@blamejs/pki 0.3.2 → 0.3.4

package/CHANGELOG.md

@@ -4,6 +4,24 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.3.4 — 2026-07-17
+
+pki.schema.c509.encode produces C509 CBOR certificates -- a DER X.509 certificate compresses to a compact, byte-exact-invertible type-3 C509, and a deterministic-CBOR encoder joins pki.cbor.
+
+### Added
+
+- pki.schema.c509.encode(input) encodes a C509 certificate to deterministic-CBOR bytes -- a DER X.509 v3 certificate to a compact type-3 C509 (byte-exact-invertible, so the original signature verifies), or a pki.schema.c509.parse result re-emitted to its native array. Canonical deterministic CBOR with the registry integer shorthands and the C509 compressions; a certificate outside the invertible covered set throws a typed C509Error. Certificate parsing remains pki.schema.c509.parse.
+- pki.cbor.build is a deterministic-CBOR encoder (RFC 8949 section 4.2) -- the byte-exact inverse of pki.cbor.decode: shortest-form heads, definite lengths, sorted and unique map keys, over unsigned and negative integers, byte and text strings, arrays, maps, tags, and the tagged bignum / epoch-time / object-identifier leaves. Encoded output always re-decodes through the strict decoder.
+
+## v0.3.3 — 2026-07-17
+
+pki.crmf.build issues RFC 4211 certificate request messages -- a CertReqMessages with a signature proof of possession, over every algorithm the toolkit supports.
+
+### Added
+
+- pki.crmf.build(spec, key, opts) builds and DER-encodes an RFC 4211 CertReqMessages -- a CertTemplate of the requested certificate fields plus a POPOSigningKey proof of possession signed with the requester's key (or a raVerified proof, opted into without a key) -- and returns DER, or a PEM block with opts.pem. The signing algorithm is resolved from the requested public key: RSA PKCS#1 v1.5 / PSS, ECDSA, EdDSA, ML-DSA, SLH-DSA, or a composite arm. Requested v3 extensions, registration controls, and regInfo ride in the message; pass an array of specs for a batch. Certificate-request-message parsing remains pki.schema.crmf.parse.
+- pki.asn1.build.implicit(tag, tlv) retags an encoded universal TLV as a context-class IMPLICIT [tag], preserving the source's primitive/constructed bit and content -- the single home for the IMPLICIT tag replacement the CertTemplate and other context-tagged structures compose.
+
 ## v0.3.2 — 2026-07-17
 
 pki.attrcert.sign issues RFC 5755 attribute certificates -- an Attribute Authority binds a holder to privilege attributes and signs with any algorithm the toolkit supports.

package/README.md

@@ -204,7 +204,7 @@ is callable today; nothing below is a stub.
 | `pki.webcrypto` | A W3C WebCrypto (`SubtleCrypto`) engine over `node:crypto` — `sign`/`verify`/`encrypt`/`decrypt`/`deriveBits`/`digest`/`generateKey`/`importKey`/`exportKey` across RSA, ECDSA, ECDH, Ed25519/Ed448, AES, HMAC, HKDF, PBKDF2, SHA — **and** post-quantum ML-DSA-44/65/87 and SLH-DSA signatures, plus ML-KEM-512/768/1024 key generation and certificate/PKCS#8 import — the RFC 9935 seed / expandedKey / both private-key CHOICE is validated fail-closed, so an OpenSSL-legacy bare-seed or an internally inconsistent key is rejected with a typed error (KEM encapsulation lands with CMS KEM-decrypt). Zero-dependency, OpenSSL-interoperable |
 | `pki.schema` | The schema family — `parse` detects which PKI format DER / PEM encodes and routes to the right parser, `all` enumerates the registered formats, and the engine + per-format members are grouped here |
 | `pki.schema.x509` | Parse DER / PEM certificates into structured, validated fields, with named + partly-decoded extensions — including the RFC 3739 / ETSI EN 319 412-5 qualified-certificate `qcStatements` (EU-qualified declaration, reliance limit, QSCD flag, certificate type, retention, PDS URLs, country of qualification; unknown statements preserved opaque) and the Microsoft Active Directory Certificate Services enrollment extensions (certificate template, CA version, previous-CA-certificate hash, application policies), fail-closed — `parse`, `pemDecode`, `pemEncode` |
-| `pki.schema.c509` | Parse C509 CBOR-encoded certificates (draft-ietf-cose-cbor-encoded-cert) — the compact CBOR profile of X.509, decoded fail-closed under deterministic CBOR; an explicit `parse` call (CBOR, not DER, so not auto-routed) |
+| `pki.schema.c509` | Parse **and encode** C509 CBOR-encoded certificates (draft-ietf-cose-cbor-encoded-cert) — the compact CBOR profile of X.509, decoded fail-closed under deterministic CBOR; an explicit `parse` call (CBOR, not DER, so not auto-routed). `encode(input)` is the byte-exact inverse: a DER X.509 v3 certificate forward-transforms to a compact type-3 C509 whose reconstruction reproduces the original DER byte for byte (so the original signature still verifies), or a `parse` result re-emits its native array — canonical deterministic CBOR with the registry integer shorthands and the C509 compressions; a certificate outside the invertible set throws a typed `C509Error` |
 | `pki.schema.crl` | Parse DER / PEM X.509 CRLs per RFC 5280 §5 — revoked serials with real-`Date` revocation times, named + partly-decoded extensions, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.csr` | Parse DER / PEM PKCS#10 certification requests per RFC 2986 — subject DN, public key, requested attributes, signature, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.pkcs8` | Parse DER / PEM PKCS#8 private keys per RFC 5208 / 5958 — algorithm, raw key bytes, attributes, optional public key, fail-closed; encrypted keys recognized (not decrypted) — `parse`, `parseEncrypted`, `pemDecode`, `pemEncode` |
@@ -225,6 +225,7 @@ is callable today; nothing below is a stub.
 | `pki.x509` | X.509 certificate issuance (RFC 5280 §4) — `sign(spec, issuer, opts)` builds and signs a certificate: a `spec` of subject (a common-name string, an array of RDNs, or raw Name DER), the public key being certified, the validity window, an optional serial, and an optional `extensions` object; an `issuer` that is a key alone (self-signed — issuer equals subject, signed with that key) or a name + public key + key, or an issuing certificate + key (CA-signed). The signature algorithm is resolved from the signing key through the shared registry, so RSA (PKCS#1 v1.5 / PSS via `opts.pss`), ECDSA P-256/384/521, Ed25519, Ed448, ML-DSA-44/65/87, the twelve SLH-DSA sets, and the composite arms all issue without a per-algorithm branch. It encodes basic constraints, key usage, extended key usage, subject and authority key identifiers (the SKI auto-derived by SHA-1 of the subject key), subject alternative names, and certificate policies from the spec — any other extension supplied as pre-encoded DER — derives the version from the field set, and enforces the serial bounds, the UTCTime/GeneralizedTime cutover, the DER default omissions, and the CA cross-field rules; a violation throws a typed `CertificateError`. Returns DER, or a PEM `CERTIFICATE` with `opts.pem`; every arm is independently verified by OpenSSL. Parsing stays at `pki.schema.x509.parse` — `sign` |
 | `pki.csr` | PKCS#10 certification-request issuance (RFC 2986 / RFC 2985) — `sign(spec, key, opts)` builds and signs a `CertificationRequest`: a `spec` of subject (a common-name string, an array of RDNs, or raw Name DER; may be empty), the public key being certified, an optional `extensionRequest` (requested v3 extensions — subject alternative names, key usage, extended key usage, basic constraints, certificate policies, subject key identifier, or an array of pre-encoded Extension DER — that a CA copies into the issued certificate), and an optional `challengePassword`. `key` (or `{ key }`) is the subject's own private key: the request is self-signed to prove possession of the private half of `subjectPublicKey`, and that proof is verified before the request is returned (what `openssl req -verify` checks). The signature algorithm is resolved from the subject key, so RSA (PKCS#1 v1.5 / PSS via `opts.pss`), ECDSA, EdDSA, ML-DSA, SLH-DSA, and the composite arms all sign without a per-algorithm branch. Returns DER, or a PEM `CERTIFICATE REQUEST` with `opts.pem`; malformed input throws a typed `CsrError`. Parsing stays at `pki.schema.csr.parse` — `sign` |
 | `pki.attrcert` | RFC 5755 attribute-certificate issuance — `sign(spec, issuer, opts)` builds and signs an `AttributeCertificate` as an Attribute Authority: a `spec` of `holder` (exactly one of an entity name, a `baseCertificateID` public-key-certificate reference, a `fromCertificate` binding derived from a certificate, or an object digest), the validity window (GeneralizedTime), an optional serial (positive, ≤ 20 octets; randomly generated when omitted), the `attributes` (the privilege syntaxes — role, clearance, group, chargingIdentity, accessIdentity, authenticationInfo — or pre-encoded Attribute DER), and optional `extensions` (auditIdentity, targetInformation, noRevAvail, aaControls, acProxying, authorityKeyIdentifier, or pre-encoded Extension DER, each with its RFC 5755 criticality). An attribute certificate is never self-signed — the `issuer` is the signing AA, supplied as `{ cert, key }` or `{ name, publicKey, key }`. The signature algorithm is resolved from the AA key, so RSA (PKCS#1 v1.5 / PSS via `opts.pss`), ECDSA, EdDSA, ML-DSA, SLH-DSA, and the composite arms all sign without a per-algorithm branch, and the signature is verified under the AA public key before the certificate is returned. Returns DER, or a PEM `ATTRIBUTE CERTIFICATE` with `opts.pem`; malformed input throws a typed `AttrCertError`. Parsing stays at `pki.schema.attrcert.parse` — `sign` |
+| `pki.crmf` | RFC 4211 certificate-request-message issuance — `build(spec, key, opts)` assembles a `CertReqMessages`: a `spec` of `certReqId` (default 0; the RFC 9483 `-1` sentinel allowed), a `certTemplate` of the requested certificate fields (`subject`, `publicKey` — the SPKI DER of the key being certified — `validity`, requested `extensions`, an optional `version` 2), optional `controls` and `regInfo` (regToken / authenticator / utf8Pairs / oldCertID / protocolEncrKey, or pre-encoded `AttributeTypeAndValue` DER), and an optional `pop` selector. `key` (or `{ key }`) is the requester's private key — the message carries a `POPOSigningKey` proof of possession signed with the private half of `certTemplate.publicKey` (verified before the message is returned), exactly as a PKCS#10 CSR proves possession; a complete template signs the `CertRequest`, an incomplete one signs a `POPOSigningKeyInput`. The signature algorithm is resolved from the requested public key, so RSA (PKCS#1 v1.5 / PSS via `opts.pss`), ECDSA, EdDSA, ML-DSA, SLH-DSA, and the composite arms all sign without a per-algorithm branch. `key` is optional for a `raVerified` proof. Pass an array of specs for a batch; the CA-assigned template fields are never emitted. Returns DER, or a PEM block with `opts.pem`; malformed input throws a typed `CrmfError`. Parsing stays at `pki.schema.crmf.parse` — `build` |
 | `pki.cms` | RFC 5652 §5 CMS SignedData signing + signature verification — `sign(content, signers, opts)` produces a SignedData (attached or detached, one or many signers, RSA / RSASSA-PSS / ECDSA / EdDSA, the post-quantum ML-DSA-44/65/87 (RFC 9882) and SLH-DSA (all twelve FIPS 205 sets, RFC 9814), and composite ML-DSA (pairing ML-DSA with a traditional RSA / ECDSA / EdDSA — accepted only when **both** components verify — draft-ietf-lamps-cms-composite-sigs)); it builds the signed attributes (content-type, message-digest, signing-time) as canonical DER, signs the exact §5.4 preimage, and emits a DER `Buffer` or PEM. `verify(input, opts)` parses a SignedData over the strict `pki.schema.cms` codec, locates each SignerInfo's signer certificate by its issuerAndSerialNumber or subjectKeyIdentifier, and checks the signature over the exact §5.4 preimage: when signed attributes are present it confirms the message-digest attribute equals the content digest and verifies over the DER re-encoding of the SignedAttributes (the on-wire `[0]` tag replaced by a universal SET OF), otherwise directly over the content. It returns a per-signer verdict with the matched signer certificate; it does not chain that certificate to a trust anchor — that is the caller's step through `pki.path.validate`. **Content encryption** (RFC 5652/5083/5084/9629): `encrypt(content, recipients, opts)` produces an EnvelopedData, AuthEnvelopedData (AES-GCM, the authenticated default), or EncryptedData — recipients auto-dispatch off the certificate key to key-transport (RSAES-OAEP; v1.5 never emitted), key-agreement (ephemeral-static ECDH over P-256/384/521 with the X9.63 KDF, and X25519/X448 with HKDF), symmetric key-wrap, password (PBKDF2 + RFC 3211 PWRI-KEK), or the post-quantum ML-KEM KEMRecipientInfo (RFC 9629/9936) — one fresh content key wrapped for every recipient. `decrypt(input, keyMaterial, opts)` recovers the content through the matching arm and returns it with an `authenticated` flag; every secret-dependent failure collapses to one uniform `cms/decrypt-failed` verdict (Bleichenbacher / EFAIL / password-oracle freedom), and PKCS#1 v1.5 is decrypt-only under the RFC 3218 implicit-rejection countermeasure. **Compression** (RFC 3274): `compress(content, opts)` / `decompress(input, opts)` produce and consume a CompressedData (ZLIB, version 0, id-alg-zlibCompress); decompress bounds the uncompressed output at 16 MiB and stops before it is materialized, so a decompression bomb fails closed as `cms/decompress-too-large` — a size transform with no integrity/confidentiality (RFC 8551 §2.4.5). Fail-closed with typed `cms/*` errors — `sign`, `verify`, `encrypt`, `decrypt`, `compress`, `decompress` |
 | `pki.smime` | RFC 8551 S/MIME message assembly, verification, encryption, and compression over the CMS layer — `sign(content, signers, opts)` wraps a MIME entity as a signed S/MIME message in either form: `multipart/signed` (clear-signed — the content stays readable in any MUA, a detached CMS SignedData rides alongside as `application/pkcs7-signature` with a matching `micalg`) or `application/pkcs7-mime; smime-type=signed-data` (opaque — the whole entity is a base64 CMS SignedData). The signed bytes are the entity's RFC 8551 §3.1.1 canonical form (CRLF line endings); `verify(message, opts)` unwraps both forms and recomputes over the same canonicalizer, so a transport that re-wraps line endings still verifies and a tampered part fails. `encrypt(content, recipients, opts)` envelopes a MIME entity as an opaque `application/pkcs7-mime` message and `decrypt(message, keyMaterial, opts)` opens one — `smime-type=authEnveloped-data` (AES-GCM, confidentiality and integrity, the default) or `smime-type=enveloped-data` (AES-CBC, confidentiality only, so `decrypt` reports `authenticated: false`, the §3.3 no-integrity caveat); the `smime-type` is derived from the CMS body, not the header, and decryption is fail-closed and oracle-free. The crypto is entirely `pki.cms.sign` / `verify` / `encrypt` / `decrypt` — any RSA / RSASSA-PSS / ECDSA / EdDSA / ML-DSA / SLH-DSA signer and any RSA-OAEP / ECDH / X25519 / X448 / AES-KW / PBKDF2 / ML-KEM recipient carries through (algorithm-agnostic). Like `cms.verify`, `verify` returns the per-signer cryptographic verdict plus the recovered content; chaining a signer to a trust anchor is the caller's `pki.path.validate` step. `compress(content, opts)` / `decompress(message, opts)` add the opaque `application/pkcs7-mime; smime-type=compressed-data; name=smime.p7z` frame (RFC 8551 §3.6, RFC 3274) — a size transform with no integrity/confidentiality (§2.4.5), decompress bounded against a bomb; the recovered content, which may itself be signed or enveloped, is returned for the caller to re-verify. Bidirectionally interoperable with `openssl smime` / `openssl cms`. Fail-closed with typed `smime/*` errors — `sign`, `verify`, `encrypt`, `decrypt`, `compress`, `decompress` |
 | `pki.tsp` | RFC 3161 Time-Stamp Protocol — `sign(messageImprint, tsa, opts)` produces a TimeStampToken: a CMS SignedData (over `pki.cms.sign`) whose content is a `TSTInfo` carrying the timestamped message imprint, the TSA policy, a serial number, and `genTime` (with optional accuracy / nonce / ordering), plus the RFC 3161 §2.4.2 signing-certificate attribute binding the token to the TSA certificate (SHA-2 imprints, any `pki.cms.sign` TSA key). `request` / `parseRequest` build and parse the TimeStampReq a client sends (imprint, requested policy, nonce, certReq), `response` / `parseResponse` the TimeStampResp a TSA returns — a granted status wrapping a token, or a rejection with PKIStatus and failure info, the §2.4.2 status↔token coupling enforced in both directions. `verify(token, data, opts)` verifies a token fail-closed: the CMS signature over the exact signed bytes, the message imprint recomputed from the data, the TSTInfo content type, the ESSCertID(V2) binding to the TSA certificate, the §2.3 critical timeStamping-only extendedKeyUsage, the request nonce when used, and — with a trust anchor supplied — full certification-path validation of the TSA certificate at the token's `genTime`, returning `{ valid, genTime, serialNumber, tstInfo, … }` — `sign`, `request`, `parseRequest`, `response`, `parseResponse`, `verify` |

