@blamejs/pki 0.1.14 → 0.1.15

package/CHANGELOG.md

@@ -4,7 +4,27 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## v0.1.14 — 2026-07-06
+## v0.1.15 — 2026-07-06
+
+CMS EnvelopedData and EncryptedData join the parser, and every documentation example is now executed as a test.
+
+### Added
+
+- pki.schema.cms.parse now decodes CMS EnvelopedData (RFC 5652 §6) and EncryptedData (§8). An EnvelopedData returns { version, originatorInfo, recipientInfos, encryptedContentInfo, unprotectedAttrs } with all five RecipientInfo kinds decoded — KeyTransRecipientInfo (§6.2.1, with the issuerAndSerialNumber/subjectKeyIdentifier version coupling enforced), KeyAgreeRecipientInfo (§6.2.2 + RFC 5753 §3.1), KEKRecipientInfo (§6.2.3), PasswordRecipientInfo (§6.2.4), and OtherRecipientInfo (§6.2.5). An EncryptedData returns { version, encryptedContentInfo, unprotectedAttrs }. The wrapped keys, the ciphertext, and all AlgorithmIdentifier parameters are surfaced raw — every recipient carries the keyEncryptionAlgorithm its encryptedKey must be unwrapped with, and a kekid / rKeyId OtherKeyAttribute is surfaced as raw DER — decryption and key-unwrap are a separate layer. The CMSVersion is recomputed and enforced per structure and per recipient, recipientInfos is required non-empty, and the encryptedContent [0] IMPLICIT OCTET STRING is read as the ciphertext directly.
+- The schema engine gains an implicitTag option on pki.schema.engine.seq() and on pki.schema.pkix.algorithmIdentifier(ns, { implicitTag }) — a [tag] IMPLICIT SEQUENCE / AlgorithmIdentifier reader (used by the PasswordRecipientInfo keyDerivationAlgorithm [0]). A call with no option is byte-identical to before.
+- Every @example in the documentation comment blocks is now executed end-to-end as a test (test/layer-0-primitives/doc-examples.test.js, in the smoke gate), not merely parse-checked: an example must run to completion or throw a typed PkiError, and every documented @primitive path must resolve to a real export — so a documented example can no longer drift from the shipped API. A new @originated comment tag records a callable's original availability version when its documented path is later corrected, enforced alongside the @since version gate.
+
+### Changed
+
+- The W3C WebCrypto constructor classes (CryptoKey, Crypto, SubtleCrypto, WebCryptoError) are now reachable under pki.webcrypto (e.g. pki.webcrypto.CryptoKey) alongside the ready Crypto instance, matching their documented path; the previously-separate pki.WebCrypto holder is removed.
+- Repository tooling now installs npm packages exclusively through integrity-verified lockfiles: the fuzz build installs the jazzer.js engine via npm ci against the committed fuzz/package-lock.json, and the vendoring script resolves a package to an integrity-pinned lockfile in an isolated staging workspace — no install script runs and the repo's own node_modules is never touched — before bundling. Tooling child processes that need a shell (the Windows npm shim) now receive one explicitly-quoted command string instead of an unescaped argument array.
+
+### Fixed
+
+- Two documented API paths that did not resolve at runtime are corrected: pki.webcrypto.CryptoKey (previously reachable only via pki.WebCrypto.CryptoKey) and pki.asn1.read.oid (its comment block labeled the path pki.asn1.readOid, which never existed). Both are now reachable at the documented path.
+- A documentation example for pki.webcrypto.subtle.exportKey referenced an undefined variable; it now generates the key pair it exports.
+
+## v0.1.14 — 2026-07-05
 
 An RFC 5755 attribute-certificate parser joins the pki.schema family.
 

package/README.md

@@ -195,7 +195,7 @@ is callable today; nothing below is a stub.
 | `pki.schema.crl` | Parse DER / PEM X.509 CRLs per RFC 5280 §5 — revoked serials with real-`Date` revocation times, named + partly-decoded extensions, fail-closed — `parse`, `pemDecode` |
 | `pki.schema.csr` | Parse DER / PEM PKCS#10 certification requests per RFC 2986 — subject DN, public key, requested attributes, signature, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.pkcs8` | Parse DER / PEM PKCS#8 private keys per RFC 5208 / 5958 — algorithm, raw key bytes, attributes, optional public key, fail-closed; encrypted keys recognized (not decrypted) — `parse`, `parseEncrypted`, `pemDecode`, `pemEncode` |
-| `pki.schema.cms` | Parse DER / PEM CMS SignedData per RFC 5652 — encapsulated content, signer infos, raw signed-attribute bytes for external verification, certificates / CRLs kept raw, fail-closed; non-SignedData content types recognized (not decoded) — `parse`, `pemDecode`, `pemEncode` |
+| `pki.schema.cms` | Parse DER / PEM CMS per RFC 5652 — SignedData (§5, signer infos + raw signed-attribute bytes for external verification), EnvelopedData (§6, all five RecipientInfo kinds incl. RFC 5753 key-agreement, with the wrapped keys / ciphertext surfaced raw), and EncryptedData (§8); certificates / CRLs kept raw, fail-closed; remaining content types recognized (not decoded) — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.ocsp` | Parse DER / PEM OCSP requests and responses per RFC 6960 — per-certificate status (good / revoked / unknown), responder identity, raw tbs bytes for external verification, certificates kept raw, fail-closed; non-basic response types recognized (not decoded) — `parseRequest`, `parseResponse`, `pemDecode` |
 | `pki.schema.tsp` | Parse DER / PEM RFC 3161 timestamp responses and tokens — the TSTInfo payload (imprint, genTime with sub-second precision, serial, nonce, accuracy), the status-to-token coupling, and the token wrapper composed over CMS with the single-signer rule, fail-closed — `parse`, `parseTstInfo`, `parseToken`, `pemDecode` |
 | `pki.schema.attrcert` | Parse DER / PEM RFC 5755 attribute certificates — the holder and issuer identities (validated GeneralNames), the validity window (real `Date`s), the privilege attributes (role / group / clearance) and extensions, with the raw signed region for a verifier; the obsolete v1 form is recognized and deferred, fail-closed — `parse`, `pemDecode` |

