@blamejs/pki 0.1.16 → 0.1.17

package/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.1.17 — 2026-07-07
+
+An RFC 4211 certificate-request-message parser joins the pki.schema family.
+
+### Added
+
+- pki.schema.crmf.parse(input) — RFC 4211 CertReqMessages parsing. It decodes a DER Buffer or PEM into { messages: [ { certReq, popo, regInfo } ] }, where each certReq is { certReqId, certReqIdHex, certTemplate, controls, certReqBytes } and certTemplate carries the requestable fields version, issuer, validity, subject, publicKey, and extensions (each null when absent). The fields RFC 4211 §5 requires a request to omit — serialNumber and signingAlg (assigned by the CA) and issuerUID and subjectUID (deprecated) — are rejected, not returned, so a requester cannot dictate a CA-assigned value. issuer and subject Names are accepted in both the EXPLICIT and the IMPLICIT wire encodings; the OptionalValidity times are EXPLICIT UTCTime or GeneralizedTime; a supplied CertTemplate version must be 2; certReqId is an unbounded signed integer. popo is null, a raVerified marker, a decoded signature proof (with its poposkInput and signature surfaced raw), or a raw key-encipherment / key-agreement arm; for a signature proof, poposkInput's presence is checked against the template per §4.1. certReqBytes is the exact CertRequest byte range a proof-of-possession verifier hashes. Malformed input fails closed with a typed crmf/* or asn1/* code.
+- pki.schema.crmf.pemDecode(text, label?) — extract the DER bytes from a PEM block (the first block unless a label is given).
+- The OID registry gains the RFC 4211 registration-control (id-regCtrl) and registration-info (id-regInfo) identifiers on the id-pkip arc, so a parsed control or info entry resolves to its name (oldCertID, pkiArchiveOptions, utf8Pairs, and the rest).
+- The error taxonomy gains CrmfError, carrying a stable crmf/* code.
+- pki.schema.engine.encode(schema, value) — the constructor direction of the schema engine. A single declarative schema now drives both decode (walk, bytes to value) and encode (canonical DER, value to bytes): every leaf carries a read and a write, and EXPLICIT wrapping and IMPLICIT context-tag retagging are applied in one place, so an encoder can no longer emit a different tag than the decoder reads. A round-trip test proves walk(decode(encode(value))) recovers the value across universal, IMPLICIT, EXPLICIT, and SET-OF-ordered shapes, and the CRMF request format is proven to round-trip end to end.
+
+### Changed
+
+- pki.schema.ocsp request and response parsing (parseRequest, parseResponse, pemDecode) is now stable.
+- An experimental primitive is surfaced for a graduation review once it has been experimental for a fixed number of releases; the review is recorded as a graduation to stable or a dated keep-experimental decision, so the experimental-to-stable-to-deprecated transition is driven on a schedule (see LTS-CALENDAR.md).
+
 ## v0.1.16 — 2026-07-06
 
 Certification path validation joins the toolkit — RFC 5280 section 6, as a pure re-entrant algorithm.

package/README.md

@@ -199,10 +199,11 @@ is callable today; nothing below is a stub.
 | `pki.schema.ocsp` | Parse DER / PEM OCSP requests and responses per RFC 6960 — per-certificate status (good / revoked / unknown), responder identity, raw tbs bytes for external verification, certificates kept raw, fail-closed; non-basic response types recognized (not decoded) — `parseRequest`, `parseResponse`, `pemDecode` |
 | `pki.schema.tsp` | Parse DER / PEM RFC 3161 timestamp responses and tokens — the TSTInfo payload (imprint, genTime with sub-second precision, serial, nonce, accuracy), the status-to-token coupling, and the token wrapper composed over CMS with the single-signer rule, fail-closed — `parse`, `parseTstInfo`, `parseToken`, `pemDecode` |
 | `pki.schema.attrcert` | Parse DER / PEM RFC 5755 attribute certificates — the holder and issuer identities (validated GeneralNames), the validity window (real `Date`s), the privilege attributes (role / group / clearance) and extensions, with the raw signed region for a verifier; the obsolete v1 form is recognized and deferred, fail-closed — `parse`, `pemDecode` |
+| `pki.schema.crmf` | Parse DER / PEM RFC 4211 certificate request messages (CertReqMessages — the CMP / EST enrollment body) — the requested-certificate template (subject, public key, validity, extensions), proof-of-possession, and registration controls, with the raw `CertRequest` region a POP verifier hashes; names dual-accepted (IMPLICIT and EXPLICIT), fail-closed — `parse`, `pemDecode` |
 | `pki.schema.engine` | The declarative ASN.1 structure-schema engine every format parser composes — `walk` plus the schema combinators |
 | `pki.path` | RFC 5280 §6 certification-path validation — `validate` runs the §6.1 state machine (signature chaining, validity windows, name chaining, basic constraints and path length, key usage, name constraints, the certificate-policy tree) over an ordered path and a trust anchor, returning a structured verdict with per-check reason codes; `crlChecker` supplies CRL-based revocation. Pure and re-entrant, fail-closed — `validate`, `crlChecker` |
 | `pki.C` / `pki.constants` | Version-stable constants — functional scale helpers (`C.TIME.*`, `C.BYTES.*`), codec `LIMITS`, `version` |
-| `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError` / `Asn1Error` / `OidError` / `PemError` / `CertificateError` / `CrlError` / `CsrError` / `Pkcs8Error` / `CmsError` / `OcspError` / `TspError` / `AttrCertError` / `PathError`, each carrying a stable `code` in `domain/reason` form |
+| `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError` / `Asn1Error` / `OidError` / `PemError` / `CertificateError` / `CrlError` / `CsrError` / `Pkcs8Error` / `CmsError` / `OcspError` / `TspError` / `AttrCertError` / `CrmfError` / `PathError`, each carrying a stable `code` in `domain/reason` form |
 | `pki` CLI | `pki version`, `pki oid <dotted\|name>`, `pki parse <cert>` |
 
 ### CLI

package/lib/asn1-der.js

@@ -627,6 +627,18 @@ function encodeLength(n) {
   return Buffer.concat([Buffer.from([0x80 | bytes.length]), Buffer.from(bytes)]);
 }
 
+// The DER of a universal SEQUENCE recovered from a decoded IMPLICIT [n] SEQUENCE
+// `node`, whose context tag replaced the universal 0x30 on the wire (e.g. an RFC
+// 4211 CertTemplate publicKey [6] SubjectPublicKeyInfo, or a POPOSigningKey
+// poposkInput [0]): the field's value is imported / signed as a standalone SEQUENCE,
+// not as the context-tagged wire form. A constructed node exposes its content as
+// `children` (not `content`), so the content is those children's DER concatenated;
+// the identifier becomes the SEQUENCE tag and the length is canonical DER.
+function sequenceTlv(node) {
+  var content = node.content != null ? node.content : Buffer.concat((node.children || []).map(function (c) { return c.bytes; }));
+  return Buffer.concat([Buffer.from([TAGS.SEQUENCE | CONSTRUCTED_BIT]), encodeLength(content.length), content]);
+}
+
 function encodeIdentifier(classBits, constructed, tagNumber) {
   var lead = classBits | (constructed ? CONSTRUCTED_BIT : 0);
   if (tagNumber < 0x1f) return Buffer.from([lead | tagNumber]);
@@ -848,6 +860,7 @@ module.exports = {
   encode:        encodeTLV,
   encodeTLV:     encodeTLV,
   encodeLength:  encodeLength,
+  sequenceTlv:   sequenceTlv,
   encodeIdentifier: encodeIdentifier,
   decodeOidContent: decodeOidContent,
   encodeOidContent: encodeOidContent,

package/lib/framework-error.js

@@ -155,6 +155,11 @@ var TspError = defineClass("TspError", { withCause: true });
 // underlying leaf fault as `.cause`.
 var AttrCertError = defineClass("AttrCertError", { withCause: true });
 
+// CrmfError — a byte sequence that is not a well-formed RFC 4211 CertReqMessages
+// / CertReqMsg / CertRequest / CertTemplate. Carries the underlying leaf fault as
+// `.cause`.
+var CrmfError = defineClass("CrmfError", { withCause: true });
+
 // PathError — a certification path that fails RFC 5280 §6 validation, or a
 // malformed input handed to the validator (an extension value that does not
 // decode, an empty path, an unsupported signature algorithm). Carries the
@@ -178,5 +183,6 @@ module.exports = {
   OcspError:        OcspError,
   TspError:         TspError,
   AttrCertError:    AttrCertError,
+  CrmfError:        CrmfError,
   PathError:        PathError,
 };

package/lib/oid.js

@@ -103,6 +103,14 @@ var FAMILIES = {
     ocspBasic: 1, ocspNonce: 2, ocspCrl: 3, ocspResponse: 4, ocspNoCheck: 5,
     ocspArchiveCutoff: 6, ocspServiceLocator: 7, ocspPrefSigAlgs: 8, ocspExtendedRevoke: 9 } },
 
