@blamejs/pki 0.8.53 → 0.8.55

package/CHANGELOG.md

@@ -4,6 +4,41 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.8.55 — 2026-10-06
+
+Tell a caller when the path search stopped looking, rather than reporting the chain it had.
+
+### Added
+
+- `pki.path.build` puts `depthLimited: true` on a `{ valid:false }` return when `opts.maxDepth` stopped an expansion that still had candidates waiting. The chain reported alongside it is the best one the search ASSEMBLED, not the best one the pool holds, so a caller treating `valid:false` as a verdict about the certificates should read the field and raise `maxDepth` instead. It is absent from a successful return and from a failing one the search explored to its end, including a chain whose last hop lands exactly on the cap with nothing left to expand: the claim is that the bound truncated the search, not that the search reached it.
+
+### Changed
+
+- `pki.sigstore.verifyBundle` reports `sigstore/chain-incomplete` where it reported `sigstore/chain-invalid`, for a bundle whose Fulcio chain the path search stopped expanding at its depth bound. A rotated CA reissues under one subject name, so a bundle can carry a short branch that assembles and fails beside a long one that reaches an anchor past the bound; the short branch's failure was being published as the verdict on the bundle. The candidate budget already answered this way, and the two bounds now agree. Nothing about a chain that was explored to its end changed: a bundle whose assembled path genuinely fails validation is still `sigstore/chain-invalid`.
+- A reached bound stays a bound rather than becoming a refusal: a bounded depth-first search visits equal-scoring candidates in the order they arrive, so a bundle large enough to exhaust the expansion ceiling can still depend on its own ordering. That is a property of bounding the search at all. Raise `maxDepth` and `maxCandidatesConsidered` for a pool whose shape needs more of the graph walked.
+- `depthLimited` reports a candidate the cap kept the search from expanding, and nothing weaker. A candidate already on the chain is one the cycle check would skip at any depth, so it is not counted: counting it would report a truncated search where the search was exhausted, and turn a chain this toolkit refuses into one it claims it never finished reading. Two cases it does not report, both of which leave the older behavior in place rather than overstating: a chain whose last hop lands on the cap with nothing left to match, and a cap that also suppressed an Authority Information Access fetch for the certificate at that hop. The second needs the fetch's own URL eligibility answered to be certain a fetch was available, so it is left unclaimed rather than guessed at.
+
+### Fixed
+
+- `pki.ct` and `pki.path.build` take their declared options through one shared snapshot instead of two copies of the same loop. Both read every declared name once, before anything derives from one, and both keep an omitted option OMITTED rather than recording it as a name holding `undefined`, which is what lets an absent `transport` still mean "open the connection yourself, under the pinned anchors". Behavior is unchanged at both verbs; what the shared door adds is that the next caller to copy an options bag by hand is caught before it ships.
+
+## v0.8.54 — 2026-10-06
+
+Refuse the universal tags X.680 assigns to no type, and tell a caller which those are.
+
+### Added
+
+- `pki.asn1.reservedUniversalTag(tagNumber)` answers whether X.680 reserves a universal tag number, which is the question `pki.asn1.decode` asks before it accepts an element. It returns `false` for every assigned type, including the seven this codec carries no reader for, so it is not a statement about what can be read: a caller deciding whether bytes are worth passing on gets the same answer the decoder will give. A value that is not a tag number answers `false` rather than throwing, as `pki.asn1.isPrintableString` and `pki.oid.isDottedDecimal` do of a value of the wrong type, and the type is checked before anything is compared, so `37.5` and `Infinity` are not read as reserved for sitting inside the addenda range and no `valueOf` of a caller's object is invoked inside the predicate.
+
+### Changed
+
+- `pki.asn1.decode` refuses a universal tag 15 element and any universal tag from 37 up, with `asn1/reserved-tag` naming the row of X.680 Table 1 that reserves it. Every reader in the toolkit inherits the refusal, so a message carrying such an element is refused at its own verb: `pki.schema.parse` and `pki.schema.detectFormat` report `schema/bad-der` before any format detector reads the children, which matters because a child nothing refuses is a child a detector may count. `pki.inspect.asn1` still prints the header walk beside the refusal, so an operator can see what the bytes claimed. Nothing that was accepted before and is assigned by X.680 changed: the four long-form time types and the two internationalized-resource-identifier types at tags 31 to 36 decode as they did.
+- `pki.asn1.encode` and `pki.asn1.encodeIdentifier` refuse the same tags, with the same `asn1/reserved-tag` code, rather than emitting bytes this toolkit's own decoder calls malformed. The class is read off the masked identifier bits as the decoder reads it, so a `classBits` carrying only the constructed bit is the universal class here too. Every other class is untouched, which is what makes the rule narrow enough to be safe: a context `[15]` is how an optional field is written across X.509 and CMS, and it encodes as it did. So do the assigned universal types at tags 31 to 36. The DER form restrictions are deliberately not enforced at this door: a constructed OCTET STRING or character string is a legitimate BER encoding that DER alone narrows to the primitive form, and this low-level encoder is how those bytes are minted for the BER reader that accepts them. A tag number that encodes nothing is a different matter from a form one set of encoding rules permits and another does not.
+- `pki.asn1.encode` and `pki.asn1.encodeIdentifier` require `classBits` to be a number naming a class: `0x00` universal, `0x40` application, `0x80` context or `0xc0` private, with `0x20` constructed allowed alongside. Anything else is `asn1/bad-tag`, as a tag number of the wrong type already was. The low five bits of that argument were being written into a single-octet identifier, so a value carrying any of them emitted a tag other than the one passed: `encodeIdentifier(0x0e, false, 1)` wrote `0f`, universal 15. A value that was not a number was narrowed into a class instead of refused, so `"128"` and `0x100000080` both encoded as a context `[1]`. For every argument still accepted the bytes are unchanged. A tag number past the four-octet high-tag form now reports `asn1/tag-too-large` ahead of any reserved-tag refusal, which is the order `pki.asn1.decode` has always refused that input in.
+- `pki.asn1.TAGS` is frozen. Assigning to it reached the encoders that compose an identifier from a tag number and the comparisons that test one against it, so a single assignment moved what a SEQUENCE is for every caller in the process. The numbers are X.680's; read them, and build a structure with a tag of your own through `pki.asn1.encode`.
+- Eight places that reported a failure by reading `message` off whatever was thrown now describe the thrown value the way the rest of the toolkit does. `pki.cmc.build`, `pki.cmp` session and verification, and `pki.crmf` are the verbs affected, and only the text of a message changes, in the case where what was caught is not an error or carries no readable message: it is named by its type instead of by a fixed phrase, and a `message` that answers from an accessor is read once rather than twice, so the text reported is the text that was tested. A `message` accessor that throws no longer replaces the failure being reported with its own. The error codes are unchanged.
+- A caught value whose `message` is the empty string is described by its type as well. It was being reported as the empty string it was, which left the sentence built around it ending at its colon with nothing after it. This reaches every message assembled that way, including the ones `pki.ocsp.httpRequest` and the revocation fetcher build. A message of only whitespace is still a message and is reported unchanged.
+
 ## v0.8.53 — 2026-10-06
 
 Put a copy of a message's algorithm identifiers where its signature or its MAC covers them, and refuse one whose copy disagrees.

