@blamejs/pki 0.2.26 → 0.2.27

package/CHANGELOG.md

@@ -4,6 +4,15 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.2.27 — 2026-07-16
+
+CMS CompressedData arrives as pki.cms.compress / pki.cms.decompress, with the matching S/MIME pki.smime.compress / pki.smime.decompress: compress and recover RFC 3274 messages, with a bounded inflate that defends the decompression-bomb class.
+
+### Added
+
+- pki.cms.compress(content, opts) and pki.cms.decompress(input, opts) produce and consume a CMS CompressedData (RFC 3274): ZLIB (RFC 1950 / RFC 1951) compression, version 0, id-alg-zlibCompress with omitted parameters. opts.contentType sets the inner content type (default id-data), opts.level the DEFLATE level, opts.pem returns PEM. Decompress requires version 0, id-alg-zlibCompress with absent-or-NULL parameters, and a present encapsulated content; it bounds the decompressed output at C.LIMITS.COMPRESS_MAX_BYTES (16 MiB, tightened downward via opts.maxOutputBytes) and stops before the output is materialized, so a decompression bomb throws cms/decompress-too-large rather than exhausting memory. Every malformed or truncated stream fails closed as cms/decompress-failed. Fail-closed with typed CmsError.
+- pki.smime.compress(content, opts) and pki.smime.decompress(message, opts) assemble and open a compressed S/MIME message (RFC 8551 section 3.6): an opaque application/pkcs7-mime; smime-type=compressed-data; name=smime.p7z entity whose base64 body is a CMS CompressedData. The MIME entity is canonicalized before compression and recovered exactly; the recovered content -- which may itself be a signed or enveloped S/MIME message -- is returned for the caller to feed back to pki.smime.verify / pki.smime.decrypt. Compression is a size transform with no integrity, confidentiality, or authentication (RFC 8551 section 2.4.5). Receive-tolerant: OpenSSL's legacy application/x-pkcs7-mime and a missing smime-type are both accepted.
+
 ## v0.2.26 — 2026-07-16
 
 S/MIME encryption arrives as pki.smime.encrypt / pki.smime.decrypt: envelope and open RFC 8551 encrypted messages over the CMS layer, with AES-GCM authenticated enveloping as the default and bidirectional OpenSSL interoperability.