+  // CRMF (RFC 4211) registration controls (§6) and registration info (§7) on the
+  // id-pkip arc (id-pkix 5). id-regCtrl (id-pkip 1) names the control types a
+  // CertRequest carries; id-regInfo (id-pkip 2) names the registration-info types.
+  // The parser surfaces each control/info value RAW keyed by these names.
+  regCtrl: { base: [1, 3, 6, 1, 5, 5, 7, 5, 1], of: {
+    regToken: 1, authenticator: 2, pkiPublicationInfo: 3, pkiArchiveOptions: 4, oldCertID: 5, protocolEncrKey: 6 } },
+  regInfo: { base: [1, 3, 6, 1, 5, 5, 7, 5, 2], of: { utf8Pairs: 1, certReq: 2 } },
+
   // PKIX extended key purposes (id-kp, RFC 5280 §4.2.1.12). timeStamping is required
   // — critical and sole — on an RFC 3161 TSA signing certificate (§2.3).
   pkixKp: { base: [1, 3, 6, 1, 5, 5, 7, 3], of: {
@@ -126,7 +134,7 @@ var FAMILIES = {
     challengePassword: 7, extensionRequest: 14 } },
 
   // S/MIME content types on the PKCS#9 smime arc (RFC 5652, RFC 3161): id-ct.
-  smimeCt: { base: [1, 2, 840, 113549, 1, 9, 16, 1], of: { authData: 2, tSTInfo: 4 } },
+  smimeCt: { base: [1, 2, 840, 113549, 1, 9, 16, 1], of: { authData: 2, tSTInfo: 4, encKeyWithID: 21 } },
 
   // S/MIME authenticated attributes (id-aa, RFC 2634 / RFC 5035 / RFC 5816). The ESS
   // signing-certificate attributes bind a CMS / TSP SignerInfo to its signing cert;

package/lib/schema-all.js

@@ -39,6 +39,7 @@ var pkcs8 = require("./schema-pkcs8");
 var cms = require("./schema-cms");
 var ocsp = require("./schema-ocsp");
 var tsp = require("./schema-tsp");
+var crmf = require("./schema-crmf");
 var attrcert = require("./schema-attrcert");
 var frameworkError = require("./framework-error");
 
@@ -83,6 +84,19 @@ var FORMATS = [
     detect: tsp.matches,
     parse: function (input) { return tsp.parse(input); },
   },
+  {
+    // CertReqMessages ::= SEQUENCE SIZE(1..MAX) OF CertReqMsg (RFC 4211 §3) — a
+    // SEQUENCE whose first CertReqMsg's CertRequest leads with a universal INTEGER
+    // (certReqId) then a universal SEQUENCE (certTemplate). Leads with a SEQUENCE
+    // like the signed-envelope trio and the ocsp-request, but the INTEGER-then-
+    // SEQUENCE pair at that depth is disjoint from both. Registered AHEAD of
+    // ocsp-request: a single-message CertReqMessages is the only remaining overlap
+    // with the ocsp-request detector, and crmf's deeper probe is the more specific.
+    name: "crmf",
+    module: crmf,
+    detect: crmf.matches,
+    parse: function (input) { return crmf.parse(input); },
+  },
   {
     // OCSPRequest ::= SEQUENCE { tbsRequest SEQUENCE, optionalSignature [0] EXPLICIT
     // OPTIONAL } — a SEQUENCE of 1-2 whose first child is the tbsRequest SEQUENCE.
@@ -179,7 +193,7 @@ var FORMATS = [
  * The names of every registered format, in detection order.
  *
  * @example
- *   pki.schema.all();  // → ["cms", "tsp", "ocsp-request", "ocsp-response", "pkcs8", "csr", "attrcert", "attrcert-v1", "crl", "x509"]
+ *   pki.schema.all();  // → ["cms", "tsp", "crmf", "ocsp-request", "ocsp-response", "pkcs8", "csr", "attrcert", "attrcert-v1", "crl", "x509"]
  */
 function all() { return FORMATS.map(function (f) { return f.name; }); }
 
@@ -224,6 +238,7 @@ module.exports = {
   cms:  { parse: cms.parse, pemDecode: cms.pemDecode, pemEncode: cms.pemEncode },
   ocsp: { parseRequest: ocsp.parseRequest, parseResponse: ocsp.parseResponse, pemDecode: ocsp.pemDecode },
   tsp: { parse: tsp.parse, parseTstInfo: tsp.parseTstInfo, parseToken: tsp.parseToken, pemDecode: tsp.pemDecode },
+  crmf: { parse: crmf.parse, pemDecode: crmf.pemDecode },
   attrcert: { parse: attrcert.parse, pemDecode: attrcert.pemDecode },
   all: all,
   parse: parse,

package/lib/schema-cms.js

@@ -618,7 +618,7 @@ var CONTENT_INFO = schema.seq([
  * @primitive  pki.schema.cms.parse
  * @signature  pki.schema.cms.parse(input) -> signedData
  * @since      0.1.10
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5652
  * @related    pki.schema.parse, pki.schema.x509.parse
  *
@@ -642,7 +642,7 @@ var parse = pkix.makeParser({ pemLabel: "CMS", PemError: PemError, ErrorClass: C
  * @primitive  pki.schema.cms.pemDecode
  * @signature  pki.schema.cms.pemDecode(text, label?) -> Buffer
  * @since      0.1.10
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468, RFC 5652
  * @related    pki.schema.cms.parse
  *
@@ -658,7 +658,7 @@ function pemDecode(text, label) { return pkix.pemDecode(text, label || "CMS", Pe
  * @primitive  pki.schema.cms.pemEncode
  * @signature  pki.schema.cms.pemEncode(der, label?) -> string
  * @since      0.1.10
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468
  * @related    pki.schema.cms.pemDecode
  *
@@ -684,9 +684,18 @@ function matches(root) {
   return true;
 }
 
+// Validate a bare EnvelopedData (RFC 5652 §6.1) — a universal SEQUENCE node —
+// returning its structured value; throws a typed cms/* error on a malformed
+// structure. Exposed for a composer that carries a bare EnvelopedData OUTSIDE a
+// ContentInfo (an RFC 4211 CRMF encryptedKey [4] POPOPrivKey arm), which the
+// content-type dispatch in `parse` cannot reach. The node MUST already be a
+// universal SEQUENCE (an IMPLICIT [n] EnvelopedData is retagged by the caller).
+function walkEnvelopedData(node) { return schema.walk(ENVELOPED_DATA, node, NS).result; }
+
 module.exports = {
   parse: parse,
   pemDecode: pemDecode,
   pemEncode: pemEncode,
   matches: matches,
+  walkEnvelopedData: walkEnvelopedData,
 };

package/lib/schema-crl.js

@@ -190,7 +190,7 @@ var CERTIFICATE_LIST = pkix.signedEnvelope(NS, TBS_CERTLIST, {
  * @primitive  pki.schema.crl.parse
  * @signature  pki.schema.crl.parse(input) -> crl
  * @since      0.1.7
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5280
  * @related    pki.schema.x509.parse, pki.schema.parse
  *
@@ -210,7 +210,7 @@ var parse = pkix.makeParser({ pemLabel: "X509 CRL", PemError: PemError, ErrorCla
  * @primitive  pki.schema.crl.pemDecode
  * @signature  pki.schema.crl.pemDecode(text, label?) -> Buffer
  * @since      0.1.7
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468, RFC 5280
  * @related    pki.schema.crl.parse
  *

