@blamejs/pki 0.3.18 → 0.3.19

package/CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.3.19 — 2026-07-26
+
+The CMP HTTP transfer client ships -- pki.cmp.transfer carries a protected PKIMessage to a CMP endpoint over the shared node:https transport (RFC 9811).
+
+### Added
+
+- pki.cmp.transfer(url, message, opts) -- the RFC 9811 HTTP transfer verb: POST a DER (or PEM) PKIMessage over the shared pki.transport and return the parsed response { response, responseBytes, status, contentType, tls }. The message is sent verbatim so its message-layer protection is preserved, and the response is classified fail-closed: HTTP 200 with an application/pkixcmp body is parsed; another 2xx is rejected (RFC 9811 requires 200); a 3xx is not followed; a 4xx/5xx carrying a CMP error PKIMessage forwards that integrity-protected verdict with the HTTP status surfaced as data, while a 4xx/5xx with no CMP body is an error. Protection is surfaced, not verified -- the caller checks it. Composes pki.cmp.build + pki.schema.cmp.parse over pki.transport; the default transport is https-only and refuses an unpinned server.
+- pki.cmp.wellKnownUrl(base, opts) -- build an RFC 9811 sec. 3.4 /.well-known/cmp request-URI, optionally with a { label, operation } path. Each label/operation is a single safe path segment; a base carrying a query or fragment, or a segment containing a separator or dot-segment, is refused so the resource cannot be silently retargeted.
+
+### Changed
+
+- pki.x509.sign now accepts a subjectAltName iPAddress entry as a dotted-quad IPv4 or colon-hex IPv6 string -- packed to its 4- or 16-octet network form internally -- in addition to a pre-packed Buffer, matching the string ergonomics of dNSName and uniformResourceIdentifier. This applies to every GeneralName consumer (certificates, CRLs, CMP, attribute certificates).
+- extendedKeyUsage and certificatePolicies now accept a raw dotted-decimal OID string directly, in addition to a registered purpose/policy name -- so an unregistered KeyPurposeId or private policy OID (a BIMI VMC purpose, a document-signing EKU, a vendor-specific purpose) can be supplied inline without first calling pki.oid.register or hand-encoding the extension. A token that is neither a registered name nor a well-formed dotted OID still fails closed.
+
 ## v0.3.18 — 2026-07-25
 
 The ACME client ships -- pki.acme drives the full RFC 8555 certificate-issuance flow over the shared node:https transport.