package/README.md

@@ -221,8 +221,8 @@ is callable today; nothing below is a stub.
 | `pki.schema.smime` | Decode S/MIME ESS signed-attribute values (RFC 5035 / RFC 8551) — `parseSigningCertificate` / `parseSigningCertificateV2` bind a signature to its signing certificate (cert hash, hash algorithm, issuer `GeneralNames` + serial), `parseSmimeCapabilities` decodes the ordered capability list, and `decodeAttribute` OID-dispatches a CMS attribute (enforcing the single-value rule, recognize-and-defer for unknown types). A companion decoder for CMS signed attributes, not an auto-routed format, fail-closed — `parseSigningCertificate`, `parseSigningCertificateV2`, `parseSmimeCapabilities`, `decodeAttribute` |
 | `pki.schema.engine` | The declarative ASN.1 structure-schema engine every format parser composes — `walk` / `encode` / `embeddedDer` plus the schema combinators |
 | `pki.path` | RFC 5280 §6 certification-path validation — `validate` runs the §6.1 state machine (signature chaining across RSA, ECDSA, EdDSA, ML-DSA, SLH-DSA and hybrid composite ML-DSA signatures — a composite is accepted only when **both** its post-quantum and traditional components verify; validity windows, name chaining, basic constraints and path length, key usage, name constraints, the certificate-policy tree) over an ordered path and a trust anchor, returning a structured verdict with per-check reason codes, and enforces a `pki.trust` anchor's per-purpose distrust-after dates and delegator purposes via `checkPurpose`; `crlChecker` supplies CRL-based revocation — including partitioned/sharded CRLs, whose §6.3.3 Distribution Point ↔ IDP correspondence lets a corresponding full-reason shard establish non-revocation — and `ocspChecker` supplies OCSP-based revocation (RFC 6960 — CertID binding, responder authorization, signature, currency) over the same pluggable hook. Pure and re-entrant, fail-closed — `validate`, `crlChecker`, `ocspChecker` |
-| `pki.cms` | RFC 5652 §5 CMS SignedData signing + signature verification — `sign(content, signers, opts)` produces a SignedData (attached or detached, one or many signers, RSA / RSASSA-PSS / ECDSA / EdDSA, the post-quantum ML-DSA-44/65/87 (RFC 9882) and SLH-DSA (all twelve FIPS 205 sets, RFC 9814), and composite ML-DSA (pairing ML-DSA with a traditional RSA / ECDSA / EdDSA — accepted only when **both** components verify — draft-ietf-lamps-cms-composite-sigs)); it builds the signed attributes (content-type, message-digest, signing-time) as canonical DER, signs the exact §5.4 preimage, and emits a DER `Buffer` or PEM. `verify(input, opts)` parses a SignedData over the strict `pki.schema.cms` codec, locates each SignerInfo's signer certificate by its issuerAndSerialNumber or subjectKeyIdentifier, and checks the signature over the exact §5.4 preimage: when signed attributes are present it confirms the message-digest attribute equals the content digest and verifies over the DER re-encoding of the SignedAttributes (the on-wire `[0]` tag replaced by a universal SET OF), otherwise directly over the content. It returns a per-signer verdict with the matched signer certificate; it does not chain that certificate to a trust anchor — that is the caller's step through `pki.path.validate`. **Content encryption** (RFC 5652/5083/5084/9629): `encrypt(content, recipients, opts)` produces an EnvelopedData, AuthEnvelopedData (AES-GCM, the authenticated default), or EncryptedData — recipients auto-dispatch off the certificate key to key-transport (RSAES-OAEP; v1.5 never emitted), key-agreement (ephemeral-static ECDH over P-256/384/521 with the X9.63 KDF, and X25519/X448 with HKDF), symmetric key-wrap, password (PBKDF2 + RFC 3211 PWRI-KEK), or the post-quantum ML-KEM KEMRecipientInfo (RFC 9629/9936) — one fresh content key wrapped for every recipient. `decrypt(input, keyMaterial, opts)` recovers the content through the matching arm and returns it with an `authenticated` flag; every secret-dependent failure collapses to one uniform `cms/decrypt-failed` verdict (Bleichenbacher / EFAIL / password-oracle freedom), and PKCS#1 v1.5 is decrypt-only under the RFC 3218 implicit-rejection countermeasure. Fail-closed with typed `cms/*` errors — `sign`, `verify`, `encrypt`, `decrypt` |
-| `pki.smime` | RFC 8551 S/MIME message assembly, verification, and encryption over the CMS layer — `sign(content, signers, opts)` wraps a MIME entity as a signed S/MIME message in either form: `multipart/signed` (clear-signed — the content stays readable in any MUA, a detached CMS SignedData rides alongside as `application/pkcs7-signature` with a matching `micalg`) or `application/pkcs7-mime; smime-type=signed-data` (opaque — the whole entity is a base64 CMS SignedData). The signed bytes are the entity's RFC 8551 §3.1.1 canonical form (CRLF line endings); `verify(message, opts)` unwraps both forms and recomputes over the same canonicalizer, so a transport that re-wraps line endings still verifies and a tampered part fails. `encrypt(content, recipients, opts)` envelopes a MIME entity as an opaque `application/pkcs7-mime` message and `decrypt(message, keyMaterial, opts)` opens one — `smime-type=authEnveloped-data` (AES-GCM, confidentiality and integrity, the default) or `smime-type=enveloped-data` (AES-CBC, confidentiality only, so `decrypt` reports `authenticated: false`, the §3.3 no-integrity caveat); the `smime-type` is derived from the CMS body, not the header, and decryption is fail-closed and oracle-free. The crypto is entirely `pki.cms.sign` / `verify` / `encrypt` / `decrypt` — any RSA / RSASSA-PSS / ECDSA / EdDSA / ML-DSA / SLH-DSA signer and any RSA-OAEP / ECDH / X25519 / X448 / AES-KW / PBKDF2 / ML-KEM recipient carries through (algorithm-agnostic). Like `cms.verify`, `verify` returns the per-signer cryptographic verdict plus the recovered content; chaining a signer to a trust anchor is the caller's `pki.path.validate` step. Bidirectionally interoperable with `openssl smime` / `openssl cms`. Fail-closed with typed `smime/*` errors — `sign`, `verify`, `encrypt`, `decrypt` |
+| `pki.cms` | RFC 5652 §5 CMS SignedData signing + signature verification — `sign(content, signers, opts)` produces a SignedData (attached or detached, one or many signers, RSA / RSASSA-PSS / ECDSA / EdDSA, the post-quantum ML-DSA-44/65/87 (RFC 9882) and SLH-DSA (all twelve FIPS 205 sets, RFC 9814), and composite ML-DSA (pairing ML-DSA with a traditional RSA / ECDSA / EdDSA — accepted only when **both** components verify — draft-ietf-lamps-cms-composite-sigs)); it builds the signed attributes (content-type, message-digest, signing-time) as canonical DER, signs the exact §5.4 preimage, and emits a DER `Buffer` or PEM. `verify(input, opts)` parses a SignedData over the strict `pki.schema.cms` codec, locates each SignerInfo's signer certificate by its issuerAndSerialNumber or subjectKeyIdentifier, and checks the signature over the exact §5.4 preimage: when signed attributes are present it confirms the message-digest attribute equals the content digest and verifies over the DER re-encoding of the SignedAttributes (the on-wire `[0]` tag replaced by a universal SET OF), otherwise directly over the content. It returns a per-signer verdict with the matched signer certificate; it does not chain that certificate to a trust anchor — that is the caller's step through `pki.path.validate`. **Content