@blamejs/pki 0.3.7 → 0.3.9

package/CHANGELOG.md

@@ -4,6 +4,25 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.3.9 — 2026-07-23
+
+pki.crl builds, signs, and verifies X.509 certificate revocation lists (RFC 5280 sec. 5) over any registry algorithm.
+
+### Added
+
+- pki.crl.sign(spec, issuer, opts) builds and signs an X.509 CRL (RFC 5280 sec. 5): thisUpdate/nextUpdate, an optional crlNumber, a revoked list (each entry a serialNumber and revocationDate with an optional reason or invalidityDate), and an extensions object (authorityKeyIdentifier, issuingDistributionPoint, deltaCRLIndicator, freshestCRL, authorityInfoAccess) or an array of pre-encoded Extension DER. The issuer is a CA certificate + key, or an explicit name + public key + key. The signature algorithm is resolved from the issuer key, so RSA (PKCS#1 v1.5 / PSS via opts.pss), ECDSA, EdDSA, ML-DSA, SLH-DSA, and the composite arms all sign without a per-algorithm branch. The version is derived from the extension set (v2 when any CRL or entry extension is present, else v1), an empty revocation list omits the field, the reason code is an ENUMERATED, an invalidity date is always a GeneralizedTime, and per-extension criticality is fixed by the profile. Returns DER or a PEM X509 CRL; the produced signature is verified under the issuer key before return, and every emitted CRL round-trips through pki.schema.crl.parse and is accepted by OpenSSL across the classical and post-quantum arms. RFC 5280 sec. 5.
+- pki.crl.verify(crl, issuer) verifies a CRL's signature over its exact tbsCertList bytes against the issuer public key (a { cert }, a { publicKey } SPKI DER, or a raw SPKI Buffer), composing the one path-validation signature engine pki.path.crlChecker uses -- the RFC 9814 algorithm-confusion and Edwards low-order-point gates included -- and failing closed to false. It checks the signature only; issuer authorization, currency, and distribution-point scope remain pki.path.crlChecker.
+- pki.crl.isRevoked(crl, serialNumber) returns the revoked-certificate entry a CRL lists for a serial number, or null when the serial is not listed.
+
+## v0.3.8 — 2026-07-18
+
+Human-readable inspection extends to CRLs, CSRs, and CMS messages, with a pki.schema.detectFormat companion.
+
+### Added
+
+- pki.inspect.crl / .csr / .cms render a certificate revocation list, a PKCS#10 certification request, and a CMS message as OpenSSL-familiar text reports (openssl crl -text / req -text / cms -cmsout -print), and pki.inspect.any detects the format of a DER/PEM input and routes it to the matching report. Each composes the certificate inspector's shipped field renderers, resolves every extension/attribute/algorithm/content-type OID through the registry (unknown -> dotted, undecodable value -> raw octets), and is best-effort: a malformed part hex-dumps rather than failing the report, and only entry-point coercion throws (inspect/bad-crl / inspect/bad-csr / inspect/bad-cms / inspect/unsupported-format). Cross-checked field-for-field against OpenSSL. RFC 5280 / RFC 2986 / RFC 5652.
+- pki.schema.detectFormat(input) returns the registered PKI format name a DER Buffer or PEM string encodes -- one of pki.schema.all() -- without parsing it, or null when it matches no registered format. The detection half of pki.schema.parse, over the same authoritative format ordering.
+
 ## v0.3.7 — 2026-07-17
 
 Certification path building arrives as pki.path.build, and pki.lint gains seven RFC 5280 extension-criticality and CA-scope lints.

package/README.md

@@ -227,6 +227,7 @@ is callable today; nothing below is a stub.
 | `pki.attrcert` | RFC 5755 attribute-certificate issuance — `sign(spec, issuer, opts)` builds and signs an `AttributeCertificate` as an Attribute Authority: a `spec` of `holder` (exactly one of an entity name, a `baseCertificateID` public-key-certificate reference, a `fromCertificate` binding derived from a certificate, or an object digest), the validity window (GeneralizedTime), an optional serial (positive, ≤ 20 octets; randomly generated when omitted), the `attributes` (the privilege syntaxes — role, clearance, group, chargingIdentity, accessIdentity, authenticationInfo — or pre-encoded Attribute DER), and optional `extensions` (auditIdentity, targetInformation, noRevAvail, aaControls, acProxying, authorityKeyIdentifier, or pre-encoded Extension DER, each with its RFC 5755 criticality). An attribute certificate is never self-signed — the `issuer` is the signing AA, supplied as `{ cert, key }` or `{ name, publicKey, key }`. The signature algorithm is resolved from the AA key, so RSA (PKCS#1 v1.5 / PSS via `opts.pss`), ECDSA, EdDSA, ML-DSA, SLH-DSA, and the composite arms all sign without a per-algorithm branch, and the signature is verified under the AA public key before the certificate is returned. Returns DER, or a PEM `ATTRIBUTE CERTIFICATE` with `opts.pem`; malformed input throws a typed `AttrCertError`. Parsing stays at `pki.schema.attrcert.parse` — `sign` |
 | `pki.crmf` | RFC 4211 certificate-request-message issuance — `build(spec, key, opts)` assembles a `CertReqMessages`: a `spec` of `certReqId` (default 0; the RFC 9483 `-1` sentinel allowed), a `certTemplate` of the requested certificate fields (`subject`, `publicKey` — the SPKI DER of the key being certified — `validity`, requested `extensions`, an optional `version` 2), optional `controls` and `regInfo` (regToken / authenticator / utf8Pairs / oldCertID / protocolEncrKey, or pre-encoded `AttributeTypeAndValue` DER), and an optional `pop` selector. `key` (or `{ key }`) is the requester's private key — the message carries a `POPOSigningKey` proof of possession signed with the private half of `certTemplate.publicKey` (verified before the message is returned), exactly as a PKCS#10 CSR proves possession; a complete template signs the `CertRequest`, an incomplete one signs a `POPOSigningKeyInput`. The signature algorithm is resolved from the requested public key, so RSA (PKCS#1 v1.5 / PSS via `opts.pss`), ECDSA, EdDSA, ML-DSA, SLH-DSA, and the composite arms all sign without a per-algorithm branch. `key` is optional for a `raVerified` proof. Pass an array of specs for a batch; the CA-assigned template fields are never emitted. Returns DER, or a PEM block with `opts.pem`; malformed input throws a typed `CrmfError`. Parsing stays at `pki.schema.crmf.parse` — `build` |
