@blamejs/pki 0.8.2 → 0.8.3

package/CHANGELOG.md

@@ -4,6 +4,28 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.8.3 — 2026-09-25
+
+A parser takes decode caps from its caller, and a resource refusal says so instead of reading as malformed input.
+
+### Added
+
+- Every parse function takes an optional second argument of decode caps: `maxBytes`, `maxDepth` and `maxItems`. That includes `pki.schema.parse`, the format-detecting door, where the caps bound both the detection decode and the decode of whichever format matches. Each may tighten below the corresponding `pki.C.LIMITS` default and is refused with `<format>/bad-input` if it names a value above it, so a caller can bound a parse more strictly than the toolkit does and cannot grant itself more resource than the built-in refusal allows. An option outside that set is named in the refusal rather than ignored.
+- A new `<format>/too-large` code on each format, reported when a decode limit refuses the input.
+
+### Changed
+
+- An input refused for exceeding a decode limit reports `<format>/too-large` where it previously reported `<format>/bad-der`. The two say different things to whoever reads them: one is answered by raising a cap, the other by fixing the bytes. A caller matching on `bad-der` to detect malformed input will stop seeing oversized and over-nested inputs under that code.
+
+### Fixed
+
+- A parse that exhausts its decode budget cannot report anything but a refusal, even when code inside the parse catches the failure. The budget latches on exhaustion, and each parser door re-reads that latch after its walk and before returning a result, so a `catch` between the two can absorb the exception and still not produce a value. This is the guarantee that makes the caps worth relying on: without it any of the toolkit's error-absorbing paths could turn `over budget` into an ordinary absent value and change a verdict.
+- The caps a caller names are read into a fresh object, and no flag is ever written onto the object the caller passed or onto the one the decode receives. A resource option therefore cannot alter which encodings a parse accepts; the strictness of a parse is the same whatever caps are asked for.
+
+### Documentation
+
+- The caps bound the decode of the input a parser is given, which is what bounds a parse overall, since everything a parse reads comes from those bytes. A structure decoded separately from inside that input keeps the built-in `pki.C.LIMITS` defaults rather than a tighter figure the caller named.
+
 ## v0.8.2 — 2026-09-25
 
 A distinguished name can be read back from its string form, and twelve attributes the name table published can finally be encoded.

package/lib/guard-limits.js

@@ -65,4 +65,51 @@ function byteCap(buf, max, E, code, label) {
   return buf;
 }
 
-module.exports = _freeze({ cap: cap, depthCap: depthCap, counter: counter, byteCap: byteCap });
+/** @internal Thrown when a parse exhausts its resource budget. It is not a PkiError subclass,
+ *  so a `catch (e) { if (e instanceof PkiError) ...; throw e; }` re-throws it. A parser door
+ *  converts it to that door's typed refusal, so the public contract is unchanged. */
+function BudgetExceeded(message) {
+  var e = new Error(message);
+  e.name = "BudgetExceeded";
+  e.budgetExceeded = true;
+  return e;
+}
+
+function isBudgetExceeded(e) {
+  return !!(e && e.budgetExceeded === true);
+}
+
+/** @internal One budget per top-level parse, carried into every nested decode. `exhausted`
+ *  latches, and the object is frozen, so a caller that catches the throw cannot clear it. A
+ *  door that re-reads the latch before returning a result therefore still refuses, whatever
+ *  code between the two caught the exception. */
+function budget(limits) {
+  var spent = 0;
+  var exhausted = false;
+  var max = cap(limits ? limits.maxBytes : undefined, "maxBytes", constants.LIMITS.DER_MAX_BYTES);
+  var self = {
+    spend: function (n, what) {
+      if (!_isInteger(n) || n < 0) throw new TypeError("guard.limits.budget: spend takes a non-negative integer");
+      spent += n;
+      if (spent > max) {
+        exhausted = true;
+        throw BudgetExceeded((what || "the parse") + " exceeds the " + max + "-byte budget for this parse");
+      }
+      return n;
+    },
+    trip: function (what) {
+      exhausted = true;
+      throw BudgetExceeded((what || "the parse") + " exceeds the budget for this parse");
+    },
+    exhausted: function () { return exhausted; },
+    spent: function () { return spent; },
+    remaining: function () { return max - spent; },
+    max: function () { return max; },
+  };
+  return _freeze(self);
+}
+
+module.exports = _freeze({
+  cap: cap, depthCap: depthCap, counter: counter, byteCap: byteCap,
+  budget: budget, isBudgetExceeded: isBudgetExceeded,
+});

package/lib/guard-parsed.js

@@ -144,10 +144,10 @@ var PROVENANCE = new _WeakMap();
 
 // @enforced-by guard-shape-reinlined -- shares the fromTrustedSource shape below; a
 function recordingParser(kind, parse, ErrorClass, code, label) {
-  return function (input) {
+  return function (input, callerOpts) {
     var isText = typeof input === "string";
     var snap = isText ? input : bytes.snapshotSource(input, ErrorClass, code, label);
-    var out = parse(snap);
+    var out = parse(snap, callerOpts);
     if (out && typeof out === "object") {
       _weakSet(PROVENANCE, out, { kind: kind, source: isText ? snap : _bufferFrom(snap),
         shape: _shapeOf(out) });

