@blamejs/pki 0.3.0 → 0.3.1

package/CHANGELOG.md

@@ -4,7 +4,19 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## v0.3.0 — 2026-07-17
+## v0.3.1 — 2026-07-17
+
+pki.csr.sign issues PKCS#10 certification requests -- self-signed by the subject key for proof of possession, over every signature algorithm the toolkit supports.
+
+### Added
+
+- pki.csr.sign(spec, key, opts) builds and signs a PKCS#10 certification request -- self-signed by the subject's own key for proof of possession -- and returns DER, or a PEM CERTIFICATE REQUEST with opts.pem. The subject may be empty; requested v3 extensions (subject alternative names, key usage, extended key usage, basic constraints, certificate policies, subject key identifier, or pre-encoded Extension DER) ride in a PKCS#9 extensionRequest attribute a CA copies into the issued certificate, and an optional challengePassword is carried too. The signing algorithm is resolved from the subject key: RSA PKCS#1 v1.5 / PSS, ECDSA, EdDSA, ML-DSA, SLH-DSA, or a composite arm. Request parsing remains pki.schema.csr.parse.
+
+### Fixed
+
+- The certificate and certification-request distinguished-name and extension encoders now reject an unrecognized attribute, extended-key-usage purpose, or certificate-policy name at build time with a typed error, rather than emitting a malformed object identifier -- an unknown name in a pki.x509.sign or pki.csr.sign spec fails closed instead of producing an unparseable structure.
+
+## v0.3.0 — 2026-07-16
 
 pki.x509.sign issues X.509 certificates -- self-signed or CA-signed, over every signature algorithm the toolkit supports, from RSA and ECDSA through EdDSA, ML-DSA, and SLH-DSA.
 

package/README.md

@@ -223,6 +223,7 @@ is callable today; nothing below is a stub.
 | `pki.schema.engine` | The declarative ASN.1 structure-schema engine every format parser composes — `walk` / `encode` / `embeddedDer` plus the schema combinators |
 | `pki.path` | RFC 5280 §6 certification-path validation — `validate` runs the §6.1 state machine (signature chaining across RSA, ECDSA, EdDSA, ML-DSA, SLH-DSA and hybrid composite ML-DSA signatures — a composite is accepted only when **both** its post-quantum and traditional components verify; validity windows, name chaining, basic constraints and path length, key usage, name constraints, the certificate-policy tree) over an ordered path and a trust anchor, returning a structured verdict with per-check reason codes, and enforces a `pki.trust` anchor's per-purpose distrust-after dates and delegator purposes via `checkPurpose`; `crlChecker` supplies CRL-based revocation — including partitioned/sharded CRLs, whose §6.3.3 Distribution Point ↔ IDP correspondence lets a corresponding full-reason shard establish non-revocation — and `ocspChecker` supplies OCSP-based revocation (RFC 6960 — CertID binding, responder authorization, signature, currency) over the same pluggable hook. Pure and re-entrant, fail-closed — `validate`, `crlChecker`, `ocspChecker` |
 | `pki.x509` | X.509 certificate issuance (RFC 5280 §4) — `sign(spec, issuer, opts)` builds and signs a certificate: a `spec` of subject (a common-name string, an array of RDNs, or raw Name DER), the public key being certified, the validity window, an optional serial, and an optional `extensions` object; an `issuer` that is a key alone (self-signed — issuer equals subject, signed with that key) or a name + public key + key, or an issuing certificate + key (CA-signed). The signature algorithm is resolved from the signing key through the shared registry, so RSA (PKCS#1 v1.5 / PSS via `opts.pss`), ECDSA P-256/384/521, Ed25519, Ed448, ML-DSA-44/65/87, the twelve SLH-DSA sets, and the composite arms all issue without a per-algorithm branch. It encodes basic constraints, key usage, extended key usage, subject and authority key identifiers (the SKI auto-derived by SHA-1 of the subject key), subject alternative names, and certificate policies from the spec — any other extension supplied as pre-encoded DER — derives the version from the field set, and enforces the serial bounds, the UTCTime/GeneralizedTime cutover, the DER default omissions, and the CA cross-field rules; a violation throws a typed `CertificateError`. Returns DER, or a PEM `CERTIFICATE` with `opts.pem`; every arm is independently verified by OpenSSL. Parsing stays at `pki.schema.x509.parse` — `sign` |
+| `pki.csr` | PKCS#10 certification-request issuance (RFC 2986 / RFC 2985) — `sign(spec, key, opts)` builds and signs a `CertificationRequest`: a `spec` of subject (a common-name string, an array of RDNs, or raw Name DER; may be empty), the public key being certified, an optional `extensionRequest` (requested v3 extensions — subject alternative names, key usage, extended key usage, basic constraints, certificate policies, subject key identifier, or an array of pre-encoded Extension DER — that a CA copies into the issued certificate), and an optional `challengePassword`. `key` (or `{ key }`) is the subject's own private key: the request is self-signed to prove possession of the private half of `subjectPublicKey`, and that proof is verified before the request is returned (what `openssl req -verify` checks). The signature algorithm is resolved from the subject key, so RSA (PKCS#1 v1.5 / PSS via `opts.pss`), ECDSA, EdDSA, ML-DSA, SLH-DSA, and the composite arms all sign without a per-algorithm branch. Returns DER, or a PEM `CERTIFICATE REQUEST` with `opts.pem`; malformed input throws a typed `CsrError`. Parsing stays at `pki.schema.csr.parse` — `sign` |
 | `pki.cms` | RFC 5652 §5 CMS SignedData signing + signature verification — `sign(content, signers, opts)` produces a SignedData (attached or detached, one or many signers, RSA / RSASSA-PSS / ECDSA / EdDSA, the post-quantum ML-DSA-44/65/87 (RFC 9882) and SLH-DSA (all twelve FIPS 205 sets, RFC 9814), and composite ML-DSA (pairing ML-DSA with a traditional RSA / ECDSA / EdDSA — accepted only when **both** components verify — draft-ietf-lamps-cms-composite-sigs)); it builds the signed attributes (content-type, message-digest, signing-time) as canonical DER, signs the exact §5.4 preimage, and emits a DER `Buffer` or PEM. `verify(input, opts)` parses a SignedData over the strict `pki.schema.cms` codec, locates each SignerInfo's signer certificate by its issuerAndSerialNumber or subjectKeyIdentifier, and checks the signature over the exact §5.4 preimage: when signed attributes are present it confirms the message-digest attribute equals the content digest and verifies over the DER re-encoding of the SignedAttributes (the on-wire `[0]` tag replaced by a universal SET OF), otherwise directly over the content. It returns a per-signer verdict with the matched signer certificate; it does not chain that certificate to a trust anchor — that is the caller's step through `pki.path.validate`. **Content encryption** (RFC 5652/5083/5084/9629): `encrypt(content, recipients, opts)` produces an EnvelopedData, AuthEnvelopedData (AES-GCM, the authenticated default), or EncryptedData — recipients auto-dispatch off the certificate key to key-transport (RSAES-OAEP; v1.5 never emitted), key-agreement (ephemeral-static ECDH over P-256/384/521 with the X9.63 KDF, and X25519/X448 with HKDF), symmetric key-wrap, password (PBKDF2 + RFC 3211 PWRI-KEK), or the post-quantum ML-KEM KEMRecipientInfo (RFC 9629/9936) — one fresh content key wrapped for every recipient. `decrypt(input, keyMaterial, opts)` recovers the content through the matching arm and returns it with an `authenticated` flag; every secret-dependent failure collapses to one uniform `cms/decrypt-failed` verdict (Bleichenbacher / EFAIL / password-oracle freedom), and PKCS#1 v1.5 is decrypt-only under the RFC 3218 implicit-rejection countermeasure. **Compression** (RFC 3274): `compress(content, opts)` / `decompress(input, opts)` produce and consume a CompressedData (ZLIB, version 0, id-alg-zlibCompress); decompress bounds the uncompressed output at 16 MiB and stops before it is materialized, so a decompression bomb fails closed as `cms/decompress-too-large` — a size transform with no integrity/confidentiality (RFC 8551 §2.4.5). Fail-closed with typed `cms/*` errors — `sign`, `verify`, `encrypt`, `decrypt`, `compress`, `decompress` |
 | `pki.smime` | RFC 8551 S/MIME message assembly, verification, encryption, and compression over the CMS layer — `sign(content, signers, opts)` wraps a MIME entity as a signed S/MIME message in either form: `multipart/signed` (clear-signed — the content stays readable in any MUA, a detached CMS SignedData rides alongside as `application/pkcs7-signature` with a matching `micalg`) or `application/pkcs7-mime; smime-type=signed-data` (opaque — the whole entity is a base64 CMS SignedData). The signed bytes are the entity's RFC 8551 §3.1.1 canonical form (CRLF line endings); `verify(message, opts)` unwraps both forms and recomputes over the same canonicalizer, so a transport that re-wraps line endings still verifies and a tampered part fails. `encrypt(content, recipients, opts)` envelopes a MIME entity as an opaque `application/pkcs7-mime` message and `decrypt(message, keyMaterial, opts)` opens one — `smime-type=authEnveloped-data` (AES-GCM, confidentiality and integrity, the default) or `smime-type=enveloped-data` (AES-CBC, confidentiality only, so `decrypt` reports `authenticated: false`, the §3.3 no-integrity caveat); the `smime-type` is derived from the CMS body, not the header, and decryption is fail-closed and oracle-free. The crypto is entirely `pki.cms.sign` / `verify` / `encrypt` / `decrypt` — any RSA / RSASSA-PSS / ECDSA / EdDSA / ML-DSA / SLH-DSA signer and any RSA-OAEP / ECDH / X25519 / X448 / AES-KW / PBKDF2 / ML-KEM recipient carries through (algorithm-agnostic). Like `cms.verify`, `verify` returns the per-signer cryptographic verdict plus the recovered content; chaining a signer to a trust anchor is the caller's `pki.path.validate` step. `compress(content, opts)` / `decompress(message, opts)` add the opaque `application/pkcs7-mime; smime-type=compressed-data; name=smime.p7z` frame (RFC 8551 §3.6, RFC 3274) — a size transform with no integrity/confidentiality (§2.4.5), decompress bounded against a bomb; the recovered content, which may itself be signed or enveloped, is returned for the caller to re-verify. Bidirectionally interoperable with `openssl smime` / `openssl cms`. Fail-closed with typed `smime/*` errors — `sign`, `verify`, `encrypt`, `decrypt`, `compress`, `decompress` |
 | `pki.tsp` | RFC 3161 Time-Stamp Protocol — `sign(messageImprint, tsa, opts)` produces a TimeStampToken: a CMS SignedData (over `pki.cms.sign`) whose content is a `TSTInfo` carrying the timestamped message imprint, the TSA policy, a serial number, and `genTime` (with optional accuracy / nonce / ordering), plus the RFC 3161 §2.4.2 signing-certificate attribute binding the token to the TSA certificate (SHA-2 imprints, any `pki.cms.sign` TSA key). `request` / `parseRequest` build and parse the TimeStampReq a client sends (imprint, requested policy, nonce, certReq), `response` / `parseResponse` the TimeStampResp a TSA returns — a granted status wrapping a token, or a rejection with PKIStatus and failure info, the §2.4.2 status↔token coupling enforced in both directions. `verify(token, data, opts)` verifies a token fail-closed: the CMS signature over the exact signed bytes, the message imprint recomputed from the data, the TSTInfo content type, the ESSCertID(V2) binding to the TSA certificate, the §2.3 critical timeStamping-only extendedKeyUsage, the request nonce when used, and — with a trust anchor supplied — full certification-path validation of the TSA certificate at the token's `genTime`, returning `{ valid, genTime, serialNumber, tstInfo, … }` — `sign`, `request`, `parseRequest`, `response`, `parseResponse`, `verify` |