 | `pki.cmp` | RFC 9810 Certificate Management Protocol message building — `build(message, opts)` assembles a protected `PKIMessage`. `message.header` carries the `sender` / `recipient` GeneralNames (including the anonymous NULL-DN) plus optional transaction metadata (`transactionID`, `senderNonce` / `recipNonce`, `messageTime` as a GeneralizedTime, `senderKID` / `recipKID`, `freeText`, `generalInfo`); `message.body` is a single-key object naming the arm. Request-side: `ir` / `cr` / `kur` (a `CertReqMessages` spec delegated to `pki.crmf.build`), `p10cr` (a PKCS#10 `CertificationRequest`), `certConf`, `pollReq`, `genm`, `rr`. CA/responder-side: `ip` / `cp` / `kup` / `ccp` (a `CertRepMessage` — `caPubs` and `response` entries carrying a `PKIStatusInfo` and, under a granting status, a `certifiedKeyPair`), `rp` (revocation response), `genp`, `error`, `pollRep`, `krp` (key-recovery response), `pkiconf`. Protection is exactly one of `opts.{ key, cert }` — a signature over the message under the sender key, the algorithm resolved from the signer certificate so RSA (PKCS#1 v1.5 / PSS), ECDSA, EdDSA, ML-DSA, SLH-DSA, and the composite arms all sign without a per-algorithm branch — or `opts.mac` — a PBMAC1 shared-secret HMAC (RFC 9481 / 9579, PBKDF2-derived). The protection covers the exact DER of the virtual `ProtectedPart` (the header and body) and is self-verified before the message is returned; the `protectionAlg` is derived, never caller-set, so the message the parser accepts is coherent by construction. Returns DER, or a PEM `CMP` block with `opts.pem`; malformed input throws a typed `CmpError`. Parsing stays at `pki.schema.cmp.parse` — `build` |
+| `pki.crl` | RFC 5280 §5 certificate revocation list issuance — `sign(spec, issuer, opts)` builds and signs a `CertificateList`: a `spec` of `thisUpdate` / `nextUpdate`, an optional `crlNumber`, a `revoked` array (each entry a `serialNumber` + `revocationDate` with an optional `reason` or `invalidityDate`), and an optional `extensions` object (authority key identifier, issuing distribution point, delta-CRL indicator, freshest CRL, authority information access) or an array of pre-encoded Extension DER; an `issuer` of `{ cert, key }` or `{ name, publicKey, key }`. The signature algorithm is resolved from the issuer key, so RSA (PKCS#1 v1.5 / PSS via `opts.pss`), ECDSA, EdDSA, ML-DSA, SLH-DSA, and the composite arms all sign without a per-algorithm branch. The version is derived from the extension set (v2 when any CRL or entry extension is present, else v1), the outer `signatureAlgorithm` matches `tbsCertList.signature`, an empty revocation list omits the field rather than emitting an empty SEQUENCE, `reasonCode` is an ENUMERATED and `invalidityDate` is always GeneralizedTime, per-extension criticality is fixed by the RFC, and the produced signature is verified under the issuer key before return. `verify(crl, issuer)` checks a CRL signature through the one path-validation signature engine (algorithm-confusion and EdDSA low-order gates included), and `isRevoked(crl, serialNumber)` looks a serial up in the revocation list. Returns DER, or a PEM `X509 CRL` with `opts.pem`; malformed input throws a typed `CrlError`. Parsing stays at `pki.schema.crl.parse` — `sign` / `verify` / `isRevoked` |
 | `pki.cms` | RFC 5652 §5 CMS SignedData signing + signature verification — `sign(content, signers, opts)` produces a SignedData (attached or detached, one or many signers, RSA / RSASSA-PSS / ECDSA / EdDSA, the post-quantum ML-DSA-44/65/87 (RFC 9882) and SLH-DSA (all twelve FIPS 205 sets, RFC 9814), and composite ML-DSA (pairing ML-DSA with a traditional RSA / ECDSA / EdDSA — accepted only when **both** components verify — draft-ietf-lamps-cms-composite-sigs)); it builds the signed attributes (content-type, message-digest, signing-time) as canonical DER, signs the exact §5.4 preimage, and emits a DER `Buffer` or PEM. `verify(input, opts)` parses a SignedData over the strict `pki.schema.cms` codec, locates each SignerInfo's signer certificate by its issuerAndSerialNumber or subjectKeyIdentifier, and checks the signature over the exact §5.4 preimage: when signed attributes are present it confirms the message-digest attribute equals the content digest and verifies over the DER re-encoding of the SignedAttributes (the on-wire `[0]` tag replaced by a universal SET OF), otherwise directly over the content. It returns a per-signer verdict with the matched signer certificate; it does not chain that certificate to a trust anchor — that is the caller's step through `pki.path.validate`. **Content encryption** (RFC 5652/5083/5084/9629): `encrypt(content, recipients, opts)` produces an EnvelopedData, AuthEnvelopedData (AES-GCM, the authenticated default), or EncryptedData — recipients auto-dispatch off the certificate key to key-transport (RSAES-OAEP; v1.5 never emitted), key-agreement (ephemeral-static ECDH over P-256/384/521 with the X9.63 KDF, and X25519/X448 with HKDF), symmetric key-wrap, password (PBKDF2 + RFC 3211 PWRI-KEK), or the post-quantum ML-KEM KEMRecipientInfo (RFC 9629/9936) — one fresh content key wrapped for every recipient. `decrypt(input, keyMaterial, opts)` recovers the content through the matching arm and returns it with an `authenticated` flag; every secret-dependent failure collapses to one uniform `cms/decrypt-failed` verdict (Bleichenbacher / EFAIL / password-oracle freedom), and PKCS#1 v1.5 is decrypt-only under the RFC 3218 implicit-rejection countermeasure. **Compression** (RFC 3274): `compress(content, opts)` / `decompress(input, opts)` produce and consume a CompressedData (ZLIB, version 0, id-alg-zlibCompress); decompress bounds the uncompressed output at 16 MiB and stops before it is materialized, so a decompression bomb fails closed as `cms/decompress-too-large` — a size transform with no integrity/confidentiality (RFC 8551 §2.4.5). Fail-closed with typed `cms/*` errors — `sign`, `verify`, `encrypt`, `decrypt`, `compress`, `decompress` |