package/README.md

@@ -217,7 +217,7 @@ is callable today; nothing below is a stub.
 | `pki.schema.cmp` | Parse DER / PEM RFC 9810 Certificate Management Protocol messages (PKIMessage) — the header (version, sender / recipient incl. the anonymous NULL-DN, nonces, transaction id, general info), the 27-arm body (certificate requests via the CRMF parser, an encrypted certificate's EnvelopedData via CMS, response / revocation / confirmation / error / support / polling arms structural, the rest raw), and the exact `headerBytes` / `bodyBytes` slices an external verifier reconstructs the protected part from; the CMP-before-OCSP dispatch order is enforced, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.csrattrs` | Parse DER EST CSR Attributes (`CsrAttrs`, RFC 8951 §3.5 / RFC 9908) — the `AttrOrOID` items a server sends to shape an enrollment: bare OIDs, attributes with raw values, and decoded views of the RFC 9908 meaningful types (extension requests, EC/RSA key-type conventions, the certification-request-info template). Unknown types tolerated (surfaced raw), fail-closed on structure and the RFC 9908 semantic MUSTs — `parse` |
 | `pki.est` | RFC 7030 / 8951 / 9908 Enrollment over Secure Transport — the thin client verbs `cacerts` / `simpleenroll` / `simplereenroll` drive the RFC 7030 flow over `pki.transport` (inject your own, or the fail-closed default): https-only, an explicit trust anchor required, same-origin redirects followed but a downgrade / loop refused, a 202 Retry-After surfaced (never slept), HTTP Basic answered only after the server is authenticated, and the issued certificate chosen by public-key match. Under them, the transport-agnostic codecs they compose — the RFC 8951 base64 transfer codec (blind to Content-Transfer-Encoding), the `multipart/mixed` splitter, the certs-only + serverkeygen response validators over CMS, the enroll-attribute builders, and the HTTP response classifier — `cacerts`, `simpleenroll`, `simplereenroll`, `transferDecode`/`transferEncode`, `parseCertsOnly`, `findIssuedCert`, `classifyResponse`, `paths`, and the builders |
-| `pki.transport` | The shared, fail-closed `node:https` transport the enrollment clients drive — `pki.transport.https(defaults)` returns a `transport(request) → { status, headers, body }`. The toolkit's sole socket choke point: an explicit trust anchor (or an opt-in to the system store) is required, `rejectUnauthorized` is always on, TLS is floored at 1.2, the response body is capped while it streams, and a stalled socket times out. Reused verbatim by the EST and ACME clients today (CMP next) — `https` |
+| `pki.transport` | The shared, fail-closed `node:https` transport the enrollment clients drive — `pki.transport.https(defaults)` returns a `transport(request) → { status, headers, body }`. The toolkit's sole socket choke point: an explicit trust anchor (or an opt-in to the system store) is required, `rejectUnauthorized` is always on, TLS is floored at 1.2, the response body is capped while it streams, and a stalled socket times out. Reused verbatim by the EST, ACME, and CMP clients — `https` |
 | `pki.jose` | RFC 7515 Flattened JWS + RFC 7638 JWK thumbprints — `sign` / `verify` run a Flattened JWS against declarative profiles (ACME outer, EAB inner, keyChange inner) that carry the required/forbidden header rules as data; `base64url` is the strict RFC 4648 §5 codec (padding, non-alphabet, and non-canonical trailing bits rejected); `parseJson` is a bounded reader that refuses duplicate members at any depth; `thumbprint` is the RFC 7638 / 8037 / 9964 canonical digest. The algorithm registry binds each `alg` to its key type (ES/RS/PS/EdDSA/ML-DSA), so `alg:none`, an RS256→HS256 key confusion, and an all-zero ECDSA signature have no code path; `assertPublicJwk` refuses a JWK carrying private material so an exported private key is never published — `sign`, `verify`, `base64url`, `parseJson`, `thumbprint`, `assertPublicJwk` |
 | `pki.acme` | RFC 8555 / 8737 / 8738 / 9773 ACME — `client(directoryUrl, opts)` is a stateful client that drives a live CA directory over `pki.transport` (inject your own, or the fail-closed default): `newAccount` / `newOrder` / `getOrder` / `getAuthorization` / `getChallenge` / `respondToChallenge` / `finalize` / `pollOrder` / `pollAuthorization` / `downloadCertificate` walk the issuance flow, and `revokeCert` (account-key or certificate-key signed), `keyChange` (account key rotation), `deactivateAccount` / `deactivateAuthorization`, and `renewalInfo` (ARI) round out the lifecycle — https-only for every URL, an explicit trust anchor required, a fresh single-use nonce per request with a bounded badNonce retry, POST-as-GET reads, bounded polling that sleeps on a Retry-After via an injectable sleeper (capped by a poll count and a total-wait budget), and every response body size-capped. Over the message layer it composes: resource-object validators (closed status enums, conditional-required fields, unknown fields ignored), the three §7.1.6 state machines, request builders (newAccount + EAB, newOrder + `replaces`, finalize with CSR identifier-set match and account-key-reuse rejection, challenge responses, deactivation, revokeCert in both key modes, the keyChange nested JWS, POST-as-GET), the http-01 / dns-01 / tls-alpn-01 challenge computations, the dns/ip identifier validators, and the ARI certID (serial sign-padding preserved), fail-closed — `client`, `validate`, `identify`, `assertTransition`, the builders, `keyAuthorization`, `http01`, `dns01`, `tlsAlpn01Extension`, `verifyTlsAlpn01`, `ariCertId` |
 | `pki.schema.smime` | Decode S/MIME ESS signed-attribute values (RFC 5035 / RFC 8551) — `parseSigningCertificate` / `parseSigningCertificateV2` bind a signature to its signing certificate (cert hash, hash algorithm, issuer `GeneralNames` + serial), `parseSmimeCapabilities` decodes the ordered capability list, and `decodeAttribute` OID-dispatches a CMS attribute (enforcing the single-value rule, recognize-and-defer for unknown types). A companion decoder for CMS signed attributes, not an auto-routed format, fail-closed — `parseSigningCertificate`, `parseSigningCertificateV2`, `parseSmimeCapabilities`, `decodeAttribute` |
@@ -227,7 +227,7 @@ is callable today; nothing below is a stub.
 | `pki.csr` | PKCS#10 certification-request issuance (RFC 2986 / RFC 2985) — `sign(spec, key, opts)` builds and signs a `CertificationRequest`: a `spec` of subject (a common-name string, an array of RDNs, or raw Name DER; may be empty), the public key being certified, an optional `extensionRequest` (requested v3 extensions — subject alternative names, key usage, extended key usage, basic constraints, certificate policies, subject key identifier, or an array of pre-encoded Extension DER — that a CA copies into the issued certificate), and an optional `challengePassword`. `key` (or `{ key }`) is the subject's own private key: the request is self-signed to prove possession of the private half of `subjectPublicKey`, and that proof is verified before the request is returned (what `openssl req -verify` checks). The signature algorithm is resolved from the subject key, so RSA (PKCS#1 v1.5 / PSS via `opts.pss`), ECDSA, EdDSA, ML-DSA, SLH-DSA, and the composite arms all sign without a per-algorithm branch. Returns DER, or a PEM `CERTIFICATE REQUEST` with `opts.pem`; malformed input throws a typed `CsrError`. Parsing stays at `pki.schema.csr.parse` — `sign` |
 | `pki.attrcert` | RFC 5755 attribute-certificate issuance — `sign(spec, issuer, opts)` builds and signs an `AttributeCertificate` as an Attribute Authority: a `spec` of `holder` (exactly one of an entity name, a `baseCertificateID` public-key-certificate reference, a `fromCertificate` binding derived from a certificate, or an object digest), the validity window (GeneralizedTime), an optional serial (positive, ≤ 20 octets; randomly generated when omitted), the `attributes` (the privilege syntaxes — role, clearance, group, chargingIdentity, accessIdentity, authenticationInfo — or pre-encoded Attribute DER), and optional `extensions` (auditIdentity, targetInformation, noRevAvail, aaControls, acProxying, authorityKeyIdentifier, or pre-encoded Extension DER, each with its RFC 5755 criticality). An attribute certificate is never self-signed — the `issuer` is the signing AA, supplied as `{ cert, key }` or `{ name, publicKey, key }`. The signature algorithm is resolved from the AA key, so RSA (PKCS#1 v1.5 / PSS via `opts.pss`), ECDSA, EdDSA, ML-DSA, SLH-DSA, and the composite arms all sign without a per-algorithm branch, and the signature is verified under the AA public key before the certificate is returned. Returns DER, or a PEM `ATTRIBUTE CERTIFICATE` with `opts.pem`; malformed input throws a typed `AttrCertError`. Parsing stays at `pki.schema.attrcert.parse` — `sign` |
 | `pki.crmf` | RFC 4211 certificate-request-message issuance — `build(spec, key, opts)` assembles a `CertReqMessages`: a `spec` of `certReqId` (default 0; the RFC 9483 `-1` sentinel allowed), a `certTemplate` of the requested certificate fields (`subject`, `publicKey` — the SPKI DER of the key being certified — `validity`, requested `extensions`, an optional `version` 2), optional `controls` and `regInfo` (regToken / authenticator / utf8Pairs / oldCertID / protocolEncrKey, or pre-encoded `AttributeTypeAndValue` DER), and an optional `pop` selector. `key` (or `{ key }`) is the requester's private key — the message carries a `POPOSigningKey` proof of possession signed with the private half of `certTemplate.publicKey` (verified before the message is returned), exactly as a PKCS#10 CSR proves possession; a complete template signs the `CertRequest`, an incomplete one signs a `POPOSigningKeyInput`. The signature algorithm is resolved from the requested public key, so RSA (PKCS#1 v1.5 / PSS via `opts.pss`), ECDSA, EdDSA, ML-DSA, SLH-DSA, and the composite arms all sign without a per-algorithm branch. `key` is optional for a `raVerified` proof. Pass an array of specs for a batch; the CA-assigned template fields are never emitted. Returns DER, or a PEM block with `opts.pem`; malformed input throws a typed `CrmfError`. Parsing stays at `pki.schema.crmf.parse` — `build` |