package/lib/schema-crmf.js

@@ -0,0 +1,487 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * @module     pki.schema.crmf
+ * @nav        Schema
+ * @title      CRMF
+ * @order      180
+ * @slug       crmf
+ *
+ * @intro
+ *   Certificate Request Message Format handling per RFC 4211. `parse` decodes a
+ *   `CertReqMessages` — the request body CMP and EST enrollment carry — into an
+ *   array of messages, each with its `CertRequest` (certReqId, a `CertTemplate`
+ *   of the requested certificate fields, and any registration controls), an
+ *   optional proof-of-possession, and optional registration info.
+ *
+ *   RFC 4211 Appendix B is an IMPLICIT TAGS module, so the whole `CertTemplate`
+ *   body is one ascending run of IMPLICIT context tags `[0]`..`[9]`, every field
+ *   OPTIONAL. Two fields break IMPLICIT because their base type is a CHOICE and
+ *   X.680 forces EXPLICIT: `issuer [3]` / `subject [5]` are `Name`, dual-accepted
+ *   here (the standards-compliant EXPLICIT encoding and the dominant IMPLICIT one
+ *   real tooling emits); and the `OptionalValidity` times are EXPLICIT. version,
+ *   when supplied, MUST be 2 (RFC 4211 §5); certReqId is an unbounded signed
+ *   INTEGER (the RFC 9483 `-1` sentinel is legal). The `CertRequest` byte range
+ *   the proof-of-possession signature covers, and each `poposkInput`, are surfaced
+ *   RAW for a downstream verifier; registration controls / info values and the
+ *   keyEncipherment / keyAgreement POP arms are surfaced RAW rather than recursed.
+ *   DER-only, fail-closed.
+ *
+ * @card
+ *   Parse DER / PEM RFC 4211 CertReqMessages into requested-certificate templates,
+ *   proof-of-possession, and registration controls — dual-accepted names, raw
+ *   verifier inputs, fail-closed.
+ */
+
+var asn1 = require("./asn1-der");
+var schema = require("./schema-engine");
+var pkix = require("./schema-pkix");
+var cms = require("./schema-cms");
+var oid = require("./oid");
+var frameworkError = require("./framework-error");
+
+var CrmfError = frameworkError.CrmfError;
+var PemError = frameworkError.PemError;
+
+var NS = pkix.makeNS("crmf", CrmfError, oid);
+
+var TAGS = asn1.TAGS;
+
+// ---- dual-accept Name (issuer [3] / subject [5]) ---------------------
+// RFC 4211 Appendix B is IMPLICIT TAGS, but Name is a CHOICE so X.680 §31.2.7
+// forces EXPLICIT tagging — the standards-compliant wire is a context [tag]
+// EXPLICIT wrapper around a universal RDNSequence. The dominant tooling
+// (pyasn1-modules, BouncyCastle) instead encodes IMPLICIT (the [tag] REPLACES the
+// RDNSequence 0x30, so the children ARE the RDN SETs). Both occur in real CMP /
+// EST, so accept either, disambiguated by the first inner element's tag: a
+// universal SET leads the IMPLICIT form; a single universal SEQUENCE is the
+// EXPLICIT wrapper. Anything else fails closed.
+function crmfName(tag) {
+  var NAME = pkix.name(NS);                          // EXPLICIT arm walks a universal RDNSequence
+  var INAME = pkix.name(NS, { implicitTag: tag });   // IMPLICIT arm: [tag] children ARE the RDN SETs
+  return schema.decode(function (n, ctx) {
+    if (n.tagClass !== "context" || n.tagNumber !== tag || !n.children) {
+      throw ctx.E("crmf/bad-name", "issuer/subject [" + tag + "] must be a Name (RFC 4211 §5)");
+    }
+    if (n.children.length === 0) return schema.walk(INAME, n, ctx).result; // IMPLICIT empty RDNSequence
+    var c0 = n.children[0];
+    if (c0.tagClass === "universal" && c0.tagNumber === TAGS.SET) {
+      return schema.walk(INAME, n, ctx).result;                            // IMPLICIT: children ARE RDN SETs
+    }
+    if (n.children.length === 1 && c0.tagClass === "universal" && c0.tagNumber === TAGS.SEQUENCE) {
+      return schema.walk(NAME, c0, ctx).result;                            // EXPLICIT: [tag] wraps RDNSequence
+    }
+    throw ctx.E("crmf/bad-name", "issuer/subject [" + tag + "] Name must be an IMPLICIT RDNSequence (SET-led) or an EXPLICIT-wrapped RDNSequence");
+  }, function (value) {
+    // encode the IMPLICIT form (the dominant wire encoding): the [tag] whose children
+    // ARE the RDN SETs, built from the decoded `rdns` via the shared Name schema.
+    return schema.encode(INAME, value.rdns, NS);
+  });
+}
+
+// ---- OptionalValidity (§5) -------------------------------------------
+// validity [4] IMPLICIT SEQUENCE { notBefore [0] Time OPTIONAL, notAfter [1] Time
+// OPTIONAL }. Time is a CHOICE of UTCTime / GeneralizedTime, so [0]/[1] are
+// EXPLICIT (an IMPLICIT tag would erase the UTCTime-vs-GeneralizedTime
+// discriminator). RFC 4211 §5 requires at least one of the two to be present.
+var OPTIONAL_VALIDITY = schema.seq([
+  schema.trailing([
+    { tag: 0, name: "notBefore", schema: schema.time(NS), explicit: true, emptyCode: "crmf/bad-validity" },
+    { tag: 1, name: "notAfter", schema: schema.time(NS), explicit: true, emptyCode: "crmf/bad-validity" },
+  ], { minTag: 0, maxTag: 1, unexpectedCode: "crmf/bad-validity", orderCode: "crmf/bad-validity" }),
+], {
+  assert: "implicit", implicitTag: 4, code: "crmf/bad-validity", what: "OptionalValidity",
+  build: function (m, ctx) {
+    var f = m.fields;
+    if (!f.notBefore.present && !f.notAfter.present) {
+      throw ctx.E("crmf/bad-validity", "OptionalValidity must contain notBefore or notAfter (RFC 4211 §5)");
+    }
+    return { notBefore: f.notBefore.present ? f.notBefore.value : null, notAfter: f.notAfter.present ? f.notAfter.value : null };
+  },
+});
+
+// ---- ProofOfPossession (§4) ------------------------------------------
+// raVerified [0] NULL — the RA has already verified POP out of band.
+var POPO_RAVERIFIED = schema.decode(function (n, ctx) {
+  try { asn1.read.nullImplicit(n, 0); }
+  catch (e) { throw ctx.E("crmf/bad-popo", "raVerified [0] must be an IMPLICIT NULL", e); }
+  return { type: "raVerified" };
+});
+
+// When poposkInput is present the POP signature is over the DER of the
+// POPOSigningKeyInput VALUE (RFC 4211 §4.1), which is a SEQUENCE — but on the wire
+// poposkInput is an IMPLICIT [0] field, so its bytes lead with the context tag
+// (0xA0) rather than the SEQUENCE tag a verifier hashes. `asn1.sequenceTlv` recovers
+// the SEQUENCE-tagged signed region from the field's content; `signedBytes` is that
+// region and `bytes` keeps the raw wire [0] TLV, so a verifier can use either
+// encoding its peer produced.
+
+// POPOSigningKeyInput ::= SEQUENCE { authInfo CHOICE { sender [0] GeneralName,
+// publicKeyMAC PKMACValue }, publicKey SubjectPublicKeyInfo } (§4.1). Structurally
+// validated (not deferred raw), so an empty or malformed poposkInput fails closed
+// rather than surfacing a signed region that was never a well-formed POP input.
+// PKMACValue ::= SEQUENCE { algId AlgorithmIdentifier, value BIT STRING }.
+var PKMAC_VALUE = schema.seq([
+  schema.field("algId", pkix.algorithmIdentifier(NS)),
+  schema.field("value", schema.bitString()),
+], { assert: "sequence", arity: { exact: 2 }, code: "crmf/bad-popo", what: "PKMACValue" });
+
+// authInfo CHOICE: sender [0] GeneralName is EXPLICIT (GeneralName is itself a
+// CHOICE); publicKeyMAC is a bare PKMACValue SEQUENCE — disjoint by tag class.
+var POPOSK_AUTH_INFO = schema.choice([
+  { when: { tagClass: "context", tagNumber: 0 }, schema: schema.explicit(0, pkix.generalName(NS, { code: "crmf/bad-popo" }), { code: "crmf/bad-popo" }) },
+  { when: { tagClass: "universal", tagNumber: TAGS.SEQUENCE }, schema: PKMAC_VALUE },
+], { code: "crmf/bad-popo" });
+
+var POPOSK_INPUT = schema.seq([
+  schema.field("authInfo", POPOSK_AUTH_INFO),
+  schema.field("publicKey", pkix.spki(NS)),
+], { assert: "implicit", implicitTag: 0, arity: { exact: 2 }, code: "crmf/bad-popo", what: "POPOSigningKeyInput" });
+
+// POPOSigningKey ::= SEQUENCE { poposkInput [0] POPOSigningKeyInput OPTIONAL,
+// algorithmIdentifier AlgorithmIdentifier, signature BIT STRING } — IMPLICIT [1].
+var POPO_SIGNING_KEY = schema.seq([
+  schema.optional("poposkInput", schema.decode(function (n, ctx) {
+    // Validate the full POPOSigningKeyInput structure fail-closed, then surface the
+    // raw [0] node plus its decoded publicKey (for the §4.1 template-match check).
+    var m = schema.walk(POPOSK_INPUT, n, ctx);
+    return { node: n, publicKey: m.fields.publicKey.value.result.bytes };
+  }), { tag: 0 }),
+  schema.field("algorithmIdentifier", pkix.algorithmIdentifier(NS)),
+  schema.field("signature", schema.bitString()),
+], {
+  assert: "implicit", implicitTag: 1, code: "crmf/bad-popo", what: "POPOSigningKey",
+  build: function (m) {
+    var pin = m.fields.poposkInput;
+    return {
+      type: "signature",
+      poposkInput: pin.present ? { bytes: pin.node.bytes, signedBytes: asn1.sequenceTlv(pin.node), publicKey: pin.value.publicKey } : null,
+      algorithmIdentifier: m.fields.algorithmIdentifier.value.result,
+      signature: { unusedBits: m.fields.signature.value.unusedBits, bytes: m.fields.signature.value.bytes },
+    };
+  },
+});
+
+// keyEncipherment [2] / keyAgreement [3] POPOPrivKey (§4). POPOPrivKey is a
+// 5-arm CHOICE { thisMessage [0], subsequentMessage [1], dhMAC [2], agreeMAC [3],
+// encryptedKey [4] }, so X.680 §31.2.7 forces the outer [2]/[3] tag to be EXPLICIT
+// (a CHOICE has no single tag to replace). Validate that shell — a constructed
+// wrapper around exactly one inner context [0]..[4] alternative — before surfacing