 | `pki.smime` | RFC 8551 S/MIME message assembly, verification, encryption, and compression over the CMS layer — `sign(content, signers, opts)` wraps a MIME entity as a signed S/MIME message in either form: `multipart/signed` (clear-signed — the content stays readable in any MUA, a detached CMS SignedData rides alongside as `application/pkcs7-signature` with a matching `micalg`) or `application/pkcs7-mime; smime-type=signed-data` (opaque — the whole entity is a base64 CMS SignedData). The signed bytes are the entity's RFC 8551 §3.1.1 canonical form (CRLF line endings); `verify(message, opts)` unwraps both forms and recomputes over the same canonicalizer, so a transport that re-wraps line endings still verifies and a tampered part fails. `encrypt(content, recipients, opts)` envelopes a MIME entity as an opaque `application/pkcs7-mime` message and `decrypt(message, keyMaterial, opts)` opens one — `smime-type=authEnveloped-data` (AES-GCM, confidentiality and integrity, the default) or `smime-type=enveloped-data` (AES-CBC, confidentiality only, so `decrypt` reports `authenticated: false`, the §3.3 no-integrity caveat); the `smime-type` is derived from the CMS body, not the header, and decryption is fail-closed and oracle-free. The crypto is entirely `pki.cms.sign` / `verify` / `encrypt` / `decrypt` — any RSA / RSASSA-PSS / ECDSA / EdDSA / ML-DSA / SLH-DSA signer and any RSA-OAEP / ECDH / X25519 / X448 / AES-KW / PBKDF2 / ML-KEM recipient carries through (algorithm-agnostic). Like `cms.verify`, `verify` returns the per-signer cryptographic verdict plus the recovered content; chaining a signer to a trust anchor is the caller's `pki.path.validate` step. `compress(content, opts)` / `decompress(message, opts)` add the opaque `application/pkcs7-mime; smime-type=compressed-data; name=smime.p7z` frame (RFC 8551 §3.6, RFC 3274) — a size transform with no integrity/confidentiality (§2.4.5), decompress bounded against a bomb; the recovered content, which may itself be signed or enveloped, is returned for the caller to re-verify. Bidirectionally interoperable with `openssl smime` / `openssl cms`. Fail-closed with typed `smime/*` errors — `sign`, `verify`, `encrypt`, `decrypt`, `compress`, `decompress` |
 | `pki.tsp` | RFC 3161 Time-Stamp Protocol — `sign(messageImprint, tsa, opts)` produces a TimeStampToken: a CMS SignedData (over `pki.cms.sign`) whose content is a `TSTInfo` carrying the timestamped message imprint, the TSA policy, a serial number, and `genTime` (with optional accuracy / nonce / ordering), plus the RFC 3161 §2.4.2 signing-certificate attribute binding the token to the TSA certificate (SHA-2 imprints, any `pki.cms.sign` TSA key). `request` / `parseRequest` build and parse the TimeStampReq a client sends (imprint, requested policy, nonce, certReq), `response` / `parseResponse` the TimeStampResp a TSA returns — a granted status wrapping a token, or a rejection with PKIStatus and failure info, the §2.4.2 status↔token coupling enforced in both directions. `verify(token, data, opts)` verifies a token fail-closed: the CMS signature over the exact signed bytes, the message imprint recomputed from the data, the TSTInfo content type, the ESSCertID(V2) binding to the TSA certificate, the §2.3 critical timeStamping-only extendedKeyUsage, the request nonce when used, and — with a trust anchor supplied — full certification-path validation of the TSA certificate at the token's `genTime`, returning `{ valid, genTime, serialNumber, tstInfo, … }` — `sign`, `request`, `parseRequest`, `response`, `parseResponse`, `verify` |
@@ -237,7 +238,7 @@ is callable today; nothing below is a stub.
 | `pki.shbs` | Stateful hash-based signature **verification** — HSS/LMS (RFC 8554), carried in X.509 by RFC 9802 and CMS by RFC 9708, profiled by NIST SP 800-208 (CNSA 2.0 firmware signing). `verify` checks an HSS signature (every level must pass) and `verifyLms` a single-tree LMS, over the raw public-key / signature blobs the parsers already surface. Pure public-input SHA-256 / SHAKE256 hashing, a data-driven typecode registry, bounds-before-slice reads; a malformed blob throws a typed `ShbsError`, a well-formed-but-wrong signature returns `false`. **Verify only by design** — stateful signing needs atomic one-time-key state that belongs in an HSM — `verify`, `verifyLms` |
 | `pki.hpke` | Hybrid Public Key Encryption (RFC 9180) — the encrypt-to-a-public-key primitive behind TLS ECH, MLS, and OHTTP. `setupS`/`setupR` establish a sender/recipient context (KEM encapsulation + HKDF key schedule); the context's `seal`/`open` AEAD-encrypt with a sequence-counter nonce and `export` derives further secrets; `seal`/`open` are single-shot wrappers. DHKEM (P-256, P-521, X25519, X448) × HKDF-SHA256/SHA512 × AES-GCM/ChaCha20Poly1305/export-only × all four modes, proven against the RFC 9180 Appendix A vectors. DHKEM(P-384) and HKDF-SHA384 are RFC-registered but Appendix A ships no vector for them, so they fail closed until an authoritative KAT exists. Pure composition over `node:crypto`; ML-KEM / X-Wing are a registry data-row extension pending stable drafts — `suites`, `setupS`, `setupR`, `seal`, `open` |
 | `pki.sigstore` | Offline verifier for a Sigstore bundle — the exact artifact `npm publish --provenance` produces and the registry serves. `verifyBundle` composes five fail-closed legs against caller-pinned trust (Fulcio CA roots + Rekor log keys, never trusted from the bundle): the DSSE signature over its PAE preimage under the Fulcio leaf key; the ephemeral Fulcio certificate chain, validated as of the Rekor log time; the RFC 9162 inclusion proof folded to a Rekor-signed tree root; the log entry bound to this exact signature; and the in-toto SLSA subject digest the caller confirms against the published artifact. Zero runtime deps — reuses the X.509 parser, RFC 5280 path validator, and Merkle verifier; the net-new codecs are the DSSE PAE byte-builder and a fail-closed JSON reader. `pae`, `parseBundle`, `verifyBundle` |
-| `pki.inspect` | Human-readable certificate inspection — the pure-JS equivalent of `openssl x509 -text`. `certificate(pem \| der \| parsed)` renders a familiar OpenSSL-style report: version, serial, signature algorithm, issuer/subject distinguished names, validity, public-key details (curve or modulus size + the raw point/modulus), every decoded extension with its critical flag, and the signature. Built over the strict parser and the two-way OID registry, so it names extension and algorithm OIDs an OpenSSL build shows only as raw bytes. No OpenSSL dependency; the format is stable and OpenSSL-familiar rather than pinned to one OpenSSL version; a malformed extension falls back to a hex dump rather than throwing — `certificate` |