package/README.md

@@ -237,7 +237,7 @@ comment blocks, is at [pkijs.com](https://pkijs.com).
 
 | Namespace | What it does |
 |---|---|
-| `pki.asn1` | Strict, bounded DER codec. `decode` returns a zero-copy node tree, `build.*` emits canonical DER values, `read.*` are typed leaf readers. Plus `encode`, `TAGS`, OID content encode/decode, and the `isPrintableString` string predicate |
+| `pki.asn1` | Strict, bounded DER codec. `decode` returns a zero-copy node tree, `build.*` emits canonical DER values, `read.*` are typed leaf readers. A universal tag X.680 Table 1 reserves and assigns to no type is refused as `asn1/reserved-tag`, and `reservedUniversalTag` answers which tags those are without attempting a decode. Plus `encode`, `TAGS`, OID content encode/decode, and the `isPrintableString` string predicate |
 | `pki.cbor` | Strict, bounded deterministic CBOR codec (RFC 8949). `decode` returns a zero-copy node tree, plus `read.*` typed leaf readers including the keyed lookup `read.mapGet` (text or COSE-label integer key, with the map's major type asserted in the accessor). Fail-closed on every non-canonical shape: indefinite length, non-minimal argument, unsorted or duplicate map keys, non-shortest float, trailing bytes. The `build.*` encoders hold an integer argument to being an integer rather than converting one: a string in any radix, a padded or empty string, and a boolean are each refused, so an unsupplied value cannot encode as zero |
 | `pki.oid` | Two-way OID ↔ name registry, seeded with RFC 5280 and the NIST PQC arcs — `name`, `byName`, `register`, `toArcs`/`fromArcs`, `toDER`/`fromDER`, and the `isDottedDecimal` string predicate |
 | `pki.webcrypto` | A W3C `SubtleCrypto` engine over `node:crypto` — `sign`/`verify`/`encrypt`/`decrypt`/`deriveBits`/`digest`/`generateKey`/`importKey`/`exportKey` across RSA, ECDSA, ECDH, Ed25519/Ed448, AES, HMAC, HKDF, PBKDF2 and SHA, plus post-quantum ML-DSA-44/65/87, SLH-DSA, and ML-KEM-512/768/1024 key generation with certificate and PKCS#8 import. The RFC 9935 seed / expandedKey / both private-key CHOICE is validated fail-closed, so an OpenSSL-legacy bare seed or an internally inconsistent key is rejected with a typed error. `encapsulateBits` and `decapsulateBits` are the ML-KEM key-establishment pair the CMS `KEMRecipientInfo` arm rides on, with the FIPS 203 §7.3 ciphertext-length check enforced here so a direct caller inherits it. Cross-implementation use is undefined in the specification, so a `CryptoKey` from a different WebCrypto implementation is refused here with a typed fault naming its origin; the `pki.*` verbs adopt such a key instead, whether it came from the platform or from a separately installed copy of this toolkit |

package/lib/asn1-der.js

@@ -64,6 +64,49 @@ function _asn1Error(c, m) { return new Asn1Error(c, m); }
 function _oidErr(c, m) { return new OidError(c, m); }
 
 
+/**
+ * @primitive  pki.asn1.reservedUniversalTag
+ * @signature  pki.asn1.reservedUniversalTag(tagNumber) -> boolean
+ * @since      0.8.54
+ * @status     stable
+ * @spec       X.680, ISO/IEC 8824-1
+ * @related    pki.asn1.decode
+ *
+ * Whether X.680 reserves this universal tag number, which means no ASN.1 type is assigned to it and
+ * no DER encoding of any type uses it. Table 1 reserves three rows: tag 0 for the encoding rules,
+ * tag 15 for future editions of the Recommendation, and tag 37 upward for its addenda. `decode`
+ * refuses an element carrying any of them with `asn1/reserved-tag`, so this answers the same
+ * question ahead of the attempt.
+ *
+ * The question is not "does this codec have a reader for the tag", which is a smaller set:
+ * ObjectDescriptor (7), REAL (9), RELATIVE-OID (13), the time type (14), VideotexString (21),
+ * GraphicString (25) and GeneralString (27) are all assigned by X.680 and all arrive here as opaque
+ * values, and each is legitimate inside an `ANY`. This returns `false` for every one of them.
+ *
+ * @example
+ *   pki.asn1.reservedUniversalTag(0);    // -> true   (the encoding rules)
+ *   pki.asn1.reservedUniversalTag(15);   // -> true   (future editions)
+ *   pki.asn1.reservedUniversalTag(37);   // -> true   (addenda)
+ *   pki.asn1.reservedUniversalTag(9);    // -> false  (REAL, assigned, no reader here)
+ *   pki.asn1.reservedUniversalTag(31);   // -> false  (DATE, assigned)
+ */
+function reservedUniversalTag(tagNumber) {
+  /** @internal The type check comes FIRST, and a value that is not a tag number answers `false`
+   *  rather than throwing, which is how the other public predicates here answer: `isPrintableString`
+   *  and `oid.isDottedDecimal` both say "not that" of a value of the wrong type. A range test alone
+   *  calls `37.5` and `Infinity` reserved, since both sit inside the addenda range while being no
+   *  tag at all, and `tagNumber >= 37` against a caller's object runs that object's `valueOf`, so a
+   *  comparison reached before this check runs caller code inside a predicate.
+   *
+   *  Then all three rows the table reserves, tag 0 included: this answers what X.680 says, and it
+   *  says tag 0 is reserved. The decode door keeps a separate branch for tag 0 ahead of the general
+   *  one so its refusal can cite the end-of-contents encoding X.690 sec. 8.1.5 gives that octet
+   *  pair, which is the useful thing to tell whoever sent it; the answer to "is it reserved" is the
+   *  same from either place. */
+  if (typeof tagNumber !== "number" || !intrinsic.isInteger(tagNumber) || tagNumber < 0) return false;
+  return tagNumber === 0 || tagNumber === 15 || tagNumber >= 37;
+}
+
 var UNIVERSAL_TYPES = intrinsic.assign(intrinsic.create(null), {
   BOOLEAN:           { tag: 0x01, form: "primitive" },
   INTEGER:           { tag: 0x02, form: "primitive" },
@@ -89,14 +132,21 @@ var UNIVERSAL_TYPES = intrinsic.assign(intrinsic.create(null), {
   BMP_STRING:        { tag: 0x1e, form: "primitive" },
 });
 