package/index.js

@@ -41,6 +41,7 @@ var smime     = require("./lib/smime");
 var tsp       = require("./lib/tsp-sign");
 var ocsp      = require("./lib/ocsp");
 var x509      = require("./lib/x509-sign");
+var csr       = require("./lib/csr-sign");
 var merkle    = require("./lib/merkle");
 var shbs      = require("./lib/shbs");
 var hpke      = require("./lib/hpke");
@@ -87,6 +88,11 @@ module.exports = {
   // signature algorithm the registry resolves (RSA/ECDSA/EdDSA/ML-DSA/SLH-DSA/composite).
   // Parsing lives at pki.schema.x509.parse.
   x509:      x509,
+  // `csr` is the PKCS#10 certification-request producing side -- pki.csr.sign builds and
+  // signs a CertificationRequest (RFC 2986), self-signed by the subject key for proof of
+  // possession, with requested extensions in a PKCS#9 extensionRequest attribute. Parsing
+  // lives at pki.schema.csr.parse.
+  csr:       csr,
   // `merkle` is the RFC 6962 / RFC 9162 Merkle-tree proof-verification core --
   // pki.merkle.leafHash / nodeHash / emptyRootHash build the domain-separated
   // (0x00 leaf / 0x01 node) SHA-256 tree hashes; pki.merkle.verifyInclusion and