+| `pki.inspect` | Human-readable inspection — the pure-JS equivalent of `openssl x509/crl/req/cms -text`. `certificate(pem \| der \| parsed)` renders a familiar OpenSSL-style report: version, serial, signature algorithm, issuer/subject distinguished names, validity, public-key details (curve or modulus size + the raw point/modulus), every decoded extension with its critical flag, and the signature. `crl` / `csr` / `cms` render the non-certificate formats the same way — a CRL like `openssl crl -text` (issuer, Last/Next Update, CRL extensions, each revoked entry with its serial, revocation date, and named reason), a CSR like `openssl req -text` (subject, key, requested extensions and attributes), and a CMS message like `openssl cms -cmsout -print` (a SignedData's content type, digest algorithms, embedded certificates, and each SignerInfo with its signer identifier, algorithms, attributes, and signature; a non-SignedData ContentInfo gets a stable summary) — and `any(input)` detects the format and routes to the right report. Built over the strict parsers and the two-way OID registry, reusing one set of field renderers, so it names extension/algorithm OIDs an OpenSSL build shows only as raw bytes and never drifts. No OpenSSL dependency; the format is stable and OpenSSL-familiar rather than pinned to one OpenSSL version; a malformed part falls back to a hex dump rather than throwing — `certificate`, `crl`, `csr`, `cms`, `any` |
 | `pki.webauthn` | WebAuthn / passkey attestation verification — offline trust evaluation of a W3C WebAuthn (Level 3) attestation. `parseAttestationObject(bytes)` decodes the CBOR attestation object + authenticatorData + COSE credential key over the strict `pki.cbor` codec; `verify(attestationObject, clientDataHash, opts)` checks the attestation-statement signature and each format's structural bindings for **packed / tpm / android-key / apple / fido-u2f / none** — the x5c leaf key, the apple nonce, the tpm `certInfo` Name/`extraData` over the `pubArea`, the android `KeyDescription`, the fido-u2f `verificationData` — binding the credential public key to each attestation (via the signed authenticatorData for packed/fido-u2f, or a cert/`pubArea`-key equality check for android-key/apple/tpm) and enforcing each leaf's certificate requirements. The credential-key check covers the full WebAuthn COSE algorithm set — ES256/384/512, RS256/384/512, PS256, EdDSA (Ed25519), and the RFC 9864 fully-specified identifiers **ESP256/384/512, Ed25519, and Ed448** — validating the public-key point on its curve, rejecting the compressed EC point form, and enforcing a minimally-encoded DER ECDSA signature. A verifier, not a ceremony client; fail-closed with typed `webauthn/*` errors. Chaining the returned trust path to a pinned root (and aaguid→root via FIDO MDS) is the caller's step through `pki.path.validate` — `parseAttestationObject`, `verify` |
 | `pki.lint` | Certificate linting — the zlint / pkilint of JavaScript. `certificate(pem \| der \| parsed, opts)` walks a parsed certificate and emits graded, advisory findings — each with a stable id, a severity (`fatal` > `error` > `warn` > `notice`), a source, a spec-clause citation, and a message — against the RFC 5280 profile plus a representative CA/Browser Forum TLS BR subset (serial sign/size, validity ordering + the SC081v3 reducing validity schedule, keyCertSign coherence, extension criticality — basicConstraints/nameConstraints/policyConstraints/inhibitAnyPolicy must be critical and keyUsage should be, nameConstraints CA-scope, unknown critical extensions, empty-subject SAN, SKI/AKI presence including the end-entity subjectKeyIdentifier, SAN required + CN-in-SAN, dNSName syntax, serverAuth EKU, weak keys). Unlike every other entry the DATA path never throws: hostile bytes return a `fatal` `lint/unparseable` finding (with the strict parser's code) so a whole directory lints without a try/catch; only config-time misuse throws a typed `LintError`. `certificate`, `rules`, `profiles` |
 | `pki.C` / `pki.constants` | Version-stable constants — functional scale helpers (`C.TIME.*`, `C.BYTES.*`), codec `LIMITS`, `version` |

package/index.js

@@ -45,6 +45,7 @@ var csr       = require("./lib/csr-sign");
 var attrcert  = require("./lib/attrcert-sign");
 var crmf      = require("./lib/crmf-sign");
 var cmp       = require("./lib/cmp-build");
+var crl       = require("./lib/crl-sign");
 var merkle    = require("./lib/merkle");
 var shbs      = require("./lib/shbs");
 var hpke      = require("./lib/hpke");
@@ -108,6 +109,10 @@ module.exports = {
   // protected PKIMessage (a certificate request / confirmation / revocation / general message).
   // Parsing lives at pki.schema.cmp.parse.
   cmp:       cmp,
+  // `crl` is the RFC 5280 sec. 5 CRL producing side -- pki.crl.sign builds and signs a CertificateList
+  // over any registry algorithm, pki.crl.verify checks a CRL signature through the one path-validation
+  // signature engine, and pki.crl.isRevoked looks a serial up. Parsing lives at pki.schema.crl.parse.
+  crl:       crl,
   // `merkle` is the RFC 6962 / RFC 9162 Merkle-tree proof-verification core --
   // pki.merkle.leafHash / nodeHash / emptyRootHash build the domain-separated
   // (0x00 leaf / 0x01 node) SHA-256 tree hashes; pki.merkle.verifyInclusion and

package/lib/crl-sign.js

@@ -0,0 +1,574 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+
+/**
+ * @module     pki.crl
+ * @nav        Signing
+ * @title      CRLs
+ * @intro The X.509 CRL producing side. `pki.crl.sign` builds a `TBSCertList`, signs it, and emits a
+ *   `CertificateList` (RFC 5280 sec. 5) that `pki.schema.crl.parse`, `pki.path.crlChecker`, and OpenSSL
+ *   all accept -- over any signature algorithm the toolkit registry resolves: RSA (PKCS#1 v1.5 / PSS),
+ *   ECDSA, EdDSA, ML-DSA, SLH-DSA, and the composite (hybrid) arms. `pki.crl.verify` checks a CRL
+ *   signature through the one path-validation signature engine, and `pki.crl.isRevoked` looks a serial up
+ *   in a parsed CRL. Parsing lives at `pki.schema.crl.parse`.
+ * @spec RFC 5280
+ * @card Build, sign, and verify an X.509 CRL (RFC 5280 sec. 5) over any registry algorithm.
+ */
+//
+// The signature matrix comes from the shared sign-scheme resolver (the same registry pki.x509.sign /
+// pki.cms.sign drive), so a new algorithm is a registry row, never a branch here. The TBSCertList DER is
+// assembled through the canonical asn1.build.* layer + the shared pki-build producing primitives; the
+// strict schema-crl decoder round-trips it and OpenSSL cross-checks it. VERIFY composes the ONE
+// path-validate.verifyCrlSignature engine pki.path.crlChecker uses -- there is no second, weaker verifier.
