@blamejs/pki 0.3.3 → 0.3.5

package/CHANGELOG.md

@@ -4,6 +4,24 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.3.5 — 2026-07-17
+
+pki.cmp.build assembles protected RFC 9810 CMP PKIMessages -- certificate requests, confirmations, revocations, and general messages, protected by a sender-key signature or a PBMAC1 shared secret.
+
+### Added
+
+- pki.cmp.build(message, opts) assembles a protected RFC 9810 CMP PKIMessage. message.header carries the sender / recipient GeneralNames (including the anonymous NULL-DN) and optional transaction metadata; message.body is a single-key arm -- ir / cr / kur (a CertReqMessages via pki.crmf.build), p10cr (a PKCS#10 CertificationRequest), certConf, pollReq, genm, or rr. Protection is exactly one of opts.{ key, cert } (a signature under the sender key, algorithm resolved from the certificate -- RSA / ECDSA / EdDSA / ML-DSA / SLH-DSA / composite) or opts.mac (a PBMAC1 shared-secret HMAC, RFC 9481 / RFC 9579), computed over the exact ProtectedPart DER and self-verified before return. Returns DER, or a PEM CMP block with opts.pem; malformed input throws a typed CmpError. Message parsing remains pki.schema.cmp.parse.
+- pki.crmf.buildCertTemplate(template) encodes a bare RFC 4211 CertTemplate (subject, public key, validity, requested extensions, version) to canonical DER -- the certTemplate interior of pki.crmf.build, exposed for the CMP rr revocation body whose certDetails names the certificate to revoke.
+
+## v0.3.4 — 2026-07-17
+
+pki.schema.c509.encode produces C509 CBOR certificates -- a DER X.509 certificate compresses to a compact, byte-exact-invertible type-3 C509, and a deterministic-CBOR encoder joins pki.cbor.
+
+### Added
+
+- pki.schema.c509.encode(input) encodes a C509 certificate to deterministic-CBOR bytes -- a DER X.509 v3 certificate to a compact type-3 C509 (byte-exact-invertible, so the original signature verifies), or a pki.schema.c509.parse result re-emitted to its native array. Canonical deterministic CBOR with the registry integer shorthands and the C509 compressions; a certificate outside the invertible covered set throws a typed C509Error. Certificate parsing remains pki.schema.c509.parse.
+- pki.cbor.build is a deterministic-CBOR encoder (RFC 8949 section 4.2) -- the byte-exact inverse of pki.cbor.decode: shortest-form heads, definite lengths, sorted and unique map keys, over unsigned and negative integers, byte and text strings, arrays, maps, tags, and the tagged bignum / epoch-time / object-identifier leaves. Encoded output always re-decodes through the strict decoder.
+
 ## v0.3.3 — 2026-07-17
 
 pki.crmf.build issues RFC 4211 certificate request messages -- a CertReqMessages with a signature proof of possession, over every algorithm the toolkit supports.

package/README.md

@@ -204,7 +204,7 @@ is callable today; nothing below is a stub.
 | `pki.webcrypto` | A W3C WebCrypto (`SubtleCrypto`) engine over `node:crypto` — `sign`/`verify`/`encrypt`/`decrypt`/`deriveBits`/`digest`/`generateKey`/`importKey`/`exportKey` across RSA, ECDSA, ECDH, Ed25519/Ed448, AES, HMAC, HKDF, PBKDF2, SHA — **and** post-quantum ML-DSA-44/65/87 and SLH-DSA signatures, plus ML-KEM-512/768/1024 key generation and certificate/PKCS#8 import — the RFC 9935 seed / expandedKey / both private-key CHOICE is validated fail-closed, so an OpenSSL-legacy bare-seed or an internally inconsistent key is rejected with a typed error (KEM encapsulation lands with CMS KEM-decrypt). Zero-dependency, OpenSSL-interoperable |
 | `pki.schema` | The schema family — `parse` detects which PKI format DER / PEM encodes and routes to the right parser, `all` enumerates the registered formats, and the engine + per-format members are grouped here |
 | `pki.schema.x509` | Parse DER / PEM certificates into structured, validated fields, with named + partly-decoded extensions — including the RFC 3739 / ETSI EN 319 412-5 qualified-certificate `qcStatements` (EU-qualified declaration, reliance limit, QSCD flag, certificate type, retention, PDS URLs, country of qualification; unknown statements preserved opaque) and the Microsoft Active Directory Certificate Services enrollment extensions (certificate template, CA version, previous-CA-certificate hash, application policies), fail-closed — `parse`, `pemDecode`, `pemEncode` |
-| `pki.schema.c509` | Parse C509 CBOR-encoded certificates (draft-ietf-cose-cbor-encoded-cert) — the compact CBOR profile of X.509, decoded fail-closed under deterministic CBOR; an explicit `parse` call (CBOR, not DER, so not auto-routed) |
+| `pki.schema.c509` | Parse **and encode** C509 CBOR-encoded certificates (draft-ietf-cose-cbor-encoded-cert) — the compact CBOR profile of X.509, decoded fail-closed under deterministic CBOR; an explicit `parse` call (CBOR, not DER, so not auto-routed). `encode(input)` is the byte-exact inverse: a DER X.509 v3 certificate forward-transforms to a compact type-3 C509 whose reconstruction reproduces the original DER byte for byte (so the original signature still verifies), or a `parse` result re-emits its native array — canonical deterministic CBOR with the registry integer shorthands and the C509 compressions; a certificate outside the invertible set throws a typed `C509Error` |
 | `pki.schema.crl` | Parse DER / PEM X.509 CRLs per RFC 5280 §5 — revoked serials with real-`Date` revocation times, named + partly-decoded extensions, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.csr` | Parse DER / PEM PKCS#10 certification requests per RFC 2986 — subject DN, public key, requested attributes, signature, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.pkcs8` | Parse DER / PEM PKCS#8 private keys per RFC 5208 / 5958 — algorithm, raw key bytes, attributes, optional public key, fail-closed; encrypted keys recognized (not decrypted) — `parse`, `parseEncrypted`, `pemDecode`, `pemEncode` |
@@ -226,6 +226,7 @@ is callable today; nothing below is a stub.
 | `pki.csr` | PKCS#10 certification-request issuance (RFC 2986 / RFC 2985) — `sign(spec, key, opts)` builds and signs a `CertificationRequest`: a `spec` of subject (a common-name string, an array of RDNs, or raw Name DER; may be empty), the public key being certified, an optional `extensionRequest` (requested v3 extensions — subject alternative names, key usage, extended key usage, basic constraints, certificate policies, subject key identifier, or an array of pre-encoded Extension DER — that a CA copies into the issued certificate), and an optional `challengePassword`. `key` (or `{ key }`) is the subject's own private key: the request is self-signed to prove possession of the private half of `subjectPublicKey`, and that proof is verified before the request is returned (what `openssl req -verify` checks). The signature algorithm is resolved from the subject key, so RSA (PKCS#1 v1.5 / PSS via `opts.pss`), ECDSA, EdDSA, ML-DSA, SLH-DSA, and the composite arms all sign without a per-algorithm branch. Returns DER, or a PEM `CERTIFICATE REQUEST` with `opts.pem`; malformed input throws a typed `CsrError`. Parsing stays at `pki.schema.csr.parse` — `sign` |
 | `pki.attrcert` | RFC 5755 attribute-certificate issuance — `sign(spec, issuer, opts)` builds and signs an `AttributeCertificate` as an Attribute Authority: a `spec` of `holder` (exactly one of an entity name, a `baseCertificateID` public-key-certificate reference, a `fromCertificate` binding derived from a certificate, or an object digest), the validity window (GeneralizedTime), an optional serial (positive, ≤ 20 octets; randomly generated when omitted), the `attributes` (the privilege syntaxes — role, clearance, group, chargingIdentity, accessIdentity, authenticationInfo — or pre-encoded Attribute DER), and optional `extensions` (auditIdentity, targetInformation, noRevAvail, aaControls, acProxying, authorityKeyIdentifier, or pre-encoded Extension DER, each with its RFC 5755 criticality). An attribute certificate is never self-signed — the `issuer` is the signing AA, supplied as `{ cert, key }` or `{ name, publicKey, key }`. The signature algorithm is resolved from the AA key, so RSA (PKCS#1 v1.5 / PSS via `opts.pss`), ECDSA, EdDSA, ML-DSA, SLH-DSA, and the composite arms all sign without a per-algorithm branch, and the signature is verified under the AA public key before the certificate is returned. Returns DER, or a PEM `ATTRIBUTE CERTIFICATE` with `opts.pem`; malformed input throws a typed `AttrCertError`. Parsing stays at `pki.schema.attrcert.parse` — `sign` |
 | `pki.crmf` | RFC 4211 certificate-request-message issuance — `build(spec, key, opts)` assembles a `CertReqMessages`: a `spec` of `certReqId` (default 0; the RFC 9483 `-1` sentinel allowed), a `certTemplate` of the requested certificate fields (`subject`, `publicKey` — the SPKI DER of the key being certified — `validity`, requested `extensions`, an optional `version` 2), optional `controls` and `regInfo` (regToken / authenticator / utf8Pairs / oldCertID / protocolEncrKey, or pre-encoded `AttributeTypeAndValue` DER), and an optional `pop` selector. `key` (or `{ key }`) is the requester's private key — the message carries a `POPOSigningKey` proof of possession signed with the private half of `certTemplate.publicKey` (verified before the message is returned), exactly as a PKCS#10 CSR proves possession; a complete template signs the `CertRequest`, an incomplete one signs a `POPOSigningKeyInput`. The signature algorithm is resolved from the requested public key, so RSA (PKCS#1 v1.5 / PSS via `opts.pss`), ECDSA, EdDSA, ML-DSA, SLH-DSA, and the composite arms all sign without a per-algorithm branch. `key` is optional for a `raVerified` proof. Pass an array of specs for a batch; the CA-assigned template fields are never emitted. Returns DER, or a PEM block with `opts.pem`; malformed input throws a typed `CrmfError`. Parsing stays at `pki.schema.crmf.parse` — `build` |
+| `pki.cmp` | RFC 9810 Certificate Management Protocol message building — `build(message, opts)` assembles a protected `PKIMessage`. `message.header` carries the `sender` / `recipient` GeneralNames (including the anonymous NULL-DN) plus optional transaction metadata (`transactionID`, `senderNonce` / `recipNonce`, `messageTime` as a GeneralizedTime, `senderKID` / `recipKID`, `freeText`, `generalInfo`); `message.body` is a single-key object naming the request or transaction arm — `ir` / `cr` / `kur` (a `CertReqMessages` spec delegated to `pki.crmf.build`), `p10cr` (a PKCS#10 `CertificationRequest`), `certConf`, `pollReq`, `genm`, or `rr`. Protection is exactly one of `opts.{ key, cert }` — a signature over the message under the sender key, the algorithm resolved from the signer certificate so RSA (PKCS#1 v1.5 / PSS), ECDSA, EdDSA, ML-DSA, SLH-DSA, and the composite arms all sign without a per-algorithm branch — or `opts.mac` — a PBMAC1 shared-secret HMAC (RFC 9481 / 9579, PBKDF2-derived). The protection covers the exact DER of the virtual `ProtectedPart` (the header and body) and is self-verified before the message is returned; the `protectionAlg` is derived, never caller-set, so the message the parser accepts is coherent by construction. Returns DER, or a PEM `CMP` block with `opts.pem`; malformed input throws a typed `CmpError`. Parsing stays at `pki.schema.cmp.parse` — `build` |
 | `pki.cms` | RFC 5652 §5 CMS SignedData signing + signature verification — `sign(content, signers, opts)` produces a SignedData (attached or detached, one or many signers, RSA / RSASSA-PSS / ECDSA / EdDSA, the post-quantum ML-DSA-44/65/87 (RFC 9882) and SLH-DSA (all twelve FIPS 205 sets, RFC 9814), and composite ML-DSA (pairing ML-DSA with a traditional RSA / ECDSA / EdDSA — accepted only when **both** components verify — draft-ietf-lamps-cms-composite-sigs)); it builds the signed attributes (content-type, message-digest, signing-time) as canonical DER, signs the exact §5.4 preimage, and emits a DER `Buffer` or PEM. `verify(input, opts)` parses a SignedData over the strict `pki.schema.cms` codec, locates each SignerInfo's signer certificate by its issuerAndSerialNumber or subjectKeyIdentifier, and checks the signature over the exact §5.4 preimage: when signed attributes are present it confirms the message-digest attribute equals the content digest and verifies over the DER re-encoding of the SignedAttributes (the on-wire `[0]` tag replaced by a universal SET OF), otherwise directly over the content. It returns a per-signer verdict with the matched signer certificate; it does not chain that certificate to a trust anchor — that is the caller's step through `pki.path.validate`. **Content encryption** (RFC 5652/5083/5084/9629): `encrypt(content, recipients, opts)` produces an EnvelopedData, AuthEnvelopedData (AES-GCM, the authenticated default), or EncryptedData — recipients auto-dispatch off the certificate key to key-transport (RSAES-OAEP; v1.5 never emitted), key-agreement (ephemeral-static ECDH over P-256/384/521 with the X9.63 KDF, and X25519/X448 with HKDF), symmetric key-wrap, password (PBKDF2 + RFC 3211 PWRI-KEK), or the post-quantum ML-KEM KEMRecipientInfo (RFC 9629/9936) — one fresh content key wrapped for every recipient. `decrypt(input, keyMaterial, opts)` recovers the content through the matching arm and returns it with an `authenticated` flag; every secret-dependent failure collapses to one uniform `cms/decrypt-failed` verdict (Bleichenbacher / EFAIL / password-oracle freedom), and PKCS#1 v1.5 is decrypt-only under the RFC 3218 implicit-rejection countermeasure. **Compression** (RFC 3274): `compress(content, opts)` / `decompress(input, opts)` produce and consume a CompressedData (ZLIB, version 0, id-alg-zlibCompress); decompress bounds the uncompressed output at 16 MiB and stops before it is materialized, so a decompression bomb fails closed as `cms/decompress-too-large` — a size transform with no integrity/confidentiality (RFC 8551 §2.4.5). Fail-closed with typed `cms/*` errors — `sign`, `verify`, `encrypt`, `decrypt`, `compress`, `decompress` |
 | `pki.smime` | RFC 8551 S/MIME message assembly, verification, encryption, and compression over the CMS layer — `sign(content, signers, opts)` wraps a MIME entity as a signed S/MIME message in either form: `multipart/signed` (clear-signed — the content stays readable in any MUA, a detached CMS SignedData rides alongside as `application/pkcs7-signature` with a matching `micalg`) or `application/pkcs7-mime; smime-type=signed-data` (opaque — the whole entity is a base64 CMS SignedData). The signed bytes are the entity's RFC 8551 §3.1.1 canonical form (CRLF line endings); `verify(message, opts)` unwraps both forms and recomputes over the same canonicalizer, so a transport that re-wraps line endings still verifies and a tampered part fails. `encrypt(content, recipients, opts)` envelopes a MIME entity as an opaque `application/pkcs7-mime` message and `decrypt(message, keyMaterial, opts)` opens one — `smime-type=authEnveloped-data` (AES-GCM, confidentiality and integrity, the default) or `smime-type=enveloped-data` (AES-CBC, confidentiality only, so `decrypt` reports `authenticated: false`, the §3.3 no-integrity caveat); the `smime-type` is derived from the CMS body, not the header, and decryption is fail-closed and oracle-free. The crypto is entirely `pki.cms.sign` / `verify` / `encrypt` / `decrypt` — any RSA / RSASSA-PSS / ECDSA / EdDSA / ML-DSA / SLH-DSA signer and any RSA-OAEP / ECDH / X25519 / X448 / AES-KW / PBKDF2 / ML-KEM recipient carries through (algorithm-agnostic). Like `cms.verify`, `verify` returns the per-signer cryptographic verdict plus the recovered content; chaining a signer to a trust anchor is the caller's `pki.path.validate` step. `compress(content, opts)` / `decompress(message, opts)` add the opaque `application/pkcs7-mime; smime-type=compressed-data; name=smime.p7z` frame (RFC 8551 §3.6, RFC 3274) — a size transform with no integrity/confidentiality (§2.4.5), decompress bounded against a bomb; the recovered content, which may itself be signed or enveloped, is returned for the caller to re-verify. Bidirectionally interoperable with `openssl smime` / `openssl cms`. Fail-closed with typed `smime/*` errors — `sign`, `verify`, `encrypt`, `decrypt`, `compress`, `decompress` |
 | `pki.tsp` | RFC 3161 Time-Stamp Protocol — `sign(messageImprint, tsa, opts)` produces a TimeStampToken: a CMS SignedData (over `pki.cms.sign`) whose content is a `TSTInfo` carrying the timestamped message imprint, the TSA policy, a serial number, and `genTime` (with optional accuracy / nonce / ordering), plus the RFC 3161 §2.4.2 signing-certificate attribute binding the token to the TSA certificate (SHA-2 imprints, any `pki.cms.sign` TSA key). `request` / `parseRequest` build and parse the TimeStampReq a client sends (imprint, requested policy, nonce, certReq), `response` / `parseResponse` the TimeStampResp a TSA returns — a granted status wrapping a token, or a rejection with PKIStatus and failure info, the §2.4.2 status↔token coupling enforced in both directions. `verify(token, data, opts)` verifies a token fail-closed: the CMS signature over the exact signed bytes, the message imprint recomputed from the data, the TSTInfo content type, the ESSCertID(V2) binding to the TSA certificate, the §2.3 critical timeStamping-only extendedKeyUsage, the request nonce when used, and — with a trust anchor supplied — full certification-path validation of the TSA certificate at the token's `genTime`, returning `{ valid, genTime, serialNumber, tstInfo, … }` — `sign`, `request`, `parseRequest`, `response`, `parseResponse`, `verify` |

