@blamejs/pki 0.8.53 → 0.8.54

package/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.8.54 — 2026-10-06
+
+Refuse the universal tags X.680 assigns to no type, and tell a caller which those are.
+
+### Added
+
+- `pki.asn1.reservedUniversalTag(tagNumber)` answers whether X.680 reserves a universal tag number, which is the question `pki.asn1.decode` asks before it accepts an element. It returns `false` for every assigned type, including the seven this codec carries no reader for, so it is not a statement about what can be read: a caller deciding whether bytes are worth passing on gets the same answer the decoder will give. A value that is not a tag number answers `false` rather than throwing, as `pki.asn1.isPrintableString` and `pki.oid.isDottedDecimal` do of a value of the wrong type, and the type is checked before anything is compared, so `37.5` and `Infinity` are not read as reserved for sitting inside the addenda range and no `valueOf` of a caller's object is invoked inside the predicate.
+
+### Changed
+
+- `pki.asn1.decode` refuses a universal tag 15 element and any universal tag from 37 up, with `asn1/reserved-tag` naming the row of X.680 Table 1 that reserves it. Every reader in the toolkit inherits the refusal, so a message carrying such an element is refused at its own verb: `pki.schema.parse` and `pki.schema.detectFormat` report `schema/bad-der` before any format detector reads the children, which matters because a child nothing refuses is a child a detector may count. `pki.inspect.asn1` still prints the header walk beside the refusal, so an operator can see what the bytes claimed. Nothing that was accepted before and is assigned by X.680 changed: the four long-form time types and the two internationalized-resource-identifier types at tags 31 to 36 decode as they did.
+- `pki.asn1.encode` and `pki.asn1.encodeIdentifier` refuse the same tags, with the same `asn1/reserved-tag` code, rather than emitting bytes this toolkit's own decoder calls malformed. The class is read off the masked identifier bits as the decoder reads it, so a `classBits` carrying only the constructed bit is the universal class here too. Every other class is untouched, which is what makes the rule narrow enough to be safe: a context `[15]` is how an optional field is written across X.509 and CMS, and it encodes as it did. So do the assigned universal types at tags 31 to 36. The DER form restrictions are deliberately not enforced at this door: a constructed OCTET STRING or character string is a legitimate BER encoding that DER alone narrows to the primitive form, and this low-level encoder is how those bytes are minted for the BER reader that accepts them. A tag number that encodes nothing is a different matter from a form one set of encoding rules permits and another does not.
+- `pki.asn1.encode` and `pki.asn1.encodeIdentifier` require `classBits` to be a number naming a class: `0x00` universal, `0x40` application, `0x80` context or `0xc0` private, with `0x20` constructed allowed alongside. Anything else is `asn1/bad-tag`, as a tag number of the wrong type already was. The low five bits of that argument were being written into a single-octet identifier, so a value carrying any of them emitted a tag other than the one passed: `encodeIdentifier(0x0e, false, 1)` wrote `0f`, universal 15. A value that was not a number was narrowed into a class instead of refused, so `"128"` and `0x100000080` both encoded as a context `[1]`. For every argument still accepted the bytes are unchanged. A tag number past the four-octet high-tag form now reports `asn1/tag-too-large` ahead of any reserved-tag refusal, which is the order `pki.asn1.decode` has always refused that input in.
+- `pki.asn1.TAGS` is frozen. Assigning to it reached the encoders that compose an identifier from a tag number and the comparisons that test one against it, so a single assignment moved what a SEQUENCE is for every caller in the process. The numbers are X.680's; read them, and build a structure with a tag of your own through `pki.asn1.encode`.
+- Eight places that reported a failure by reading `message` off whatever was thrown now describe the thrown value the way the rest of the toolkit does. `pki.cmc.build`, `pki.cmp` session and verification, and `pki.crmf` are the verbs affected, and only the text of a message changes, in the case where what was caught is not an error or carries no readable message: it is named by its type instead of by a fixed phrase, and a `message` that answers from an accessor is read once rather than twice, so the text reported is the text that was tested. A `message` accessor that throws no longer replaces the failure being reported with its own. The error codes are unchanged.
+- A caught value whose `message` is the empty string is described by its type as well. It was being reported as the empty string it was, which left the sentence built around it ending at its colon with nothing after it. This reaches every message assembled that way, including the ones `pki.ocsp.httpRequest` and the revocation fetcher build. A message of only whitespace is still a message and is reported unchanged.
+
 ## v0.8.53 — 2026-10-06
 
 Put a copy of a message's algorithm identifiers where its signature or its MAC covers them, and refuse one whose copy disagrees.

package/README.md

@@ -237,7 +237,7 @@ comment blocks, is at [pkijs.com](https://pkijs.com).
 
