# `asn1/oid` — OBJECT IDENTIFIER encode / decode

## Purpose

Encodes and decodes ASN.1 OBJECT IDENTIFIER bodies per X.690 paragraph 8.19. OIDs in X.509 identify algorithms, extensions, key purposes, name attributes, and policies — every dispatch site in this package keys on a dotted-decimal string returned by `decodeOid`. The encoder is needed only for synthesising test fixtures since `parseCertificate` never re-emits OIDs onto the wire.

## Features

- Folded first-arc decoding (X.690 paragraph 8.19.4): the leading sub-identifier splits into two arcs by the `value < 80` / `value >= 80` rule.
- Minimal sub-identifier check — leading `0x80` byte on a sub-identifier is rejected as non-minimal.
- Truncation guard — a sub-identifier that ends mid-byte (high-bit set on final byte) is rejected.
- Symmetric encoder — produces the same byte sequence the decoder would consume.

## Usage: Basic Example

```ts
import { decodeOid, encodeOid } from "@suaveplan/x509/asn1";

const dotted = decodeOid(new Uint8Array([0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x0b]));
// "1.2.840.113549.1.1.11" (sha256WithRSAEncryption)

const back = encodeOid("1.2.840.113549.1.1.11");
```

## Usage: Advanced Example

```ts
import { decodeOid, encodeOid } from "@suaveplan/x509/asn1";

// Round-trip every OID in a recognised set:
const OIDS = [
    "2.5.29.17",       // subjectAltName
    "2.5.29.19",       // basicConstraints
    "1.3.101.112",     // id-Ed25519
];
for (const o of OIDS) {
    const body = encodeOid(o);
    const back = decodeOid(body);
    if (back !== o) throw new Error("round-trip mismatch");
}
```

## API Reference

- `decodeOid(body: Uint8Array): string` — OID body (without outer tag-length) into dotted-decimal string. Throws `X509Error(ASN1_MALFORMED)` on empty body, non-minimal sub-id, or truncation.
- `encodeOid(dotted: string): Uint8Array` — dotted-decimal into OID body. Throws on negative or non-decimal arcs, or invalid first two arcs.

## Implementation Notes

- Decoder uses `bigint` arithmetic for sub-identifiers — production OIDs occasionally exceed 32 bits (e.g. some experimental private-enterprise IDs).
- `arc1 ∈ {0, 1, 2}`; `arc2 < 40` when `arc1 < 2`. The encoder validates this constraint and folds correctly.
- Empty OIDs are rejected — every X.509 production that carries an OID requires at least two arcs.