package/index.js

@@ -44,6 +44,7 @@ var x509      = require("./lib/x509-sign");
 var csr       = require("./lib/csr-sign");
 var attrcert  = require("./lib/attrcert-sign");
 var crmf      = require("./lib/crmf-sign");
+var cmp       = require("./lib/cmp-build");
 var merkle    = require("./lib/merkle");
 var shbs      = require("./lib/shbs");
 var hpke      = require("./lib/hpke");
@@ -103,6 +104,10 @@ module.exports = {
   // assembles a CertReqMessages (a CertTemplate + a signature proof of possession) for a CMP
   // or EST enrollment. Parsing lives at pki.schema.crmf.parse.
   crmf:      crmf,
+  // `cmp` is the RFC 9810 Certificate Management Protocol producing side -- pki.cmp.build assembles a
+  // protected PKIMessage (a certificate request / confirmation / revocation / general message).
+  // Parsing lives at pki.schema.cmp.parse.
+  cmp:       cmp,
   // `merkle` is the RFC 6962 / RFC 9162 Merkle-tree proof-verification core --
   // pki.merkle.leafHash / nodeHash / emptyRootHash build the domain-separated
   // (0x00 leaf / 0x01 node) SHA-256 tree hashes; pki.merkle.verifyInclusion and

package/lib/cbor-det.js

@@ -624,8 +624,111 @@ function readOid(node) {
   return asn1.decodeOidContent(inner.content);
 }
 
+// ---- deterministic-CBOR encoder (RFC 8949 sec. 4.2) -- the byte-exact inverse of decode ----
+// Every emitted head is the shortest form (the exact mirror of decode's cbor/non-minimal-argument reject),
+// every length is definite, and map keys are sorted bytewise + unique -- so decode(build.x(...)) round-trips
+// or the builder produced a shape its own strict decoder rejects. Nested items are pre-encoded CBOR item
+// Buffers (the asn1.build pattern); the CBOR-encoded PKI surfaces (C509, COSE) compose these leaves.
+function _cbItem(x, who) {
+  if (!Buffer.isBuffer(x)) throw new CborError("cbor/not-buffer", who + ": expected a pre-encoded CBOR item Buffer");
+  return x;
+}
+// Validate an assembled container decodes: well-formed nested items (no malformed head, indefinite length,
+// stray break, or trailing bytes), AND within the decoder's depth cap -- a container adds ONE nesting
+// level, so a child AT the cap would overflow the output. Decoding the whole output in one pass catches
+// both, so the encoder never produces bytes its own strict decoder rejects.
+function _assertDecodes(out, who) {
+  try { decode(out); } catch (e) { throw new CborError("cbor/bad-item", who + ": produced bytes the strict decoder rejects (" + (e && e.code) + ")", e); }
+  return out;
+}
+// Mirror the decoder's total-size cap (constants.LIMITS.CBOR_MAX_BYTES) so a string leaf never emits an
+// item the strict reader would reject as too large -- the encode/decode round trip stays closed under the
+// default limits.
+function _capString(out, who) {
+  if (out.length > constants.LIMITS.CBOR_MAX_BYTES) throw new CborError("cbor/too-large", who + ": encoded " + out.length + " bytes exceeds cap " + constants.LIMITS.CBOR_MAX_BYTES);
+  return out;
+}
+// Reject a JS string carrying an unpaired UTF-16 surrogate: Buffer.from(..., "utf8") would silently
+// substitute U+FFFD, so the emitted text string would not be the input (and read.text enforces well-formed
+// UTF-8). Fail closed to match the decoder rather than corrupt the text.
+function _assertWellFormedText(str, who) {
+  for (var i = 0; i < str.length; i++) {
+    var c = str.charCodeAt(i);
+    if (c >= 0xd800 && c <= 0xdbff) { var n = str.charCodeAt(i + 1); if (!(n >= 0xdc00 && n <= 0xdfff)) throw new CborError("cbor/bad-utf8", who + ": the string has an unpaired high surrogate"); i++; }
+    else if (c >= 0xdc00 && c <= 0xdfff) throw new CborError("cbor/bad-utf8", who + ": the string has an unpaired low surrogate");
+  }
+}
+// The initial byte + minimal-width argument for major type `mt` and unsigned `argument`.
+function _head(mt, argument, who) {
+  var a = typeof argument === "bigint" ? argument : BigInt(argument);
+  if (a < 0n) throw new CborError("cbor/bad-argument", who + ": a CBOR head argument must be non-negative");
+  if (a > 0xffffffffffffffffn) throw new CborError("cbor/bad-argument", who + ": a CBOR head argument exceeds 64 bits");
+  var mtb = mt << 5, b;
+  if (a <= 23n) return Buffer.from([mtb | Number(a)]);
+  if (a < 256n) return Buffer.from([mtb | 24, Number(a)]);
+  if (a < 65536n) { b = Buffer.alloc(3); b[0] = mtb | 25; b.writeUInt16BE(Number(a), 1); return b; }
+  if (a < 4294967296n) { b = Buffer.alloc(5); b[0] = mtb | 26; b.writeUInt32BE(Number(a), 1); return b; }
+  b = Buffer.alloc(9); b[0] = mtb | 27; b.writeBigUInt64BE(a, 1); return b;
+}
+var build = {
+  uint: function (n) { var a = typeof n === "bigint" ? n : BigInt(n); if (a < 0n) throw new CborError("cbor/bad-argument", "build.uint: value must be non-negative"); return _head(0, a, "build.uint"); },
+  nint: function (n) { var a = typeof n === "bigint" ? n : BigInt(n); if (a >= 0n) throw new CborError("cbor/bad-argument", "build.nint: value must be negative"); return _head(1, -1n - a, "build.nint"); },
+  int:  function (n) { var a = typeof n === "bigint" ? n : BigInt(n); return a >= 0n ? _head(0, a, "build.int") : _head(1, -1n - a, "build.int"); },
+  byteString: function (buf) { var b = _asBuffer(buf, "build.byteString"); return _capString(Buffer.concat([_head(2, b.length, "build.byteString"), b]), "build.byteString"); },
+  textString: function (s) { var str = String(s); _assertWellFormedText(str, "build.textString"); var b = Buffer.from(str, "utf8"); return _capString(Buffer.concat([_head(3, b.length, "build.textString"), b]), "build.textString"); },
+  array: function (items) {
+    if (!Array.isArray(items)) throw new CborError("cbor/bad-argument", "build.array: expected an array of pre-encoded items");
+    var parts = items.map(function (x, i) { return _cbItem(x, "build.array[" + i + "]"); });
+    return _assertDecodes(Buffer.concat([_head(4, items.length, "build.array")].concat(parts)), "build.array");
+  },
+  map: function (pairs) {
+    if (!Array.isArray(pairs)) throw new CborError("cbor/bad-argument", "build.map: expected an array of [key, value] pairs");
+    var enc = pairs.map(function (p, i) { if (!Array.isArray(p) || p.length !== 2) throw new CborError("cbor/bad-argument", "build.map[" + i + "]: each entry is a [key, value] pair"); return [_cbItem(p[0], "build.map key"), _cbItem(p[1], "build.map value")]; });
+    // RFC 8949 sec. 4.2.1 Core Deterministic: keys sorted in the BYTEWISE lexicographic order of their
+    // encodings -- NOT the length-first order of sec. 4.2.3 (the older RFC 7049 "Canonical CBOR" variant).
+    // This MUST match the decoder, which enforces bytewise order (_profile "deterministic" -> Buffer.compare
+    // at :70); a length-first sort here would emit a map the strict decoder then rejects as unsorted.
+    enc.sort(function (a, b) { return Buffer.compare(a[0], b[0]); });
+    for (var i = 1; i < enc.length; i++) { if (Buffer.compare(enc[i - 1][0], enc[i][0]) === 0) throw new CborError("cbor/duplicate-map-key", "build.map: duplicate map key"); }
+    var flat = [_head(5, pairs.length, "build.map")];
+    enc.forEach(function (p) { flat.push(p[0], p[1]); });
+    return _assertDecodes(Buffer.concat(flat), "build.map");
+  },
+  tag: function (tagNum, inner) { return _assertDecodes(Buffer.concat([_head(6, tagNum, "build.tag"), _cbItem(inner, "build.tag content")]), "build.tag"); },
+  boolean: function (v) { return Buffer.from([v ? 0xf5 : 0xf4]); },
+  nullValue: function () { return Buffer.from([0xf6]); },
+  raw: function (buf) { return _assertDecodes(_asBuffer(buf, "build.raw"), "build.raw"); },
+  // Tagged leaves -- the inverse of read.biguint / read.time / read.oid.
+  biguint: function (n) {
+    var a = typeof n === "bigint" ? n : BigInt(n);
+    if (a < 0n) throw new CborError("cbor/bad-argument", "build.biguint: value must be non-negative");
+    var hex = a.toString(16); if (hex.length % 2) hex = "0" + hex;
+    var mag = a === 0n ? Buffer.alloc(0) : Buffer.from(hex, "hex");
+    if (mag.length <= 8) throw new CborError("cbor/bad-argument", "build.biguint: a value that fits 8 bytes must use build.uint (RFC 8949 preferred serialization)");
+    // Mirror read.biguint's cap so the tagged bignum builder never emits a value the strict reader rejects.
+    if (mag.length > constants.LIMITS.CBOR_MAX_BIGUINT_BYTES) throw new CborError("cbor/biguint-too-large", "build.biguint: " + mag.length + " bytes exceeds cap " + constants.LIMITS.CBOR_MAX_BIGUINT_BYTES);
+    return build.tag(2, build.byteString(mag));
+  },
+  time: function (v) {
+    var ms;
+    if (v instanceof Date) {
+      ms = v.getTime();
+      if (Number.isNaN(ms)) throw new CborError("cbor/bad-time", "build.time: an Invalid Date has no epoch value");
+      // read.time reads only an integer (second-granularity) tag-1, so a sub-second Date cannot round-trip:
+      // reject it rather than silently truncate the milliseconds.
+      if (ms % 1000 !== 0) throw new CborError("cbor/bad-time", "build.time: a Date with sub-second precision cannot be a second-granularity CBOR epoch; round to whole seconds");
+    }
+    var secs = v instanceof Date ? BigInt(Math.floor(ms / 1000)) : (typeof v === "bigint" ? v : BigInt(v));
+    // Mirror read.time's bound so build.time never emits a tag-1 the strict reader would reject as out of range.
+    if (secs < -_MAX_EPOCH_SECONDS || secs > _MAX_EPOCH_SECONDS) throw new CborError("cbor/bad-time", "build.time: epoch seconds " + secs + " are outside the representable Date range");
+    return build.tag(1, build.int(secs));
+  },
+  oid: function (dotted) { return build.tag(111, build.byteString(asn1.encodeOidContent(dotted))); },
+};
+
 module.exports = {
   decode: decode,
+  build: build,
   read: {
     uint:           readUint,
     nint:           readNint,