package/index.js

@@ -42,13 +42,17 @@ module.exports = {
   // `schema` is the family: the L2 structure-schema engine (schema.engine) and
   // the per-format parsers (schema.x509, …) with detect-and-route schema.parse.
   schema:    schema,
-  // A ready W3C Crypto instance (globalThis.crypto shape) + the classes
-  // for constructing more. PQC-first, classical-capable, zero-dep.
-  webcrypto: webcrypto.webcrypto,
-  WebCrypto: {
-    Crypto:         webcrypto.Crypto,
-    SubtleCrypto:   webcrypto.SubtleCrypto,
-    CryptoKey:      webcrypto.CryptoKey,
-    WebCryptoError: webcrypto.WebCryptoError,
-  },
+  // A ready W3C Crypto instance (globalThis.crypto shape) with the classes for
+  // constructing more attached under the same namespace (pki.webcrypto.CryptoKey,
+  // .SubtleCrypto, .Crypto, .WebCryptoError). PQC-first, classical-capable, zero-dep.
+  webcrypto: _webcryptoNamespace(),
 };
+
+function _webcryptoNamespace() {
+  var wc = webcrypto.webcrypto;                 // the ready Crypto instance
+  wc.Crypto = webcrypto.Crypto;
+  wc.SubtleCrypto = webcrypto.SubtleCrypto;
+  wc.CryptoKey = webcrypto.CryptoKey;
+  wc.WebCryptoError = webcrypto.WebCryptoError;
+  return wc;
+}

package/lib/asn1-der.js

@@ -408,9 +408,10 @@ function readNullImplicit(node, tag) {
 }
 
 /**
- * @primitive  pki.asn1.readOid
+ * @primitive  pki.asn1.read.oid
  * @signature  pki.asn1.read.oid(node) -> "1.2.840.113549.1.1.11"
- * @since      0.1.0
+ * @since      0.1.15
+ * @originated 0.1.0
  * @status     stable
  * @spec       X.690 §8.19
  * @related    pki.oid.name

package/lib/schema-cms.js

@@ -9,14 +9,16 @@
  * @slug       cms
  *
  * @intro
- *   CMS SignedData handling per RFC 5652 (§3 ContentInfo envelope, §5 SignedData).
- *   `parse` turns a DER or PEM (`CMS`) message into a structured object: the
- *   SignedData version, the digest algorithms, the encapsulated content, the
- *   certificate / CRL sets, and the signer infos. It is an OID-dispatch envelope —
- *   ContentInfo reads its `contentType` and structurally decodes only
- *   `id-signedData`; the other PKCS#7 content types (EnvelopedData, EncryptedData,
- *   …) are recognized and rejected with a precise `cms/unsupported-content-type`
- *   rather than a generic unknown-format error.
+ *   CMS handling per RFC 5652 (§3 ContentInfo envelope). `parse` turns a DER or PEM
+ *   (`CMS`) message into a structured object and is an OID-dispatch envelope —
+ *   ContentInfo reads its `contentType` and structurally decodes SignedData (§5),
+ *   EnvelopedData (§6, with all five RecipientInfo kinds — key-transport,
+ *   key-agreement per RFC 5753, KEK, password, and other), and EncryptedData (§8);
+ *   the remaining PKCS#7 content types are recognized and rejected with a precise
+ *   `cms/unsupported-content-type` rather than a generic unknown-format error. A
+ *   SignedData surfaces its version, digest algorithms, encapsulated content,
+ *   certificate / CRL sets, and signer infos; an EnvelopedData its recipient infos
+ *   and encrypted content info; an EncryptedData its encrypted content info.
  *
  *   CMS is a signed container: the bytes an external verifier must hash are
  *   surfaced RAW and never re-serialized. `encapContentInfo.eContent` is the raw
@@ -53,15 +55,26 @@ var NAME = pkix.name(NS);
 // version is {1,3} (RFC 5652 §5.1, §5.3). Wider accept maps than any other format.
 var SIGNED_DATA_VERSION = pkix.versionReader(NS, { "1": 1, "3": 3, "4": 4, "5": 5 });
 var SIGNER_VERSION = pkix.versionReader(NS, { "1": 1, "3": 3 });
+// EnvelopedData §6.1 (0/2/3/4), EncryptedData §8 (0/2), and the per-RecipientInfo
+// versions (RFC 5652 §6.2.1-§6.2.4): ktri {0,2}, kari {3}, kekri {4}, pwri {0}.
+var ENVELOPED_DATA_VERSION = pkix.versionReader(NS, { "0": 0, "2": 2, "3": 3, "4": 4 });
+var ENCRYPTED_DATA_VERSION = pkix.versionReader(NS, { "0": 0, "2": 2 });
+var KTRI_VERSION = pkix.versionReader(NS, { "0": 0, "2": 2 });
+var KARI_VERSION = pkix.versionReader(NS, { "3": 3 });
+var KEKRI_VERSION = pkix.versionReader(NS, { "4": 4 });
+var PWRI_VERSION = pkix.versionReader(NS, { "0": 0 });
 