package/lib/schema-all.js

@@ -60,85 +60,85 @@ var FORMATS = [
     name: "cms",
     module: cms,
     detect: cms.matches,
-    parse: function (input) { return cms.parse(input); },
+    parse: function (input, caps) { return cms.parse(input, caps); },
   },
   {
     name: "tsp",
     module: tsp,
     detect: tsp.matches,
-    parse: function (input) { return tsp.parse(input); },
+    parse: function (input, caps) { return tsp.parse(input, caps); },
   },
   {
     name: "crmf",
     module: crmf,
     detect: crmf.matches,
-    parse: function (input) { return crmf.parse(input); },
+    parse: function (input, caps) { return crmf.parse(input, caps); },
   },
   {
     name: "cmp",
     module: cmp,
     detect: cmp.matches,
-    parse: function (input) { return cmp.parse(input); },
+    parse: function (input, caps) { return cmp.parse(input, caps); },
   },
   {
     name: "csrattrs",
     module: csrattrs,
     detect: csrattrs.matches,
-    parse: function (input) { return csrattrs.parse(input); },
+    parse: function (input, caps) { return csrattrs.parse(input, caps); },
   },
   {
     name: "ocsp-request",
     module: ocsp,
     detect: ocsp.matchesRequest,
-    parse: function (input) { return ocsp.parseRequest(input); },
+    parse: function (input, caps) { return ocsp.parseRequest(input, caps); },
   },
   {
     name: "ocsp-response",
     module: ocsp,
     detect: ocsp.matchesResponse,
-    parse: function (input) { return ocsp.parseResponse(input); },
+    parse: function (input, caps) { return ocsp.parseResponse(input, caps); },
   },
   {
     name: "pkcs12",
     module: pkcs12,
     detect: pkcs12.matches,
-    parse: function (input) { return pkcs12.parse(input); },
+    parse: function (input, caps) { return pkcs12.parse(input, caps); },
   },
   {
     name: "pkcs8",
     module: pkcs8,
     detect: pkcs8.matches,
-    parse: function (input) { return pkcs8.parse(input); },
+    parse: function (input, caps) { return pkcs8.parse(input, caps); },
   },
   {
     name: "csr",
     module: csr,
     detect: csr.matches,
-    parse: function (input) { return csr.parse(input); },
+    parse: function (input, caps) { return csr.parse(input, caps); },
   },
   {
     name: "attrcert",
     module: attrcert,
     detect: attrcert.matches,
-    parse: function (input) { return attrcert.parse(input); },
+    parse: function (input, caps) { return attrcert.parse(input, caps); },
   },
   {
     name: "attrcert-v1",
     module: attrcert,
     detect: attrcert.matchesV1,
-    parse: function (input) { return attrcert.parseV1(input); },
+    parse: function (input, caps) { return attrcert.parseV1(input, caps); },
   },
   {
     name: "crl",
     module: crl,
     detect: crl.matches,
-    parse: function (input) { return crl.parse(input); },
+    parse: function (input, caps) { return crl.parse(input, caps); },
   },
   {
     name: "x509",
     module: x509,
     detect: x509.matches,
-    parse: function (input) { return x509.parse(input); },
+    parse: function (input, caps) { return x509.parse(input, caps); },
   },
 ];
 
@@ -159,7 +159,7 @@ function all() { return FORMATS.map(function (f) { return f.name; }); }
 
 /**
  * @primitive  pki.schema.parse
- * @signature  pki.schema.parse(input) -> parsed
+ * @signature  pki.schema.parse(input, caps?) -> parsed
  * @since      0.1.7
  * @status     stable
  * @spec       RFC 5280
@@ -171,6 +171,13 @@ function all() { return FORMATS.map(function (f) { return f.name; }); }
  * the bytes match no registered format; the underlying decode / structural
  * errors of the matched format propagate unchanged.
  *
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. They bound the detection decode
+ *     and the decode of whichever format matches, and a parse that exceeds one is refused
+ *     with the `/too-large` code of that format.
+ *
  * @example
  *   var pair = await pki.key.generate("Ed25519");
  *   var der = await pki.x509.sign({ subject: "example.com", subjectPublicKey: await pki.key.export(pair.publicKey),
@@ -178,11 +185,15 @@ function all() { return FORMATS.map(function (f) { return f.name; }); }
  *     { key: await pki.key.export(pair.privateKey) });
  *   var parsed = pki.schema.parse(der);  // cert -> the pki.schema.x509 shape
  */
-function parse(input) {
+function parse(input, callerOpts) {
+  /** @internal The caps are validated once here and the snapshot is what the chosen format
+   *  receives, so the detection decode and the format's own decode are held to the same
+   *  figures a caller named, read once. */
+  var caps = pkix.parseCaps(callerOpts, ENTRY);
   var der = pkix.coerceToDer(input, ENTRY);
-  var root = pkix.decodeRoot(der, ENTRY);
+  var root = pkix.decodeRoot(der, ENTRY, caps);
   for (var i = 0; i < FORMATS.length; i++) {
-    if (FORMATS[i].detect(root)) return FORMATS[i].parse(der);
+    if (FORMATS[i].detect(root)) return FORMATS[i].parse(der, caps);
   }
   throw new SchemaError("schema/unknown-format", "input does not match any registered PKI format (" + all().join(", ") + ")");
 }

package/lib/schema-attrcert.js

@@ -248,7 +248,7 @@ var ATTRIBUTE_CERTIFICATE = pkix.signedEnvelope(NS, ACINFO, {
 
 /**
  * @primitive  pki.schema.attrcert.parse
- * @signature  pki.schema.attrcert.parse(input) -> attributeCertificate
+ * @signature  pki.schema.attrcert.parse(input, caps?) -> attributeCertificate
  * @since      0.1.14
  * @status     stable
  * @spec       RFC 5755, X.509
@@ -279,25 +279,32 @@ var ATTRIBUTE_CERTIFICATE = pkix.signedEnvelope(NS, ACINFO, {
  *   var ac = pki.schema.attrcert.parse(der);
  *   ac.attributes[0].name;   // "role"
  *   ac.validity.notAfterTime;// Date
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
-var PARSE_OPTS = intrinsic.assign(intrinsic.create(null), { pemLabel: "ATTRIBUTE CERTIFICATE", PemError: PemError, ErrorClass: AttrCertError, prefix: "attrcert", what: "attribute certificate" });
+var PARSE_OPTS = intrinsic.assign(intrinsic.create(null), { pemLabel: "ATTRIBUTE CERTIFICATE", PemError: PemError, ErrorClass: AttrCertError, prefix: "attrcert", what: "attribute certificate", ns: NS });
 
 function _legacyV1Error() {
   return new AttrCertError("attrcert/legacy-v1-not-supported", "AttributeCertificateV1 (X.509-1997) is obsolete and not parsed by this build (RFC 5755 sec. 1)");
 }
 
-function _parseAc(input) {
-  var root = pkix.decodeRoot(pkix.coerceToDer(input, PARSE_OPTS), PARSE_OPTS);
-  if (matchesV1(root)) throw _legacyV1Error();
-  return schema.walk(ATTRIBUTE_CERTIFICATE, root, NS).result;
+function _parseAc(input, callerOpts) {
+  return pkix.runParseWith(input, PARSE_OPTS, callerOpts, function (root, ns) {
+    if (matchesV1(root)) throw _legacyV1Error();
+    return schema.walk(ATTRIBUTE_CERTIFICATE, root, ns).result;
+  });
 }
 
 var parse = guard.parsed.recordingParser("attributeCertificate", _parseAc,
   AttrCertError, "attrcert/bad-input", "an attribute certificate");
 