encryption** (RFC 5652/5083/5084/9629): `encrypt(content, recipients, opts)` produces an EnvelopedData, AuthEnvelopedData (AES-GCM, the authenticated default), or EncryptedData — recipients auto-dispatch off the certificate key to key-transport (RSAES-OAEP; v1.5 never emitted), key-agreement (ephemeral-static ECDH over P-256/384/521 with the X9.63 KDF, and X25519/X448 with HKDF), symmetric key-wrap, password (PBKDF2 + RFC 3211 PWRI-KEK), or the post-quantum ML-KEM KEMRecipientInfo (RFC 9629/9936) — one fresh content key wrapped for every recipient. `decrypt(input, keyMaterial, opts)` recovers the content through the matching arm and returns it with an `authenticated` flag; every secret-dependent failure collapses to one uniform `cms/decrypt-failed` verdict (Bleichenbacher / EFAIL / password-oracle freedom), and PKCS#1 v1.5 is decrypt-only under the RFC 3218 implicit-rejection countermeasure. **Compression** (RFC 3274): `compress(content, opts)` / `decompress(input, opts)` produce and consume a CompressedData (ZLIB, version 0, id-alg-zlibCompress); decompress bounds the uncompressed output at 16 MiB and stops before it is materialized, so a decompression bomb fails closed as `cms/decompress-too-large` — a size transform with no integrity/confidentiality (RFC 8551 §2.4.5). Fail-closed with typed `cms/*` errors — `sign`, `verify`, `encrypt`, `decrypt`, `compress`, `decompress` |
+| `pki.smime` | RFC 8551 S/MIME message assembly, verification, encryption, and compression over the CMS layer — `sign(content, signers, opts)` wraps a MIME entity as a signed S/MIME message in either form: `multipart/signed` (clear-signed — the content stays readable in any MUA, a detached CMS SignedData rides alongside as `application/pkcs7-signature` with a matching `micalg`) or `application/pkcs7-mime; smime-type=signed-data` (opaque — the whole entity is a base64 CMS SignedData). The signed bytes are the entity's RFC 8551 §3.1.1 canonical form (CRLF line endings); `verify(message, opts)` unwraps both forms and recomputes over the same canonicalizer, so a transport that re-wraps line endings still verifies and a tampered part fails. `encrypt(content, recipients, opts)` envelopes a MIME entity as an opaque `application/pkcs7-mime` message and `decrypt(message, keyMaterial, opts)` opens one — `smime-type=authEnveloped-data` (AES-GCM, confidentiality and integrity, the default) or `smime-type=enveloped-data` (AES-CBC, confidentiality only, so `decrypt` reports `authenticated: false`, the §3.3 no-integrity caveat); the `smime-type` is derived from the CMS body, not the header, and decryption is fail-closed and oracle-free. The crypto is entirely `pki.cms.sign` / `verify` / `encrypt` / `decrypt` — any RSA / RSASSA-PSS / ECDSA / EdDSA / ML-DSA / SLH-DSA signer and any RSA-OAEP / ECDH / X25519 / X448 / AES-KW / PBKDF2 / ML-KEM recipient carries through (algorithm-agnostic). Like `cms.verify`, `verify` returns the per-signer cryptographic verdict plus the recovered content; chaining a signer to a trust anchor is the caller's `pki.path.validate` step. `compress(content, opts)` / `decompress(message, opts)` add the opaque `application/pkcs7-mime; smime-type=compressed-data; name=smime.p7z` frame (RFC 8551 §3.6, RFC 3274) — a size transform with no integrity/confidentiality (§2.4.5), decompress bounded against a bomb; the recovered content, which may itself be signed or enveloped, is returned for the caller to re-verify. Bidirectionally interoperable with `openssl smime` / `openssl cms`. Fail-closed with typed `smime/*` errors — `sign`, `verify`, `encrypt`, `decrypt`, `compress`, `decompress` |
 | `pki.tsp` | RFC 3161 Time-Stamp Protocol — `sign(messageImprint, tsa, opts)` produces a TimeStampToken: a CMS SignedData (over `pki.cms.sign`) whose content is a `TSTInfo` carrying the timestamped message imprint, the TSA policy, a serial number, and `genTime` (with optional accuracy / nonce / ordering), plus the RFC 3161 §2.4.2 signing-certificate attribute binding the token to the TSA certificate (SHA-2 imprints, any `pki.cms.sign` TSA key). `request` / `parseRequest` build and parse the TimeStampReq a client sends (imprint, requested policy, nonce, certReq), `response` / `parseResponse` the TimeStampResp a TSA returns — a granted status wrapping a token, or a rejection with PKIStatus and failure info, the §2.4.2 status↔token coupling enforced in both directions. `verify(token, data, opts)` verifies a token fail-closed: the CMS signature over the exact signed bytes, the message imprint recomputed from the data, the TSTInfo content type, the ESSCertID(V2) binding to the TSA certificate, the §2.3 critical timeStamping-only extendedKeyUsage, the request nonce when used, and — with a trust anchor supplied — full certification-path validation of the TSA certificate at the token's `genTime`, returning `{ valid, genTime, serialNumber, tstInfo, … }` — `sign`, `request`, `parseRequest`, `response`, `parseResponse`, `verify` |
 | `pki.ocsp` | RFC 6960 Online Certificate Status Protocol — the responder and relying-party surface. `buildRequest(query, opts)` builds an OCSPRequest for one or more `{ cert, issuer }` pairs (CertID hashed under SHA-1 by default per the RFC 5019 lightweight profile, or SHA-2; optional RFC 9654 nonce, optional requestor signature). `sign(responseData, responder, opts)` produces a signed BasicOCSPResponse over the exact `ResponseData` DER — the issuing CA directly or a delegated responder, any `pki.cms.sign` key including the post-quantum ML-DSA / SLH-DSA sets, with `good` / `revoked` (reason + time) / `unknown` per-certificate status, and `buildErrorResponse(status)` the unsigned §2.3 error (`tryLater` / `unauthorized` / …). `verify(response, opts)` verifies a response fail-closed against the same hardened gates `pki.path.ocspChecker` runs: the CertID binding, responder authorization (the issuing CA or a CA-issued delegate bearing id-kp-OCSPSigning **and** id-pkix-ocsp-nocheck, passing the full out-of-path certificate gates), the signature over `tbsResponseDataBytes`, currency (`thisUpdate`/`nextUpdate`), and the request-nonce echo — returning `{ status: "good" / "revoked" / "unknown", … }`, never a silent accept. Transport-free — `buildRequest`, `sign`, `buildErrorResponse`, `verify` |
 | `pki.ct` | RFC 6962 Certificate Transparency SCTs — `parseSctList` decodes the `SignedCertificateTimestampList` a certificate or OCSP response carries in the SCT extension (a TLS-presentation-language payload inside the §3.3 double DER wrap) into per-SCT log id, exact `timestamp` (BigInt), named signature algorithm, and raw signature; `reconstructSignedData` rebuilds the exact `digitally-signed` preimage; `verifySct` verifies an SCT signature against a log's public key by reconstructing the signed data, routing an ECDSA signature through the strict DER-conformance gate, and verifying through the crypto engine — resolving true or false, and throwing a typed error on a structural fault. The producing side: `encodeSctList` builds the extension value byte-for-byte (the exact inverse of `parseSctList`) and `signSct` performs a log's signing step (rebuilding the same signed-data preimage the verifier hashes and signing it with the log's ECDSA-P-256 / RSA key). Structure decoded, crypto fail-closed — `parseSctList`, `reconstructSignedData`, `verifySct`, `encodeSctList`, `signSct` |