+/** @internal Frozen, because it is exported and every structure in the toolkit names its tags
+ *  through it. Left writable, `pki.asn1.TAGS.SEQUENCE = 15` reached the encoders that compose an
+ *  identifier from it and the guard that compares one against it, so one assignment by anything
+ *  sharing the process moved what a SEQUENCE is for the whole process. The numbers are X.680's and
+ *  no caller has a reason to change one. */
 var TAGS = intrinsic.create(null);
 Object.keys(UNIVERSAL_TYPES).forEach(function (k) { TAGS[k] = UNIVERSAL_TYPES[k].tag; });
+intrinsic.freeze(TAGS);
 
 var CLASS_UNIVERSAL   = 0x00;
 var CLASS_APPLICATION = 0x40;
 var CLASS_CONTEXT     = 0x80;
 var CLASS_PRIVATE     = 0xc0;
 var CONSTRUCTED_BIT   = 0x20;
+var CLASS_MASK        = 0xc0;
 
 var CONSTRUCTED_ONLY_UNIVERSAL_TAGS = Object.create(null);
 Object.keys(UNIVERSAL_TYPES).forEach(function (k) {
@@ -185,7 +235,7 @@ function _decodeTLV(buf, start, limit, depth, maxDepth, ber, strDepth, ctr) {
   var p = start;
   if (p >= limit) throw new Asn1Error("asn1/truncated", "expected an identifier octet");
   var first = buf[p]; p += 1;
-  var tagClassBits = first & 0xc0;
+  var tagClassBits = first & CLASS_MASK;
   var constructed = (first & CONSTRUCTED_BIT) !== 0;
   var tagNumber = first & 0x1f;
 
@@ -221,6 +271,12 @@ function _decodeTLV(buf, start, limit, depth, maxDepth, ber, strDepth, ctr) {
       "universal tag 0 is the reserved end-of-contents encoding (X.690 sec. 8.1.5) and is not an element");
   }
 
+  if (tagClassBits === CLASS_UNIVERSAL && reservedUniversalTag(tagNumber)) {
+    throw new Asn1Error("asn1/reserved-tag",
+      "universal tag " + tagNumber + " is reserved by X.680 Table 1 (" + (tagNumber === 15
+        ? "for future editions" : "for addenda") + ") and is not assigned to any type");
+  }
+
   if (tagClassBits === CLASS_UNIVERSAL && CONSTRUCTED_ONLY_UNIVERSAL_TAGS[tagNumber] && !constructed) {
     throw new Asn1Error("asn1/bad-tlv", "a universal constructed-only type (SEQUENCE/SET/EXTERNAL/EMBEDDED PDV/CHARACTER STRING) must be constructed");
   }
@@ -707,9 +763,13 @@ function encodeLength(n) {
   return Buffer.concat([Buffer.from([0x80 | bytes.length]), Buffer.from(bytes)]);
 }
 
+/** @internal The identifier comes from the one function that composes one. Writing the octet here
+ *  instead put a second author of an identifier in the file, and it answered differently: with
+ *  `TAGS.SEQUENCE` reassigned to 15 this emitted `2f00`, which `decode` refuses, while every
+ *  `build.*` helper routed through `encodeIdentifier` and refused it. */
 function sequenceTlv(node) {
   var content = node.content != null ? node.content : Buffer.concat((node.children || []).map(function (c) { return c.bytes; }));
-  return Buffer.concat([Buffer.from([TAGS.SEQUENCE | CONSTRUCTED_BIT]), encodeLength(content.length), content]);
+  return Buffer.concat([encodeIdentifier(CLASS_UNIVERSAL, true, TAGS.SEQUENCE), encodeLength(content.length), content]);
 }
 
 /** @internal A constructed value written into ONE allocation, rather than concatenating the children
@@ -738,12 +798,43 @@ function encodeIdentifier(classBits, constructed, tagNumber) {
   if (typeof tagNumber !== "number" || !isFinite(tagNumber) || tagNumber < 0 || Math.floor(tagNumber) !== tagNumber) {
     throw new Asn1Error("asn1/bad-tag", "tag number must be a non-negative integer");
   }
-  var lead = classBits | (constructed ? CONSTRUCTED_BIT : 0);
+  /** @internal The class bits are taken ONCE, into the number the checks and the emitted octet all
+   *  use, and then checked to be a class. The low five bits of this argument are OR'd into the
+   *  single-octet identifier, so a `classBits` carrying any of them emits a DIFFERENT tag than the
+   *  one handed in: `encodeIdentifier(0x0e, false, 1)` wrote `0f`, universal 15, past a reserved-tag
+   *  check that had been shown tag 1. The four class values are the whole domain, with the
+   *  constructed bit allowed alongside because a caller may fold it in rather than pass it. */
+  var cls = classBits | 0;
+  if (typeof classBits !== "number" || cls !== classBits ||
+      (cls & ~(CLASS_MASK | CONSTRUCTED_BIT)) !== 0) {
+    throw new Asn1Error("asn1/bad-tag", "class bits must be one of 0x00 universal, 0x40 application, " +
+      "0x80 context or 0xc0 private, optionally with 0x20 constructed, got " + _typeOf(classBits));
+  }
+  /** @internal The size bound before the reserved rows, which is the order the decoder refuses them
+   *  in: a tag past the four-octet high-tag form it reads is unreadable whatever the table says
+   *  about the number, so both directions name `asn1/tag-too-large` for it and the reserved code
+   *  keeps meaning that X.680 reserved the row. 0x0fffffff is the largest number four 7-bit octets
+   *  hold, so this is the bound the body-length check below expressed. */
+  if (tagNumber > 0x0fffffff) throw new Asn1Error("asn1/tag-too-large", "high-tag-number too large");
+  /** @internal The reserved rows, refused in BOTH directions. X.680 Table 1 assigns no type to
+   *  universal 0, 15, or 37 upward, so there is no encoding of any type for `decode` to accept and
+   *  it refuses all three; emitting them anyway hands a caller bytes this codec's own decoder calls
+   *  malformed. The DER FORM rules are deliberately NOT enforced here: a constructed OCTET STRING or
+   *  string type is a legitimate BER encoding (X.690 sec. 8.21.1) that DER alone restricts to the
+   *  primitive form (sec. 10.2), and this encoder is the escape hatch those bytes are minted through
+   *  for the BER door that reads them. A tag number that encodes nothing is a different thing from a
+   *  form one encoding rule allows and another does not. */
+  if ((cls & CLASS_MASK) === CLASS_UNIVERSAL && reservedUniversalTag(tagNumber)) {
+    throw new Asn1Error("asn1/reserved-tag", "universal tag " + tagNumber + " is reserved by X.680 " +
+      "Table 1 (" + (tagNumber === 0 ? "for the encoding rules, which give 00 00 to the " +
+      "end-of-contents marker" : tagNumber === 15 ? "for future editions" : "for addenda") +
+      ") and is not assigned to any type, so no encoding of it is a DER element");
+  }
+  var lead = cls | (constructed ? CONSTRUCTED_BIT : 0);
   if (tagNumber < 0x1f) return Buffer.from([lead | tagNumber]);
   var body = [];
   var v = tagNumber;
   do { _unshift(body, v & 0x7f); v = Math.floor(v / 128); } while (v > 0);
-  if (body.length > 4) throw new Asn1Error("asn1/tag-too-large", "high-tag-number too large");
   for (var i = 0; i < body.length - 1; i++) body[i] |= 0x80;
   return Buffer.concat([Buffer.from([lead | 0x1f]), Buffer.from(body)]);
 }
@@ -760,6 +851,22 @@ function encodeIdentifier(classBits, constructed, tagNumber) {
  * buffer. Most callers use the higher-level `build.*` helpers; this is the
  * escape hatch for context-tagged and implicitly-tagged constructions.
  *
+ * `classBits` is a number naming a class: `0x00` universal, `0x40`
+ * application, `0x80` context or `0xc0` private, with `0x20` constructed
+ * allowed alongside. Anything else is `asn1/bad-tag`, because the low five
+ * bits of this argument are written into a single-octet identifier and a
+ * value carrying any of them emits a tag other than the one passed.
+ *
+ * A universal-class tag number that X.680 Table 1 reserves is refused with
+ * `asn1/reserved-tag`, the code `pki.asn1.decode` gives the same bytes, so the
+ * escape hatch cannot author an element the decoder calls malformed. Ask
+ * `pki.asn1.reservedUniversalTag` which numbers those are. Every other class
+ * takes any tag number the 4-octet high-tag form holds, a context `[15]`
+ * included; past that form the code is `asn1/tag-too-large`, as it is on the
+ * way in. The DER form restrictions are not applied here: a constructed
+ * OCTET STRING or character string is a legal BER encoding, and this is the
+ * door it is written through.
+ *
  * @example
  *   pki.asn1.encode(0x00, false, pki.asn1.TAGS.NULL, Buffer.alloc(0));
  */
@@ -1059,6 +1166,7 @@ function _asBufferArray(arr, who) {
 