+// the arm RAW, so a primitive / empty / mis-tagged node is rejected rather than
+// reported to a verifier as a well-formed POP. The inner alternative's own value
+// (incl. the encryptedKey [4] EnvelopedData) stays deferred to the verify layer.
+// POPOPrivKey ::= CHOICE { thisMessage [0] BIT STRING (deprecated), subsequentMessage
+// [1] SubsequentMessage, dhMAC [2] BIT STRING (deprecated), agreeMAC [3] PKMACValue,
+// encryptedKey [4] EnvelopedData } (RFC 4211 §4.2). The deprecated arms are still
+// parsed. The inner VALUE stays deferred raw (the EnvelopedData / MAC decode is a
+// verify-layer concern), but the alternative's shape is validated fail-closed.
+var POPOPRIVKEY_METHODS = { 0: "thisMessage", 1: "subsequentMessage", 2: "dhMAC", 3: "agreeMAC", 4: "encryptedKey" };
+function popoPrivKey(type) {
+  return schema.decode(function (n, ctx) {
+    if (!n.children || n.children.length !== 1) {
+      throw ctx.E("crmf/bad-popo", type + " [" + n.tagNumber + "] POPOPrivKey must be an EXPLICIT wrapper around one alternative (RFC 4211 §4)");
+    }
+    var inner = n.children[0];
+    if (inner.tagClass !== "context" || inner.tagNumber < 0 || inner.tagNumber > 4) {
+      throw ctx.E("crmf/bad-popo", type + " POPOPrivKey alternative must be a context [0]..[4] CHOICE element (RFC 4211 §4)");
+    }
+    // RFC 4211 §4.2/§4.3 — the MAC alternatives dhMAC [2] / agreeMAC [3] are the
+    // key-agreement "fourth method"; key-encipherment POP uses only the
+    // thisMessage / subsequentMessage / encryptedKey methods, so a MAC arm under
+    // keyEncipherment is non-conforming.
+    if (type === "keyEncipherment" && (inner.tagNumber === 2 || inner.tagNumber === 3)) {
+      throw ctx.E("crmf/bad-popo", "keyEncipherment POP cannot use the MAC alternative " + POPOPRIVKEY_METHODS[inner.tagNumber] + " (RFC 4211 §4.2)");
+    }
+    // FORM: thisMessage [0] / subsequentMessage [1] / dhMAC [2] are primitive (BIT
+    // STRING / INTEGER / BIT STRING); agreeMAC [3] PKMACValue and encryptedKey [4]
+    // EnvelopedData are constructed (SEQUENCE). A wrong-form node is malformed.
+    var mustBeConstructed = inner.tagNumber === 3 || inner.tagNumber === 4;
+    if (mustBeConstructed !== !!inner.children) {
+      throw ctx.E("crmf/bad-popo", type + " POPOPrivKey [" + inner.tagNumber + "] has the wrong primitive/constructed form (RFC 4211 §4)");
+    }
+    // Each alternative's PAYLOAD is decoded fail-closed, not just its form:
+    // thisMessage [0] / dhMAC [2] are BIT STRINGs; subsequentMessage [1] an INTEGER
+    // in {0,1}; agreeMAC [3] a PKMACValue SEQUENCE; encryptedKey [4] an EnvelopedData.
+    if (inner.tagNumber === 0 || inner.tagNumber === 2) {
+      try { asn1.read.bitStringImplicit(inner, inner.tagNumber); }
+      catch (e) { throw ctx.E("crmf/bad-popo", POPOPRIVKEY_METHODS[inner.tagNumber] + " [" + inner.tagNumber + "] must be a BIT STRING (RFC 4211 §4.2)", e); }
+    }
+    if (inner.tagNumber === 1) {
+      var v;
+      try { v = asn1.read.integerImplicit(inner, 1); }
+      catch (e) { throw ctx.E("crmf/bad-popo", "subsequentMessage must be an INTEGER", e); }
+      if (v !== 0n && v !== 1n) {
+        throw ctx.E("crmf/bad-popo", "SubsequentMessage must be encrCert(0) or challengeResp(1) (RFC 4211 §4.2)");
+      }
+    }
+    if (inner.tagNumber === 3) {
+      try { schema.walk(PKMAC_VALUE, asn1.decode(asn1.sequenceTlv(inner)), NS); }
+      catch (e) { throw ctx.E("crmf/bad-popo", "agreeMAC [3] must be a PKMACValue SEQUENCE { algId, BIT STRING } (RFC 4211 §4.2)", e); }
+    }
+    // encryptedKey [4] EnvelopedData — validate the CMS structure fail-closed by
+    // composing the shared EnvelopedData decoder (retag the IMPLICIT [4] to the
+    // universal SEQUENCE it decodes as). The EncKeyWithID identity check lives inside
+    // the ENCRYPTED content, so it stays a verify-layer concern.
+    if (inner.tagNumber === 4) {
+      var env;
+      try { env = cms.walkEnvelopedData(asn1.decode(asn1.sequenceTlv(inner))); }
+      catch (e) { throw ctx.E("crmf/bad-popo", "encryptedKey [4] must be a well-formed EnvelopedData (RFC 4211 §4.2, RFC 5652 §6.1)", e); }
+      // RFC 4211 §4.2 — the enveloped content type MUST be id-ct-encKeyWithID (the
+      // ContentType OID is in the clear even though the content itself is encrypted).
+      if (env.encryptedContentInfo.contentType !== oid.byName("encKeyWithID")) {
+        throw ctx.E("crmf/bad-popo", "encryptedKey [4] EnvelopedData content type MUST be id-ct-encKeyWithID (RFC 4211 §4.2)");
+      }
+      // The encrypted key material MUST be present — CMS allows a detached
+      // EnvelopedData (encryptedContent OPTIONAL), but a POP with no key to verify
+      // or archive is meaningless.
+      if (env.encryptedContentInfo.encryptedContent == null) {
+        throw ctx.E("crmf/bad-popo", "encryptedKey [4] EnvelopedData MUST carry the encrypted key in encryptedContent (RFC 4211 §4.2)");
+      }
+    }
+    return { type: type, method: POPOPRIVKEY_METHODS[inner.tagNumber], bytes: n.bytes };
+  });
+}
+
+// ProofOfPossession ::= CHOICE { raVerified [0] NULL, signature [1] POPOSigningKey,
+// keyEncipherment [2] POPOPrivKey, keyAgreement [3] POPOPrivKey }. Each arm yields
+// the final object so the CertReqMsg build reads one uniform popo shape.
+var PROOF_OF_POSSESSION = schema.choice([
+  { when: { tagClass: "context", tagNumber: 0 }, schema: POPO_RAVERIFIED },
+  { when: { tagClass: "context", tagNumber: 1 }, schema: schema.decode(function (n, ctx) { return schema.walk(POPO_SIGNING_KEY, n, ctx).result; }) },
+  { when: { tagClass: "context", tagNumber: 2 }, schema: popoPrivKey("keyEncipherment") },
+  { when: { tagClass: "context", tagNumber: 3 }, schema: popoPrivKey("keyAgreement") },
+], { code: "crmf/bad-popo" });
+
+// ---- Controls / regInfo (§5, §6, §7) ---------------------------------
+// AttributeTypeAndValue ::= SEQUENCE { type OBJECT IDENTIFIER, value ANY DEFINED BY
+// type }. The list is decoded; each value stays RAW (the per-OID value semantics
+// are deferred). Shared shape for both controls and regInfo.
+var CONTROL = schema.seq([
+  schema.field("type", schema.oidLeaf()),
+  schema.field("value", schema.any()),
+], {
+  assert: "sequence", arity: { exact: 2 }, code: "crmf/bad-control", what: "AttributeTypeAndValue",
+  build: function (m, ctx) {
+    var t = m.fields.type.value;
+    return { type: t, name: ctx.oid.name(t) || null, value: m.fields.value.node.bytes };
+  },
+});
+function mapControls(m) { return m.items.map(function (it) { return it.value.result; }); }
+// Controls ::= SEQUENCE SIZE(1..MAX) OF AttributeTypeAndValue (§5).
+var CONTROLS = schema.seqOf(CONTROL, { assert: "sequence", min: 1, code: "crmf/bad-controls", what: "Controls", build: mapControls });
+// regInfo ::= SEQUENCE SIZE(1..MAX) OF AttributeTypeAndValue (§7).
+var REG_INFO = schema.seqOf(CONTROL, { assert: "sequence", min: 1, code: "crmf/bad-reg-info", what: "regInfo", build: mapControls });
+
+// ---- CertTemplate (§5) — the IMPLICIT-TAGS core ----------------------
+// CertTemplate ::= SEQUENCE { version [0], serialNumber [1], signingAlg [2],
+// issuer [3] Name, validity [4] OptionalValidity, subject [5] Name, publicKey [6]
+// SubjectPublicKeyInfo, issuerUID [7], subjectUID [8], extensions [9] } — every
+// field IMPLICIT and OPTIONAL, so the whole body is one ascending [0..9] trailing
+// run. issuer/subject Name and the [4] validity times are the CHOICE exceptions.
+var CERT_TEMPLATE = schema.seq([
+  schema.trailing([
+    { tag: 0, name: "version", schema: schema.implicitInteger(0) },
+    { tag: 1, name: "serialNumber", schema: schema.implicitInteger(1) },
+    { tag: 2, name: "signingAlg", schema: pkix.algorithmIdentifier(NS, { implicitTag: 2 }) },
+    { tag: 3, name: "issuer", schema: crmfName(3) },
+    { tag: 4, name: "validity", schema: OPTIONAL_VALIDITY },
+    { tag: 5, name: "subject", schema: crmfName(5) },
+    { tag: 6, name: "publicKey", schema: pkix.spki(NS, { implicitTag: 6 }) },
+    { tag: 7, name: "issuerUID", schema: schema.implicitBitString(7) },
+    { tag: 8, name: "subjectUID", schema: schema.implicitBitString(8) },
+    { tag: 9, name: "extensions", schema: pkix.extensions(NS, { implicitTag: 9 }) },
+  ], { minTag: 0, maxTag: 9, unexpectedCode: "crmf/bad-cert-template", orderCode: "crmf/bad-cert-template" }),
+], {
+  assert: "sequence", code: "crmf/bad-cert-template", what: "CertTemplate",
+  build: function (m, ctx) {
+    var f = m.fields;
+    // RFC 4211 §5 — serialNumber, signingAlg, issuerUID, and subjectUID MUST be
+    // omitted from a CertTemplate: serialNumber and signingAlg are assigned by the
+    // CA, and the UID pair is deprecated. A requester must not dictate a
+    // CA-assigned value (a requester-chosen serialNumber is a real hazard), so a
+    // template that sets any of them is rejected fail-closed, not surfaced as
+    // acceptable. They stay in the field map (parsed, then rejected) so the
+    // diagnostic names the offending field rather than a bare tag number.
+    var caAssigned = ["serialNumber", "signingAlg", "issuerUID", "subjectUID"];
+    for (var i = 0; i < caAssigned.length; i++) {
+      if (f[caAssigned[i]].present) {
+        throw ctx.E("crmf/bad-cert-template", "CertTemplate " + caAssigned[i] + " MUST be omitted — it is CA-assigned or deprecated (RFC 4211 §5)");
+      }
+    }
+    // version MUST be 2 (v3) when supplied; SHOULD be omitted (RFC 4211 §5).