package/lib/csr-sign.js

@@ -0,0 +1,209 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+
+/**
+ * @module     pki.csr
+ * @nav        Signing
+ * @title      Certification requests
+ * @intro The PKCS#10 certification-request producing side. `pki.csr.sign` builds a
+ *   `CertificationRequestInfo`, signs it with the SUBJECT's own private key (proof of possession -- a
+ *   CSR has no issuer), and emits a `CertificationRequest` (RFC 2986) that `pki.schema.csr.parse`,
+ *   OpenSSL, and a CA enrollment pipeline all accept. Requested v3 extensions ride in a PKCS#9
+ *   `extensionRequest` attribute (RFC 2985) a CA copies into the issued certificate. Parsing lives at
+ *   `pki.schema.csr.parse`.
+ * @spec RFC 2986
+ * @card Build and sign a PKCS#10 certification request (proof of possession by the subject key).
+ */
+//
+// The signature algorithm resolves from the SUBJECT public key through the shared sign-scheme registry
+// (RSA / ECDSA / EdDSA / ML-DSA / SLH-DSA / composite), so there is no per-algorithm branch here. The
+// distinguished-name / extension / SPKI encoders + the post-sign self-check are the shared lib/pki-build
+// primitives (the same ones pki.x509.sign composes), bound to the csr namespace.
+
+var asn1 = require("./asn1-der");
+var oid = require("./oid");
+var csr = require("./schema-csr");
+var signScheme = require("./sign-scheme");
+var pkix = require("./schema-pkix");
+var pkiBuild = require("./pki-build");
+var frameworkError = require("./framework-error");
+
+var CsrError = frameworkError.CsrError;
+var b = asn1.build;
+function _err(code, message, cause) { return new CsrError(code, message, cause); }
+function _signE(kind, message, cause) { return new CsrError("csr/" + kind, message, cause); }
+function O(n) { return oid.byName(n); }
+
+var NS = pkix.makeNS("csr", CsrError, oid);
+var EXT_DECODERS = pkix.certExtensionDecoders(NS).byOid;
+var _b = pkiBuild.makeBuilder({
+  ErrorClass: CsrError, prefix: "csr", O: O, NS: NS,
+  NAME_SCHEMA: pkix.name(NS), SPKI_SCHEMA: pkix.spki(NS), EXT_DECODERS: EXT_DECODERS,
+});
+
+// The requested-extension object keys (a CSR REQUESTS extensions; it does NOT enforce issuance policy,
+// so there are no CA cross-field gates and no authorityKeyIdentifier auto-derivation).
+var KNOWN_REQ_EXT_KEYS = {
+  subjectAltName: 1, keyUsage: 1, keyUsageCritical: 1, extendedKeyUsage: 1, extendedKeyUsageCritical: 1,
+  basicConstraints: 1, certificatePolicies: 1, certificatePoliciesCritical: 1, subjectKeyIdentifier: 1,
+};
+// challengePassword DirectoryString charset (PrintableString set); anything else uses UTF8String.
+var PRINTABLE_RE = /^[A-Za-z0-9 '()+,\-./:=?]*$/;
+
+// attributes ::= [0] IMPLICIT SET OF Attribute (RFC 2986). The IMPLICIT tag replaces the universal SET,
+// so it is a context-constructed [0] whose DER-sorted members ARE the SET-OF; empty -> A0 00.
+function _implicitSetOf0(members) {
+  return b.contextConstructed(0, Buffer.concat(members.slice().sort(Buffer.compare)));
+}
+
+// The requested v3 Extensions (a bare SEQUENCE OF Extension, RFC 2985 sec. 5.4.2) from the object form,
+// or an array of pre-encoded Extension DER. Reuses the shared extension-value encoders; no CA gates.
+function _buildRequestedExtensions(extSpec, subjectSpki) {
+  if (Array.isArray(extSpec)) {
+    if (!extSpec.length) throw _err("csr/bad-input", "extensionRequest must carry at least one extension");
+    var seen = {};
+    return b.sequence(extSpec.map(function (e, i) {
+      var der = _b.reqDer(e, "extension");
+      _b.assertValidExtension(der, i);
+      var n = asn1.decode(der);
+      var extnId = asn1.read.oid(n.children[0]);
+      if (seen[extnId]) throw _err("csr/bad-input", "duplicate extension " + extnId + " in extensionRequest (RFC 5280 sec. 4.2)");
+      seen[extnId] = true;
+      // Fully validate a RECOGNIZED extension via its real RFC 5280 sec. 4.2.1 value decoder (a malformed
+      // value fails closed with the decoder's typed code); an unrecognized extension stays opaque.
+      var dec = EXT_DECODERS[extnId];
+      if (dec) {
+        try { dec(asn1.read.octetString(n.children[n.children.length - 1])); }
+        catch (err) { if (err instanceof CsrError) throw err; throw _err("csr/bad-input", "pre-encoded " + (oid.name(extnId) || extnId) + " extension value is malformed", err); }
+      }
+      return b.raw(der);
+    }));
+  }
+  if (!extSpec || typeof extSpec !== "object") throw _err("csr/bad-input", "extensionRequest must be an object or an array of pre-encoded Extension DER");
+  Object.keys(extSpec).forEach(function (k) {
+    if (!KNOWN_REQ_EXT_KEYS[k]) throw _err("csr/bad-input", "unknown extensionRequest extension " + JSON.stringify(k) + "; pass a pre-encoded Extension DER via the array form for a custom extension");
+  });
+  var out = [];
+  if (extSpec.subjectKeyIdentifier != null) out.push(_b.ext(O("subjectKeyIdentifier"), false, _b.extSki(_b.skiKeyId(extSpec.subjectKeyIdentifier, subjectSpki))));
+  if (extSpec.keyUsage != null) out.push(_b.ext(O("keyUsage"), extSpec.keyUsageCritical !== false, _b.extKeyUsage(extSpec.keyUsage)));
+  if (extSpec.extendedKeyUsage != null) out.push(_b.ext(O("extKeyUsage"), !!extSpec.extendedKeyUsageCritical, _b.extExtKeyUsage(extSpec.extendedKeyUsage)));
+  if (extSpec.basicConstraints != null) { _b.validateBcSpec(extSpec.basicConstraints); out.push(_b.ext(O("basicConstraints"), extSpec.basicConstraints.critical !== false, _b.extBasicConstraints(extSpec.basicConstraints))); }
+  if (extSpec.subjectAltName != null) out.push(_b.ext(O("subjectAltName"), false, _b.extSan(extSpec.subjectAltName)));
+  if (extSpec.certificatePolicies != null) out.push(_b.ext(O("certificatePolicies"), !!extSpec.certificatePoliciesCritical, _b.extCertPolicies(extSpec.certificatePolicies)));
+  if (!out.length) throw _err("csr/bad-input", "extensionRequest must request at least one extension");
+  return b.sequence(out);
+}
+
+// challengePassword ::= DirectoryString bounded 1..255 (RFC 2985 sec. 5.4.1). PrintableString when the
+// value is in that charset, else UTF8String; never a Teletex/BMP/Universal string for a new value.
+function _challengePassword(pw) {
+  if (typeof pw !== "string" || pw.length < 1 || pw.length > 255) throw _err("csr/bad-input", "challengePassword must be a 1..255 character string (RFC 2985 sec. 5.4.1)");
+  return PRINTABLE_RE.test(pw) ? b.printable(pw) : b.utf8(pw);
+}
+
+/**
+ * @primitive pki.csr.sign
+ * @signature pki.csr.sign(spec, key, opts?) -> Promise<Buffer|string>
+ * @since 0.3.1
+ * @status stable
+ * @spec RFC 2986, RFC 2985
+ * @defends forged-certification-request (CWE-347)
+ * @related pki.schema.csr.parse, pki.x509.sign
+ *
+ * Build, sign, and DER-encode a PKCS#10 certification request. `spec` describes the request -- `subject`
+ * (a common-name string, an array of RDNs, or raw Name DER; MAY be empty), `subjectPublicKey` (the SPKI
+ * DER of the key being certified), and optional `extensionRequest` (requested v3 extensions -- an object
+ * of subjectAltName / keyUsage / extendedKeyUsage / basicConstraints / certificatePolicies /
+ * subjectKeyIdentifier, or an array of pre-encoded Extension DER) and `challengePassword`. `key` (or
+ * `{ key }`) is the SUBJECT's own PKCS#8 private key / WebCrypto CryptoKey -- the request is self-signed
+ * to prove possession of the private half of `subjectPublicKey`, and that proof is verified before the
+ * request is returned. The signature algorithm is resolved from the subject key (RSA PKCS#1 v1.5 or PSS,
+ * ECDSA, EdDSA, ML-DSA, SLH-DSA, or a composite arm). Returns DER, or a PEM `CERTIFICATE REQUEST` with
+ * `opts.pem`. Malformed input throws a typed `CsrError`. Certificate-request parsing is `pki.schema.csr.parse`.
+ *
+ * @opts
+ *   - `pem` (boolean) -- return a PEM `CERTIFICATE REQUEST` string instead of DER.
+ *   - `pss` (boolean) -- sign an RSA key with RSASSA-PSS rather than PKCS#1 v1.5.
+ *   - `digestAlgorithm` (string) -- override the message digest where the algorithm permits a choice.
+ * @example
+ *   var req = await pki.csr.sign(
+ *     { subject: "req.example.com", subjectPublicKey: signerSpki,
+ *       extensionRequest: { subjectAltName: [{ dNSName: "req.example.com" }] } },
+ *     { key: signerKeyPkcs8 });
+ *   pki.schema.csr.parse(req).subject.dn;   // "CN=req.example.com"
+ */
+function sign(spec, key, opts) {
+  return Promise.resolve().then(function () { return _sign(spec, key, opts); });
+}
+
+function _sign(spec, key, opts) {
+  opts = opts || {};
+  if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("csr/bad-input", "the certification-request spec must be an object");
+  // Reject a typo'd spec field at config-time rather than silently dropping it (a misspelled `subjcet`
+  // would otherwise yield an empty-subject request).
+  Object.keys(spec).forEach(function (k) {
+    if (k !== "subject" && k !== "subjectPublicKey" && k !== "extensionRequest" && k !== "challengePassword" && k !== "attributes") throw _err("csr/bad-input", "unknown spec field " + JSON.stringify(k));
+  });
+  // The signing key is the second argument (a PKCS#8 key / CryptoKey / composite key pair), or { key }.
+  var signingKey = (key && typeof key === "object" && !Buffer.isBuffer(key) && !(key instanceof Uint8Array) && key.type == null && "key" in key) ? key.key : key;
+  if (signingKey == null) throw _err("csr/bad-input", "a signing key (the subject's private key) is required");
+
+  var subjectSpki = _b.reqDer(spec.subjectPublicKey, "spec.subjectPublicKey (the SPKI DER of the requested key)");
+  _b.assertValidSpki(subjectSpki, "spec.subjectPublicKey");
+  var subjectDer = _b.encodeName(spec.subject == null ? [] : spec.subject);
+
+  // attributes: extensionRequest + challengePassword + pre-encoded opaque Attribute DER (the escape
+  // hatch). A recognized attribute may appear at most once (RFC 2985 SINGLE VALUE + producer hygiene).
+  var attrs = [], seenAttr = {};
+  function addAttr(attrType, valueTlv) {
+    if (seenAttr[attrType]) throw _err("csr/bad-input", "duplicate " + (oid.name(attrType) || attrType) + " attribute");
+    seenAttr[attrType] = true;
+    attrs.push(b.sequence([b.oid(attrType), b.set([valueTlv])]));   // Attribute ::= SEQUENCE { type, SET OF value }
+  }
+  if (spec.extensionRequest != null) addAttr(O("extensionRequest"), _buildRequestedExtensions(spec.extensionRequest, subjectSpki));
+  if (spec.challengePassword != null) addAttr(O("challengePassword"), _challengePassword(spec.challengePassword));
+  if (spec.attributes != null) {
+    if (!Array.isArray(spec.attributes)) throw _err("csr/bad-input", "spec.attributes must be an array of pre-encoded Attribute DER");
+    spec.attributes.forEach(function (a, i) {
+      var der = _b.reqDer(a, "attribute [" + i + "]");
+      var n;
+      try { n = asn1.decode(der); }
+      catch (e) { throw _err("csr/bad-input", "pre-encoded attribute [" + i + "] is not valid DER", e); }
+      if (n.tagNumber !== asn1.TAGS.SEQUENCE || n.tagClass !== "universal" || !n.children || n.children.length !== 2 || n.children[1].tagNumber !== asn1.TAGS.SET) throw _err("csr/bad-input", "pre-encoded attribute [" + i + "] must be an Attribute SEQUENCE { type OID, SET OF value }");
+      var at;
+      try { at = asn1.read.oid(n.children[0]); }
+      catch (e) { throw _err("csr/bad-input", "pre-encoded attribute [" + i + "] type is not an OBJECT IDENTIFIER", e); }
+      // A type with a dedicated typed spec field must go through that field so its value syntax is always
+      // enforced (RFC 2985 sec. 5.4): the opaque escape hatch is for UNRECOGNIZED attribute types only and
+      // must never carry a recognized type with an unvalidated value the strict parser would then reject.
+      if (at === O("extensionRequest")) throw _err("csr/bad-input", "pass requested extensions via spec.extensionRequest, not a pre-encoded extensionRequest attribute");
+      if (at === O("challengePassword")) throw _err("csr/bad-input", "pass the challenge password via spec.challengePassword, not a pre-encoded challengePassword attribute");
+      // Attribute ::= SEQUENCE { type, values SET SIZE(1..MAX) }: an empty value SET is malformed and the
+      // strict parser rejects it, so reject at build time -- a signed request must always round-trip.
+      if (!n.children[1].children || n.children[1].children.length === 0) throw _err("csr/bad-input", "pre-encoded attribute [" + i + "] value SET must contain at least one value (RFC 2986 SET SIZE(1..MAX))");
+      if (seenAttr[at]) throw _err("csr/bad-input", "duplicate " + (oid.name(at) || at) + " attribute");
+      seenAttr[at] = true;
+      attrs.push(b.raw(der));
+    });
+  }
+
+  // Resolve the signature scheme from the SUBJECT public key (the request proves possession of its private half).
+  var scheme = signScheme.resolveSignScheme(_b.certLikeFromSpki(subjectSpki), { combinedRsaSig: true, pss: opts.pss, digestAlgorithm: opts.digestAlgorithm }, true, _signE);
+
+  // CertificationRequestInfo ::= SEQUENCE { version INTEGER(0), subject, subjectPKInfo, attributes [0] }.
+  var criDer = b.sequence([b.integer(0n), subjectDer, b.raw(subjectSpki), _implicitSetOf0(attrs)]);
+
+  return signScheme.signOverTbs(scheme, signingKey, criDer, _signE).then(function (sig) {
+    // Proof of possession: the signature MUST verify under the subject public key (what openssl req -verify checks).
+    return Promise.resolve(_b.assertSignatureVerifies(criDer, sig, subjectSpki, scheme)).then(function () {
+      var der = b.sequence([criDer, scheme.sigAlgId, b.bitString(sig, 0)]);
+      return opts.pem ? csr.pemEncode(der, "CERTIFICATE REQUEST") : der;
+    });
+  }, function (e) {
+    if (e instanceof CsrError) throw e;
+    throw _err("csr/bad-input", "signing the certification request failed -- the signing key does not match the subject public key or is invalid", e);
+  });
+}
+
+module.exports = { sign: sign };