-// id-signedData is the one content type this build structurally decodes; the rest
-// are recognized-and-deferred (a precise diagnostic, not a silent unknown-format).
-// OIDs resolve from the registry (pkcs7 / smimeCt families), never dotted literals.
+// id-signedData / id-envelopedData / id-encryptedData are the content types this
+// build structurally decodes; the rest are recognized-and-deferred (a precise
+// diagnostic, not a silent unknown-format). OIDs resolve from the registry (pkcs7 /
+// smimeCt families), never dotted literals.
 var OID_SIGNED_DATA = oid.byName("signedData");
+var OID_ENVELOPED_DATA = oid.byName("envelopedData");
+var OID_ENCRYPTED_DATA = oid.byName("encryptedData");
 var OID_DATA = oid.byName("data");
 var DEFERRED = new Set([
-  oid.byName("data"), oid.byName("envelopedData"), oid.byName("signedAndEnvelopedData"),
-  oid.byName("digestedData"), oid.byName("encryptedData"), oid.byName("authData"),
+  oid.byName("data"), oid.byName("signedAndEnvelopedData"),
+  oid.byName("digestedData"), oid.byName("authData"),
 ]);
 // The two mandatory signed-attribute types (RFC 5652 §5.3, §11.1/§11.2).
 var OID_CONTENT_TYPE = oid.byName("contentType");
@@ -277,11 +290,313 @@ var SIGNED_DATA = schema.seq([
   },
 });
 
