@blamejs/pki 0.2.18 → 0.2.19

package/CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.2.19 — 2026-07-14
+
+The RFC 3161 Time-Stamp Protocol surface is complete: pki.tsp.request and pki.tsp.response build and parse the protocol's request and response messages, and pki.tsp.verify verifies a timestamp token end to end -- the CMS signature, the message imprint, the ESSCertID(V2) certificate binding, the critical timeStamping-only extendedKeyUsage, and full validation of the TSA certificate at the token's own genTime.
+
+### Added
+
+- pki.tsp.request builds an RFC 3161 TimeStampReq around a message imprint, with the optional nonce, requested TSA policy, certReq, and extensions -- canonical DER, the DEFAULT-FALSE certReq omitted unless true -- and pki.tsp.parseRequest parses one (a new TimeStampReq decoder, also exposed as pki.schema.tsp.parseRequest). pki.tsp.response builds a TimeStampResp -- a granted status wrapping the token pki.tsp.sign produces, or a rejection carrying a PKIStatus, status text, and PKIFailureInfo names -- and pki.tsp.parseResponse parses one; the section 2.4.2 status-to-token coupling (a granted response carries a token, any other status must not) is enforced on build and parse alike. These are the byte payloads an RFC 3161 transport carries, completing the protocol message surface around pki.tsp.sign and pki.schema.tsp.parseToken.
+- pki.tsp.verify(token, data, opts) verifies a timestamp token and returns a verdict carrying the verified genTime, serial number, and TSTInfo fields. It checks the CMS signature over the exact signed bytes, recomputes the message imprint from the supplied data (or compares a precomputed imprint), requires the encapsulated content be a TSTInfo, binds the token to the TSA certificate by recomputing the ESSCertID(V2) certificate hash (RFC 5816) and matching its issuerSerial when present, and enforces RFC 3161 section 2.3 on the TSA certificate: its extendedKeyUsage must be present, critical, and contain exactly id-kp-timeStamping, and -- when the certificate asserts a keyUsage -- that keyUsage must permit signing, so a certificate not issued for timestamping cannot mint a trusted token. When a trust anchor is supplied, the TSA certificate chain -- ordered from the token's embedded certificates, so a TSA under an intermediate CA validates -- receives full certification-path validation at the token's genTime, including optional revocation; when the request carried a nonce, the token must echo it. Every checked field is read from the verified encapsulated content, never a caller-supplied parsed object; a well-formed token failing any check is a fail-closed { valid: false } verdict with a stable reason code.
+
+### Fixed
+
+- CMS signer-certificate lookup now matches the certificate's issuer name in addition to its serial number when a signer is identified by issuerAndSerialNumber (RFC 5652); the issuer comparison was previously inert, so a signer was located by serial number alone. The verification verdict is unchanged -- the signature check remains the authority -- but the correct signer certificate is now selected precisely.
+- Malformed input to several verifiers now fails closed with a typed pki.errors.PkiError instead of a raw TypeError: a signer or issuer distinguished name carrying an embedded control byte (the RFC 5280 section 7.1 name comparison, CVE-2009-2408) and oversized or malformed JSON are rejected with a domain error code across pki.cms.verify, pki.tsp.verify, pki.jose, pki.sigstore, and pki.webcrypto key import.
+
 ## v0.2.18 — 2026-07-14
 
 Composite ML-DSA signatures join CMS SignedData: pki.cms.sign and pki.cms.verify now produce and verify a composite SignerInfo -- a post-quantum ML-DSA paired with a traditional RSA, ECDSA, or EdDSA -- accepted only when BOTH components verify.