+    if (f.version.present && f.version.value !== 2n) {
+      throw ctx.E("crmf/bad-version", "CertTemplate version MUST be 2 (v3) if supplied (RFC 4211 §5)");
+    }
+    return {
+      version:    f.version.present ? f.version.value : null,
+      issuer:     f.issuer.present ? f.issuer.value : null,
+      validity:   f.validity.present ? f.validity.value.result : null,
+      subject:    f.subject.present ? f.subject.value : null,
+      publicKey:  f.publicKey.present ? f.publicKey.value.result : null,
+      extensions: f.extensions.present ? f.extensions.value.result : null,
+    };
+  },
+});
+
+// ---- CertRequest / CertReqMsg / CertReqMessages (§3, §5) --------------
+// CertRequest ::= SEQUENCE { certReqId INTEGER, certTemplate CertTemplate,
+// controls Controls OPTIONAL }. certReqId is a SIGNED INTEGER with no value
+// constraint — a negative value (the RFC 9483 -1 sentinel) is legal.
+var CERT_REQUEST = schema.seq([
+  schema.field("certReqId", schema.integerLeaf()),
+  schema.field("certTemplate", CERT_TEMPLATE),
+  schema.optional("controls", CONTROLS, { whenUniversal: [TAGS.SEQUENCE] }),
+], {
+  assert: "sequence", code: "crmf/bad-cert-request", what: "CertRequest",
+  build: function (m) {
+    return {
+      certReqId:     m.fields.certReqId.value,
+      certReqIdHex:  m.fields.certReqId.node.content.toString("hex"),
+      certTemplate:  m.fields.certTemplate.value.result,
+      controls:      m.fields.controls.present ? m.fields.controls.value.result : null,
+      certReqBytes:  m.node.bytes,   // the exact CertRequest TLV the POP signature covers (§4.1)
+    };
+  },
+});
+
+// CertReqMsg ::= SEQUENCE { certReq CertRequest, popo ProofOfPossession OPTIONAL,
+// regInfo SEQUENCE OF AttributeTypeAndValue OPTIONAL }. popo is a CHOICE of context
+// [0]..[3]; regInfo is a bare universal SEQUENCE, so the two OPTIONAL positions are
+// disambiguated by tag class.
+var CERT_REQ_MSG = schema.seq([
+  schema.field("certReq", CERT_REQUEST),
+  schema.optional("popo", PROOF_OF_POSSESSION, { tags: [0, 1, 2, 3] }),
+  schema.optional("regInfo", REG_INFO, { whenUniversal: [TAGS.SEQUENCE] }),
+], {
+  assert: "sequence", code: "crmf/bad-cert-req-msg", what: "CertReqMsg",
+  build: function (m, ctx) {
+    var certReq = m.fields.certReq.value.result;
+    var popo = m.fields.popo.present ? m.fields.popo.value : null;
+    // A POP whose signature/MAC covers the certReq requires the CertTemplate to
+    // contain both subject and publicKey — otherwise there is no complete request
+    // to sign / MAC over, and a verifier would be bound to the wrong identity/key.
+    var complete = certReq.certTemplate.subject !== null && certReq.certTemplate.publicKey !== null;
+    // RFC 4211 §4.1 — for a signature POP, poposkInput's presence is fixed by the
+    // CertTemplate: it MUST be omitted when the template carries BOTH subject and
+    // publicKey (the signature is then over the DER of the CertRequest), and MUST be
+    // present otherwise.
+    if (popo && popo.type === "signature") {
+      if (complete && popo.poposkInput !== null) {
+        throw ctx.E("crmf/bad-popo", "poposkInput MUST be omitted when the CertTemplate contains both subject and publicKey (RFC 4211 §4.1)");
+      }
+      if (!complete && popo.poposkInput === null) {
+        throw ctx.E("crmf/bad-popo", "poposkInput MUST be present when the CertTemplate lacks subject or publicKey (RFC 4211 §4.1)");
+      }
+      // RFC 4211 §4.1 — the POPOSigningKeyInput publicKey MUST be exactly the template
+      // publicKey (both surfaced as canonical SubjectPublicKeyInfo DER), so a request
+      // cannot sign one key while asking for a certificate over a different key.
+      if (popo.poposkInput !== null && certReq.certTemplate.publicKey !== null &&
+          !popo.poposkInput.publicKey.equals(certReq.certTemplate.publicKey.bytes)) {
+        throw ctx.E("crmf/bad-popo", "POPOSigningKeyInput publicKey MUST equal the CertTemplate publicKey (RFC 4211 §4.1)");
+      }
+    }
+    // RFC 4211 §4.2/§4.3 — a MAC-based POPOPrivKey (dhMAC / agreeMAC) proves
+    // possession by MACing the certReq, which MUST include both subject and publicKey.
+    if (popo && (popo.type === "keyEncipherment" || popo.type === "keyAgreement") &&
+        (popo.method === "dhMAC" || popo.method === "agreeMAC") && !complete) {
+      throw ctx.E("crmf/bad-popo", "a MAC-based key-agreement/encipherment POP (dhMAC/agreeMAC) requires the CertTemplate to contain both subject and publicKey (RFC 4211 §4.2/§4.3)");
+    }
+    return {
+      certReq: certReq,
+      popo:    popo,
+      regInfo: m.fields.regInfo.present ? m.fields.regInfo.value.result : null,
+    };
+  },
+});
+
+// CertReqMessages ::= SEQUENCE SIZE(1..MAX) OF CertReqMsg (§3) — an empty sequence
+// is malformed.
+var CERT_REQ_MESSAGES = schema.seqOf(CERT_REQ_MSG, {
+  assert: "sequence", min: 1, code: "crmf/bad-cert-req-messages", what: "CertReqMessages",
+  build: function (m) { return { messages: m.items.map(function (it) { return it.value.result; }) }; },
+});
+
+// ---- parse -----------------------------------------------------------
+
+/**
+ * @primitive  pki.schema.crmf.parse
+ * @signature  pki.schema.crmf.parse(input) -> certReqMessages
+ * @since      0.1.17
+ * @status     experimental
+ * @spec       RFC 4211
+ * @related    pki.schema.parse, pki.schema.csr.parse
+ *
+ * Parse a DER `Buffer` or a PEM string/Buffer into a structured `CertReqMessages`:
+ * `{ messages: [ { certReq, popo, regInfo } ] }`. Each `certReq` is
+ * `{ certReqId, certReqIdHex, certTemplate, controls, certReqBytes }`, and
+ * `certTemplate` carries the requestable certificate fields (`version`, `issuer`,
+ * `validity`, `subject`, `publicKey`, `extensions` — each `null` when absent). The
+ * CA-assigned / deprecated fields RFC 4211 §5 requires a request to omit
+ * (`serialNumber`, `signingAlg`, `issuerUID`, `subjectUID`) are rejected, not
+ * surfaced. `popo` is
+ * `null`, `{ type: "raVerified" }`, `{ type: "signature", poposkInput,
+ * algorithmIdentifier, signature }`, or `{ type: "keyEncipherment" |
+ * "keyAgreement", method, bytes }` (where `method` is the POPOPrivKey alternative —
+ * `thisMessage` / `subsequentMessage` / `dhMAC` / `agreeMAC` / `encryptedKey` — each
+ * structurally validated, the `encryptedKey` EnvelopedData included). When present, `poposkInput` is `{ bytes, signedBytes }`
+ * — `bytes` is the raw wire `[0]` TLV and `signedBytes` is the `POPOSigningKeyInput`
+ * re-tagged to the `SEQUENCE` DER the signature actually covers (RFC 4211 §4.1).
+ * `certReqBytes` is the exact `CertRequest` byte range a proof-of-possession
+ * verifier hashes when `poposkInput` is absent.
+ *
+ * Throws `CrmfError` when the bytes are not a well-formed `CertReqMessages`, and
+ * `Asn1Error` when the underlying DER is malformed.
+ *
+ * @example
+ *   var m = pki.schema.crmf.parse(der);
+ *   m.messages[0].certReq.certTemplate.subject.dn;   // "CN=req.example"
+ */
+var parse = pkix.makeParser({
+  pemLabel: null, PemError: PemError, ErrorClass: CrmfError, prefix: "crmf",
+  what: "certificate request message", topSchema: CERT_REQ_MESSAGES, ns: NS,
+});
+
+/**
+ * @primitive  pki.schema.crmf.pemDecode
+ * @signature  pki.schema.crmf.pemDecode(text, label?) -> Buffer
+ * @since      0.1.17
+ * @status     experimental
+ * @spec       RFC 7468, RFC 4211
+ * @related    pki.schema.crmf.parse
+ *
+ * Extract the DER bytes from a PEM block (RFC 4211 registers no RFC 7468 label, so
+ * the first block is taken unless `label` is given — CRMF rides inside CMP / EST as
+ * DER in practice). Throws `PemError` on a missing envelope or a non-base64 body.
+ *
+ * @example
+ *   var der = pki.schema.crmf.pemDecode(pemText);
+ */
+function pemDecode(text, label) { return pkix.pemDecode(text, label || null, PemError); }
+
+// matches(root): a CertReqMessages is a universal SEQUENCE whose first CertReqMsg
+// is a SEQUENCE whose first CertRequest is a SEQUENCE leading with a universal
+// INTEGER (certReqId) then a universal SEQUENCE (certTemplate). This 3-level probe
+// is disjoint from every registered root PROVIDED crmf is checked before
+// ocsp-request: an OCSPRequest's tbsRequest never leads with the INTEGER-then-
+// SEQUENCE pair (its children[0] is a context [0] version or a requestList).
+function matches(root) {
+  if (!root || root.tagClass !== "universal" || root.tagNumber !== TAGS.SEQUENCE || !root.children || root.children.length < 1) return false;
+  var msg = root.children[0];
+  if (!msg.children || msg.tagClass !== "universal" || msg.tagNumber !== TAGS.SEQUENCE || msg.children.length < 1) return false;
+  var certReq = msg.children[0];
+  if (!certReq.children || certReq.tagClass !== "universal" || certReq.tagNumber !== TAGS.SEQUENCE || certReq.children.length < 2) return false;
+  var id = certReq.children[0], tpl = certReq.children[1];
+  return id.tagClass === "universal" && id.tagNumber === TAGS.INTEGER &&
+    tpl.tagClass === "universal" && tpl.tagNumber === TAGS.SEQUENCE && !!tpl.children;
+}
+
+module.exports = {
+  parse: parse,
+  pemDecode: pemDecode,
+  matches: matches,
+  // The top schema, exposed (not on the curated pki.schema.crmf surface) so a
+  // round-trip test can prove schema.encode(schema, v) -> decode -> parse recovers
+  // v — the invariant that structurally validates the IMPLICIT/EXPLICIT tag handling.
+  certReqMessagesSchema: CERT_REQ_MESSAGES,
+};