package/index.js

@@ -43,6 +43,7 @@ var ocsp      = require("./lib/ocsp");
 var x509      = require("./lib/x509-sign");
 var csr       = require("./lib/csr-sign");
 var attrcert  = require("./lib/attrcert-sign");
+var crmf      = require("./lib/crmf-sign");
 var merkle    = require("./lib/merkle");
 var shbs      = require("./lib/shbs");
 var hpke      = require("./lib/hpke");
@@ -98,6 +99,10 @@ module.exports = {
   // builds and signs an AttributeCertificate binding a Holder to privilege attributes as an
   // Attribute Authority (never self-signed). Parsing lives at pki.schema.attrcert.parse.
   attrcert:  attrcert,
+  // `crmf` is the RFC 4211 certificate-request-message producing side -- pki.crmf.build
+  // assembles a CertReqMessages (a CertTemplate + a signature proof of possession) for a CMP
+  // or EST enrollment. Parsing lives at pki.schema.crmf.parse.
+  crmf:      crmf,
   // `merkle` is the RFC 6962 / RFC 9162 Merkle-tree proof-verification core --
   // pki.merkle.leafHash / nodeHash / emptyRootHash build the domain-separated
   // (0x00 leaf / 0x01 node) SHA-256 tree hashes; pki.merkle.verifyInclusion and

package/lib/asn1-der.js

@@ -989,6 +989,15 @@ var build = {
   explicit: function (tagNumber, inner) { return encodeTLV(CLASS_CONTEXT, true, tagNumber, _asBuffer(inner, "build.explicit")); },
   contextPrimitive:   function (tagNumber, content) { return encodeTLV(CLASS_CONTEXT, false, tagNumber, _asBuffer(content, "build.contextPrimitive")); },
   contextConstructed: function (tagNumber, content) { return encodeTLV(CLASS_CONTEXT, true, tagNumber, _asBuffer(content, "build.contextConstructed")); },
+  // IMPLICIT [tag] retag of an already-encoded UNIVERSAL TLV: replace the source's tag with a context-class
+  // [tag] identifier, PRESERVING the source's primitive/constructed bit and content octets (X.680 sec. 30.6).
+  // A single home for the tag replacement so no format module re-inlines the P/C-bit handling (a decode of
+  // the source validates it is exactly one well-formed TLV; its content is the trailing `length` octets).
+  implicit: function (tagNumber, tlv) {
+    var buf = _asBuffer(tlv, "build.implicit");
+    var node = decode(buf);
+    return encodeTLV(CLASS_CONTEXT, node.constructed, tagNumber, buf.slice(buf.length - node.length));
+  },
   raw:      function (buf) { return _asBuffer(buf, "build.raw"); },
 };
 

package/lib/cbor-det.js

@@ -624,8 +624,111 @@ function readOid(node) {
   return asn1.decodeOidContent(inner.content);
 }
 