package/lib/cmp-build.js

@@ -0,0 +1,490 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+
+/**
+ * @module     pki.cmp
+ * @nav        Signing
+ * @title      Certificate management protocol messages
+ * @intro The RFC 9810 Certificate Management Protocol producing side. `pki.cmp.build` assembles a
+ *   `PKIMessage` -- a `PKIHeader` (sender / recipient / transaction metadata), a `PKIBody` carrying one
+ *   request or transaction (an `ir` / `cr` / `kur` certificate request via `pki.crmf.build`, a `p10cr`
+ *   PKCS#10 via `pki.csr.sign`, or a `certConf` / `pollReq` / `genm` / `rr`), and an optional
+ *   `PKIProtection` computed over the message. Protection is a signature under the sender key (any
+ *   registry algorithm) or a PBMAC1 shared-secret MAC. The emitted message round-trips through
+ *   `pki.schema.cmp.parse` and its protection verifies. Parsing lives at `pki.schema.cmp.parse`.
+ * @spec RFC 9810
+ * @card Build a CMP PKIMessage with signature or PBMAC1 protection.
+ */
+//
+// RFC 9810 Appendix A is DEFINITIONS EXPLICIT TAGS: every context tag in the PKIMessage envelope --
+// each PKIHeader [0..8] optional, every PKIBody [n] arm, protection [0], extraCerts [1] -- is an EXPLICIT
+// wrapper (asn1.build.explicit), the exact inverse of the RFC 4211 CRMF interior (IMPLICIT TAGS). The two
+// IMPLICIT islands are foreign imports produced wholesale by pki.crmf.build (the CertReqMessages /
+// CertTemplate interior) and embedded verbatim, never re-encoded here. Protection is computed over the
+// byte-exact DER of the virtual ProtectedPart ::= SEQUENCE { header, body }, built from the same header
+// and body TLVs placed in the envelope. The signature scheme resolves from the sender key through the
+// shared sign-scheme registry; the Name / GeneralName / SPKI encoders and the post-sign self-check are the
+// shared lib/pki-build primitives, bound to the cmp namespace.
+
+var asn1 = require("./asn1-der");
+var oid = require("./oid");
+var cmp = require("./schema-cmp");
+var crmf = require("./crmf-sign");
+var csr = require("./schema-csr");
+var x509 = require("./schema-x509");
+var signScheme = require("./sign-scheme");
+var pkix = require("./schema-pkix");
+var pkiBuild = require("./pki-build");
+var webcrypto = require("./webcrypto");
+var constants = require("./constants");
+var guard = require("./guard-all");
+var frameworkError = require("./framework-error");
+
+var CmpError = frameworkError.CmpError;
+var b = asn1.build;
+function _err(code, message, cause) { return new CmpError(code, message, cause); }
+function _signE(kind, message, cause) { return new CmpError("cmp/" + kind, message, cause); }
+function O(n) { return oid.byName(n); }
+
+var NS = pkix.makeNS("cmp", CmpError, oid);
+var EXT_DECODERS = pkix.certExtensionDecoders(NS).byOid;
+var _b = pkiBuild.makeBuilder({
+  ErrorClass: CmpError, prefix: "cmp", O: O, NS: NS,
+  NAME_SCHEMA: pkix.name(NS), SPKI_SCHEMA: pkix.spki(NS), EXT_DECODERS: EXT_DECODERS,
+});
+
+var KNOWN_HEADER_KEYS = {
+  sender: 1, recipient: 1, pvno: 1, messageTime: 1, senderKID: 1, recipKID: 1,
+  transactionID: 1, senderNonce: 1, recipNonce: 1, freeText: 1, generalInfo: 1,
+};
+var KNOWN_BODY_KEYS = { ir: 1, cr: 1, kur: 1, p10cr: 1, certConf: 1, pollReq: 1, genm: 1, rr: 1 };
+// The PKIBody arm -> its EXPLICIT context tag number (schema-cmp.js BODY_ARMS). rr is [11], NOT [15].
+var BODY_TAG = { ir: 0, cr: 2, p10cr: 4, kur: 7, rr: 11, genm: 21, certConf: 24, pollReq: 25 };
+var CRMF_BODY = { ir: 1, cr: 1, kur: 1 };   // arms whose content is a CertReqMessages via pki.crmf.build
+var KNOWN_OPTS_KEYS = { key: 1, cert: 1, mac: 1, extraCerts: 1, pem: 1, pss: 1, digestAlgorithm: 1 };
+var KNOWN_MAC_KEYS = { secret: 1, salt: 1, iterationCount: 1, prf: 1, keyLength: 1, algorithm: 1 };
+
+var PBMAC1_DEFAULT_ITER = 100000;
+var PBMAC1_DEFAULT_SALT_BYTES = 16;
+var PBMAC1_DEFAULT_KEYLEN = 32;   // bytes -- HMAC-SHA256 key
+var PBMAC1_MAX_KEYLEN = 1024;     // bytes -- an HMAC key beyond a hash block is pointless; bound the work
+var PBMAC1_MIN_ITER = 1000;       // RFC 8018 sec. 4.2 recommended minimum -- reject a trivially weak count
+var PBMAC1_PRF = { "SHA-256": "hmacWithSHA256", "SHA-384": "hmacWithSHA384", "SHA-512": "hmacWithSHA512" };
+var PBMAC1_MAC_OID = { "SHA-256": "hmacWithSHA256", "SHA-384": "hmacWithSHA384", "SHA-512": "hmacWithSHA512" };
+// PKIFailureInfo named bits (RFC 9810 sec. 5.2.3), position = bit index -- mirrors schema-cmp's decode list;
+// the build -> parse round-trip cross-checks the positions against the parser.
+var FAIL_INFO_NAMES = ["badAlg", "badMessageCheck", "badRequest", "badTime", "badCertId", "badDataFormat",
+  "wrongAuthority", "incorrectData", "missingTimeStamp", "badPOP", "certRevoked", "certConfirmed",
+  "wrongIntegrity", "badRecipientNonce", "timeNotAvailable", "unacceptedPolicy", "unacceptedExtension",
+  "addInfoNotAvailable", "badSenderNonce", "badCertTemplate", "signerNotTrusted", "transactionIdInUse",
+  "unsupportedVersion", "notAuthorized", "systemUnavail", "systemFailure", "duplicateCertReq"];
+var FAIL_INFO_INDEX = {};
+FAIL_INFO_NAMES.forEach(function (n, i) { FAIL_INFO_INDEX[n] = i; });
+// CertStatus.hashAlg names the hash used to compute certHash -- restrict it to hash algorithms, not any OID.
+var CERT_CONF_HASH_ALGS = { sha1: 1, sha256: 1, sha384: 1, sha512: 1, "sha3-256": 1, "sha3-512": 1 };
+
+// ---- small shared encoders (byte-exact inverses of schema-cmp.js readers) ----
+
+function _reqOctets(v, what) {
+  var buf = _b.reqDer(v, what);
+  return b.octetString(buf);
+}
+
+// PKIFreeText ::= SEQUENCE SIZE (1..MAX) OF UTF8String -- non-empty, every element UTF8String.
+function _encodePkiFreeText(strings, code, what) {
+  if (!Array.isArray(strings) || !strings.length) throw _err(code, what + " must be a non-empty array of strings");
+  return b.sequence(strings.map(function (s) {
+    if (typeof s !== "string") throw _err(code, what + " entries must be strings");
+    return b.utf8(s);
+  }));
+}
+
+// A recognized fixed-syntax id-it value (RFC 9810 sec. 5.1.1.1/.2/.4): implicitConfirm -> NULL,
+// confirmWaitTime -> GeneralizedTime, certProfile -> non-empty SEQUENCE OF UTF8String. An unknown id-it
+// carries a pre-encoded infoValue DER (or none).
+function _encodeInfoValue(itav) {
+  var name = itav.infoType;
+  if (name === "implicitConfirm") {
+    if (itav.infoValue != null) throw _err("cmp/bad-info-value", "implicitConfirm carries a NULL infoValue");
+    return b.nullValue();
+  }
+  if (name === "confirmWaitTime") {
+    guard.time.assertValid(itav.infoValue, _err, "cmp/bad-info-value", "confirmWaitTime infoValue");   // reject a non-Date / Invalid Date
+    return b.generalizedTime(itav.infoValue);
+  }
+  if (name === "certProfile") {
+    return _encodePkiFreeText(itav.infoValue, "cmp/bad-info-value", "certProfile");
+  }
+  if (itav.infoValue == null) return null;
+  return b.raw(_b.reqDer(itav.infoValue, "infoValue (a pre-encoded DER value)"));
+}
+
+// InfoTypeAndValue ::= SEQUENCE { infoType OID, infoValue ANY DEFINED BY infoType OPTIONAL }.
+function _encodeInfoTypeAndValue(itav) {
+  if (!itav || typeof itav !== "object" || Buffer.isBuffer(itav)) throw _err("cmp/bad-info-value", "an InfoTypeAndValue must be an object { infoType, infoValue? }");
+  if (typeof itav.infoType !== "string" || O(itav.infoType) == null) throw _err("cmp/bad-name", "unknown infoType " + JSON.stringify(itav.infoType));
+  var children = [b.oid(O(itav.infoType))];
+  var val = _encodeInfoValue(itav);
+  if (val != null) children.push(val);
+  return b.sequence(children);
+}
+
+// generalInfo [8] / genm content: SEQUENCE SIZE (1..MAX) OF InfoTypeAndValue.
+function _encodeGeneralInfo(itavs, code, what) {
+  if (!Array.isArray(itavs) || !itavs.length) throw _err(code, what + " must be a non-empty array of InfoTypeAndValue");
+  return b.sequence(itavs.map(_encodeInfoTypeAndValue));
+}
+
+// ---- PKIHeader ----
+
+// An AlgorithmIdentifier { algorithm OID, parameters ANY OPTIONAL } for a bare/absent-params digest.
+function _algIdNoParams(name) { return b.sequence([b.oid(O(name))]); }
+// An HMAC AlgorithmIdentifier carries NULL parameters (RFC 8018 App. B.1.1 / RFC 4231), unlike a bare SHA-2
+// digest algId (ABSENT parameters, RFC 5754 sec. 2). Used for the PBMAC1 prf + messageAuthScheme.
+function _hmacAlgId(name) { return b.sequence([b.oid(O(name)), b.nullValue()]); }
+
+// PKIHeader ::= SEQUENCE { pvno INTEGER, sender GeneralName, recipient GeneralName, EXPLICIT [0..8] }.
+// protectionAlgDer is the DERIVED AlgorithmIdentifier ([1]), present iff the message is protected. Returns
+// the exact headerTLV, built ONCE and reused in both the envelope and the ProtectedPart (RFC 9810 5.1.3).
+function _encodeHeader(headerSpec, protectionAlgDer, pvno) {
+  if (!headerSpec || typeof headerSpec !== "object" || Buffer.isBuffer(headerSpec)) throw _err("cmp/bad-input", "message.header must be an object");
+  Object.keys(headerSpec).forEach(function (k) { if (!KNOWN_HEADER_KEYS[k]) throw _err("cmp/bad-input", "unknown header field " + JSON.stringify(k)); });
+  if (headerSpec.sender == null) throw _err("cmp/bad-input", "message.header.sender is required (GeneralName)");
+  if (headerSpec.recipient == null) throw _err("cmp/bad-input", "message.header.recipient is required (GeneralName)");
+
+  var children = [
+    b.integer(BigInt(pvno)),
+    _b.encodeGeneralName(headerSpec.sender),
+    _b.encodeGeneralName(headerSpec.recipient),
+  ];
+  // EXPLICIT [0..8] optionals, ascending, at most once each.
+  if (headerSpec.messageTime != null) {
+    guard.time.assertValid(headerSpec.messageTime, _err, "cmp/bad-input", "header.messageTime");   // reject a non-Date / Invalid Date
+    children.push(b.explicit(0, b.generalizedTime(headerSpec.messageTime)));   // GeneralizedTime ONLY (never UTCTime)
+  }
+  if (protectionAlgDer != null) children.push(b.explicit(1, b.raw(protectionAlgDer)));
+  if (headerSpec.senderKID != null) children.push(b.explicit(2, _reqOctets(headerSpec.senderKID, "header.senderKID")));
+  if (headerSpec.recipKID != null) children.push(b.explicit(3, _reqOctets(headerSpec.recipKID, "header.recipKID")));