+// ==== EnvelopedData / EncryptedData (RFC 5652 §6/§8, RFC 5753) ========
+var T = asn1.TAGS;
+
+// EncryptedContentInfo ::= SEQUENCE { contentType OID, contentEncryptionAlgorithm
+//   AlgorithmIdentifier, encryptedContent [0] IMPLICIT OCTET STRING OPTIONAL } (RFC
+//   5652 §6.1). encryptedContent is [0] IMPLICIT (context PRIMITIVE) — its content
+//   octets ARE the ciphertext directly, so it reads through implicitOctetString(0),
+//   NOT the [0] EXPLICIT shape ENCAP_CONTENT_INFO uses (which would double-strip a
+//   length header). The ciphertext + algorithm parameters are surfaced RAW.
+var ENCRYPTED_CONTENT_INFO = schema.seq([
+  schema.field("contentType", schema.oidLeaf()),
+  schema.field("contentEncryptionAlgorithm", ALGORITHM_IDENTIFIER),
+  schema.optional("encryptedContent", schema.implicitOctetString(0), { tag: 0 }),
+], {
+  assert: "sequence", arity: { min: 2, max: 3 }, code: "cms/bad-encrypted-content-info", what: "EncryptedContentInfo",
+  build: function (m) {
+    return {
+      contentType: m.fields.contentType.value,
+      contentEncryptionAlgorithm: m.fields.contentEncryptionAlgorithm.value.result,
+      encryptedContent: m.fields.encryptedContent.present ? m.fields.encryptedContent.value : null,
+    };
+  },
+});
+
+// RecipientIdentifier ::= CHOICE { issuerAndSerialNumber, subjectKeyIdentifier [0]
+//   IMPLICIT OCTET STRING } (RFC 5652 §6.2.1) — structurally identical to
+//   SignerIdentifier; reuse ISSUER_AND_SERIAL + the implicitOctetString(0) leaf.
+var RECIPIENT_IDENTIFIER = schema.choice([
+  { when: { tagClass: "universal", tagNumber: T.SEQUENCE }, schema: ISSUER_AND_SERIAL },
+  { when: { tagClass: "context", tagNumber: 0 }, schema: schema.implicitOctetString(0) },
+], { code: "cms/bad-recipient-identifier", what: "RecipientIdentifier" });
+
+// KeyTransRecipientInfo ::= SEQUENCE { version(0|2), rid RecipientIdentifier,
+//   keyEncryptionAlgorithm, encryptedKey OCTET STRING } (RFC 5652 §6.2.1).
+var KEY_TRANS_RECIPIENT_INFO = schema.seq([
+  schema.field("version", KTRI_VERSION),
+  schema.field("rid", RECIPIENT_IDENTIFIER),
+  schema.field("keyEncryptionAlgorithm", ALGORITHM_IDENTIFIER),
+  schema.field("encryptedKey", schema.octetString()),
+], {
+  assert: "sequence", code: "cms/bad-ktri", what: "KeyTransRecipientInfo",
+  build: function (m) {
+    var version = m.fields.version.value;
+    var ridNode = m.fields.rid.node;
+    var isSkid = ridNode.tagClass === "context" && ridNode.tagNumber === 0;
+    // RFC 5652 §6.2.1 — rid ⇔ version: issuerAndSerialNumber ⇒ 0, subjectKeyIdentifier ⇒ 2.
+    if (isSkid && version !== 2) throw NS.E("cms/bad-recipient-version", "a subjectKeyIdentifier recipient identifier requires KeyTransRecipientInfo version 2 (RFC 5652 §6.2.1)");
+    if (!isSkid && version !== 0) throw NS.E("cms/bad-recipient-version", "an issuerAndSerialNumber recipient identifier requires KeyTransRecipientInfo version 0 (RFC 5652 §6.2.1)");
+    return {
+      type: "ktri", version: version,
+      rid: isSkid ? { subjectKeyIdentifier: m.fields.rid.value } : m.fields.rid.value.result,
+      ridType: isSkid ? "subjectKeyIdentifier" : "issuerAndSerialNumber",
+      keyEncryptionAlgorithm: m.fields.keyEncryptionAlgorithm.value.result,
+      encryptedKey: m.fields.encryptedKey.value,
+    };
+  },
+});
+
+// OriginatorPublicKey ::= SEQUENCE { algorithm, publicKey BIT STRING } (RFC 5753
+//   §3.1.1), reached as originatorKey [1] IMPLICIT — SPKI-shaped but cannot reuse
+//   pkix.spki (which asserts a universal SEQUENCE), so assert:"constructed".
+var ORIGINATOR_PUBLIC_KEY = schema.seq([
+  schema.field("algorithm", ALGORITHM_IDENTIFIER),
+  schema.field("publicKey", schema.bitString()),
+], {
+  assert: "constructed", code: "cms/bad-originator-public-key", what: "OriginatorPublicKey",
+  build: function (m) { return { algorithm: m.fields.algorithm.value.result, publicKey: m.fields.publicKey.value }; },
+});
+
+// OriginatorIdentifierOrKey ::= CHOICE { issuerAndSerialNumber, subjectKeyIdentifier
+//   [0] IMPLICIT OCTET STRING, originatorKey [1] IMPLICIT OriginatorPublicKey }.
+var ORIGINATOR_IDENTIFIER_OR_KEY = schema.choice([
+  { when: { tagClass: "universal", tagNumber: T.SEQUENCE }, schema: ISSUER_AND_SERIAL },
+  { when: { tagClass: "context", tagNumber: 0 }, schema: schema.implicitOctetString(0) },
+  { when: { tagClass: "context", tagNumber: 1 }, schema: ORIGINATOR_PUBLIC_KEY },
+], { code: "cms/bad-originator-identifier", what: "OriginatorIdentifierOrKey" });
+
+// RecipientKeyIdentifier (RFC 5652 §6.2.2) and KEKIdentifier (§6.2.3) are one