+// ---- deterministic-CBOR encoder (RFC 8949 sec. 4.2) -- the byte-exact inverse of decode ----
+// Every emitted head is the shortest form (the exact mirror of decode's cbor/non-minimal-argument reject),
+// every length is definite, and map keys are sorted bytewise + unique -- so decode(build.x(...)) round-trips
+// or the builder produced a shape its own strict decoder rejects. Nested items are pre-encoded CBOR item
+// Buffers (the asn1.build pattern); the CBOR-encoded PKI surfaces (C509, COSE) compose these leaves.
+function _cbItem(x, who) {
+  if (!Buffer.isBuffer(x)) throw new CborError("cbor/not-buffer", who + ": expected a pre-encoded CBOR item Buffer");
+  return x;
+}
+// Validate an assembled container decodes: well-formed nested items (no malformed head, indefinite length,
+// stray break, or trailing bytes), AND within the decoder's depth cap -- a container adds ONE nesting
+// level, so a child AT the cap would overflow the output. Decoding the whole output in one pass catches
+// both, so the encoder never produces bytes its own strict decoder rejects.
+function _assertDecodes(out, who) {
+  try { decode(out); } catch (e) { throw new CborError("cbor/bad-item", who + ": produced bytes the strict decoder rejects (" + (e && e.code) + ")", e); }
+  return out;
+}
+// Mirror the decoder's total-size cap (constants.LIMITS.CBOR_MAX_BYTES) so a string leaf never emits an
+// item the strict reader would reject as too large -- the encode/decode round trip stays closed under the
+// default limits.
+function _capString(out, who) {
+  if (out.length > constants.LIMITS.CBOR_MAX_BYTES) throw new CborError("cbor/too-large", who + ": encoded " + out.length + " bytes exceeds cap " + constants.LIMITS.CBOR_MAX_BYTES);
+  return out;
+}
+// Reject a JS string carrying an unpaired UTF-16 surrogate: Buffer.from(..., "utf8") would silently
+// substitute U+FFFD, so the emitted text string would not be the input (and read.text enforces well-formed
+// UTF-8). Fail closed to match the decoder rather than corrupt the text.
+function _assertWellFormedText(str, who) {
+  for (var i = 0; i < str.length; i++) {
+    var c = str.charCodeAt(i);
+    if (c >= 0xd800 && c <= 0xdbff) { var n = str.charCodeAt(i + 1); if (!(n >= 0xdc00 && n <= 0xdfff)) throw new CborError("cbor/bad-utf8", who + ": the string has an unpaired high surrogate"); i++; }
+    else if (c >= 0xdc00 && c <= 0xdfff) throw new CborError("cbor/bad-utf8", who + ": the string has an unpaired low surrogate");
+  }
+}
+// The initial byte + minimal-width argument for major type `mt` and unsigned `argument`.
+function _head(mt, argument, who) {
+  var a = typeof argument === "bigint" ? argument : BigInt(argument);
+  if (a < 0n) throw new CborError("cbor/bad-argument", who + ": a CBOR head argument must be non-negative");
+  if (a > 0xffffffffffffffffn) throw new CborError("cbor/bad-argument", who + ": a CBOR head argument exceeds 64 bits");
+  var mtb = mt << 5, b;
+  if (a <= 23n) return Buffer.from([mtb | Number(a)]);
+  if (a < 256n) return Buffer.from([mtb | 24, Number(a)]);
+  if (a < 65536n) { b = Buffer.alloc(3); b[0] = mtb | 25; b.writeUInt16BE(Number(a), 1); return b; }
+  if (a < 4294967296n) { b = Buffer.alloc(5); b[0] = mtb | 26; b.writeUInt32BE(Number(a), 1); return b; }
+  b = Buffer.alloc(9); b[0] = mtb | 27; b.writeBigUInt64BE(a, 1); return b;
+}
+var build = {
+  uint: function (n) { var a = typeof n === "bigint" ? n : BigInt(n); if (a < 0n) throw new CborError("cbor/bad-argument", "build.uint: value must be non-negative"); return _head(0, a, "build.uint"); },
+  nint: function (n) { var a = typeof n === "bigint" ? n : BigInt(n); if (a >= 0n) throw new CborError("cbor/bad-argument", "build.nint: value must be negative"); return _head(1, -1n - a, "build.nint"); },
+  int:  function (n) { var a = typeof n === "bigint" ? n : BigInt(n); return a >= 0n ? _head(0, a, "build.int") : _head(1, -1n - a, "build.int"); },
+  byteString: function (buf) { var b = _asBuffer(buf, "build.byteString"); return _capString(Buffer.concat([_head(2, b.length, "build.byteString"), b]), "build.byteString"); },
+  textString: function (s) { var str = String(s); _assertWellFormedText(str, "build.textString"); var b = Buffer.from(str, "utf8"); return _capString(Buffer.concat([_head(3, b.length, "build.textString"), b]), "build.textString"); },
+  array: function (items) {
+    if (!Array.isArray(items)) throw new CborError("cbor/bad-argument", "build.array: expected an array of pre-encoded items");
+    var parts = items.map(function (x, i) { return _cbItem(x, "build.array[" + i + "]"); });
+    return _assertDecodes(Buffer.concat([_head(4, items.length, "build.array")].concat(parts)), "build.array");
+  },
+  map: function (pairs) {
+    if (!Array.isArray(pairs)) throw new CborError("cbor/bad-argument", "build.map: expected an array of [key, value] pairs");
+    var enc = pairs.map(function (p, i) { if (!Array.isArray(p) || p.length !== 2) throw new CborError("cbor/bad-argument", "build.map[" + i + "]: each entry is a [key, value] pair"); return [_cbItem(p[0], "build.map key"), _cbItem(p[1], "build.map value")]; });
+    // RFC 8949 sec. 4.2.1 Core Deterministic: keys sorted in the BYTEWISE lexicographic order of their
+    // encodings -- NOT the length-first order of sec. 4.2.3 (the older RFC 7049 "Canonical CBOR" variant).
+    // This MUST match the decoder, which enforces bytewise order (_profile "deterministic" -> Buffer.compare
+    // at :70); a length-first sort here would emit a map the strict decoder then rejects as unsorted.
+    enc.sort(function (a, b) { return Buffer.compare(a[0], b[0]); });
+    for (var i = 1; i < enc.length; i++) { if (Buffer.compare(enc[i - 1][0], enc[i][0]) === 0) throw new CborError("cbor/duplicate-map-key", "build.map: duplicate map key"); }
+    var flat = [_head(5, pairs.length, "build.map")];
+    enc.forEach(function (p) { flat.push(p[0], p[1]); });
+    return _assertDecodes(Buffer.concat(flat), "build.map");
+  },
+  tag: function (tagNum, inner) { return _assertDecodes(Buffer.concat([_head(6, tagNum, "build.tag"), _cbItem(inner, "build.tag content")]), "build.tag"); },
+  boolean: function (v) { return Buffer.from([v ? 0xf5 : 0xf4]); },
+  nullValue: function () { return Buffer.from([0xf6]); },
+  raw: function (buf) { return _assertDecodes(_asBuffer(buf, "build.raw"), "build.raw"); },
+  // Tagged leaves -- the inverse of read.biguint / read.time / read.oid.
+  biguint: function (n) {
+    var a = typeof n === "bigint" ? n : BigInt(n);
+    if (a < 0n) throw new CborError("cbor/bad-argument", "build.biguint: value must be non-negative");
+    var hex = a.toString(16); if (hex.length % 2) hex = "0" + hex;
+    var mag = a === 0n ? Buffer.alloc(0) : Buffer.from(hex, "hex");
+    if (mag.length <= 8) throw new CborError("cbor/bad-argument", "build.biguint: a value that fits 8 bytes must use build.uint (RFC 8949 preferred serialization)");
+    // Mirror read.biguint's cap so the tagged bignum builder never emits a value the strict reader rejects.
+    if (mag.length > constants.LIMITS.CBOR_MAX_BIGUINT_BYTES) throw new CborError("cbor/biguint-too-large", "build.biguint: " + mag.length + " bytes exceeds cap " + constants.LIMITS.CBOR_MAX_BIGUINT_BYTES);
+    return build.tag(2, build.byteString(mag));
+  },
+  time: function (v) {
+    var ms;
+    if (v instanceof Date) {
+      ms = v.getTime();
+      if (Number.isNaN(ms)) throw new CborError("cbor/bad-time", "build.time: an Invalid Date has no epoch value");
+      // read.time reads only an integer (second-granularity) tag-1, so a sub-second Date cannot round-trip:
+      // reject it rather than silently truncate the milliseconds.
+      if (ms % 1000 !== 0) throw new CborError("cbor/bad-time", "build.time: a Date with sub-second precision cannot be a second-granularity CBOR epoch; round to whole seconds");
+    }
+    var secs = v instanceof Date ? BigInt(Math.floor(ms / 1000)) : (typeof v === "bigint" ? v : BigInt(v));
+    // Mirror read.time's bound so build.time never emits a tag-1 the strict reader would reject as out of range.
+    if (secs < -_MAX_EPOCH_SECONDS || secs > _MAX_EPOCH_SECONDS) throw new CborError("cbor/bad-time", "build.time: epoch seconds " + secs + " are outside the representable Date range");
+    return build.tag(1, build.int(secs));
+  },
+  oid: function (dotted) { return build.tag(111, build.byteString(asn1.encodeOidContent(dotted))); },
+};
+
 module.exports = {
   decode: decode,
+  build: build,
   read: {
     uint:           readUint,
     nint:           readNint,