package/README.md

@@ -209,7 +209,7 @@ is callable today; nothing below is a stub.
 | `pki.schema.pkcs8` | Parse DER / PEM PKCS#8 private keys per RFC 5208 / 5958 — algorithm, raw key bytes, attributes, optional public key, fail-closed; encrypted keys recognized (not decrypted) — `parse`, `parseEncrypted`, `pemDecode`, `pemEncode` |
 | `pki.schema.cms` | Parse DER / PEM CMS per RFC 5652 / 5083 / 9629 — SignedData (§5, signer infos + raw signed-attribute bytes for external verification), EnvelopedData (§6, all five RecipientInfo kinds incl. RFC 5753 key-agreement and RFC 9629 KEM recipients with ML-KEM validation), EncryptedData (§8), AuthenticatedData (§9, MAC surface + raw `authAttrsBytes`), and AuthEnvelopedData (RFC 5083, with RFC 5084 AES-GCM/CCM parameter validation); §11 attribute placement enforced, countersignatures validated recursively, certificates / CRLs validated against the closed CHOICE sets and kept raw, every result tagged `contentTypeName`, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.ocsp` | Parse DER / PEM OCSP requests and responses per RFC 6960 — per-certificate status (good / revoked / unknown), responder identity, raw tbs bytes for external verification, certificates kept raw, fail-closed; non-basic response types recognized (not decoded) — `parseRequest`, `parseResponse`, `pemDecode`, `pemEncode` |
-| `pki.schema.tsp` | Parse DER / PEM RFC 3161 timestamp responses and tokens — the TSTInfo payload (imprint, genTime with sub-second precision, serial, nonce, accuracy), the status-to-token coupling, and the token wrapper composed over CMS with the single-signer rule, fail-closed — `parse`, `parseTstInfo`, `parseToken`, `pemDecode`, `pemEncode` |
+| `pki.schema.tsp` | Parse DER / PEM RFC 3161 timestamp requests, responses, and tokens — the TimeStampReq a client sends (imprint, requested policy, nonce, certReq), the TSTInfo payload (imprint, genTime with sub-second precision, serial, nonce, accuracy), the status-to-token coupling, and the token wrapper composed over CMS with the single-signer rule, fail-closed — `parse`, `parseRequest`, `parseResponse`, `parseTstInfo`, `parseToken`, `pemDecode`, `pemEncode` |
 | `pki.schema.attrcert` | Parse DER / PEM RFC 5755 attribute certificates — the holder and issuer identities (validated GeneralNames), the validity window (real `Date`s), the privilege attributes (role / group / clearance) and extensions, with the raw signed region for a verifier; the obsolete v1 form is recognized and deferred, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.crmf` | Parse DER / PEM RFC 4211 certificate request messages (CertReqMessages — the CMP / EST enrollment body) — the requested-certificate template (subject, public key, validity, extensions), proof-of-possession, and registration controls, with the raw `CertRequest` region a POP verifier hashes; names dual-accepted (IMPLICIT and EXPLICIT), fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.pkcs12` | Parse DER / BER / PEM RFC 7292 PKCS#12 (PFX) stores — key bags via the PKCS#8 parser, shrouded keys (algorithm surfaced, ciphertext opaque), cert / CRL / secret bags raw and byte-exact, encrypted and enveloped safes structurally via CMS, `friendlyName` / `localKeyId` decoded, and the exact MAC byte range (`macedBytes`) plus RFC 9579 PBMAC1 recognition for external verification; BER accepted exactly where §4.1 requires it, fail-closed — `parse`, `pemDecode`, `pemEncode` |
@@ -222,7 +222,7 @@ is callable today; nothing below is a stub.
 | `pki.schema.engine` | The declarative ASN.1 structure-schema engine every format parser composes — `walk` / `encode` / `embeddedDer` plus the schema combinators |
 | `pki.path` | RFC 5280 §6 certification-path validation — `validate` runs the §6.1 state machine (signature chaining across RSA, ECDSA, EdDSA, ML-DSA, SLH-DSA and hybrid composite ML-DSA signatures — a composite is accepted only when **both** its post-quantum and traditional components verify; validity windows, name chaining, basic constraints and path length, key usage, name constraints, the certificate-policy tree) over an ordered path and a trust anchor, returning a structured verdict with per-check reason codes, and enforces a `pki.trust` anchor's per-purpose distrust-after dates and delegator purposes via `checkPurpose`; `crlChecker` supplies CRL-based revocation — including partitioned/sharded CRLs, whose §6.3.3 Distribution Point ↔ IDP correspondence lets a corresponding full-reason shard establish non-revocation — and `ocspChecker` supplies OCSP-based revocation (RFC 6960 — CertID binding, responder authorization, signature, currency) over the same pluggable hook. Pure and re-entrant, fail-closed — `validate`, `crlChecker`, `ocspChecker` |
 | `pki.cms` | RFC 5652 §5 CMS SignedData signing + signature verification — `sign(content, signers, opts)` produces a SignedData (attached or detached, one or many signers, RSA / RSASSA-PSS / ECDSA / EdDSA, the post-quantum ML-DSA-44/65/87 (RFC 9882) and SLH-DSA (all twelve FIPS 205 sets, RFC 9814), and composite ML-DSA (pairing ML-DSA with a traditional RSA / ECDSA / EdDSA — accepted only when **both** components verify — draft-ietf-lamps-cms-composite-sigs)); it builds the signed attributes (content-type, message-digest, signing-time) as canonical DER, signs the exact §5.4 preimage, and emits a DER `Buffer` or PEM. `verify(input, opts)` parses a SignedData over the strict `pki.schema.cms` codec, locates each SignerInfo's signer certificate by its issuerAndSerialNumber or subjectKeyIdentifier, and checks the signature over the exact §5.4 preimage: when signed attributes are present it confirms the message-digest attribute equals the content digest and verifies over the DER re-encoding of the SignedAttributes (the on-wire `[0]` tag replaced by a universal SET OF), otherwise directly over the content. It returns a per-signer verdict with the matched signer certificate; it does not chain that certificate to a trust anchor — that is the caller's step through `pki.path.validate`. Fail-closed with typed `cms/*` errors — `sign`, `verify` |
-| `pki.tsp` | RFC 3161 timestamp token creation — `sign(messageImprint, tsa, opts)` produces a TimeStampToken: a CMS SignedData (over `pki.cms.sign`) whose content is a `TSTInfo` carrying the timestamped message imprint, the TSA policy, a serial number, and `genTime` (with optional accuracy / nonce / ordering), plus the RFC 3161 §2.4.2 signing-certificate attribute binding the token to the TSA certificate. The producing side of `pki.schema.tsp.parseToken`; SHA-2 imprints, and any `pki.cms.sign` TSA key — `sign` |
+| `pki.tsp` | RFC 3161 Time-Stamp Protocol — `sign(messageImprint, tsa, opts)` produces a TimeStampToken: a CMS SignedData (over `pki.cms.sign`) whose content is a `TSTInfo` carrying the timestamped message imprint, the TSA policy, a serial number, and `genTime` (with optional accuracy / nonce / ordering), plus the RFC 3161 §2.4.2 signing-certificate attribute binding the token to the TSA certificate (SHA-2 imprints, any `pki.cms.sign` TSA key). `request` / `parseRequest` build and parse the TimeStampReq a client sends (imprint, requested policy, nonce, certReq), `response` / `parseResponse` the TimeStampResp a TSA returns — a granted status wrapping a token, or a rejection with PKIStatus and failure info, the §2.4.2 status↔token coupling enforced in both directions. `verify(token, data, opts)` verifies a token fail-closed: the CMS signature over the exact signed bytes, the message imprint recomputed from the data, the TSTInfo content type, the ESSCertID(V2) binding to the TSA certificate, the §2.3 critical timeStamping-only extendedKeyUsage, the request nonce when used, and — with a trust anchor supplied — full certification-path validation of the TSA certificate at the token's `genTime`, returning `{ valid, genTime, serialNumber, tstInfo, … }` — `sign`, `request`, `parseRequest`, `response`, `parseResponse`, `verify` |
 | `pki.ct` | RFC 6962 Certificate Transparency SCTs — `parseSctList` decodes the `SignedCertificateTimestampList` a certificate or OCSP response carries in the SCT extension (a TLS-presentation-language payload inside the §3.3 double DER wrap) into per-SCT log id, exact `timestamp` (BigInt), named signature algorithm, and raw signature; `reconstructSignedData` rebuilds the exact `digitally-signed` preimage; `verifySct` verifies an SCT signature against a log's public key by reconstructing the signed data, routing an ECDSA signature through the strict DER-conformance gate, and verifying through the crypto engine — resolving true or false, and throwing a typed error on a structural fault. Structure decoded, crypto fail-closed — `parseSctList`, `reconstructSignedData`, `verifySct` |
 | `pki.merkle` | RFC 6962 / RFC 9162 Merkle-tree proof verification — `leafHash` / `nodeHash` / `emptyRootHash` build the domain-separated (0x00 leaf / 0x01 node) SHA-256 tree hashes; `verifyInclusion` folds an audit proof back to a root and `verifyConsistency` reconstructs both the old and new root (the append-only guarantee), each constant-time-compared to a trusted checkpoint root. Fail-closed on bad geometry, sync hashing, transport-free — `leafHash`, `nodeHash`, `emptyRootHash`, `verifyInclusion`, `verifyConsistency` |
 | `pki.trust` | Mozilla / CCADB trust-store ingestion — `parseCertdata` reads the NSS `certdata.txt` object stream and `parseCcadbCsv` the CCADB CSV export into one identical constraint-carrying anchor shape: the per-purpose trust bits (only `CKT_NSS_TRUSTED_DELEGATOR` grants) and the per-purpose distrust-after dates the bare root list omits. Certificate and trust objects pair by byte-exact issuer + serial (never adjacency) and are cross-checked against the parsed DER, so metadata can never attach to the wrong root; `anchor()` hands an entry to `pki.path.validate({ trustAnchor, checkPurpose })`. Offline, fail-closed, bounded — `parseCertdata`, `parseCcadbCsv`, `anchor` |
@@ -343,7 +343,7 @@ SCTs), `pki.hpke` (RFC 9180), `pki.shbs` (HSS/LMS stateful hash signatures),
 `pki.merkle` (RFC 9162 transparency proofs), `pki.sigstore` (offline npm-provenance
 verification), `pki.webauthn` (WebAuthn / passkey attestation verification),
 `pki.cms` (RFC 5652 SignedData signing + signature verification), `pki.tsp` (RFC 3161
-timestamp token creation), and the
+timestamping — requests, responses, token creation and verification), and the
 `jose` / `acme` / `est` enrollment surfaces. Each composes
 the shared structure, foundation, and crypto layers directly. Alongside the schema
 engine, the fail-closed **guard family** (`guard-*`) centralizes each CVE-class

package/lib/cms-verify.js

@@ -120,7 +120,7 @@ function _findSignerCerts(sid, parsedCerts) {
     if (sid.subjectKeyIdentifier != null) {
       if (c.ski && c.ski.equals(_toBuf(sid.subjectKeyIdentifier, "sid.subjectKeyIdentifier"))) out.push(c);
     } else if (sid.issuer && sid.serialNumberHex != null) {
-      if (c.cert.serialNumberHex === sid.serialNumberHex && guard.name.dnEqual(c.cert.issuer, sid.issuer, CmsError, "cms/bad-name")) out.push(c);
+      if (c.cert.serialNumberHex === sid.serialNumberHex && guard.name.dnEqual(c.cert.issuer.rdns, sid.issuer.rdns, _err, "cms/bad-name", "the signer certificate issuer")) out.push(c);
     }
   }
   return out;

package/lib/jose.js

@@ -117,7 +117,7 @@ function parseJson(input) {
   // The strict bounded reader (byte + depth caps, duplicate-member reject at every
   // depth, __proto__-safe own-property assignment, fatal UTF-8, RFC 8259 grammar)
   // lives once in the shared JSON guard; the frozen jose/* codes are threaded through.
-  return guard.json.parse(input, JoseError, {
+  return guard.json.parse(input, E, {
     maxBytes: LIMITS.JSON_MAX_BYTES, maxDepth: LIMITS.JSON_MAX_DEPTH,
     badJson: "jose/bad-json", tooDeep: "jose/too-deep", duplicateMember: "jose/duplicate-member",
     tooLarge: "jose/too-large", badInput: "jose/bad-input", label: "the JSON document",

package/lib/schema-all.js

@@ -301,7 +301,7 @@ module.exports = {
   pkcs12: { parse: pkcs12.parse, pemDecode: pkcs12.pemDecode, pemEncode: pkcs12.pemEncode },
   cms:  { parse: cms.parse, pemDecode: cms.pemDecode, pemEncode: cms.pemEncode },
   ocsp: { parseRequest: ocsp.parseRequest, parseResponse: ocsp.parseResponse, pemDecode: ocsp.pemDecode, pemEncode: ocsp.pemEncode },
-  tsp: { parse: tsp.parse, parseTstInfo: tsp.parseTstInfo, parseToken: tsp.parseToken, pemDecode: tsp.pemDecode, pemEncode: tsp.pemEncode },
+  tsp: { parse: tsp.parse, parseResponse: tsp.parseResponse, parseRequest: tsp.parseRequest, parseTstInfo: tsp.parseTstInfo, parseToken: tsp.parseToken, pemDecode: tsp.pemDecode, pemEncode: tsp.pemEncode },
   crmf: { parse: crmf.parse, pemDecode: crmf.pemDecode, pemEncode: crmf.pemEncode },
   cmp: { parse: cmp.parse, pemDecode: cmp.pemDecode, pemEncode: cmp.pemEncode },
   csrattrs: { parse: csrattrs.parse },

package/lib/schema-tsp.js

@@ -272,6 +272,64 @@ var TIME_STAMP_RESP = schema.seq([
   },
 });
 
