _requireStrictDerTlv(content, code, label) {
-  if (content.length === 0) throw _err(code, label + " must be a non-empty DER element");
-  var node;
-  try { node = asn1.decode(content); } catch (e) { throw _err(code, label + " must be exactly one well-formed DER element (no trailing data)", e); }
-  _strictDerElement(node, code, label);
-  return content;
+  return guard.der.tlv(content, _err, code, label);
 }
 
 // asn1.build.set SORTS its members, so handing it a non-canonically-ordered values list would silently rewrite
@@ -1700,7 +1650,7 @@ function _sdaToDer(node, isNative) {
       if (tname === undefined) throw _err("c509/bad-extensions", "a subjectDirectoryAttributes attribute type int " + ti + " has no C509 sec. 8.6 registry row");
       // countryName / serialNumber carry a CHARACTER restriction (draft sec. 3.1.4 "SHALL contain only
       // characters from the 74-character ASCII subset permitted by PrintableString"), and not a sign override --
-      // _reconAttrValue asserts the charset and honours the declared string type. Requiring the negative sign
+      // _reconAttrValue asserts the charset and honors the declared string type. Requiring the negative sign
       // here would also make these attributes unrepresentable in a NATIVE certificate, whose ints SHALL all be
       // non-negative (same sec.), so the rule is the charset, not the sign.
       for (var vi = 0; vi < valuesNode.children.length; vi++) {
@@ -1896,7 +1846,7 @@ function _reconAttrValue(rdn) {
   if (rdn.type === "emailAddress") return b.ia5(s);
   // serialNumber / countryName carry a CHARACTER restriction, not a string-type override: draft sec. 3.1.4
   // "SHALL contain only characters from the 74-character ASCII subset permitted by PrintableString". Enforce
-  // that on the CHARACTERS and still honour the sign for the string type. Coercing them to PrintableString
+  // that on the CHARACTERS and still honor the sign for the string type. Coercing them to PrintableString
   // regardless of sign would make the +N and -N encodings of one value reconstruct IDENTICAL DER, so a single
   // X.509 signature would cover two distinct C509 encodings (a malleability window in the type-3 transform).
   // b.printable IS the PrintableString charset authority -- run it for the assert even when the sign selects

package/lib/schema-cmp.js

@@ -460,7 +460,7 @@ var CERT_RESPONSE = schema.seq([
     // accepted (0) or grantedWithMods (1). Any other status (rejection, waiting,
     // the revocation / keyUpdate warnings) denies or defers the request, so a
     // certificate under it is a malformed response even when no explicit failInfo
-    // bit is set (a rejection is commonly signalled by status alone). Keying the
+    // bit is set (a rejection is commonly signaled by status alone). Keying the
     // rule off failInfo presence alone would let a bare-rejection status ship a
     // certificate (RFC 9810 sec. 5.3.4).
     if (certifiedKeyPair !== null && status.status.code !== 0 && status.status.code !== 1) {

package/lib/schema-crl.js

@@ -41,7 +41,7 @@ var CRL_REASONS = pkix.CRL_REASON_NAMES;
 
 // Extension-value decoding is keyed off the stable dotted OID (resolved once at
 // load from the canonical name) and not the mutable display name, so a caller's
-// pki.oid.register() display override cannot change parse behaviour.
+// pki.oid.register() display override cannot change parse behavior.
 var OID_CRL_NUMBER = oid.byName("cRLNumber");
 var OID_REASON_CODE = oid.byName("reasonCode");
 var OID_INVALIDITY_DATE = oid.byName("invalidityDate");

package/lib/schema-engine.js

@@ -40,11 +40,11 @@ function _fail(ctx, code, message) {
 }
 
 // ---- shape assertions ------------------------------------------------
-// A schema's `assert` mode is a real behaviour-preservation control: some
+// A schema's `assert` mode is a real behavior-preservation control: some
 // hand-written guards checked the universal SEQUENCE tag (algorithmIdentifier,
 // Name), others checked only that the node had children (Validity, SPKI, the
 // tbs body, an AttributeTypeAndValue). Collapsing them to one "is a SEQUENCE"
-// check would silently change behaviour on SET-wrapped input, so each is kept.
+// check would silently change behavior on SET-wrapped input, so each is kept.
 