package/lib/cms-compress.js

@@ -0,0 +1,111 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- the pki.cms.compress / pki.cms.decompress implementation. The operator-facing
+// @module pki.cms + the @primitive blocks live in cms-verify.js, which re-exports these (the
+// cms-encrypt.js / cms-decrypt.js model).
+//
+// CMS CompressedData (RFC 3274) -- the size-transform content type. compress ZLIB-compresses
+// (RFC 1950 / RFC 1951) the content and wraps it as a CompressedData ContentInfo; decompress parses
+// one (over the shipped strict schema-cms parser), enforces version 0 + id-alg-zlibCompress +
+// absent-or-NULL params (RFC 3274 sec. 2), and BOUNDED-inflates the eContent. There is NO crypto
+// here -- CompressedData provides no integrity / confidentiality / authentication (RFC 8551 sec.
+// 2.4.5); it is purely a size transform. The one load-bearing defense is the decompression-bomb
+// cap: inflate stops at C.LIMITS.COMPRESS_MAX_BYTES BEFORE the output is materialized (a
+// resource-exhaustion defense, CWE-409), and every zlib fault collapses to a uniform typed error.
+
+var zlib = require("zlib");
+var oid = require("./oid");
+var schemaCms = require("./schema-cms");
+var frameworkError = require("./framework-error");
+var guard = require("./guard-all");
+var C = require("./constants");
+var asn1 = require("./asn1-der");
+var b = asn1.build;
+var CmsError = frameworkError.CmsError;
+
+function O(n) { return oid.byName(n); }
+function _err(code, message, cause) { return new CmsError(code, message, cause); }
+
+var OID_ZLIB = O("id-alg-zlibCompress");
+// The NULL params DER (0x05 0x00) -- the one non-absent encoding RFC 3274 sec. 2 permits (MAY be NULL).
+var NULL_PARAMS_DER = Buffer.from([0x05, 0x00]);
+
+// Compress `content` and wrap it as a CMS CompressedData ContentInfo (RFC 3274 sec. 1.1): version 0,
+// compressionAlgorithm = id-alg-zlibCompress with ABSENT parameters, encapContentInfo = { eContentType
+// (default id-data), eContent = the RFC 1950 ZLIB stream }.
+async function compress(content, opts) {
+  opts = opts || {};
+  var raw = guard.bytes.view(content, CmsError, "cms/bad-input", "content");
+  var level = opts.level;
+  if (level !== undefined && (typeof level !== "number" || !isFinite(level) || Math.floor(level) !== level)) throw _err("cms/bad-input", "opts.level must be an integer");
+  var ctName = opts.contentType || "data";
+  var ctOid = O(ctName);
+  if (!ctOid) throw _err("cms/bad-input", "opts.contentType is not a known OID name: " + ctName);
+  var stream;
+  try { stream = zlib.deflateSync(raw, level !== undefined ? { level: level } : undefined); }
+  catch (e) { throw _err("cms/bad-input", "the content could not be compressed (check opts.level)", e); }
+  var cd = b.sequence([
+    b.integer(0),
+    b.sequence([b.oid(OID_ZLIB)]),                 // compressionAlgorithm, params ABSENT (RFC 3274 sec. 2)
+    b.sequence([b.oid(ctOid), b.explicit(0, b.octetString(stream))]),
+  ]);
+  var ci = b.sequence([b.oid(O("compressedData")), b.explicit(0, cd)]);
+  return opts.pem ? schemaCms.pemEncode(ci, "CMS") : ci;
+}
+
+// Parse a CMS CompressedData and recover its content. Requires contentTypeName == compressedData,
+// version 0 (enforced by the parser), compressionAlgorithm == id-alg-zlibCompress with absent-or-NULL
+// params, and a present eContent; then BOUNDED-inflates. Every failure is a typed CmsError.
+async function decompress(input, opts) {
+  opts = opts || {};
+  var cap = C.LIMITS.COMPRESS_MAX_BYTES;
+  if (opts.maxOutputBytes !== undefined) {
+    var mo = opts.maxOutputBytes;
+    if (typeof mo !== "number" || !isFinite(mo) || mo <= 0 || Math.floor(mo) !== mo) throw _err("cms/bad-input", "opts.maxOutputBytes must be a positive integer");
+    if (mo < cap) cap = mo;   // a caller may tighten the cap DOWNWARD only, never loosen it
+  }
+  var parsed = schemaCms.parse(_toDer(input));
+  if (parsed.contentTypeName !== "compressedData") throw _err("cms/unsupported-content-type", "input is not a CMS CompressedData (got " + parsed.contentTypeName + ")");
+  var alg = parsed.compressionAlgorithm;
+  if (alg.oid !== OID_ZLIB) throw _err("cms/unsupported-algorithm", "unsupported compressionAlgorithm " + (alg.name || alg.oid) + " (only id-alg-zlibCompress, RFC 3274 sec. 2)");
+  // RFC 3274 sec. 2: the parameters SHOULD be omitted but MAY be NULL -- reject any other encoding.
+  if (alg.parameters != null && Buffer.compare(alg.parameters, NULL_PARAMS_DER) !== 0) throw _err("cms/bad-algorithm-parameters", "id-alg-zlibCompress parameters must be absent or NULL (RFC 3274 sec. 2)");
+  var eci = parsed.encapContentInfo;
+  if (eci.eContent == null) throw _err("cms/no-encapsulated-content", "the CompressedData carries no encapsulated content (a detached CompressedData cannot be decompressed)");
+  var content = _inflateBounded(eci.eContent, cap);
+  return {
+    content: content,
+    contentType: eci.eContentType,
+    contentTypeName: oid.name(eci.eContentType) || eci.eContentType,
+    // Coverage residual: reaching here requires alg.oid === id-alg-zlibCompress (line above), which is
+    // always a registered name, so the `|| alg.oid` fallback is a defensive belt, never selected.
+    compressionAlgorithm: alg.name || alg.oid,
+  };
+}
+
+function _toDer(input) {
+  if (Buffer.isBuffer(input)) return input;
+  if (input instanceof Uint8Array) return Buffer.from(input);
+  if (typeof input === "string") { try { return schemaCms.pemDecode(input); } catch (e) { throw _err("cms/bad-input", "the CMS PEM could not be decoded", e); } }
+  throw _err("cms/bad-input", "input must be a DER Buffer, Uint8Array, or PEM string");
+}
+
+// Inflate an RFC 1950 ZLIB stream, bounding the output at `cap` bytes BEFORE it is materialized:
+// Node's maxOutputLength throws ERR_BUFFER_TOO_LARGE the moment the output would exceed the bound
+// (it does not first allocate the whole output), so a decompression bomb cannot exhaust memory
+// (CWE-409). The cap breach maps to cms/decompress-too-large; every other zlib fault (bad RFC-1950
+// header, truncated stream, corrupt DEFLATE, trailing garbage) collapses to the uniform
+// cms/decompress-failed -- a per-errno surface would be needless attack telemetry.
+function _inflateBounded(stream, cap) {
+  var view = guard.bytes.view(stream, CmsError, "cms/decompress-failed", "the compressed content");
+  try {
+    return zlib.inflateSync(view, { maxOutputLength: cap });
+  } catch (e) {
+    if (e && e.code === "ERR_BUFFER_TOO_LARGE") throw _err("cms/decompress-too-large", "the decompressed output exceeds the " + cap + "-byte cap (a decompression-bomb defense)", e);
+    throw _err("cms/decompress-failed", "the compressed content could not be decompressed", e);
+  }
+}
+
+module.exports = { compress: compress, decompress: decompress };