+// ---- TimeStampReq ----------------------------------------------------
+
+// TimeStampReq ::= SEQUENCE { version INTEGER { v1(1) }, messageImprint MessageImprint,
+// reqPolicy TSAPolicyId OPTIONAL, nonce INTEGER OPTIONAL, certReq BOOLEAN DEFAULT FALSE,
+// extensions [0] IMPLICIT Extensions OPTIONAL } (RFC 3161 sec. 2.4.1). version + messageImprint
+// are mandatory; the three optionals are consumed by universal tag (OID / INTEGER / BOOLEAN),
+// then the [0] extensions. certReq DEFAULT FALSE follows the TSTInfo.ordering explicit-FALSE rule.
+var TIME_STAMP_REQ = schema.seq([
+  schema.field("version", VERSION),
+  schema.field("messageImprint", MESSAGE_IMPRINT),
+  schema.optional("reqPolicy", schema.oidLeaf(), { whenUniversal: [TAGS.OBJECT_IDENTIFIER] }),
+  schema.optional("nonce", schema.integerLeaf(), { whenUniversal: [TAGS.INTEGER] }),
+  schema.optional("certReq", schema.boolean(), { whenUniversal: [TAGS.BOOLEAN] }),
+  schema.trailing([
+    { tag: 0, name: "extensions", schema: schema.implicitSeqOf(0, EXTENSION, { min: 1, unique: function (it) { return it.value.oid; }, dupCode: "tsp/duplicate-extension", code: "tsp/bad-extensions", what: "extensions" }) },
+  ], { minTag: 0, maxTag: 0, unexpectedCode: "tsp/bad-request", orderCode: "tsp/bad-request" }),
+], {
+  assert: "sequence", code: "tsp/bad-request", what: "TimeStampReq",
+  build: function (m, ctx) {
+    // certReq BOOLEAN DEFAULT FALSE -- an explicit FALSE must be omitted under DER.
+    if (m.fields.certReq.present && m.fields.certReq.value === false) {
+      throw NS.E("tsp/bad-request", "certReq is BOOLEAN DEFAULT FALSE -- an explicit FALSE must be omitted (DER)");
+    }
+    var reqPolicy = m.fields.reqPolicy.present ? m.fields.reqPolicy.value : null;
+    return {
+      version: m.fields.version.value,
+      messageImprint: m.fields.messageImprint.value.result,
+      reqPolicy: reqPolicy,
+      reqPolicyName: reqPolicy ? (ctx.oid.name(reqPolicy) || null) : null,
+      nonce: m.fields.nonce.present ? m.fields.nonce.value : null,
+      nonceHex: m.fields.nonce.present ? m.fields.nonce.node.content.toString("hex") : null,
+      certReq: m.fields.certReq.present ? m.fields.certReq.value : false,
+      extensions: m.fields.extensions.present ? m.fields.extensions.value.items.map(function (it) { return it.value; }) : null,
+    };
+  },
+});
+
+/**
+ * @primitive  pki.schema.tsp.parseRequest
+ * @signature  pki.schema.tsp.parseRequest(input) -> timeStampReq
+ * @since      0.2.19
+ * @status     experimental
+ * @spec       RFC 3161
+ * @related    pki.schema.tsp.parse, pki.tsp.request
+ *
+ * Parse a DER `Buffer` or PEM string into a `TimeStampReq` (RFC 3161 sec. 2.4.1):
+ * `{ version, messageImprint, reqPolicy, reqPolicyName, nonce, nonceHex, certReq, extensions }`.
+ * `version` MUST be 1; `certReq` is BOOLEAN DEFAULT FALSE (an explicit FALSE is non-DER and
+ * rejected `tsp/bad-request`); `nonce` is lossless (BigInt + hex); `messageImprint.hashedMessage`
+ * is the raw digest. A malformed structure throws a typed `TspError`.
+ *
+ * @example
+ *   var req = pki.schema.tsp.parseRequest(der);
+ *   req.certReq;                        // -> boolean
+ *   req.messageImprint.hashedMessage;   // -> Buffer (the raw digest)
+ */
+var parseRequest = pkix.makeParser({ pemLabel: null, PemError: PemError, ErrorClass: TspError, prefix: "tsp", what: "TimeStampReq", topSchema: TIME_STAMP_REQ, ns: NS });
+
 /**
  * @primitive  pki.schema.tsp.parseTstInfo
  * @signature  pki.schema.tsp.parseTstInfo(input) -> tstInfo
@@ -410,6 +468,13 @@ function parseToken(input) {
  * @example
  *   var der = pki.schema.tsp.pemDecode(pemText);
  */
+// Decode a raw GeneralName TLV (the tsa field and the ESS issuerSerial issuer are surfaced raw) into
+// { tagClass, tagNumber, value } -- for a directoryName [4] the value is a decoded Name { rdns },
+// so a verifier canonically compares it (guard.name.dnEqual) rather than by raw bytes. @internal.
+function decodeGeneralName(bytes) {
+  return schema.embeddedDer(pkix.generalName(NS, { decodeValue: true, code: "tsp/bad-tsa" }), bytes, NS, { code: "tsp/bad-tsa", what: "GeneralName" });
+}
+
 function pemDecode(text, label) { return pkix.pemDecode(text, label || null, PemError); }
 
 /**
@@ -445,6 +510,9 @@ function matches(root) {
 
 module.exports = {
   parse: parse,
+  parseResponse: parse,   // TimeStampResp parsing == parse; named for symmetry with parseRequest
+  parseRequest: parseRequest,
+  decodeGeneralName: decodeGeneralName,   // @internal -- the verifier's tsa / issuerSerial DN decode
   parseTstInfo: parseTstInfo,
   parseToken: parseToken,
   pemDecode: pemDecode,

package/lib/sigstore.js

@@ -47,7 +47,7 @@ var NOTE_SIG = new RegExp("^" + String.fromCharCode(0x2014) + " (\\S+) (\\S+)$")
 