-function parseV1(input) {
-  pkix.decodeRoot(pkix.coerceToDer(input, PARSE_OPTS), PARSE_OPTS);
-  throw _legacyV1Error();
+function parseV1(input, callerOpts) {
+  return pkix.runParseWith(input, PARSE_OPTS, callerOpts, function () {
+    throw _legacyV1Error();
+  });
 }
 
 /**

package/lib/schema-c509.js

@@ -1563,7 +1563,7 @@ function _reconstructDer(r, sigNode) {
 
 /**
  * @primitive  pki.schema.c509.parse
- * @signature  pki.schema.c509.parse(bytes) -> { certificateType, serialNumber, serialNumberHex, ... }
+ * @signature  pki.schema.c509.parse(bytes, caps?) -> { certificateType, serialNumber, serialNumberHex, ... }
  * @since      0.2.30
  * @status     stable
  * @spec       draft-ietf-cose-cbor-encoded-cert, RFC 8949, RFC 9090, RFC 5280
@@ -1583,11 +1583,27 @@ function _reconstructDer(r, sigNode) {
  *     "hex");
  *   var c = pki.schema.c509.parse(bytes);
  *   c.certificateType; // 3
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
-function parse(input) {
+var _PARSE_OPTS = pkix.cborParseOpts(C509Error, "c509", "the C509 certificate");
+
+function parse(input, callerOpts) {
+  var caps = pkix.parseCaps(callerOpts, _PARSE_OPTS);
   var root;
-  try { root = cbor.decode(input); }
-  catch (e) { throw _err("c509/not-a-certificate", "the input is not well-formed deterministic CBOR", e); }
+  try {
+    root = cbor.decode(input, { maxBytes: caps.maxBytes, maxDepth: caps.maxDepth, maxItems: caps.maxItems });
+  } catch (e) {
+    /** @internal A resource refusal from the CBOR reader says the cap was too small. Reading it
+     *  as "these bytes are not a certificate" would send a caller to look at the wrong thing. */
+    if (pkix.isCborResourceRefusal(e)) {
+      throw _err("c509/too-large", "the C509 certificate exceeds the decode budget for this parse: " + ((e && e.message) || ""), e);
+    }
+    throw _err("c509/not-a-certificate", "the input is not well-formed deterministic CBOR", e);
+  }
   if (root.majorType !== 4 || !root.children) throw _err("c509/not-a-certificate", "a C509 certificate must be a CBOR array");
   var f = root.children;
   if (f.length !== 11) throw _err("c509/bad-tbs", "a C509 certificate must be an array of exactly 11 elements, got " + f.length);

package/lib/schema-cmc.js

@@ -646,7 +646,7 @@ function _finishBody(body, where) {
 
 /**
  * @primitive  pki.schema.cmc.parsePkiData
- * @signature  pki.schema.cmc.parsePkiData(der) -> parsed
+ * @signature  pki.schema.cmc.parsePkiData(der, caps?) -> parsed
  * @since      0.4.16
  * @status     stable
  * @spec       RFC 5272 sec. 3.2.1
@@ -664,17 +664,23 @@ function _finishBody(body, where) {
  *   var der = b.sequence([b.sequence([]), b.sequence([]), b.sequence([]), b.sequence([])]);
  *   var d = pki.schema.cmc.parsePkiData(der);
  *   d.controls.length;   // 0 -- present and empty, which is legal
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
-function parsePkiData(input) {
-  var root = asn1.decode(guard.bytes.isByteSource(input) ? guard.bytes.source(input, E, "cmc/bad-input", "the CMC DER") : Buffer.from(input));
-  var body = schema.walk(PKI_DATA, root, NS).result;
-  body.bytes = root.bytes;
-  return _finishBody(body, "pkiData");
+function parsePkiData(input, callerOpts) {
+  return pkix.runParseWith(input, _BODY_PARSE_OPTS, callerOpts, function (root, ns) {
+    var body = schema.walk(PKI_DATA, root, ns).result;
+    body.bytes = root.bytes;
+    return _finishBody(body, "pkiData");
+  });
 }
 
 /**
  * @primitive  pki.schema.cmc.parsePkiResponse
- * @signature  pki.schema.cmc.parsePkiResponse(der) -> parsed
+ * @signature  pki.schema.cmc.parsePkiResponse(der, caps?) -> parsed
  * @since      0.4.16
  * @status     stable
  * @spec       RFC 5272 sec. 4.2.1
@@ -690,17 +696,33 @@ function parsePkiData(input) {
  *   var der = b.sequence([b.sequence([]), b.sequence([]), b.sequence([])]);
  *   var r = pki.schema.cmc.parsePkiResponse(der);
  *   r.statuses.length;   // 0 -- no status control means success is assumed
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
-function parsePkiResponse(input) {
-  var root = asn1.decode(guard.bytes.isByteSource(input) ? guard.bytes.source(input, E, "cmc/bad-input", "the CMC DER") : Buffer.from(input));
-  var body = schema.walk(PKI_RESPONSE, root, NS).result;
-  body.bytes = root.bytes;
-  return _finishBody(body, "pkiResponse");
+function parsePkiResponse(input, callerOpts) {
+  return pkix.runParseWith(input, _BODY_PARSE_OPTS, callerOpts, function (root, ns) {
+    var body = schema.walk(PKI_RESPONSE, root, ns).result;
+    body.bytes = root.bytes;
+    return _finishBody(body, "pkiResponse");
+  });
 }
 