 | Namespace | What it does |
 |---|---|
-| `pki.asn1` | Strict, bounded DER codec. `decode` returns a zero-copy node tree, `build.*` emits canonical DER values, `read.*` are typed leaf readers. Plus `encode`, `TAGS`, OID content encode/decode, and the `isPrintableString` string predicate |
+| `pki.asn1` | Strict, bounded DER codec. `decode` returns a zero-copy node tree, `build.*` emits canonical DER values, `read.*` are typed leaf readers. A universal tag X.680 Table 1 reserves and assigns to no type is refused as `asn1/reserved-tag`, and `reservedUniversalTag` answers which tags those are without attempting a decode. Plus `encode`, `TAGS`, OID content encode/decode, and the `isPrintableString` string predicate |
 | `pki.cbor` | Strict, bounded deterministic CBOR codec (RFC 8949). `decode` returns a zero-copy node tree, plus `read.*` typed leaf readers including the keyed lookup `read.mapGet` (text or COSE-label integer key, with the map's major type asserted in the accessor). Fail-closed on every non-canonical shape: indefinite length, non-minimal argument, unsorted or duplicate map keys, non-shortest float, trailing bytes. The `build.*` encoders hold an integer argument to being an integer rather than converting one: a string in any radix, a padded or empty string, and a boolean are each refused, so an unsupplied value cannot encode as zero |
 | `pki.oid` | Two-way OID ↔ name registry, seeded with RFC 5280 and the NIST PQC arcs — `name`, `byName`, `register`, `toArcs`/`fromArcs`, `toDER`/`fromDER`, and the `isDottedDecimal` string predicate |
 | `pki.webcrypto` | A W3C `SubtleCrypto` engine over `node:crypto` — `sign`/`verify`/`encrypt`/`decrypt`/`deriveBits`/`digest`/`generateKey`/`importKey`/`exportKey` across RSA, ECDSA, ECDH, Ed25519/Ed448, AES, HMAC, HKDF, PBKDF2 and SHA, plus post-quantum ML-DSA-44/65/87, SLH-DSA, and ML-KEM-512/768/1024 key generation with certificate and PKCS#8 import. The RFC 9935 seed / expandedKey / both private-key CHOICE is validated fail-closed, so an OpenSSL-legacy bare seed or an internally inconsistent key is rejected with a typed error. `encapsulateBits` and `decapsulateBits` are the ML-KEM key-establishment pair the CMS `KEMRecipientInfo` arm rides on, with the FIPS 203 §7.3 ciphertext-length check enforced here so a direct caller inherits it. Cross-implementation use is undefined in the specification, so a `CryptoKey` from a different WebCrypto implementation is refused here with a typed fault naming its origin; the `pki.*` verbs adopt such a key instead, whether it came from the platform or from a separately installed copy of this toolkit |

package/lib/asn1-der.js

@@ -64,6 +64,49 @@ function _asn1Error(c, m) { return new Asn1Error(c, m); }
 function _oidErr(c, m) { return new OidError(c, m); }
 
 
+/**
+ * @primitive  pki.asn1.reservedUniversalTag
+ * @signature  pki.asn1.reservedUniversalTag(tagNumber) -> boolean
+ * @since      0.8.54
+ * @status     stable
+ * @spec       X.680, ISO/IEC 8824-1
+ * @related    pki.asn1.decode
+ *
+ * Whether X.680 reserves this universal tag number, which means no ASN.1 type is assigned to it and
+ * no DER encoding of any type uses it. Table 1 reserves three rows: tag 0 for the encoding rules,
+ * tag 15 for future editions of the Recommendation, and tag 37 upward for its addenda. `decode`
+ * refuses an element carrying any of them with `asn1/reserved-tag`, so this answers the same
+ * question ahead of the attempt.
+ *
+ * The question is not "does this codec have a reader for the tag", which is a smaller set:
+ * ObjectDescriptor (7), REAL (9), RELATIVE-OID (13), the time type (14), VideotexString (21),
+ * GraphicString (25) and GeneralString (27) are all assigned by X.680 and all arrive here as opaque
+ * values, and each is legitimate inside an `ANY`. This returns `false` for every one of them.
+ *
+ * @example
+ *   pki.asn1.reservedUniversalTag(0);    // -> true   (the encoding rules)
+ *   pki.asn1.reservedUniversalTag(15);   // -> true   (future editions)
+ *   pki.asn1.reservedUniversalTag(37);   // -> true   (addenda)
+ *   pki.asn1.reservedUniversalTag(9);    // -> false  (REAL, assigned, no reader here)
+ *   pki.asn1.reservedUniversalTag(31);   // -> false  (DATE, assigned)
+ */
+function reservedUniversalTag(tagNumber) {
+  /** @internal The type check comes FIRST, and a value that is not a tag number answers `false`
+   *  rather than throwing, which is how the other public predicates here answer: `isPrintableString`
+   *  and `oid.isDottedDecimal` both say "not that" of a value of the wrong type. A range test alone
+   *  calls `37.5` and `Infinity` reserved, since both sit inside the addenda range while being no
+   *  tag at all, and `tagNumber >= 37` against a caller's object runs that object's `valueOf`, so a
+   *  comparison reached before this check runs caller code inside a predicate.
+   *
+   *  Then all three rows the table reserves, tag 0 included: this answers what X.680 says, and it
+   *  says tag 0 is reserved. The decode door keeps a separate branch for tag 0 ahead of the general
+   *  one so its refusal can cite the end-of-contents encoding X.690 sec. 8.1.5 gives that octet
+   *  pair, which is the useful thing to tell whoever sent it; the answer to "is it reserved" is the
+   *  same from either place. */
+  if (typeof tagNumber !== "number" || !intrinsic.isInteger(tagNumber) || tagNumber < 0) return false;
+  return tagNumber === 0 || tagNumber === 15 || tagNumber >= 37;
+}
+
 var UNIVERSAL_TYPES = intrinsic.assign(intrinsic.create(null), {
   BOOLEAN:           { tag: 0x01, form: "primitive" },
   INTEGER:           { tag: 0x02, form: "primitive" },
@@ -89,14 +132,21 @@ var UNIVERSAL_TYPES = intrinsic.assign(intrinsic.create(null), {
   BMP_STRING:        { tag: 0x1e, form: "primitive" },
 });
 