 // Parse untrusted JSON through the bounded, duplicate-member-rejecting guard.
 function _jsonParse(input, code, label) {
-  return guard.json.parse(input, SigstoreError, {
+  return guard.json.parse(input, _err, {
     maxBytes: JSON_MAX, maxDepth: 64,
     badJson: code, tooDeep: code, duplicateMember: code, tooLarge: code, badInput: code, label: label,
   });

package/lib/tsp-sign.js

@@ -18,6 +18,13 @@ var nodeCrypto = require("crypto");
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
 var cmsSign = require("./cms-sign");
+var cmsVerify = require("./cms-verify");
+var pathValidate = require("./path-validate");
+var pkiX509 = require("./schema-x509");
+var smime = require("./schema-smime");
+var schemaTsp = require("./schema-tsp");
+var schema = require("./schema-engine");
+var guard = require("./guard-all");
 var frameworkError = require("./framework-error");
 
 var TspError = frameworkError.TspError;
@@ -158,4 +165,519 @@ function _subMilliBytes(n, label) {
 // Coverage residual -- `_hashAlgId`'s unsupported-hash throw is unreachable through the shipped
 // path: both callers (the messageImprint hash and the ESSCertIDv2 certHashAlgorithm) validate
 // the name against NODE_DIGEST before `_hashAlgId` runs, so the guard is belt-and-suspenders.
-module.exports = { sign: sign };
+
+// PKIFailureInfo name -> NamedBitList bit index (RFC 3161 sec. 2.4.2; the reverse of the
+// schema-tsp FAILURE_BITS decode map). Build maps names -> bits; an unknown name fails closed.
+var FAILINFO_BIT = { badAlg: 0, badRequest: 2, badDataFormat: 5, timeNotAvailable: 14, unacceptedPolicy: 15, unacceptedExtension: 16, addInfoNotAvailable: 17, systemFailure: 25 };
+
+// Encode a PKIFailureInfo as a minimal DER NamedBitList BIT STRING from a set of names: set each
+// named bit (bit 0 = MSB of byte 0), strip trailing zero octets, and place unusedBits exactly
+// below the lowest set bit (X.690 sec. 11.2.2).
+function _failInfoBits(names) {
+  if (!Array.isArray(names)) throw _err("tsp/bad-input", "failInfo must be an array of PKIFailureInfo names");
+  var idxs = names.map(function (n) {
+    var i = FAILINFO_BIT[n];
+    if (i == null) throw _err("tsp/bad-input", "unknown PKIFailureInfo name " + JSON.stringify(n) + " (RFC 3161 sec. 2.4.2)");
+    return i;
+  });
+  if (!idxs.length) return b.bitString(Buffer.alloc(0), 0);          // no bits -> empty BIT STRING
+  // buf is sized to the highest set bit, so its last octet always carries that bit (non-zero) --
+  // there is never a trailing zero octet to strip; only the trailing zero BITS of the last octet
+  // are removed, via the DER unusedBits count (X.690 sec. 11.2.2).
+  var buf = Buffer.alloc((Math.max.apply(null, idxs) >> 3) + 1);
+  idxs.forEach(function (i) { buf[i >> 3] |= 0x80 >> (i & 7); });
+  var unused = 0, last = buf[buf.length - 1];
+  while (unused < 7 && ((last >> unused) & 1) === 0) unused++;       // unusedBits below the lowest set bit
+  return b.bitString(buf, unused);
+}
+
+// Coerce a timeStampToken (a CMS ContentInfo the token producer emits) to DER for embedding in a
+// TimeStampResp -- a DER Buffer as-is, a Uint8Array copied, or a PEM string de-armored.
+function _tokenDer(t) {
+  if (Buffer.isBuffer(t) && t[0] === 0x30) return t;
+  if (t instanceof Uint8Array && !Buffer.isBuffer(t)) { var u = Buffer.from(t); if (u[0] === 0x30) return u; }
+  if (typeof t === "string") return schemaTsp.pemDecode(t);
+  throw _err("tsp/bad-input", "the timeStampToken must be a DER Buffer or a PEM string");
+}
+
+function _assertImprint(mi) {
+  if (!mi.hashAlgorithm || !NODE_DIGEST[mi.hashAlgorithm]) throw _err("tsp/unsupported-algorithm", "messageImprint.hashAlgorithm must be a supported hash name");
+  if (!Buffer.isBuffer(mi.hashedMessage) && !(mi.hashedMessage instanceof Uint8Array)) throw _err("tsp/bad-input", "messageImprint.hashedMessage must be a Buffer");
+  if (mi.hashedMessage.length !== HASH_LEN[mi.hashAlgorithm]) throw _err("tsp/bad-input", "messageImprint.hashedMessage length (" + mi.hashedMessage.length + ") does not match the " + mi.hashAlgorithm + " digest length (" + HASH_LEN[mi.hashAlgorithm] + ")");
+}
+
+/**
+ * @primitive  pki.tsp.request
+ * @signature  pki.tsp.request(messageImprint, opts) -> Buffer|string
+ * @since      0.2.19
+ * @status     experimental
+ * @spec       RFC 3161
+ * @related    pki.tsp.parseRequest, pki.tsp.sign
+ *
+ * Build an RFC 3161 `TimeStampReq` (sec. 2.4.1) over `messageImprint`
+ * (`{ hashAlgorithm, hashedMessage }` -- the same shape `pki.tsp.sign` takes). `version` is 1;
+ * `certReq` is BOOLEAN DEFAULT FALSE, so it is emitted only when explicitly `true`. Returns DER
+ * (or PEM when `opts.pem`).
+ *
+ * @opts  reqPolicy   The requested TSA policy (an OID name or dotted string).
+ * @opts  nonce       A large random nonce (number/BigInt) the client checks the token echoes.
+ * @opts  certReq     Whether the TSA should include its certificate in the token (boolean).
+ * @opts  extensions  An array of encoded Extension DER buffers ([0] IMPLICIT Extensions).
+ * @opts  pem         Return a PEM "TIMESTAMP REQUEST" string instead of DER (boolean).
+ * @example
+ *   var req = pki.tsp.request({ hashAlgorithm: "sha256", hashedMessage: sha256Digest }, { nonce: 0x0102030405060708n, certReq: true });
+ */
+function request(messageImprint, opts) {
+  opts = opts || {};
+  if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("tsp/bad-input", "pki.tsp.request options must be an object");
+  var mi = messageImprint || {};
+  _assertImprint(mi);
+  var imprint = b.sequence([_hashAlgId(mi.hashAlgorithm), b.octetString(Buffer.from(mi.hashedMessage))]);
+  // TimeStampReq: version(1), messageImprint, then OPTIONAL reqPolicy / nonce / certReq /
+  // extensions in schema order. certReq DEFAULT FALSE -> only an explicit TRUE is encoded (DER).
+  var fields = [b.integer(1n), imprint];
+  if (opts.reqPolicy != null) fields.push(_policy(opts.reqPolicy));
+  if (opts.nonce != null) fields.push(b.integer(BigInt(opts.nonce)));
+  if (opts.certReq != null && typeof opts.certReq !== "boolean") throw _err("tsp/bad-input", "certReq must be a boolean");
+  if (opts.certReq === true) fields.push(b.boolean(true));
+  if (opts.extensions != null) {
+    if (!Array.isArray(opts.extensions) || !opts.extensions.every(function (e) { return Buffer.isBuffer(e) || e instanceof Uint8Array; })) throw _err("tsp/bad-input", "extensions must be an array of encoded Extension DER buffers");
+    if (opts.extensions.length) fields.push(b.contextConstructed(0, Buffer.concat(opts.extensions.map(function (e) { return Buffer.from(e); }))));
+  }
+  var der = b.sequence(fields);
+  return opts.pem ? schemaTsp.pemEncode(der, "TIMESTAMP REQUEST") : der;
+}
+
+/**
+ * @primitive  pki.tsp.parseRequest
+ * @signature  pki.tsp.parseRequest(input) -> timeStampReq
+ * @since      0.2.19
+ * @status     experimental
+ * @spec       RFC 3161
+ * @related    pki.tsp.request, pki.schema.tsp.parseRequest
+ *
+ * Parse a `TimeStampReq` (DER `Buffer` or PEM) -- the `pki.schema.tsp.parseRequest` decoder on the
+ * `pki.tsp` namespace. Returns `{ version, messageImprint, reqPolicy, reqPolicyName, nonce,
+ * nonceHex, certReq, extensions }`; a malformed structure throws a typed `TspError`.
+ *
+ * @example
+ *   var req = pki.tsp.parseRequest(der);
+ *   req.certReq;   // -> boolean
+ */
+function parseRequest(input) { return schemaTsp.parseRequest(input); }
+
+/**
+ * @primitive  pki.tsp.response
+ * @signature  pki.tsp.response(token, opts) -> Buffer|string
+ * @since      0.2.19
+ * @status     experimental
+ * @spec       RFC 3161
+ * @related    pki.tsp.parseResponse, pki.tsp.sign
+ *
+ * Build an RFC 3161 `TimeStampResp` (sec. 2.4.2): a `PKIStatusInfo` and, on success, the
+ * `timeStampToken`. Pass a `token` (the CMS ContentInfo `pki.tsp.sign` produces) with the default
+ * granted status, or build a rejection with `response(null, { status, failInfo, statusString })`.
+ * The status-to-token coupling is enforced (granted 0/1 carries a token, any other status must not),
+ * mirroring the parse-side gate. Returns DER (or PEM when `opts.pem`).
+ *
+ * @opts  status        PKIStatus 0..5 (default 0 granted). granted(0)/grantedWithMods(1) carry a token.
+ * @opts  failInfo      Array of PKIFailureInfo names (only on rejection(2)): e.g. ["badAlg"].
+ * @opts  statusString  Human-readable PKIFreeText (string or array of strings).
+ * @opts  pem           Return a PEM "TIMESTAMP RESPONSE" string instead of DER (boolean).
+ * @example
+ *   var resp = pki.tsp.response(token, {});                                  // granted
+ *   var rej  = pki.tsp.response(null, { status: 2, failInfo: ["badAlg"] });  // rejection
+ */
+function response(token, opts) {
+  opts = opts || {};
+  if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("tsp/bad-input", "pki.tsp.response options must be an object");
+  var status = opts.status == null ? 0 : Number(opts.status);
+  if (!Number.isInteger(status) || status < 0 || status > 5) throw _err("tsp/bad-input", "PKIStatus must be an integer in 0..5 (RFC 3161 sec. 2.4.2)");