 module.exports = {
   TAGS:          TAGS,
+  reservedUniversalTag: reservedUniversalTag,
   decode:        decode,
   isPrintableString: isPrintableString,
   encode:        encodeTLV,

package/lib/cmc-build.js

@@ -253,7 +253,7 @@ function encodeRequest(req, ids, index) {
     try { csr.parse(_der(req.tcr, "a tcr certificationRequest")); }
     catch (e) {
       throw E("cmc/bad-input", "a tcr request must be a PKCS#10 CertificationRequest: " +
-        (e && e.message ? e.message : "it did not parse as one"), e);
+        guard.text.describeThrown(e), e);
     }
     var id = ids.claim(req.bodyPartID, "a tcr request");
     return { bodyPartID: id, der: b.contextConstructed(0, Buffer.concat([b.integer(BigInt(id)), _der(req.tcr, "a tcr certificationRequest")])) };
@@ -263,7 +263,7 @@ function encodeRequest(req, ids, index) {
     try { crmf.parse(b.sequence([msg])); }
     catch (e) {
       throw E("cmc/bad-input", "a crm request must be an RFC 4211 CertReqMsg: " +
-        (e && e.message ? e.message : "it did not parse as one"), e);
+        guard.text.describeThrown(e), e);
     }
     var certReqId = ids.claim(_certReqIdOf(msg), "a crm request");
     var node = asn1.decode(msg);
@@ -947,7 +947,7 @@ async function _build(spec, signer, opts) {
   } catch (e) {
     throw E("cmc/bad-input",
       "the assembled PKIData does not parse as one, so it would be refused by its recipient: " +
-      (e && e.message ? e.message : "malformed"), e);
+      guard.text.describeThrown(e), e);
   }
 
   /** @internal RFC 5272 sec. 3.2 gives a Full PKI Request two carriers, and a request uses one: a

package/lib/cmp-session.js

@@ -971,8 +971,8 @@ function session(opts) {
     var res;
     try { res = await _engine.build(leaf, { trustAnchors: _asCertList(opts.trustAnchors), intermediates: pool, validate: true, time: opts.time != null ? opts.time : new Date() }); }
     catch (e) {
-      if (e.code === "path/bad-input") throw _err("cmp/bad-input", "invalid trust / validation options for issued-certificate validation: " + (e.message || e), e);
-      throw _err("cmp/bad-cert-response", "the issued certificate could not be validated to a supplied trust anchor: " + (e.message || e), e);
+      if (e.code === "path/bad-input") throw _err("cmp/bad-input", "invalid trust / validation options for issued-certificate validation: " + guard.text.describeThrown(e), e);
+      throw _err("cmp/bad-cert-response", "the issued certificate could not be validated to a supplied trust anchor: " + guard.text.describeThrown(e), e);
     }
     if (!res || res.valid !== true) throw _err("cmp/bad-cert-response", "the issued certificate did not validate to a supplied trust anchor (its signature or chain is invalid) (RFC 5280 sec. 6.1)");
   }

package/lib/cmp-verify.js

@@ -671,9 +671,9 @@ async function _chainSigner(signer, m, opts, extra) {
     return guard.verdict.of({ trusted: true, reason: null, chain: chain });
   } catch (e) {
     if (e && e.code === "path/bad-input") {
-      throw _err("cmp/bad-input", "invalid trust / validation options for signer-certificate path validation: " + (e.message || e), e);
+      throw _err("cmp/bad-input", "invalid trust / validation options for signer-certificate path validation: " + guard.text.describeThrown(e), e);
     }
-    return guard.verdict.of({ trusted: false, reason: "signer certificate path validation failed: " + (e.message || e) });
+    return guard.verdict.of({ trusted: false, reason: "signer certificate path validation failed: " + guard.text.describeThrown(e) });
   }
 }
 

package/lib/crmf-sign.js

@@ -943,7 +943,7 @@ async function _assertEnclosedKeyCorresponds(privateKeyDer, templateSpki) {
      * failing, not the input. */
     if (e && e.isPkiError === true && e.code === "key/bad-input") {
       throw _err("crmf/bad-input", "pop.privateKey could not be read as a private key to check against " +
-        "certTemplate.publicKey: " + (e.message || e), e);
+        "certTemplate.publicKey: " + guard.text.describeThrown(e), e);
     }
     throw _err("crmf/bad-popo", "the private key enclosed in the encryptedKey proof of possession could not be " +
       "exercised with certTemplate.publicKey, so it cannot be shown to be that key's private half (RFC 4211 sec. 4.2)", e);

package/lib/ct.js

@@ -1353,18 +1353,16 @@ function _clientDoor(opts, keyName) {
 }
 
 /** @internal Every DECLARED option the bag can answer, read once into a record of plain values, before
- *  anything derives from one. `in` is used rather than an enumeration because the door accepts an option
- *  supplied through a caller's defaults object, and an enumeration omits an inherited FUNCTION member,
- *  which silently dropped a `transport` and fell through to opening a real connection. It consults the
- *  prototype chain exactly as the direct reads it replaces did, so it carries no new exposure, and
- *  absence survives: a name the bag cannot answer is left out rather than materialized as `undefined`,
- *  which a guard that tells absent from present-and-undefined depends on. */
+ *  anything derives from one. The presence-preserving snapshot is the one this module needs: absence
+ *  survives, so a name the bag cannot answer is left out rather than materialized as `undefined`,
+ *  which is what lets an absent `transport` still mean "open the connection yourself, under the
+ *  pinned anchors". It consults the prototype chain exactly as the direct reads it replaces did,
+ *  because the door accepts an option supplied through a caller's defaults object and an enumeration
+ *  omits an inherited FUNCTION member, which silently dropped a `transport` and fell through to
+ *  opening a real connection. */
+// @guard-via guard.identifier.snapshotPresentOptions
 function _takeTopLevel(bag, known) {
-  var o = intrinsic.create(null);
-  intrinsic.forEach(intrinsic.keys(known), function (k) {
-    if (k in bag) o[k] = bag[k];
-  });
-  return o;
+  return guard.identifier.snapshotPresentOptions(bag, known);
 }
 