+
+var asn1 = require("./asn1-der");
+var oid = require("./oid");
+var crlSchema = require("./schema-crl");
+var x509Schema = require("./schema-x509");
+var signScheme = require("./sign-scheme");
+var guard = require("./guard-all");
+var frameworkError = require("./framework-error");
+var pkix = require("./schema-pkix");
+var pkiBuild = require("./pki-build");
+var constants = require("./constants");
+require("./path-validate");   // side-effect: path-validate injects its signature engine into crl-verify at load
+var crlVerify = require("./crl-verify");
+
+var CrlError = frameworkError.CrlError;
+var NS = pkix.makeNS("crl", CrlError, oid);
+var NAME_SCHEMA = pkix.name(NS);
+var SPKI_SCHEMA = pkix.spki(NS);
+var b = asn1.build;
+var TAGS = asn1.TAGS;
+
+// Two error factories (x509-sign pattern): `_err` takes a full crl/* code; `_signE` prepends the domain so
+// the shared sign-scheme resolver/signer faults keep crl/* codes. Both are FACTORIES (guard.* and
+// resolveSignScheme invoke them as E(code, msg) with no `new`).
+function _err(code, message, cause) { return new CrlError(code, message, cause); }
+function _signE(kind, message, cause) { return new CrlError("crl/" + kind, message, cause); }
+function O(n) { return oid.byName(n); }
+
+// The shared PKIX producing primitives (lib/pki-build.js), bound to the crl namespace so they keep the
+// frozen crl/* codes (Hard rule #5 -- one encode definition, no per-format hand-roll).
+var _b = pkiBuild.makeBuilder({ ErrorClass: CrlError, prefix: "crl", O: O, NS: NS, NAME_SCHEMA: NAME_SCHEMA, SPKI_SCHEMA: SPKI_SCHEMA, EXT_DECODERS: {} });
+var _encodeName = _b.encodeName, _isEmptyName = _b.isEmptyName, _reqDer = _b.reqDer,
+  _assertValidSpki = _b.assertValidSpki, _assertValidExtension = _b.assertValidExtension,
+  _timeDer = _b.timeDer, _ext = _b.ext, _extAki = _b.extAki, _spkiKeyId = _b.spkiKeyId,
+  _serialInteger = _b.serialInteger, _encodeGeneralName = _b.encodeGeneralName,
+  _certLikeFromSpki = _b.certLikeFromSpki, _assertSignatureVerifies = _b.assertSignatureVerifies;
+// The RFC 5280 sec. 4.2.1 extension value decoders (shared with pki.schema.x509.parse), used to confirm an
+// issuer certificate's keyUsage asserts cRLSign before a CRL is signed under it.
+var EXT_DECODERS = pkix.certExtensionDecoders(NS).byOid;
+
+var OID_SKI = O("subjectKeyIdentifier");
+
+// CRLReason value<->name (RFC 5280 sec. 5.3.1). The value->name table is the frozen constants source;
+// build the name->value reverse once at load. Value 7 is unused/reserved and absent from the table.
+var CRL_REASON = constants.NAMES.CRL_REASON;
+var REASON_BY_NAME = {};
+Object.keys(CRL_REASON).forEach(function (v) { REASON_BY_NAME[CRL_REASON[v]] = Number(v); });
+
+var KNOWN_CRL_EXT_KEYS = { authorityKeyIdentifier: 1, issuingDistributionPoint: 1, deltaCRLIndicator: 1, freshestCRL: 1, authorityInfoAccess: 1 };
+var KNOWN_IDP_KEYS = { fullName: 1, onlyContainsUserCerts: 1, onlyContainsCACerts: 1, onlyContainsAttributeCerts: 1, indirectCRL: 1 };
+
+// RFC 5280 sec. 5.2 -- the profile-fixed criticality of each recognized CRL extension. cRLNumber (5.2.3),
+// authorityKeyIdentifier (5.2.1), freshestCRL (5.2.6), and authorityInfoAccess (5.2.7) MUST be non-critical;
+// issuingDistributionPoint (5.2.5) and deltaCRLIndicator (5.2.4) MUST be critical. Enforced on the object
+// form by construction AND on the pre-encoded escape hatch, so the hatch cannot bypass the profile.
+var REQUIRED_CRITICALITY = {};
+[["cRLNumber", false], ["authorityKeyIdentifier", false], ["freshestCRL", false], ["authorityInfoAccess", false],
+  ["issuingDistributionPoint", true], ["deltaCRLIndicator", true]].forEach(function (r) { REQUIRED_CRITICALITY[O(r[0])] = r[1]; });
+
+// RFC 5280 sec. 5.3 -- the profile-fixed criticality of each recognized crlEntryExtension: reasonCode (5.3.1)
+// and invalidityDate (5.3.2) MUST be non-critical; certificateIssuer (5.3.3) MUST be critical.
+var REQUIRED_ENTRY_CRITICALITY = {};
+[["reasonCode", false], ["invalidityDate", false]].forEach(function (r) { REQUIRED_ENTRY_CRITICALITY[O(r[0])] = r[1]; });
+
+// certificateIssuer (indirect CRLs) is deferred: pki.path.crlChecker skips a CRL carrying any critical entry
+// extension other than reasonCode (it does not track the per-entry issuer of an indirect CRL), so a CRL
+// signed with certificateIssuer would verify but never be authoritative for revocation. Reject it -- on both
+// the object form and the pre-encoded hatch -- until the checker processes indirect CRLs.
+var _CERT_ISSUER_DEFERRED = "certificateIssuer (indirect CRLs) is not yet supported -- pki.path.crlChecker skips a CRL carrying any critical entry extension other than reasonCode, so an indirect CRL would never be authoritative for revocation. Re-enabled once the checker processes certificateIssuer / indirect CRLs.";
+// The IDP indirectCRL flag marks the whole CRL as indirect, which crlChecker skips outright -- deferred for
+// the same reason as certificateIssuer, on both the object form and the pre-encoded hatch.
+var _INDIRECT_IDP_DEFERRED = "issuingDistributionPoint indirectCRL (indirect CRLs) is not yet supported -- pki.path.crlChecker skips a CRL whose IDP marks it indirect, so it would never be authoritative for revocation. Re-enabled once the checker processes indirect CRLs.";
+
+// ---- shared numeric / reason / key-id helpers ------------------------------
+
+// A non-negative INTEGER (0..MAX) of at most 20 content octets -- cRLNumber (sec. 5.2.3) and
+// deltaCRLIndicator baseCRLNumber (sec. 5.2.4). b.integer has no size cap of its own (unlike serialInteger).
+function _boundedInteger(v, label) {
+  var n;
+  if (typeof v === "bigint") n = v;
+  else if (typeof v === "number") { if (!Number.isSafeInteger(v)) throw _err("crl/bad-crl-number", label + " number must be a safe integer (pass a BigInt, hex string, or Buffer for a larger value)"); n = BigInt(v); }
+  else if (typeof v === "string") { try { n = BigInt(v); } catch (e) { throw _err("crl/bad-crl-number", label + " string must be a decimal or 0x-hex integer", e); } }
+  else if (Buffer.isBuffer(v)) { n = v.length ? BigInt("0x" + v.toString("hex")) : 0n; }
+  else throw _err("crl/bad-crl-number", label + " must be a BigInt, integer, hex string, or Buffer");
+  if (n < 0n) throw _err("crl/bad-crl-number", label + " must be non-negative (INTEGER 0..MAX, RFC 5280 sec. 5.2.3)");
+  var tlv = b.integer(n);
+  if (asn1.decode(tlv).content.length > 20) throw _err("crl/bad-crl-number", label + " must not exceed 20 octets (RFC 5280 sec. 5.2.3)");
+  return { tlv: tlv, value: n };
+}
+
+// Decode a pre-encoded Extension's extnValue (the trailing OCTET STRING's content) to one well-formed DER
+// node, or reject -- so a recognized extension's value is validated on the escape hatch, not emitted opaque.