+  if (headerSpec.transactionID != null) children.push(b.explicit(4, _reqOctets(headerSpec.transactionID, "header.transactionID")));
+  if (headerSpec.senderNonce != null) children.push(b.explicit(5, _reqOctets(headerSpec.senderNonce, "header.senderNonce")));
+  if (headerSpec.recipNonce != null) children.push(b.explicit(6, _reqOctets(headerSpec.recipNonce, "header.recipNonce")));
+  if (headerSpec.freeText != null) children.push(b.explicit(7, _encodePkiFreeText(headerSpec.freeText, "cmp/bad-freetext", "header.freeText")));
+  if (headerSpec.generalInfo != null) children.push(b.explicit(8, _encodeGeneralInfo(headerSpec.generalInfo, "cmp/bad-general-info", "header.generalInfo")));
+  return b.sequence(children);
+}
+
+// ---- PKIBody arm content encoders ----
+
+// A certReqId is an UNBOUNDED INTEGER (RFC 9483 -1 sentinel, no upper bound): accept a safe-integer number
+// or a bigint (a large value beyond 2^53), reject a non-integer / other type. Returns a BigInt for b.integer.
+function _reqIdInt(v, code, what) {
+  if (typeof v === "bigint") return v;
+  // Number.isSafeInteger (not isInteger): a value above 2^53 is imprecise as a Number, so it MUST be a bigint.
+  if (typeof v === "number" && Number.isSafeInteger(v)) return BigInt(v);
+  throw _err(code, what + " must be an integer (a safe-integer number, or a bigint for a large value)");
+}
+
+// PKIFailureInfo ::= BIT STRING (named bits, RFC 9810 sec. 5.2.3) -- a minimal NamedBitList from bit names.
+function _encodeFailInfo(names) {
+  if (!Array.isArray(names)) throw _err("cmp/bad-cert-status", "statusInfo.failInfo must be an array of PKIFailureInfo bit names");
+  return b.namedBitString(names.map(function (n) {
+    if (typeof n !== "string" || FAIL_INFO_INDEX[n] === undefined) throw _err("cmp/bad-cert-status", "unknown PKIFailureInfo bit " + JSON.stringify(n));
+    return FAIL_INFO_INDEX[n];
+  }));
+}
+
+// PKIStatusInfo ::= SEQUENCE { status PKIStatus INTEGER, statusString PKIFreeText OPTIONAL, failInfo BIT STRING OPTIONAL }.
+function _encodePkiStatusInfo(si) {
+  if (typeof si.status !== "number" || !Number.isInteger(si.status)) throw _err("cmp/bad-cert-status", "statusInfo.status must be a PKIStatus integer");
+  var children = [b.integer(BigInt(si.status))];
+  if (si.statusString != null) children.push(_encodePkiFreeText(si.statusString, "cmp/bad-cert-status", "statusInfo.statusString"));
+  if (si.failInfo != null) children.push(_encodeFailInfo(si.failInfo));   // strict order: status -> statusString -> failInfo (both optionals untagged)
+  return b.sequence(children);
+}
+
+// CertStatus ::= SEQUENCE { certHash OCTET STRING, certReqId INTEGER, statusInfo PKIStatusInfo OPTIONAL,
+//   hashAlg [0] EXPLICIT AlgorithmIdentifier OPTIONAL }. hashAlg present => cmp2021 (pvno bump).
+function _encodeCertStatus(cs, state) {
+  if (!cs || typeof cs !== "object" || Buffer.isBuffer(cs)) throw _err("cmp/bad-cert-status", "each CertStatus must be an object");
+  var children = [
+    _reqOctets(cs.certHash, "certConf certHash"),
+    b.integer(_reqIdInt(cs.certReqId, "cmp/bad-cert-status", "CertStatus certReqId")),   // signed, -1 legal, unbounded
+  ];
+  if (cs.statusInfo != null) children.push(_encodePkiStatusInfo(cs.statusInfo));
+  if (cs.hashAlg != null) {
+    if (typeof cs.hashAlg !== "string" || !CERT_CONF_HASH_ALGS[cs.hashAlg]) throw _err("cmp/bad-name", "certConf hashAlg must be a hash algorithm (sha256 / sha384 / sha512 / sha3-256 / sha3-512 / sha1); got " + JSON.stringify(cs.hashAlg));
+    children.push(b.explicit(0, _algIdNoParams(cs.hashAlg)));
+    state.usesCmp2021 = true;
+  }
+  return b.sequence(children);
+}
+
+// CertConfirmContent ::= SEQUENCE OF CertStatus (empty legal, no SIZE floor).
+function _encodeCertConfirmContent(list, state) {
+  if (!Array.isArray(list)) throw _err("cmp/bad-cert-status", "certConf must be an array of CertStatus");
+  return b.sequence(list.map(function (cs) { return _encodeCertStatus(cs, state); }));
+}
+
+// PollReqContent ::= SEQUENCE OF SEQUENCE { certReqId INTEGER } (-1 legal).
+function _encodePollReqContent(list) {
+  if (!Array.isArray(list)) throw _err("cmp/bad-poll-req", "pollReq must be an array of { certReqId }");
+  return b.sequence(list.map(function (pr) {
+    if (!pr || typeof pr !== "object" || Buffer.isBuffer(pr)) throw _err("cmp/bad-poll-req", "each pollReq entry must be { certReqId: <integer> }");
+    return b.sequence([b.integer(_reqIdInt(pr.certReqId, "cmp/bad-poll-req", "pollReq certReqId"))]);
+  }));
+}
+
+// GenMsgContent ::= SEQUENCE OF InfoTypeAndValue (empty legal).
+function _encodeGenMsgContent(list) {
+  if (!Array.isArray(list)) throw _err("cmp/bad-info-type-and-value", "genm must be an array of InfoTypeAndValue");
+  return b.sequence(list.map(_encodeInfoTypeAndValue));
+}
+
+// RevReqContent ::= SEQUENCE OF RevDetails { certDetails CertTemplate, crlEntryDetails Extensions OPTIONAL }.
+function _encodeRevDetails(rd) {
+  if (!rd || typeof rd !== "object" || Buffer.isBuffer(rd)) throw _err("cmp/bad-rev-req", "each RevDetails must be an object { certDetails, crlEntryDetails? }");
+  if (rd.certDetails == null) throw _err("cmp/bad-rev-req", "RevDetails.certDetails (a CertTemplate) is required");
+  var certDetails;
+  if (Buffer.isBuffer(rd.certDetails) || rd.certDetails instanceof Uint8Array) {
+    certDetails = b.raw(_b.reqDer(rd.certDetails, "RevDetails.certDetails (a pre-encoded CertTemplate DER)"));
+  } else {
+    // A revocation must identify the certificate to revoke by issuer + serialNumber (RFC 9810 App. D sec.
+    // 5.3.2); the pre-encoded-CertTemplate hatch above is the escape for an advanced identification.
+    if (rd.certDetails.issuer == null || rd.certDetails.serialNumber == null) throw _err("cmp/bad-rev-req", "a revocation certDetails must identify the certificate by issuer and serialNumber");
+    certDetails = b.raw(crmf.buildCertTemplate(rd.certDetails));
+  }
+  var children = [certDetails];
+  if (rd.crlEntryDetails != null) children.push(b.raw(_b.reqDer(rd.crlEntryDetails, "RevDetails.crlEntryDetails (a pre-encoded Extensions DER)")));
+  return b.sequence(children);
+}
+
+function _encodeRevReqContent(list) {
+  if (!Array.isArray(list) || !list.length) throw _err("cmp/bad-rev-req", "rr must be a non-empty array of RevDetails");
+  return b.sequence(list.map(_encodeRevDetails));
+}
+
+// Dispatch the single-key body object to its EXPLICIT-tagged arm. Returns { bodyTLV, usesCmp2021 }.
+function _encodeBody(bodySpec, key, opts) {
+  if (!bodySpec || typeof bodySpec !== "object" || Buffer.isBuffer(bodySpec)) throw _err("cmp/bad-input", "message.body must be a single-key object");
+  var keys = Object.keys(bodySpec);
+  if (keys.length !== 1) throw _err("cmp/bad-input", "message.body must have exactly one arm, got " + keys.length);
+  var arm = keys[0];
+  if (!KNOWN_BODY_KEYS[arm]) throw _err("cmp/bad-input", "unknown body arm " + JSON.stringify(arm));
+  var tag = BODY_TAG[arm], state = { usesCmp2021: false };
+
+  if (CRMF_BODY[arm]) {
+    // The CRMF proof of possession is signed with the REQUESTED key's private half, which is distinct from
+    // the message-protection key. Take it from a `key` field on the request spec; default to the protection
+    // key only for a self-request (the client certifying the very key it protects with).
+    var reqSpec = bodySpec[arm], popKey = key;
+    if (reqSpec && typeof reqSpec === "object" && !Buffer.isBuffer(reqSpec) && "key" in reqSpec) {
+      popKey = reqSpec.key;
+      reqSpec = Object.assign({}, reqSpec);
+      delete reqSpec.key;
+    }
+    return crmf.build(reqSpec, popKey, {}).then(function (crmfDer) {
+      return { bodyTLV: b.explicit(tag, b.raw(crmfDer)), usesCmp2021: false };
+    });
+  }
+  var inner;
+  if (arm === "p10cr") {
+    var csrDer = _b.reqDer(bodySpec.p10cr, "p10cr (a CertificationRequest DER)");
+    try { csr.parse(csrDer); }   // validate the embedded PKCS#10 via the real parser (fail-closed on a non-CSR)
+    catch (e) { if (e instanceof CmpError) throw e; throw _err("cmp/bad-input", "p10cr is not a valid PKCS#10 CertificationRequest", e); }
+    inner = b.raw(csrDer);
+  } else if (arm === "certConf") {
+    inner = _encodeCertConfirmContent(bodySpec.certConf, state);
+  } else if (arm === "pollReq") {
+    inner = _encodePollReqContent(bodySpec.pollReq);
+  } else if (arm === "genm") {
+    inner = _encodeGenMsgContent(bodySpec.genm);
+  } else {   // rr
+    inner = _encodeRevReqContent(bodySpec.rr);
+  }
+  return Promise.resolve({ bodyTLV: b.explicit(tag, inner), usesCmp2021: state.usesCmp2021 });
+}
+
+// ---- protection ----
+
+// PBMAC1 protectionAlg: id-PBMAC1 with PBMAC1-params { keyDerivationFunc PBKDF2{salt,iter,keyLength,prf},
+// messageAuthScheme HMAC } -- the byte-exact inverse of schema-pkcs12.js PBMAC1_PARAMS / PBKDF2_PARAMS.
+function _encodePbmac1AlgId(pd) {
+  var pbkdf2Params = [b.octetString(pd.salt), b.integer(BigInt(pd.iterationCount)), b.integer(BigInt(pd.keyLength))];
+  // prf: omit iff the DEFAULT algid-hmacWithSHA1; else the prf AlgorithmIdentifier with ABSENT params.
+  // nosemgrep: pki-non-constant-time-secret-compare -- prfName is a PRF algorithm name, not a secret
+  if (pd.prfName !== "hmacWithSHA1") pbkdf2Params.push(_hmacAlgId(pd.prfName));
+  var pbkdf2AlgId = b.sequence([b.oid(O("pbkdf2")), b.sequence(pbkdf2Params)]);
+  var pbmac1Params = b.sequence([pbkdf2AlgId, _hmacAlgId(pd.macName)]);
+  return b.sequence([b.oid(O("pbmac1")), pbmac1Params]);
+}
+
+// Resolve the protection selector to { protectionAlgDer, computeBits(protectedPartDer)->Promise<Buffer> },
+// senderSpki, senderScheme } BEFORE the header is built (protectionAlg is opts-derived, not header-derived).
+function _resolveProtection(opts) {
+  var hasSig = opts.key != null || opts.cert != null;
+  var hasMac = opts.mac != null;
+  if (hasSig && hasMac) throw _err("cmp/bad-input", "supply exactly one of { key, cert } (signature) or { mac } (PBMAC1), not both");
+  if (!hasSig && !hasMac) throw _err("cmp/bad-input", "a PKIMessage requires protection: supply { key, cert } for a signature or { mac } for PBMAC1");
+
+  if (hasSig) {