package/lib/cms-verify.js

@@ -37,6 +37,7 @@ var edwardsPoint = require("./edwards-point");
 var cmsSign = require("./cms-sign");
 var cmsEncrypt = require("./cms-encrypt");
 var cmsDecrypt = require("./cms-decrypt");
+var cmsCompress = require("./cms-compress");
 var signScheme = require("./sign-scheme");
 var MLDSA_SUITABLE_DIGEST = signScheme.MLDSA_SUITABLE_DIGEST;   // shared sign/verify digest-strength policy (RFC 9882 sec. 3.3)
 var SLHDSA_BY_OID = signScheme.SLHDSA_BY_OID;                   // shared SLH-DSA set -> { wc, digest } (RFC 9814 sec. 4 pinned digest)
@@ -658,4 +659,51 @@ var encrypt = cmsEncrypt.encrypt;
  */
 var decrypt = cmsDecrypt.decrypt;
 
-module.exports = { verify: verify, sign: sign, encrypt: encrypt, decrypt: decrypt };
+/**
+ * @primitive pki.cms.compress
+ * @signature pki.cms.compress(content, opts?) -> Promise<Buffer | string>
+ * @since 0.2.27
+ * @status experimental
+ * @spec RFC 3274, RFC 1950, RFC 1951
+ * @related pki.cms.decompress, pki.schema.cms.parse
+ *
+ * ZLIB-compress `content` and wrap it as a CMS `CompressedData` ContentInfo (RFC 3274): version 0,
+ * `compressionAlgorithm` = id-alg-zlibCompress (parameters omitted), `encapContentInfo` = the inner
+ * content type plus the RFC 1950 ZLIB stream (RFC 1951 DEFLATE) as the eContent. There is exactly
+ * ONE compression algorithm in RFC 3274 -- ZLIB -- so there is no algorithm selector. CompressedData
+ * is a size transform with NO integrity, confidentiality, or authentication (RFC 8551 sec. 2.4.5);
+ * compress it, then sign or encrypt it if you need protection. Malformed input throws a typed `CmsError`.
+ *
+ * @opts contentType The inner eContentType (an OID name). Default `data`.
+ * @opts level       The DEFLATE compression level (an integer) forwarded to zlib. Default zlib's default.
+ * @opts pem         Return a PEM string instead of a DER Buffer.
+ * @example
+ *   var z = await pki.cms.compress(Buffer.from("compress me"));
+ */
+var compress = cmsCompress.compress;
+
+/**
+ * @primitive pki.cms.decompress
+ * @signature pki.cms.decompress(input, opts?) -> Promise<{ content, contentType, contentTypeName, compressionAlgorithm }>
+ * @since 0.2.27
+ * @status experimental
+ * @spec RFC 3274, RFC 1950, RFC 1951
+ * @related pki.cms.compress, pki.schema.cms.parse
+ *
+ * Parse a CMS `CompressedData` (DER Buffer or PEM) and recover its content. It requires version 0,
+ * `compressionAlgorithm` = id-alg-zlibCompress with absent-or-NULL parameters (RFC 3274 sec. 2), and a
+ * present eContent, then inflates the RFC 1950 ZLIB stream. The inflate is BOUNDED at
+ * `C.LIMITS.COMPRESS_MAX_BYTES` (16 MiB) and stops before the output is materialized -- a
+ * decompression-bomb / resource-exhaustion defense (CWE-409): a cap breach throws
+ * `cms/decompress-too-large`, and every malformed / truncated / corrupt stream collapses to the uniform
+ * `cms/decompress-failed`. `opts.maxOutputBytes` tightens the cap DOWNWARD only. The verdict carries NO
+ * `authenticated` / `valid` field -- CompressedData is not a security assertion (RFC 8551 sec. 2.4.5).
+ *
+ * @opts maxOutputBytes Lower the decompressed-output cap (a DoS bound; downward only).
+ * @example
+ *   var res = await pki.cms.decompress(compressedDer);
+ *   res.content;   // the recovered plaintext Buffer
+ */
+var decompress = cmsCompress.decompress;
+
+module.exports = { verify: verify, sign: sign, encrypt: encrypt, decrypt: decrypt, compress: compress, decompress: decompress };