+/** @internal Frozen, because it is exported and every structure in the toolkit names its tags
+ *  through it. Left writable, `pki.asn1.TAGS.SEQUENCE = 15` reached the encoders that compose an
+ *  identifier from it and the guard that compares one against it, so one assignment by anything
+ *  sharing the process moved what a SEQUENCE is for the whole process. The numbers are X.680's and
+ *  no caller has a reason to change one. */
 var TAGS = intrinsic.create(null);
 Object.keys(UNIVERSAL_TYPES).forEach(function (k) { TAGS[k] = UNIVERSAL_TYPES[k].tag; });
+intrinsic.freeze(TAGS);
 
 var CLASS_UNIVERSAL   = 0x00;
 var CLASS_APPLICATION = 0x40;
 var CLASS_CONTEXT     = 0x80;
 var CLASS_PRIVATE     = 0xc0;
 var CONSTRUCTED_BIT   = 0x20;
+var CLASS_MASK        = 0xc0;
 
 var CONSTRUCTED_ONLY_UNIVERSAL_TAGS = Object.create(null);
 Object.keys(UNIVERSAL_TYPES).forEach(function (k) {
@@ -185,7 +235,7 @@ function _decodeTLV(buf, start, limit, depth, maxDepth, ber, strDepth, ctr) {
   var p = start;
   if (p >= limit) throw new Asn1Error("asn1/truncated", "expected an identifier octet");
   var first = buf[p]; p += 1;
-  var tagClassBits = first & 0xc0;
+  var tagClassBits = first & CLASS_MASK;
   var constructed = (first & CONSTRUCTED_BIT) !== 0;
   var tagNumber = first & 0x1f;
 
@@ -221,6 +271,12 @@ function _decodeTLV(buf, start, limit, depth, maxDepth, ber, strDepth, ctr) {
       "universal tag 0 is the reserved end-of-contents encoding (X.690 sec. 8.1.5) and is not an element");
   }
 
+  if (tagClassBits === CLASS_UNIVERSAL && reservedUniversalTag(tagNumber)) {
+    throw new Asn1Error("asn1/reserved-tag",
+      "universal tag " + tagNumber + " is reserved by X.680 Table 1 (" + (tagNumber === 15
+        ? "for future editions" : "for addenda") + ") and is not assigned to any type");
+  }
+
   if (tagClassBits === CLASS_UNIVERSAL && CONSTRUCTED_ONLY_UNIVERSAL_TAGS[tagNumber] && !constructed) {
     throw new Asn1Error("asn1/bad-tlv", "a universal constructed-only type (SEQUENCE/SET/EXTERNAL/EMBEDDED PDV/CHARACTER STRING) must be constructed");
   }
@@ -707,9 +763,13 @@ function encodeLength(n) {
   return Buffer.concat([Buffer.from([0x80 | bytes.length]), Buffer.from(bytes)]);
 }
 
+/** @internal The identifier comes from the one function that composes one. Writing the octet here
+ *  instead put a second author of an identifier in the file, and it answered differently: with
+ *  `TAGS.SEQUENCE` reassigned to 15 this emitted `2f00`, which `decode` refuses, while every
+ *  `build.*` helper routed through `encodeIdentifier` and refused it. */
 function sequenceTlv(node) {
   var content = node.content != null ? node.content : Buffer.concat((node.children || []).map(function (c) { return c.bytes; }));
-  return Buffer.concat([Buffer.from([TAGS.SEQUENCE | CONSTRUCTED_BIT]), encodeLength(content.length), content]);
+  return Buffer.concat([encodeIdentifier(CLASS_UNIVERSAL, true, TAGS.SEQUENCE), encodeLength(content.length), content]);
 }
 