package/lib/pki-build.js

@@ -0,0 +1,270 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- the ENCODE-direction sibling of schema-pkix.js (which is decode-only). `makeBuilder(ctx)`
+// binds a domain namespace once and returns the shared PKIX producing primitives every signer module
+// composes: the distinguished-name encoder, the GeneralName + RFC 5280 sec. 4.2.1 extension-value
+// encoders, the embedded-input validators (a raw Name / a SubjectPublicKeyInfo / a pre-encoded Extension
+// run through the SAME parser the decoder uses), the sign-scheme bridge, and the post-sign signature
+// self-check (the key-match / proof-of-possession verify). Each is parameterized on the CALLER's error
+// class + code prefix, so pki.x509.sign keeps x509/* codes and pki.csr.sign keeps csr/*.
+
+var asn1 = require("./asn1-der");
+var schema = require("./schema-engine");
+var compositeSig = require("./composite-sig");
+var nodeCrypto = require("crypto");
+
+var b = asn1.build;
+
+// KeyUsage named-bit positions (RFC 5280 sec. 4.2.1.3); contentCommitment is the RFC 5280 rename of the
+// X.509 nonRepudiation bit (1).
+var KU_BIT = {
+  digitalSignature: 0, nonRepudiation: 1, contentCommitment: 1, keyEncipherment: 2,
+  dataEncipherment: 3, keyAgreement: 4, keyCertSign: 5, cRLSign: 6, encipherOnly: 7, decipherOnly: 8,
+};
+
+// makeBuilder(ctx) -> the bound producing primitives. ctx = { ErrorClass, prefix, O, NS, NAME_SCHEMA,
+// SPKI_SCHEMA, EXT_DECODERS }. `E(kind, msg, cause)` builds a `<prefix>/<kind>` typed error.
+function makeBuilder(ctx) {
+  var ErrorClass = ctx.ErrorClass, O = ctx.O, NS = ctx.NS;
+  var NAME_SCHEMA = ctx.NAME_SCHEMA, SPKI_SCHEMA = ctx.SPKI_SCHEMA;
+  function E(kind, message, cause) { return new ErrorClass(ctx.prefix + "/" + kind, message, cause); }
+  function code(kind) { return ctx.prefix + "/" + kind; }
+
+  // ---- distinguished name encoding (RFC 5280 sec. 4.1.2.4) ----
+  // countryName is a PrintableString SIZE(2), emailAddress an IA5String; every other new-name attribute
+  // is a UTF8String (Teletex/BMP/Universal are backward-compat only and never emitted).
+  function atvString(attrName, value) {
+    if (attrName === "countryName") {
+      if (String(value).length !== 2) throw E("bad-name", "countryName must be a two-letter ISO 3166 code (PrintableString SIZE(2))");
+      return b.printable(value);
+    }
+    if (attrName === "emailAddress") return b.ia5(value);
+    return b.utf8(value);
+  }
+  function encodeAtv(attrName, value) {
+    if (value == null || value === "") throw E("bad-name", "the " + attrName + " attribute value must be a non-empty string");
+    // oid.byName returns undefined (does not throw) for an unrecognized name -- reject it explicitly.
+    var typeOid = O(attrName);
+    if (typeOid == null) throw E("bad-name", "unknown distinguished-name attribute " + JSON.stringify(attrName));
+    var valueTlv;
+    try { valueTlv = atvString(attrName, value); }
+    catch (e) { if (e instanceof ErrorClass) throw e; throw E("bad-name", "the " + attrName + " value has characters invalid for its string type", e); }
+    return b.sequence([b.oid(typeOid), valueTlv]);
+  }
+  function encodeRdn(rdnSpec) {
+    if (!rdnSpec || typeof rdnSpec !== "object" || Buffer.isBuffer(rdnSpec)) throw E("bad-name", "each RDN must be an object of { attributeName: value }");
+    var keys = Object.keys(rdnSpec);
+    if (!keys.length) throw E("bad-name", "an RDN must carry at least one attribute");
+    return b.set(keys.map(function (k) { return encodeAtv(k, rdnSpec[k]); }));
+  }
+  // A DN spec -> RDNSequence DER. A string is shorthand for a single commonName RDN; a Buffer is raw
+  // pre-encoded Name DER (validated through the parser). An empty array yields an empty RDNSequence.
+  function encodeName(spec) {
+    if (Buffer.isBuffer(spec)) { assertValidNameDer(spec); return spec; }
+    if (typeof spec === "string") spec = [{ commonName: spec }];
+    if (!Array.isArray(spec)) throw E("bad-name", "a name must be a string, an array of RDNs, or raw Name DER");
+    return b.sequence(spec.map(encodeRdn));
+  }
+  // Full validation of a raw Name DER: walk it through the exact RDNSequence parser the decoder uses.
+  function assertValidNameDer(der) {
+    var node;
+    try { node = asn1.decode(der); }
+    catch (e) { throw E("bad-name", "the raw Name DER is not valid DER", e); }
+    try { schema.walk(NAME_SCHEMA, node, NS); }
+    catch (e) {
+      if (e instanceof ErrorClass || (e && e.name === "Asn1Error")) throw e;
+      throw E("bad-name", "the raw Name DER is not a well-formed distinguished name", e);
+    }
+  }
+  function isEmptyName(nameDer) { return asn1.decode(nameDer).children.length === 0; }
+
+  // ---- GeneralName encoding (RFC 5280 sec. 4.2.1.6) ----
+  function ia5Content(s) {
+    s = String(s);
+    for (var i = 0; i < s.length; i++) {
+      if (s.charCodeAt(i) > 0x7F) throw E("bad-input", "value requires 7-bit ASCII (IA5String): " + JSON.stringify(s));
+    }
+    return Buffer.from(s, "latin1");
+  }
+  function encodeGeneralName(entry) {
+    if (!entry || typeof entry !== "object" || Buffer.isBuffer(entry)) throw E("bad-input", "a GeneralName must be an object with exactly one name form");
+    var keys = Object.keys(entry);
+    if (keys.length !== 1) throw E("bad-input", "a GeneralName entry must have exactly one form, got " + keys.length);
+    var k = keys[0], v = entry[k];
+    if (v == null || v === "") throw E("bad-input", "an empty GeneralName value is not permitted (RFC 5280 sec. 4.2.1.6)");
+    switch (k) {
+      case "rfc822Name": return b.contextPrimitive(1, ia5Content(v));
+      case "dNSName": return b.contextPrimitive(2, ia5Content(v));
+      case "uniformResourceIdentifier": case "uri": return b.contextPrimitive(6, ia5Content(v));
+      case "iPAddress":
+        if (!Buffer.isBuffer(v) || (v.length !== 4 && v.length !== 16)) throw E("bad-input", "iPAddress must be a 4- or 16-octet Buffer");
+        return b.contextPrimitive(7, v);
+      case "directoryName": return b.explicit(4, encodeName(v));   // Name is a CHOICE -> the context tag is EXPLICIT
+      default: throw E("bad-input", "unsupported GeneralName form " + JSON.stringify(k) + " (supported: rfc822Name, dNSName, uniformResourceIdentifier, iPAddress, directoryName)");
+    }
+  }
+
+  // ---- extension-value encoders (the inverse of certExtensionDecoders) ----
+  function extKeyUsage(names) {
+    if (!Array.isArray(names) || !names.length) throw E("bad-input", "keyUsage must assert at least one bit (RFC 5280 sec. 4.2.1.3)");
+    var positions = names.map(function (n) {
+      var pos = KU_BIT[n];
+      if (pos == null) throw E("bad-input", "unknown keyUsage bit " + JSON.stringify(n));
+      return pos;
+    });
+    return b.namedBitString(positions);
+  }
+  function extExtKeyUsage(names) {
+    if (!Array.isArray(names) || !names.length) throw E("bad-input", "extendedKeyUsage must list at least one KeyPurposeId");
+    return b.sequence(names.map(function (n) {
+      var purposeOid = O(n);
+      if (purposeOid == null) throw E("bad-input", "unknown extendedKeyUsage purpose " + JSON.stringify(n));
+      return b.oid(purposeOid);
+    }));
+  }
+  function validateBcSpec(bc) {
+    if (bc.cA != null && typeof bc.cA !== "boolean") throw E("bad-input", "basicConstraints cA must be a boolean");
+    if (bc.critical != null && typeof bc.critical !== "boolean") throw E("bad-input", "basicConstraints critical must be a boolean");
+    if (bc.pathLen != null) pathLen(bc.pathLen);
+    Object.keys(bc).forEach(function (k) {
+      if (k !== "cA" && k !== "pathLen" && k !== "critical") throw E("bad-input", "unknown basicConstraints field " + JSON.stringify(k));
+    });
+  }
+  function extBasicConstraints(spec) {
+    var children = [];
+    if (spec.cA === true) children.push(b.boolean(true));   // cA=FALSE omitted (DER DEFAULT)
+    if (spec.pathLen != null) children.push(b.integer(pathLen(spec.pathLen)));
+    return b.sequence(children);
+  }
+  function pathLen(v) {