package/lib/constants.js

@@ -235,6 +235,10 @@ var LIMITS = {
   PBKDF2_MAX_SALT: 1024,
   // A MIME entity / S/MIME message size ceiling -- bounds the header + body decode before a copy.
   MIME_MAX_BYTES: BYTES.mib(16),
+  // The decompressed-output ceiling for CMS CompressedData (RFC 3274) -- bounds the inflate BEFORE the
+  // output is materialized (a decompression-bomb / resource-exhaustion defense, CWE-409); a caller may
+  // tighten it DOWNWARD via opts.maxOutputBytes, never loosen it.
+  COMPRESS_MAX_BYTES: BYTES.mib(16),
   // ACME challenge token entropy floor (RFC 8555 sec. 8, errata 6950): >= 128
   // bits of base64url is >= 22 characters. A shorter token is refused before use.
   ACME_TOKEN_MIN_CHARS: 22,

package/lib/oid.js

@@ -204,8 +204,9 @@ var FAMILIES = {
     hmacWithSHA384: 10, hmacWithSHA512: 11 } },
 
   // S/MIME content types on the PKCS#9 smime arc (RFC 5652, RFC 3161): id-ct.
-  // authData is RFC 5652 sec. 9 AuthenticatedData; authEnvelopedData is RFC 5083.
-  smimeCt: { base: [1, 2, 840, 113549, 1, 9, 16, 1], of: { authData: 2, tSTInfo: 4, authEnvelopedData: 23, encKeyWithID: 21 } },
+  // authData is RFC 5652 sec. 9 AuthenticatedData; authEnvelopedData is RFC 5083;
+  // compressedData is RFC 3274 CompressedData.
+  smimeCt: { base: [1, 2, 840, 113549, 1, 9, 16, 1], of: { authData: 2, tSTInfo: 4, compressedData: 9, encKeyWithID: 21, authEnvelopedData: 23 } },
 
   // S/MIME other-recipient-info types (id-ori, RFC 5652 sec. 6.2.5). id-ori-kem
   // carries a KEMRecipientInfo (RFC 9629) inside the ori [4] RecipientInfo arm.
@@ -215,7 +216,7 @@ var FAMILIES = {
   // CEK-HKDF content-encryption wrapper (RFC 9709) a KEMRecipientInfo names, plus
   // the RSA-KEM SPKI algorithm (RFC 9690). Parameters are absent for the HKDFs.
   smimeAlg: { base: [1, 2, 840, 113549, 1, 9, 16, 3], of: {
-    "id-alg-PWRI-KEK": 9,
+    "id-alg-zlibCompress": 8, "id-alg-PWRI-KEK": 9,
     "id-rsa-kem": 14, "id-alg-hss-lms-hashsig": 17,
     // RFC 8418 X25519/X448 key-agreement schemes (HKDF-based).
     "dhSinglePass-stdDH-hkdf-sha256-scheme": 19, "dhSinglePass-stdDH-hkdf-sha384-scheme": 20,

package/lib/schema-cms.js

@@ -76,6 +76,7 @@ var PWRI_VERSION = pkix.versionReader(NS, { "0": 0 });
 // AuthEnvelopedData version (RFC 5083 sec. 2.1) and the KEMRecipientInfo version
 // (RFC 9629 sec. 3) are both a fixed 0.
 var AUTHDATA_VERSION = pkix.versionReader(NS, { "0": 0, "1": 1, "3": 3 });
+var COMPRESSED_DATA_VERSION = pkix.versionReader(NS, { "0": 0 });   // RFC 3274 sec. 1.1 -- version MUST be 0
 var AUTHENV_VERSION = pkix.versionReader(NS, { "0": 0 });
 var KEMRI_VERSION = pkix.versionReader(NS, { "0": 0 });
 