+//   shape — { <keyId> OCTET STRING, date GeneralizedTime OPTIONAL, other
+//   OtherKeyAttribute OPTIONAL } — differing only in the key-id field's name and
+//   the enclosing tag form. One factory defines both so the OPTIONAL handling
+//   (date and the raw-surfaced OtherKeyAttribute) cannot diverge between them.
+function keyIdentifierSchema(keyIdName, assert, code, what) {
+  return schema.seq([
+    schema.field(keyIdName, schema.octetString()),
+    schema.optional("date", schema.time(NS), { whenUniversal: [T.GENERALIZED_TIME] }),
+    schema.optional("other", schema.any(), { whenUniversal: [T.SEQUENCE] }),
+  ], {
+    assert: assert, code: code, what: what,
+    build: function (m) {
+      var out = {};
+      out[keyIdName] = m.fields[keyIdName].value;
+      out.date = m.fields.date.present ? m.fields.date.value : null;
+      out.other = m.fields.other.present ? m.fields.other.node.bytes : null;
+      return out;
+    },
+  });
+}
+
+// Reached as rKeyId [0] IMPLICIT (a SEQUENCE — constructed, unlike ktri's [0] leaf).
+var RECIPIENT_KEY_IDENTIFIER = keyIdentifierSchema("subjectKeyIdentifier",
+  "constructed", "cms/bad-recipient-key-identifier", "RecipientKeyIdentifier");
+
+// KeyAgreeRecipientIdentifier ::= CHOICE { issuerAndSerialNumber, rKeyId [0] IMPLICIT
+//   RecipientKeyIdentifier } (RFC 5652 §6.2.2).
+var KEY_AGREE_RECIPIENT_IDENTIFIER = schema.choice([
+  { when: { tagClass: "universal", tagNumber: T.SEQUENCE }, schema: ISSUER_AND_SERIAL },
+  { when: { tagClass: "context", tagNumber: 0 }, schema: RECIPIENT_KEY_IDENTIFIER },
+], { code: "cms/bad-kari-identifier", what: "KeyAgreeRecipientIdentifier" });
+
+// RecipientEncryptedKey ::= SEQUENCE { rid KeyAgreeRecipientIdentifier, encryptedKey
+//   OCTET STRING } (RFC 5652 §6.2.2).
+var RECIPIENT_ENCRYPTED_KEY = schema.seq([
+  schema.field("rid", KEY_AGREE_RECIPIENT_IDENTIFIER),
+  schema.field("encryptedKey", schema.octetString()),
+], {
+  assert: "sequence", code: "cms/bad-recipient-encrypted-key", what: "RecipientEncryptedKey",
+  build: function (m) {
+    var ridNode = m.fields.rid.node;
+    var isRkid = ridNode.tagClass === "context" && ridNode.tagNumber === 0;
+    return {
+      rid: isRkid ? m.fields.rid.value.result : m.fields.rid.value.result,
+      encryptedKey: m.fields.encryptedKey.value,
+    };
+  },
+});
+
+// KeyAgreeRecipientInfo ::= [1] IMPLICIT SEQUENCE { version(3), originator [0]
+//   EXPLICIT OriginatorIdentifierOrKey, ukm [1] EXPLICIT OPTIONAL,
+//   keyEncryptionAlgorithm, recipientEncryptedKeys SEQUENCE OF } (RFC 5652 §6.2.2 +
+//   RFC 5753 §3.1.1). originator [0] is EXPLICIT (wraps a CHOICE).
+var KEY_AGREE_RECIPIENT_INFO = schema.seq([
+  schema.field("version", KARI_VERSION),
+  schema.field("originator", schema.explicit(0, ORIGINATOR_IDENTIFIER_OR_KEY, { code: "cms/bad-kari" })),
+  schema.optional("ukm", schema.octetString(), { tag: 1, explicit: true, emptyCode: "cms/bad-kari" }),
+  schema.field("keyEncryptionAlgorithm", ALGORITHM_IDENTIFIER),
+  schema.field("recipientEncryptedKeys", schema.seqOf(RECIPIENT_ENCRYPTED_KEY, { code: "cms/bad-recipient-encrypted-keys", what: "recipientEncryptedKeys" })),
+], {
+  assert: "constructed", code: "cms/bad-kari", what: "KeyAgreeRecipientInfo",
+  build: function (m) {
+    var origNode = m.fields.originator.node.children[0];
+    var origForm = origNode.tagClass === "context" ? (origNode.tagNumber === 0 ? "subjectKeyIdentifier" : "originatorKey") : "issuerAndSerialNumber";
+    var origVal = m.fields.originator.value;
+    return {
+      type: "kari", version: m.fields.version.value,
+      originator: { form: origForm, value: origForm === "subjectKeyIdentifier" ? origVal : origVal.result },
+      ukm: m.fields.ukm.present ? m.fields.ukm.value : null,
+      keyEncryptionAlgorithm: m.fields.keyEncryptionAlgorithm.value.result,
+      recipientEncryptedKeys: m.fields.recipientEncryptedKeys.value.items.map(function (it) { return it.value.result; }),
+    };
+  },
+});
+
+// KEKRecipientInfo ::= [2] IMPLICIT SEQUENCE { version(4), kekid KEKIdentifier,
+//   keyEncryptionAlgorithm, encryptedKey } (RFC 5652 §6.2.3).
+var KEK_IDENTIFIER = keyIdentifierSchema("keyIdentifier",
+  "sequence", "cms/bad-kek-identifier", "KEKIdentifier");
+var KEK_RECIPIENT_INFO = schema.seq([
+  schema.field("version", KEKRI_VERSION),
+  schema.field("kekid", KEK_IDENTIFIER),
+  schema.field("keyEncryptionAlgorithm", ALGORITHM_IDENTIFIER),
+  schema.field("encryptedKey", schema.octetString()),
+], {
+  assert: "constructed", code: "cms/bad-kekri", what: "KEKRecipientInfo",