 /** @internal A constructed value written into ONE allocation, rather than concatenating the children
@@ -738,12 +798,43 @@ function encodeIdentifier(classBits, constructed, tagNumber) {
   if (typeof tagNumber !== "number" || !isFinite(tagNumber) || tagNumber < 0 || Math.floor(tagNumber) !== tagNumber) {
     throw new Asn1Error("asn1/bad-tag", "tag number must be a non-negative integer");
   }
-  var lead = classBits | (constructed ? CONSTRUCTED_BIT : 0);
+  /** @internal The class bits are taken ONCE, into the number the checks and the emitted octet all
+   *  use, and then checked to be a class. The low five bits of this argument are OR'd into the
+   *  single-octet identifier, so a `classBits` carrying any of them emits a DIFFERENT tag than the
+   *  one handed in: `encodeIdentifier(0x0e, false, 1)` wrote `0f`, universal 15, past a reserved-tag
+   *  check that had been shown tag 1. The four class values are the whole domain, with the
+   *  constructed bit allowed alongside because a caller may fold it in rather than pass it. */
+  var cls = classBits | 0;
+  if (typeof classBits !== "number" || cls !== classBits ||
+      (cls & ~(CLASS_MASK | CONSTRUCTED_BIT)) !== 0) {
+    throw new Asn1Error("asn1/bad-tag", "class bits must be one of 0x00 universal, 0x40 application, " +
+      "0x80 context or 0xc0 private, optionally with 0x20 constructed, got " + _typeOf(classBits));
+  }
+  /** @internal The size bound before the reserved rows, which is the order the decoder refuses them
+   *  in: a tag past the four-octet high-tag form it reads is unreadable whatever the table says
+   *  about the number, so both directions name `asn1/tag-too-large` for it and the reserved code
+   *  keeps meaning that X.680 reserved the row. 0x0fffffff is the largest number four 7-bit octets
+   *  hold, so this is the bound the body-length check below expressed. */
+  if (tagNumber > 0x0fffffff) throw new Asn1Error("asn1/tag-too-large", "high-tag-number too large");
+  /** @internal The reserved rows, refused in BOTH directions. X.680 Table 1 assigns no type to
+   *  universal 0, 15, or 37 upward, so there is no encoding of any type for `decode` to accept and
+   *  it refuses all three; emitting them anyway hands a caller bytes this codec's own decoder calls
+   *  malformed. The DER FORM rules are deliberately NOT enforced here: a constructed OCTET STRING or
+   *  string type is a legitimate BER encoding (X.690 sec. 8.21.1) that DER alone restricts to the
+   *  primitive form (sec. 10.2), and this encoder is the escape hatch those bytes are minted through
+   *  for the BER door that reads them. A tag number that encodes nothing is a different thing from a
+   *  form one encoding rule allows and another does not. */
+  if ((cls & CLASS_MASK) === CLASS_UNIVERSAL && reservedUniversalTag(tagNumber)) {
+    throw new Asn1Error("asn1/reserved-tag", "universal tag " + tagNumber + " is reserved by X.680 " +
+      "Table 1 (" + (tagNumber === 0 ? "for the encoding rules, which give 00 00 to the " +
+      "end-of-contents marker" : tagNumber === 15 ? "for future editions" : "for addenda") +
+      ") and is not assigned to any type, so no encoding of it is a DER element");
+  }
+  var lead = cls | (constructed ? CONSTRUCTED_BIT : 0);
   if (tagNumber < 0x1f) return Buffer.from([lead | tagNumber]);
   var body = [];
   var v = tagNumber;
   do { _unshift(body, v & 0x7f); v = Math.floor(v / 128); } while (v > 0);
-  if (body.length > 4) throw new Asn1Error("asn1/tag-too-large", "high-tag-number too large");
   for (var i = 0; i < body.length - 1; i++) body[i] |= 0x80;
   return Buffer.concat([Buffer.from([lead | 0x1f]), Buffer.from(body)]);
 }
@@ -760,6 +851,22 @@ function encodeIdentifier(classBits, constructed, tagNumber) {
  * buffer. Most callers use the higher-level `build.*` helpers; this is the
  * escape hatch for context-tagged and implicitly-tagged constructions.
  *
+ * `classBits` is a number naming a class: `0x00` universal, `0x40`
+ * application, `0x80` context or `0xc0` private, with `0x20` constructed
+ * allowed alongside. Anything else is `asn1/bad-tag`, because the low five
+ * bits of this argument are written into a single-octet identifier and a
+ * value carrying any of them emits a tag other than the one passed.
+ *
+ * A universal-class tag number that X.680 Table 1 reserves is refused with
+ * `asn1/reserved-tag`, the code `pki.asn1.decode` gives the same bytes, so the
+ * escape hatch cannot author an element the decoder calls malformed. Ask
+ * `pki.asn1.reservedUniversalTag` which numbers those are. Every other class
+ * takes any tag number the 4-octet high-tag form holds, a context `[15]`
+ * included; past that form the code is `asn1/tag-too-large`, as it is on the
+ * way in. The DER form restrictions are not applied here: a constructed
+ * OCTET STRING or character string is a legal BER encoding, and this is the
+ * door it is written through.
+ *
  * @example
  *   pki.asn1.encode(0x00, false, pki.asn1.TAGS.NULL, Buffer.alloc(0));
  */
@@ -1059,6 +1166,7 @@ function _asBufferArray(arr, who) {
 