 function _assertShape(schema, node, ctx) {
   var mode = schema.assert || "sequence";

package/lib/schema-pkix.js

@@ -1228,7 +1228,7 @@ function certExtensionDecoders(ns) {
 
   // qcStatements ::= SEQUENCE OF QCStatement (RFC 3739 sec. 3.2.6). QCStatement ::= SEQUENCE {
   // statementId OBJECT IDENTIFIER, statementInfo ANY DEFINED BY statementId OPTIONAL }. Known statementIds
-  // (RFC 3739 id-qcs + the ETSI EN 319 412-5 esi4 catalog) decode their statementInfo; an unknown statementId
+  // (RFC 3739 id-qcs + the ETSI EN 319 412-5 esi4 catalogue) decode their statementInfo; an unknown statementId
   // is preserved OPAQUE (the RFC 3739 open type), never rejected. The DEFINED-BY selection is an OID re-dispatch.
   function _qcStr(node, tag, C, what) {
     if (!node || node.tagClass !== "universal" || node.tagNumber !== tag) throw ns.E(C, what);

package/lib/smime.js

@@ -846,7 +846,7 @@ function _capped(msg) {
  * compared under RFC 5280 sec. 7.5: the local-part exactly, the host-part case-insensitively. The
  * address is read from the `subjectAltName` `rfc822Name` entries (RFC 8550 sec. 4.4.3) and, where the
  * extension carries none, from the subject DN's PKCS #9 `emailAddress` attribute, which RFC 8550 sec. 3
- * requires a receiving agent to recognise. Where both are present the extension wins. Only a signer
+ * requires a receiving agent to recognize. Where both are present the extension wins. Only a signer
  * whose signature verified contributes an identity, so a tampered message cannot report a binding. `match` is THREE-valued and a caller enforcing sender binding tests
  * `match === true` -- `false` means every identity was comparable and none matched, and `null` means the
  * question was not answered (no `expectedSender` and no single outer `From`, a signer certificate

package/lib/validator-cose.js

@@ -8,7 +8,7 @@
 // validator-cose -- the SINGLE home for "is this a conformant WebAuthn credential
 // COSE_Key" (RFC 9052 sec. 7 structure + RFC 9053 EC2/OKP/RSA key parameters + the
 // CTAP2 canonical-CBOR profile WebAuthn sec. 6.5.1 imposes). Sibling to the guard
-// family: where a guard owns a CVE-class fail-closed defence once, a validator owns a
+// family: where a guard owns a CVE-class fail-closed defense once, a validator owns a
 // decoded TYPE's COMPLETE conformance rule set once, so a format module composes the
 // family instead of re-deriving a partial subset inline (the drift that leaks MUSTs
 // out one review round at a time). Enforced by the validator-shape-reinlined
@@ -242,10 +242,10 @@ function assertKeyMaterial(key, E, code, unsupportedCode) {
   // PROFILE: the declared alg must match the key type (and, for EC2, the curve).
   var prof = ALG_PROFILE[String(key.alg)];
   // An algorithm this verifier does not implement is not a malformed key. The key can be perfectly
-  // well-formed (the same bytes may parse under a neighbouring algorithm id), and a relying
+  // well-formed (the same bytes may parse under a neighboring algorithm id), and a relying
   // party migrating credential rows written elsewhere needs to tell "I cannot check this
   // algorithm" from "these bytes are wrong", since only one of those is fixable by re-registering.
-  // Callers that do not distinguish the two pass one code and keep the previous behaviour.
+  // Callers that do not distinguish the two pass one code and keep the previous behavior.
   if (!prof) throw new E(unsupportedCode || code, "unsupported credential key algorithm " + key.alg);
   if (prof.kty !== key.kty) throw bad("credential key algorithm " + key.alg + " is inconsistent with key type " + key.kty);
   if (prof.crv != null && prof.crv !== key.crv) throw bad("credential key algorithm " + key.alg + " requires a different curve");