package/lib/schema-csr.js

@@ -106,7 +106,7 @@ var CERTIFICATION_REQUEST = pkix.signedEnvelope(NS, CERTIFICATION_REQUEST_INFO,
  * @primitive  pki.schema.csr.parse
  * @signature  pki.schema.csr.parse(input) -> csr
  * @since      0.1.8
- * @status     experimental
+ * @status     stable
  * @spec       RFC 2986
  * @related    pki.schema.x509.parse, pki.schema.parse
  *
@@ -129,7 +129,7 @@ var parse = pkix.makeParser({ pemLabel: "CERTIFICATE REQUEST", PemError: PemErro
  * @primitive  pki.schema.csr.pemDecode
  * @signature  pki.schema.csr.pemDecode(text, label?) -> Buffer
  * @since      0.1.8
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468, RFC 2986
  * @related    pki.schema.csr.parse
  *
@@ -146,7 +146,7 @@ function pemDecode(text, label) { return pkix.pemDecode(text, label || "CERTIFIC
  * @primitive  pki.schema.csr.pemEncode
  * @signature  pki.schema.csr.pemEncode(der, label?) -> string
  * @since      0.1.8
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468
  * @related    pki.schema.csr.pemDecode
  *

package/lib/schema-engine.js

@@ -93,39 +93,49 @@ function _assertArity(schema, kids, ctx) {
 // the OID / INTEGER / string reads). `decode(fn)` hands the whole node to fn,
 // which owns its try/catch and code mapping. `any()` yields the node itself.
 
-function oidLeaf()        { return { kind: "leaf", read: asn1.read.oid }; }
-function integerLeaf()    { return { kind: "leaf", read: asn1.read.integer }; }
-function boolean()        { return { kind: "leaf", read: asn1.read.boolean }; }
-function octetString()    { return { kind: "leaf", read: asn1.read.octetString }; }
-function bitString()      { return { kind: "leaf", read: function (n) { var b = asn1.read.bitString(n); return { unusedBits: b.unusedBits, bytes: b.bytes }; } }; }
+// Leaves carry BOTH directions: `read(node) -> value` and `write(value) -> DER TLV`,
+// so a single leaf definition drives decode (walk) and encode (build). A [tag]
+// IMPLICIT leaf's write emits the context-tagged TLV directly, mirroring its read.
+function _implicitIntContent(v) { return asn1.decode(asn1.build.integer(v)).content; }
+function oidLeaf()        { return { kind: "leaf", read: asn1.read.oid, write: function (v) { return asn1.build.oid(v); } }; }
+function integerLeaf()    { return { kind: "leaf", read: asn1.read.integer, write: function (v) { return asn1.build.integer(v); } }; }
+function boolean()        { return { kind: "leaf", read: asn1.read.boolean, write: function (v) { return asn1.build.boolean(v); } }; }
+function octetString()    { return { kind: "leaf", read: asn1.read.octetString, write: function (v) { return asn1.build.octetString(v); } }; }
+function bitString()      { return { kind: "leaf", read: function (n) { var b = asn1.read.bitString(n); return { unusedBits: b.unusedBits, bytes: b.bytes }; }, write: function (v) { return asn1.build.bitString(v.bytes, v.unusedBits); } }; }
 // A [tag] IMPLICIT BIT STRING leaf (context-class primitive) — the primitive-leaf
 // counterpart to implicitSetOf, for e.g. the PKCS#8 publicKey [1] (RFC 5958 §2).
-function implicitBitString(tag) { return { kind: "leaf", read: function (n) { var b = asn1.read.bitStringImplicit(n, tag); return { unusedBits: b.unusedBits, bytes: b.bytes }; } }; }
+function implicitBitString(tag) { return { kind: "leaf", read: function (n) { var b = asn1.read.bitStringImplicit(n, tag); return { unusedBits: b.unusedBits, bytes: b.bytes }; }, write: function (v) { return asn1.build.contextPrimitive(tag, Buffer.concat([Buffer.from([v.unusedBits]), v.bytes])); } }; }
 // A [tag] IMPLICIT OCTET STRING leaf (context-class primitive) — the sibling of
 // implicitBitString, for e.g. the CMS SignerIdentifier subjectKeyIdentifier [0]
 // (RFC 5652 §5.3). Yields the raw content bytes.
-function implicitOctetString(tag) { return { kind: "leaf", read: function (n) { return asn1.read.octetStringImplicit(n, tag); } }; }
+function implicitOctetString(tag) { return { kind: "leaf", read: function (n) { return asn1.read.octetStringImplicit(n, tag); }, write: function (v) { return asn1.build.contextPrimitive(tag, v); } }; }
 // A [tag] IMPLICIT NULL leaf (context-class primitive, empty content) — the sibling
 // of implicitBitString/implicitOctetString, for e.g. the OCSP CertStatus good [0] /
 // unknown [2] arms (RFC 6960 §4.2.1). Yields null; rejects a constructed or
 // non-empty [tag] node fail-closed.
-function implicitNull(tag) { return { kind: "leaf", read: function (n) { return asn1.read.nullImplicit(n, tag); } }; }
+function implicitNull(tag) { return { kind: "leaf", read: function (n) { return asn1.read.nullImplicit(n, tag); }, write: function () { return asn1.build.contextPrimitive(tag, Buffer.alloc(0)); } }; }
 // A [tag] IMPLICIT INTEGER leaf (context-class primitive) — the integer sibling of
 // implicitBitString, for the RFC 3161 Accuracy millis [0] / micros [1] fields
 // (context-tagged primitive INTEGERs). Yields a BigInt; a constructed or wrong-tag
 // node fails asn1/* at the codec.
-function implicitInteger(tag) { return { kind: "leaf", read: function (n) { return asn1.read.integerImplicit(n, tag); } }; }
+function implicitInteger(tag) { return { kind: "leaf", read: function (n) { return asn1.read.integerImplicit(n, tag); }, write: function (v) { return asn1.build.contextPrimitive(tag, _implicitIntContent(v)); } }; }
 function any()            { return { kind: "any" }; }
-function decode(fn)       { return { kind: "decode", fn: fn }; }
+// decode(fn, write?): a custom decode leaf; `write` is its optional paired encoder
+// (value -> DER TLV) so the same leaf drives both directions.
+function decode(fn, write) { return { kind: "decode", fn: fn, write: write }; }
 
 // time(ns): a UTCTime / GeneralizedTime value, asserting the tag before the
-// codec reads it (mirrors _parseValidityTime's x509/bad-time guard).
+// codec reads it (mirrors _parseValidityTime's x509/bad-time guard). Encodes as
+// UTCTime for years 1950..2049 and GeneralizedTime otherwise (RFC 5280 §4.1.2.5).
 function time(ns) {
   return decode(function (n, ctx) {
     if (n.tagClass !== "universal" || (n.tagNumber !== TAGS.UTC_TIME && n.tagNumber !== TAGS.GENERALIZED_TIME)) {
       _fail(ctx, ns.prefix + "/bad-time", "time must be UTCTime or GeneralizedTime");
     }
     return asn1.read.time(n);
+  }, function (date) {
+    var y = date.getUTCFullYear();
+    return (y >= 1950 && y < 2050) ? asn1.build.utcTime(date) : asn1.build.generalizedTime(date);
   });
 }
 