+    if (typeof v !== "number" || !isFinite(v) || v < 0 || (v | 0) !== v) throw E("bad-input", "basicConstraints pathLenConstraint must be a non-negative integer");
+    return BigInt(v);
+  }
+  function extSki(keyid) { return b.octetString(keyid); }
+  function extAki(keyid) { return b.sequence([b.contextPrimitive(0, keyid)]); }   // keyIdentifier [0] IMPLICIT OCTET STRING
+  function extSan(entries) {
+    if (!Array.isArray(entries) || !entries.length) throw E("bad-input", "subjectAltName must carry at least one GeneralName");
+    return b.sequence(entries.map(encodeGeneralName));
+  }
+  function extCertPolicies(names) {
+    if (!Array.isArray(names) || !names.length) throw E("bad-input", "certificatePolicies must list at least one policy OID");
+    var seen = {};
+    return b.sequence(names.map(function (n) {
+      var pOid = O(n);
+      if (pOid == null) throw E("bad-input", "unknown certificate policy " + JSON.stringify(n));
+      if (seen[pOid]) throw E("bad-input", "duplicate certificate policy " + JSON.stringify(n) + " (RFC 5280 sec. 4.2.1.4)");
+      seen[pOid] = true;
+      return b.sequence([b.oid(pOid)]);
+    }));
+  }
+  // Wrap a value in Extension ::= SEQUENCE { extnID, critical?, extnValue }; a FALSE critical is omitted.
+  function ext(oidStr, critical, valueDer) {
+    var children = [b.oid(oidStr)];
+    if (critical) children.push(b.boolean(true));
+    children.push(b.octetString(valueDer));
+    return b.sequence(children);
+  }
+
+  // The SHA-1 subjectKeyIdentifier (RFC 5280 sec. 4.2.1.2 method 1): SHA-1 of the subjectPublicKey BIT
+  // STRING CONTENT (past the unused-bits octet), NOT the whole SPKI or the BIT STRING TLV.
+  function spkiKeyId(spkiDer) {
+    var keyBytes = asn1.read.bitString(asn1.decode(spkiDer).children[1]).bytes;
+    // RFC 5280 sec. 4.2.1.2 method 1 DEFINES the subjectKeyIdentifier as the SHA-1 of the
+    // subjectPublicKey; this is a key identifier, not a signature or a collision-resistance use,
+    // and the algorithm is fixed by the standard.
+    // nosemgrep: pki-weak-hash-md5-sha1
+    return nodeCrypto.createHash("sha1").update(keyBytes).digest();
+  }
+  function skiKeyId(val, spkiDer) {
+    if (Buffer.isBuffer(val)) return val;
+    if (val === true) return spkiKeyId(spkiDer);
+    throw E("bad-input", "subjectKeyIdentifier must be true (auto-derive) or a Buffer key id");
+  }
+
+  // ---- embedded-input validators ----
+  function reqDer(v, what) {
+    if (Buffer.isBuffer(v)) return v;
+    if (v instanceof Uint8Array) return Buffer.from(v);
+    throw E("bad-input", what + " must be a DER Buffer");
+  }
+  // Full validation of an embedded SubjectPublicKeyInfo via the SAME parser the decoder uses.
+  function assertValidSpki(spkiDer, what) {
+    var node;
+    try { node = asn1.decode(spkiDer); }
+    catch (e) { throw E("bad-input", what + " is not valid DER", e); }
+    try { schema.walk(SPKI_SCHEMA, node, NS); }
+    catch (e) {
+      if (e instanceof ErrorClass || (e && e.name === "Asn1Error")) throw e;
+      throw E("bad-input", what + " is not a well-formed SubjectPublicKeyInfo", e);
+    }
+  }
+  // A pre-encoded Extension ::= SEQUENCE { extnID OID, critical BOOLEAN OPTIONAL, extnValue OCTET STRING };
+  // an explicit critical=FALSE is non-canonical (DER DEFAULT) and rejected.
+  function assertValidExtension(der, idx) {
+    var n;
+    try { n = asn1.decode(der); }
+    catch (e) { throw E("bad-input", "pre-encoded extension [" + idx + "] is not valid DER", e); }
+    if (n.tagNumber !== asn1.TAGS.SEQUENCE || n.tagClass !== "universal" || !n.children || n.children.length < 2 || n.children.length > 3) throw E("bad-input", "pre-encoded extension [" + idx + "] must be an Extension SEQUENCE { extnID, critical?, extnValue }");
+    try { asn1.read.oid(n.children[0]); }
+    catch (e) { throw E("bad-input", "pre-encoded extension [" + idx + "] extnID is not an OBJECT IDENTIFIER", e); }
+    if (n.children.length === 3) {
+      var crit;
+      try { crit = asn1.read.boolean(n.children[1]); }
+      catch (e) { throw E("bad-input", "pre-encoded extension [" + idx + "] critical must be a BOOLEAN", e); }
+      if (crit !== true) throw E("bad-input", "pre-encoded extension [" + idx + "] critical=FALSE must be omitted (DER DEFAULT)");
+    }
+    var last = n.children[n.children.length - 1];
+    if (last.tagNumber !== asn1.TAGS.OCTET_STRING || last.tagClass !== "universal") throw E("bad-input", "pre-encoded extension [" + idx + "] extnValue must be an OCTET STRING");
+  }
+  // Synthesize the parsed-cert shape resolveSignScheme reads (subjectPublicKeyInfo.algorithm) from a raw SPKI.
+  function certLikeFromSpki(spkiDer) {
+    var spki = asn1.decode(spkiDer);
+    if (!spki.children || !spki.children.length) throw E("bad-input", "the signing key SPKI is not a SubjectPublicKeyInfo");
+    var alg = spki.children[0];
+    var keyOid;
+    try { keyOid = asn1.read.oid(alg.children[0]); }
+    catch (e) { throw E("bad-input", "the signing key SPKI algorithm is not an OID", e); }
+    return { subjectPublicKeyInfo: { algorithm: { oid: keyOid, parameters: alg.children.length > 1 ? alg.children[1].bytes : undefined } } };
+  }
+
+  // Confirm the produced signature verifies under `spki` -- key-type-agnostic (a PKCS#8 key, a WebCrypto
+  // CryptoKey, or any signer), where deriving-and-comparing the public key cannot (a non-extractable
+  // CryptoKey has no exportable public half). This is the x509 chain self-check AND the CSR proof of
+  // possession. Composite verifies both components. Returns a promise for composite, sync-throws for classical.
+  function assertSignatureVerifies(preimage, sig, spki, scheme) {
+    if (scheme.composite) {
+      return compositeSig.compositeVerify(spki, sig, preimage, scheme.composite, ErrorClass, code("unsupported-algorithm"), code("bad-input")).then(function (r) {
+        if (!r.ok) throw E("bad-input", "the composite signing key does not correspond to the public key -- the signature would not verify");
+      });
+    }
+    var pub;
+    try { pub = nodeCrypto.createPublicKey({ key: spki, format: "der", type: "spki" }); }
+    catch (e) { throw E("bad-input", "the public key could not be imported for the signature self-check", e); }
+    var s = scheme.sign, ok;
+    try {
+      if (s.name === "ECDSA") ok = nodeCrypto.verify(scheme.digest, preimage, { key: pub, dsaEncoding: "der" }, sig);
+      else if (s.name === "RSA-PSS") ok = nodeCrypto.verify(scheme.digest, preimage, { key: pub, padding: nodeCrypto.constants.RSA_PKCS1_PSS_PADDING, saltLength: s.saltLength }, sig);
+      else if (s.name === "RSASSA-PKCS1-v1_5") ok = nodeCrypto.verify(scheme.digest, preimage, pub, sig);
+      // allow:eddsa-verify-without-loworder-gate -- a self-check that OUR just-produced signature verifies
+      // under the key the caller controls, not a security verify of an untrusted EdDSA signature, so the
+      // low-order-point gate (a forged-signature defense) does not apply.
+      else ok = nodeCrypto.verify(null, preimage, pub, sig);   // Ed25519 / Ed448 / ML-DSA / SLH-DSA
+    } catch (e) { throw E("bad-input", "the signature self-check could not run against the public key", e); }
+    if (!ok) throw E("bad-input", "the signing key does not correspond to the public key -- the signature would not verify");
+  }
+
+  return {
+    E: E, code: code, KU_BIT: KU_BIT,
+    encodeName: encodeName, isEmptyName: isEmptyName, encodeGeneralName: encodeGeneralName,
+    extKeyUsage: extKeyUsage, extExtKeyUsage: extExtKeyUsage, validateBcSpec: validateBcSpec,
+    extBasicConstraints: extBasicConstraints, pathLen: pathLen, extSki: extSki, extAki: extAki,
+    extSan: extSan, extCertPolicies: extCertPolicies, ext: ext,
+    spkiKeyId: spkiKeyId, skiKeyId: skiKeyId,
+    reqDer: reqDer, assertValidSpki: assertValidSpki, assertValidExtension: assertValidExtension,
+    certLikeFromSpki: certLikeFromSpki, assertSignatureVerifies: assertSignatureVerifies,
+  };
+}
+
+module.exports = { makeBuilder: makeBuilder, KU_BIT: KU_BIT };