-| `pki.cmp` | RFC 9810 Certificate Management Protocol message building — `build(message, opts)` assembles a protected `PKIMessage`. `message.header` carries the `sender` / `recipient` GeneralNames (including the anonymous NULL-DN) plus optional transaction metadata (`transactionID`, `senderNonce` / `recipNonce`, `messageTime` as a GeneralizedTime, `senderKID` / `recipKID`, `freeText`, `generalInfo`); `message.body` is a single-key object naming the arm. Request-side: `ir` / `cr` / `kur` (a `CertReqMessages` spec delegated to `pki.crmf.build`), `p10cr` (a PKCS#10 `CertificationRequest`), `certConf`, `pollReq`, `genm`, `rr`. CA/responder-side: `ip` / `cp` / `kup` / `ccp` (a `CertRepMessage` — `caPubs` and `response` entries carrying a `PKIStatusInfo` and, under a granting status, a `certifiedKeyPair`), `rp` (revocation response), `genp`, `error`, `pollRep`, `krp` (key-recovery response), `pkiconf`. Protection is exactly one of `opts.{ key, cert }` — a signature over the message under the sender key, the algorithm resolved from the signer certificate so RSA (PKCS#1 v1.5 / PSS), ECDSA, EdDSA, ML-DSA, SLH-DSA, and the composite arms all sign without a per-algorithm branch — or `opts.mac` — a PBMAC1 shared-secret HMAC (RFC 9481 / 9579, PBKDF2-derived). The protection covers the exact DER of the virtual `ProtectedPart` (the header and body) and is self-verified before the message is returned; the `protectionAlg` is derived, never caller-set, so the message the parser accepts is coherent by construction. Returns DER, or a PEM `CMP` block with `opts.pem`; malformed input throws a typed `CmpError`. Parsing stays at `pki.schema.cmp.parse` — `build` |
+| `pki.cmp` | RFC 9810 Certificate Management Protocol message building — `build(message, opts)` assembles a protected `PKIMessage`. `message.header` carries the `sender` / `recipient` GeneralNames (including the anonymous NULL-DN) plus optional transaction metadata (`transactionID`, `senderNonce` / `recipNonce`, `messageTime` as a GeneralizedTime, `senderKID` / `recipKID`, `freeText`, `generalInfo`); `message.body` is a single-key object naming the arm. Request-side: `ir` / `cr` / `kur` (a `CertReqMessages` spec delegated to `pki.crmf.build`), `p10cr` (a PKCS#10 `CertificationRequest`), `certConf`, `pollReq`, `genm`, `rr`. CA/responder-side: `ip` / `cp` / `kup` / `ccp` (a `CertRepMessage` — `caPubs` and `response` entries carrying a `PKIStatusInfo` and, under a granting status, a `certifiedKeyPair`), `rp` (revocation response), `genp`, `error`, `pollRep`, `krp` (key-recovery response), `pkiconf`. Protection is exactly one of `opts.{ key, cert }` — a signature over the message under the sender key, the algorithm resolved from the signer certificate so RSA (PKCS#1 v1.5 / PSS), ECDSA, EdDSA, ML-DSA, SLH-DSA, and the composite arms all sign without a per-algorithm branch — or `opts.mac` — a PBMAC1 shared-secret HMAC (RFC 9481 / 9579, PBKDF2-derived). The protection covers the exact DER of the virtual `ProtectedPart` (the header and body) and is self-verified before the message is returned; the `protectionAlg` is derived, never caller-set, so the message the parser accepts is coherent by construction. Returns DER, or a PEM `CMP` block with `opts.pem`; malformed input throws a typed `CmpError`. `transfer(url, message, opts)` carries a built message to a CMP endpoint over the shared `pki.transport` (RFC 9811 HTTP transfer) — one POST of the DER PKIMessage, the response classified fail-closed (200-only success, a non-200 2xx or an un-followed 3xx refused, a 4xx/5xx carrying a CMP error PKIMessage forwarded as the integrity-protected verdict) with protection surfaced not verified; `wellKnownUrl(base, opts)` builds the RFC 9811 §3.4 `/.well-known/cmp` request-URIs. Parsing stays at `pki.schema.cmp.parse` — `build`, `transfer`, `wellKnownUrl` |
 | `pki.crl` | RFC 5280 §5 certificate revocation list issuance — `sign(spec, issuer, opts)` builds and signs a `CertificateList`: a `spec` of `thisUpdate` / `nextUpdate`, an optional `crlNumber`, a `revoked` array (each entry a `serialNumber` + `revocationDate` with an optional `reason` or `invalidityDate`), and an optional `extensions` object (authority key identifier, issuing distribution point, delta-CRL indicator, freshest CRL, authority information access) or an array of pre-encoded Extension DER; an `issuer` of `{ cert, key }` or `{ name, publicKey, key }`. The signature algorithm is resolved from the issuer key, so RSA (PKCS#1 v1.5 / PSS via `opts.pss`), ECDSA, EdDSA, ML-DSA, SLH-DSA, and the composite arms all sign without a per-algorithm branch. The version is derived from the extension set (v2 when any CRL or entry extension is present, else v1), the outer `signatureAlgorithm` matches `tbsCertList.signature`, an empty revocation list omits the field rather than emitting an empty SEQUENCE, `reasonCode` is an ENUMERATED and `invalidityDate` is always GeneralizedTime, per-extension criticality is fixed by the RFC, and the produced signature is verified under the issuer key before return. `verify(crl, issuer)` checks a CRL signature through the one path-validation signature engine (algorithm-confusion and EdDSA low-order gates included), and `isRevoked(crl, serialNumber)` looks a serial up in the revocation list. Returns DER, or a PEM `X509 CRL` with `opts.pem`; malformed input throws a typed `CrlError`. Parsing stays at `pki.schema.crl.parse` — `sign` / `verify` / `isRevoked` |
 | `pki.key` | RFC 5958 / RFC 8018 key-material lifecycle — `encrypt(privateKey, password, opts)` wraps a PKCS#8 private key (DER, PEM, or an extractable `CryptoKey`) into an `EncryptedPrivateKeyInfo` under PBES2 (PBKDF2 + AES-CBC-Pad): `opts` selects the `cipher` (`aes-256-cbc` default, `aes-192-cbc`, `aes-128-cbc`), the `prf` (`hmacWithSHA256` default, SHA-384/512, SHA-1), the `iterations` (default 600000), and the `salt`; the plaintext is validated as PKCS#8 before encryption, a default `prf` and `keyLength` are omitted so the parameters are byte-exact with OpenSSL, and the output is re-parsed before return. `decrypt(encrypted, password, opts)` recovers the inner `PrivateKeyInfo` (re-validated through `pki.schema.pkcs8.parse`) — only PBES2/PBKDF2/AES-CBC is accepted (PBES1, PBMAC1, scrypt refused), the salt and iteration count are bounded before any derivation (`opts.maxIterations` lowers the cap), a malformed parameter set or wrong-length IV is a distinct typed error, and — because a MAC-less PBES2-CBC decrypt must not be a padding oracle (RFC 8018 §8) — a wrong password and a valid-pad-but-not-a-key both surface the one uniform `key/decrypt-failed`. `export(key, opts)` / `import(input, opts)` move a private key as PKCS#8 or a public key as SubjectPublicKeyInfo, delegating the encoding to WebCrypto so RSA carries an explicit NULL, EC a named curve, and Ed25519/Ed448/X25519/X448 omit parameters (an ambiguous RSA/EC import requires `opts.algorithm`). `generate(algorithm, opts)` produces a key pair over RSA, ECDSA/ECDH, the Edwards/Montgomery curves, and the FIPS post-quantum ML-DSA / ML-KEM, and `publicFromPrivate(privateKey)` derives the public key. Returns DER or PEM; fail-closed with typed `KeyError`. Parsing stays at `pki.schema.pkcs8.parse` — `encrypt` / `decrypt` / `export` / `import` / `generate` / `publicFromPrivate` |
 | `pki.pkcs12` | RFC 7292 / RFC 9579 PKCS#12 (.p12/.pfx) issuance — `build(spec, opts)` assembles a password-integrity store. `spec` is the OpenSSL-style `{ key, cert, ca?, friendlyName?, localKeyId? }` or the full `{ safeContents: [...] }`, where each element is a plaintext or PBES2-encrypted `SafeContents` of key / shroudedKey / cert / crl / secret / nested `safeContents` bags. Keys and certs are validated before wrapping; `friendlyName` (BMPString) and `localKeyId` attributes are single-value. The store is protected by a classic Appendix B HMAC (default, max interop) or an RFC 9579 PBMAC1 (`opts.mac.algorithm`), over SHA-256/384/512, with the shrouded keys and cert safes encrypted under RFC 8018 PBES2 (AES-128/192/256-CBC). Every password is encoded the PKCS#12 way — BMPString+NULL for the classic MAC, UTF-8 for the PBES2 bags and PBMAC1 (what OpenSSL and NSS consume) — so a file it emits opens in OpenSSL and NSS, cross-checked bidirectionally. The MAC is computed over the exact AuthenticatedSafe byte range, a DEFAULT-1 `MacData.iterations` is rejected up front, and the store is re-parsed before return. `verifyMac(pfx, password, opts)` recomputes a store's classic or PBMAC1 MAC over `macedBytes` and constant-time-compares it, throwing on a MAC-less or public-key-integrity store. **Public-key integrity** (`opts.integrity.mode: "public-key"`) wraps the AuthenticatedSafe in a CMS SignedData instead of a MAC — a signature from any `pki.cms.sign` signer (RSA / ECDSA / EdDSA / ML-DSA / SLH-DSA / composite), no MacData (RFC 7292 §4); privacy stays independent, so the `password` still PBES2-encrypts the bags. Legacy-PBE (PKCS#12 Appendix C) bag decryption is not yet built. Returns DER or a PEM `PKCS12`; fail-closed with typed `Pkcs12Error`. `open(pfx, password, opts)` reads a store back: it verifies the MAC **first** (a wrong password is the MAC verdict, not a decrypt error), then PBES2-decrypts every privacy safe and shrouded key bag and returns `{ integrityMode, macVerified, signers, keys, certs, crls, secrets }` — keys as re-validated PKCS#8 DER, certs/CRLs/secrets as raw DER, all with `friendlyName`/`localKeyId`, nested safes recursively. A MAC-less store is refused unless `opts.allowUnauthenticated`; a **public-key-integrity store is verified through its CMS SignedData signature first** (`pkcs12/signature-invalid` on failure, the signer surfaced in `signers` but never trust-chained — the caller's `pki.path.validate` step); a legacy-PBE store is refused; a post-integrity decrypt failure is the uniform `pkcs12/decrypt-failed`, and `opts.keys: 'crypto'` imports each key to a `CryptoKey`; it reads what OpenSSL and NSS produce. Parsing stays at `pki.schema.pkcs12.parse` — `build` / `verifyMac` / `open` |
@@ -272,10 +272,11 @@ certificate and writes a DER (or `--pem`) SignedData to `--out` or stdout.
 