+/** @internal The door options for the two body parsers, which read a bare DER body rather than
+ *  a CMS carrier, so they take no PEM label. `rawDecodeErrors` keeps the codec's own code for a
+ *  malformed body, which callers already pin. */
+var _CARRIER_PARSE_OPTS = pkix.parseOpts({ ErrorClass: CmcError, prefix: "cmc", what: "the CMC message" });
+
+var _BODY_PARSE_OPTS = pkix.parseOpts({
+  ns: NS, ErrorClass: CmcError, PemError: CmcError, prefix: "cmc",
+  what: "the CMC body", pemLabel: null, rawDecodeErrors: true,
+});
+
 /**
  * @primitive  pki.schema.cmc.parse
- * @signature  pki.schema.cmc.parse(input) -> parsed
+ * @signature  pki.schema.cmc.parse(input, caps?) -> parsed
  * @since      0.4.16
  * @status     stable
  * @spec       RFC 5272, RFC 6402
@@ -724,17 +746,31 @@ function parsePkiResponse(input) {
  *   var sd = b.sequence([b.integer(3n), b.set([]), encap, b.set([])]);
  *   var der = b.sequence([b.oid("1.2.840.113549.1.7.2"), b.explicit(0, sd)]);
  *   pki.schema.cmc.parse(der).kind;   // "pkiData"
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
-function parse(input) {
+function parse(input, callerOpts) {
+  /** @internal Before the branch, because the already-parsed arm reaches no decode and would
+   *  otherwise hold a caller to the option contract only when they passed bytes. The snapshot
+   *  is what travels onward: handing the caller's own object to the CMS parser would read each
+   *  cap a second time, and a value read twice need not answer the same way twice. */
+  var caps = pkix.parseCaps(callerOpts, _CARRIER_PARSE_OPTS);
   var alreadyParsed = input && typeof input === "object" && !ArrayBuffer.isView(input) &&
     !guard.bytes.isByteSource(input) && input.encapContentInfo != null;
   var parsedCms;
   if (alreadyParsed) { parsedCms = input; }
   else {
     /** @internal Bytes that are not a CMS message at all are a CMC message this cannot read, and every
-     * other format parser answers for its own input in its own domain. */
-    try { parsedCms = cms.parse(input); }
+     * other format parser answers for its own input in its own domain. A resource refusal is the one
+     * exception: it is not a statement about the bytes, so it keeps its own code. */
+    try { parsedCms = cms.parse(input, caps); }
     catch (e) {
+      if (e && typeof e.code === "string" && e.code.indexOf("/too-large") !== -1) {
+        throw E("cmc/too-large", "the CMC message exceeds the decode budget for this parse: " + (e.message || ""), e);
+      }
       throw E("cmc/bad-der",
         "a CMC message is carried in a CMS SignedData or AuthenticatedData, and these bytes are not " +
         "one: " + ((e && e.message) || "malformed") + " (RFC 5272 sec. 3.2 / 4.2)", e);

package/lib/schema-cmp.js

@@ -751,7 +751,7 @@ var readName = _valueParser("Name", pkix.name(NS));
 
 /**
  * @primitive  pki.schema.cmp.parse
- * @signature  pki.schema.cmp.parse(input) -> pkiMessage
+ * @signature  pki.schema.cmp.parse(input, caps?) -> pkiMessage
  * @since      0.1.19
  * @status     stable
  * @spec       RFC 9810, RFC 9483, RFC 9481
@@ -805,6 +805,11 @@ var readName = _valueParser("Name", pkix.name(NS));
  *   var m = pki.schema.cmp.parse(der);
  *   m.body.arm;             // "ir", "ip", "error", ...
  *   m.header.transactionID; // raw Buffer or null
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parse = pkix.makeParser({
   pemLabel: "CMP", PemError: PemError, ErrorClass: CmpError,

package/lib/schema-cms.js

@@ -934,7 +934,7 @@ var CONTENT_INFO = schema.seq([
 
 /**
  * @primitive  pki.schema.cms.parse
- * @signature  pki.schema.cms.parse(input) -> content
+ * @signature  pki.schema.cms.parse(input, caps?) -> content
  * @since      0.1.10
  * @status     stable
  * @spec       RFC 5652, RFC 5083, RFC 9629
@@ -972,6 +972,11 @@ var CONTENT_INFO = schema.seq([
  *   var cms = pki.schema.cms.parse(der);
  *   cms.signerInfos[0].sid.serialNumberHex;   // -> "0a1b"
  *   cms.encapContentInfo.eContent;            // -> Buffer | null (detached)
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parse = pkix.makeRecordingParser({ pemLabel: "CMS", PemError: PemError, ErrorClass: CmsError, prefix: "cms", what: "CMS ContentInfo", topSchema: CONTENT_INFO, ns: NS }, "cms");
 

package/lib/schema-crl.js

@@ -157,7 +157,7 @@ var CERTIFICATE_LIST = pkix.signedEnvelope(NS, TBS_CERTLIST, {
 
 /**
  * @primitive  pki.schema.crl.parse
- * @signature  pki.schema.crl.parse(input) -> crl
+ * @signature  pki.schema.crl.parse(input, caps?) -> crl
  * @since      0.1.7
  * @status     stable
  * @spec       RFC 5280
@@ -180,6 +180,11 @@ var CERTIFICATE_LIST = pkix.signedEnvelope(NS, TBS_CERTLIST, {
  *     { cert: caCert, key: key });
  *   var crl = pki.schema.crl.parse(der);
  *   crl.revokedCertificates[0].serialNumberHex;  // -> "0a3f"
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parse = pkix.makeRecordingParser({ pemLabel: "X509 CRL", PemError: PemError, ErrorClass: CrlError, prefix: "crl", what: "CRL", topSchema: CERTIFICATE_LIST, ns: NS }, "crl");
 

package/lib/schema-crmf.js

@@ -311,7 +311,7 @@ var CERT_REQ_MESSAGES = schema.seqOf(CERT_REQ_MSG, {
 
 /**
  * @primitive  pki.schema.crmf.parse
- * @signature  pki.schema.crmf.parse(input) -> certReqMessages
+ * @signature  pki.schema.crmf.parse(input, caps?) -> certReqMessages
  * @since      0.1.17
  * @status     stable
  * @spec       RFC 4211
@@ -348,6 +348,11 @@ var CERT_REQ_MESSAGES = schema.seqOf(CERT_REQ_MSG, {
  *     { key: await pki.key.export(pair.privateKey) });
  *   var m = pki.schema.crmf.parse(der);
  *   m.messages[0].certReq.certTemplate.subject.dn;   // "CN=req.example"
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parse = pkix.makeRecordingParser({
   pemLabel: null, PemError: PemError, ErrorClass: CrmfError, prefix: "crmf",

package/lib/schema-csr.js

@@ -121,7 +121,7 @@ var CERTIFICATION_REQUEST = pkix.signedEnvelope(NS, CERTIFICATION_REQUEST_INFO,
 