 /** @internal The two values a verdict rests on, made IMMUNE rather than merely taken. Holding a

package/lib/guard-der.js

@@ -8,23 +8,42 @@ var _forEach = require("./guard-intrinsic").forEach;
 var _sizeOf = require("./guard-intrinsic").sizeOf;
 var _create = require("./guard-intrinsic").create;
 var _isBuffer = require("./guard-intrinsic").isBuffer;
+var _isArray = require("./guard-intrinsic").isArray;
 
 var asn1 = null;
 function _asn1() { if (asn1 === null) asn1 = require("./asn1-der"); return asn1; }
 
-var VALUE_READERS = null;
-function _readers() {
-  if (VALUE_READERS !== null) return VALUE_READERS;
-  var asn1 = _asn1();
-  var m = _create(null), R = asn1.read, T = asn1.TAGS;
-  m[T.BOOLEAN] = R.boolean; m[T.INTEGER] = R.integer; m[T.ENUMERATED] = R.enumerated;
-  m[T.BIT_STRING] = R.bitString; m[T.OCTET_STRING] = R.octetString; m[T.NULL] = R.nullValue;
-  m[T.OBJECT_IDENTIFIER] = R.oid; m[T.UTC_TIME] = R.time; m[T.GENERALIZED_TIME] = R.time;
-  m[T.NUMERIC_STRING] = R.numericString;
+/** @internal Everything this file needs from the codec, captured in ONE step on first use: the two
+ *  functions it calls, the two tag NUMBERS it compares against, and the reader table. Read per call
+ *  instead, each is a property of a module object anything sharing the process can assign to, and
+ *  the verdict follows the assignment: `reservedUniversalTag` replaced by a function answering
+ *  `true` made `tlv` refuse a valid NULL, and `TAGS.SEQUENCE` reassigned made both `element` and
+ *  `tlv` refuse a valid empty SEQUENCE. The tag numbers are copied out rather than the table kept,
+ *  because freezing a record holding a reference leaves what it points at writable. One step rather
+ *  than two because two initialize at different first calls, and the gap between them was itself a
+ *  window: warming the codec through a context node left the readers uncaptured, and `read.nullValue`
+ *  replaced in between turned a NULL with content from refused into accepted. The capture is lazy
+ *  because the codec requires this file, so neither can be required at the other's load. */
+var CODEC = null;
+function _codec() {
+  if (CODEC !== null) return CODEC;
+  var m = _asn1();
+  var R = m.read, T = m.TAGS;
+  var readers = _create(null);
+  readers[T.BOOLEAN] = R.boolean; readers[T.INTEGER] = R.integer; readers[T.ENUMERATED] = R.enumerated;
+  readers[T.BIT_STRING] = R.bitString; readers[T.OCTET_STRING] = R.octetString;
+  readers[T.NULL] = R.nullValue; readers[T.OBJECT_IDENTIFIER] = R.oid; readers[T.UTC_TIME] = R.time;
+  readers[T.GENERALIZED_TIME] = R.time; readers[T.NUMERIC_STRING] = R.numericString;
   _forEach([T.UTF8_STRING, T.PRINTABLE_STRING, T.IA5_STRING, T.TELETEX_STRING, T.VISIBLE_STRING,
-    T.BMP_STRING, T.UNIVERSAL_STRING], function (t) { m[t] = R.string; });
-  VALUE_READERS = m;
-  return VALUE_READERS;
+    T.BMP_STRING, T.UNIVERSAL_STRING], function (t) { readers[t] = R.string; });
+  CODEC = _freeze({
+    decode: m.decode,
+    reservedUniversalTag: m.reservedUniversalTag,
+    SEQUENCE: T.SEQUENCE,
+    SET: T.SET,
+    readers: _freeze(readers),
+  });
+  return CODEC;
 }
 
 var TAG_CLASS_RANK = _create(null);
@@ -48,30 +67,69 @@ function setOrderOk(kids) {
   return dup ? octetAsc : (octetAsc || tagAsc);
 }
 
-// @enforced-by guard-shape-reinlined
-// @guard-shape _ANY_VALUE_READERS\[
-function element(node, E, code, label) {
-  if (node.tagClass === "universal" && node.tagNumber === 0) {
+// @enforced-by behavioral -- validating a universal element's content through the codec's own reader
+// @enforced-by behavioral -- for its tag has no rename-proof shape: a re-inline builds a table keyed
+// @enforced-by behavioral -- by a TAGS member under any local name, and an anchor on one name goes
+// @enforced-by behavioral -- silently green on a rename. The RED vectors in guard-der.test.js are the
+// @enforced-by behavioral -- guard, and every format parser's strict-DER vectors route through tlv.
+function element(node, E, code, label) { _element(node, E, code, label); }
+
+/** @internal Every field of the node is taken ONCE, into the plain record every rule below decides
+ *  on, every reader is handed, and the SET-order check compares. Read per rule instead, a node whose
+ *  `tagNumber` answers from a getter clears one check as the tag it is not and is then handled as the
+ *  tag it is: a node answering 15 and then 5 was ACCEPTED, over four reads. A Proxy saw two reads of
+ *  each field, the content validator was handed the caller's object rather than what was checked, and
+ *  a SET member's getter answered the order comparison with a value the member's own validation never
+ *  saw. The record is TYPED because each field is read as something: the tag becomes a property key at
+ *  the reader lookup, which runs a `Symbol.toPrimitive` an object carries, and the form decides a
+ *  branch a truthy non-boolean enters. `decode` answers every field with a plain value for every
+ *  input it accepts, so this refuses only a node the codec did not produce. The node `tlv` passes
+ *  holds plain values; what the record closes is the next caller, which hands this a node it decoded
+ *  elsewhere or built itself. Returned so the caller's walk compares the members it validated. */
+function _element(node, E, code, label) {
+  if (!node || typeof node !== "object") throw E(code, label + " must be a decoded DER node");
+  var s = {
+    tagClass: node.tagClass,
+    tagNumber: node.tagNumber,
+    constructed: node.constructed,
+    content: node.content,
+    bytes: node.bytes,
+  };
+  var kids = s.constructed === true ? node.children : null;
+  if (typeof s.tagClass !== "string" || typeof s.tagNumber !== "number" ||
+      typeof s.constructed !== "boolean" || (s.constructed && !_isArray(kids))) {
+    throw E(code, label + " must be a node this codec decoded, carrying a tag class, a tag number, " +
+      "a form, and members when it is constructed");
+  }
+  var cls = s.tagClass, tag = s.tagNumber, C = _codec();
+  if (cls === "universal" && tag === 0) {
     throw E(code, label + " must not use the reserved end-of-contents encoding (tag 0)");
   }
-  var T = _asn1().TAGS;
-  if (node.constructed) {
-    if (node.tagClass === "universal" && node.tagNumber !== T.SEQUENCE && node.tagNumber !== T.SET) {
-      throw E(code, label + " of universal constructed type " + node.tagNumber + " has no strict DER structure validator here");
+  /** @internal The other reserved rows, asked of the codec's own predicate so the two cannot
+   *  disagree about which universal tags X.680 Table 1 assigns to no type. The codec door refuses
+   *  these before a node exists, so this answers for a node that reached here by another route. */
+  if (cls === "universal" && C.reservedUniversalTag(tag)) {
+    throw E(code, label + " must not use universal tag " + tag +
+      ", which X.680 Table 1 reserves and assigns to no type");
+  }
+  if (s.constructed) {
+    if (cls === "universal" && tag !== C.SEQUENCE && tag !== C.SET) {
+      throw E(code, label + " of universal constructed type " + tag + " has no strict DER structure validator here");
     }
-    var kids = node.children;
-    for (var i = 0; i < kids.length; i++) element(kids[i], E, code, label);
-    if (node.tagClass === "universal" && node.tagNumber === T.SET && !setOrderOk(kids)) {
+    var n = kids.length, members = [];
+    for (var i = 0; i < n; i++) members[i] = _element(kids[i], E, code, label);
+    if (cls === "universal" && tag === C.SET && !setOrderOk(members)) {
       throw E(code, label + " has a SET whose members are in no canonical DER order (X.690 sec. 11.6 / X.680 sec. 8.6)");
     }
-    return;
+    return s;
   }
-  if (node.tagClass === "universal") {
-    var reader = _readers()[node.tagNumber];
-    if (!reader) throw E(code, label + " of universal type " + node.tagNumber + " has no strict DER content validator here");
-    try { reader(node); }
+  if (cls === "universal") {
+    var reader = C.readers[tag];
+    if (!reader) throw E(code, label + " of universal type " + tag + " has no strict DER content validator here");
+    try { reader(s); }
     catch (e) { throw E(code, label + " is not a valid DER element for its type", e); }
   }
+  return s;
 }
 