 ### What's coming
 
-The CMP HTTP transport (RFC 9811), the remaining EST network verbs
-(`/serverkeygen`, `/csrattrs`, `/fullcmc`) and HTTP Digest auth, SCEP and CMC
-enrollment, and additional NIST-on-ramp PQC signatures as the OID registry
-admits them are on the roadmap and ride this same core. See
+A stateful CMP transaction orchestrator (the `certConf` / `pollReq` round-trips),
+the remaining EST network verbs (`/serverkeygen`, `/csrattrs`, `/fullcmc`) and
+HTTP Digest auth, SCEP and CMC enrollment, and additional NIST-on-ramp PQC
+signatures as the OID registry admits them are on the roadmap and ride this same
+core. See
 [ROADMAP.md](ROADMAP.md) for the full plan and current status of each area, and
 [CHANGELOG.md](CHANGELOG.md) for what has landed.
 

package/lib/cmp-build.js

@@ -41,6 +41,7 @@ var webcrypto = require("./webcrypto");
 var pbes2 = require("./pbes2");
 var constants = require("./constants");
 var guard = require("./guard-all");
+var httpTransport = require("./http-transport");
 var frameworkError = require("./framework-error");
 
 var CmpError = frameworkError.CmpError;
@@ -632,4 +633,244 @@ function _collectExtraCerts(opts, protCertDer) {
  *     { key: signerKeyPkcs8, cert: signerCertDer });
  *   pki.schema.cmp.parse(der).body.arm;   // "p10cr"
  */
-module.exports = { build: build };
+
+// ---- the thin RFC 9811 HTTP transfer verb: POST a DER PKIMessage over the shared pki.transport ----
+//
+// RFC 9811 defines exactly ONE client operation -- POST a DER PKIMessage, receive a DER PKIMessage -- so
+// every CMP exchange (ir / p10cr / certConf / pollReq / rr / genm ...) rides this single stateless verb;
+// the caller builds+protects the message upstream with pki.cmp.build and hands the finished bytes here,
+// which are POSTed VERBATIM (the protection covers them). No socket is opened by this codec -- the verb
+// composes pki.schema.cmp.parse over pki.transport, exactly as pki.est / pki.acme wire their message layers.
+
+var DEFAULT_TRANSFER_TIMEOUT = constants.TIME.seconds(30);
+var MAX_TRANSFER_TIMEOUT = constants.TIME.seconds(600);
+var PKIXCMP = "application/pkixcmp";
+var PKIXCMP_POLL = "application/pkixcmp-poll";   // the legacy type handled "like application/pkixcmp" (RFC 9811 sec. 4)
+var KNOWN_TRANSFER_OPTS = { transport: 1, tls: 1, headers: 1, timeout: 1, maxResponseBytes: 1 };
+
+// The DER of a caller-supplied PKIMessage: a DER Buffer / Uint8Array re-viewed through guard.bytes.view
+// (sent VERBATIM -- protection covers these exact bytes), a PEM "CMP" string decoded, else a config-time
+// cmp/bad-input before the wire. The re-view fails a DETACHED backing buffer (a transferred / structuredClone'd
+// view reads as zero-length) as cmp/bad-input rather than silently POSTing an empty body in its place.
+function _cmpMessageDer(input) {
+  var der;
+  if (Buffer.isBuffer(input) || input instanceof Uint8Array) der = guard.bytes.view(input, CmpError, "cmp/bad-input", "the CMP message DER");
+  else if (typeof input === "string") {
+    // Normalize a PEM decode failure (no block, wrong armor label, malformed base64) to the stable
+    // cmp/bad-input at this input boundary, rather than leaking the PEM layer's PemError to the caller.
+    try { der = cmp.pemDecode(input); }
+    catch (e) { throw _err("cmp/bad-input", "the CMP message is not a valid PEM CMP block", e); }
+  } else throw _err("cmp/bad-input", "a CMP message must be a DER Buffer/Uint8Array or a PEM CMP string");
+  // Validate the bytes ARE a PKIMessage before the wire (transfer accepts a DER PKIMessage), so malformed
+  // input fails locally as cmp/bad-input rather than crossing the network seam. parse validates only -- the
+  // ORIGINAL der is returned for the verbatim POST (protection covers the exact bytes; nothing re-serialized).
+  try { cmp.parse(der); }
+  catch (e) { throw _err("cmp/bad-input", "the CMP message is not a valid PKIMessage", e); }
+  return der;
+}
+
+// Map opts.tls (operator-facing) to the transport request.tls shape. rejectUnauthorized is NOT here --
+// the transport forces it on unconditionally; the verb never disables server verification.
+function _tlsForTransfer(opts) {
+  var t = opts.tls || {};
+  return { anchors: t.anchors, useSystemStore: t.useSystemStore, cert: t.cert, key: t.key, minVersion: t.minVersion, servername: t.servername, checkServerIdentity: t.checkServerIdentity };
+}
+
+// The response content-type token (before any ;-parameters), lowercased; is it a CMP media type?
+function _ctypeToken(headers) { return String((headers || {})["content-type"] || "").split(";")[0].trim().toLowerCase(); }
+function _isPkixcmp(headers) { var t = _ctypeToken(headers); return t === PKIXCMP || t === PKIXCMP_POLL; }
+
+// Classify the CMP HTTP response (RFC 9811 sec. 3.1/3.2/4). 200 + a pkixcmp body -> parse + resolve;
+// another 2xx -> reject (a request response MUST be 200, sec. 3.1); 3xx -> not followed (sec. 3.1/5);
+// 4xx/5xx WITH a well-formed CMP body -> FORWARD the integrity-protected verdict (sec. 1.2/3.1), else
+// cmp/http-error. The HTTP status is surfaced as DATA, never used to set the transaction verdict (sec. 5).
+// `body` is always a Buffer (the verb normalizes it before the size cap).
+function _classifyCmpResponse(status, headers, body, tls) {
+  var ctype = _ctypeToken(headers);
+  if (status === 200) {
+    if (!_isPkixcmp(headers)) throw _err("cmp/bad-content-type", "a 200 CMP response must be application/pkixcmp (RFC 9811 sec. 3.2), got " + JSON.stringify(ctype || null));
+    if (body.length === 0) throw _err("cmp/empty-response", "a 200 CMP response carried an empty body (RFC 9811 sec. 3.3)");
+    return { response: cmp.parse(body), responseBytes: body, status: 200, contentType: ctype, tls: tls };   // a malformed body surfaces the parser's fail-closed cmp/* verdict
+  }
+  // Below 200, every branch requires a valid HTTP status INTEGER -- a missing / non-numeric / out-of-range
+  // status from an injected transport must not fall through to the forward branch as if it were a 4xx/5xx.
+  var httpStatus = (typeof status === "number" && Number.isSafeInteger(status) && status >= 100 && status <= 599) ? status : null;
+  if (httpStatus !== null && httpStatus >= 300 && httpStatus < 400) throw _err("cmp/redirect-not-followed", "a CMP " + httpStatus + " redirect is not followed (RFC 9811 sec. 3.1, sec. 5); reconfigure the endpoint URL");
+  if (httpStatus !== null && httpStatus >= 400 && httpStatus <= 599) {
+    if (_isPkixcmp(headers) && body.length > 0) {
+      var forwarded;
+      try { forwarded = cmp.parse(body); }
+      catch (e) { throw _err("cmp/http-error", "the CMP server returned HTTP " + httpStatus + " with an undecodable body", e); }
+      // Only a CMP `error` message is a coherent verdict to forward on an HTTP failure. A 4xx/5xx carrying a