 module.exports = {
   TAGS:          TAGS,
+  reservedUniversalTag: reservedUniversalTag,
   decode:        decode,
   isPrintableString: isPrintableString,
   encode:        encodeTLV,

package/lib/cmc-build.js

@@ -253,7 +253,7 @@ function encodeRequest(req, ids, index) {
     try { csr.parse(_der(req.tcr, "a tcr certificationRequest")); }
     catch (e) {
       throw E("cmc/bad-input", "a tcr request must be a PKCS#10 CertificationRequest: " +
-        (e && e.message ? e.message : "it did not parse as one"), e);
+        guard.text.describeThrown(e), e);
     }
     var id = ids.claim(req.bodyPartID, "a tcr request");
     return { bodyPartID: id, der: b.contextConstructed(0, Buffer.concat([b.integer(BigInt(id)), _der(req.tcr, "a tcr certificationRequest")])) };
@@ -263,7 +263,7 @@ function encodeRequest(req, ids, index) {
     try { crmf.parse(b.sequence([msg])); }
     catch (e) {
       throw E("cmc/bad-input", "a crm request must be an RFC 4211 CertReqMsg: " +
-        (e && e.message ? e.message : "it did not parse as one"), e);
+        guard.text.describeThrown(e), e);
     }
     var certReqId = ids.claim(_certReqIdOf(msg), "a crm request");
     var node = asn1.decode(msg);
@@ -947,7 +947,7 @@ async function _build(spec, signer, opts) {
   } catch (e) {
     throw E("cmc/bad-input",
       "the assembled PKIData does not parse as one, so it would be refused by its recipient: " +
-      (e && e.message ? e.message : "malformed"), e);
+      guard.text.describeThrown(e), e);
   }
 
   /** @internal RFC 5272 sec. 3.2 gives a Full PKI Request two carriers, and a request uses one: a

package/lib/cmp-session.js

@@ -971,8 +971,8 @@ function session(opts) {
     var res;
     try { res = await _engine.build(leaf, { trustAnchors: _asCertList(opts.trustAnchors), intermediates: pool, validate: true, time: opts.time != null ? opts.time : new Date() }); }
     catch (e) {
-      if (e.code === "path/bad-input") throw _err("cmp/bad-input", "invalid trust / validation options for issued-certificate validation: " + (e.message || e), e);
-      throw _err("cmp/bad-cert-response", "the issued certificate could not be validated to a supplied trust anchor: " + (e.message || e), e);
+      if (e.code === "path/bad-input") throw _err("cmp/bad-input", "invalid trust / validation options for issued-certificate validation: " + guard.text.describeThrown(e), e);
+      throw _err("cmp/bad-cert-response", "the issued certificate could not be validated to a supplied trust anchor: " + guard.text.describeThrown(e), e);
     }
     if (!res || res.valid !== true) throw _err("cmp/bad-cert-response", "the issued certificate did not validate to a supplied trust anchor (its signature or chain is invalid) (RFC 5280 sec. 6.1)");
   }

package/lib/cmp-verify.js

@@ -671,9 +671,9 @@ async function _chainSigner(signer, m, opts, extra) {
     return guard.verdict.of({ trusted: true, reason: null, chain: chain });
   } catch (e) {
     if (e && e.code === "path/bad-input") {
-      throw _err("cmp/bad-input", "invalid trust / validation options for signer-certificate path validation: " + (e.message || e), e);
+      throw _err("cmp/bad-input", "invalid trust / validation options for signer-certificate path validation: " + guard.text.describeThrown(e), e);
     }
-    return guard.verdict.of({ trusted: false, reason: "signer certificate path validation failed: " + (e.message || e) });
+    return guard.verdict.of({ trusted: false, reason: "signer certificate path validation failed: " + guard.text.describeThrown(e) });
   }
 }
 

package/lib/crmf-sign.js

@@ -943,7 +943,7 @@ async function _assertEnclosedKeyCorresponds(privateKeyDer, templateSpki) {
      * failing, not the input. */
     if (e && e.isPkiError === true && e.code === "key/bad-input") {
       throw _err("crmf/bad-input", "pop.privateKey could not be read as a private key to check against " +
-        "certTemplate.publicKey: " + (e.message || e), e);
+        "certTemplate.publicKey: " + guard.text.describeThrown(e), e);
     }
     throw _err("crmf/bad-popo", "the private key enclosed in the encryptedKey proof of possession could not be " +
       "exercised with certTemplate.publicKey, so it cannot be shown to be that key's private half (RFC 4211 sec. 4.2)", e);

package/lib/guard-der.js

@@ -8,23 +8,42 @@ var _forEach = require("./guard-intrinsic").forEach;
 var _sizeOf = require("./guard-intrinsic").sizeOf;
 var _create = require("./guard-intrinsic").create;
 var _isBuffer = require("./guard-intrinsic").isBuffer;
+var _isArray = require("./guard-intrinsic").isArray;
 
 var asn1 = null;
 function _asn1() { if (asn1 === null) asn1 = require("./asn1-der"); return asn1; }
 