+  build: function (m) {
+    return {
+      type: "kekri", version: m.fields.version.value,
+      kekid: m.fields.kekid.value.result,
+      keyEncryptionAlgorithm: m.fields.keyEncryptionAlgorithm.value.result,
+      encryptedKey: m.fields.encryptedKey.value,
+    };
+  },
+});
+
+// PasswordRecipientInfo ::= [3] IMPLICIT SEQUENCE { version(0), keyDerivationAlgorithm
+//   [0] IMPLICIT AlgorithmIdentifier OPTIONAL, keyEncryptionAlgorithm, encryptedKey }
+//   (RFC 5652 §6.2.4). keyDerivationAlgorithm [0] IMPLICIT is the one field needing
+//   the implicitTag AlgorithmIdentifier; present iff the first post-version node is [0].
+var PASSWORD_RECIPIENT_INFO = schema.seq([
+  schema.field("version", PWRI_VERSION),
+  schema.optional("keyDerivationAlgorithm", pkix.algorithmIdentifier(NS, { implicitTag: 0 }), { tag: 0 }),
+  schema.field("keyEncryptionAlgorithm", ALGORITHM_IDENTIFIER),
+  schema.field("encryptedKey", schema.octetString()),
+], {
+  assert: "constructed", code: "cms/bad-pwri", what: "PasswordRecipientInfo",
+  build: function (m) {
+    return {
+      type: "pwri", version: m.fields.version.value,
+      keyDerivationAlgorithm: m.fields.keyDerivationAlgorithm.present ? m.fields.keyDerivationAlgorithm.value.result : null,
+      keyEncryptionAlgorithm: m.fields.keyEncryptionAlgorithm.value.result,
+      encryptedKey: m.fields.encryptedKey.value,
+    };
+  },
+});
+
+// OtherRecipientInfo ::= [4] IMPLICIT SEQUENCE { oriType OID, oriValue ANY } (RFC
+//   5652 §6.2.5) — oriValue opaque, surfaced RAW (the shipped encoder routes
+//   KEMRecipientInfo through here).
+var OTHER_RECIPIENT_INFO = schema.seq([
+  schema.field("oriType", schema.oidLeaf()),
+  schema.field("oriValue", schema.any()),
+], {
+  assert: "constructed", code: "cms/bad-ori", what: "OtherRecipientInfo",
+  build: function (m) { return { type: "ori", oriType: m.fields.oriType.value, oriValue: m.fields.oriValue.node.bytes }; },
+});
+
+// RecipientInfo ::= CHOICE { ktri KeyTransRecipientInfo, kari [1], kekri [2], pwri
+//   [3], ori [4] } (RFC 5652 §6.2). A bare universal SEQUENCE is ktri (the untagged
+//   alternative). An unknown context tag → no arm → cms/bad-recipient-info.
+var RECIPIENT_INFO = schema.choice([
+  { when: { tagClass: "universal", tagNumber: T.SEQUENCE }, schema: KEY_TRANS_RECIPIENT_INFO },
+  { when: { tagClass: "context", tagNumber: 1 }, schema: KEY_AGREE_RECIPIENT_INFO },
+  { when: { tagClass: "context", tagNumber: 2 }, schema: KEK_RECIPIENT_INFO },
+  { when: { tagClass: "context", tagNumber: 3 }, schema: PASSWORD_RECIPIENT_INFO },
+  { when: { tagClass: "context", tagNumber: 4 }, schema: OTHER_RECIPIENT_INFO },
+], { code: "cms/bad-recipient-info", what: "RecipientInfo" });
+
+// OriginatorInfo ::= [0] IMPLICIT SEQUENCE { certs [0] IMPLICIT OPTIONAL, crls [1]
+//   IMPLICIT OPTIONAL } (RFC 5652 §6.1). Members surfaced RAW (their outer tag feeds
+//   the version rule).
+var ORIGINATOR_INFO = schema.seq([
+  schema.optional("certs", schema.implicitSetOf(0, schema.any(), { min: 1, code: "cms/bad-originator-certs", what: "certs" }), { tag: 0 }),
+  schema.optional("crls", schema.implicitSetOf(1, schema.any(), { min: 1, code: "cms/bad-originator-crls", what: "crls" }), { tag: 1 }),
+], {
+  assert: "constructed", code: "cms/bad-originator-info", what: "OriginatorInfo",
+  build: function (m) {
+    return {
+      certs: m.fields.certs.present ? m.fields.certs.value.items.map(rawElement) : [],
+      crls: m.fields.crls.present ? m.fields.crls.value.items.map(rawElement) : [],
+    };
+  },
+});
+
+// RFC 5652 §6.1 — the exact EnvelopedData CMSVersion, from originatorInfo's raw
+// cert/crl outer tags and the recipient arms (a cert `other` is [3], a v2AttrCert
+// [2]; a crl `other` is [1]; a pwri or ori forces v3; all-ktri-IAS with no
+// originatorInfo/unprotectedAttrs is v0; everything else v2).
+function _expectedEnvelopedDataVersion(originatorInfo, recipientInfos, hasUnprotectedAttrs) {
+  function ctx(el, n) { return el.tagClass === "context" && el.tagNumber === n; }
+  var hasOrig = !!originatorInfo;
+  var certs = hasOrig ? originatorInfo.certs : [];
+  var crls = hasOrig ? originatorInfo.crls : [];
+  if (hasOrig && (certs.some(function (c) { return ctx(c, 3); }) || crls.some(function (c) { return ctx(c, 1); }))) return 4;
+  if ((hasOrig && certs.some(function (c) { return ctx(c, 2); })) ||
+      recipientInfos.some(function (r) { return r.type === "pwri" || r.type === "ori"; })) return 3;
+  if (!hasOrig && !hasUnprotectedAttrs &&