@@ -88,6 +89,7 @@ var OID_ENVELOPED_DATA = oid.byName("envelopedData");
 var OID_ENCRYPTED_DATA = oid.byName("encryptedData");
 var OID_AUTH_DATA = oid.byName("authData");                         // RFC 5652 sec. 9
 var OID_AUTH_ENVELOPED_DATA = oid.byName("authEnvelopedData");      // RFC 5083
+var OID_COMPRESSED_DATA = oid.byName("compressedData");             // RFC 3274
 var OID_DATA = oid.byName("data");
 var OID_ORI_KEM = oid.byName("kem");                                // id-ori-kem (RFC 9629)
 
@@ -1047,6 +1049,28 @@ var AUTH_ENVELOPED_DATA = schema.seq([
 //   SIGNED_DATA; id-envelopedData / id-encryptedData / id-ct-authData /
 //   id-ct-authEnvelopedData walk their schemas; the other PKCS#7 types are
 //   recognized-and-deferred; unknown OIDs are rejected.
+// CompressedData ::= SEQUENCE { version CMSVersion (0), compressionAlgorithm
+//   CompressionAlgorithmIdentifier, encapContentInfo EncapsulatedContentInfo }
+//   (RFC 3274 sec. 1.1). The eContent is an RFC 1950 ZLIB stream of the inner
+//   content. Parse decodes the structure and surfaces the raw compressionAlgorithm
+//   + eContent; the zlib-only algorithm check + the bounded inflate live in the
+//   pki.cms.decompress consuming operation, not the parser (mirroring how the
+//   content-encryption algorithm is validated by decrypt, not the envelope parse).
+var COMPRESSED_DATA = schema.seq([
+  schema.field("version", COMPRESSED_DATA_VERSION),
+  schema.field("compressionAlgorithm", ALGORITHM_IDENTIFIER),
+  schema.field("encapContentInfo", ENCAP_CONTENT_INFO),
+], {
+  assert: "sequence", code: "cms/bad-compressed-data", what: "CompressedData",
+  build: function (m) {
+    return {
+      version: m.fields.version.value,
+      compressionAlgorithm: m.fields.compressionAlgorithm.value.result,
+      encapContentInfo: m.fields.encapContentInfo.value.result,
+    };
+  },
+});
+
 var CONTENT_INFO = schema.seq([
   schema.field("contentType", schema.oidLeaf()),
   schema.field("content", schema.explicit(0, schema.any(), { code: "cms/not-a-content-info" })),
@@ -1060,6 +1084,7 @@ var CONTENT_INFO = schema.seq([
     else if (ct === OID_ENCRYPTED_DATA) inner = ENCRYPTED_DATA;
     else if (ct === OID_AUTH_DATA) inner = AUTHENTICATED_DATA;
     else if (ct === OID_AUTH_ENVELOPED_DATA) inner = AUTH_ENVELOPED_DATA;
+    else if (ct === OID_COMPRESSED_DATA) inner = COMPRESSED_DATA;
     if (inner === null) {
       if (DEFERRED.has(ct)) {
         // Coverage residual -- reached only when the OID is a registry entry (the guard above

package/lib/smime.js

@@ -240,9 +240,10 @@ async function verify(message, opts) {
   throw _err("smime/unsupported-type", "not a signed S/MIME message (Content-Type " + JSON.stringify(ct.type) + ")");
 }
 
-// The application/pkcs7-mime header for an enveloped S/MIME message (RFC 8551 sec. 3.2 / sec. 3.2.2).
-function _pkcs7MimeHead(smimeType) {
-  return Buffer.from("Content-Type: application/pkcs7-mime; smime-type=" + smimeType + "; name=smime.p7m\r\nContent-Transfer-Encoding: base64\r\nContent-Disposition: attachment; filename=smime.p7m\r\n\r\n", "latin1");
+// The application/pkcs7-mime header for an opaque S/MIME message (RFC 8551 sec. 3.2 / sec. 3.2.2). `name`
+// is the smime.p7m (enveloped) / smime.p7z (compressed) file name for the media type + Content-Disposition.
+function _pkcs7MimeHead(smimeType, name) {
+  return Buffer.from("Content-Type: application/pkcs7-mime; smime-type=" + smimeType + "; name=" + name + "\r\nContent-Transfer-Encoding: base64\r\nContent-Disposition: attachment; filename=" + name + "\r\n\r\n", "latin1");
 }
 
 // The smime-type for a CMS enveloped body, DERIVED from its OUTER content type (RFC 8551 sec. 3.2.2) --
@@ -307,7 +308,7 @@ async function encrypt(content, recipients, opts) {
   // RecipientInfos), never bare EncryptedData -- which is not an S/MIME construct (no smime-type maps to it).
   var recips = Array.isArray(recipients) ? recipients : [recipients];
   var der = _toBuf(await cms.encrypt(entity, recips, _cmsEncryptOpts(opts)));
-  var head = _pkcs7MimeHead(_envelopedTypeOf(der, "smime/bad-mime"));
+  var head = _pkcs7MimeHead(_envelopedTypeOf(der, "smime/bad-mime"), "smime.p7m");
   return _capped(Buffer.concat([head, _base64Body(der), mime.CRLF]));
 }
 
@@ -362,6 +363,75 @@ async function decrypt(message, keyMaterial, opts) {
   };
 }
 