 // @enforced-by guard-shape-reinlined
@@ -79,7 +137,7 @@ function element(node, E, code, label) {
 function tlv(content, E, code, label) {
   if (!content || _sizeOf(content) === 0) throw E(code, label + " must be a non-empty DER element");
   var node;
-  try { node = _asn1().decode(content); }
+  try { node = _codec().decode(content); }
   catch (e) { throw E(code, label + " must be exactly one well-formed DER element (no trailing data)", e); }
   element(node, E, code, label);
   return content;
@@ -115,8 +173,13 @@ function paramsAbsentOrNull(params) {
  */
 function sameAlgorithmExactly(a, c) {
   if (!a || !c || a.oid !== c.oid) return false;
-  var ap = a.parameters === undefined ? null : a.parameters;
-  var cp = c.parameters === undefined ? null : c.parameters;
+  /** @internal Each operand's `parameters` is read ONCE, into the value the absence test and the
+   *  comparison share. Read twice, the first value decided which branch ran and the second was the
+   *  one compared, so a getter answering a DER NULL and then `null` made an algorithm carrying
+   *  parameters compare EQUAL to one carrying none. */
+  var araw = a.parameters, craw = c.parameters;
+  var ap = araw === undefined ? null : araw;
+  var cp = craw === undefined ? null : craw;
   if (ap === null || cp === null) return ap === cp;
   return _isBuffer(ap) && _isBuffer(cp) && _sizeOf(ap) === _sizeOf(cp) && _compare(ap, cp) === 0;
 }

package/lib/guard-encoding.js

@@ -171,7 +171,8 @@ function _rawError(E) {
  * characters passes a URL the rule was meant to refuse.
  *
  * @enforced-by guard-shape-reinlined
- * @guard-shape /charCodeAt\s*\(\s*[\w$]+\s*,\s*[\w$]+\s*\)\s*>\s*(?:0x7f|127)\b/ */
+ * @guard-shape charCodeAt\s*\(\s*[\w$]+\s*,\s*[\w$]+\s*\)\s*>\s*(?:0x7f|127)\b
+ */
 function isAsciiText(s) {
   if (typeof s !== "string") return false;
   for (var i = 0; i < s.length; i++) {

package/lib/guard-identifier.js

@@ -101,6 +101,28 @@ function snapshotOptions(obj, known) {
   return out;
 }
 
+/** @internal The same one-read capture, for a caller that tells an ABSENT option from one present
+ *  and holding `undefined`. `snapshotOptions` materializes every declared name, which is correct for
+ *  a caller testing `!== undefined` and wrong for one testing presence: an omitted option becomes an
+ *  own key, and a presence-based guard then sees an option the caller never passed. Measured, a bag
+ *  omitting `transport` is ACCEPTED by `assertCallableOption` and REFUSED after `snapshotOptions`,
+ *  because the materialized `undefined` is a transport that is not callable.
+ *
+ *  Presence consults the prototype chain, because a caller supplying options through a defaults
+ *  object is supplying them, and an enumeration omits an inherited FUNCTION member: that is how a
+ *  copy once dropped a `transport` and fell through to opening a real connection where the caller
+ *  had passed a fake one. The VALUE is still read once per name, which is what the snapshot is for.
+ *  The two live side by side rather than behind a flag so a caller chooses between them knowingly. */
+// @enforced-by guard-shape-reinlined
+// @guard-shape if \(\w+ in \w+\) \w+\[\w+\] = \w+\[\w+\];
+function snapshotPresentOptions(obj, known) {
+  var out = _create(null);
+  if (obj === null || obj === undefined) return out;
+  var o = _Object(obj);
+  _forEach(_getOwnPropertyNames(known), function (k) { if (k in o) out[k] = o[k]; });
+  return out;
+}
+
 /** @internal The option names a bag carries, read the way assertKnownKeys read them: every own
  *  string key, whatever its descriptor says. Object.keys reports only the enumerable ones, so an
  *  option written with `enumerable: false` clears the door and then vanishes from the read.
@@ -634,7 +656,8 @@ function _showSwitch(value) {
  * the object, so an accessor further up the chain cannot answer either.
  *
  * @enforced-by guard-shape-reinlined
- * @guard-shape /\.\s*blocksPrivateAddresses\s*===\s*true/ */
+ * @guard-shape \.\s*blocksPrivateAddresses\s*===\s*true
+ */
 function declaresOwn(obj, name) {
   if (obj === null || obj === undefined) return false;
   var d;
@@ -655,6 +678,7 @@ module.exports = intrinsic.freeze({
   optionsObject: optionsObject,
   refuseAccessorFields: refuseAccessorFields,
   snapshotOptions: snapshotOptions,
+  snapshotPresentOptions: snapshotPresentOptions,
   optionNames: optionNames,
   ownOptions: ownOptions,
   pickSettings: pickSettings,

package/lib/guard-name.js

@@ -198,6 +198,7 @@ function escapeControlBytes(str) {
 var DN_SPECIAL = intrinsic.assign(intrinsic.create(null), { 0x2c: 1, 0x2b: 1, 0x22: 1, 0x5c: 1, 0x3c: 1, 0x3e: 1, 0x3b: 1 });
 
 var _hexNibble = require("./guard-encoding").hexNibble;
+var _isAsciiText = require("./guard-encoding").isAsciiText;
 function _isAttrTypeStart(c) { return (c >= 0x41 && c <= 0x5a) || (c >= 0x61 && c <= 0x7a); }
 function _isAttrTypeChar(c) { return _isAttrTypeStart(c) || (c >= 0x30 && c <= 0x39) || c === 0x2d; }
 function _isDigit(c) { return c >= 0x30 && c <= 0x39; }
@@ -335,10 +336,12 @@ function emailEqual(a, b) {
   return lowerAscii(aHost) === lowerAscii(bHost) ? "match" : "no-match";
 }
 