+function _extInner(node, label) {
+  try { return asn1.decode(asn1.read.octetString(node.children[node.children.length - 1])); }
+  catch (e) { throw _err("crl/bad-input", "pre-encoded " + label + " extension value is not valid DER", e); }
+}
+// A pre-encoded cRLNumber / baseCRLNumber value: a non-negative INTEGER of at most 20 octets, or reject.
+function _requireBoundedInt(inner, label) {
+  if (inner.tagClass !== "universal" || inner.tagNumber !== TAGS.INTEGER) throw _err("crl/bad-crl-number", "pre-encoded " + label + " value must be an INTEGER (RFC 5280 sec. 5.2.3 / 5.2.4)");
+  var v = asn1.read.integer(inner);
+  if (v < 0n) throw _err("crl/bad-crl-number", label + " must be non-negative (RFC 5280 sec. 5.2.3)");
+  if (inner.content.length > 20) throw _err("crl/bad-crl-number", label + " must not exceed 20 octets (RFC 5280 sec. 5.2.3)");
+  return v;
+}
+
+// Resolve a CRLReason to its numeric code: validate membership, reject 7/undefined, gate removeFromCRL(8)
+// to a delta CRL. unspecified(0) is returned so the caller OMITS it (SHOULD be absent, sec. 5.3.1).
+function _resolveReason(reason, isDelta) {
+  var codeNum;
+  if (typeof reason === "number") codeNum = reason;
+  else if (typeof reason === "string") {
+    if (!Object.prototype.hasOwnProperty.call(REASON_BY_NAME, reason)) throw _err("crl/bad-reason-code", "unknown CRLReason " + JSON.stringify(reason));
+    codeNum = REASON_BY_NAME[reason];
+  } else throw _err("crl/bad-reason-code", "reason must be a CRLReason name or number");
+  if (!Object.prototype.hasOwnProperty.call(CRL_REASON, String(codeNum))) throw _err("crl/bad-reason-code", "undefined or reserved CRLReason " + codeNum + " (RFC 5280 sec. 5.3.1)");
+  if (codeNum === 8 && !isDelta) throw _err("crl/bad-reason-code", "removeFromCRL(8) may appear only in a delta CRL (RFC 5280 sec. 5.3.1)");
+  return codeNum;
+}
+
+// The AKI keyIdentifier from the issuer: an explicit Buffer, or true -> the issuer cert's subjectKeyIdentifier,
+// else the SHA-1 of the issuer SPKI (RFC 5280 sec. 5.2.1 key-identifier method).
+function _akiKeyId(val, ctx) {
+  if (Buffer.isBuffer(val)) return val;
+  if (val === true) {
+    if (ctx.issuerCert) {
+      var ski = (ctx.issuerCert.extensions || []).filter(function (e) { return e.oid === OID_SKI; })[0];
+      if (ski) { try { return asn1.read.octetString(asn1.decode(ski.value)); } catch (_e) { /* fall through to re-derive from the issuer SPKI */ } }
+    }
+    return _spkiKeyId(ctx.issuerSpki);
+  }
+  throw _err("crl/bad-input", "authorityKeyIdentifier must be true (auto-derive from the issuer) or a Buffer key id");
+}
+
+// ---- CRL extension value encoders (sec. 5.2) -------------------------------
+
+// IssuingDistributionPoint (sec. 5.2.5): critical; MUST NOT DER-encode to an empty SEQUENCE; at most one
+// scope boolean TRUE; onlyContainsAttributeCerts MUST be FALSE; DEFAULT-FALSE booleans omitted.
+function _idpValue(idp) {
+  if (!idp || typeof idp !== "object" || Array.isArray(idp) || Buffer.isBuffer(idp)) throw _err("crl/bad-idp", "issuingDistributionPoint must be an object");
+  Object.keys(idp).forEach(function (k) { if (!KNOWN_IDP_KEYS[k]) throw _err("crl/bad-idp", "unknown issuingDistributionPoint field " + JSON.stringify(k) + " (pass a pre-encoded Extension DER via the extensions array for an exotic field like onlySomeReasons)"); });
+  if (idp.onlyContainsAttributeCerts === true) throw _err("crl/bad-idp", "onlyContainsAttributeCerts=TRUE is not permitted for a conforming CRL issuer (RFC 5280 sec. 5.2.5)");
+  var children = [];
+  if (idp.fullName != null) {
+    var entries = Array.isArray(idp.fullName) ? idp.fullName : [idp.fullName];
+    if (!entries.length) throw _err("crl/bad-idp", "issuingDistributionPoint fullName must carry at least one GeneralName");
+    // distributionPoint [0] { fullName [0] IMPLICIT GeneralNames }
+    children.push(b.contextConstructed(0, b.contextConstructed(0, Buffer.concat(entries.map(_encodeGeneralName)))));
+  }
+  var scopeTrue = 0;
+  if (idp.onlyContainsUserCerts === true) { children.push(b.contextPrimitive(1, Buffer.from([0xff]))); scopeTrue++; }
+  if (idp.onlyContainsCACerts === true) { children.push(b.contextPrimitive(2, Buffer.from([0xff]))); scopeTrue++; }
+  if (idp.indirectCRL === true) throw _err("crl/bad-idp", _INDIRECT_IDP_DEFERRED);
+  if (scopeTrue > 1) throw _err("crl/bad-idp", "at most one of onlyContainsUserCerts / onlyContainsCACerts may be TRUE (RFC 5280 sec. 5.2.5)");
+  if (!children.length) throw _err("crl/bad-idp", "issuingDistributionPoint MUST NOT be empty (RFC 5280 sec. 5.2.5)");
+  return b.sequence(children);
+}
+
+// Validate a pre-encoded IssuingDistributionPoint value against the same RFC 5280 sec. 5.2.5 profile the
+// object form enforces: MUST NOT be empty; at most one of onlyContainsUserCerts [1] / onlyContainsCACerts [2]
+// TRUE; onlyContainsAttributeCerts [5] MUST be FALSE; indirectCRL [4] deferred (crlChecker skips indirect CRLs).