-var VALUE_READERS = null;
-function _readers() {
-  if (VALUE_READERS !== null) return VALUE_READERS;
-  var asn1 = _asn1();
-  var m = _create(null), R = asn1.read, T = asn1.TAGS;
-  m[T.BOOLEAN] = R.boolean; m[T.INTEGER] = R.integer; m[T.ENUMERATED] = R.enumerated;
-  m[T.BIT_STRING] = R.bitString; m[T.OCTET_STRING] = R.octetString; m[T.NULL] = R.nullValue;
-  m[T.OBJECT_IDENTIFIER] = R.oid; m[T.UTC_TIME] = R.time; m[T.GENERALIZED_TIME] = R.time;
-  m[T.NUMERIC_STRING] = R.numericString;
+/** @internal Everything this file needs from the codec, captured in ONE step on first use: the two
+ *  functions it calls, the two tag NUMBERS it compares against, and the reader table. Read per call
+ *  instead, each is a property of a module object anything sharing the process can assign to, and
+ *  the verdict follows the assignment: `reservedUniversalTag` replaced by a function answering
+ *  `true` made `tlv` refuse a valid NULL, and `TAGS.SEQUENCE` reassigned made both `element` and
+ *  `tlv` refuse a valid empty SEQUENCE. The tag numbers are copied out rather than the table kept,
+ *  because freezing a record holding a reference leaves what it points at writable. One step rather
+ *  than two because two initialize at different first calls, and the gap between them was itself a
+ *  window: warming the codec through a context node left the readers uncaptured, and `read.nullValue`
+ *  replaced in between turned a NULL with content from refused into accepted. The capture is lazy
+ *  because the codec requires this file, so neither can be required at the other's load. */
+var CODEC = null;
+function _codec() {
+  if (CODEC !== null) return CODEC;
+  var m = _asn1();
+  var R = m.read, T = m.TAGS;
+  var readers = _create(null);
+  readers[T.BOOLEAN] = R.boolean; readers[T.INTEGER] = R.integer; readers[T.ENUMERATED] = R.enumerated;
+  readers[T.BIT_STRING] = R.bitString; readers[T.OCTET_STRING] = R.octetString;
+  readers[T.NULL] = R.nullValue; readers[T.OBJECT_IDENTIFIER] = R.oid; readers[T.UTC_TIME] = R.time;
+  readers[T.GENERALIZED_TIME] = R.time; readers[T.NUMERIC_STRING] = R.numericString;
   _forEach([T.UTF8_STRING, T.PRINTABLE_STRING, T.IA5_STRING, T.TELETEX_STRING, T.VISIBLE_STRING,
-    T.BMP_STRING, T.UNIVERSAL_STRING], function (t) { m[t] = R.string; });
-  VALUE_READERS = m;
-  return VALUE_READERS;
+    T.BMP_STRING, T.UNIVERSAL_STRING], function (t) { readers[t] = R.string; });
+  CODEC = _freeze({
+    decode: m.decode,
+    reservedUniversalTag: m.reservedUniversalTag,
+    SEQUENCE: T.SEQUENCE,
+    SET: T.SET,
+    readers: _freeze(readers),
+  });
+  return CODEC;
 }
 
 var TAG_CLASS_RANK = _create(null);
@@ -48,30 +67,69 @@ function setOrderOk(kids) {
   return dup ? octetAsc : (octetAsc || tagAsc);
 }
 