+/** @internal An all-ASCII host, asked of the one place that scans for a byte above 0x7f, with the
+ *  non-empty requirement kept here because a host part is not optional and `isAsciiText` answers
+ *  `true` of the empty string. */
+// @guard-via guard.encoding.isAsciiText
 function _asciiHost(h) {
-  if (h.length === 0) return false;
-  for (var i = 0; i < h.length; i++) if (_charCodeAt(h, i) > 0x7f) return false;
-  return true;
+  return h.length > 0 && _isAsciiText(h);
 }
 
 // @enforced-by guard-shape-reinlined

package/lib/guard-text.js

@@ -102,13 +102,17 @@ function keyOf(v) {
  * by its type, which is what `showValue` would have said about it anyway.
  *
  * @enforced-by guard-shape-reinlined
- * @guard-shape /([\w$]+)\s*&&\s*\1\.message\s*\?\s*\1\.message\s*:|([\w$]+)\.message\s*\|\|\s*\2\b/ */
+ * @guard-shape ([\w$]+)\s*&&\s*\1\.message\s*\?\s*\1\.message\s*:|([\w$]+)\.message\s*\|\|\s*\2\b
+ */
 function describeThrown(e) {
   var m;
   try { m = e === null || e === undefined ? undefined : e.message; }
   catch (_readFailed) { return _thrownFallback(e); }
   if (typeof m === "string" && m.length > 0) return m;
-  if (m === undefined || m === null) return _thrownFallback(e);
+  /** @internal An EMPTY message answers nothing readable, so it is described by its type like any
+   *  other unreadable value. Returned as the empty string it was, it left the sentence built around
+   *  it ending at its colon with nothing after it, which tells a reader less than the type does. */
+  if (m === undefined || m === null || m === "") return _thrownFallback(e);
   try {
     if (typeof m === "symbol") return intrinsic.String(m);
     return "" + m;

package/lib/path-validate.js

@@ -3301,7 +3301,7 @@ async function _fetchAiaIssuers(current, aia) {
 
 /**
  * @primitive  pki.path.build
- * @signature  pki.path.build(leaf, opts) -> Promise<{ valid, path, trustAnchor, result, candidatesConsidered, aiaFetches }>
+ * @signature  pki.path.build(leaf, opts) -> Promise<{ valid, path, trustAnchor, result, candidatesConsidered, aiaFetches, depthLimited? }>
  * @since       0.3.7
  * @status      stable
  * @spec        RFC 4158, RFC 5280
@@ -3347,7 +3347,12 @@ async function _fetchAiaIssuers(current, aia) {
  * `validate` consumes (anchor-proximal first, leaf last, the anchor excluded). Fail-closed: bad
  * options throw `path/bad-input`; no chain to any anchor throws `path/no-path`; chains that
  * assemble but none validate return `{ valid:false }` with the best failing `validate` result;
- * the search bound throws `path/build-limit`. By default `build` is OFFLINE (zero network), so supply
+ * the search bound throws `path/build-limit`. A `{ valid:false }` return carries
+ * `depthLimited: true` when the depth cap stopped an expansion that still had candidates waiting,
+ * which means the chain reported is the best one ASSEMBLED rather than the best one that exists: a
+ * caller that treats `valid:false` as a verdict about the certificates should read that field and
+ * raise `opts.maxDepth` instead. It is absent on a successful return and on a failing one the
+ * search explored to its end. By default `build` is OFFLINE (zero network), so supply
  * intermediates in `opts.candidates`. Set `opts.fetchAia: true` to opt in to fetching a MISSING intermediate
  * from a certificate's Authority Information Access `caIssuers` URL (RFC 5280 sec. 4.2.2.1) over
  * `pki.transport`: the fetch triggers only on a pool miss, every fetched certificate is UNTRUSTED pool material
@@ -3511,14 +3516,24 @@ async function build(leaf, opts) {
 
   var BUILD_ONLY_OPT = { candidates: 1, intermediates: 1, trustAnchors: 1, maxDepth: 1, maxCandidatesConsidered: 1, validate: 1,
     fetchAia: 1, transport: 1, tls: 1, maxAiaFetches: 1, maxAiaPerCert: 1, aiaTimeout: 1, maxResponseBytes: 1 };
-  var forwarded = Object.create(null);
+  /** @internal The names this door forwards by VALUE: every validate option that is not consumed by
+   * the builder and not one of the switches typed above. Absence has to survive the copy, so the
+   * presence-preserving snapshot is the one to take: an option the caller omitted stays omitted
+   * rather than arriving at `validate` as a name holding `undefined`.
+   * @guard-via guard.identifier.snapshotPresentOptions */
+  var FORWARD_BY_VALUE = intrinsic.create(null);
   intrinsic.forEach(intrinsic.keys(_VALIDATE_OPTS), function (k) {
-    if (intrinsic.hasOwn(BUILD_ONLY_OPT, k)) return;
-    /** @internal A switch this door typed is forwarded as the value it typed. Reading it off the
-     * options object again would ask a second time, and normalizing an anchor between the two runs
-     * caller accessors, so the value `validate` is handed need not be the one that passed here. */
-    if (intrinsic.hasOwn(forwardedSwitches, k)) { forwarded[k] = forwardedSwitches[k]; return; }
-    if (k in opts) forwarded[k] = opts[k];
+    if (intrinsic.hasOwn(BUILD_ONLY_OPT, k) || intrinsic.hasOwn(forwardedSwitches, k)) return;
+    FORWARD_BY_VALUE[k] = 1;
+  });
+  var forwarded = guard.identifier.snapshotPresentOptions(opts, FORWARD_BY_VALUE);
+  /** @internal A switch this door typed is forwarded as the value it typed, overlaid after the copy.
+   * Reading it off the options object again would ask a second time, and normalizing an anchor
+   * between the two runs caller accessors, so the value `validate` is handed need not be the one that
+   * passed here. All four are validate options and none is build-only, so the overlay adds no name
+   * the loop above would have skipped. */
+  intrinsic.forEach(intrinsic.keys(forwardedSwitches), function (k) {
+    forwarded[k] = forwardedSwitches[k];
   });
   if (buildPermRaw != null) forwarded.initialPermittedSubtrees = buildPermSeeds;
   if (buildExclRaw != null) forwarded.initialExcludedSubtrees = buildExclSeeds;
@@ -3533,6 +3548,10 @@ async function build(leaf, opts) {
   var considered = 0;
   var anyChainAssembled = false;
   var bestFail = null;
+  /** @internal Whether the depth bound stopped an expansion that had candidates waiting. A reached
+   * bound is "stopped looking", not "the chain is bad", and the two left this verb returning the
+   * same `valid:false`. */
+  var depthStopped = false;
   var success = null;
   _assertUserInitialPolicySet(opts.userInitialPolicySet, "build");
   var uipsDistinct = null, selectByPolicy = false;
@@ -3570,7 +3589,6 @@ async function build(leaf, opts) {
           guard.list.append(accepted, racc);
         } else if (!bestFail) bestFail = { path: rpath, trustAnchor: rframe.anchor, result: rres };
       }
-      if (rframe.hop >= maxDepth) continue;
       var rscored = [];
       for (var rpi = 0; rpi < pool.length; rpi++) {
         if (nameMatchSoft(pool[rpi].subject.rdns, rframe.anchor.name.rdns) &&
@@ -3579,6 +3597,13 @@ async function build(leaf, opts) {
           guard.list.append(rscored, { cand: pool[rpi], score: scoreCandidateReverse(pool[rpi], frontierCert, leafCert, opts.time) });
         }
       }
+      /** @internal The anchor-first search answers the same question the forward one does, for the
+       * same reason: candidates scored before the bound is consulted, so reaching it can say whether
+       * it stopped anything. */
+      if (rframe.hop >= maxDepth) {
+        if (_anyExpandable(rscored, rframe)) depthStopped = true;
+        continue;
+      }
       considered += _pushCandidates(rframe, rscored, rstack, counter, true);
     }
   } else {
@@ -3635,7 +3660,7 @@ async function build(leaf, opts) {
         guard.list.append(accepted, acc);
       } else if (!bestFail) bestFail = { path: frame.chain.slice(), trustAnchor: anchors[ai], result: res };
     }
-    if (success || frame.hop >= maxDepth) continue;
+    if (success) continue;
 