+function _validatePreEncodedIdp(inner) {
+  if (!inner.children || !inner.children.length) throw _err("crl/bad-idp", "pre-encoded issuingDistributionPoint MUST NOT be empty (RFC 5280 sec. 5.2.5)");
+  var scopeTrue = 0;
+  inner.children.forEach(function (c) {
+    if (c.tagClass !== "context") throw _err("crl/bad-idp", "pre-encoded issuingDistributionPoint members must be context-tagged (RFC 5280 sec. 5.2.5)");
+    var isTrue = c.content != null && c.content.length > 0 && c.content[c.content.length - 1] !== 0x00;   // a present DEFAULT-FALSE boolean is TRUE
+    if (c.tagNumber === 4) throw _err("crl/bad-idp", _INDIRECT_IDP_DEFERRED);   // indirectCRL
+    if (c.tagNumber === 5 && isTrue) throw _err("crl/bad-idp", "onlyContainsAttributeCerts=TRUE is not permitted for a conforming CRL issuer (RFC 5280 sec. 5.2.5)");
+    if ((c.tagNumber === 1 || c.tagNumber === 2) && isTrue) scopeTrue++;
+  });
+  if (scopeTrue > 1) throw _err("crl/bad-idp", "at most one of onlyContainsUserCerts / onlyContainsCACerts may be TRUE (RFC 5280 sec. 5.2.5)");
+}
+
+// freshestCRL / CRLDistributionPoints (sec. 5.2.6): SEQUENCE OF DistributionPoint carrying only
+// distributionPoint (reasons + cRLIssuer omitted). Accepts an array of GeneralName entries (one DP's
+// fullName) or an array of { fullName } distribution points.
+function _freshestValue(spec) {
+  if (!Array.isArray(spec) || !spec.length) throw _err("crl/bad-input", "freshestCRL must be a non-empty array of GeneralNames (or { fullName } distribution points)");
+  var dps = spec.every(function (e) { return e && typeof e === "object" && !Buffer.isBuffer(e) && Object.keys(e).length === 1 && e.fullName != null; })
+    ? spec.map(function (dp) { return dp.fullName; })
+    : [spec];
+  return b.sequence(dps.map(function (fullName) {
+    var entries = Array.isArray(fullName) ? fullName : [fullName];
+    if (!entries.length) throw _err("crl/bad-input", "a freshestCRL distribution point must carry at least one GeneralName (GeneralNames is SIZE(1..MAX), RFC 5280 sec. 4.2.1.13)");
+    return b.sequence([b.contextConstructed(0, b.contextConstructed(0, Buffer.concat(entries.map(_encodeGeneralName))))]);
+  }));
+}
+
+// authorityInfoAccess (sec. 5.2.7): SEQUENCE OF AccessDescription, caIssuers-only. Accepts an array of
+// GeneralName entries, each a caIssuers accessLocation.
+function _aiaValue(spec) {
+  if (!Array.isArray(spec) || !spec.length) throw _err("crl/bad-input", "authorityInfoAccess must be a non-empty array of caIssuers GeneralNames");
+  var caIssuers = O("caIssuers");
+  return b.sequence(spec.map(function (gn) { return b.sequence([b.oid(caIssuers), _encodeGeneralName(gn)]); }));
+}
+
+// The crlExtensions [0] set. Fixed per-extension criticality (sec. 5.2); at most one instance of each
+// (sec. 5.2). `spec.extensions` is an object of the recognized keys OR an array of pre-encoded Extension
+// DER (escape hatch for an extension the object form does not model). Returns { exts, isDelta }.
+function _buildCrlExtensions(spec, ctx) {
+  var out = [], seen = {}, isDelta = false;
+  function push(oidName, critical, valueDer) {
+    var id = O(oidName);
+    if (seen[id]) throw _err("crl/bad-input", "duplicate CRL extension " + oidName + " (RFC 5280 sec. 5.2 -- at most one instance)");
+    seen[id] = true;
+    out.push(_ext(id, critical, valueDer));
+  }
+  var crlNumberVal = null;
+  if (spec.crlNumber != null) { var cn = _boundedInteger(spec.crlNumber, "cRLNumber"); crlNumberVal = cn.value; push("cRLNumber", false, cn.tlv); }
+  var ext = spec.extensions;
+  if (ext == null) return { exts: out, isDelta: isDelta };
+  if (Array.isArray(ext)) {
+    var arrBase = null, arrCrlNum = null;
+    ext.forEach(function (e, i) {
+      var der = _reqDer(e, "extension");
+      _assertValidExtension(der, i);
+      var node = asn1.decode(der);
+      var extnId = asn1.read.oid(node.children[0]);
+      if (seen[extnId]) throw _err("crl/bad-input", "duplicate extension " + extnId + " (RFC 5280 sec. 5.2)");
+      seen[extnId] = true;
+      // RFC 5280 sec. 5.2 -- a recognized CRL extension is held to the profile even via the escape hatch: its
+      // fixed criticality (assertValidExtension rejects an explicit critical=FALSE, so 3 children == critical,
+      // 2 == non-critical) AND a well-formed value of the right type (INTEGER for cRLNumber/deltaCRLIndicator,
+      // else a SEQUENCE), never emitted opaque.
+      if (Object.prototype.hasOwnProperty.call(REQUIRED_CRITICALITY, extnId)) {
+        if ((node.children.length === 3) !== REQUIRED_CRITICALITY[extnId]) {
+          throw _err("crl/bad-input", "pre-encoded " + (oid.name(extnId) || extnId) + " extension has the wrong criticality (RFC 5280 sec. 5.2 requires it " + (REQUIRED_CRITICALITY[extnId] ? "critical" : "non-critical") + ")");
+        }
+        var inner = _extInner(node, oid.name(extnId) || extnId);
+        if (extnId === O("cRLNumber")) arrCrlNum = _requireBoundedInt(inner, "cRLNumber");
+        else if (extnId === O("deltaCRLIndicator")) arrBase = _requireBoundedInt(inner, "deltaCRLIndicator baseCRLNumber");
+        else {
+          if (inner.tagClass !== "universal" || inner.tagNumber !== TAGS.SEQUENCE) throw _err("crl/bad-input", "pre-encoded " + (oid.name(extnId) || extnId) + " extension value must be a SEQUENCE (RFC 5280 sec. 5.2)");
+          // A pre-encoded IssuingDistributionPoint is held to the same sec. 5.2.5 profile as the object form.
+          if (extnId === O("issuingDistributionPoint")) _validatePreEncodedIdp(inner);
+        }
+      }
+      if (extnId === O("deltaCRLIndicator")) isDelta = true;
+      out.push(b.raw(der));
+    });
+    // RFC 5280 sec. 5.2.3 / 5.2.4 -- a delta CRL MUST carry a cRLNumber greater than its baseCRLNumber, whether
+    // that cRLNumber is pre-encoded here or supplied via spec.crlNumber; the escape hatch is held to the same rule.