 /**
  * @primitive  pki.schema.csr.parse
- * @signature  pki.schema.csr.parse(input) -> csr
+ * @signature  pki.schema.csr.parse(input, caps?) -> csr
  * @since      0.1.8
  * @status     stable
  * @spec       RFC 2986
@@ -147,6 +147,11 @@ var CERTIFICATION_REQUEST = pkix.signedEnvelope(NS, CERTIFICATION_REQUEST_INFO,
  *   var csr = pki.schema.csr.parse(der);
  *   csr.subject.dn;             // -> "CN=req.example"
  *   csr.attributes[0].type;     // -> "1.2.840.113549.1.9.14"
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parse = pkix.makeRecordingParser({ pemLabel: "CERTIFICATE REQUEST", PemError: PemError, ErrorClass: CsrError, prefix: "csr", what: "certification request", topSchema: CERTIFICATION_REQUEST, ns: NS }, "csr");
 

package/lib/schema-csrattrs.js

@@ -244,7 +244,7 @@ var CSR_ATTRS = schema.seqOf(ATTR_OR_OID, {
 
 /**
  * @primitive  pki.schema.csrattrs.parse
- * @signature  pki.schema.csrattrs.parse(der) -> { items }
+ * @signature  pki.schema.csrattrs.parse(der, caps?) -> { items }
  * @since      0.1.24
  * @status     stable
  * @spec       RFC 8951, RFC 9908, RFC 7030
@@ -269,6 +269,11 @@ var CSR_ATTRS = schema.seqOf(ATTR_OR_OID, {
  *   ]);
  *   var a = pki.schema.csrattrs.parse(der);
  *   a.items[0].kind;   // -> "oid" | "attribute"
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parse = pkix.makeParser({ pemLabel: null, PemError: frameworkError.PemError, ErrorClass: CsrattrsError, prefix: "csrattrs", what: "CsrAttrs", topSchema: CSR_ATTRS, ns: NS });
 

package/lib/schema-ocsp.js

@@ -431,7 +431,7 @@ var OCSP_REQUEST = schema.seq([
 
 /**
  * @primitive  pki.schema.ocsp.parseRequest
- * @signature  pki.schema.ocsp.parseRequest(input) -> ocspRequest
+ * @signature  pki.schema.ocsp.parseRequest(input, caps?) -> ocspRequest
  * @since      0.1.11
  * @status     stable
  * @spec       RFC 6960
@@ -458,12 +458,17 @@ var OCSP_REQUEST = schema.seq([
  *   var der = await pki.ocsp.buildRequest({ cert: leafDer, issuer: caDer }, {});
  *   var req = pki.schema.ocsp.parseRequest(der);
  *   req.requestList[0].certID.serialNumberHex;   // -> "1332"
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parseRequest = pkix.makeParser({ pemLabel: "OCSP REQUEST", PemError: PemError, ErrorClass: OcspError, prefix: "ocsp", what: "OCSP request", topSchema: OCSP_REQUEST, ns: NS });
 
 /**
  * @primitive  pki.schema.ocsp.parseResponse
- * @signature  pki.schema.ocsp.parseResponse(input) -> ocspResponse
+ * @signature  pki.schema.ocsp.parseResponse(input, caps?) -> ocspResponse
  * @since      0.1.11
  * @status     stable
  * @spec       RFC 6960
@@ -495,6 +500,11 @@ var parseRequest = pkix.makeParser({ pemLabel: "OCSP REQUEST", PemError: PemErro
  *   var res = pki.schema.ocsp.parseResponse(der);
  *   res.responseStatus.name;                       // -> "successful"
  *   res.basicResponse.responses[0].certStatus.type; // -> "good" | "revoked" | "unknown"
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parseResponse = pkix.makeRecordingParser({ pemLabel: "OCSP RESPONSE", PemError: PemError, ErrorClass: OcspError, prefix: "ocsp", what: "OCSP response", topSchema: OCSP_RESPONSE, ns: NS }, "ocspResponse");
 

package/lib/schema-pkcs12.js

@@ -396,7 +396,7 @@ function _buildBag(rec, state, ctx) {
 
 /**
  * @primitive  pki.schema.pkcs12.parse
- * @signature  pki.schema.pkcs12.parse(input) -> pfx
+ * @signature  pki.schema.pkcs12.parse(input, caps?) -> pfx
  * @since      0.1.18
  * @status     stable
  * @spec       RFC 7292, RFC 9579
@@ -441,6 +441,11 @@ function _buildBag(rec, state, ctx) {
  *   var der = await pki.pkcs12.build({ key: key, cert: cert }, { password: "changeit" });
  *   var store = pki.schema.pkcs12.parse(der);
  *   store.safeBags.map(function (b) { return b.type; });
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parse = pkix.makeRecordingParser({
   pemLabel: "PKCS12", PemError: PemError, ErrorClass: Pkcs12Error,

package/lib/schema-pkcs8.js

@@ -88,7 +88,7 @@ var ENCRYPTED_PRIVATE_KEY_INFO = schema.seq([
 
 /**
  * @primitive  pki.schema.pkcs8.parse
- * @signature  pki.schema.pkcs8.parse(input) -> privateKey
+ * @signature  pki.schema.pkcs8.parse(input, caps?) -> privateKey
  * @since      0.1.9
  * @status     stable
  * @spec       RFC 5208, RFC 5958
@@ -107,12 +107,17 @@ var ENCRYPTED_PRIVATE_KEY_INFO = schema.seq([
  *   var key = pki.schema.pkcs8.parse(der);
  *   key.privateKeyAlgorithm.oid;   // -> "1.3.101.112" (Ed25519)
  *   key.privateKey;                // -> Buffer (the inner key encoding)
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parse = pkix.makeParser({ pemLabel: "PRIVATE KEY", PemError: PemError, ErrorClass: Pkcs8Error, prefix: "pkcs8", what: "private key", topSchema: PRIVATE_KEY_INFO, ns: NS });
 