@@ -136,6 +146,10 @@ function optional(name, schema, opts) {
   opts = opts || {};
   // How the optional field is recognized at its position:
   //   - default:       a context [tag] (the certificate version [0] shape).
+  //   - tags:          a context tag in the set — an OPTIONAL field whose type is
+  //     itself a CHOICE of several context alternatives, e.g. the CRMF CertReqMsg
+  //     popo ProofOfPossession ([0]..[3]) sitting before the universal-SEQUENCE
+  //     regInfo (RFC 4211 §3), where ANY of the CHOICE's tags marks it present.
   //   - whenUniversal: the next element iff its UNIVERSAL tag is in the set —
   //     the CRL TBSCertList shape (bare INTEGER version, Time nextUpdate,
   //     SEQUENCE revokedCertificates), disambiguated by tag, not a context [n].
@@ -147,7 +161,9 @@ function optional(name, schema, opts) {
     ? function () { return true; }
     : opts.whenUniversal
       ? function (n) { return n.tagClass === "universal" && opts.whenUniversal.indexOf(n.tagNumber) !== -1; }
-      : function (n) { return n.tagClass === "context" && n.tagNumber === opts.tag; };
+      : opts.tags
+        ? function (n) { return n.tagClass === "context" && opts.tags.indexOf(n.tagNumber) !== -1; }
+        : function (n) { return n.tagClass === "context" && n.tagNumber === opts.tag; };
   return { fkind: "optional", name: name, schema: schema, tag: opts.tag, match: match,
            explicit: !!opts.explicit, emptyCode: opts.emptyCode, hasDefault: ("default" in opts), def: opts.default };
 }
@@ -218,7 +234,7 @@ function implicitSeqOf(tag, item, opts) {
  * @primitive  pki.schema.engine.walk
  * @signature  pki.schema.engine.walk(schema, node, ctx) -> value
  * @since      0.1.7
- * @status     experimental
+ * @status     stable
  * @spec       X.690, X.680
  * @related    pki.asn1.decode, pki.schema.x509.parse
  *
@@ -389,6 +405,124 @@ function _consumeTrailing(fld, kids, start, fields, ctx) {
   }
 }
 
+// ---- the encode engine (the inverse of walk) -------------------------
+// encode(schema, value) is the constructor direction of the SAME schema walk
+// decodes: it interprets the schema against a plain structural value and emits
+// canonical DER. A single schema definition therefore drives both directions, so
+// context-tag (EXPLICIT/IMPLICIT) handling cannot diverge between them — the class
+// of bug where a decoder reads a [tag] IMPLICIT field but an ad-hoc encoder emits
+// the wrong tag is structurally retired. Encode errors are authoring faults (a bad
+// value / an un-encodable schema), thrown as plain Errors, not parse verdicts.
+
+function _encFail(message) { throw new Error("schema.encode: " + message); }
+
+/**
+ * @primitive  pki.schema.engine.encode
+ * @signature  pki.schema.engine.encode(schema, value, ctx) -> Buffer
+ * @since      0.1.17
+ * @status     experimental
+ * @spec       X.690, X.680
+ * @related    pki.schema.engine.walk
+ *
+ * Encode a structural value to canonical DER by interpreting the SAME schema
+ * `walk` decodes — the constructor direction. `value` mirrors the schema: a `seq`
+ * takes `{ fieldName: value }`, a leaf its natural JS value (an OID string, a
+ * BigInt, a `{ unusedBits, bytes }` BIT STRING, a `Date`), a `repeat` an array, a
+ * `choice` `{ arm, value }`. EXPLICIT wrappers and IMPLICIT `[tag]` retagging are
+ * applied by the engine, so `walk(schema, decode(encode(schema, v)))` round-trips.
+ *
+ * @example
+ *   var S = pki.schema.engine;
+ *   var der = S.encode(S.seq([S.field("n", S.integerLeaf())]), { n: 42n });
+ */
+function encode(schema, value, ctx) {
+  switch (schema.kind) {
+    case "leaf":     return schema.write(value);
+    case "any":      return Buffer.isBuffer(value) ? value : value.bytes;
+    case "decode":
+      if (typeof schema.write !== "function") _encFail("this decode leaf has no paired encoder (decode(fn, write))");
+      return schema.write(value, ctx);
+    case "seq":      return _encodeSeq(schema, value, ctx);
+    case "explicit": return asn1.build.explicit(schema.tag, encode(schema.schema, value, ctx));
+    case "repeat":   return _encodeRepeat(schema, value, ctx);
+    case "choice":   return _encodeChoice(schema, value, ctx);
+    default:         _encFail("cannot encode schema kind " + JSON.stringify(schema.kind));
+  }
+  return undefined;
+}
+
+function _wrapConstructed(schema, parts) {
+  if (schema.implicitTag != null) return asn1.build.contextConstructed(schema.implicitTag, Buffer.concat(parts));
+  var mode = schema.assert || "sequence";
+  if (mode === "set") return asn1.build.set(parts);
+  // "constructed" is a DECODE-time leniency (accept any constructed shape); the
+  // canonical encoding is a universal SEQUENCE, same as "sequence".
+  if (mode === "sequence" || mode === "constructed") return asn1.build.sequence(parts);
+  _encFail("cannot encode a seq/repeat with assert " + JSON.stringify(mode));
+  return undefined;
+}
+
+function _present(v) { return v !== undefined && v !== null; }
+
+function _encodeSeq(schema, value, ctx) {
+  value = value || {};
+  var parts = [];
+  for (var f = 0; f < schema.fields.length; f++) {
+    var fld = schema.fields[f];
+    if (fld.fkind === "required") {
+      parts.push(encode(fld.schema, value[fld.name], ctx));
+    } else if (fld.fkind === "optional") {
+      if (_present(value[fld.name])) {
+        var enc = encode(fld.schema, value[fld.name], ctx);
+        parts.push(fld.explicit ? asn1.build.explicit(fld.tag, enc) : enc);
+      }
+    } else if (fld.fkind === "trailing") {
+      // Emit present members in strictly-increasing tag order (the walk's rule).
+      var members = fld.members.slice().sort(function (a, b) { return a.tag - b.tag; });
+      for (var i = 0; i < members.length; i++) {
+        var mm = members[i];
+        if (_present(value[mm.name])) {
+          var menc = encode(mm.schema, value[mm.name], ctx);
+          parts.push(mm.explicit ? asn1.build.explicit(mm.tag, menc) : menc);
+        }
+      }
+    }
+  }
+  return _wrapConstructed(schema, parts);
+}
+
+function _encodeRepeat(schema, items, ctx) {
+  if (!Array.isArray(items)) _encFail("a repeat value must be an array");
+  // Enforce the SAME constraints walk enforces, so encode never emits DER its own
+  // decoder rejects (the walk(decode(encode)) invariant): the SIZE minimum, and
+  // semantic uniqueness (the key computed exactly as walk does, off the round-tripped
+  // item — a duplicate is an authoring fault, not a parse verdict).
+  if (schema.min != null && items.length < schema.min) {
+    _encFail("this repeat requires at least " + schema.min + " element(s) but got " + items.length);
+  }
+  var parts = items.map(function (it) { return encode(schema.item, it, ctx); });
+  if (schema.unique) {
+    var seen = new Set();
+    parts.forEach(function (tlv) {
+      var item = { node: asn1.decode(tlv) };
+      item.value = walk(schema.item, item.node, ctx);
+      var key = schema.unique(item);
+      if (seen.has(key)) _encFail("this repeat requires unique elements but got a duplicate key: " + key);
+      seen.add(key);
+    });
+  }
+  if (schema.derSetOrder) parts = parts.slice().sort(Buffer.compare);
+  if (schema.implicitTag != null) return asn1.build.contextConstructed(schema.implicitTag, Buffer.concat(parts));
+  return schema.assert === "set" ? asn1.build.set(parts) : asn1.build.sequence(parts);
+}
+
+function _encodeChoice(schema, value, ctx) {
+  if (!value || typeof value.arm !== "number" || value.arm < 0 || value.arm >= schema.alts.length) {
+    _encFail("a choice value must be { arm: <index>, value: <arm value> }");
+  }
+  return encode(schema.alts[value.arm].schema, value.value, ctx);
+}
+
 module.exports = {
   // structural
   seq: seq, field: field, optional: optional, explicit: explicit, trailing: trailing,
@@ -399,5 +533,5 @@ module.exports = {
   implicitNull: implicitNull, implicitInteger: implicitInteger,
   any: any, decode: decode, time: time,
   // engine
-  walk: walk,
+  walk: walk, encode: encode,
 };

package/lib/schema-ocsp.js

@@ -425,7 +425,7 @@ var OCSP_REQUEST = schema.seq([
  * @primitive  pki.schema.ocsp.parseRequest
  * @signature  pki.schema.ocsp.parseRequest(input) -> ocspRequest
  * @since      0.1.11
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6960
  * @related    pki.schema.ocsp.parseResponse, pki.schema.parse
  *
@@ -447,7 +447,7 @@ var parseRequest = pkix.makeParser({ pemLabel: "OCSP REQUEST", PemError: PemErro
  * @primitive  pki.schema.ocsp.parseResponse
  * @signature  pki.schema.ocsp.parseResponse(input) -> ocspResponse
  * @since      0.1.11
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6960
  * @related    pki.schema.ocsp.parseRequest, pki.schema.parse
  *
@@ -471,7 +471,7 @@ var parseResponse = pkix.makeParser({ pemLabel: "OCSP RESPONSE", PemError: PemEr
  * @primitive  pki.schema.ocsp.pemDecode
  * @signature  pki.schema.ocsp.pemDecode(text, label?) -> Buffer
  * @since      0.1.11
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468, RFC 6960
  * @related    pki.schema.ocsp.parseResponse
  *