package/lib/crmf-sign.js

@@ -0,0 +1,275 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+
+/**
+ * @module     pki.crmf
+ * @nav        Signing
+ * @title      Certificate request messages
+ * @intro The RFC 4211 certificate-request-message producing side. `pki.crmf.build` assembles a
+ *   `CertReqMessages` -- one or more `CertReqMsg`, each a `CertRequest` (a `CertTemplate` of the requested
+ *   certificate fields plus optional controls) paired with a proof of possession. The common proof is a
+ *   `POPOSigningKey` signature over the `CertRequest`, made with the private half of the key being
+ *   certified (the requester proves possession, exactly as a PKCS#10 CSR does). The message drops into a
+ *   CMP (RFC 9810) or EST enrollment body. Parsing lives at `pki.schema.crmf.parse`.
+ * @spec RFC 4211
+ * @card Build a CRMF CertReqMessages with a signature proof of possession.
+ */
+//
+// RFC 4211 App. B / RFC 5912 sec. 10 are DEFINITIONS IMPLICIT TAGS: a CertTemplate [0]..[9] field tag
+// REPLACES the base universal tag (built via asn1.build.implicit, preserving the primitive/constructed
+// bit); the shipped parser encodes issuer [3] / subject [5] Name IMPLICITLY (the dominant CMP/EST wire
+// form), so the builder does too. The two EXPLICIT exceptions are the OptionalValidity notBefore [0] /
+// notAfter [1] Time (a genuine UTCTime/GeneralizedTime CHOICE). The signature scheme resolves from the
+// requested publicKey through the shared sign-scheme registry; the Name / extension / SPKI encoders and
+// the post-sign self-check are the shared lib/pki-build primitives, bound to the crmf namespace.
+
+var asn1 = require("./asn1-der");
+var oid = require("./oid");
+var crmf = require("./schema-crmf");
+var signScheme = require("./sign-scheme");
+var pkix = require("./schema-pkix");
+var pkiBuild = require("./pki-build");
+var frameworkError = require("./framework-error");
+
+var CrmfError = frameworkError.CrmfError;
+var b = asn1.build;
+function _err(code, message, cause) { return new CrmfError(code, message, cause); }
+function _signE(kind, message, cause) { return new CrmfError("crmf/" + kind, message, cause); }
+function O(n) { return oid.byName(n); }
+
+var NS = pkix.makeNS("crmf", CrmfError, oid);
+var EXT_DECODERS = pkix.certExtensionDecoders(NS).byOid;
+var _b = pkiBuild.makeBuilder({
+  ErrorClass: CrmfError, prefix: "crmf", O: O, NS: NS,
+  NAME_SCHEMA: pkix.name(NS), SPKI_SCHEMA: pkix.spki(NS), EXT_DECODERS: EXT_DECODERS,
+});
+
+var KNOWN_SPEC_KEYS = { certReqId: 1, certTemplate: 1, controls: 1, regInfo: 1, pop: 1 };
+var KNOWN_TEMPLATE_KEYS = { version: 1, subject: 1, publicKey: 1, validity: 1, extensions: 1, issuer: 1 };
+// The controls (RFC 4211 sec. 6) and regInfo (sec. 7) are DISJOINT AttributeTypeAndValue namespaces --
+// regToken/authenticator/oldCertID/protocolEncrKey are controls; utf8Pairs is regInfo -- so the object
+// form validates each key against its own field's registry (a control name is not a valid regInfo, and
+// vice versa). The key name equals the registered OID name; complex values (pkiPublicationInfo, certReq)
+// ride the pre-encoded escape hatch. Each entry is the value encoder for that OID.
+function _ctlUtf8(v) { return b.utf8(String(v)); }
+function _ctlSpki(v) { var k = _b.reqDer(v, "protocolEncrKey (an SPKI DER)"); _b.assertValidSpki(k, "protocolEncrKey"); return b.raw(k); }
+var CONTROL_VALUE = { regToken: _ctlUtf8, authenticator: _ctlUtf8, oldCertID: function (v) { return _encodeCertId(v); }, protocolEncrKey: _ctlSpki };
+var REGINFO_VALUE = { utf8Pairs: _ctlUtf8 };
+
+// ---- CertTemplate + POP structural encoders (byte-exact inverses of schema-crmf.js) ----
+
+// OptionalValidity [4] IMPLICIT SEQUENCE { notBefore [0] EXPLICIT Time, notAfter [1] EXPLICIT Time } --
+// at least one present (RFC 4211 sec. 5). Time is a CHOICE so [0]/[1] are EXPLICIT.
+function _encodeOptionalValidity(validity) {
+  if (!validity || typeof validity !== "object" || Buffer.isBuffer(validity)) throw _err("crmf/bad-validity", "validity must be an object { notBefore?, notAfter? }");
+  var nb = validity.notBefore, na = validity.notAfter;
+  if (nb == null && na == null) throw _err("crmf/bad-validity", "validity must contain notBefore or notAfter (RFC 4211 sec. 5)");
+  var parts = [];
+  // timeDer validates each instant (guard.time.assertValid throws on an Invalid Date) BEFORE the
+  // inverted-window comparison, so getTime() below cannot be NaN.
+  if (nb != null) parts.push(b.explicit(0, _b.timeDer(nb, "validity notBefore")));
+  if (na != null) parts.push(b.explicit(1, _b.timeDer(na, "validity notAfter")));
+  // allow:nan-date-comparison-unguarded -- both instants passed timeDer's guard.time.assertValid above.
+  if (nb != null && na != null && nb.getTime() > na.getTime()) throw _err("crmf/bad-validity", "notBefore must not be after notAfter");
+  return b.implicit(4, b.sequence(parts));
+}
+// CertTemplate ::= SEQUENCE { [0..9] all IMPLICIT OPTIONAL }. A REQUEST omits serialNumber [1] / signingAlg
+// [2] / issuerUID [7] / subjectUID [8] (CA-assigned or deprecated, RFC 4211 sec. 5) -- the builder never
+// emits them. Fields are emitted in ascending tag order.
+function _encodeCertTemplate(tpl) {
+  if (!tpl || typeof tpl !== "object" || Buffer.isBuffer(tpl)) throw _err("crmf/bad-cert-template", "certTemplate must be an object");
+  Object.keys(tpl).forEach(function (k) { if (!KNOWN_TEMPLATE_KEYS[k]) throw _err("crmf/bad-input", "unknown certTemplate field " + JSON.stringify(k)); });
+  var fields = [];
+  if (tpl.version != null) {
+    if (tpl.version !== 2) throw _err("crmf/bad-version", "certTemplate version MUST be 2 (v3) if supplied (RFC 4211 sec. 5)");
+    fields.push(b.implicit(0, b.integer(2n)));                                  // version [0]
+  }
+  // issuer [3] / subject [5] are EXPLICIT: Name is a CHOICE, and X.680 sec. 31.2.7 forces a context tag on
+  // a CHOICE to EXPLICIT even under the module's IMPLICIT TAGS default (the [3]/[5] wraps the RDNSequence
+  // SEQUENCE, it does not replace its tag). The parser accepts both forms; this is the conformant one.
+  if (tpl.issuer != null) fields.push(b.explicit(3, _b.encodeName(tpl.issuer)));    // issuer [3] EXPLICIT
+  if (tpl.validity != null) fields.push(_encodeOptionalValidity(tpl.validity));     // validity [4] IMPLICIT
+  if (tpl.subject != null) fields.push(b.explicit(5, _b.encodeName(tpl.subject)));  // subject [5] EXPLICIT
+  var spki = null;
+  if (tpl.publicKey != null) {
+    spki = _b.reqDer(tpl.publicKey, "certTemplate.publicKey (the SPKI DER of the requested key)");
+    _b.assertValidSpki(spki, "certTemplate.publicKey");
+    fields.push(b.implicit(6, spki));                                             // publicKey [6]
+  }
+  if (tpl.extensions != null) fields.push(b.implicit(9, _b.requestedExtensions(tpl.extensions, spki)));   // extensions [9]
+  return { der: b.sequence(fields), spki: spki, complete: tpl.subject != null && tpl.publicKey != null };
+}
+
+// Controls / regInfo ::= SEQUENCE SIZE(1..MAX) OF AttributeTypeAndValue { type OID, value ANY }. Object
+// form maps recognized names to typed value encoders; any other (or a pre-encoded AttributeTypeAndValue
+// DER array) rides the escape hatch, shape-validated.
+function _buildAttrTypeAndValues(spec, code, label, valueMap) {
+  if (Array.isArray(spec)) {
+    if (!spec.length) throw _err(code, label + " must carry at least one entry");
+    var seenA = {};
+    return b.sequence(spec.map(function (e, i) {
+      var der = _b.reqDer(e, label + " [" + i + "]");
+      var n;
+      try { n = asn1.decode(der); } catch (err) { throw _err("crmf/bad-input", "pre-encoded " + label + " [" + i + "] is not valid DER", err); }
+      if (n.tagNumber !== asn1.TAGS.SEQUENCE || n.tagClass !== "universal" || !n.children || n.children.length !== 2) throw _err("crmf/bad-input", "pre-encoded " + label + " [" + i + "] must be a SEQUENCE { type OID, value }");
+      var t;
+      try { t = asn1.read.oid(n.children[0]); } catch (err) { throw _err("crmf/bad-input", "pre-encoded " + label + " [" + i + "] type is not an OBJECT IDENTIFIER", err); }
+      if (seenA[t]) throw _err(code, "duplicate " + label + " type " + (oid.name(t) || t));
+      seenA[t] = true;
+      return b.raw(der);
+    }));
+  }
+  if (!spec || typeof spec !== "object") throw _err("crmf/bad-input", label + " must be an object or an array of pre-encoded AttributeTypeAndValue DER");
+  var out = [], seen = {};
+  Object.keys(spec).forEach(function (k) {
+    var enc = valueMap[k];
+    if (!enc) throw _err("crmf/bad-input", "unknown " + label + " " + JSON.stringify(k) + "; pass a pre-encoded AttributeTypeAndValue DER via the array form for a " + label + " entry outside " + Object.keys(valueMap).join("/"));
+    var typeOid = O(k);
+    if (seen[typeOid]) throw _err(code, "duplicate " + label + " type " + k);
+    seen[typeOid] = true;
+    out.push(b.sequence([b.oid(typeOid), enc(spec[k])]));
+  });
+  if (!out.length) throw _err(code, label + " must carry at least one entry");
+  return b.sequence(out);
+}
+// certReqId is a signed INTEGER, value UNCONSTRAINED (the RFC 9483 -1 sentinel and 0 are both legal). A
+// number must be a safe integer (a fractional or > 2^53 number loses precision through BigInt); a BigInt
+// or a decimal / 0x-hex string carries an arbitrary value.
+function _certReqId(v) {
+  if (v == null) return 0n;
+  if (typeof v === "bigint") return v;
+  if (typeof v === "number") { if (!Number.isSafeInteger(v)) throw _err("crmf/bad-input", "certReqId number must be a safe integer (pass a BigInt or a string for a larger value)"); return BigInt(v); }
+  if (typeof v === "string") { try { return BigInt(v); } catch (e) { throw _err("crmf/bad-input", "certReqId string must be a decimal or 0x-hex integer", e); } }
+  throw _err("crmf/bad-input", "certReqId must be a BigInt, a safe integer, or a string");
+}
+// CertId ::= SEQUENCE { issuer GeneralName, serialNumber INTEGER } (RFC 4211 sec. 6.4, oldCertID value).
+function _encodeCertId(id) {
+  if (!id || typeof id !== "object" || id.issuer == null || id.serialNumber == null) throw _err("crmf/bad-input", "oldCertID must be { issuer: GeneralName, serialNumber }");
+  return b.sequence([_b.encodeGeneralName(id.issuer), _b.serialInteger(id.serialNumber)]);
+}
+
+// ProofOfPossession. The signature arm (the default when a key is given): when the template carries BOTH
+// subject and publicKey (complete), sign the CertRequest DER and OMIT poposkInput; otherwise build a
+// POPOSigningKeyInput (authInfo sender [0] GeneralName + the requested publicKey), sign its SEQUENCE, and
+// carry it as poposkInput [0] (RFC 4211 sec. 4.1). raVerified is emitted only on an explicit opt-in.
+function _buildProofOfPossession(pop, certReqDer, template, signingKey, opts) {
+  if (pop != null && (typeof pop !== "object" || Buffer.isBuffer(pop))) throw _err("crmf/bad-input", "spec.pop must be an object (e.g. { type: 'signature' } or { type: 'raVerified', raVerified: true })");
+  var mode = (pop && pop.type) || (signingKey != null ? "signature" : null);
+  if (mode == null) return null;   // no POP requested and no key -> omit popo (an RA supplies it out of band)
+  if (mode === "raVerified") {
+    if (!(pop && pop.raVerified === true)) throw _err("crmf/bad-popo", "raVerified must be explicitly opted into (pop: { type: 'raVerified', raVerified: true }) -- a requester does not normally assert it (RFC 4211 sec. 4)");
+    return b.implicit(0, b.nullValue());   // raVerified [0] IMPLICIT NULL
+  }
+  if (mode !== "signature") throw _err("crmf/bad-popo", "unsupported proof-of-possession type " + JSON.stringify(mode) + " (supported: 'signature', 'raVerified')");
+  if (signingKey == null) throw _err("crmf/bad-input", "a signature proof of possession requires the requester's private key");
+  if (template.spki == null) throw _err("crmf/bad-input", "a signature proof of possession requires certTemplate.publicKey");
+  var scheme = signScheme.resolveSignScheme(_b.certLikeFromSpki(template.spki), { combinedRsaSig: true, pss: opts.pss, digestAlgorithm: opts.digestAlgorithm }, true, _signE);
+  var signedRegion, poposkInputField = null;
+  if (template.complete) {
+    signedRegion = certReqDer;   // sec. 4.1: complete template -> sign the CertRequest, poposkInput omitted
+  } else {
+    // POPOSigningKeyInput ::= SEQUENCE { authInfo CHOICE { sender [0] GeneralName, publicKeyMAC }, publicKey }.
+    var sender = pop && pop.sender;
+    if (sender == null) throw _err("crmf/bad-popo", "an incomplete template (missing subject or publicKey) requires pop.sender (a GeneralName) for the POPOSigningKeyInput authInfo (RFC 4211 sec. 4.1)");
+    var poposkSeq = b.sequence([b.explicit(0, _b.encodeGeneralName(sender)), b.raw(template.spki)]);
+    signedRegion = poposkSeq;
+    poposkInputField = b.implicit(0, poposkSeq);   // poposkInput [0] IMPLICIT POPOSigningKeyInput
+  }
+  return signScheme.signOverTbs(scheme, signingKey, signedRegion, _signE).then(function (sig) {
+    return Promise.resolve(_b.assertSignatureVerifies(signedRegion, sig, template.spki, scheme)).then(function () {
+      var popoChildren = [];
+      if (poposkInputField) popoChildren.push(poposkInputField);
+      popoChildren.push(scheme.sigAlgId);
+      popoChildren.push(b.bitString(sig, 0));
+      return b.implicit(1, b.sequence(popoChildren));   // signature [1] IMPLICIT POPOSigningKey
+    });
+  }, function (e) {
+    if (e instanceof CrmfError) throw e;
+    throw _err("crmf/bad-input", "signing the proof of possession failed -- the key does not match the requested public key or is invalid", e);
+  });
+}
+
+/**
+ * @primitive pki.crmf.build
+ * @signature pki.crmf.build(spec, key?, opts?) -> Promise<Buffer|string>
+ * @since 0.3.3
+ * @status experimental
+ * @spec RFC 4211
+ * @defends forged-certificate-request (CWE-347)
+ * @related pki.schema.crmf.parse, pki.csr.sign
+ *
+ * Build and DER-encode an RFC 4211 `CertReqMessages`. `spec` describes one certificate request message (or
+ * pass `spec.messages` -- an array of specs -- for a batch): `certReqId` (an integer, default 0; the RFC
+ * 9483 `-1` sentinel is allowed), `certTemplate` (the requested certificate fields -- `subject`, `publicKey`
+ * (the SPKI DER of the key being certified), `validity` ({ notBefore, notAfter } Dates), `extensions` (an
+ * object of subjectAltName / keyUsage / extendedKeyUsage / basicConstraints / certificatePolicies /
+ * subjectKeyIdentifier, or pre-encoded Extension DER), and an optional `version` (2)), optional `controls`
+ * and `regInfo` (an object of regToken / authenticator / utf8Pairs / oldCertID / protocolEncrKey, or
+ * pre-encoded AttributeTypeAndValue DER), and an optional `pop` selector. `key` (or `{ key }`) is the
+ * REQUESTER's private key -- the private half of `certTemplate.publicKey`; the message carries a
+ * `POPOSigningKey` proof of possession signed with it (verified before the message is returned), exactly
+ * as a PKCS#10 CSR proves possession. The signature algorithm is resolved from the requested public key
+ * (RSA PKCS#1 v1.5 / PSS, ECDSA, EdDSA, ML-DSA, SLH-DSA, or a composite arm). `key` is optional -- omit it
+ * for a `raVerified` proof (opt in with `pop: { type: 'raVerified', raVerified: true }`). Returns DER, or a
+ * PEM block with `opts.pem` (the label is required). Malformed input throws a typed `CrmfError`.
+ * Certificate-request-message parsing is `pki.schema.crmf.parse`.
+ *
+ * @opts
+ *   - `pem` (string) -- return a PEM block with this label instead of DER (e.g. "CERTIFICATE REQUEST MESSAGE").
+ *   - `pss` (boolean) -- sign an RSA key with RSASSA-PSS rather than PKCS#1 v1.5.
+ *   - `digestAlgorithm` (string) -- override the message digest where the algorithm permits a choice.
+ * @example
+ *   var msg = await pki.crmf.build(
+ *     { certReqId: 0, certTemplate: { subject: "device-42", publicKey: signerSpki } },
+ *     { key: signerKeyPkcs8 });
+ *   pki.schema.crmf.parse(msg).messages[0].certReq.certTemplate.subject.dn;   // "CN=device-42"
+ */
+function build(spec, key, opts) {
+  return Promise.resolve().then(function () { return _build(spec, key, opts); });
+}
+
+function _buildCertReqMsg(spec, key, opts) {
+  if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("crmf/bad-input", "each certificate-request-message spec must be an object");
+  Object.keys(spec).forEach(function (k) { if (!KNOWN_SPEC_KEYS[k]) throw _err("crmf/bad-input", "unknown spec field " + JSON.stringify(k)); });
+  if (spec.certTemplate == null) throw _err("crmf/bad-input", "spec.certTemplate is required");
+
+  var signingKey = (key && typeof key === "object" && !Buffer.isBuffer(key) && !(key instanceof Uint8Array) && key.type == null && "key" in key) ? key.key : key;
+  var template = _encodeCertTemplate(spec.certTemplate);
+  var certReqChildren = [b.integer(_certReqId(spec.certReqId)), template.der];
+  if (spec.controls != null) certReqChildren.push(_buildAttrTypeAndValues(spec.controls, "crmf/bad-controls", "controls", CONTROL_VALUE));
+  var certReqDer = b.sequence(certReqChildren);
+
+  return Promise.resolve(_buildProofOfPossession(spec.pop, certReqDer, template, signingKey, opts)).then(function (popoDer) {
+    var msgChildren = [certReqDer];
+    if (popoDer) msgChildren.push(popoDer);
+    if (spec.regInfo != null) msgChildren.push(_buildAttrTypeAndValues(spec.regInfo, "crmf/bad-reg-info", "regInfo", REGINFO_VALUE));
+    return b.sequence(msgChildren);   // CertReqMsg
+  });
+}
+
+function _build(spec, key, opts) {
+  opts = opts || {};
+  if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("crmf/bad-input", "the certificate-request-message spec must be an object");
+  var specs;
+  if (spec.messages != null) {
+    // Batch form: the envelope carries ONLY `messages` -- reject a stray field so a request spec written at
+    // the wrong nesting level (e.g. certTemplate alongside messages) is not silently dropped.
+    if (!Array.isArray(spec.messages)) throw _err("crmf/bad-input", "spec.messages must be an array of certificate-request-message specs");
+    Object.keys(spec).forEach(function (k) { if (k !== "messages") throw _err("crmf/bad-input", "unknown batch-envelope field " + JSON.stringify(k) + " -- a batch spec carries only 'messages'"); });
+    specs = spec.messages;
+  } else {
+    specs = [spec];
+  }
+  if (!specs.length) throw _err("crmf/bad-input", "at least one certificate request message is required (RFC 4211 sec. 3)");
+  return Promise.all(specs.map(function (s) { return _buildCertReqMsg(s, key, opts); })).then(function (msgs) {
+    var der = b.sequence(msgs);   // CertReqMessages ::= SEQUENCE SIZE(1..MAX) OF CertReqMsg
+    if (opts.pem != null) {
+      if (typeof opts.pem !== "string" || !opts.pem) throw _err("crmf/bad-input", "opts.pem must be a non-empty PEM label string");
+      return crmf.pemEncode(der, opts.pem);
+    }
+    return der;
+  });
+}
+
+module.exports = { build: build };