+/**
+ * @primitive  pki.smime.compress
+ * @signature  pki.smime.compress(content, opts?) -> Promise<Buffer>
+ * @since      0.2.27
+ * @status     experimental
+ * @spec       RFC 8551, RFC 3274
+ * @related    pki.smime.decompress, pki.cms.compress
+ *
+ * Compress a MIME entity as an opaque compressed S/MIME message (RFC 8551 sec. 3.6). `content` is the
+ * payload -- a raw body wrapped as a `text/plain` entity by default, or the caller's own complete MIME
+ * entity when `opts.entity` is set. The entity is canonicalized (RFC 8551 sec. 3.1) and ZLIB-compressed
+ * into a CMS `CompressedData` (`pki.cms.compress`), carried opaque in one `application/pkcs7-mime;
+ * smime-type=compressed-data; name=smime.p7z` entity (base64). Compression is a size transform with NO
+ * integrity, confidentiality, or authentication (RFC 8551 sec. 2.4.5) -- sign or encrypt the result if
+ * you need protection. Returns the assembled message bytes; fail-closed with `SmimeError`.
+ *
+ * @opts entity      treat `content` as a complete MIME entity (default: wrap it as text/plain).
+ * @opts contentType the wrapped entity's MIME Content-Type (default `text/plain; charset=utf-8`).
+ * @opts level       forwarded to cms.compress: the DEFLATE compression level (an integer).
+ * @example
+ *   var z = await pki.smime.compress(Buffer.from("compress this message"));
+ */
+async function compress(content, opts) {
+  opts = opts || {};
+  var entity = _entityBytes(content, opts);
+  var cOpts = {};
+  if (opts.level !== undefined) cOpts.level = opts.level;
+  var der = _toBuf(await cms.compress(entity, cOpts));
+  var head = _pkcs7MimeHead("compressed-data", "smime.p7z");
+  return _capped(Buffer.concat([head, _base64Body(der), mime.CRLF]));
+}
+
+/**
+ * @primitive  pki.smime.decompress
+ * @signature  pki.smime.decompress(message, opts?) -> Promise<{ content, contentType, contentTypeName, compressionAlgorithm }>
+ * @since      0.2.27
+ * @status     experimental
+ * @spec       RFC 8551, RFC 3274
+ * @related    pki.smime.compress, pki.cms.decompress, pki.smime.verify, pki.smime.decrypt
+ *
+ * Decompress a compressed S/MIME message (RFC 8551 sec. 3.6) -- an `application/pkcs7-mime` entity whose
+ * base64 body is a CMS `CompressedData`. Returns the recovered inner MIME entity as `content` plus the
+ * inner `contentType` / `contentTypeName` and the `compressionAlgorithm`. The inflate is BOUNDED (a
+ * decompression-bomb defense, `cms/decompress-too-large`; `opts.maxOutputBytes` tightens it downward).
+ * The verdict carries NO `authenticated` / `valid` field -- CompressedData is not a security assertion
+ * (RFC 8551 sec. 2.4.5). A recovered content that is itself a signed or enveloped S/MIME message is
+ * returned as-is for the caller to feed back to `pki.smime.verify` / `pki.smime.decrypt` (no
+ * auto-recursion). Accepts OpenSSL's legacy `application/x-pkcs7-mime` and a missing `smime-type`.
+ *
+ * @opts maxOutputBytes forwarded to cms.decompress: lower the decompressed-output cap (a DoS bound; downward only).
+ * @example
+ *   var res = await pki.smime.decompress(compressedSmimeBytes);
+ *   res.content;   // the recovered inner MIME entity
+ */
+async function decompress(message, opts) {
+  opts = opts || {};
+  var ent = mime.parse(message, SmimeError, "smime/bad-mime");
+  var ct = ent.contentType;
+  if (!_isPkcs7(ct.type, "mime")) throw _err("smime/unsupported-type", "not a compressed S/MIME message (Content-Type " + JSON.stringify(ct.type) + ")");
+  // The smime-type header is advisory (the CMS body is authoritative) -- compare case-insensitively.
+  var st = ct.params["smime-type"];
+  if (st && st.toLowerCase() !== "compressed-data") throw _err("smime/unsupported-type", "unsupported smime-type " + JSON.stringify(st) + " (only compressed-data)");
+  var der = _decodeCms(ent);
+  var dOpts = {};
+  if (opts.maxOutputBytes !== undefined) dOpts.maxOutputBytes = opts.maxOutputBytes;
+  var res = await cms.decompress(der, dOpts);
+  return { content: res.content, contentType: res.contentType, contentTypeName: res.contentTypeName, compressionAlgorithm: res.compressionAlgorithm };
+}
+
 // Decode a CMS body per its Content-Transfer-Encoding (base64 is the S/MIME norm; 7bit/8bit/binary pass through).
 function _decodeCms(ent) {
   // guard.encoding.base64 is strict (no whitespace) and rejects via a (code,msg) FACTORY -- strip the
@@ -372,4 +442,4 @@ function _decodeCms(ent) {
 
 function _toBuf(v) { return Buffer.isBuffer(v) ? v : Buffer.from(v); }
 
-module.exports = { sign: sign, verify: verify, encrypt: encrypt, decrypt: decrypt };
+module.exports = { sign: sign, verify: verify, encrypt: encrypt, decrypt: decrypt, compress: compress, decompress: decompress };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.2.26",
+  "version": "0.2.27",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:f346b9f1-fcfc-449a-bd4f-4e1dfeb3209c",
+  "serialNumber": "urn:uuid:0c393bfc-d076-4de6-8aca-b3027ef12b2a",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-16T12:38:31.773Z",
+    "timestamp": "2026-07-16T13:18:09.528Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.2.26",
+      "bom-ref": "@blamejs/pki@0.2.27",
       "type": "application",
       "name": "pki",
-      "version": "0.2.26",
+      "version": "0.2.27",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.2.26",
+      "purl": "pkg:npm/%40blamejs/pki@0.2.27",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.2.26",
+      "ref": "@blamejs/pki@0.2.27",
       "dependsOn": []
     }
   ]