+  var granted = status === 0 || status === 1;
+  if (granted && token == null) throw _err("tsp/missing-token", "a granted TimeStampResp requires a timeStampToken (RFC 3161 sec. 2.4.2)");
+  if (!granted && token != null) throw _err("tsp/unexpected-token", "a non-granted TimeStampResp must not carry a timeStampToken (RFC 3161 sec. 2.4.2)");
+  var siFields = [b.integer(BigInt(status))];
+  if (opts.statusString != null) {
+    var texts = Array.isArray(opts.statusString) ? opts.statusString : [opts.statusString];
+    // PKIFreeText is SEQUENCE SIZE (1..MAX) OF UTF8String -- an empty statusString would build an
+    // empty SEQUENCE the parser (seqOf min:1) rejects, so reject it at the builder instead.
+    if (!texts.length) throw _err("tsp/bad-input", "statusString must carry at least one PKIFreeText element (RFC 4210 SEQUENCE SIZE 1..MAX)");
+    siFields.push(b.sequence(texts.map(function (t) { return b.utf8(String(t)); })));
+  }
+  if (opts.failInfo != null) {
+    if (status !== 2) throw _err("tsp/unexpected-failinfo", "failInfo is present only when the status is rejection(2) (RFC 3161 sec. 2.4.2)");
+    siFields.push(_failInfoBits(opts.failInfo));
+  }
+  var respFields = [b.sequence(siFields)];
+  if (token != null) respFields.push(b.raw(_tokenDer(token)));
+  var der = b.sequence(respFields);
+  return opts.pem ? schemaTsp.pemEncode(der, "TIMESTAMP RESPONSE") : der;
+}
+
+/**
+ * @primitive  pki.tsp.parseResponse
+ * @signature  pki.tsp.parseResponse(input) -> timeStampResp
+ * @since      0.2.19
+ * @status     experimental
+ * @spec       RFC 3161
+ * @related    pki.tsp.response, pki.schema.tsp.parse
+ *
+ * Parse a `TimeStampResp` (DER `Buffer` or PEM) -- the shipped `pki.schema.tsp.parse` decoder on
+ * the `pki.tsp` namespace. Returns `{ status, statusString, failInfo, timeStampToken }` with the
+ * status-to-token coupling enforced; a granted response's token is decoded via `parseToken`.
+ *
+ * @example
+ *   var resp = pki.tsp.parseResponse(der);
+ *   resp.timeStampToken.tstInfo.genTime;   // -> Date (on a granted response)
+ */
+function parseResponse(input) { return schemaTsp.parse(input); }
+
+// Coverage residual -- the null-guards and decode/parse catches in the verify helpers below are
+// belt-and-suspenders on values already guaranteed upstream, so their failure arms are unreachable
+// through the shipped path: parseToken has already proven the token is a single-signer SignedData
+// carrying a signing-certificate attribute, so `signerInfo`/`signedAttrs`/the signing-cert attr are
+// present; cms.verify returns a parsed, matched signer certificate, so `tsaCertDer` is set and
+// re-parsing it (or decoding its extensions) cannot fail here; decodeAttribute yields at least one
+// ESSCertID (an empty SEQUENCE OF is rejected at decode -> the `!essCert` guard is defensive); and
+// path.validate returns a fail-closed verdict for a bad anchor rather than throwing, so its catch
+// is defensive. Likewise, in the out-of-path chain step, `parsed.certificates` is always an array
+// (empty when absent), the embedded certs the chain walk parses are the X.509 (universal) choices,
+// and guard.name.dnEqual's control-byte reject is defensive on a cert x509.parse already accepted --
+// so the `|| []`, the non-universal filter arm, and that throw are unreachable through the shipped
+// path. In the tsa-hint check, the tsa GeneralName's decode catch is likewise defensive: parseToken
+// eager-decodes the token, so a constructed GeneralName that would fail decodeGeneralName has already
+// failed there, and a primitive one decodes -- the catch only guards decodeGeneralName's standalone
+// use and yields the same safe no-match. A malformed ESS value, a malformed EKU/keyUsage extnValue,
+// and a malformed subjectAltName ARE reachable (a signed-but-broken cert/attribute) and ARE covered;
+// the reachable verdicts (unsupported hash, EKU shape/wrapper, keyUsage, imprint/nonce/policy/binding
+// mismatch, tsa-hint match + mismatch, unknown critical extension, untrusted TSA, embedded-chain
+// ordering) are each driven by a RED conformance vector.
+
+// The imprint / ESSCertID hash algorithms a verifier can recompute: the SHA-2 family, plus SHA-1
+// for MATCHING a legacy token's imprint (a verify-side digest, never a signing choice). An unknown
+// or weak (e.g. MD5) algorithm cannot be recomputed, so the check fails closed rather than assume.
+var _VERIFY_DIGEST = { sha256: "sha256", sha384: "sha384", sha512: "sha512", sha1: "sha1" };
+// The digest output length each verify hash MUST produce: a messageImprint or precomputed imprint
+// of any other length is not a real digest and can never correspond to data (RFC 3161 sec. 2.4.1).
+var _VERIFY_DIGEST_LEN = { sha1: 20, sha256: 32, sha384: 48, sha512: 64 };
+// The ESSCertID(V2) certificate binding is a pure identity pin, so its digest MUST be
+// collision-resistant: a SHA-1 certHash would let a chosen-prefix collision substitute the TSA
+// certificate. RFC 5816 moved this binding from the SHA-1 ESSCertID to the SHA-2 ESSCertIDv2 for
+// exactly this reason -- accept only SHA-2 here (the messageImprint stays algorithm-agile, since
+// that hash is the requester's documented RFC 3161 choice, not an identity pin).
+var _BIND_DIGEST = { sha256: "sha256", sha384: "sha384", sha512: "sha512" };
+
+// M10 -- recompute the imprint over `data` under the token's messageImprint hash algorithm (read
+// from the verified eContent) and compare to hashedMessage. `data` is raw bytes (hashed) or a
+// precomputed { hashAlgorithm, hashedMessage } (algorithm-exact + byte-exact). Returns true or a
+// tsp/* verdict code; a config-shape error throws (the caller's contract).
+function _imprintMatches(mi, data) {
+  var name = mi.hashAlgorithm && mi.hashAlgorithm.name;
+  var nodeAlg = name && _VERIFY_DIGEST[name];
+  if (!nodeAlg) return "tsp/unsupported-algorithm";   // cannot recompute -> never assume a match
+  var wantLen = _VERIFY_DIGEST_LEN[name];
+  // The token's messageImprint MUST be a full-length digest for its algorithm. A short/empty
+  // hashedMessage is not a hash and cannot correspond to any data, so it fails closed here -- a
+  // matching short precomputed imprint must never make it verify (RFC 3161 sec. 2.4.1).
+  if (mi.hashedMessage.length !== wantLen) return "tsp/imprint-mismatch";
+  var actual;
+  if (Buffer.isBuffer(data) || data instanceof Uint8Array) {
+    actual = nodeCrypto.createHash(nodeAlg).update(Buffer.from(data)).digest();
+  } else if (data && typeof data === "object" && (Buffer.isBuffer(data.hashedMessage) || data.hashedMessage instanceof Uint8Array)) {
+    if (data.hashAlgorithm !== name) return "tsp/imprint-mismatch";   // a precomputed imprint under a different algorithm
+    // a caller-supplied precomputed imprint of the wrong length is a config error (the sign path
+    // rejects it identically) -- throw rather than silently mismatch (three-tier: caller input).
+    if (data.hashedMessage.length !== wantLen) throw _err("tsp/bad-input", "precomputed imprint hashedMessage length (" + data.hashedMessage.length + ") does not match the " + name + " digest length (" + wantLen + ")");
+    actual = Buffer.from(data.hashedMessage);
+  } else {
+    throw _err("tsp/bad-input", "pki.tsp.verify data must be a Buffer or a { hashAlgorithm, hashedMessage } imprint");
+  }
+  return Buffer.compare(actual, Buffer.from(mi.hashedMessage)) === 0 ? true : "tsp/imprint-mismatch";
+}
+
+// M13 -- the token MUST be bound to the exact signer certificate via the ESS SigningCertificate(V2)
+// signed attribute (RFC 3161 sec. 2.4.2 / RFC 5816): recompute hash(tsaCertDer) under the
+// ESSCertID(V2) hashAlgorithm (v1 implies SHA-1, v2 defaults SHA-256) and compare to certHash.
+function _checkCertBinding(signerInfo, tsaCertDer) {
+  var attrs = (signerInfo && signerInfo.signedAttrs) || [];
+  // Prefer the RFC 5816 SigningCertificateV2 (SHA-2) binding over the legacy RFC 2634
+  // SigningCertificate (SHA-1). A token may carry both for compatibility, and the SHA-1 attribute
+  // sorts first in the signed-attribute SET; picking it would fail the SHA-2-only binding pin even
+  // though a usable v2 binding is present. Fall back to the legacy attribute only when no v2 exists.
+  var sc = null, scV1 = null;
+  for (var i = 0; i < attrs.length; i++) {
+    if (attrs[i].type === O("signingCertificateV2")) { sc = attrs[i]; break; }
+    if (attrs[i].type === O("signingCertificate") && !scV1) scV1 = attrs[i];
+  }
+  if (!sc) sc = scV1;
+  if (!sc) return "tsp/missing-signing-certificate";   // parseToken guarantees presence; belt-and-suspenders
+  var decoded;
+  try { decoded = smime.decodeAttribute(sc); }
+  catch (_e) { return "tsp/bad-signing-certificate"; }
+  var essCert = decoded.certs && decoded.certs[0];
+  if (!essCert) return "tsp/bad-signing-certificate";
+  var nodeAlg = essCert.hashAlgorithm && _BIND_DIGEST[essCert.hashAlgorithm.name];