package/lib/csr-sign.js

@@ -42,12 +42,6 @@ var _b = pkiBuild.makeBuilder({
   NAME_SCHEMA: pkix.name(NS), SPKI_SCHEMA: pkix.spki(NS), EXT_DECODERS: EXT_DECODERS,
 });
 
-// The requested-extension object keys (a CSR REQUESTS extensions; it does NOT enforce issuance policy,
-// so there are no CA cross-field gates and no authorityKeyIdentifier auto-derivation).
-var KNOWN_REQ_EXT_KEYS = {
-  subjectAltName: 1, keyUsage: 1, keyUsageCritical: 1, extendedKeyUsage: 1, extendedKeyUsageCritical: 1,
-  basicConstraints: 1, certificatePolicies: 1, certificatePoliciesCritical: 1, subjectKeyIdentifier: 1,
-};
 // challengePassword DirectoryString charset (PrintableString set); anything else uses UTF8String.
 var PRINTABLE_RE = /^[A-Za-z0-9 '()+,\-./:=?]*$/;
 
@@ -57,43 +51,9 @@ function _implicitSetOf0(members) {
   return b.contextConstructed(0, Buffer.concat(members.slice().sort(Buffer.compare)));
 }
 
-// The requested v3 Extensions (a bare SEQUENCE OF Extension, RFC 2985 sec. 5.4.2) from the object form,
-// or an array of pre-encoded Extension DER. Reuses the shared extension-value encoders; no CA gates.
-function _buildRequestedExtensions(extSpec, subjectSpki) {
-  if (Array.isArray(extSpec)) {
-    if (!extSpec.length) throw _err("csr/bad-input", "extensionRequest must carry at least one extension");
-    var seen = {};
-    return b.sequence(extSpec.map(function (e, i) {
-      var der = _b.reqDer(e, "extension");
-      _b.assertValidExtension(der, i);
-      var n = asn1.decode(der);
-      var extnId = asn1.read.oid(n.children[0]);
-      if (seen[extnId]) throw _err("csr/bad-input", "duplicate extension " + extnId + " in extensionRequest (RFC 5280 sec. 4.2)");
-      seen[extnId] = true;
-      // Fully validate a RECOGNIZED extension via its real RFC 5280 sec. 4.2.1 value decoder (a malformed
-      // value fails closed with the decoder's typed code); an unrecognized extension stays opaque.
-      var dec = EXT_DECODERS[extnId];
-      if (dec) {
-        try { dec(asn1.read.octetString(n.children[n.children.length - 1])); }
-        catch (err) { if (err instanceof CsrError) throw err; throw _err("csr/bad-input", "pre-encoded " + (oid.name(extnId) || extnId) + " extension value is malformed", err); }
-      }
-      return b.raw(der);
-    }));
-  }
-  if (!extSpec || typeof extSpec !== "object") throw _err("csr/bad-input", "extensionRequest must be an object or an array of pre-encoded Extension DER");
-  Object.keys(extSpec).forEach(function (k) {
-    if (!KNOWN_REQ_EXT_KEYS[k]) throw _err("csr/bad-input", "unknown extensionRequest extension " + JSON.stringify(k) + "; pass a pre-encoded Extension DER via the array form for a custom extension");
-  });
-  var out = [];
-  if (extSpec.subjectKeyIdentifier != null) out.push(_b.ext(O("subjectKeyIdentifier"), false, _b.extSki(_b.skiKeyId(extSpec.subjectKeyIdentifier, subjectSpki))));
-  if (extSpec.keyUsage != null) out.push(_b.ext(O("keyUsage"), extSpec.keyUsageCritical !== false, _b.extKeyUsage(extSpec.keyUsage)));
-  if (extSpec.extendedKeyUsage != null) out.push(_b.ext(O("extKeyUsage"), !!extSpec.extendedKeyUsageCritical, _b.extExtKeyUsage(extSpec.extendedKeyUsage)));
-  if (extSpec.basicConstraints != null) { _b.validateBcSpec(extSpec.basicConstraints); out.push(_b.ext(O("basicConstraints"), extSpec.basicConstraints.critical !== false, _b.extBasicConstraints(extSpec.basicConstraints))); }
-  if (extSpec.subjectAltName != null) out.push(_b.ext(O("subjectAltName"), false, _b.extSan(extSpec.subjectAltName)));
-  if (extSpec.certificatePolicies != null) out.push(_b.ext(O("certificatePolicies"), !!extSpec.certificatePoliciesCritical, _b.extCertPolicies(extSpec.certificatePolicies)));
-  if (!out.length) throw _err("csr/bad-input", "extensionRequest must request at least one extension");
-  return b.sequence(out);
-}
+// The requested v3 Extensions (a bare SEQUENCE OF Extension, RFC 2985 sec. 5.4.2) -- the shared builder
+// primitive (a CSR REQUESTS extensions; no CA gates), object form or a pre-encoded Extension DER array.
+function _buildRequestedExtensions(extSpec, subjectSpki) { return _b.requestedExtensions(extSpec, subjectSpki); }
 
 // challengePassword ::= DirectoryString bounded 1..255 (RFC 2985 sec. 5.4.1). PrintableString when the
 // value is in that charset, else UTF8String; never a Teletex/BMP/Universal string for a new value.

package/lib/pki-build.js

@@ -13,6 +13,8 @@
 var asn1 = require("./asn1-der");
 var schema = require("./schema-engine");
 var compositeSig = require("./composite-sig");
+var guard = require("./guard-all");
+var oid = require("./oid");
 var nodeCrypto = require("crypto");
 
 var b = asn1.build;
@@ -31,6 +33,17 @@ function makeBuilder(ctx) {
   var NAME_SCHEMA = ctx.NAME_SCHEMA, SPKI_SCHEMA = ctx.SPKI_SCHEMA;
   function E(kind, message, cause) { return new ErrorClass(ctx.prefix + "/" + kind, message, cause); }
   function code(kind) { return ctx.prefix + "/" + kind; }
+  // A full-code error factory (guard.* helpers invoke E as `E(fullCode, msg)`, not `E(kind, msg)`).
+  function rawErr(fullCode, message, cause) { return new ErrorClass(fullCode, message, cause); }
+
+  // RFC 5280 sec. 4.1.2.5 -- UTCTime for 1950..2049, GeneralizedTime otherwise (UTCTime's two-digit year
+  // only represents that window). The shared cutover so a certificate / CRMF / any validity encoder cannot
+  // drift on the boundary. `which` labels the instant in a validation error.
+  function timeDer(date, which) {
+    guard.time.assertValid(date, rawErr, code("bad-input"), which);
+    var y = date.getUTCFullYear();
+    return (y >= 1950 && y <= 2049) ? b.utcTime(date) : b.generalizedTime(date);
+  }
 