+    if (opts.key == null || opts.cert == null) throw _err("cmp/bad-input", "signature protection requires both opts.key (the private key) and opts.cert (the signer certificate)");
+    var certDer = _b.reqDer(opts.cert, "opts.cert (the signer certificate DER)");
+    var senderSpki;
+    try { senderSpki = x509.parse(certDer).subjectPublicKeyInfo.bytes; }
+    catch (e) { throw _err("cmp/bad-input", "opts.cert is not a valid X.509 certificate", e); }
+    _b.assertValidSpki(senderSpki, "the sender certificate SPKI");
+    var scheme = signScheme.resolveSignScheme(_b.certLikeFromSpki(senderSpki), { combinedRsaSig: true, pss: opts.pss, digestAlgorithm: opts.digestAlgorithm }, true, _signE);
+    return {
+      protectionAlgDer: scheme.sigAlgId,
+      certDer: certDer,
+      computeBits: function (protectedPartDer) {
+        return Promise.resolve(signScheme.signOverTbs(scheme, opts.key, protectedPartDer, _signE)).then(function (sig) {
+          return Promise.resolve(_b.assertSignatureVerifies(protectedPartDer, sig, senderSpki, scheme)).then(function () {
+            return b.bitString(sig, 0);
+          });
+        });
+      },
+    };
+  }
+
+  // PBMAC1
+  var m = opts.mac;
+  if (!m || typeof m !== "object" || Buffer.isBuffer(m)) throw _err("cmp/bad-input", "opts.mac must be an object { secret, salt?, iterationCount?, prf?, keyLength? }");
+  Object.keys(m).forEach(function (k) { if (!KNOWN_MAC_KEYS[k]) throw _err("cmp/bad-input", "unknown opts.mac field " + JSON.stringify(k)); });
+  if (m.algorithm != null && m.algorithm !== "pbmac1") throw _err("cmp/unsupported-algorithm", "opts.mac.algorithm " + JSON.stringify(m.algorithm) + " is not supported (v1 ships pbmac1; passwordBasedMac is deferred)");
+  var secret = m.secret;
+  if (typeof secret !== "string" || !secret) {
+    if (!Buffer.isBuffer(secret) || !secret.length) throw _err("cmp/bad-input", "opts.mac.secret must be a non-empty string or Buffer");
+  }
+  var secretBuf = Buffer.isBuffer(secret) ? secret : Buffer.from(secret, "utf8");
+  var prf = m.prf || "SHA-256";
+  if (!PBMAC1_PRF[prf]) throw _err("cmp/bad-input", "opts.mac.prf must be SHA-256 / SHA-384 / SHA-512");
+  var iterationCount = m.iterationCount != null ? m.iterationCount : PBMAC1_DEFAULT_ITER;
+  if (typeof iterationCount !== "number" || !Number.isInteger(iterationCount) || iterationCount < PBMAC1_MIN_ITER) throw _err("cmp/bad-input", "opts.mac.iterationCount must be at least " + PBMAC1_MIN_ITER + " (RFC 8018 sec. 4.2)");
+  // Bound the PBKDF2 work factors BEFORE deriving -- a huge iterationCount / keyLength is self-inflicted work.
+  if (iterationCount > constants.LIMITS.PBKDF2_MAX_ITERATIONS) throw _err("cmp/bad-input", "opts.mac.iterationCount exceeds the PBKDF2 work-factor cap " + constants.LIMITS.PBKDF2_MAX_ITERATIONS);
+  var keyLength = m.keyLength != null ? m.keyLength : PBMAC1_DEFAULT_KEYLEN;
+  if (typeof keyLength !== "number" || !Number.isInteger(keyLength) || keyLength < 1) throw _err("cmp/bad-input", "opts.mac.keyLength must be a positive integer (bytes)");
+  if (keyLength > PBMAC1_MAX_KEYLEN) throw _err("cmp/bad-input", "opts.mac.keyLength exceeds the cap " + PBMAC1_MAX_KEYLEN + " bytes");
+  var salt = m.salt != null ? _b.reqDer(m.salt, "opts.mac.salt") : Buffer.from(webcrypto.webcrypto.getRandomValues(new Uint8Array(PBMAC1_DEFAULT_SALT_BYTES)));
+  if (salt.length > constants.LIMITS.PBKDF2_MAX_SALT) throw _err("cmp/bad-input", "opts.mac.salt exceeds " + constants.LIMITS.PBKDF2_MAX_SALT + " bytes");
+  var macDesc = { salt: salt, iterationCount: iterationCount, keyLength: keyLength, prfName: PBMAC1_PRF[prf], macName: PBMAC1_MAC_OID[prf] };
+
+  return {
+    protectionAlgDer: _encodePbmac1AlgId(macDesc),
+    certDer: null,
+    computeBits: function (protectedPartDer) {
+      return _pbmac1(secretBuf, salt, iterationCount, keyLength, prf, protectedPartDer).then(function (mac) {
+        return b.bitString(mac, 0);
+      });
+    },
+  };
+}
+
+// PBKDF2-derive an HMAC key from the shared secret, then HMAC the ProtectedPart (both via the engine).
+function _pbmac1(secretBuf, salt, iterationCount, keyLength, prf, message) {
+  var subtle = webcrypto.webcrypto.subtle;
+  return subtle.importKey("raw", secretBuf, { name: "PBKDF2" }, false, ["deriveBits"]).then(function (baseKey) {
+    return subtle.deriveBits({ name: "PBKDF2", salt: salt, iterations: iterationCount, hash: prf }, baseKey, keyLength * 8);
+  }).then(function (bits) {
+    return subtle.importKey("raw", Buffer.from(bits), { name: "HMAC", hash: prf }, false, ["sign"]).then(function (hmacKey) {
+      return subtle.sign({ name: "HMAC" }, hmacKey, message);
+    });
+  }).then(function (sig) { return Buffer.from(sig); });
+}
+
+// ---- orchestrator ----
+
+function build(message, opts) {
+  return Promise.resolve().then(function () { return _build(message, opts); });
+}
+
+function _build(message, opts) {
+  opts = opts || {};
+  if (!message || typeof message !== "object" || Buffer.isBuffer(message)) throw _err("cmp/bad-input", "the PKIMessage spec must be an object { header, body }");
+  Object.keys(message).forEach(function (k) { if (k !== "header" && k !== "body") throw _err("cmp/bad-input", "unknown message field " + JSON.stringify(k) + " (a message carries only header + body)"); });
+  Object.keys(opts).forEach(function (k) { if (!KNOWN_OPTS_KEYS[k]) throw _err("cmp/bad-input", "unknown opts field " + JSON.stringify(k)); });
+  if (message.header == null) throw _err("cmp/bad-input", "message.header is required");
+  if (message.body == null) throw _err("cmp/bad-input", "message.body is required");
+
+  var prot = _resolveProtection(opts);
+  var senderKey = opts.key;
+
+  return Promise.resolve(_encodeBody(message.body, senderKey, opts)).then(function (bodyResult) {
+    var bodyTLV = bodyResult.bodyTLV;
+    var pvno = message.header.pvno != null ? message.header.pvno : 2;
+    if (typeof pvno !== "number" || !Number.isInteger(pvno)) throw _err("cmp/bad-input", "header.pvno must be an integer");
+    if (bodyResult.usesCmp2021 && pvno < 3) pvno = 3;   // a certConf hashAlg forces cmp2021(3)
+
+    var headerTLV = _encodeHeader(message.header, prot.protectionAlgDer, pvno);   // built ONCE
+    var protectedPartDer = b.sequence([headerTLV, bodyTLV]);   // virtual ProtectedPart ::= SEQUENCE { header, body }
+
+    return prot.computeBits(protectedPartDer).then(function (protectionBits) {
+      var msgChildren = [headerTLV, bodyTLV, b.explicit(0, protectionBits)];   // reuse the SAME header/body TLVs
+      var extraCertsDers = _collectExtraCerts(opts, prot.certDer);
+      if (extraCertsDers.length) msgChildren.push(b.explicit(1, b.sequence(extraCertsDers)));
+      var der = b.sequence(msgChildren);
+
+      cmp.parse(der);   // round-trip re-validation: the emitted message MUST parse (protection<=>protectionAlg, pvno, freeText, etc.)
+      if (opts.pem != null) {
+        if (opts.pem === true) return cmp.pemEncode(der, "CMP");
+        if (typeof opts.pem !== "string" || !opts.pem) throw _err("cmp/bad-input", "opts.pem must be true or a non-empty PEM label string");
+        return cmp.pemEncode(der, opts.pem);
+      }
+      return der;
+    });
+  });
+}
+
+function _collectExtraCerts(opts, protCertDer) {
+  var out = [];
+  if (protCertDer != null) out.push(b.raw(protCertDer));
+  if (opts.extraCerts != null) {
+    if (!Array.isArray(opts.extraCerts)) throw _err("cmp/bad-extra-certs", "opts.extraCerts must be an array of certificate DERs");
+    opts.extraCerts.forEach(function (c) {
+      var der = _b.reqDer(c, "extraCerts entry (a Certificate DER)");
+      try { x509.parse(der); }   // each extraCerts entry MUST be a valid X.509 certificate (RFC 9810 sec. 5.1)
+      catch (e) { if (e instanceof CmpError) throw e; throw _err("cmp/bad-extra-certs", "an extraCerts entry is not a valid X.509 certificate", e); }
+      out.push(b.raw(der));
+    });
+  }
+  return out;
+}
+
+/**
+ * @primitive  pki.cmp.build
+ * @signature  pki.cmp.build(message, opts?) -> Promise<Buffer|string>
+ * @since      0.3.5
+ * @status     experimental
+ * @spec       RFC 9810, RFC 9481, RFC 9579
+ * @related    pki.schema.cmp.parse
+ *
+ * Build an RFC 9810 CMP `PKIMessage` -- the producing-side inverse of `pki.schema.cmp.parse`. `message` is
+ * `{ header, body }`: `header` carries the `sender` / `recipient` GeneralNames plus optional transaction
+ * metadata (`transactionID`, `senderNonce`, `messageTime`, `freeText`, `generalInfo`, ...); `body` is a
+ * single-key object naming the request or transaction arm -- `{ ir }` / `{ cr }` / `{ kur }` (a
+ * `CertReqMessages` spec delegated to `pki.crmf.build`), `{ p10cr }` (a PKCS#10 CertificationRequest DER),
+ * `{ certConf }`, `{ pollReq }`, `{ genm }`, or `{ rr }`. The message is protected: `opts` carries EXACTLY
+ * ONE of `{ key, cert }` (a signature under the sender key over the message -- any registry algorithm, RSA
+ * / ECDSA / EdDSA / ML-DSA / SLH-DSA / composite, resolved from the certificate) or `{ mac }` (a PBMAC1
+ * shared-secret MAC). The protection is computed over the exact DER of the virtual
+ * `ProtectedPart ::= SEQUENCE { header, body }` and self-verified before the message is returned. The
+ * emitted PKIMessage round-trips byte-identically through `pki.schema.cmp.parse`.
+ *
+ * @opts
+ *   - `key` (Buffer|CryptoKey) + `cert` (Buffer) -- signature protection under the sender key; `cert` is
+ *     the signer certificate (its SPKI resolves the algorithm) and is placed in `extraCerts`.
+ *   - `mac` ({ secret, salt?, iterationCount?, prf?, keyLength? }) -- PBMAC1 protection from a shared secret.
+ *   - `extraCerts` (array of Buffer) -- additional certificates to carry in `extraCerts [1]`.
+ *   - `pem` (boolean|string) -- return a PEM `CMP` block instead of DER.
+ *   - `pss` (boolean) / `digestAlgorithm` (string) -- signature-protection algorithm options.
+ *
+ * @example
+ *   var der = await pki.cmp.build(
+ *     { header: { sender: { directoryName: "CN=client" }, recipient: { directoryName: "CN=CA" } },
+ *       body: { p10cr: csrDer } },
+ *     { key: signerKeyPkcs8, cert: signerCertDer });
+ *   pki.schema.cmp.parse(der).body.arm;   // "p10cr"
+ */
+module.exports = { build: build };