-// @enforced-by guard-shape-reinlined
-// @guard-shape _ANY_VALUE_READERS\[
-function element(node, E, code, label) {
-  if (node.tagClass === "universal" && node.tagNumber === 0) {
+// @enforced-by behavioral -- validating a universal element's content through the codec's own reader
+// @enforced-by behavioral -- for its tag has no rename-proof shape: a re-inline builds a table keyed
+// @enforced-by behavioral -- by a TAGS member under any local name, and an anchor on one name goes
+// @enforced-by behavioral -- silently green on a rename. The RED vectors in guard-der.test.js are the
+// @enforced-by behavioral -- guard, and every format parser's strict-DER vectors route through tlv.
+function element(node, E, code, label) { _element(node, E, code, label); }
+
+/** @internal Every field of the node is taken ONCE, into the plain record every rule below decides
+ *  on, every reader is handed, and the SET-order check compares. Read per rule instead, a node whose
+ *  `tagNumber` answers from a getter clears one check as the tag it is not and is then handled as the
+ *  tag it is: a node answering 15 and then 5 was ACCEPTED, over four reads. A Proxy saw two reads of
+ *  each field, the content validator was handed the caller's object rather than what was checked, and
+ *  a SET member's getter answered the order comparison with a value the member's own validation never
+ *  saw. The record is TYPED because each field is read as something: the tag becomes a property key at
+ *  the reader lookup, which runs a `Symbol.toPrimitive` an object carries, and the form decides a
+ *  branch a truthy non-boolean enters. `decode` answers every field with a plain value for every
+ *  input it accepts, so this refuses only a node the codec did not produce. The node `tlv` passes
+ *  holds plain values; what the record closes is the next caller, which hands this a node it decoded
+ *  elsewhere or built itself. Returned so the caller's walk compares the members it validated. */
+function _element(node, E, code, label) {
+  if (!node || typeof node !== "object") throw E(code, label + " must be a decoded DER node");
+  var s = {
+    tagClass: node.tagClass,
+    tagNumber: node.tagNumber,
+    constructed: node.constructed,
+    content: node.content,
+    bytes: node.bytes,
+  };
+  var kids = s.constructed === true ? node.children : null;
+  if (typeof s.tagClass !== "string" || typeof s.tagNumber !== "number" ||
+      typeof s.constructed !== "boolean" || (s.constructed && !_isArray(kids))) {
+    throw E(code, label + " must be a node this codec decoded, carrying a tag class, a tag number, " +
+      "a form, and members when it is constructed");
+  }
+  var cls = s.tagClass, tag = s.tagNumber, C = _codec();
+  if (cls === "universal" && tag === 0) {
     throw E(code, label + " must not use the reserved end-of-contents encoding (tag 0)");
   }
-  var T = _asn1().TAGS;
-  if (node.constructed) {
-    if (node.tagClass === "universal" && node.tagNumber !== T.SEQUENCE && node.tagNumber !== T.SET) {
-      throw E(code, label + " of universal constructed type " + node.tagNumber + " has no strict DER structure validator here");
+  /** @internal The other reserved rows, asked of the codec's own predicate so the two cannot
+   *  disagree about which universal tags X.680 Table 1 assigns to no type. The codec door refuses
+   *  these before a node exists, so this answers for a node that reached here by another route. */
+  if (cls === "universal" && C.reservedUniversalTag(tag)) {
+    throw E(code, label + " must not use universal tag " + tag +
+      ", which X.680 Table 1 reserves and assigns to no type");
+  }
+  if (s.constructed) {
+    if (cls === "universal" && tag !== C.SEQUENCE && tag !== C.SET) {
+      throw E(code, label + " of universal constructed type " + tag + " has no strict DER structure validator here");
     }
-    var kids = node.children;
-    for (var i = 0; i < kids.length; i++) element(kids[i], E, code, label);
-    if (node.tagClass === "universal" && node.tagNumber === T.SET && !setOrderOk(kids)) {
+    var n = kids.length, members = [];
+    for (var i = 0; i < n; i++) members[i] = _element(kids[i], E, code, label);
+    if (cls === "universal" && tag === C.SET && !setOrderOk(members)) {
       throw E(code, label + " has a SET whose members are in no canonical DER order (X.690 sec. 11.6 / X.680 sec. 8.6)");
     }
-    return;
+    return s;
   }
-  if (node.tagClass === "universal") {
-    var reader = _readers()[node.tagNumber];
-    if (!reader) throw E(code, label + " of universal type " + node.tagNumber + " has no strict DER content validator here");
-    try { reader(node); }
+  if (cls === "universal") {
+    var reader = C.readers[tag];
+    if (!reader) throw E(code, label + " of universal type " + tag + " has no strict DER content validator here");
+    try { reader(s); }
     catch (e) { throw E(code, label + " is not a valid DER element for its type", e); }
   }
+  return s;
 }
 
 // @enforced-by guard-shape-reinlined
@@ -79,7 +137,7 @@ function element(node, E, code, label) {
 function tlv(content, E, code, label) {
   if (!content || _sizeOf(content) === 0) throw E(code, label + " must be a non-empty DER element");
   var node;
-  try { node = _asn1().decode(content); }
+  try { node = _codec().decode(content); }
   catch (e) { throw E(code, label + " must be exactly one well-formed DER element (no trailing data)", e); }
   element(node, E, code, label);
   return content;
@@ -115,8 +173,13 @@ function paramsAbsentOrNull(params) {
  */
 function sameAlgorithmExactly(a, c) {
   if (!a || !c || a.oid !== c.oid) return false;
-  var ap = a.parameters === undefined ? null : a.parameters;
-  var cp = c.parameters === undefined ? null : c.parameters;
+  /** @internal Each operand's `parameters` is read ONCE, into the value the absence test and the
+   *  comparison share. Read twice, the first value decided which branch ran and the second was the
+   *  one compared, so a getter answering a DER NULL and then `null` made an algorithm carrying
+   *  parameters compare EQUAL to one carrying none. */
+  var araw = a.parameters, craw = c.parameters;
+  var ap = araw === undefined ? null : araw;
+  var cp = craw === undefined ? null : craw;
   if (ap === null || cp === null) return ap === cp;
   return _isBuffer(ap) && _isBuffer(cp) && _sizeOf(ap) === _sizeOf(cp) && _compare(ap, cp) === 0;
 }