   // ---- distinguished name encoding (RFC 5280 sec. 4.1.2.4) ----
   // countryName is a PrintableString SIZE(2), emailAddress an IA5String; every other new-name attribute
@@ -226,6 +239,55 @@ function makeBuilder(ctx) {
     var last = n.children[n.children.length - 1];
     if (last.tagNumber !== asn1.TAGS.OCTET_STRING || last.tagClass !== "universal") throw E("bad-input", "pre-encoded extension [" + idx + "] extnValue must be an OCTET STRING");
   }
+  // The requested v3 Extensions (a bare SEQUENCE OF Extension) from an object of the recognized keys, or
+  // an array of pre-encoded Extension DER (shape- + recognized-value-validated). Shared by every enrollment
+  // request that carries requested extensions (a PKCS#10 extensionRequest attribute, a CRMF CertTemplate
+  // extensions [9]); a request REQUESTS extensions, so there are no CA cross-field gates. `spki` feeds the
+  // subjectKeyIdentifier auto-derive.
+  var REQ_EXT_KEYS = {
+    subjectAltName: 1, keyUsage: 1, keyUsageCritical: 1, extendedKeyUsage: 1, extendedKeyUsageCritical: 1,
+    basicConstraints: 1, certificatePolicies: 1, certificatePoliciesCritical: 1, subjectKeyIdentifier: 1,
+  };
+  function requestedExtensions(extSpec, spki) {
+    var EXT_DECODERS = ctx.EXT_DECODERS;
+    if (Array.isArray(extSpec)) {
+      if (!extSpec.length) throw E("bad-input", "the requested extensions list must carry at least one extension");
+      var seen = {};
+      return b.sequence(extSpec.map(function (e, i) {
+        var der = reqDer(e, "extension");
+        assertValidExtension(der, i);
+        var n = asn1.decode(der);
+        var extnId = asn1.read.oid(n.children[0]);
+        if (seen[extnId]) throw E("bad-input", "duplicate requested extension " + extnId + " (RFC 5280 sec. 4.2)");
+        seen[extnId] = true;
+        var dec = EXT_DECODERS && EXT_DECODERS[extnId];
+        if (dec) {
+          try { dec(asn1.read.octetString(n.children[n.children.length - 1])); }
+          catch (err) { if (err instanceof ErrorClass) throw err; throw E("bad-input", "pre-encoded " + (oid.name(extnId) || extnId) + " extension value is malformed", err); }
+        }
+        return b.raw(der);
+      }));
+    }
+    if (!extSpec || typeof extSpec !== "object") throw E("bad-input", "requested extensions must be an object or an array of pre-encoded Extension DER");
+    Object.keys(extSpec).forEach(function (k) {
+      if (!REQ_EXT_KEYS[k]) throw E("bad-input", "unknown requested extension " + JSON.stringify(k) + "; pass a pre-encoded Extension DER via the array form for a custom extension");
+    });
+    var out = [];
+    if (extSpec.subjectKeyIdentifier != null) {
+      // Auto-deriving the SKI (subjectKeyIdentifier: true) hashes the subject public key, so it needs one;
+      // reject the request when no public key is available (supply a Buffer key id instead).
+      if (extSpec.subjectKeyIdentifier === true && spki == null) throw E("bad-input", "subjectKeyIdentifier auto-derive (true) requires the public key -- supply a Buffer key id, or include the public key");
+      out.push(ext(O("subjectKeyIdentifier"), false, extSki(skiKeyId(extSpec.subjectKeyIdentifier, spki))));
+    }
+    if (extSpec.keyUsage != null) out.push(ext(O("keyUsage"), extSpec.keyUsageCritical !== false, extKeyUsage(extSpec.keyUsage)));
+    if (extSpec.extendedKeyUsage != null) out.push(ext(O("extKeyUsage"), !!extSpec.extendedKeyUsageCritical, extExtKeyUsage(extSpec.extendedKeyUsage)));
+    if (extSpec.basicConstraints != null) { validateBcSpec(extSpec.basicConstraints); out.push(ext(O("basicConstraints"), extSpec.basicConstraints.critical !== false, extBasicConstraints(extSpec.basicConstraints))); }
+    if (extSpec.subjectAltName != null) out.push(ext(O("subjectAltName"), false, extSan(extSpec.subjectAltName)));
+    if (extSpec.certificatePolicies != null) out.push(ext(O("certificatePolicies"), !!extSpec.certificatePoliciesCritical, extCertPolicies(extSpec.certificatePolicies)));
+    if (!out.length) throw E("bad-input", "the requested extensions object must request at least one extension");
+    return b.sequence(out);
+  }
+
   // A positive, non-zero INTEGER of at most 20 content octets (RFC 5280 sec. 4.1.2.2 / RFC 5755 sec.
   // 4.2.5 -- the identical serial rule for a certificate and an attribute certificate). A random 20-octet
   // positive serial is generated when none is supplied. Accepts a BigInt, a safe integer, a decimal /
@@ -287,7 +349,8 @@ function makeBuilder(ctx) {
   return {
     E: E, code: code, KU_BIT: KU_BIT,
     encodeName: encodeName, isEmptyName: isEmptyName, encodeGeneralName: encodeGeneralName,
-    encodeGeneralNames: encodeGeneralNames, serialInteger: serialInteger,
+    encodeGeneralNames: encodeGeneralNames, serialInteger: serialInteger, timeDer: timeDer,
+    requestedExtensions: requestedExtensions,
     extKeyUsage: extKeyUsage, extExtKeyUsage: extExtKeyUsage, validateBcSpec: validateBcSpec,
     extBasicConstraints: extBasicConstraints, pathLen: pathLen, extSki: extSki, extAki: extAki,
     extSan: extSan, extCertPolicies: extCertPolicies, ext: ext,

package/lib/schema-all.js

@@ -298,7 +298,7 @@ module.exports = {
   x509: { parse: x509.parse, pemDecode: x509.pemDecode, pemEncode: x509.pemEncode },
   // C509 is CBOR, not DER: an explicit-call surface only, NOT added to FORMATS / the detect-and-route
   // parse() below (which detect DER shapes). No pemDecode/pemEncode -- C509 is binary CBOR.
-  c509: { parse: c509.parse },
+  c509: { parse: c509.parse, encode: c509.encode },
   crl:  { parse: crl.parse,  pemDecode: crl.pemDecode, pemEncode: crl.pemEncode },
   csr:  { parse: csr.parse,  pemDecode: csr.pemDecode, pemEncode: csr.pemEncode },
   pkcs8: { parse: pkcs8.parse, parseEncrypted: pkcs8.parseEncrypted, pemDecode: pkcs8.pemDecode, pemEncode: pkcs8.pemEncode },

package/lib/schema-c509.js

@@ -17,6 +17,8 @@
 var cbor = require("./cbor-det");
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
+var x509 = require("./schema-x509");
+var pkix = require("./schema-pkix");
 var constants = require("./constants");
 var frameworkError = require("./framework-error");
 var validator = require("./validator-all");
@@ -452,14 +454,16 @@ function parse(input) {
     signatureValue: signatureValue,
   };
 
-  // Native (type-2) signed region (sec. 3.1.12): the RAW bytes of the CBOR-sequence elements 0..9 (NOT
-  // the outer array head, NOT the signature) -- a zero-copy subarray a native verifier hashes.
-  if (type === 2) {
-    var b0 = f[0].bytes, b9 = f[9].bytes;
-    var start = b0.byteOffset - input.byteOffset;
-    var end = b9.byteOffset - input.byteOffset + b9.length;
-    result.signedData = input.subarray(start, end);
-  }
+  // The RAW bytes of CBOR-array elements 0..9 (NOT the outer array head, NOT the signature) -- a zero-copy
+  // subarray. For a native (type-2) certificate this is the signed region a verifier hashes (sec. 3.1.12);
+  // surfaced as `_fieldBytes` for BOTH types so encode() re-emits a parsed certificate byte-for-byte (a
+  // re-derivation from the decoded values could differ on a canonical-equivalent form, breaking a type-2
+  // signature or a type-3 DER reconstruction). `signedData` keeps its type-2-only signed-region meaning.
+  // From the DECODED root's own bytes (root.bytes == array head + all 11 elements), not offset arithmetic
+  // on `input` (which breaks when input is a Uint8Array the codec normalized to a different buffer): the
+  // fields region is root.bytes minus the 1-byte array(11) head and minus the trailing signatureValue.
+  result._fieldBytes = root.bytes.subarray(1, root.bytes.length - f[10].bytes.length);
+  if (type === 2) result.signedData = result._fieldBytes;
 
   // Type-3 is an invertible re-encoding of a DER X.509 certificate: reconstruct the original DER
   // byte-for-byte so the original signature verifies and x509.parse recovers the certificate.
@@ -476,4 +480,325 @@ function matches(node) {
     (Number(node.children[0].argument) === 2 || Number(node.children[0].argument) === 3);
 }
 