 /**
  * @primitive  pki.schema.pkcs8.parseEncrypted
- * @signature  pki.schema.pkcs8.parseEncrypted(input) -> encrypted
+ * @signature  pki.schema.pkcs8.parseEncrypted(input, caps?) -> encrypted
  * @since      0.1.9
  * @status     stable
  * @spec       RFC 5958, RFC 5208
@@ -128,6 +133,11 @@ var parse = pkix.makeParser({ pemLabel: "PRIVATE KEY", PemError: PemError, Error
  *   var der = await pki.key.encrypt(await pki.key.export(pair.privateKey), "s3cr3t");
  *   var enc = pki.schema.pkcs8.parseEncrypted(der);
  *   enc.encryptionAlgorithm.oid;   // -> "1.2.840.113549.1.5.13" (PBES2)
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parseEncrypted = pkix.makeParser({ pemLabel: "ENCRYPTED PRIVATE KEY", PemError: PemError, ErrorClass: Pkcs8Error, prefix: "pkcs8", what: "encrypted private key", topSchema: ENCRYPTED_PRIVATE_KEY_INFO, ns: NS });
 

package/lib/schema-pkix.js

@@ -219,15 +219,155 @@ function _isPemArmor(buf) {
   return true;
 }
 
-function decodeRoot(der, opts) {
-  try { return asn1.decode(der, opts.ber ? { ber: true } : undefined); }
+/** @internal The codec's resource refusals, as distinct from its malformed-input refusals. A
+ *  caller who tightened a cap has to be able to tell "your bytes are wrong" from "your cap is
+ *  too small", and only the second is answered by raising the cap. */
+var RESOURCE_REFUSALS = intrinsic.assign(intrinsic.create(null), {
+  "asn1/too-large": 1, "asn1/too-deep": 1, "asn1/too-many-items": 1,
+});
+
+function decodeRoot(der, opts, caps, budget) {
+  try { return asn1.decode(der, _decodeOptions(opts, caps)); }
   catch (e) {
+    /** @internal `rawDecodeErrors` keeps the codec's own code for a malformed body, which some
+     *  callers pin. A resource refusal is still translated, that code being new. */
+    if (opts.rawDecodeErrors && !(e && RESOURCE_REFUSALS[e.code])) throw e;
+    if (e && RESOURCE_REFUSALS[e.code]) {
+      if (budget) {
+        try {
+          budget.trip(opts.what || "the input");
+        } catch (_b) {
+          /* allow:swallow-unverified the latch is the point here; the refusal below carries the cause */
+        }
+      }
+      throw new opts.ErrorClass(opts.prefix + "/too-large",
+        (opts.what || "the input") + " exceeds the decode budget for this parse: " + (e.message || _String(e)), e);
+    }
     throw new opts.ErrorClass(opts.prefix + "/bad-der", (opts.what || "input") + " DER did not decode: " + ((e && e.message) || _String(e)), e);
   }
 }
 
-function runParse(input, opts) {
-  return schema.walk(opts.topSchema, decodeRoot(coerceToDer(input, opts), opts), opts.ns).result;
+/** @internal A fresh options object per decode. The strictness a format declares and the caps
+ *  a caller asked for are combined here and nowhere else, so neither can be written onto the
+ *  other's object and outlive this call. */
+function _decodeOptions(opts, caps) {
+  if (!caps) return opts.ber ? { ber: true } : undefined;
+  var out = { maxBytes: caps.maxBytes, maxDepth: caps.maxDepth, maxItems: caps.maxItems };
+  if (opts.ber) out.ber = true;
+  return out;
+}
+
+/** @internal The decode caps a caller may name, each paired with the `C.LIMITS` default that
+ *  is also its ceiling. A cap may tighten and may not loosen: the defaults are the resource
+ *  the toolkit is willing to spend, and a caller raising one past them would be granting
+ *  themselves more than the built-in refusal allows. */
+var PARSE_CAPS = intrinsic.assign(intrinsic.create(null), {
+  maxBytes: "DER_MAX_BYTES",
+  maxDepth: "DER_MAX_DEPTH",
+  maxItems: "DER_MAX_ITEMS",
+});
+
+/** @internal A format that reads something other than DER declares its own ceilings through
+ *  `opts.capLimits`, so the bound a caller is held to is the one their parser actually uses. */
+var CBOR_PARSE_CAPS = intrinsic.assign(intrinsic.create(null), {
+  maxBytes: "CBOR_MAX_BYTES",
+  maxDepth: "CBOR_MAX_DEPTH",
+  maxItems: "CBOR_MAX_ITEMS",
+});
+
+var CBOR_RESOURCE_REFUSALS = intrinsic.assign(intrinsic.create(null), {
+  "cbor/too-large": 1, "cbor/too-deep": 1, "cbor/too-many-items": 1,
+});
+
+function isCborResourceRefusal(e) {
+  return !!(e && typeof e.code === "string" && CBOR_RESOURCE_REFUSALS[e.code] === 1);
+}
+
+function cborParseOpts(ErrorClass, prefix, what) {
+  var out = intrinsic.create(null);
+  out.ErrorClass = ErrorClass;
+  out.prefix = prefix;
+  out.what = what;
+  out.capLimits = CBOR_PARSE_CAPS;
+  return out;
+}
+
+/** @internal A parser door's options, held on a prototype-less object so a computed lookup on
+ *  it answers from what the format declared. Every hand-rolled door builds its options here
+ *  rather than as a literal in its own module. */
+function parseOpts(spec) {
+  var out = intrinsic.create(null);
+  _forEach(intrinsic.keys(spec), function (k) { out[k] = spec[k]; });
+  return out;
+}
+
+/** @internal Reads the caller's caps into a FRESH object. Nothing is written back onto what
+ *  the caller passed, and nothing else is ever written onto the returned one, so a resource
+ *  option cannot become a strictness flag on a shared object. */
+function parseCaps(callerOpts, opts) {
+  var E = function (message) { return new opts.ErrorClass(opts.prefix + "/bad-input", message); };
+  if (callerOpts === undefined || callerOpts === null) callerOpts = _emptyOptions;
+  if (typeof callerOpts !== "object" || intrinsic.isArray(callerOpts) || guard.bytes.isByteSource(callerOpts)) {
+    throw E("parse options must be an object of decode caps");
+  }
+  var capLimits = opts.capLimits || PARSE_CAPS;
+  guard.identifier.assertKnownKeys(callerOpts, capLimits,
+    function (code, message) { return new opts.ErrorClass(code, message); },
+    opts.prefix + "/bad-input", "parse does not take the option ");
+  var caps = intrinsic.create(null);
+  _forEach(intrinsic.keys(capLimits), function (key) {
+    var ceiling = constants.LIMITS[capLimits[key]];
+    var asked = callerOpts[key];
+    if (asked === undefined) { caps[key] = ceiling; return; }
+    if (!intrinsic.isInteger(asked) || asked < 0) {
+      throw E(key + " must be a non-negative integer no greater than " + ceiling);
+    }
+    if (asked > ceiling) {
+      throw E(key + " " + asked + " is above the built-in ceiling " + ceiling + "; a cap may only tighten");
+    }
+    caps[key] = asked;
+  });
+  return caps;
+}
+var _emptyOptions = intrinsic.freeze(intrinsic.create(null));
+
+/** @internal The door every format parser opens, whether it composes the shared factory or
+ *  hand-rolls its walk. `build(rootNode, ns)` does the format's own work; everything around it
+ *  is the part that must not be re-implemented per parser, because each re-implementation is
+ *  another place the caller's caps can go missing or the latch can go unread. */
+function runParseWith(input, opts, callerOpts, build) {
+  var caps = parseCaps(callerOpts, opts);
+  var budget = guard.limits.budget({ maxBytes: caps.maxBytes });
+  var ns = _nsWithBudget(opts.ns, budget);
+  var result;
+  try {
+    result = build(decodeRoot(coerceToDer(input, opts), opts, caps, budget), ns, caps, budget);
+  } catch (e) {
+    if (guard.limits.isBudgetExceeded(e)) throw _budgetRefusal(opts, e);
+    throw e;
+  }
+  if (budget.exhausted()) throw _budgetRefusal(opts, null);
+  return result;
+}
+
+function runParse(input, opts, callerOpts) {
+  return runParseWith(input, opts, callerOpts, function (root, ns) {
+    return schema.walk(opts.topSchema, root, ns).result;
+  });
+}
+
+/** @internal The re-read at the door is what makes the latch worth having: a catch anywhere
+ *  under the walk may absorb the exception, and this still refuses. */
+function _budgetRefusal(opts, cause) {
+  return new opts.ErrorClass(opts.prefix + "/too-large",
+    (opts.what || "the input") + " exceeds the decode budget for this parse", cause || undefined);
+}
+
+function _nsWithBudget(ns, budget) {
+  var out = intrinsic.create(null);
+  _forEach(intrinsic.keys(ns), function (k) { out[k] = ns[k]; });
+  out.budget = budget;
+  return out;
 }
 