+      // non-error arm (a granting `ip`, a `pkiconf`) is contradictory -- the HTTP layer says failure while the
+      // CMP body says success -- so it is NOT accepted as a usable response; the HTTP failure stands.
+      if (forwarded.body.arm !== "error") throw _err("cmp/http-error", "the CMP server returned HTTP " + httpStatus + " with a non-error '" + forwarded.body.arm + "' body; an HTTP failure forwards only a CMP error message (RFC 9811 sec. 1.2/3.1)");
+      return { response: forwarded, responseBytes: body, status: httpStatus, contentType: ctype, tls: tls };
+    }
+    throw _err("cmp/http-error", "the CMP server returned HTTP " + httpStatus + " with no forwardable CMP error body");
+  }
+  // Any other status -- a non-200 2xx, a 1xx informational, or a non-numeric / out-of-range value.
+  throw _err("cmp/unexpected-status", "a CMP response must be HTTP 200 (or a 4xx/5xx carrying a CMP error), not " + JSON.stringify(status) + " (RFC 9811 sec. 3.1)");
+}
+
+function transfer(url, message, opts) {
+  return Promise.resolve().then(function () { return _transfer(url, message, opts); });
+}
+
+function _transfer(url, message, opts) {
+  opts = opts || {};
+  Object.keys(opts).forEach(function (k) { if (!KNOWN_TRANSFER_OPTS[k]) throw _err("cmp/bad-input", "unknown opts field " + JSON.stringify(k)); });
+  var der = _cmpMessageDer(message);   // config gate: before any transport call
+  var parsedUrl;
+  try { parsedUrl = new URL(String(url)); }   // parse only -- NO client scheme gate (the transport owns socket security)
+  catch (e) { throw _err("cmp/bad-url", "the CMP URL did not parse: " + String(url), e); }
+  var transport = opts.transport;
+  if (!transport) {
+    var t = opts.tls || {};
+    var hasAnchors = t.anchors !== undefined && t.anchors !== null && !(Array.isArray(t.anchors) && t.anchors.length === 0);
+    if (!hasAnchors && t.useSystemStore !== true) throw _err("cmp/no-trust-anchors", "no explicit trust anchor and tls.useSystemStore not set to true -- refusing an unpinned server (RFC 9811 sec. 5)");
+    transport = httpTransport.https({ E: _err, errPrefix: "cmp" });
+  }
+  var timeout = guard.limits.cap(opts.timeout, "timeout", DEFAULT_TRANSFER_TIMEOUT, { E: _err, code: "cmp/bad-input", min: 1, max: MAX_TRANSFER_TIMEOUT });
+  var maxResponseBytes = guard.limits.cap(opts.maxResponseBytes, "maxResponseBytes", constants.LIMITS.HTTP_MAX_RESPONSE_BYTES, { E: _err, code: "cmp/bad-input", min: 1, max: constants.LIMITS.HTTP_MAX_RESPONSE_BYTES });
+  // Build the request headers: forward custom opts.headers but STRIP the request-framing headers
+  // (content-length, transfer-encoding) and ANY content-type case variant -- the verb sets the content-type
+  // and the transport computes Content-Length from the exact body, so a caller cannot desync the request
+  // framing (HTTP request smuggling via a short/long content-length) or override the media type through
+  // header-name casing (a "Content-Type" that Object.assign would keep alongside the lowercase one).
+  var headers = {};
+  Object.keys(opts.headers || {}).forEach(function (k) {
+    var lk = k.toLowerCase();
+    if (lk !== "content-length" && lk !== "transfer-encoding" && lk !== "content-type") headers[k] = opts.headers[k];
+  });
+  headers["content-type"] = PKIXCMP;
+  var tls = _tlsForTransfer(opts);
+  return Promise.resolve(transport({ method: "POST", url: parsedUrl.href, headers: headers, body: der, tls: tls, timeout: timeout, maxResponseBytes: maxResponseBytes })).then(function (res) {
+    res = res || {};
+    var h = {};
+    Object.keys(res.headers || {}).forEach(function (k) { h[k.toLowerCase()] = res.headers[k]; });
+    // Normalize the response body to a Buffer preserving its exact bytes: a binary view (Buffer / Uint8Array
+    // from an injected transport) is re-viewed through the byte guard, as the request path does; only a
+    // genuine string body falls back to a UTF-8 encode (the width a real socket already counts) so the size
+    // cap and the parser see the same bytes -- a typed array is not stringified to "48,130,..." garbage.
+    var body = (Buffer.isBuffer(res.body) || res.body instanceof Uint8Array)
+      ? guard.bytes.view(res.body, CmpError, "cmp/bad-response", "the CMP response body")
+      : Buffer.from(String(res.body == null ? "" : res.body), "utf8");
+    if (body.length > maxResponseBytes) throw _err("cmp/response-too-large", "the response body (" + body.length + " bytes) exceeds the " + maxResponseBytes + "-byte cap");
+    return _classifyCmpResponse(res.status, h, body, res.tls || null);
+  });
+}
+
+// A single safe path segment for a well-known URI: no separator, dot-segment, or reserved/space char that
+// would retarget the resource; percent-encoded on the way out. Fails closed (guards never guess a value).
+function _wellKnownSeg(v, name) {
+  var s = String(v);
+  if (s === "" || s === "." || s === ".." || /[/?#\s\\]/.test(s)) throw _err("cmp/bad-url", "the CMP " + name + " must be a single safe path segment (no '/', dot-segment, or reserved char): " + JSON.stringify(s));
+  // encodeURIComponent throws a raw URIError (no .code) on an unpaired UTF-16 surrogate; normalize it to the
+  // helper's cmp/bad-url contract so a malformed-config segment never escapes as an untyped error.
+  try { return encodeURIComponent(s); }
+  catch (e) { throw _err("cmp/bad-url", "the CMP " + name + " is not encodable (e.g. an unpaired surrogate): " + JSON.stringify(s), e); }
+}
+
+var KNOWN_WELLKNOWN_OPTS = { label: 1, operation: 1 };
+
+function wellKnownUrl(base, opts) {
+  opts = opts || {};
+  // Reject an unknown option key (a typo like { lable } / { operaton }), as build/transfer do -- a silently
+  // ignored option would build the DEFAULT endpoint and send the request to a different CA/profile.
+  Object.keys(opts).forEach(function (k) { if (!KNOWN_WELLKNOWN_OPTS[k]) throw _err("cmp/bad-input", "unknown wellKnownUrl option " + JSON.stringify(k) + " (expected label / operation)"); });
+  var u;
+  try { u = new URL(String(base)); }
+  catch (e) { throw _err("cmp/bad-url", "the CMP base URL did not parse: " + String(base), e); }
+  // Require an http(s) authority: a non-HTTP scheme (file:, data:, a custom scheme) has an opaque origin
+  // ("null"), which would build a nonsensical "null/.well-known/cmp". A well-known URI is an HTTP concept
+  // (RFC 8615); https vs http is left to the transport (Build decision 6), but the scheme must be one of them.
+  if (u.protocol !== "https:" && u.protocol !== "http:") throw _err("cmp/bad-url", "the CMP base URL must be http or https (a well-known URI is authority-rooted over HTTP), got " + u.protocol + ": " + JSON.stringify(String(base)));