package/lib/x509-sign.js

@@ -26,11 +26,11 @@ var asn1 = require("./asn1-der");
 var oid = require("./oid");
 var x509 = require("./schema-x509");
 var signScheme = require("./sign-scheme");
-var compositeSig = require("./composite-sig");
 var guard = require("./guard-all");
 var frameworkError = require("./framework-error");
 var schema = require("./schema-engine");
 var pkix = require("./schema-pkix");
+var pkiBuild = require("./pki-build");
 
 var CertificateError = frameworkError.CertificateError;
 // The x509 schema namespace + Name parser -- the SAME RDNSequence parser pki.schema.x509.parse uses, so
@@ -59,189 +59,25 @@ var KNOWN_EXT_KEYS = {
   certificatePolicies: 1, certificatePoliciesCritical: 1,
 };
 
-// KeyUsage named-bit positions (RFC 5280 sec. 4.2.1.3); contentCommitment is the RFC 5280 rename of
-// the X.509 nonRepudiation bit (1).
-var KU_BIT = {
-  digitalSignature: 0, nonRepudiation: 1, contentCommitment: 1, keyEncipherment: 2,
-  dataEncipherment: 3, keyAgreement: 4, keyCertSign: 5, cRLSign: 6, encipherOnly: 7, decipherOnly: 8,
-};
-
-// ---- distinguished name encoding (RFC 5280 sec. 4.1.2.4) -------------------
-
-// countryName is a PrintableString, emailAddress an IA5String; every other new-certificate attribute
-// is a UTF8String (Teletex/BMP/Universal are backward-compat only and never emitted).
-function _atvString(attrName, value) {
-  if (attrName === "countryName") {
-    // countryName is a PrintableString SIZE(2) -- the two-letter ISO 3166 alpha-2 code (RFC 5280 /
-    // X.520). Reject any other length at config-time.
-    if (String(value).length !== 2) throw _err("x509/bad-name", "countryName must be a two-letter ISO 3166 code (PrintableString SIZE(2))");
-    return b.printable(value);
-  }
-  if (attrName === "emailAddress") return b.ia5(value);
-  return b.utf8(value);
-}
-function _encodeAtv(attrName, value) {
-  if (value == null || value === "") throw _err("x509/bad-name", "the " + attrName + " attribute value must be a non-empty string");
-  var typeOid;
-  try { typeOid = O(attrName); }
-  catch (e) { throw _err("x509/bad-name", "unknown distinguished-name attribute " + JSON.stringify(attrName), e); }
-  var valueTlv;
-  try { valueTlv = _atvString(attrName, value); }
-  catch (e) { if (e instanceof CertificateError) throw e; throw _err("x509/bad-name", "the " + attrName + " value has characters invalid for its string type", e); }
-  return b.sequence([b.oid(typeOid), valueTlv]);
-}
-function _encodeRdn(rdnSpec) {
-  if (!rdnSpec || typeof rdnSpec !== "object" || Buffer.isBuffer(rdnSpec)) throw _err("x509/bad-name", "each RDN must be an object of { attributeName: value }");
-  var keys = Object.keys(rdnSpec);
-  if (!keys.length) throw _err("x509/bad-name", "an RDN must carry at least one attribute");
-  // build.set DER-sorts the AttributeTypeAndValue members (X.690 SET-OF ordering) for a multi-valued RDN.
-  return b.set(keys.map(function (k) { return _encodeAtv(k, rdnSpec[k]); }));
-}
-// A DN spec -> RDNSequence DER. A string is shorthand for a single commonName RDN; a Buffer is raw
-// pre-encoded Name DER (the escape hatch). An empty array yields an empty RDNSequence (a subject MAY
-// be empty with a critical SAN; the issuer non-empty rule is enforced by the caller).
-function _encodeName(spec) {
-  if (Buffer.isBuffer(spec)) { _assertValidNameDer(spec); return spec; }
-  if (typeof spec === "string") spec = [{ commonName: spec }];
-  if (!Array.isArray(spec)) throw _err("x509/bad-name", "a name must be a string, an array of RDNs, or raw Name DER");
-  return b.sequence(spec.map(_encodeRdn));
-}
-// A raw Name DER is embedded verbatim, so validate it is a well-formed RDNSequence -- a SEQUENCE OF
-// RelativeDistinguishedName, each a non-empty SET OF AttributeTypeAndValue{ type OID, value } -- before
-// it is embedded. An empty RDNSequence is permitted (an empty subject; the issuer non-empty rule is
-// enforced separately). asn1.decode already rejects trailing bytes.
-function _assertValidNameDer(der) {
-  var node;
-  try { node = asn1.decode(der); }
-  catch (e) { throw _err("x509/bad-name", "the raw Name DER is not valid DER", e); }
-  // Full validation: walk the raw Name through the exact RDNSequence parser the certificate parser
-  // uses (the SET-OF structure, the AttributeTypeAndValue arity, the DirectoryString value types),
-  // not a partial hand-rolled shape check -- so an embedded raw Name is exactly what parses back.
-  try { schema.walk(NAME_SCHEMA, node, NS); }
-  catch (e) {
-    if (e instanceof CertificateError || (e && e.name === "Asn1Error")) throw e;
-    throw _err("x509/bad-name", "the raw Name DER is not a well-formed distinguished name", e);
-  }
-}
-function _isEmptyName(nameDer) { return asn1.decode(nameDer).children.length === 0; }
+// The shared PKIX producing primitives (lib/pki-build.js), bound to the x509 namespace so they keep the
+// frozen x509/* codes. Thin local aliases let the x509 call sites read unchanged. csr-sign binds the same
+// builder to its own namespace (Hard rule #5 -- one encode definition, no per-format hand-roll).
+var _b = pkiBuild.makeBuilder({ ErrorClass: CertificateError, prefix: "x509", O: O, NS: NS, NAME_SCHEMA: NAME_SCHEMA, SPKI_SCHEMA: SPKI_SCHEMA, EXT_DECODERS: EXT_DECODERS });
+var _encodeName = _b.encodeName, _isEmptyName = _b.isEmptyName, _reqDer = _b.reqDer,
+  _assertValidSpki = _b.assertValidSpki, _assertValidExtension = _b.assertValidExtension,
+  _certLikeFromSpki = _b.certLikeFromSpki, _assertCertVerifies = _b.assertSignatureVerifies,
+  _ext = _b.ext, _extBasicConstraints = _b.extBasicConstraints, _validateBcSpec = _b.validateBcSpec,
+  _extKeyUsage = _b.extKeyUsage, _extExtKeyUsage = _b.extExtKeyUsage, _extSki = _b.extSki,
+  _extAki = _b.extAki, _extSan = _b.extSan, _extCertPolicies = _b.extCertPolicies,
+  _skiKeyId = _b.skiKeyId, _spkiKeyId = _b.spkiKeyId;
 