package/lib/crmf-sign.js

@@ -47,6 +47,7 @@ var _b = pkiBuild.makeBuilder({
 
 var KNOWN_SPEC_KEYS = { certReqId: 1, certTemplate: 1, controls: 1, regInfo: 1, pop: 1 };
 var KNOWN_TEMPLATE_KEYS = { version: 1, subject: 1, publicKey: 1, validity: 1, extensions: 1, issuer: 1 };
+var REVOCATION_TEMPLATE_KEYS = { version: 1, subject: 1, publicKey: 1, validity: 1, extensions: 1, issuer: 1, serialNumber: 1 };
 // The controls (RFC 4211 sec. 6) and regInfo (sec. 7) are DISJOINT AttributeTypeAndValue namespaces --
 // regToken/authenticator/oldCertID/protocolEncrKey are controls; utf8Pairs is regInfo -- so the object
 // form validates each key against its own field's registry (a control name is not a valid regInfo, and
@@ -77,14 +78,18 @@ function _encodeOptionalValidity(validity) {
 // CertTemplate ::= SEQUENCE { [0..9] all IMPLICIT OPTIONAL }. A REQUEST omits serialNumber [1] / signingAlg
 // [2] / issuerUID [7] / subjectUID [8] (CA-assigned or deprecated, RFC 4211 sec. 5) -- the builder never
 // emits them. Fields are emitted in ascending tag order.
-function _encodeCertTemplate(tpl) {
+function _encodeCertTemplate(tpl, opts) {
   if (!tpl || typeof tpl !== "object" || Buffer.isBuffer(tpl)) throw _err("crmf/bad-cert-template", "certTemplate must be an object");
-  Object.keys(tpl).forEach(function (k) { if (!KNOWN_TEMPLATE_KEYS[k]) throw _err("crmf/bad-input", "unknown certTemplate field " + JSON.stringify(k)); });
+  // A REQUEST template omits serialNumber (CA-assigned, RFC 4211 sec. 5); a REVOCATION template (CMP rr,
+  // RFC 9810 sec. 5.3.9) carries serialNumber [1] to name the certificate to revoke -- allowed only then.
+  var allowed = (opts && opts.revocation) ? REVOCATION_TEMPLATE_KEYS : KNOWN_TEMPLATE_KEYS;
+  Object.keys(tpl).forEach(function (k) { if (!allowed[k]) throw _err("crmf/bad-input", "unknown certTemplate field " + JSON.stringify(k)); });
   var fields = [];
   if (tpl.version != null) {
     if (tpl.version !== 2) throw _err("crmf/bad-version", "certTemplate version MUST be 2 (v3) if supplied (RFC 4211 sec. 5)");
     fields.push(b.implicit(0, b.integer(2n)));                                  // version [0]
   }
+  if (tpl.serialNumber != null) fields.push(b.implicit(1, _b.serialInteger(tpl.serialNumber)));   // serialNumber [1] (revocation only)
   // issuer [3] / subject [5] are EXPLICIT: Name is a CHOICE, and X.680 sec. 31.2.7 forces a context tag on
   // a CHOICE to EXPLICIT even under the module's IMPLICIT TAGS default (the [3]/[5] wraps the RDNSequence
   // SEQUENCE, it does not replace its tag). The parser accepts both forms; this is the conformant one.
@@ -272,4 +277,24 @@ function _build(spec, key, opts) {
   });
 }
 
-module.exports = { build: build };
+/**
+ * @primitive  pki.crmf.buildCertTemplate
+ * @signature  pki.crmf.buildCertTemplate(template) -> Buffer
+ * @since      0.3.5
+ * @status     experimental
+ * @spec       RFC 4211
+ * @related    pki.crmf.build
+ *
+ * Encode a bare RFC 4211 `CertTemplate` (the requested-certificate fields -- `subject`, `publicKey`,
+ * `validity`, requested `extensions`, an optional `version` 2, `issuer`) to canonical DER. This is the
+ * `certTemplate` interior of `pki.crmf.build`, exposed for the RFC 9810 CMP `rr` (revocation request) body,
+ * whose `RevDetails.certDetails` carries a `CertTemplate` naming the certificate to revoke. Returns the DER
+ * `Buffer`; a malformed template throws a typed `CrmfError`.
+ *
+ * @example
+ *   var tpl = pki.crmf.buildCertTemplate({ serialNumber: 42n, issuer: "CN=CA" });
+ *   pki.asn1.decode(tpl).tagNumber === pki.asn1.TAGS.SEQUENCE;   // the CertTemplate SEQUENCE
+ */
+function buildCertTemplate(template) { return _encodeCertTemplate(template, { revocation: true }).der; }
+
+module.exports = { build: build, buildCertTemplate: buildCertTemplate };

package/lib/schema-all.js

@@ -298,7 +298,7 @@ module.exports = {
   x509: { parse: x509.parse, pemDecode: x509.pemDecode, pemEncode: x509.pemEncode },
   // C509 is CBOR, not DER: an explicit-call surface only, NOT added to FORMATS / the detect-and-route
   // parse() below (which detect DER shapes). No pemDecode/pemEncode -- C509 is binary CBOR.
-  c509: { parse: c509.parse },
+  c509: { parse: c509.parse, encode: c509.encode },
   crl:  { parse: crl.parse,  pemDecode: crl.pemDecode, pemEncode: crl.pemEncode },
   csr:  { parse: csr.parse,  pemDecode: csr.pemDecode, pemEncode: csr.pemEncode },
   pkcs8: { parse: pkcs8.parse, parseEncrypted: pkcs8.parseEncrypted, pemDecode: pkcs8.pemDecode, pemEncode: pkcs8.pemEncode },

package/lib/schema-c509.js

@@ -17,6 +17,8 @@
 var cbor = require("./cbor-det");
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
+var x509 = require("./schema-x509");
+var pkix = require("./schema-pkix");
 var constants = require("./constants");
 var frameworkError = require("./framework-error");
 var validator = require("./validator-all");
@@ -452,14 +454,16 @@ function parse(input) {
     signatureValue: signatureValue,
   };
 
-  // Native (type-2) signed region (sec. 3.1.12): the RAW bytes of the CBOR-sequence elements 0..9 (NOT
-  // the outer array head, NOT the signature) -- a zero-copy subarray a native verifier hashes.
-  if (type === 2) {
-    var b0 = f[0].bytes, b9 = f[9].bytes;
-    var start = b0.byteOffset - input.byteOffset;
-    var end = b9.byteOffset - input.byteOffset + b9.length;
-    result.signedData = input.subarray(start, end);
-  }
+  // The RAW bytes of CBOR-array elements 0..9 (NOT the outer array head, NOT the signature) -- a zero-copy
+  // subarray. For a native (type-2) certificate this is the signed region a verifier hashes (sec. 3.1.12);
+  // surfaced as `_fieldBytes` for BOTH types so encode() re-emits a parsed certificate byte-for-byte (a
+  // re-derivation from the decoded values could differ on a canonical-equivalent form, breaking a type-2
+  // signature or a type-3 DER reconstruction). `signedData` keeps its type-2-only signed-region meaning.
+  // From the DECODED root's own bytes (root.bytes == array head + all 11 elements), not offset arithmetic
+  // on `input` (which breaks when input is a Uint8Array the codec normalized to a different buffer): the
+  // fields region is root.bytes minus the 1-byte array(11) head and minus the trailing signatureValue.
+  result._fieldBytes = root.bytes.subarray(1, root.bytes.length - f[10].bytes.length);
+  if (type === 2) result.signedData = result._fieldBytes;
 
   // Type-3 is an invertible re-encoding of a DER X.509 certificate: reconstruct the original DER
   // byte-for-byte so the original signature verifies and x509.parse recovers the certificate.
@@ -476,4 +480,325 @@ function matches(node) {
     (Number(node.children[0].argument) === 2 || Number(node.children[0].argument) === 3);
 }
 