+  if (u.search || u.hash) throw _err("cmp/bad-url", "the CMP base URL must not carry a query or fragment component (RFC 9811 sec. 3.4)");
+  // A backslash has no place in an http(s) authority: WHATWG rewrites it to a path separator (so
+  // `https://ca.example\tenant` is really the path `/tenant`), but the raw-path regex below excludes only
+  // `/?#` and would swallow it as authority, slipping a supplied path past the check. Reject it outright.
+  if (/\\/.test(String(base))) throw _err("cmp/bad-url", "the CMP base URL must not contain a backslash (WHATWG rewrites it to a path separator): " + JSON.stringify(String(base)));
+  // An RFC 8615 well-known URI is AUTHORITY-ROOTED (/.well-known/...), so a base carrying ANY path is
+  // rejected fail-closed -- an operator whose CMP endpoint sits under a path passes that full operation URL
+  // to transfer() directly. Inspect the RAW path in the source string, NOT url.pathname: WHATWG normalizes
+  // dot-segments (`/tenant/..`, `/%2e`) to "/" before the parse, which would slip a supplied path past a
+  // pathname check and silently target the authority-root profile instead of reporting the misconfiguration.
+  var rawBasePath = String(base).replace(/^[a-z]+:\/\/[^/?#]*/i, "").split(/[?#]/)[0];
+  if (rawBasePath !== "" && rawBasePath !== "/") throw _err("cmp/bad-url", "an RFC 8615 well-known URI is authority-rooted; the CMP base URL must have no path component (pass a full operation URL to transfer instead): " + JSON.stringify(String(base)));
+  var segs = [".well-known", "cmp"];
+  if (opts.label != null) { segs.push("p"); segs.push(_wellKnownSeg(opts.label, "label")); }
+  if (opts.operation != null) segs.push(_wellKnownSeg(opts.operation, "operation"));
+  return u.origin + "/" + segs.join("/");
+}
+
+/**
+ * @primitive  pki.cmp.transfer
+ * @signature  pki.cmp.transfer(url, message, opts?) -> Promise<{ response, responseBytes, status, contentType, tls }>
+ * @since      0.3.19
+ * @status     experimental
+ * @spec       RFC 9811, RFC 9810
+ * @related    pki.cmp.build, pki.cmp.wellKnownUrl, pki.schema.cmp.parse, pki.transport.https
+ *
+ * POST a DER `PKIMessage` to a CMP endpoint and return the parsed response `PKIMessage`, over the shared
+ * `pki.transport`. RFC 9811 transfers every CMP exchange identically -- one HTTP POST of a DER PKIMessage,
+ * one response PKIMessage -- so a single stateless verb carries `ir` / `cr` / `kur` / `p10cr` / `certConf`
+ * / `pollReq` / `rr` / `genm` and their responses; the caller builds and protects the message upstream with
+ * `pki.cmp.build` and hands the finished bytes here. `message` is a DER `Buffer`/`Uint8Array` or a PEM `CMP`
+ * string, sent VERBATIM (the message-layer protection covers these exact bytes -- they are never re-encoded).
+ * The response is classified fail-closed: HTTP 200 carrying an `application/pkixcmp` body is parsed and
+ * resolved; another 2xx is `cmp/unexpected-status` (RFC 9811 requires 200); a 3xx is `cmp/redirect-not-followed`
+ * (never auto-followed, sec. 3.1/5); a 4xx/5xx carrying a well-formed CMP `error` PKIMessage FORWARDS that
+ * integrity-protected verdict (sec. 1.2/3.1) with the HTTP status surfaced as data, while a 4xx/5xx that is
+ * not a CMP `error` message (no body, an undecodable body, or a non-error arm) is `cmp/http-error`.
+ * Protection is SURFACED, not verified -- the client confers no trust; the
+ * caller (or a future `pki.cmp.verify`) checks the response protection using the raw `headerBytes`/`bodyBytes`.
+ * By default the transport is https-only and requires an explicit trust anchor; there is no client scheme
+ * gate, so an operator who injects an http-capable transport reaches the RFC-9811-permitted plain-HTTP path.
+ *
+ * @opts
+ *   - `transport` -- an injectable `transport(request) -> Promise<{status,headers,body}>` (default
+ *     `pki.transport.https`, which fail-closes on a non-https URL and an unpinned server).
+ *   - `tls` -- `{ anchors, useSystemStore, cert, key, minVersion, servername, checkServerIdentity }` for the
+ *     default transport (mutual-TLS `cert`/`key` is common for CMP in addition to message protection).
+ *   - `headers` -- extra request headers. The `content-type: application/pkixcmp` is always set and not
+ *     overridable (any casing), and the request-framing headers (`content-length`, `transfer-encoding`) are
+ *     stripped -- the transport computes Content-Length from the exact body, so a caller cannot desync framing.
+ *   - `timeout` -- ms (default 30s); `maxResponseBytes` -- streaming cap, tightenable downward only.
+ * @example
+ *   var reqDer = await pki.cmp.build(
+ *     { header: { sender: { directoryName: "CN=client" }, recipient: { directoryName: "CN=CA" } },
+ *       body: { p10cr: csrDer } },
+ *     { key: signerKeyPkcs8, cert: signerCertDer });
+ *   var url = pki.cmp.wellKnownUrl("https://ca.example", { operation: "p10cr" });
+ *   var res = await pki.cmp.transfer(url, reqDer, { transport: transport });
+ *   res.response.body.arm;   // "ip" | "cp" | "error"
+ */
+
+/**
+ * @primitive  pki.cmp.wellKnownUrl
+ * @signature  pki.cmp.wellKnownUrl(base, opts?) -> string
+ * @since      0.3.19
+ * @status     experimental
+ * @spec       RFC 9811, RFC 8615
+ * @related    pki.cmp.transfer
+ *
+ * Build an RFC 9811 sec. 3.4 CMP request-URI under the `/.well-known/cmp` prefix (RFC 8615). The four forms:
+ * `<base>/.well-known/cmp`, `.../<operation>`, `.../p/<label>`, and `.../p/<label>/<operation>`. A pure string
+ * builder over an authority-rooted well-known path (RFC 8615) -- https vs http is left to the transport (both
+ * forms are accepted, RFC 9811 sec. 3.4), but the `base` MUST be an http(s) URL. It rejects (`cmp/bad-url`) an
+ * unparseable `base`, a non-http(s) scheme (`file:`/`data:`/a custom scheme has an opaque origin), a `base`
+ * carrying a path / query / fragment (a well-known URI is authority-rooted; a path would capture it), and a
+ * `label`/`operation` that is empty, a dot-segment, or contains a `/` or other reserved char (never silently
+ * retarget the resource). The `operation` label is a caller-supplied string, not validated against a profile
+ * vocabulary (RFC 9483 is out of scope).
+ *
+ * @opts
+ *   - `label` -- an optional CA/RA name inserted as `.../p/<label>` (a single percent-encoded path segment).
+ *   - `operation` -- an optional operation label appended as the final path segment.
+ * @example
+ *   pki.cmp.wellKnownUrl("https://ca.example");                          // "https://ca.example/.well-known/cmp"
+ *   pki.cmp.wellKnownUrl("https://ca.example", { label: "myca", operation: "cr" });
+ *   //                                                                   // ".../.well-known/cmp/p/myca/cr"
+ */
+module.exports = { build: build, transfer: transfer, wellKnownUrl: wellKnownUrl };