 var DN_SHORT = constants.NAMES.DN_SHORT;
@@ -1356,7 +1496,7 @@ function rootSequenceChildren(root, minLen, maxLen) {
 }
 
 function makeParser(opts) {
-  return function (input) { return runParse(input, opts); };
+  return function (input, callerOpts) { return runParse(input, opts, callerOpts); };
 }
 
 function makeRecordingParser(opts, kind) {
@@ -1430,6 +1570,12 @@ module.exports = {
   isPemArmor: _isPemArmor,
   decodeRoot: decodeRoot,
   runParse: runParse,
+  runParseWith: runParseWith,
+  parseCaps: parseCaps,
+  CBOR_PARSE_CAPS: CBOR_PARSE_CAPS,
+  isCborResourceRefusal: isCborResourceRefusal,
+  cborParseOpts: cborParseOpts,
+  parseOpts: parseOpts,
   makeNS: makeNS,
   versionReader: versionReader,
   DN_SHORT: DN_SHORT,

package/lib/schema-smime.js

@@ -187,7 +187,7 @@ var SMIME_CAPABILITIES = schema.seqOf(SMIME_CAPABILITY, {
 
 /**
  * @primitive  pki.schema.smime.parseSigningCertificate
- * @signature  pki.schema.smime.parseSigningCertificate(der) -> { certs, policies }
+ * @signature  pki.schema.smime.parseSigningCertificate(der, caps?) -> { certs, policies }
  * @since      0.1.22
  * @status     stable
  * @spec       RFC 5035, RFC 2634
@@ -207,6 +207,11 @@ var SMIME_CAPABILITIES = schema.seqOf(SMIME_CAPABILITY, {
  *   var av = b.sequence([b.sequence([essCertId])]);                     // SigningCertificate { certs }
  *   var sc = pki.schema.smime.parseSigningCertificate(av);
  *   sc.certs[0].hashAlgorithm.name;    // "sha1" (implied)
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parseSigningCertificate = pkix.makeParser({ pemLabel: null, PemError: PemError, ErrorClass: SmimeError, prefix: "smime", what: "SigningCertificate", topSchema: SIGNING_CERTIFICATE, ns: NS });
 
@@ -236,7 +241,7 @@ var parseSigningCertificateV2 = pkix.makeParser({ pemLabel: null, PemError: PemE
 
 /**
  * @primitive  pki.schema.smime.parseSmimeCapabilities
- * @signature  pki.schema.smime.parseSmimeCapabilities(der) -> { capabilities }
+ * @signature  pki.schema.smime.parseSmimeCapabilities(der, caps?) -> { capabilities }
  * @since      0.1.22
  * @status     stable
  * @spec       RFC 8551
@@ -253,6 +258,11 @@ var parseSigningCertificateV2 = pkix.makeParser({ pemLabel: null, PemError: PemE
  *   var cap = b.sequence([b.oid(pki.oid.byName("aes256-CBC"))]);
  *   var caps = pki.schema.smime.parseSmimeCapabilities(b.sequence([cap]));
  *   caps.capabilities[0].name;    // "aes256-CBC"
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parseSmimeCapabilities = pkix.makeParser({ pemLabel: null, PemError: PemError, ErrorClass: SmimeError, prefix: "smime", what: "SMIMECapabilities", topSchema: SMIME_CAPABILITIES, ns: NS });
 

package/lib/schema-tsp.js

@@ -46,6 +46,8 @@ var PemError = frameworkError.PemError;
 
 var NS = pkix.makeNS("tsp", TspError, oid);
 
+var _TOKEN_PARSE_OPTS = pkix.parseOpts({ ErrorClass: TspError, prefix: "tsp", what: "the timeStampToken" });
+
 var ALGORITHM_IDENTIFIER = pkix.algorithmIdentifier(NS);
 var EXTENSION = pkix.extension(NS);
 