package/lib/schema-pkcs8.js

@@ -102,7 +102,7 @@ var ENCRYPTED_PRIVATE_KEY_INFO = schema.seq([
  * @primitive  pki.schema.pkcs8.parse
  * @signature  pki.schema.pkcs8.parse(input) -> privateKey
  * @since      0.1.9
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5208, RFC 5958
  * @related    pki.schema.parse, pki.schema.x509.parse
  *
@@ -124,7 +124,7 @@ var parse = pkix.makeParser({ pemLabel: "PRIVATE KEY", PemError: PemError, Error
  * @primitive  pki.schema.pkcs8.parseEncrypted
  * @signature  pki.schema.pkcs8.parseEncrypted(input) -> encrypted
  * @since      0.1.9
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5958, RFC 5208
  * @related    pki.schema.pkcs8.parse
  *
@@ -143,7 +143,7 @@ var parseEncrypted = pkix.makeParser({ pemLabel: "ENCRYPTED PRIVATE KEY", PemErr
  * @primitive  pki.schema.pkcs8.pemDecode
  * @signature  pki.schema.pkcs8.pemDecode(text, label?) -> Buffer
  * @since      0.1.9
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468, RFC 5958
  * @related    pki.schema.pkcs8.parse
  *
@@ -160,7 +160,7 @@ function pemDecode(text, label) { return pkix.pemDecode(text, label || "PRIVATE
  * @primitive  pki.schema.pkcs8.pemEncode
  * @signature  pki.schema.pkcs8.pemEncode(der, label?) -> string
  * @since      0.1.9
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7468
  * @related    pki.schema.pkcs8.pemDecode
  *

package/lib/schema-pkix.js

@@ -166,6 +166,12 @@ function attrValueToString(ns) {
       }
       return "#" + node.bytes.toString("hex");
     }
+  }, function (value) {
+    // encode: a "#hex" escape (RFC 4514 §2.4) round-trips its raw DER verbatim; any
+    // other string encodes as UTF8String (the decode does not preserve the original
+    // string type, so this is the canonical re-encoding, not a byte-exact one).
+    if (typeof value === "string" && value.charAt(0) === "#") return Buffer.from(value.slice(1), "hex");
+    return asn1.build.utf8(value);
   });
 }
 
@@ -193,25 +199,34 @@ function relativeDistinguishedName(ns) {
   // RelativeDistinguishedName ::= SET SIZE (1..MAX) — an empty SET {} is malformed.
   return schema.setOf(attributeTypeAndValue(ns), { assert: "set", min: 1, code: ns.prefix + "/bad-rdn", what: "RelativeDistinguishedName" });
 }
-function name(ns) {
-  return schema.seqOf(relativeDistinguishedName(ns), {
-    assert: "sequence", code: ns.prefix + "/bad-name", what: "Name",
-    build: function (m) {
-      var rdns = [], parts = [];
-      m.items.forEach(function (rdnItem) {
-        var atvs = [], atvParts = [];
-        rdnItem.value.items.forEach(function (atvItem) {
-          var a = atvItem.value.result; // atvItem.value = the atv seq-match; .result = its build result
-          atvs.push(a);
-          var label = (a.name && DN_SHORT[a.name]) || a.name || a.type;
-          atvParts.push(label + "=" + _escapeDnValue(a.value));
-        });
-        rdns.push(atvs);
-        parts.push(atvParts.join("+"));
+// opts.implicitTag (optional): read the Name as a [tag] IMPLICIT RDNSequence — the
+// context tag REPLACES the universal SEQUENCE tag, so the node is a context-class
+// constructed [tag] whose children ARE the RDN SETs (the CRMF CertTemplate issuer
+// [3] / subject [5] IMPLICIT arm, RFC 4211 §5). With no opts the shape is a bare
+// universal SEQUENCE OF, byte-identical to every existing caller.
+function name(ns, opts) {
+  opts = opts || {};
+  function nameBuild(m) {
+    var rdns = [], parts = [];
+    m.items.forEach(function (rdnItem) {
+      var atvs = [], atvParts = [];
+      rdnItem.value.items.forEach(function (atvItem) {
+        var a = atvItem.value.result; // atvItem.value = the atv seq-match; .result = its build result
+        atvs.push(a);
+        var label = (a.name && DN_SHORT[a.name]) || a.name || a.type;
+        atvParts.push(label + "=" + _escapeDnValue(a.value));
       });
-      return { rdns: rdns, dn: parts.join(", ") };
-    },
-  });
+      rdns.push(atvs);
+      parts.push(atvParts.join("+"));
+    });
+    return { rdns: rdns, dn: parts.join(", ") };
+  }
+  if (opts.implicitTag != null) {
+    return schema.implicitSeqOf(opts.implicitTag, relativeDistinguishedName(ns), {
+      code: ns.prefix + "/bad-name", what: "Name", build: nameBuild });
+  }
+  return schema.seqOf(relativeDistinguishedName(ns), {
+    assert: "sequence", code: ns.prefix + "/bad-name", what: "Name", build: nameBuild });
 }
 
 // GeneralName ::= CHOICE (RFC 5280 §4.2.1.6). A validate-and-surface-raw leaf for a
@@ -623,12 +638,20 @@ function extension(ns) {
     return { oid: extnID, name: ns.oid.name(extnID) || null, critical: critical, value: asn1.read.octetString(valueNode) };
   });
 }
-function extensions(ns) {
-  return schema.seqOf(extension(ns), {
-    assert: "sequence", min: 1, code: ns.prefix + "/bad-extensions", what: "Extensions",
-    unique: function (item) { return item.value.oid; }, dupCode: ns.prefix + "/duplicate-extension",
+// opts.implicitTag (optional): read Extensions as a [tag] IMPLICIT SEQUENCE OF
+// Extension — the context tag REPLACES the universal SEQUENCE tag, for the CRMF
+// CertTemplate extensions [9] (RFC 4211 §5). With no opts the shape is a bare
+// universal SEQUENCE OF, byte-identical to every existing caller.
+function extensions(ns, opts) {
+  opts = opts || {};
+  var EXT = extension(ns);
+  var extOpts = {
+    min: 1, code: ns.prefix + "/bad-extensions", what: "Extensions",
+    unique: function (it) { return it.value.oid; }, dupCode: ns.prefix + "/duplicate-extension",
     build: function (m) { return m.items.map(function (it) { return it.value; }); },
-  });
+  };
+  if (opts.implicitTag != null) return schema.implicitSeqOf(opts.implicitTag, EXT, extOpts);
+  return schema.seqOf(EXT, Object.assign({ assert: "sequence" }, extOpts));
 }
 
 // SubjectPublicKeyInfo ::= SEQUENCE { algorithm AlgorithmIdentifier,
@@ -636,17 +659,26 @@ function extensions(ns) {
 // universal SEQUENCE — a context-tagged or SET-tagged constructed node carrying
 // two well-formed children is NOT a SubjectPublicKeyInfo. Shared by the
 // certificate and CSR parsers.
-function spki(ns) {
+// opts.implicitTag (optional): read the SubjectPublicKeyInfo as a [tag] IMPLICIT
+// SEQUENCE (a context-class constructed node whose children are algorithm +
+// subjectPublicKey), for the CRMF CertTemplate publicKey [6] (RFC 4211 §5). With no
+// opts the shape is a universal SEQUENCE, byte-identical to every existing caller.
+function spki(ns, opts) {
+  opts = opts || {};
   return schema.seq([
     schema.field("algorithm", algorithmIdentifier(ns)),
     schema.field("subjectPublicKey", schema.bitString()),
   ], {
-    assert: "sequence", arity: { exact: 2 }, code: ns.prefix + "/bad-spki", what: "SubjectPublicKeyInfo",
+    assert: opts.implicitTag != null ? "implicit" : "sequence", implicitTag: opts.implicitTag,
+    arity: { exact: 2 }, code: ns.prefix + "/bad-spki", what: "SubjectPublicKeyInfo",
     build: function (m) {
       return {
         algorithm: m.fields.algorithm.value.result,
         publicKey: { unusedBits: m.fields.subjectPublicKey.value.unusedBits, bytes: m.fields.subjectPublicKey.value.bytes },
-        bytes: m.node.bytes,
+        // `bytes` is the importable SubjectPublicKeyInfo DER. In IMPLICIT [tag]
+        // mode the wire node leads with the context tag, so recover the SEQUENCE
+        // encoding a consumer imports / hashes rather than the [tag] wire form.
+        bytes: opts.implicitTag != null ? asn1.sequenceTlv(m.node) : m.node.bytes,
       };
     },
   });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:69692b51-d096-4124-9a0c-886b9a5ad78e",
+  "serialNumber": "urn:uuid:b6db5d53-2a3e-46f9-9187-9c2f6fd9249b",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-06T19:48:47.311Z",
+    "timestamp": "2026-07-07T05:30:55.753Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.1.16",
+      "bom-ref": "@blamejs/pki@0.1.17",
       "type": "application",
       "name": "pki",
-      "version": "0.1.16",
+      "version": "0.1.17",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.1.16",
+      "purl": "pkg:npm/%40blamejs/pki@0.1.17",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.1.16",
+      "ref": "@blamejs/pki@0.1.17",
       "dependsOn": []
     }
   ]