package/lib/http-transport.js

@@ -178,6 +178,19 @@ function httpsTransport(defaults) {
     var body = request.body;
     if (Buffer.isBuffer(body)) body = guard.bytes.view(body, E, C("bad-input"), "the request body");
 
+    // Frame a body-bearing request with a fixed Content-Length computed from the EXACT body, so it is sent
+    // length-delimited rather than Transfer-Encoding: chunked (node's default when a body is written with no
+    // Content-Length -- which strict enrollment / CMP appliances reject). A caller-supplied content-length
+    // (any case) is dropped: the transport owns request framing and never trusts a possibly-mismatched value.
+    var reqHeaders = Object.assign({}, request.headers || {});
+    if (body != null && body !== "") {
+      // Drop BOTH caller-supplied framing headers before installing the fixed length: node rejects a request
+      // carrying Content-Length AND Transfer-Encoding together (HPE_INVALID_CONTENT_LENGTH), and the transport
+      // owns framing -- it never honors a caller's chunked directive or a mismatched length.
+      Object.keys(reqHeaders).forEach(function (k) { var lk = k.toLowerCase(); if (lk === "content-length" || lk === "transfer-encoding") delete reqHeaders[k]; });
+      reqHeaders["Content-Length"] = Buffer.byteLength(body);
+    }
+
     // URL.hostname keeps the square brackets on an IPv6 literal ([2001:db8::1]); node's `hostname`
     // option and its IP-detection expect the bare address, so strip the brackets once here.
     var host = url.hostname.replace(/^\[(.*)\]$/, "$1");
@@ -186,7 +199,7 @@ function httpsTransport(defaults) {
       hostname: host,
       port: url.port || 443,
       path: url.pathname + url.search,
-      headers: request.headers || {},
+      headers: reqHeaders,
       minVersion: minVersion,
       rejectUnauthorized: true,   // ALWAYS on -- there is no code path that disables server verification
       // Opt out of connection pooling: node's keep-alive agent keys the socket pool on host + TLS

package/lib/ip-utils.js

@@ -56,4 +56,14 @@ function expandIpv6Hex(ip) {
 // Is `s` a syntactically valid IPv4 or IPv6 textual literal?
 function isIpLiteral(s) { return isIPv4(s) || expandIpv6Hex(s) !== null; }
 
-module.exports = { isIPv4: isIPv4, expandIpv6Hex: expandIpv6Hex, isIpLiteral: isIpLiteral, IPV4_RE: IPV4_RE };
+// Pack an IPv4/IPv6 textual literal to its network-order octets -- 4 for IPv4, 16 for IPv6 --
+// or null when `s` is not a valid literal. The binary inverse of the textual forms isIPv4 /
+// expandIpv6Hex validate, so a SAN/GeneralName iPAddress (RFC 5280 sec. 4.2.1.6, always a bare
+// host address of 4 or 16 octets) can be given as a string instead of a pre-packed Buffer.
+function packIpLiteral(s) {
+  if (isIPv4(s)) return Buffer.from(s.split(".").map(Number));   // each octet already range-checked by IPV4_RE
+  var hex = expandIpv6Hex(s);
+  return hex === null ? null : Buffer.from(hex, "hex");
+}
+
+module.exports = { isIPv4: isIPv4, expandIpv6Hex: expandIpv6Hex, isIpLiteral: isIpLiteral, packIpLiteral: packIpLiteral, IPV4_RE: IPV4_RE };

package/lib/pkcs12-build.js

@@ -55,9 +55,14 @@ var DEFAULT_MAC_ITER = 2048;
 var DEFAULT_PBMAC1_ITER = 2048;
 var MAC_SALT_BYTES = 8;
 var MAX_PBMAC1_KEYLEN = 1024;   // an HMAC key beyond a hash block is pointless -- bound the derived length
-// The classic Appendix B KDF is a SYNCHRONOUS JS hash loop (unlike native/async PBKDF2), so its iteration
-// count is capped far lower than the PBKDF2 limit -- a store just under the PBKDF2 cap would block the event
-// loop for seconds. 1e6 is ~500x the OpenSSL default (2048) yet bounds the loop to a fraction of a second.
+// Both MAC paths cap iterations to bound the SYNCHRONOUS derivation that blocks the event loop, but at
+// different counts BECAUSE the per-iteration cost differs by ~5x -- the two ceilings target a comparable
+// ~1-2 second wall-clock budget, not inconsistent DoS budgets. The classic Appendix B KDF is a hand-rolled
+// JS hash loop (a createHash per iteration, ~1.1us each, so 1e6 ~= 1s); PBMAC1 derives via native
+// crypto.pbkdf2Sync (one FFI call, ~0.2us per iteration, so the shared C.LIMITS.PBKDF2_MAX_ITERATIONS of 1e7
+// ~= 2s). The 10x iteration-count gap is thus calibrated to wall clock; additionally the classic count is
+// pkcs12-local (its KDF is bespoke here) while PBMAC1 reuses the toolkit-wide PBKDF2 ceiling. 1e6 is ~500x
+// the OpenSSL default (2048) yet still bounds the loop to ~1 second.
 var CLASSIC_MAC_MAX_ITERATIONS = 1000000;
 