-module.exports = { parse: parse, matches: matches };
+// ---- the encode (the producing side; draft-20 sec. 3) -----------------------
+// The byte-exact inverse of parse/reconstruct: emit the 11-element deterministic-CBOR C509 array via the
+// cbor.build.* emitter. Two inputs, dispatched structurally: a DER X.509 certificate (Buffer/PEM) -> the
+// FLAGSHIP type-3 forward transform (parse(encode(der)).reconstructedDer == der, so the original signature
+// verifies); a c509.parse result -> re-emit its native array. Signing-free (mirrors ct.encodeSctList).
+
+// The registry INVERSE tables -- the canonical int per name (the lossy forward map is resolved to ONE
+// choice: EXT_BY_INT maps both 2 and 7 to keyUsage, so keyUsage encodes to the canonical draft int 2).
+var SIG_ALG_TO_INT = { ecdsaWithSHA256: 0, ecdsaWithSHA384: 1, ecdsaWithSHA512: 2 };
+var PK_ALG_TO_INT = { rsaEncryption: 0, "ecPublicKey|prime256v1": 1, "ecPublicKey|secp384r1": 2, "ecPublicKey|secp521r1": 3 };
+var ATTR_TO_INT = { commonName: 1, surname: 2, serialNumber: 3, countryName: 4, localityName: 6, stateOrProvinceName: 7, organizationName: 8, organizationalUnitName: 9, title: 10 };
+var EXT_TO_INT = { subjectKeyIdentifier: 1, keyUsage: 2, subjectAltName: 3, basicConstraints: 4, authorityKeyIdentifier: 10 };
+
+// A non-negative BigInt -> its minimal big-endian ~biguint bytes (the leading 0x00 sign octet omitted).
+function _minBytes(n) {
+  if (n < 0n) throw _err("c509/bad-serial", "a ~biguint value must be non-negative");
+  if (n === 0n) return Buffer.alloc(0);
+  var hex = n.toString(16); if (hex.length % 2) hex = "0" + hex;
+  return Buffer.from(hex, "hex");
+}
+// A C509 AlgorithmIdentifier -> int (registry) | ~oid (bare bytes) | [~oid, params]. `key` selects the row.
+function _encAlgorithm(alg, toInt, key) {
+  var i = toInt[key];
+  if (i !== undefined && !(alg.parameters && alg.parameters.length)) return cbor.build.int(BigInt(i));
+  var oidBytes = cbor.build.byteString(asn1.encodeOidContent(alg.oid));   // ~oid: bare BER OID content
+  if (alg.parameters && alg.parameters.length) return cbor.build.array([oidBytes, cbor.build.byteString(alg.parameters)]);
+  return oidBytes;
+}
+// A SpecialText attribute value -> CBOR (text | tag-48 EUI). v1 encodes the text + eui64 forms.
+function _encSpecialText(rdn) {
+  if (rdn.eui64) return cbor.build.tag(48, cbor.build.byteString(rdn.eui64));
+  return cbor.build.textString(String(rdn.value));
+}
+// A Name -> CBOR: null (issuer only) | a bare SpecialText single utf8 commonName | an array of RDN pairs.
+function _encName(name, isSubject) {
+  if (name === null || name === undefined) {
+    if (!isSubject) return cbor.build.nullValue();   // issuer == subject (self-signed)
+    throw _err("c509/bad-name", "the subject Name is required");
+  }
+  var rdns = name.rdns || [];
+  if (rdns.length === 1 && rdns[0].type === "commonName" && !rdns[0].printable) return _encSpecialText(rdns[0]);
+  var items = [];
+  rdns.forEach(function (rdn) {
+    var ai = ATTR_TO_INT[rdn.type];
+    if (ai === undefined) throw _err("c509/bad-name", "attribute type " + rdn.type + " has no C509 registry int");
+    items.push(cbor.build.int(BigInt(rdn.printable ? -ai : ai)));   // sign selects printableString
+    items.push(_encSpecialText(rdn));
+  });
+  return cbor.build.array(items);
+}
+// subjectPublicKey -> CBOR: EC point byte string, or an RSA ~biguint modulus ([modulus, exponent] when e != 65537).
+function _encSpk(r) {
+  if (r.rsaPublicKey) {
+    var mod = cbor.build.byteString(_minBytes(r.rsaPublicKey.modulus));
+    if (r.rsaPublicKey.exponent === 65537n) return mod;
+    return cbor.build.array([mod, cbor.build.byteString(_minBytes(r.rsaPublicKey.exponent))]);
+  }
+  if (!Buffer.isBuffer(r.subjectPublicKey)) throw _err("c509/bad-spki", "the subjectPublicKey bytes are missing");
+  return cbor.build.byteString(r.subjectPublicKey);
+}
+// extensions -> CBOR: the keyUsage int-shortcut (a lone keyUsage), else an array of [extID, extValue] pairs.
+function _encExtensions(exts) {
+  if (exts.length === 1 && exts[0].name === "keyUsage" && typeof exts[0].keyUsageBits === "number") {
+    return cbor.build.int(BigInt(exts[0].critical ? -exts[0].keyUsageBits : exts[0].keyUsageBits));
+  }
+  var items = [];
+  exts.forEach(function (ext) {
+    var ei = EXT_TO_INT[ext.name];
+    if (ei !== undefined) {
+      items.push(cbor.build.int(BigInt(ext.critical ? -ei : ei)));
+      // a registered-int extension carries its extnValue DER bytes as a bare byte string.
+      if (!Buffer.isBuffer(ext.value)) throw _err("c509/non-invertible", "extension " + ext.name + " has no byte-string value to encode");
+      items.push(cbor.build.byteString(ext.value));
+    } else {
+      items.push(cbor.build.byteString(asn1.encodeOidContent(ext.oid)));   // ~oid extension id
+      if (!Buffer.isBuffer(ext.value)) throw _err("c509/non-invertible", "extension " + (ext.oid || ext.name) + " has no byte-string value to encode");
+      var bs = cbor.build.byteString(ext.value);
+      items.push(ext.critical ? cbor.build.array([bs]) : bs);              // critical ~oid value wraps in a 1-element array
+    }
+  });
+  return cbor.build.array(items);
+}
+// forward-declared below; the DER X.509 -> type-3 C509 structured result.
+var _derToType3;
+// A hand-built (no _fieldBytes) result must carry the structured fields the encode below reads; a missing or
+// wrong-typed field fails closed with a typed verdict rather than a raw property-access crash.
+function _requireResultShape(r) {
+  if (r.certificateType == null) throw _err("c509/bad-input", "a C509 result must carry certificateType");
+  if (r.serialNumber == null && r.serialNumberHex == null) throw _err("c509/bad-input", "a C509 result must carry serialNumber or serialNumberHex");
+  if (!r.signatureAlgorithm || typeof r.signatureAlgorithm.name !== "string") throw _err("c509/bad-input", "a C509 result must carry signatureAlgorithm.name");
+  if (!r.subjectPublicKeyAlgorithm || typeof r.subjectPublicKeyAlgorithm.name !== "string") throw _err("c509/bad-input", "a C509 result must carry subjectPublicKeyAlgorithm.name");
+  if (!r.validity || !(r.validity.notBefore instanceof Date) || (r.validity.notAfter !== null && !(r.validity.notAfter instanceof Date))) throw _err("c509/bad-input", "a C509 result must carry validity.notBefore (Date) and notAfter (Date or null)");
+  if (!Array.isArray(r.extensions)) throw _err("c509/bad-input", "a C509 result must carry an extensions array");
+  if (!Buffer.isBuffer(r.signatureValue)) throw _err("c509/bad-input", "a C509 result must carry a Buffer signatureValue");
+}
+// A validity Date -> its C509 ~time (a non-negative CBOR epoch uint). A pre-epoch date cannot be
+// represented (the parser accepts only an unwrapped major-type-0 integer) and fails closed here.
+function _validityUint(date, label) {
+  var secs = Math.floor(date.getTime() / 1000);
+  if (!isFinite(secs) || secs < 0) throw _err("c509/bad-validity", label + " is before the Unix epoch or not a valid date; C509 ~time is a non-negative CBOR epoch");
+  return cbor.build.uint(BigInt(secs));
+}
+// A structured C509 result -> the 11-element deterministic-CBOR array.
+function _encodeC509Array(r) {
+  // Re-emit a PARSED certificate's raw fields (elements 0..9) VERBATIM -- re-deriving from the decoded
+  // values could differ on a canonical-equivalent form (a byte-string attribute value, a registry alias)
+  // and break a type-2 native signature (which covers these bytes) or a type-3 DER reconstruction (which
+  // depends on the field values). Both types preserve the exact bytes; only a hand-built result (no
+  // _fieldBytes) re-derives from the structured values below.
+  if (Buffer.isBuffer(r._fieldBytes)) {
+    if (!Buffer.isBuffer(r.signatureValue)) throw _err("c509/bad-input", "a re-emitted certificate must carry a Buffer signatureValue");
+    var out = Buffer.concat([Buffer.from([0x8b]), r._fieldBytes, cbor.build.byteString(r.signatureValue)]);   // array(11) head + fields 0..9 + signatureValue
+    parse(out);   // fail closed: a caller-mutated _fieldBytes must still re-parse as a valid C509, else parse throws a typed c509/* verdict
+    return out;
+  }
+  _requireResultShape(r);
+  var pkKey = r.subjectPublicKeyAlgorithm.curve ? r.subjectPublicKeyAlgorithm.name + "|" + r.subjectPublicKeyAlgorithm.curve : r.subjectPublicKeyAlgorithm.name;
+  var arr = cbor.build.array([
+    cbor.build.int(BigInt(r.certificateType)),
+    cbor.build.byteString(r.serialNumberHex != null ? Buffer.from(r.serialNumberHex, "hex") : _minBytes(r.serialNumber)),
+    _encAlgorithm(r.signatureAlgorithm, SIG_ALG_TO_INT, r.signatureAlgorithm.name),
+    _encName(r.issuer, false),
+    _validityUint(r.validity.notBefore, "validityNotBefore"),
+    r.validity.notAfter === null ? cbor.build.nullValue() : _validityUint(r.validity.notAfter, "validityNotAfter"),
+    _encName(r.subject, true),
+    _encAlgorithm(r.subjectPublicKeyAlgorithm, PK_ALG_TO_INT, pkKey),
+    _encSpk(r),
+    _encExtensions(r.extensions),
+    cbor.build.byteString(r.signatureValue),
+  ]);
+  parse(arr);   // fail closed: a hand-built result must re-parse as a valid C509 (as the verbatim path checks), else parse throws a typed c509/* verdict
+  return arr;
+}
+
+/**
+ * @primitive  pki.schema.c509.encode
+ * @signature  pki.schema.c509.encode(input[, opts]) -> Buffer
+ * @since      0.3.4
+ * @status     experimental
+ * @spec       draft-ietf-cose-cbor-encoded-cert, RFC 8949, RFC 9090
+ * @related    pki.schema.c509.parse
+ *
+ * Encode a C509 certificate to its deterministic-CBOR bytes -- the producing-side inverse of
+ * `pki.schema.c509.parse`. `input` is either a DER X.509 v3 certificate (a Buffer or PEM string), which is
+ * forward-transformed to a **type-3** C509 (a compact CBOR re-encoding whose signature is copied from the
+ * source and re-expressed as a fixed-width r||s, so `parse(encode(der)).reconstructedDer` reproduces the
+ * original DER byte for byte and the original signature still verifies), or a `pki.schema.c509.parse`
+ * result object, which is re-emitted to its native deterministic-CBOR array. The emission is canonical
+ * deterministic CBOR (RFC 8949 sec. 4.2) -- shortest-form heads, definite lengths, sorted map keys, and the
+ * registry integer shorthand for every registered algorithm / attribute / extension. It is signing-free (a
+ * byte transform, like `pki.ct.encodeSctList`); a shape outside the covered set throws a typed `C509Error`.
+ *
+ * The fixed-width ECDSA r||s is sized by the ISSUER's signing curve, which a leaf certificate does not
+ * carry. It is resolved authoritatively (never a magnitude guess, and matching issuer/subject Names are not
+ * taken as proof of self-signing): from `opts.issuerCurve`, or from the RFC 5480 standard digest<->curve
+ * pairing the signature algorithm implies. A certificate signed with a non-standard digest/curve pairing
+ * (its r/s wider than the digest's standard curve) fails closed -- supply the issuer curve via
+ * `opts.issuerCurve`.
+ *
+ * @opts
+ *   - `issuerCurve` (string) -- the ISSUER's ECDSA signing curve "P-256" / "P-384" / "P-521" (or the OID
+ *     names prime256v1 / secp384r1 / secp521r1); authoritative, overrides the resolution above. Consulted
+ *     only for the DER -> type-3 path; ignored when re-emitting a parse result.
+ *
+ * @example
+ *   var cbor = pki.schema.c509.encode(signerCertDer);   // a DER cert -> a compact type-3 C509
+ *   pki.schema.c509.parse(cbor).certificateType;        // 3
+ */
+// A commonName string that is a MAC / EUI address ("HH-HH-HH-FF-FE-HH-HH-HH") -> the C509 tag-48 byte
+// value (draft-20 sec. 3.2.3): an FF-FE-in-the-middle EUI-64 collapses to its 6-byte EUI-48, else the
+// 8-byte EUI-64 verbatim. A non-MAC commonName returns null (encoded as text). The exact inverse of
+// _macToEui64String, so the reconstruction rebuilds the identical DER commonName string.