-module.exports = { parse: parse, matches: matches };
+// ---- the encode (the producing side; draft-20 sec. 3) -----------------------
+// The byte-exact inverse of parse/reconstruct: emit the 11-element deterministic-CBOR C509 array via the
+// cbor.build.* emitter. Two inputs, dispatched structurally: a DER X.509 certificate (Buffer/PEM) -> the
+// FLAGSHIP type-3 forward transform (parse(encode(der)).reconstructedDer == der, so the original signature
+// verifies); a c509.parse result -> re-emit its native array. Signing-free (mirrors ct.encodeSctList).
+
+// The registry INVERSE tables -- the canonical int per name (the lossy forward map is resolved to ONE
+// choice: EXT_BY_INT maps both 2 and 7 to keyUsage, so keyUsage encodes to the canonical draft int 2).
+var SIG_ALG_TO_INT = { ecdsaWithSHA256: 0, ecdsaWithSHA384: 1, ecdsaWithSHA512: 2 };
+var PK_ALG_TO_INT = { rsaEncryption: 0, "ecPublicKey|prime256v1": 1, "ecPublicKey|secp384r1": 2, "ecPublicKey|secp521r1": 3 };
+var ATTR_TO_INT = { commonName: 1, surname: 2, serialNumber: 3, countryName: 4, localityName: 6, stateOrProvinceName: 7, organizationName: 8, organizationalUnitName: 9, title: 10 };
+var EXT_TO_INT = { subjectKeyIdentifier: 1, keyUsage: 2, subjectAltName: 3, basicConstraints: 4, authorityKeyIdentifier: 10 };
+
+// A non-negative BigInt -> its minimal big-endian ~biguint bytes (the leading 0x00 sign octet omitted).
+function _minBytes(n) {
+  if (n < 0n) throw _err("c509/bad-serial", "a ~biguint value must be non-negative");
+  if (n === 0n) return Buffer.alloc(0);
+  var hex = n.toString(16); if (hex.length % 2) hex = "0" + hex;
+  return Buffer.from(hex, "hex");
+}
+// A C509 AlgorithmIdentifier -> int (registry) | ~oid (bare bytes) | [~oid, params]. `key` selects the row.
+function _encAlgorithm(alg, toInt, key) {
+  var i = toInt[key];
+  if (i !== undefined && !(alg.parameters && alg.parameters.length)) return cbor.build.int(BigInt(i));
+  var oidBytes = cbor.build.byteString(asn1.encodeOidContent(alg.oid));   // ~oid: bare BER OID content
+  if (alg.parameters && alg.parameters.length) return cbor.build.array([oidBytes, cbor.build.byteString(alg.parameters)]);
+  return oidBytes;
+}
+// A SpecialText attribute value -> CBOR (text | tag-48 EUI). v1 encodes the text + eui64 forms.
+function _encSpecialText(rdn) {
+  if (rdn.eui64) return cbor.build.tag(48, cbor.build.byteString(rdn.eui64));
+  return cbor.build.textString(String(rdn.value));
+}
+// A Name -> CBOR: null (issuer only) | a bare SpecialText single utf8 commonName | an array of RDN pairs.
+function _encName(name, isSubject) {
+  if (name === null || name === undefined) {
+    if (!isSubject) return cbor.build.nullValue();   // issuer == subject (self-signed)
+    throw _err("c509/bad-name", "the subject Name is required");
+  }
+  var rdns = name.rdns || [];
+  if (rdns.length === 1 && rdns[0].type === "commonName" && !rdns[0].printable) return _encSpecialText(rdns[0]);
+  var items = [];
+  rdns.forEach(function (rdn) {
+    var ai = ATTR_TO_INT[rdn.type];
+    if (ai === undefined) throw _err("c509/bad-name", "attribute type " + rdn.type + " has no C509 registry int");
+    items.push(cbor.build.int(BigInt(rdn.printable ? -ai : ai)));   // sign selects printableString
+    items.push(_encSpecialText(rdn));
+  });
+  return cbor.build.array(items);
+}
+// subjectPublicKey -> CBOR: EC point byte string, or an RSA ~biguint modulus ([modulus, exponent] when e != 65537).
+function _encSpk(r) {
+  if (r.rsaPublicKey) {
+    var mod = cbor.build.byteString(_minBytes(r.rsaPublicKey.modulus));
+    if (r.rsaPublicKey.exponent === 65537n) return mod;
+    return cbor.build.array([mod, cbor.build.byteString(_minBytes(r.rsaPublicKey.exponent))]);
+  }
+  if (!Buffer.isBuffer(r.subjectPublicKey)) throw _err("c509/bad-spki", "the subjectPublicKey bytes are missing");
+  return cbor.build.byteString(r.subjectPublicKey);
+}
+// extensions -> CBOR: the keyUsage int-shortcut (a lone keyUsage), else an array of [extID, extValue] pairs.
+function _encExtensions(exts) {
+  if (exts.length === 1 && exts[0].name === "keyUsage" && typeof exts[0].keyUsageBits === "number") {
+    return cbor.build.int(BigInt(exts[0].critical ? -exts[0].keyUsageBits : exts[0].keyUsageBits));
+  }
+  var items = [];
+  exts.forEach(function (ext) {
+    var ei = EXT_TO_INT[ext.name];
+    if (ei !== undefined) {
+      items.push(cbor.build.int(BigInt(ext.critical ? -ei : ei)));
+      // a registered-int extension carries its extnValue DER bytes as a bare byte string.
+      if (!Buffer.isBuffer(ext.value)) throw _err("c509/non-invertible", "extension " + ext.name + " has no byte-string value to encode");
+      items.push(cbor.build.byteString(ext.value));
+    } else {
+      items.push(cbor.build.byteString(asn1.encodeOidContent(ext.oid)));   // ~oid extension id
+      if (!Buffer.isBuffer(ext.value)) throw _err("c509/non-invertible", "extension " + (ext.oid || ext.name) + " has no byte-string value to encode");
+      var bs = cbor.build.byteString(ext.value);
+      items.push(ext.critical ? cbor.build.array([bs]) : bs);              // critical ~oid value wraps in a 1-element array
+    }
+  });
+  return cbor.build.array(items);
+}
+// forward-declared below; the DER X.509 -> type-3 C509 structured result.
+var _derToType3;
+// A hand-built (no _fieldBytes) result must carry the structured fields the encode below reads; a missing or
+// wrong-typed field fails closed with a typed verdict rather than a raw property-access crash.
+function _requireResultShape(r) {
+  if (r.certificateType == null) throw _err("c509/bad-input", "a C509 result must carry certificateType");
+  if (r.serialNumber == null && r.serialNumberHex == null) throw _err("c509/bad-input", "a C509 result must carry serialNumber or serialNumberHex");
+  if (!r.signatureAlgorithm || typeof r.signatureAlgorithm.name !== "string") throw _err("c509/bad-input", "a C509 result must carry signatureAlgorithm.name");
+  if (!r.subjectPublicKeyAlgorithm || typeof r.subjectPublicKeyAlgorithm.name !== "string") throw _err("c509/bad-input", "a C509 result must carry subjectPublicKeyAlgorithm.name");
+  if (!r.validity || !(r.validity.notBefore instanceof Date) || (r.validity.notAfter !== null && !(r.validity.notAfter instanceof Date))) throw _err("c509/bad-input", "a C509 result must carry validity.notBefore (Date) and notAfter (Date or null)");
+  if (!Array.isArray(r.extensions)) throw _err("c509/bad-input", "a C509 result must carry an extensions array");
+  if (!Buffer.isBuffer(r.signatureValue)) throw _err("c509/bad-input", "a C509 result must carry a Buffer signatureValue");
+}
+// A validity Date -> its C509 ~time (a non-negative CBOR epoch uint). A pre-epoch date cannot be
+// represented (the parser accepts only an unwrapped major-type-0 integer) and fails closed here.
+function _validityUint(date, label) {
+  var secs = Math.floor(date.getTime() / 1000);
+  if (!isFinite(secs) || secs < 0) throw _err("c509/bad-validity", label + " is before the Unix epoch or not a valid date; C509 ~time is a non-negative CBOR epoch");
+  return cbor.build.uint(BigInt(secs));
+}
+// A structured C509 result -> the 11-element deterministic-CBOR array.
+function _encodeC509Array(r) {
+  // Re-emit a PARSED certificate's raw fields (elements 0..9) VERBATIM -- re-deriving from the decoded
+  // values could differ on a canonical-equivalent form (a byte-string attribute value, a registry alias)
+  // and break a type-2 native signature (which covers these bytes) or a type-3 DER reconstruction (which
+  // depends on the field values). Both types preserve the exact bytes; only a hand-built result (no
+  // _fieldBytes) re-derives from the structured values below.
+  if (Buffer.isBuffer(r._fieldBytes)) {
+    if (!Buffer.isBuffer(r.signatureValue)) throw _err("c509/bad-input", "a re-emitted certificate must carry a Buffer signatureValue");
+    var out = Buffer.concat([Buffer.from([0x8b]), r._fieldBytes, cbor.build.byteString(r.signatureValue)]);   // array(11) head + fields 0..9 + signatureValue
+    parse(out);   // fail closed: a caller-mutated _fieldBytes must still re-parse as a valid C509, else parse throws a typed c509/* verdict
+    return out;
+  }
+  _requireResultShape(r);
+  var pkKey = r.subjectPublicKeyAlgorithm.curve ? r.subjectPublicKeyAlgorithm.name + "|" + r.subjectPublicKeyAlgorithm.curve : r.subjectPublicKeyAlgorithm.name;
+  var arr = cbor.build.array([
+    cbor.build.int(BigInt(r.certificateType)),
+    cbor.build.byteString(r.serialNumberHex != null ? Buffer.from(r.serialNumberHex, "hex") : _minBytes(r.serialNumber)),
+    _encAlgorithm(r.signatureAlgorithm, SIG_ALG_TO_INT, r.signatureAlgorithm.name),
+    _encName(r.issuer, false),
+    _validityUint(r.validity.notBefore, "validityNotBefore"),
+    r.validity.notAfter === null ? cbor.build.nullValue() : _validityUint(r.validity.notAfter, "validityNotAfter"),
+    _encName(r.subject, true),
+    _encAlgorithm(r.subjectPublicKeyAlgorithm, PK_ALG_TO_INT, pkKey),
+    _encSpk(r),
+    _encExtensions(r.extensions),
+    cbor.build.byteString(r.signatureValue),
+  ]);
+  parse(arr);   // fail closed: a hand-built result must re-parse as a valid C509 (as the verbatim path checks), else parse throws a typed c509/* verdict
+  return arr;
+}
+
+/**
+ * @primitive  pki.schema.c509.encode
+ * @signature  pki.schema.c509.encode(input[, opts]) -> Buffer
+ * @since      0.3.4
+ * @status     experimental
+ * @spec       draft-ietf-cose-cbor-encoded-cert, RFC 8949, RFC 9090
+ * @related    pki.schema.c509.parse
+ *
+ * Encode a C509 certificate to its deterministic-CBOR bytes -- the producing-side inverse of
+ * `pki.schema.c509.parse`. `input` is either a DER X.509 v3 certificate (a Buffer or PEM string), which is
+ * forward-transformed to a **type-3** C509 (a compact CBOR re-encoding whose signature is copied from the
+ * source and re-expressed as a fixed-width r||s, so `parse(encode(der)).reconstructedDer` reproduces the
+ * original DER byte for byte and the original signature still verifies), or a `pki.schema.c509.parse`
+ * result object, which is re-emitted to its native deterministic-CBOR array. The emission is canonical
+ * deterministic CBOR (RFC 8949 sec. 4.2) -- shortest-form heads, definite lengths, sorted map keys, and the
+ * registry integer shorthand for every registered algorithm / attribute / extension. It is signing-free (a
+ * byte transform, like `pki.ct.encodeSctList`); a shape outside the covered set throws a typed `C509Error`.
+ *
+ * The fixed-width ECDSA r||s is sized by the ISSUER's signing curve, which a leaf certificate does not
+ * carry. It is resolved authoritatively (never a magnitude guess, and matching issuer/subject Names are not
+ * taken as proof of self-signing): from `opts.issuerCurve`, or from the RFC 5480 standard digest<->curve
+ * pairing the signature algorithm implies. A certificate signed with a non-standard digest/curve pairing
+ * (its r/s wider than the digest's standard curve) fails closed -- supply the issuer curve via
+ * `opts.issuerCurve`.
+ *
+ * @opts
+ *   - `issuerCurve` (string) -- the ISSUER's ECDSA signing curve "P-256" / "P-384" / "P-521" (or the OID
+ *     names prime256v1 / secp384r1 / secp521r1); authoritative, overrides the resolution above. Consulted
+ *     only for the DER -> type-3 path; ignored when re-emitting a parse result.
+ *
+ * @example
+ *   var cbor = pki.schema.c509.encode(signerCertDer);   // a DER cert -> a compact type-3 C509
+ *   pki.schema.c509.parse(cbor).certificateType;        // 3
+ */
+// A commonName string that is a MAC / EUI address ("HH-HH-HH-FF-FE-HH-HH-HH") -> the C509 tag-48 byte
+// value (draft-20 sec. 3.2.3): an FF-FE-in-the-middle EUI-64 collapses to its 6-byte EUI-48, else the
+// 8-byte EUI-64 verbatim. A non-MAC commonName returns null (encoded as text). The exact inverse of
+// _macToEui64String, so the reconstruction rebuilds the identical DER commonName string.
+function _euiFromCn(value) {
+  if (!/^[0-9A-F]{2}(-[0-9A-F]{2}){7}$/.test(value)) return null;
+  var bytes = Buffer.from(value.replace(/-/g, ""), "hex");
+  if (bytes[3] === 0xff && bytes[4] === 0xfe) return Buffer.concat([bytes.subarray(0, 3), bytes.subarray(5)]);
+  return bytes;
+}
+// A DER Name -> the C509 structured rdns, decoding each attribute's string type (PrintableString ->
+// printable, UTF8String -> utf8; the C509 int sign carries this). Single-attribute RDNs only (v1).
+function _c509NameFromDer(nameBytes) {
+  var node = asn1.decode(nameBytes);
+  var rdns = [];
+  (node.children || []).forEach(function (rdnSet) {
+    if (!rdnSet.children || rdnSet.children.length !== 1) throw _err("c509/non-invertible", "a C509 Name requires single-attribute RDNs");
+    var attr = rdnSet.children[0];
+    var attrName = oid.name(asn1.read.oid(attr.children[0]));
+    if (attrName == null || ATTR_TO_INT[attrName] === undefined) throw _err("c509/non-invertible", "attribute type " + attrName + " has no C509 registry integer");
+    var valNode = attr.children[1];
+    var value = asn1.read.string(valNode);
+    var eui = attrName === "commonName" ? _euiFromCn(value) : null;
+    if (eui) rdns.push({ type: attrName, value: value, eui64: eui });                            // tag-48 MAC commonName
+    else rdns.push({ type: attrName, value: value, printable: valNode.tagNumber === asn1.TAGS.PRINTABLE_STRING });
+  });
+  return { rdns: rdns };
+}
+// A keyUsage extnValue (a DER KeyUsage BIT STRING) -> the C509 integer whose bit i is the named bit i.
+function _keyUsageBitsFromDer(extnValue) {
+  var bs;
+  try {
+    bs = asn1.read.bitString(asn1.decode(extnValue));
+  } catch (_e) {
+    return null;   // a malformed keyUsage BIT STRING cannot take the int shortcut -> encode it as a raw extension
+  }
+  var total = bs.bytes.length * 8 - bs.unusedBits, value = 0;
+  for (var bit = 0; bit < total && bit < 31; bit++) { if (bs.bytes[bit >> 3] & (0x80 >> (bit & 7))) value |= (1 << bit); }
+  return value > 0 && value <= 0x1ff ? value : null;
+}
+var _NO_EXPIRY = Date.UTC(9999, 11, 31, 23, 59, 59);
+// The C509 (OID/node) curve names <-> the WebCrypto namedCurve the P1363 converter expects, and the
+// RFC 5480 standard digest<->curve pairing an ECDSA signature algorithm implies.
+var NODE_TO_WEBCRYPTO = { "prime256v1": "P-256", "secp384r1": "P-384", "secp521r1": "P-521" };
+var WEBCRYPTO_FIELD_BYTES = { "P-256": 32, "P-384": 48, "P-521": 66 };
+var SIG_ALG_TO_CURVE = { "ecdsaWithSHA256": "P-256", "ecdsaWithSHA384": "P-384", "ecdsaWithSHA512": "P-521" };
+// A DER INTEGER magnitude byte length: the content past any leading sign/pad octet.
+function _magBytes(intNode) {
+  var c = intNode.content, i = 0;
+  while (i < c.length - 1 && c[i] === 0x00) i++;
+  return c.length - i;
+}
+// The max r/s magnitude width of a DER ECDSA signature (validating its two-INTEGER shape).
+function _sigMagWidth(derSig) {
+  var n;
+  try { n = asn1.decode(derSig); } catch (e) { throw _err("c509/bad-signature", "the ECDSA issuer signature is not valid DER", e); }
+  if (n.tagNumber !== asn1.TAGS.SEQUENCE || n.tagClass !== "universal" || !n.children || n.children.length !== 2) throw _err("c509/bad-signature", "the ECDSA issuer signature must be a SEQUENCE of two INTEGERs");
+  for (var i = 0; i < 2; i++) {
+    var ch = n.children[i];
+    if (ch.tagNumber !== asn1.TAGS.INTEGER || ch.tagClass !== "universal" || ch.constructed) throw _err("c509/bad-signature", "the ECDSA issuer signature r and s must be universal INTEGERs");
+  }
+  return Math.max(_magBytes(n.children[0]), _magBytes(n.children[1]));
+}
+var CURVE_ORDER = ["P-256", "P-384", "P-521"];   // ascending field size
+// The smallest supported curve whose field holds a magnitude, or null if none does.
+function _minCurveForMag(mag) {
+  for (var i = 0; i < CURVE_ORDER.length; i++) { if (mag <= WEBCRYPTO_FIELD_BYTES[CURVE_ORDER[i]]) return CURVE_ORDER[i]; }
+  return null;
+}
+// The ISSUER signature's fixed-width r||s is sized by the ISSUER's signing curve. The DER ECDSA signature
+// does NOT carry the curve and the r/s magnitudes are only a lower bound (a P-384 signature with small r/s
+// is byte-indistinguishable from a P-256 one), so the curve is resolved from an AUTHORITATIVE source, never
+// a guess: (1) an explicit opts.issuerCurve, or (2) the RFC 5480 standard digest<->curve pairing the
+// signature algorithm implies -- and ONLY when that pairing is the smallest curve the magnitude admits.
+// Matching issuer/subject Names are NOT treated as proof of self-signing (a self-issued certificate may be
+// cross-signed by a different key on a different curve). A signature whose r/s exceed the digest's standard
+// curve (a larger key) OR whose magnitude also fits a SMALLER curve (a smaller key signing with a larger
+// digest) leaves the curve undetermined: it fails closed and directs the caller to opts.issuerCurve.
+function _resolveIssuerSigCurve(c, opts) {
+  var mag = _sigMagWidth(c.signatureValue.bytes), curve;
+  if (opts && opts.issuerCurve != null) {
+    curve = String(opts.issuerCurve);
+    if (NODE_TO_WEBCRYPTO[curve]) curve = NODE_TO_WEBCRYPTO[curve];
+    if (!WEBCRYPTO_FIELD_BYTES[curve]) throw _err("c509/bad-input", "opts.issuerCurve must be P-256 / P-384 / P-521 (or prime256v1 / secp384r1 / secp521r1); got " + opts.issuerCurve);
+  } else {
+    curve = SIG_ALG_TO_CURVE[c.signatureAlgorithm.name];
+    if (!curve) throw _err("c509/non-invertible", "cannot resolve the issuer signing curve for signature algorithm " + c.signatureAlgorithm.name);
+    var minCurve = _minCurveForMag(mag);
+    if (!minCurve) throw _err("c509/non-invertible", "the ECDSA signature r/s width " + mag + " exceeds every supported curve field");
+    if (WEBCRYPTO_FIELD_BYTES[curve] < mag) throw _err("c509/non-invertible", "the issuer signed with a non-standard digest/curve pairing (r/s width " + mag + " exceeds the " + curve + " field implied by " + c.signatureAlgorithm.name + "); pass opts.issuerCurve (P-256 / P-384 / P-521)");
+    if (WEBCRYPTO_FIELD_BYTES[curve] > WEBCRYPTO_FIELD_BYTES[minCurve]) throw _err("c509/non-invertible", "signature algorithm " + c.signatureAlgorithm.name + " does not uniquely determine the issuer curve (r/s width " + mag + " also fits " + minCurve + "); pass opts.issuerCurve (P-256 / P-384 / P-521)");
+  }
+  if (mag > WEBCRYPTO_FIELD_BYTES[curve]) throw _err("c509/non-invertible", "the ECDSA signature r/s width " + mag + " does not fit the resolved " + curve + " field");
+  return curve;
+}
+// Compress an uncompressed SEC1 EC point (0x04||X||Y) to the C509 marker form (draft-20 sec. 3.2.2): the
+// sign-of-Y marker 0xFE (Y even) / 0xFD (Y odd) followed by X. The inverse of webcrypto.decompressEcPoint,
+// so the type-3 reconstruction recovers the exact original point. A non-0x04 point is kept verbatim.
+function _compressEcPoint(point, coordLen) {
+  if (!point.length || point[0] !== 0x04) return point;
+  if (point.length !== 1 + 2 * coordLen) throw _err("c509/non-invertible", "uncompressed EC point length " + point.length + " does not match the curve field size");
+  var x = point.subarray(1, 1 + coordLen), y = point.subarray(1 + coordLen);
+  return Buffer.concat([Buffer.from([(y[y.length - 1] & 1) ? 0xfd : 0xfe]), x]);
+}
+// A DER X.509 v3 certificate -> the type-3 C509 structured result (the inverse of _reconstructDer). Only
+// the reconstruction's covered set is invertible; encode() self-verifies the byte-exact round trip.
+_derToType3 = function (input, opts) {
+  var c;
+  try { c = x509.parse(input); } catch (e) { throw _err("c509/bad-input", "the input is not a valid X.509 certificate", e); }
+  if (!/^ecdsa/i.test(c.signatureAlgorithm.name || "")) throw _err("c509/non-invertible", "type-3 C509 encoding covers only ECDSA-signed certificates; got " + (c.signatureAlgorithm.name || "an unregistered algorithm"));
+  if (c.subjectPublicKeyInfo.algorithm.name !== "ecPublicKey") throw _err("c509/non-invertible", "type-3 C509 encoding covers only EC (ecPublicKey) certificates in v1; got " + (c.subjectPublicKeyInfo.algorithm.name || "an unregistered algorithm"));
+  var curveOid = asn1.read.oid(asn1.decode(c.subjectPublicKeyInfo.algorithm.parameters));
+  var curve = oid.name(curveOid);
+  var coordLen = EC_FIELD_BYTES[curve];
+  if (!coordLen) throw _err("c509/non-invertible", "unsupported EC subject curve " + (curve || curveOid));
+  var sigCurve = _resolveIssuerSigCurve(c, opts);   // the ISSUER signing curve, resolved authoritatively (opts / digest pairing)
+  var spkiNode = asn1.decode(c.subjectPublicKeyInfo.bytes);
+  return {
+    certificateType: 3,
+    serialNumber: c.serialNumber,          // no serialNumberHex -> the encoder uses the minimal ~biguint magnitude
+    signatureAlgorithm: { name: c.signatureAlgorithm.name, oid: c.signatureAlgorithm.oid },
+    issuer: _c509NameFromDer(c.issuer.bytes),
+    validity: { notBefore: c.validity.notBefore, notAfter: c.validity.notAfter.getTime() === _NO_EXPIRY ? null : c.validity.notAfter },
+    subject: _c509NameFromDer(c.subject.bytes),
+    subjectPublicKeyAlgorithm: { name: "ecPublicKey", oid: c.subjectPublicKeyInfo.algorithm.oid, curve: curve },
+    subjectPublicKey: _compressEcPoint(asn1.read.bitString(spkiNode.children[1]).bytes, coordLen),   // 0x04||X||Y -> C509 compressed marker
+    rsaPublicKey: null,
+    extensions: (c.extensions || []).map(function (e) {
+      var ext = { name: e.name, oid: e.oid, critical: !!e.critical, value: e.value };
+      if (e.name === "keyUsage") { var bits = _keyUsageBitsFromDer(e.value); if (bits != null) ext.keyUsageBits = bits; }   // enable the int-shortcut
+      return ext;
+    }),
+    signatureValue: validator.sig.ecdsaDerToP1363(c.signatureValue.bytes, sigCurve, C509Error, "c509/bad-signature"),
+  };
+};
+
+function encode(input, opts) {
+  if (input && typeof input === "object" && !Buffer.isBuffer(input) && input.certificateType != null) {
+    return _encodeC509Array(input);   // a parse result -> re-emit its native array
+  }
+  if (!Buffer.isBuffer(input) && typeof input !== "string") throw _err("c509/bad-input", "encode input must be a DER/PEM X.509 certificate or a c509.parse result");
+  // Normalize input to DER through the SAME shared coercion x509.parse uses (a PEM string, a PEM-armored
+  // Buffer, or raw DER all collapse to the certificate DER), so the self-verify compares against exactly the
+  // bytes _derToType3 processed -- never a Buffer of PEM text.
+  var origDer = pkix.coerceToDer(input, { pemLabel: "CERTIFICATE", PemError: frameworkError.PemError, ErrorClass: C509Error, prefix: "c509" });
+  var encoded = _encodeC509Array(_derToType3(origDer, opts));
+  // The type-3 transform MUST invert back to the original DER byte-for-byte (so the original signature
+  // verifies) -- self-verify it, failing closed on any edge the reconstruction cannot reproduce.
+  var recon = parse(encoded).reconstructedDer;
+  if (!recon || Buffer.compare(recon, origDer) !== 0) throw _err("c509/non-invertible", "the type-3 C509 does not reconstruct the source certificate byte-for-byte");
+  return encoded;
+}
+
+module.exports = { parse: parse, matches: matches, encode: encode };