 // The classic App. B.2 KDF (u = hash output bytes, v = compression block bytes) per RFC 7292 App. B.2.
@@ -289,6 +294,8 @@ async function _buildMacData(macOpts, sharedPassword, authSafeDer) {
   if (algorithm === "pbmac1") {
     var prf = PBMAC1_PRF[hash];
     if (!prf) throw _err("pkcs12/unsupported-algorithm", "PBMAC1 requires a SHA-256/384/512 digest (RFC 9579 sec. 5/7 forbids a <= 160-bit digest, e.g. SHA-1)");
+    // Native PBKDF2 (~0.2us/iter) tolerates the toolkit-wide PBKDF2 ceiling where the classic JS-loop KDF
+    // caps ~10x lower; both target a comparable ~1-2s wall clock (see CLASSIC_MAC_MAX_ITERATIONS).
     var iter2 = _assertMacIter(macOpts.iterations == null ? DEFAULT_PBMAC1_ITER : macOpts.iterations, C.LIMITS.PBKDF2_MAX_ITERATIONS);
     var keyLen = macOpts.keyLength != null ? macOpts.keyLength : prf.keyLen;
     if (typeof keyLen !== "number" || !Number.isInteger(keyLen) || keyLen < 20 || keyLen > MAX_PBMAC1_KEYLEN) throw _err("pkcs12/bad-input", "PBMAC1 keyLength must be an integer in [20, " + MAX_PBMAC1_KEYLEN + "] (RFC 9579 sec. 9)");

package/lib/pki-build.js

@@ -15,10 +15,16 @@ var schema = require("./schema-engine");
 var compositeSig = require("./composite-sig");
 var guard = require("./guard-all");
 var oid = require("./oid");
+var ipUtils = require("./ip-utils");
 var nodeCrypto = require("crypto");
 
 var b = asn1.build;
 
+// A well-formed dotted-decimal OID: a first arc 0-2 followed by one or more non-leading-zero arcs. Used to
+// accept a raw OID string (an unregistered KeyPurposeId / policy OID) where a registered name would go; the
+// encoder (encodeOidContent) remains the authoritative validator of the arc-value bounds.
+var DOTTED_OID_RE = /^[0-2](?:\.(?:0|[1-9]\d*))+$/;
+
 // KeyUsage named-bit positions (RFC 5280 sec. 4.2.1.3); contentCommitment is the RFC 5280 rename of the
 // X.509 nonRepudiation bit (1).
 var KU_BIT = {
@@ -112,8 +118,16 @@ function makeBuilder(ctx) {
       case "dNSName": return b.contextPrimitive(2, ia5Content(v));
       case "uniformResourceIdentifier": case "uri": return b.contextPrimitive(6, ia5Content(v));
       case "iPAddress":
-        if (!Buffer.isBuffer(v) || (v.length !== 4 && v.length !== 16)) throw E("bad-input", "iPAddress must be a 4- or 16-octet Buffer");
-        return b.contextPrimitive(7, v);
+        // Accept a dotted-quad / colon-hex string (packed to its 4/16 network octets) as well as a
+        // pre-packed Buffer, so an iPAddress SAN reads like dNSName/URI rather than forcing the caller
+        // to pack octets by hand (RFC 5280 sec. 4.2.1.6 -- a GeneralName iPAddress is a bare host address).
+        var ipBuf = v;
+        if (typeof v === "string") {
+          ipBuf = ipUtils.packIpLiteral(v);
+          if (ipBuf === null) throw E("bad-input", "iPAddress string is not a valid IPv4 or IPv6 literal: " + JSON.stringify(v));
+        }
+        if (!Buffer.isBuffer(ipBuf) || (ipBuf.length !== 4 && ipBuf.length !== 16)) throw E("bad-input", "iPAddress must be a 4- or 16-octet Buffer or an IPv4/IPv6 string");
+        return b.contextPrimitive(7, ipBuf);
       case "directoryName": return b.explicit(4, encodeName(v));   // Name is a CHOICE -> the context tag is EXPLICIT
       default: throw E("bad-input", "unsupported GeneralName form " + JSON.stringify(k) + " (supported: rfc822Name, dNSName, uniformResourceIdentifier, iPAddress, directoryName)");
     }
@@ -129,13 +143,26 @@ function makeBuilder(ctx) {
     });
     return b.namedBitString(positions);
   }
+  // Resolve an OID token to a dotted-decimal OID: a registered name via the registry, OR a raw dotted-OID
+  // string accepted directly (an unregistered KeyPurposeId / policy OID -- BIMI, document-signing, vendor
+  // purposes -- is a common valid input). A token that is neither fails closed (never silently accept a
+  // typo'd name); a dotted string that passes the shape check is still arc-validated by b.oid's encoder.
+  function _resolveOid(n, label) {
+    var dotted = O(n);
+    if (dotted != null) return dotted;
+    if (typeof n === "string" && DOTTED_OID_RE.test(n)) {
+      // The regex fixes the general shape; b.oid's encoder is the authoritative X.660 arc-bounds check
+      // (a first arc 0/1 caps the second at 39; an arc must DER-encode). A failure there is THIS producer's
+      // bad-input, not a leaked oid/* code, so every shared-builder consumer keeps its own error contract.
+      try { b.oid(n); }
+      catch (e) { throw E("bad-input", "invalid " + label + " OID " + JSON.stringify(n) + " (violates the X.660 arc bounds)", e); }
+      return n;
+    }
+    throw E("bad-input", "unknown " + label + " " + JSON.stringify(n) + " (expected a registered name or a dotted-decimal OID)");
+  }
   function extExtKeyUsage(names) {
     if (!Array.isArray(names) || !names.length) throw E("bad-input", "extendedKeyUsage must list at least one KeyPurposeId");
-    return b.sequence(names.map(function (n) {
-      var purposeOid = O(n);
-      if (purposeOid == null) throw E("bad-input", "unknown extendedKeyUsage purpose " + JSON.stringify(n));
-      return b.oid(purposeOid);
-    }));
+    return b.sequence(names.map(function (n) { return b.oid(_resolveOid(n, "extendedKeyUsage purpose")); }));
   }
   function validateBcSpec(bc) {
     if (bc.cA != null && typeof bc.cA !== "boolean") throw E("bad-input", "basicConstraints cA must be a boolean");
@@ -173,8 +200,7 @@ function makeBuilder(ctx) {
     if (!Array.isArray(names) || !names.length) throw E("bad-input", "certificatePolicies must list at least one policy OID");
     var seen = {};
     return b.sequence(names.map(function (n) {
-      var pOid = O(n);
-      if (pOid == null) throw E("bad-input", "unknown certificate policy " + JSON.stringify(n));
+      var pOid = _resolveOid(n, "certificate policy");
       if (seen[pOid]) throw E("bad-input", "duplicate certificate policy " + JSON.stringify(n) + " (RFC 5280 sec. 4.2.1.4)");
       seen[pOid] = true;
       return b.sequence([b.oid(pOid)]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.3.18",
+  "version": "0.3.19",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:38b1d773-a2de-428b-848c-aece31c991f9",
+  "serialNumber": "urn:uuid:5ea5efe8-4feb-403c-ab5c-154dfdb673c4",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-25T19:26:20.442Z",
+    "timestamp": "2026-07-26T02:33:15.202Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.3.18",
+      "bom-ref": "@blamejs/pki@0.3.19",
       "type": "application",
       "name": "pki",
-      "version": "0.3.18",
+      "version": "0.3.19",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.3.18",
+      "purl": "pkg:npm/%40blamejs/pki@0.3.19",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.3.18",
+      "ref": "@blamejs/pki@0.3.19",
       "dependsOn": []
     }
   ]