+      recipientInfos.every(function (r) { return r.type === "ktri" && r.ridType === "issuerAndSerialNumber"; })) return 0;
+  return 2;
+}
+
+// EnvelopedData ::= SEQUENCE { version, originatorInfo [0] IMPLICIT OPTIONAL,
+//   recipientInfos RecipientInfos (SET SIZE 1..MAX), encryptedContentInfo,
+//   unprotectedAttrs [1] IMPLICIT OPTIONAL } (RFC 5652 §6.1). recipientInfos is
+//   min:1 (an empty SET is non-conformant — the INVERSE of SignedData's degenerate
+//   signerInfos).
+var ENVELOPED_DATA = schema.seq([
+  schema.field("version", ENVELOPED_DATA_VERSION),
+  schema.optional("originatorInfo", ORIGINATOR_INFO, { tag: 0 }),
+  schema.field("recipientInfos", schema.setOf(RECIPIENT_INFO, { min: 1, code: "cms/bad-recipient-infos", what: "recipientInfos" })),
+  schema.field("encryptedContentInfo", ENCRYPTED_CONTENT_INFO),
+  schema.optional("unprotectedAttrs", schema.implicitSetOf(1, ATTRIBUTE, { min: 1, code: "cms/bad-unprotected-attrs", what: "unprotectedAttrs" }), { tag: 1 }),
+], {
+  assert: "sequence", code: "cms/bad-enveloped-data", what: "EnvelopedData",
+  build: function (m) {
+    var version = m.fields.version.value;
+    var originatorInfo = m.fields.originatorInfo.present ? m.fields.originatorInfo.value.result : null;
+    var recipientInfos = m.fields.recipientInfos.value.items.map(function (it) { return it.value.result; });
+    var hasUnprotectedAttrs = m.fields.unprotectedAttrs.present;
+    var expected = _expectedEnvelopedDataVersion(originatorInfo, recipientInfos, hasUnprotectedAttrs);
+    if (version !== expected) throw NS.E("cms/bad-version", "EnvelopedData version " + version + " does not match its contents (RFC 5652 §6.1 requires v" + expected + ")");
+    return {
+      version: version,
+      originatorInfo: originatorInfo,
+      recipientInfos: recipientInfos,
+      encryptedContentInfo: m.fields.encryptedContentInfo.value.result,
+      unprotectedAttrs: hasUnprotectedAttrs ? m.fields.unprotectedAttrs.value.items.map(function (it) { return it.value.result; }) : null,
+    };
+  },
+});
+
+// EncryptedData ::= SEQUENCE { version, encryptedContentInfo, unprotectedAttrs [1]
+//   IMPLICIT OPTIONAL } (RFC 5652 §8) — no recipients, no originatorInfo; the CEK is
+//   distributed out of band. version is 0, or 2 iff unprotectedAttrs are present.
+var ENCRYPTED_DATA = schema.seq([
+  schema.field("version", ENCRYPTED_DATA_VERSION),
+  schema.field("encryptedContentInfo", ENCRYPTED_CONTENT_INFO),
+  schema.optional("unprotectedAttrs", schema.implicitSetOf(1, ATTRIBUTE, { min: 1, code: "cms/bad-unprotected-attrs", what: "unprotectedAttrs" }), { tag: 1 }),
+], {
+  assert: "sequence", code: "cms/bad-encrypted-data", what: "EncryptedData",
+  build: function (m) {
+    var version = m.fields.version.value;
+    var hasUnprotectedAttrs = m.fields.unprotectedAttrs.present;
+    var expected = hasUnprotectedAttrs ? 2 : 0;
+    if (version !== expected) throw NS.E("cms/bad-version", "EncryptedData version " + version + " does not match its contents (RFC 5652 §8 requires v" + expected + ")");
+    return {
+      version: version,
+      encryptedContentInfo: m.fields.encryptedContentInfo.value.result,
+      unprotectedAttrs: hasUnprotectedAttrs ? m.fields.unprotectedAttrs.value.items.map(function (it) { return it.value.result; }) : null,
+    };
+  },
+});
+
 // ContentInfo ::= SEQUENCE { contentType OID, content [0] EXPLICIT ANY DEFINED BY
 //   contentType } (RFC 5652 §3). The content is captured raw (explicit(0, any()))
 //   and re-dispatched by contentType inside the build: id-signedData walks
-//   SIGNED_DATA, the other PKCS#7 types are recognized-and-deferred, unknown OIDs
-//   are rejected.
+//   SIGNED_DATA, id-envelopedData / id-encryptedData walk their schemas, the other
+//   PKCS#7 types are recognized-and-deferred, unknown OIDs are rejected.
 var CONTENT_INFO = schema.seq([
   schema.field("contentType", schema.oidLeaf()),
   schema.field("content", schema.explicit(0, schema.any(), { code: "cms/not-a-content-info" })),
@@ -290,6 +605,8 @@ var CONTENT_INFO = schema.seq([
   build: function (m, ctx) {
     var ct = m.fields.contentType.value;
     if (ct === OID_SIGNED_DATA) return schema.walk(SIGNED_DATA, m.fields.content.value, ctx).result;
+    if (ct === OID_ENVELOPED_DATA) return schema.walk(ENVELOPED_DATA, m.fields.content.value, ctx).result;
+    if (ct === OID_ENCRYPTED_DATA) return schema.walk(ENCRYPTED_DATA, m.fields.content.value, ctx).result;
     if (DEFERRED.has(ct)) {
       throw NS.E("cms/unsupported-content-type", (ctx.oid.name(ct) || ct) + " is recognized but not parsed by this build");
     }