+function _euiFromCn(value) {
+  if (!/^[0-9A-F]{2}(-[0-9A-F]{2}){7}$/.test(value)) return null;
+  var bytes = Buffer.from(value.replace(/-/g, ""), "hex");
+  if (bytes[3] === 0xff && bytes[4] === 0xfe) return Buffer.concat([bytes.subarray(0, 3), bytes.subarray(5)]);
+  return bytes;
+}
+// A DER Name -> the C509 structured rdns, decoding each attribute's string type (PrintableString ->
+// printable, UTF8String -> utf8; the C509 int sign carries this). Single-attribute RDNs only (v1).
+function _c509NameFromDer(nameBytes) {
+  var node = asn1.decode(nameBytes);
+  var rdns = [];
+  (node.children || []).forEach(function (rdnSet) {
+    if (!rdnSet.children || rdnSet.children.length !== 1) throw _err("c509/non-invertible", "a C509 Name requires single-attribute RDNs");
+    var attr = rdnSet.children[0];
+    var attrName = oid.name(asn1.read.oid(attr.children[0]));
+    if (attrName == null || ATTR_TO_INT[attrName] === undefined) throw _err("c509/non-invertible", "attribute type " + attrName + " has no C509 registry integer");
+    var valNode = attr.children[1];
+    var value = asn1.read.string(valNode);
+    var eui = attrName === "commonName" ? _euiFromCn(value) : null;
+    if (eui) rdns.push({ type: attrName, value: value, eui64: eui });                            // tag-48 MAC commonName
+    else rdns.push({ type: attrName, value: value, printable: valNode.tagNumber === asn1.TAGS.PRINTABLE_STRING });
+  });
+  return { rdns: rdns };
+}
+// A keyUsage extnValue (a DER KeyUsage BIT STRING) -> the C509 integer whose bit i is the named bit i.
+function _keyUsageBitsFromDer(extnValue) {
+  var bs;
+  try {
+    bs = asn1.read.bitString(asn1.decode(extnValue));
+  } catch (_e) {
+    return null;   // a malformed keyUsage BIT STRING cannot take the int shortcut -> encode it as a raw extension
+  }
+  var total = bs.bytes.length * 8 - bs.unusedBits, value = 0;
+  for (var bit = 0; bit < total && bit < 31; bit++) { if (bs.bytes[bit >> 3] & (0x80 >> (bit & 7))) value |= (1 << bit); }
+  return value > 0 && value <= 0x1ff ? value : null;
+}
+var _NO_EXPIRY = Date.UTC(9999, 11, 31, 23, 59, 59);
+// The C509 (OID/node) curve names <-> the WebCrypto namedCurve the P1363 converter expects, and the
+// RFC 5480 standard digest<->curve pairing an ECDSA signature algorithm implies.
+var NODE_TO_WEBCRYPTO = { "prime256v1": "P-256", "secp384r1": "P-384", "secp521r1": "P-521" };
+var WEBCRYPTO_FIELD_BYTES = { "P-256": 32, "P-384": 48, "P-521": 66 };
+var SIG_ALG_TO_CURVE = { "ecdsaWithSHA256": "P-256", "ecdsaWithSHA384": "P-384", "ecdsaWithSHA512": "P-521" };
+// A DER INTEGER magnitude byte length: the content past any leading sign/pad octet.
+function _magBytes(intNode) {
+  var c = intNode.content, i = 0;
+  while (i < c.length - 1 && c[i] === 0x00) i++;
+  return c.length - i;
+}
+// The max r/s magnitude width of a DER ECDSA signature (validating its two-INTEGER shape).
+function _sigMagWidth(derSig) {
+  var n;
+  try { n = asn1.decode(derSig); } catch (e) { throw _err("c509/bad-signature", "the ECDSA issuer signature is not valid DER", e); }
+  if (n.tagNumber !== asn1.TAGS.SEQUENCE || n.tagClass !== "universal" || !n.children || n.children.length !== 2) throw _err("c509/bad-signature", "the ECDSA issuer signature must be a SEQUENCE of two INTEGERs");
+  for (var i = 0; i < 2; i++) {
+    var ch = n.children[i];
+    if (ch.tagNumber !== asn1.TAGS.INTEGER || ch.tagClass !== "universal" || ch.constructed) throw _err("c509/bad-signature", "the ECDSA issuer signature r and s must be universal INTEGERs");
+  }
+  return Math.max(_magBytes(n.children[0]), _magBytes(n.children[1]));
+}
+var CURVE_ORDER = ["P-256", "P-384", "P-521"];   // ascending field size
+// The smallest supported curve whose field holds a magnitude, or null if none does.
+function _minCurveForMag(mag) {
+  for (var i = 0; i < CURVE_ORDER.length; i++) { if (mag <= WEBCRYPTO_FIELD_BYTES[CURVE_ORDER[i]]) return CURVE_ORDER[i]; }
+  return null;
+}
+// The ISSUER signature's fixed-width r||s is sized by the ISSUER's signing curve. The DER ECDSA signature
+// does NOT carry the curve and the r/s magnitudes are only a lower bound (a P-384 signature with small r/s
+// is byte-indistinguishable from a P-256 one), so the curve is resolved from an AUTHORITATIVE source, never
+// a guess: (1) an explicit opts.issuerCurve, or (2) the RFC 5480 standard digest<->curve pairing the
+// signature algorithm implies -- and ONLY when that pairing is the smallest curve the magnitude admits.
+// Matching issuer/subject Names are NOT treated as proof of self-signing (a self-issued certificate may be
+// cross-signed by a different key on a different curve). A signature whose r/s exceed the digest's standard
+// curve (a larger key) OR whose magnitude also fits a SMALLER curve (a smaller key signing with a larger
+// digest) leaves the curve undetermined: it fails closed and directs the caller to opts.issuerCurve.
+function _resolveIssuerSigCurve(c, opts) {
+  var mag = _sigMagWidth(c.signatureValue.bytes), curve;
+  if (opts && opts.issuerCurve != null) {
+    curve = String(opts.issuerCurve);
+    if (NODE_TO_WEBCRYPTO[curve]) curve = NODE_TO_WEBCRYPTO[curve];
+    if (!WEBCRYPTO_FIELD_BYTES[curve]) throw _err("c509/bad-input", "opts.issuerCurve must be P-256 / P-384 / P-521 (or prime256v1 / secp384r1 / secp521r1); got " + opts.issuerCurve);
+  } else {
+    curve = SIG_ALG_TO_CURVE[c.signatureAlgorithm.name];
+    if (!curve) throw _err("c509/non-invertible", "cannot resolve the issuer signing curve for signature algorithm " + c.signatureAlgorithm.name);
+    var minCurve = _minCurveForMag(mag);
+    if (!minCurve) throw _err("c509/non-invertible", "the ECDSA signature r/s width " + mag + " exceeds every supported curve field");
+    if (WEBCRYPTO_FIELD_BYTES[curve] < mag) throw _err("c509/non-invertible", "the issuer signed with a non-standard digest/curve pairing (r/s width " + mag + " exceeds the " + curve + " field implied by " + c.signatureAlgorithm.name + "); pass opts.issuerCurve (P-256 / P-384 / P-521)");
+    if (WEBCRYPTO_FIELD_BYTES[curve] > WEBCRYPTO_FIELD_BYTES[minCurve]) throw _err("c509/non-invertible", "signature algorithm " + c.signatureAlgorithm.name + " does not uniquely determine the issuer curve (r/s width " + mag + " also fits " + minCurve + "); pass opts.issuerCurve (P-256 / P-384 / P-521)");
+  }
+  if (mag > WEBCRYPTO_FIELD_BYTES[curve]) throw _err("c509/non-invertible", "the ECDSA signature r/s width " + mag + " does not fit the resolved " + curve + " field");
+  return curve;
+}
+// Compress an uncompressed SEC1 EC point (0x04||X||Y) to the C509 marker form (draft-20 sec. 3.2.2): the
+// sign-of-Y marker 0xFE (Y even) / 0xFD (Y odd) followed by X. The inverse of webcrypto.decompressEcPoint,
+// so the type-3 reconstruction recovers the exact original point. A non-0x04 point is kept verbatim.
+function _compressEcPoint(point, coordLen) {
+  if (!point.length || point[0] !== 0x04) return point;
+  if (point.length !== 1 + 2 * coordLen) throw _err("c509/non-invertible", "uncompressed EC point length " + point.length + " does not match the curve field size");
+  var x = point.subarray(1, 1 + coordLen), y = point.subarray(1 + coordLen);
+  return Buffer.concat([Buffer.from([(y[y.length - 1] & 1) ? 0xfd : 0xfe]), x]);
+}
+// A DER X.509 v3 certificate -> the type-3 C509 structured result (the inverse of _reconstructDer). Only
+// the reconstruction's covered set is invertible; encode() self-verifies the byte-exact round trip.
+_derToType3 = function (input, opts) {
+  var c;
+  try { c = x509.parse(input); } catch (e) { throw _err("c509/bad-input", "the input is not a valid X.509 certificate", e); }
+  if (!/^ecdsa/i.test(c.signatureAlgorithm.name || "")) throw _err("c509/non-invertible", "type-3 C509 encoding covers only ECDSA-signed certificates; got " + (c.signatureAlgorithm.name || "an unregistered algorithm"));
+  if (c.subjectPublicKeyInfo.algorithm.name !== "ecPublicKey") throw _err("c509/non-invertible", "type-3 C509 encoding covers only EC (ecPublicKey) certificates in v1; got " + (c.subjectPublicKeyInfo.algorithm.name || "an unregistered algorithm"));
+  var curveOid = asn1.read.oid(asn1.decode(c.subjectPublicKeyInfo.algorithm.parameters));
+  var curve = oid.name(curveOid);
+  var coordLen = EC_FIELD_BYTES[curve];
+  if (!coordLen) throw _err("c509/non-invertible", "unsupported EC subject curve " + (curve || curveOid));
+  var sigCurve = _resolveIssuerSigCurve(c, opts);   // the ISSUER signing curve, resolved authoritatively (opts / digest pairing)
+  var spkiNode = asn1.decode(c.subjectPublicKeyInfo.bytes);
+  return {
+    certificateType: 3,
+    serialNumber: c.serialNumber,          // no serialNumberHex -> the encoder uses the minimal ~biguint magnitude
+    signatureAlgorithm: { name: c.signatureAlgorithm.name, oid: c.signatureAlgorithm.oid },
+    issuer: _c509NameFromDer(c.issuer.bytes),
+    validity: { notBefore: c.validity.notBefore, notAfter: c.validity.notAfter.getTime() === _NO_EXPIRY ? null : c.validity.notAfter },
+    subject: _c509NameFromDer(c.subject.bytes),
+    subjectPublicKeyAlgorithm: { name: "ecPublicKey", oid: c.subjectPublicKeyInfo.algorithm.oid, curve: curve },
+    subjectPublicKey: _compressEcPoint(asn1.read.bitString(spkiNode.children[1]).bytes, coordLen),   // 0x04||X||Y -> C509 compressed marker
+    rsaPublicKey: null,
+    extensions: (c.extensions || []).map(function (e) {
+      var ext = { name: e.name, oid: e.oid, critical: !!e.critical, value: e.value };
+      if (e.name === "keyUsage") { var bits = _keyUsageBitsFromDer(e.value); if (bits != null) ext.keyUsageBits = bits; }   // enable the int-shortcut
+      return ext;
+    }),
+    signatureValue: validator.sig.ecdsaDerToP1363(c.signatureValue.bytes, sigCurve, C509Error, "c509/bad-signature"),
+  };
+};
+
+function encode(input, opts) {
+  if (input && typeof input === "object" && !Buffer.isBuffer(input) && input.certificateType != null) {
+    return _encodeC509Array(input);   // a parse result -> re-emit its native array
+  }
+  if (!Buffer.isBuffer(input) && typeof input !== "string") throw _err("c509/bad-input", "encode input must be a DER/PEM X.509 certificate or a c509.parse result");
+  // Normalize input to DER through the SAME shared coercion x509.parse uses (a PEM string, a PEM-armored
+  // Buffer, or raw DER all collapse to the certificate DER), so the self-verify compares against exactly the
+  // bytes _derToType3 processed -- never a Buffer of PEM text.
+  var origDer = pkix.coerceToDer(input, { pemLabel: "CERTIFICATE", PemError: frameworkError.PemError, ErrorClass: C509Error, prefix: "c509" });
+  var encoded = _encodeC509Array(_derToType3(origDer, opts));
+  // The type-3 transform MUST invert back to the original DER byte-for-byte (so the original signature
+  // verifies) -- self-verify it, failing closed on any edge the reconstruction cannot reproduce.
+  var recon = parse(encoded).reconstructedDer;
+  if (!recon || Buffer.compare(recon, origDer) !== 0) throw _err("c509/non-invertible", "the type-3 C509 does not reconstruct the source certificate byte-for-byte");
+  return encoded;
+}
+
+module.exports = { parse: parse, matches: matches, encode: encode };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:e238289a-30dc-45fc-b08a-4cc7a4f0a503",
+  "serialNumber": "urn:uuid:9ded865a-a922-4de1-a8f0-bd02d3b29a2e",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-17T09:21:09.414Z",
+    "timestamp": "2026-07-17T19:09:09.529Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.3.3",
+      "bom-ref": "@blamejs/pki@0.3.5",
       "type": "application",
       "name": "pki",
-      "version": "0.3.3",
+      "version": "0.3.5",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.3.3",
+      "purl": "pkg:npm/%40blamejs/pki@0.3.5",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.3.3",
+      "ref": "@blamejs/pki@0.3.5",
       "dependsOn": []
     }
   ]