-// ---- GeneralName encoding (RFC 5280 sec. 4.2.1.6) --------------------------
+// ---- issuer-side extension helpers (subjectKeyIdentifier lookup + authorityKeyIdentifier) ----
 
-function _ia5Content(s) {
-  s = String(s);
-  for (var i = 0; i < s.length; i++) {
-    if (s.charCodeAt(i) > 0x7F) throw _err("x509/bad-input", "value requires 7-bit ASCII (IA5String): " + JSON.stringify(s));
-  }
-  return Buffer.from(s, "latin1");
-}
-function _encodeGeneralName(entry) {
-  if (!entry || typeof entry !== "object" || Buffer.isBuffer(entry)) throw _err("x509/bad-input", "a GeneralName must be an object with exactly one name form");
-  var keys = Object.keys(entry);
-  if (keys.length !== 1) throw _err("x509/bad-input", "a GeneralName entry must have exactly one form, got " + keys.length);
-  var k = keys[0], v = entry[k];
-  if (v == null || v === "") throw _err("x509/bad-input", "an empty GeneralName value is not permitted (RFC 5280 sec. 4.2.1.6)");
-  switch (k) {
-    // IMPLICIT [1]/[2]/[6] IA5String -- context-primitive over the raw ASCII content.
-    case "rfc822Name": return b.contextPrimitive(1, _ia5Content(v));
-    case "dNSName": return b.contextPrimitive(2, _ia5Content(v));
-    case "uniformResourceIdentifier": case "uri": return b.contextPrimitive(6, _ia5Content(v));
-    // IMPLICIT [7] OCTET STRING -- 4 octets (IPv4) or 16 (IPv6).
-    case "iPAddress":
-      if (!Buffer.isBuffer(v) || (v.length !== 4 && v.length !== 16)) throw _err("x509/bad-input", "iPAddress must be a 4- or 16-octet Buffer");
-      return b.contextPrimitive(7, v);
-    // [4] Name -- Name is a CHOICE, so the context tag is necessarily EXPLICIT.
-    case "directoryName": return b.explicit(4, _encodeName(v));
-    default: throw _err("x509/bad-input", "unsupported GeneralName form " + JSON.stringify(k) + " (supported: rfc822Name, dNSName, uniformResourceIdentifier, iPAddress, directoryName)");
-  }
-}
-
-// ---- extension-value encoders (the inverse of certExtensionDecoders) -------
-
-function _extKeyUsage(names) {
-  if (!Array.isArray(names) || !names.length) throw _err("x509/bad-input", "keyUsage must assert at least one bit (RFC 5280 sec. 4.2.1.3)");
-  var positions = names.map(function (n) {
-    var pos = KU_BIT[n];
-    if (pos == null) throw _err("x509/bad-input", "unknown keyUsage bit " + JSON.stringify(n));
-    return pos;
-  });
-  return b.namedBitString(positions);   // minimal NamedBitList DER (X.690 sec. 11.2.2)
-}
-function _extExtKeyUsage(names) {
-  if (!Array.isArray(names) || !names.length) throw _err("x509/bad-input", "extendedKeyUsage must list at least one KeyPurposeId");
-  return b.sequence(names.map(function (n) {
-    var purposeOid;
-    try { purposeOid = O(n); }
-    catch (e) { throw _err("x509/bad-input", "unknown extendedKeyUsage purpose " + JSON.stringify(n), e); }
-    return b.oid(purposeOid);
-  }));
-}
-// Validate a basicConstraints spec object before it drives the coherence checks + encoding: cA must be
-// an explicit boolean (a truthy non-true value like 1 or "true" would silently encode as a non-CA),
-// pathLen a non-negative integer, and only cA/pathLen/critical are recognized.
-function _validateBcSpec(bc) {
-  if (bc.cA != null && typeof bc.cA !== "boolean") throw _err("x509/bad-input", "basicConstraints cA must be a boolean");
-  if (bc.critical != null && typeof bc.critical !== "boolean") throw _err("x509/bad-input", "basicConstraints critical must be a boolean");
-  if (bc.pathLen != null) _pathLen(bc.pathLen);
-  Object.keys(bc).forEach(function (k) {
-    if (k !== "cA" && k !== "pathLen" && k !== "critical") throw _err("x509/bad-input", "unknown basicConstraints field " + JSON.stringify(k));
-  });
-}
-function _extBasicConstraints(spec) {
-  var children = [];
-  if (spec.cA === true) children.push(b.boolean(true));   // cA=FALSE omitted (DER DEFAULT)
-  if (spec.pathLen != null) children.push(b.integer(_pathLen(spec.pathLen)));
-  return b.sequence(children);
-}
-function _pathLen(v) {
-  if (typeof v !== "number" || !isFinite(v) || v < 0 || (v | 0) !== v) throw _err("x509/bad-input", "basicConstraints pathLenConstraint must be a non-negative integer");
-  return BigInt(v);
-}
-function _extSki(keyid) { return b.octetString(keyid); }
-function _extAki(keyid) { return b.sequence([b.contextPrimitive(0, keyid)]); }   // keyIdentifier [0] IMPLICIT OCTET STRING
-function _extSan(entries) {
-  if (!Array.isArray(entries) || !entries.length) throw _err("x509/bad-input", "subjectAltName must carry at least one GeneralName");
-  return b.sequence(entries.map(_encodeGeneralName));
-}
-function _extCertPolicies(names) {
-  if (!Array.isArray(names) || !names.length) throw _err("x509/bad-input", "certificatePolicies must list at least one policy OID");
-  var seen = {};
-  return b.sequence(names.map(function (n) {
-    var pOid;
-    try { pOid = O(n); }
-    catch (e) { throw _err("x509/bad-input", "unknown certificate policy " + JSON.stringify(n), e); }
-    if (seen[pOid]) throw _err("x509/bad-input", "duplicate certificate policy " + JSON.stringify(n) + " (RFC 5280 sec. 4.2.1.4)");
-    seen[pOid] = true;
-    return b.sequence([b.oid(pOid)]);   // PolicyInformation ::= SEQUENCE { policyIdentifier OID }
-  }));
-}
-// Wrap an encoded extension value in Extension ::= SEQUENCE { extnID, critical?, extnValue }. A
-// FALSE critical bit is omitted (DER DEFAULT), so the boolean appears only when the extension is critical.
-function _ext(oidStr, critical, valueDer) {
-  var children = [b.oid(oidStr)];
-  if (critical) children.push(b.boolean(true));
-  children.push(b.octetString(valueDer));
-  return b.sequence(children);
-}
-
-// The SHA-1 subjectKeyIdentifier (RFC 5280 sec. 4.2.1.2 method 1): the hash of the subjectPublicKey
-// BIT STRING CONTENT (past the unused-bits octet), NOT the whole SPKI or the whole BIT STRING TLV.
-function _spkiKeyId(spkiDer) {
-  var keyBytes = asn1.read.bitString(asn1.decode(spkiDer).children[1]).bytes;
-  // nosemgrep: pki-weak-hash-md5-sha1 -- RFC 5280 sec. 4.2.1.2 method 1 DEFINES the subjectKeyIdentifier
-  // as the SHA-1 of the subjectPublicKey; this is a key identifier, not a signature or a
-  // collision-resistance use, and the algorithm is fixed by the standard.
-  return nodeCrypto.createHash("sha1").update(keyBytes).digest();
-}
 function _skiValueOf(caCert) {
   var ext = (caCert.extensions || []).filter(function (e) { return e.oid === OID_SKI; })[0];
   if (ext) { try { return asn1.read.octetString(asn1.decode(ext.value)); } catch (_e) { /* fall through to re-derive from the issuer SPKI */ } }
   return null;
 }
-function _skiKeyId(val, spkiDer) {
-  if (Buffer.isBuffer(val)) return val;
-  if (val === true) return _spkiKeyId(spkiDer);
-  throw _err("x509/bad-input", "subjectKeyIdentifier must be true (auto-derive) or a Buffer key id");
-}
 function _akiKeyId(val, ctx) {
   if (Buffer.isBuffer(val)) return val;
   if (val === true) {
@@ -357,57 +193,6 @@ function _timeDer(date, which) {
   var y = date.getUTCFullYear();
   return (y >= 1950 && y <= 2049) ? b.utcTime(date) : b.generalizedTime(date);
 }
-function _reqDer(v, what) {