+  if (!nodeAlg) return "tsp/unsupported-algorithm";   // SHA-1 (or an unknown hash) is not a valid identity pin
+  var actual = nodeCrypto.createHash(nodeAlg).update(tsaCertDer).digest();
+  if (Buffer.compare(actual, Buffer.from(essCert.certHash)) !== 0) return "tsp/cert-binding-mismatch";
+  // RFC 5035 sec. 5: if the ESSCertID(V2) carries the OPTIONAL issuerSerial, it MUST identify the
+  // signer certificate -- confirm its serialNumber. The certHash already pins the exact cert
+  // cryptographically; the serialNumber is that cert's unambiguous identity field.
+  if (essCert.issuerSerial) {
+    var signerCert;
+    try { signerCert = pkiX509.parse(tsaCertDer); }
+    catch (_e) { return "tsp/bad-signing-certificate"; }
+    if (essCert.issuerSerial.serialNumber !== signerCert.serialNumber) return "tsp/cert-binding-mismatch";
+    // the issuerSerial issuer is a single directoryName (RFC 5035 sec. 5) that MUST canonically
+    // equal the signer cert's issuer DN -- decode it and compare through the shared name guard.
+    var names = essCert.issuerSerial.issuer.names || [];
+    var gn = null;
+    try { if (names.length === 1) gn = schemaTsp.decodeGeneralName(names[0].bytes); }
+    catch (_e) { return "tsp/cert-binding-mismatch"; }
+    if (!gn || gn.tagNumber !== 4 || !gn.value || !guard.name.dnEqual(gn.value.rdns, signerCert.issuer.rdns, _err, "tsp/cert-binding-mismatch", "the ESSCertID issuer")) {
+      return "tsp/cert-binding-mismatch";
+    }
+  }
+  return true;
+}
+
+// M11 -- RFC 3161 sec. 2.3: the TSA certificate MUST contain exactly ONE extendedKeyUsage instance
+// whose sole KeyPurposeID is id-kp-timeStamping, and that extension MUST be CRITICAL. path.validate's
+// requiredEku only checks the purpose is ASSERTED (an absent EKU is unrestricted), so this
+// single-purpose + critical gate is layered on top -- the OCSP-delegate precedent for a format gate
+// above the path checks. Additionally (RFC 5280 sec. 4.2.1.3) a keyUsage extension, if present, MUST
+// permit signing for the cert to sign the token. Returns true or a tsp/* code.
+function _checkTsaCertUsage(tsaCertDer) {
+  var cert;
+  try { cert = pkiX509.parse(tsaCertDer); }
+  catch (_e) { return "tsp/bad-tsa-certificate"; }
+  var exts = (cert.extensions || []).filter(function (e) { return e.oid === O("extKeyUsage"); });
+  if (exts.length !== 1) return "tsp/bad-eku";   // absent, or a duplicate extension (RFC 5280 -- one instance)
+  if (!exts[0].critical) return "tsp/eku-not-critical";
+  var purposes, ekuNode;
+  try { ekuNode = asn1.decode(exts[0].value); }
+  catch (_e) { return "tsp/bad-eku"; }
+  // the extnValue MUST be a universal SEQUENCE OF KeyPurposeId -- a non-SEQUENCE constructed wrapper
+  // (e.g. a SET) carrying OID children would otherwise slip through the bare children walk.
+  if (ekuNode.tagClass !== "universal" || ekuNode.tagNumber !== asn1.TAGS.SEQUENCE || !ekuNode.children) return "tsp/bad-eku";
+  try { purposes = ekuNode.children.map(function (c) { return asn1.read.oid(c); }); }
+  catch (_e) { return "tsp/bad-eku"; }
+  if (purposes.length !== 1 || purposes[0] !== O("timeStamping")) return "tsp/eku-not-exclusive";
+  // A keyUsage that forbids signing cannot mint a token (RFC 5280 sec. 4.2.1.3); an absent keyUsage
+  // is unrestricted. Require digitalSignature (bit 0) or nonRepudiation/contentCommitment (bit 1) --
+  // the signing bits, the TSA analogue of the OCSP-responder keyUsage gate.
+  var kuExts = (cert.extensions || []).filter(function (e) { return e.oid === O("keyUsage"); });
+  if (kuExts.length) {
+    var ku;
+    try {
+      ku = asn1.read.bitString(asn1.decode(kuExts[0].value));
+      // KeyUsage is a NamedBitList: enforce the X.690 sec. 11.2.2 minimal-DER rule (no trailing zero
+      // bits) that the shared certExtensionDecoders keyUsage decoder applies, so a non-minimal
+      // encoding other paths reject cannot slip a "permits signing" verdict through here.
+      schema.assertMinimalNamedBits(ku.unusedBits, ku.bytes, function (m) { throw _err("tsp/bad-key-usage", m); });
+    } catch (_e) { return "tsp/bad-key-usage"; }
+    var byte0 = ku.bytes.length ? ku.bytes[0] : 0;
+    if (!((byte0 >> 7) & 1) && !((byte0 >> 6) & 1)) return "tsp/bad-key-usage";   // no digitalSignature / nonRepudiation
+  }
+  return true;
+}
+
+// RFC 5816 sec. 2.2.2: if TSTInfo.tsa is present, it is a hint that MUST correspond to one of the
+// signing certificate's subject names -- its subject DN (a directoryName, compared canonically) or a
+// subjectAltName entry (a byte-exact GeneralName match). `tsaBytes` is the raw tsa GeneralName TLV.
+function _tsaMatchesCert(tsaBytes, signerCert) {
+  var gn;
+  try { gn = schemaTsp.decodeGeneralName(tsaBytes); }
+  catch (_e) { return false; }
+  if (gn.tagNumber === 4 && gn.value && guard.name.dnEqual(gn.value.rdns, signerCert.subject.rdns, _err, "tsp/tsa-mismatch", "the TSA subject")) return true;
+  var sanExt = (signerCert.extensions || []).filter(function (e) { return e.oid === O("subjectAltName"); })[0];
+  if (sanExt) {
+    var san;
+    try { san = asn1.decode(sanExt.value); }
+    catch (_e) { return false; }
+    // subjectAltName MUST be a universal SEQUENCE OF GeneralName -- a malformed wrapper (e.g. a SET)
+    // carrying a byte-equal child must not contribute an identity (mirrors the EKU wrapper gate).
+    if (san.tagClass === "universal" && san.tagNumber === asn1.TAGS.SEQUENCE && san.children) {
+      for (var i = 0; i < san.children.length; i++) {
+        if (san.children[i].bytes.equals(tsaBytes)) return true;
+      }
+    }
+  }
+  return false;
+}
+
+// Bound on the candidate certification paths enumerated from a token's certificate pool -- a guard
+// against a hostile embed of many same-subject certificates blowing up the search (CWE-834).
+var MAX_TSA_CHAINS = 32;
+
+// Enumerate candidate certification paths for the TSA leaf from a pool of embedded and caller-supplied
+// certificates. path.validate validates a FIXED ordered path (it is not a path builder), so the
+// ordering + backtracking lives here: at every step EVERY unused pool certificate whose subject DN
+// equals the working issuer DN is a candidate issuer -- CA rollover / cross-certification embed
+// several with the same subject, and a same-subject wrong-key certificate must not shadow the real
+// issuer -- and each accumulated prefix is itself a candidate (the anchor may have issued the leaf
+// directly or any intermediate). A certificate is never chained to itself (RFC 5280 identity is
+// issuer + serialNumber, never the serial alone). Each chain is returned anchor-down (highest issuer
+// first, the leaf last) as path.validate takes it; longer chains first so a fully-embedded path is
+// preferred. Bounded by MAX_TSA_CHAINS. The caller (verify) tries each until one validates.
+function _buildTsaChains(leaf, pool) {
+  var chains = [];
+  function dfs(current, acc, used) {
+    if (chains.length >= MAX_TSA_CHAINS) return;
+    chains.push(acc.slice());   // acc is leaf..current; the anchor may validate the path at this length
+    for (var i = 0; i < pool.length && chains.length < MAX_TSA_CHAINS; i++) {
+      if (used[i]) continue;
+      // never chain a certificate to itself (issuer + serialNumber identity, not the serial alone).
+      if (pool[i].serialNumberHex === current.serialNumberHex && guard.name.dnEqual(pool[i].issuer.rdns, current.issuer.rdns, _err, "tsp/bad-tsa-certificate", "the TSA certificate issuer")) continue;
+      if (guard.name.dnEqual(pool[i].subject.rdns, current.issuer.rdns, _err, "tsp/bad-tsa-certificate", "the TSA certificate subject")) {
+        used[i] = true; acc.push(pool[i]);
+        dfs(pool[i], acc, used);
+        acc.pop(); used[i] = false;
+      }
+    }
+  }
+  dfs(leaf, [leaf], []);
+  return chains.map(function (c) { return c.slice().reverse(); }).sort(function (a, b) { return b.length - a.length; });
+}
+
+/**
+ * @primitive  pki.tsp.verify
+ * @signature  pki.tsp.verify(token, data, opts) -> Promise<result>
+ * @since      0.2.19
+ * @status     experimental
+ * @spec       RFC 3161, RFC 5816
+ * @related    pki.tsp.sign, pki.cms.verify, pki.path.validate
+ *
+ * Verify an RFC 3161 TimeStampToken against the data it should cover. `token` is the token DER /
+ * PEM (never a parsed object -- every checked field is read from the CMS-verified eContent, so a
+ * mutated parsed structure cannot desynchronize the checks from the signed bytes). `data` is the
+ * original bytes (hashed under the token's messageImprint algorithm) or a precomputed
+ * `{ hashAlgorithm, hashedMessage }`. Returns `{ valid, genTime, accuracy, serialNumber,
+ * serialNumberHex, policy, nonce, tsa, tstInfo, signer, code?, reason? }`. `valid` is true only
+ * when the CMS signature, the imprint match, the eContentType, the ESSCertID(V2) binding, the
+ * RFC 3161 sec. 2.3 critical single-`timeStamping` extendedKeyUsage rule, the requested nonce (when