     var childAki = childAkiKeyId(current);
     var scored = [];
@@ -3645,6 +3670,16 @@ async function build(leaf, opts) {
           ineligible: _forwardPathLenIneligible(pool[pi], frame.chain) });
       }
     }
+    /** @internal The candidates are scored BEFORE the depth bound is consulted, so reaching the
+     * bound can say whether it stopped anything. A chain whose last hop lands on the bound with
+     * nothing left to expand was explored to its end, and a chain with candidates waiting was
+     * TRUNCATED: the two produce the same `valid:false` otherwise, and a caller reading that cannot
+     * tell a refused chain from one the search never assembled. Nothing is pushed either way, so the
+     * reorder costs one pool pass on a frame at the bound and changes no outcome. */
+    if (frame.hop >= maxDepth) {
+      if (_anyExpandable(scored, frame)) depthStopped = true;
+      continue;
+    }
     if (aiaCtx && frame.hop < maxDepth && aiaCtx.fetches < aiaCtx.maxFetches) {
       guard.list.append(deferredAia, { chain: frame.chain, hop: frame.hop, keys: frame.keys, poolMark: pool.length, seq: deferSeq, fetched: false });
       deferSeq += 1;
@@ -3666,11 +3701,29 @@ async function build(leaf, opts) {
     return guard.verdict.of({ path: success.path, trustAnchor: success.trustAnchor, candidatesConsidered: considered, aiaFetches: aiaFetches });
   }
   if (anyChainAssembled) {
-    return guard.verdict.of({ valid: false, path: bestFail.path, trustAnchor: bestFail.trustAnchor, result: bestFail.result, candidatesConsidered: considered, aiaFetches: aiaFetches });
+    /** @internal `depthLimited` is carried only on the FAILING return, and only when the bound
+     * stopped an expansion. On a success the bound hid nothing that mattered, and a caller reading
+     * the field on every verdict would have to ask what it meant for a valid path. */
+    var failed = { valid: false, path: bestFail.path, trustAnchor: bestFail.trustAnchor, result: bestFail.result, candidatesConsidered: considered, aiaFetches: aiaFetches };
+    if (depthStopped) failed.depthLimited = true;
+    return guard.verdict.of(failed);
   }
   throw E("path/no-path", "build: no certification path from the leaf to any configured trust anchor could be assembled");
 }
 
+/** @internal Whether raising the depth cap could reach anything through these candidates. A
+ * candidate already on the chain is skipped by `_pushCandidates` on the identity key, so a deeper
+ * search would skip it too: counting it reports a truncated search where the search is exhausted,
+ * which turns a chain this toolkit refuses into one it says it never finished reading. The identity
+ * key and the frame's visited set are the same two the push uses, so the two cannot disagree about
+ * which candidate is reachable. */
+function _anyExpandable(scored, frame) {
+  for (var i = 0; i < scored.length; i++) {
+    if (!intrinsic.setHas(frame.keys, identityKey(scored[i].cand))) return true;
+  }
+  return false;
+}
+
 /** @internal The fetching checker composes the two gates below, so it loads after this module
  * rather than beside it. The require sits in the call so the cycle resolves at first use, which is
  * the documented reason an inline require is permitted. */

package/lib/sigstore.js

@@ -1417,8 +1417,11 @@ async function _verifyChain(leaf, chainDers, roots, timeMs) {
    * reported `chain-invalid`. `build` ranks candidates by the RFC 4158 sec. 3.5 heuristics, the key
    * identifier among them, EXCLUDING none, and bounds the search by total candidate expansions rather
    * than by how many paths it has collected, so a later candidate stays reachable and an exhausted
-   * budget is reported as `path/build-limit` rather than as a verdict about the chain. Every assembled
-   * path still flows through `pki.path.validate`, so this delegates the search and duplicates no check.
+   * budget is reported as `path/build-limit` rather than as a verdict about the chain, and a depth bound
+   * that stopped an expansion as `depthLimited` on the failing return. Both reach the incomplete code
+   * below, because a bound the search reached says nothing about the certificates it never read. Every
+   * assembled path still flows through `pki.path.validate`, so this delegates the search and duplicates
+   * no check.
    * The anchors go into the pool as well as the trust store, because a cross-signed root appears in a
    * chain as an intermediate under another anchor. */
   var anchorTuples = _map(inWindow, function (r) {
@@ -1462,6 +1465,14 @@ async function _verifyChain(leaf, chainDers, roots, timeMs) {
     throw _err("sigstore/chain-invalid", "the Fulcio certificate chain failed validation: " + e.message, e);
   }
   if (!built.valid) {
+    /** @internal The third outcome that means "stopped looking". `build` reports `depthLimited` when
+     * its depth bound stopped an expansion that had candidates waiting, so the chain it hands back
+     * is the best one it ASSEMBLED rather than the best one that exists. Reporting that as invalid
+     * denies a bundle whose path the search never reached, which is the same denial the candidate
+     * bound above avoids, so it answers with the same incomplete code. */
+    if (built.depthLimited) {
+      throw _err("sigstore/chain-incomplete", "no chain to a caller-supplied Fulcio anchor was established before the path search reached its depth bound");
+    }
     throw _err("sigstore/chain-invalid", "the Fulcio certificate chain is not valid as of the log time");
   }
   /** @internal `path` is anchor-proximal first and leaf last with the anchor excluded, so the certificate

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.53",
+  "version": "0.8.55",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:f287baca-f745-4ecd-8265-d6953251f0b6",
+  "serialNumber": "urn:uuid:f7650379-6444-462e-bd4b-7cfbdc879bc7",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-06T00:56:34.786Z",
+    "timestamp": "2026-10-06T04:32:24.064Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.53",
+      "bom-ref": "@blamejs/pki@0.8.55",
       "type": "application",
       "name": "pki",
-      "version": "0.8.53",
+      "version": "0.8.55",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.53",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.55",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.53",
+      "ref": "@blamejs/pki@0.8.55",
       "dependsOn": []
     }
   ]