@@ -250,7 +252,7 @@ var TIME_STAMP_REQ = schema.seq([
 
 /**
  * @primitive  pki.schema.tsp.parseRequest
- * @signature  pki.schema.tsp.parseRequest(input) -> timeStampReq
+ * @signature  pki.schema.tsp.parseRequest(input, caps?) -> timeStampReq
  * @since      0.2.19
  * @status     stable
  * @spec       RFC 3161
@@ -268,12 +270,17 @@ var TIME_STAMP_REQ = schema.seq([
  *   var req = pki.schema.tsp.parseRequest(der);
  *   req.certReq;                        // -> boolean
  *   req.messageImprint.hashedMessage;   // -> Buffer (the raw digest)
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parseRequest = pkix.makeParser({ pemLabel: null, PemError: PemError, ErrorClass: TspError, prefix: "tsp", what: "TimeStampReq", topSchema: TIME_STAMP_REQ, ns: NS });
 
 /**
  * @primitive  pki.schema.tsp.parseTstInfo
- * @signature  pki.schema.tsp.parseTstInfo(input) -> tstInfo
+ * @signature  pki.schema.tsp.parseTstInfo(input, caps?) -> tstInfo
  * @since      0.1.13
  * @status     stable
  * @spec       RFC 3161
@@ -299,12 +306,17 @@ var parseRequest = pkix.makeParser({ pemLabel: null, PemError: PemError, ErrorCl
  *   var tst = pki.schema.tsp.parseTstInfo(der);
  *   tst.genTime;                       // -> Date
  *   tst.messageImprint.hashedMessage;  // -> Buffer (the raw digest)
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parseTstInfo = pkix.makeParser({ pemLabel: null, PemError: PemError, ErrorClass: TspError, prefix: "tsp", what: "TSTInfo", topSchema: TST_INFO, ns: NS });
 
 /**
  * @primitive  pki.schema.tsp.parse
- * @signature  pki.schema.tsp.parse(input) -> timeStampResp
+ * @signature  pki.schema.tsp.parse(input, caps?) -> timeStampResp
  * @since      0.1.13
  * @status     stable
  * @spec       RFC 3161
@@ -329,12 +341,17 @@ var parseTstInfo = pkix.makeParser({ pemLabel: null, PemError: PemError, ErrorCl
  *   var res = pki.schema.tsp.parse(der);
  *   res.status;                              // -> 0 (granted)
  *   res.timeStampToken.tstInfo.genTime;      // -> Date (a granted token is decoded)
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parse = pkix.makeParser({ pemLabel: null, PemError: PemError, ErrorClass: TspError, prefix: "tsp", what: "TimeStampResp", topSchema: TIME_STAMP_RESP, ns: NS });
 
 /**
  * @primitive  pki.schema.tsp.parseToken
- * @signature  pki.schema.tsp.parseToken(input) -> tstInfo
+ * @signature  pki.schema.tsp.parseToken(input, caps?) -> tstInfo
  * @since      0.1.13
  * @status     stable
  * @spec       RFC 3161, RFC 5652
@@ -364,13 +381,28 @@ var parse = pkix.makeParser({ pemLabel: null, PemError: PemError, ErrorClass: Ts
  *   var token = pki.schema.tsp.parseToken(tokenDer);
  *   token.tstInfo.genTime;   // -> Date
  *   token.signerInfo.sid;    // -> the TSA signer identifier
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
-function parseToken(input) {
+function parseToken(input, callerOpts) {
+  /** @internal The caller's options are this door's to answer for, so they are read here rather
+   *  than inside the CMS parser: a complaint about an option must not come back wearing the
+   *  delegate's verdict about the content. The snapshot travels onward, because handing the
+   *  caller's own object to the CMS parser would read each cap a second time. */
+  var caps = pkix.parseCaps(callerOpts, _TOKEN_PARSE_OPTS);
   var der = pkix.coerceToDer(input, { pemLabel: null, PemError: PemError, ErrorClass: TspError, prefix: "tsp" });
   var signed;
-  try { signed = cms.parse(der); }
+  try { signed = cms.parse(der, caps); }
   catch (e) {
     if (e instanceof TspError) throw e;
+    /** @internal A resource refusal says the cap was too small, not that the token is malformed,
+     *  so it keeps that meaning rather than becoming a statement about the bytes. */
+    if (e && typeof e.code === "string" && e.code.indexOf("/too-large") !== -1) {
+      throw new TspError("tsp/too-large", "the timeStampToken exceeds the decode budget for this parse: " + (e.message || ""), e);
+    }
     throw new TspError("tsp/bad-token", "the timeStampToken did not decode as a CMS SignedData: " + ((e && e.message) || String(e)), e);
   }
   if (signed.contentTypeName !== "signedData") {

package/lib/schema-x509.js

@@ -165,7 +165,7 @@ var CERTIFICATE = pkix.signedEnvelope(NS, CERTIFICATE_TBS, {
 
 /**
  * @primitive  pki.schema.x509.parse
- * @signature  pki.schema.x509.parse(input) -> certificate
+ * @signature  pki.schema.x509.parse(input, caps?) -> certificate
  * @since      0.1.7
  * @status     stable
  * @spec       RFC 5280, X.509
@@ -194,6 +194,11 @@ var CERTIFICATE = pkix.signedEnvelope(NS, CERTIFICATE_TBS, {
  *   cert.subject.dn;                 // "CN=example.com, O=Example"
  *   cert.validity.notAfter;          // Date
  *   cert.signatureAlgorithm.name;    // "Ed25519" (the algorithm the issuer signed with)
+ * @opts
+ *   - `maxBytes` / `maxDepth` / `maxItems` (number) -- decode caps for this parse. Each
+ *     defaults to the matching `pki.C.LIMITS` figure and may only be set lower; a value
+ *     above it, or an option outside this set, is refused. A parse that exceeds one is
+ *     refused with the `/too-large` code of this format.
  */
 var parse = pkix.makeRecordingParser({ pemLabel: "CERTIFICATE", PemError: PemError, ErrorClass: CertificateError, prefix: "x509", what: "certificate", topSchema: CERTIFICATE, ns: NS }, "certificate");
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.2",
+  "version": "0.8.3",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:b0bab233-a055-413d-8f5b-3ed8a3f7a8c4",
+  "serialNumber": "urn:uuid:9e704e55-ccb2-4ecb-9370-04d6f58aa807",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-20T02:50:18.934Z",
+    "timestamp": "2026-09-20T04:03:01.349Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.2",
+      "bom-ref": "@blamejs/pki@0.8.3",
       "type": "application",
       "name": "pki",
-      "version": "0.8.2",
+      "version": "0.8.3",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.2",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.3",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.2",
+      "ref": "@blamejs/pki@0.8.3",
       "dependsOn": []
     }
   ]