+ * supplied), and -- when a `trustAnchor` is supplied -- the full out-of-path TSA-cert path
+ * validation all pass. A conformance / trust failure of a well-formed token is a
+ * `{ valid:false, code }` verdict; malformed or config input throws a typed `TspError`.
+ *
+ * @opts  trustAnchor   Anchor `{ name, publicKey, algorithm }` -- runs `pki.path.validate` on the
+ *                       TSA certificate chain ordered from the token's embedded certificates
+ *                       (validity at genTime, requiredEku timeStamping, revocation), so a TSA under
+ *                       an intermediate CA validates, not only one directly under the anchor. Omit
+ *                       to verify signature + imprint + binding + EKU only and anchor the cert yourself.
+ * @opts  nonce         Require the token's TSTInfo.nonce to equal this (a number/BigInt).
+ * @opts  reqPolicy     Require the token's policy to equal this (an OID name or dotted string).
+ * @opts  certs         Out-of-band TSA certificates (an array of DER `Buffer`s) added to the signer
+ *                      candidates and the path pool, so a cert-less token (the TSA omits its
+ *                      certificate when `certReq` was false) and an intermediate absent from the
+ *                      token can still verify and chain.
+ * @opts  revocationChecker  Passed through to `pki.path.validate`.
+ * @example
+ *   var imprint = { hashAlgorithm: "sha256", hashedMessage: sha256Digest };
+ *   var token = await pki.tsp.sign(imprint, { cert: signerCertDer, key: signerKeyPkcs8 }, { policy: "1.3.6.1.4.1.1", serialNumber: 1 });
+ *   var res = await pki.tsp.verify(token, Buffer.from("hello"), {});
+ *   res.valid;     // boolean; pass opts.trustAnchor to also chain the TSA cert to a root
+ *   res.genTime;   // Date, read from the verified eContent
+ */
+async function verify(token, data, opts) {
+  opts = opts || {};
+  if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("tsp/bad-input", "pki.tsp.verify options must be an object");
+  if (opts.certs != null && (!Array.isArray(opts.certs) || !opts.certs.every(function (c) { return Buffer.isBuffer(c) || c instanceof Uint8Array; }))) {
+    throw _err("tsp/bad-input", "pki.tsp.verify opts.certs must be an array of DER certificate Buffers");   // a bad element is a caller error, never silently dropped
+  }
+  var tokenDer = _tokenDer(token);   // DER Buffer / PEM -> DER; a non-token input throws tsp/bad-input
+  // M7 -- parseToken enforces the SignedData + id-ct-TSTInfo + single-signer + signing-cert-present
+  // structure and decodes the TSTInfo FROM the raw eContent; a structural defect throws.
+  var parsed = schemaTsp.parseToken(tokenDer);
+  var tst = parsed.tstInfo;
+  function fail(code, reason) {
+    return { valid: false, code: code, reason: reason || null, genTime: tst.genTime, accuracy: tst.accuracy, serialNumber: tst.serialNumber, serialNumberHex: tst.serialNumberHex, policy: tst.policy, nonce: tst.nonce, tsa: tst.tsa, tstInfo: tst, signer: null };
+  }
+  // M12 -- the CMS signature over the exact RFC 5652 sec. 5.4 preimage (message-digest bound to the
+  // authenticated eContent). cms.verify re-parses the same bytes; a failure is a fail-closed verdict.
+  // Caller-supplied out-of-band certificates (opts.certs) join the signer-certificate candidates, so
+  // a cert-less token (RFC 3161 -- the TSA omits its certificate when certReq was false) can verify.
+  var cmsRes = await cmsVerify.verify(tokenDer, { certs: opts.certs });
+  var signer = cmsRes.signers[0];
+  if (!cmsRes.valid) return fail("tsp/bad-signature", signer && (signer.code || signer.message));
+  var tsaCertDer = signer && signer.cert;
+  if (!tsaCertDer) return fail("tsp/bad-signature", "the TSA signer certificate was not found");
+  // M10 -- what was timestamped MUST correspond to the data (imprint recompute + match).
+  var mi = _imprintMatches(tst.messageImprint, data);
+  if (mi !== true) return fail(mi);
+  // M14 -- if a request nonce is supplied, the token MUST echo it (BigInt-exact).
+  if (opts.nonce != null) {
+    var wantNonce = BigInt(opts.nonce);
+    if (tst.nonce == null || tst.nonce !== wantNonce) return fail("tsp/nonce-mismatch");
+  }
+  // M15 -- if the requested policy is supplied, the token's policy MUST equal it.
+  if (opts.reqPolicy != null) {
+    var wantPolicy = /^\d+(\.\d+)+$/.test(opts.reqPolicy) ? opts.reqPolicy : O(opts.reqPolicy);
+    if (tst.policy !== wantPolicy) return fail("tsp/policy-mismatch");
+  }
+  // A TSTInfo carrying a CRITICAL extension the verifier cannot process is unusable: RFC 3161 sec.
+  // 2.4.2 defers extension handling to RFC 5280 sec. 4.2, and defines no TSTInfo extension, so any
+  // critical one is unrecognized (the unknown-critical-extension gate the cert path also applies).
+  if (tst.extensions && tst.extensions.some(function (e) { return e.critical; })) {
+    return fail("tsp/unknown-critical-extension");
+  }
+  // M13 -- the ESSCertID(V2) binding: the verifying cert MUST be the one the signer identified.
+  var bind = _checkCertBinding(parsed.signerInfo, tsaCertDer);
+  if (bind !== true) return fail(bind);
+  // M11 -- the RFC 3161 sec. 2.3 critical single-timeStamping EKU gate + the keyUsage-permits-signing check.
+  var usage = _checkTsaCertUsage(tsaCertDer);
+  if (usage !== true) return fail(usage);
+  // RFC 5816 sec. 2.2.2 -- the tsa hint, when present, MUST name the signer certificate.
+  if (tst.tsa) {
+    var sc;
+    try { sc = pkiX509.parse(tsaCertDer); }
+    catch (_e) { return fail("tsp/bad-tsa-certificate"); }
+    if (!_tsaMatchesCert(tst.tsa.bytes, sc)) return fail("tsp/tsa-mismatch");
+  }
+  // M18 -- full out-of-path TSA-cert validation (issuer-sig, validity at genTime, unknown-critical,
+  // key-param inheritance, requiredEku, optional revocation), only when a trustAnchor is supplied.
+  // The path is ordered from the token's embedded certificates (leaf + any intermediates), so a TSA
+  // issued under an intermediate CA -- not just directly under the anchor -- validates.
+  if (opts.trustAnchor) {
+    var pathRes = null;
+    // tst.genTime floors to millisecond precision. When genTime carries sub-millisecond digits the true
+    // instant lies in (floor, floor+1ms], so fail closed on BOTH validity boundaries: require each
+    // candidate path to validate at the floor AND the ceil. A token minted just after the certificate
+    // expired is rejected at the ceil (floor <= notAfter but ceil > notAfter); one minted just before
+    // notBefore is rejected at the floor (ceil >= notBefore but floor < notBefore). Certificate
+    // validity is seconds-precise (RFC 5280 sec. 4.1.2.5), so this never over-rejects a valid token.
+    var floorT = tst.genTime;
+    var ceilT = (tst.genTimeFraction != null && /[1-9]/.test(tst.genTimeFraction.slice(3))) ? new Date(floorT.getTime() + 1) : floorT;
+    try {
+      // parseToken surfaces each embedded cert as { bytes, tagClass, ... }; take the X.509 certs
+      // (universal SEQUENCE), skipping any attribute-certificate choices, and parse their raw bytes.
+      // Caller out-of-band certificates (opts.certs) join the pool so an intermediate absent from the
+      // token can still complete the path.
+      var pool = (parsed.certificates || []).filter(function (c) { return c.tagClass === "universal"; }).map(function (c) { return pkiX509.parse(c.bytes); });
+      (opts.certs || []).forEach(function (c) { pool.push(pkiX509.parse(c)); });
+      // path.validate validates a FIXED path, so backtracking over same-subject issuer candidates
+      // happens here -- accept the TSA certificate if ANY enumerated chain validates to the anchor at
+      // both window endpoints.
+      var chains = _buildTsaChains(pkiX509.parse(tsaCertDer), pool);
+      for (var ci = 0; ci < chains.length && !(pathRes && pathRes.valid); ci++) {
+        pathRes = await pathValidate.validate(chains[ci], {
+          time: floorT, trustAnchor: opts.trustAnchor, requiredEku: ["timeStamping"], revocationChecker: opts.revocationChecker,
+        });
+        if (pathRes.valid && ceilT !== floorT) {
+          pathRes = await pathValidate.validate(chains[ci], {
+            time: ceilT, trustAnchor: opts.trustAnchor, requiredEku: ["timeStamping"], revocationChecker: opts.revocationChecker,
+          });
+        }
+      }
+    } catch (e) { return fail("tsp/untrusted-tsa", (e && e.message) || String(e)); }
+    if (!pathRes || !pathRes.valid) return fail("tsp/untrusted-tsa", "the TSA certificate did not validate to the trust anchor at genTime");
+  }
+  return {
+    valid: true, genTime: tst.genTime, accuracy: tst.accuracy,
+    serialNumber: tst.serialNumber, serialNumberHex: tst.serialNumberHex,
+    policy: tst.policy, policyName: tst.policyName, nonce: tst.nonce, tsa: tst.tsa,
+    tstInfo: tst, signer: { cert: tsaCertDer, sid: signer.sid },
+  };
+}
+
+module.exports = { sign: sign, request: request, parseRequest: parseRequest, response: response, parseResponse: parseResponse, verify: verify };