-  if (Buffer.isBuffer(v)) return v;
-  if (v instanceof Uint8Array) return Buffer.from(v);
-  throw _err("x509/bad-input", what + " must be a DER Buffer");
-}
-// A well-formed SubjectPublicKeyInfo is a SEQUENCE { algorithm AlgorithmIdentifier, subjectPublicKey
-// BIT STRING }. The subject key is embedded verbatim (b.raw), so reject a malformed one AT ISSUANCE
-// rather than emitting a certificate that fails to parse. (asn1.decode already rejects trailing bytes.)
-function _assertValidSpki(spkiDer, what) {
-  var node;
-  try { node = asn1.decode(spkiDer); }
-  catch (e) { throw _err("x509/bad-input", what + " is not valid DER", e); }
-  // Full validation: run it through the SAME SubjectPublicKeyInfo parser pki.schema.x509.parse uses
-  // (the AlgorithmIdentifier + the subjectPublicKey BIT STRING), not a partial hand-rolled shape check.
-  try { schema.walk(SPKI_SCHEMA, node, NS); }
-  catch (e) {
-    if (e instanceof CertificateError || (e && e.name === "Asn1Error")) throw e;
-    throw _err("x509/bad-input", what + " is not a well-formed SubjectPublicKeyInfo", e);
-  }
-}
-// A well-formed Extension is a SEQUENCE { extnID OID, critical BOOLEAN OPTIONAL, extnValue OCTET
-// STRING }. A pre-encoded (array-form) extension is embedded verbatim, so validate its shape here.
-function _assertValidExtension(der, idx) {
-  var n;
-  try { n = asn1.decode(der); }
-  catch (e) { throw _err("x509/bad-input", "pre-encoded extension [" + idx + "] is not valid DER", e); }
-  if (n.tagNumber !== asn1.TAGS.SEQUENCE || n.tagClass !== "universal" || !n.children || n.children.length < 2 || n.children.length > 3) throw _err("x509/bad-input", "pre-encoded extension [" + idx + "] must be an Extension SEQUENCE { extnID, critical?, extnValue }");
-  try { asn1.read.oid(n.children[0]); }
-  catch (e) { throw _err("x509/bad-input", "pre-encoded extension [" + idx + "] extnID is not an OBJECT IDENTIFIER", e); }
-  if (n.children.length === 3) {
-    var crit;
-    try { crit = asn1.read.boolean(n.children[1]); }
-    catch (e) { throw _err("x509/bad-input", "pre-encoded extension [" + idx + "] critical must be a BOOLEAN", e); }
-    // DER DEFAULT: a FALSE criticality MUST be omitted, so an explicitly-encoded critical=FALSE is
-    // non-canonical (RFC 5280 sec. 4.2 / X.690 sec. 11.5).
-    if (crit !== true) throw _err("x509/bad-input", "pre-encoded extension [" + idx + "] critical=FALSE must be omitted (DER DEFAULT)");
-  }
-  var last = n.children[n.children.length - 1];
-  if (last.tagNumber !== asn1.TAGS.OCTET_STRING || last.tagClass !== "universal") throw _err("x509/bad-input", "pre-encoded extension [" + idx + "] extnValue must be an OCTET STRING");
-}
-// Synthesize the parsed-cert shape resolveSignScheme reads (it only needs subjectPublicKeyInfo.algorithm)
-// from a raw SPKI DER: { algorithm: { oid, parameters } }. `parameters` is the raw params TLV (or undefined).
-function _certLikeFromSpki(spkiDer) {
-  var spki = asn1.decode(spkiDer);
-  if (!spki.children || !spki.children.length) throw _err("x509/bad-input", "the signing key SPKI is not a SubjectPublicKeyInfo");
-  var alg = spki.children[0];
-  var keyOid;
-  try { keyOid = asn1.read.oid(alg.children[0]); }
-  catch (e) { throw _err("x509/bad-input", "the signing key SPKI algorithm is not an OID", e); }
-  return { subjectPublicKeyInfo: { algorithm: { oid: keyOid, parameters: alg.children.length > 1 ? alg.children[1].bytes : undefined } } };
-}
 // The raw subject Name TLV of a parsed CA certificate (byte-identical, so the child issuer chains to
 // the CA subject exactly). The subject follows the optional version [0], serial, signature, issuer,
 // and validity in the tbsCertificate.
@@ -455,33 +240,6 @@ function _issuedCaInfo(extSpec) {
   }
   return { cA: false, pathLen: null };
 }
-// Confirm the produced signature verifies under the ISSUER public key, so a signing key that does not
-// correspond to it cannot silently yield a certificate that fails to chain. Verifying the actual
-// signature is key-type-agnostic -- it holds for a PKCS#8 key, a WebCrypto CryptoKey, or any signer --
-// where deriving-and-comparing the public key cannot (a non-extractable CryptoKey has no exportable
-// public half). A composite {mldsa, trad} arm is the caller's to pair and is skipped here.
-function _assertCertVerifies(tbsDer, sig, issuerSpki, scheme) {
-  if (scheme.composite) {
-    // Verify BOTH composite component signatures against the composite public key.
-    return compositeSig.compositeVerify(issuerSpki, sig, tbsDer, scheme.composite, CertificateError, "x509/unsupported-algorithm", "x509/bad-input").then(function (r) {
-      if (!r.ok) throw _err("x509/bad-input", "the composite signing key does not correspond to the issuer public key -- the certificate would not chain");
-    });
-  }
-  var pub;
-  try { pub = nodeCrypto.createPublicKey({ key: issuerSpki, format: "der", type: "spki" }); }
-  catch (e) { throw _err("x509/bad-input", "the issuer public key could not be imported for the chain self-check", e); }
-  var s = scheme.sign, ok;
-  try {
-    if (s.name === "ECDSA") ok = nodeCrypto.verify(scheme.digest, tbsDer, { key: pub, dsaEncoding: "der" }, sig);
-    else if (s.name === "RSA-PSS") ok = nodeCrypto.verify(scheme.digest, tbsDer, { key: pub, padding: nodeCrypto.constants.RSA_PKCS1_PSS_PADDING, saltLength: s.saltLength }, sig);
-    else if (s.name === "RSASSA-PKCS1-v1_5") ok = nodeCrypto.verify(scheme.digest, tbsDer, pub, sig);
-    // allow:eddsa-verify-without-loworder-gate -- this is a self-check that OUR just-produced signature
-    // verifies under the issuer key the caller controls, not a security verify of an untrusted EdDSA
-    // signature, so the low-order-point gate (a forged-signature defense) does not apply.
-    else ok = nodeCrypto.verify(null, tbsDer, pub, sig);   // Ed25519 / Ed448 / ML-DSA / SLH-DSA
-  } catch (e) { throw _err("x509/bad-input", "the chain self-check could not run against the issuer public key", e); }
-  if (!ok) throw _err("x509/bad-input", "the signing key does not correspond to the issuer public key -- the certificate would not chain");
-}
 // Does the extensions spec carry a subjectAltName that will be emitted critical? The object form forces
 // SAN critical when the subject is empty (so any subjectAltName qualifies); the pre-encoded array form
 // is decoded to look for an Extension whose extnID is subjectAltName with a TRUE critical flag.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:6f299c9a-151b-4a48-9580-bc19e1ab66b0",
+  "serialNumber": "urn:uuid:d4ed0583-0ef7-424e-90b1-6a5b7b80e23d",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-17T06:00:11.553Z",
+    "timestamp": "2026-07-17T07:12:45.777Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.3.0",
+      "bom-ref": "@blamejs/pki@0.3.1",
       "type": "application",
       "name": "pki",
-      "version": "0.3.0",
+      "version": "0.3.1",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.3.0",
+      "purl": "pkg:npm/%40blamejs/pki@0.3.1",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.3.0",
+      "ref": "@blamejs/pki@0.3.1",
       "dependsOn": []
     }
   ]