package/lib/schema-crl.js

@@ -121,6 +121,11 @@ var REVOKED_LIST = schema.seqOf(REVOKED_ENTRY, {
 // revokedCertificates=SEQUENCE) are disambiguated by their universal tag;
 // crlExtensions is modeled as a trailing [0]..[0] so a stray non-[0] trailing
 // context tag is REJECTED (crl/bad-tbs), not silently ignored.
+// `signature` is consumed by the CERTIFICATE_LIST build (the §5.1.1.2
+// outer==inner agreement check reads tbsMatch.fields.signature.node.bytes);
+// the operator reads the surfaced outer signatureAlgorithm, which that
+// check proves byte-identical.
+// allow:schema-build-drops-parsed-field
 var TBS_CERTLIST = schema.seq([
   schema.optional("version", CRL_VERSION, { whenUniversal: [TAGS.INTEGER] }),
   schema.field("signature", ALGORITHM_IDENTIFIER),

package/lib/schema-engine.js

@@ -63,11 +63,12 @@ function _assertShape(schema, node, ctx) {
       _fail(ctx, schema.code, (schema.what || "value") + " must be a constructed value");
     }
   } else if (mode === "implicit") {
-    // IMPLICIT [tag] SET/SEQUENCE OF: the context tag replaces the universal
-    // tag, so the node is a context-class constructed [tag] and its direct
-    // children are the items (no inner universal SET, no EXPLICIT unwrap).
+    // IMPLICIT [tag] SET/SEQUENCE OF or a fixed-field IMPLICIT [tag] SEQUENCE body:
+    // the context tag replaces the universal tag, so the node is a context-class
+    // constructed [tag] and its direct children are the items / positional fields
+    // (no inner universal tag, no EXPLICIT unwrap).
     if (node.tagClass !== "context" || node.tagNumber !== schema.implicitTag || !node.children) {
-      _fail(ctx, schema.code, (schema.what || "value") + " must be an IMPLICIT [" + schema.implicitTag + "] SET OF");
+      _fail(ctx, schema.code, (schema.what || "value") + " must be an IMPLICIT [" + schema.implicitTag + "] constructed value");
     }
   } else {
     _fail(ctx, schema.code, "unknown assert mode " + JSON.stringify(mode));
@@ -163,7 +164,7 @@ function trailing(members, opts) {
 
 function seq(fields, opts) {
   opts = opts || {};
-  return { kind: "seq", fields: fields, assert: opts.assert || "sequence", arity: opts.arity,
+  return { kind: "seq", fields: fields, assert: opts.assert || "sequence", implicitTag: opts.implicitTag, arity: opts.arity,
            code: opts.code, what: opts.what, build: opts.build, checks: opts.checks || [] };
 }
 

package/lib/schema-pkix.js

@@ -129,12 +129,18 @@ function versionReader(ns, accept) {
   });
 }
 
-function algorithmIdentifier(ns) {
+// opts.implicitTag (optional): read the AlgorithmIdentifier as a [tag] IMPLICIT
+// SEQUENCE (a context-class constructed node whose children are algorithm + parameters),
+// for the RFC 5652 §6.2.4 pwri.keyDerivationAlgorithm [0]. With no opts the shape is a
+// universal SEQUENCE, byte-identical to every existing caller.
+function algorithmIdentifier(ns, opts) {
+  opts = opts || {};
   return schema.seq([
     schema.field("algorithm", schema.oidLeaf()),
     schema.optional("parameters", schema.any(), { whenAny: true }),
   ], {
-    assert: "sequence", arity: { min: 1 }, code: ns.prefix + "/bad-algorithm-identifier", what: "AlgorithmIdentifier",
+    assert: opts.implicitTag != null ? "implicit" : "sequence", implicitTag: opts.implicitTag,
+    arity: { min: 1 }, code: ns.prefix + "/bad-algorithm-identifier", what: "AlgorithmIdentifier",
     build: function (m, ctx) {
       var dotted = m.fields.algorithm.value;
       return { oid: dotted, name: ctx.oid.name(dotted) || null, parameters: m.fields.parameters.present ? m.fields.parameters.node.bytes : null };

package/lib/webcrypto.js

@@ -531,6 +531,7 @@ function _curveFromKey(ko) {
  * point). Throws unless the key was created `extractable`.
  *
  * @example
+ *   var keyPair = await pki.webcrypto.subtle.generateKey({ name: "Ed25519" }, true, ["sign", "verify"]);
  *   var spki = await pki.webcrypto.subtle.exportKey("spki", keyPair.publicKey);
  */
 SubtleCrypto.prototype.exportKey = async function exportKey(format, key) {
@@ -566,7 +567,7 @@ function _rawPublic(key) {
  *
  * A ready `Crypto` instance (the shape of `globalThis.crypto`) exposing
  * `getRandomValues`, `randomUUID`, and `subtle`. Construct additional
- * instances with `new pki.WebCrypto.Crypto()`.
+ * instances with `new pki.webcrypto.Crypto()`.
  *
  * @example
  *   var iv = pki.webcrypto.getRandomValues(new Uint8Array(12));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.1.14",
+  "version": "0.1.15",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:7865e3f3-f43e-4cdb-818f-8a8fe2cf2d7a",
+  "serialNumber": "urn:uuid:d18de1ff-7ebd-406f-91cb-801da4286f4f",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-06T02:35:05.577Z",
+    "timestamp": "2026-07-06T08:32:53.685Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.1.14",
+      "bom-ref": "@blamejs/pki@0.1.15",
       "type": "application",
       "name": "pki",
-      "version": "0.1.14",
+      "version": "0.1.15",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.1.14",
+      "purl": "pkg:npm/%40blamejs/pki@0.1.15",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.1.14",
+      "ref": "@blamejs/pki@0.1.15",
       "dependsOn": []
     }
   ]