package/lib/webcrypto.js

@@ -627,7 +627,7 @@ SubtleCrypto.prototype.unwrapKey = async function unwrapKey(format, wrappedKey,
     // notice. The shared JSON guard parses strictly (bounded, fatal UTF-8, and a
     // smuggled duplicate member rejected rather than resolved last-wins), and its
     // failure surfaces as the module's typed webcrypto/data (W3C: DataError).
-    keyData = guard.json.parse(bytes, WebCryptoError, {
+    keyData = guard.json.parse(bytes, _wcErr, {
       maxBytes: constants.LIMITS.JSON_MAX_BYTES, maxDepth: constants.LIMITS.JSON_MAX_DEPTH,
       badJson: "webcrypto/data", tooDeep: "webcrypto/data", duplicateMember: "webcrypto/data",
       tooLarge: "webcrypto/data", badInput: "webcrypto/data", label: "the unwrapped JWK",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.2.18",
+  "version": "0.2.19",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:bec63d3e-7332-4a32-bcc8-ac8614e7402a",
+  "serialNumber": "urn:uuid:d6e0649c-f4db-4241-8784-6f3c9d3d663f",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-14T07:20:40.274Z",
+    "timestamp": "2026-07-14T16:14:40.970Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.2.18",
+      "bom-ref": "@blamejs/pki@0.2.19",
       "type": "application",
       "name": "pki",
-      "version": "0.2.18",
+      "version": "0.2.19",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.2.18",
+      "purl": "pkg:npm/%40blamejs/pki@0.2.19",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.2.18",
+      "ref": "@blamejs/pki@0.2.19",
       "dependsOn": []
     }
   ]