package/lib/guard-encoding.js

@@ -171,7 +171,8 @@ function _rawError(E) {
  * characters passes a URL the rule was meant to refuse.
  *
  * @enforced-by guard-shape-reinlined
- * @guard-shape /charCodeAt\s*\(\s*[\w$]+\s*,\s*[\w$]+\s*\)\s*>\s*(?:0x7f|127)\b/ */
+ * @guard-shape charCodeAt\s*\(\s*[\w$]+\s*,\s*[\w$]+\s*\)\s*>\s*(?:0x7f|127)\b
+ */
 function isAsciiText(s) {
   if (typeof s !== "string") return false;
   for (var i = 0; i < s.length; i++) {

package/lib/guard-identifier.js

@@ -634,7 +634,8 @@ function _showSwitch(value) {
  * the object, so an accessor further up the chain cannot answer either.
  *
  * @enforced-by guard-shape-reinlined
- * @guard-shape /\.\s*blocksPrivateAddresses\s*===\s*true/ */
+ * @guard-shape \.\s*blocksPrivateAddresses\s*===\s*true
+ */
 function declaresOwn(obj, name) {
   if (obj === null || obj === undefined) return false;
   var d;

package/lib/guard-name.js

@@ -198,6 +198,7 @@ function escapeControlBytes(str) {
 var DN_SPECIAL = intrinsic.assign(intrinsic.create(null), { 0x2c: 1, 0x2b: 1, 0x22: 1, 0x5c: 1, 0x3c: 1, 0x3e: 1, 0x3b: 1 });
 
 var _hexNibble = require("./guard-encoding").hexNibble;
+var _isAsciiText = require("./guard-encoding").isAsciiText;
 function _isAttrTypeStart(c) { return (c >= 0x41 && c <= 0x5a) || (c >= 0x61 && c <= 0x7a); }
 function _isAttrTypeChar(c) { return _isAttrTypeStart(c) || (c >= 0x30 && c <= 0x39) || c === 0x2d; }
 function _isDigit(c) { return c >= 0x30 && c <= 0x39; }
@@ -335,10 +336,12 @@ function emailEqual(a, b) {
   return lowerAscii(aHost) === lowerAscii(bHost) ? "match" : "no-match";
 }
 
+/** @internal An all-ASCII host, asked of the one place that scans for a byte above 0x7f, with the
+ *  non-empty requirement kept here because a host part is not optional and `isAsciiText` answers
+ *  `true` of the empty string. */
+// @guard-via guard.encoding.isAsciiText
 function _asciiHost(h) {
-  if (h.length === 0) return false;
-  for (var i = 0; i < h.length; i++) if (_charCodeAt(h, i) > 0x7f) return false;
-  return true;
+  return h.length > 0 && _isAsciiText(h);
 }
 
 // @enforced-by guard-shape-reinlined

package/lib/guard-text.js

@@ -102,13 +102,17 @@ function keyOf(v) {
  * by its type, which is what `showValue` would have said about it anyway.
  *
  * @enforced-by guard-shape-reinlined
- * @guard-shape /([\w$]+)\s*&&\s*\1\.message\s*\?\s*\1\.message\s*:|([\w$]+)\.message\s*\|\|\s*\2\b/ */
+ * @guard-shape ([\w$]+)\s*&&\s*\1\.message\s*\?\s*\1\.message\s*:|([\w$]+)\.message\s*\|\|\s*\2\b
+ */
 function describeThrown(e) {
   var m;
   try { m = e === null || e === undefined ? undefined : e.message; }
   catch (_readFailed) { return _thrownFallback(e); }
   if (typeof m === "string" && m.length > 0) return m;
-  if (m === undefined || m === null) return _thrownFallback(e);
+  /** @internal An EMPTY message answers nothing readable, so it is described by its type like any
+   *  other unreadable value. Returned as the empty string it was, it left the sentence built around
+   *  it ending at its colon with nothing after it, which tells a reader less than the type does. */
+  if (m === undefined || m === null || m === "") return _thrownFallback(e);
   try {
     if (typeof m === "symbol") return intrinsic.String(m);
     return "" + m;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.53",
+  "version": "0.8.54",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:f287baca-f745-4ecd-8265-d6953251f0b6",
+  "serialNumber": "urn:uuid:4fbfd882-9aa0-491d-b309-378e286e0976",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-06T00:56:34.786Z",
+    "timestamp": "2026-10-06T03:34:15.912Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.53",
+      "bom-ref": "@blamejs/pki@0.8.54",
       "type": "application",
       "name": "pki",
-      "version": "0.8.53",
+      "version": "0.8.54",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.53",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.54",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.53",
+      "ref": "@blamejs/pki@0.8.54",
       "dependsOn": []
     }
   ]