package/lib/x509-sign.js

@@ -165,14 +165,9 @@ function _buildExtensions(extSpec, ctx) {
 
 // ---- serial + validity + key plumbing --------------------------------------
 
-// RFC 5280 sec. 4.1.2.5 -- UTCTime for 1950..2049, GeneralizedTime otherwise. UTCTime's two-digit year
-// only represents 1950..2049 (sec. 4.1.2.5.1), so a pre-1950 date MUST use GeneralizedTime (the same
-// arm as a date from 2050 on); using UTCTime for a pre-1950 year would be unrepresentable.
-function _timeDer(date, which) {
-  guard.time.assertValid(date, _err, "x509/bad-input", "certificate " + which);
-  var y = date.getUTCFullYear();
-  return (y >= 1950 && y <= 2049) ? b.utcTime(date) : b.generalizedTime(date);
-}
+// RFC 5280 sec. 4.1.2.5 UTCTime/GeneralizedTime cutover -- the shared builder primitive (pki-build), a
+// thin wrapper here so the certificate validity label reads "certificate notBefore/notAfter".
+function _timeDer(date, which) { return _b.timeDer(date, "certificate " + which); }
 // A supplied issuer certificate MUST be a CA that may sign certificates: basicConstraints present AND
 // critical AND cA=TRUE (RFC 5280 sec. 4.2.1.9), and -- when a keyUsage extension is present -- the
 // keyCertSign bit (sec. 4.2.1.3). Refuse a non-CA issuer rather than mint a certificate that will not

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3787cd37-e9d0-465d-bed3-0f6822edb52c",
+  "serialNumber": "urn:uuid:4cfd38cc-6772-42e6-bed2-46e04c2a950e",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-17T08:27:56.310Z",
+    "timestamp": "2026-07-17T17:26:06.040Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.3.2",
+      "bom-ref": "@blamejs/pki@0.3.4",
       "type": "application",
       "name": "pki",
-      "version": "0.3.2",
+      "version": "0.3.4",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.3.2",
+      "purl": "pkg:npm/%40blamejs/pki@0.3.4",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.3.2",
+      "ref": "@blamejs/pki@0.3.4",
       "dependsOn": []
     }
   ]