+    if (isDelta) {
+      // RFC 5280 sec. 5.2.6 -- freshestCRL MUST NOT appear in a delta CRL, including via the pre-encoded hatch.
+      if (seen[O("freshestCRL")]) throw _err("crl/bad-input", "freshestCRL MUST NOT appear in a delta CRL (RFC 5280 sec. 5.2.6)");
+      var eff = crlNumberVal != null ? crlNumberVal : arrCrlNum;
+      if (eff == null) throw _err("crl/bad-input", "a delta CRL MUST include a cRLNumber (RFC 5280 sec. 5.2.3 / 5.2.4)");
+      if (arrBase != null && eff <= arrBase) throw _err("crl/bad-crl-number", "a delta CRL's cRLNumber MUST be greater than its baseCRLNumber (RFC 5280 sec. 5.2.4)");
+    }
+    return { exts: out, isDelta: isDelta };
+  }
+  if (typeof ext !== "object") throw _err("crl/bad-input", "extensions must be an object or an array of pre-encoded Extension DER");
+  Object.keys(ext).forEach(function (k) { if (!KNOWN_CRL_EXT_KEYS[k]) throw _err("crl/bad-input", "unknown CRL extension " + JSON.stringify(k) + " in the extensions spec; pass a pre-encoded Extension DER via the array form"); });
+  isDelta = ext.deltaCRLIndicator != null;
+  if (ext.authorityKeyIdentifier != null) push("authorityKeyIdentifier", false, _extAki(_akiKeyId(ext.authorityKeyIdentifier, ctx)));
+  if (ext.issuingDistributionPoint != null) push("issuingDistributionPoint", true, _idpValue(ext.issuingDistributionPoint));
+  if (ext.deltaCRLIndicator != null) {
+    var base = _boundedInteger(ext.deltaCRLIndicator, "deltaCRLIndicator baseCRLNumber");
+    // RFC 5280 sec. 5.2.3 / 5.2.4 -- a conforming delta CRL MUST carry a cRLNumber (sec. 5.2.3 requires it in
+    // every CRL), and that cRLNumber MUST be greater than the BaseCRLNumber it is built against (sec. 5.2.4).
+    if (crlNumberVal == null) throw _err("crl/bad-input", "a delta CRL MUST include a cRLNumber (set spec.crlNumber) (RFC 5280 sec. 5.2.3 / 5.2.4)");
+    if (crlNumberVal <= base.value) throw _err("crl/bad-crl-number", "a delta CRL's cRLNumber (" + crlNumberVal + ") MUST be greater than its baseCRLNumber (" + base.value + ") (RFC 5280 sec. 5.2.4)");
+    push("deltaCRLIndicator", true, base.tlv);
+  }
+  if (ext.freshestCRL != null) {
+    if (isDelta) throw _err("crl/bad-input", "freshestCRL MUST NOT appear in a delta CRL (RFC 5280 sec. 5.2.6)");
+    push("freshestCRL", false, _freshestValue(ext.freshestCRL));
+  }
+  if (ext.authorityInfoAccess != null) push("authorityInfoAccess", false, _aiaValue(ext.authorityInfoAccess));
+  return { exts: out, isDelta: isDelta };
+}
+
+// The revokedCertificates entries (sec. 5.1.2.6 / 5.3). Each entry: serial + revocationDate + optional
+// crlEntryExtensions (reasonCode ENUMERATED, invalidityDate GeneralizedTime-only, certificateIssuer, or a
+// pre-encoded escape hatch). Returns { entries, anyExt } -- anyExt forces v2 (sec. 5.1.2.1).
+function _buildRevoked(entryList, isDelta) {
+  if (!Array.isArray(entryList)) throw _err("crl/bad-input", "revoked must be an array of revoked-certificate entries");
+  var anyExt = false, seenSerials = {};
+  var entries = entryList.map(function (e, idx) {
+    if (!e || typeof e !== "object" || Buffer.isBuffer(e)) throw _err("crl/bad-input", "each revoked entry must be an object");
+    if (e.serialNumber == null) throw _err("crl/bad-input", "revoked entry [" + idx + "] requires a serialNumber");
+    var serialTlv = _serialInteger(e.serialNumber);
+    // RFC 5280 sec. 5.1.2.6 -- a serial number identifies a certificate uniquely, so a CRL MUST NOT list the
+    // same serial twice; dedup on the DER content (the same value the parser surfaces as serialNumberHex).
+    var serialKey = asn1.decode(serialTlv).content.toString("hex");
+    if (seenSerials[serialKey]) throw _err("crl/bad-input", "revoked entry [" + idx + "] duplicates a serial number already listed in this CRL (RFC 5280 sec. 5.1.2.6)");
+    seenSerials[serialKey] = true;
+    var children = [serialTlv, _timeDer(e.revocationDate, "revocationDate")];
+    var entryExts = [], seen = {};
+    function pushE(oidName, critical, valueDer) {
+      var id = O(oidName);
+      if (seen[id]) throw _err("crl/bad-input", "duplicate entry extension " + oidName + " in revoked entry [" + idx + "]");
+      seen[id] = true;
+      entryExts.push(_ext(id, critical, valueDer));
+    }
+    if (e.reason != null) {
+      var codeNum = _resolveReason(e.reason, isDelta);
+      if (codeNum !== 0) pushE("reasonCode", false, b.enumerated(BigInt(codeNum)));   // unspecified(0) omitted (sec. 5.3.1)
+    }
+    if (e.invalidityDate != null) {
+      guard.time.assertValid(e.invalidityDate, _err, "crl/bad-input", "invalidityDate");
+      // sec. 5.3.2 -- ALWAYS GeneralizedTime (never the UTCTime cutover), no fractional seconds.
+      pushE("invalidityDate", false, b.generalizedTime(e.invalidityDate));
+    }
+    if (e.certificateIssuer != null) throw _err("crl/bad-input", _CERT_ISSUER_DEFERRED);
+    if (e.extensions != null) {
+      if (!Array.isArray(e.extensions)) throw _err("crl/bad-input", "revoked entry [" + idx + "] extensions must be an array of pre-encoded Extension DER");
+      e.extensions.forEach(function (x, j) {
+        var der = _reqDer(x, "entry extension");
+        _assertValidExtension(der, j);
+        var xnode = asn1.decode(der);
+        var extnId = asn1.read.oid(xnode.children[0]);
+        if (seen[extnId]) throw _err("crl/bad-input", "duplicate entry extension " + extnId + " in revoked entry [" + idx + "]");
+        seen[extnId] = true;
+        // certificateIssuer (indirect CRLs) is not usable end-to-end yet (crlChecker skips such a CRL); reject it.
+        if (extnId === O("certificateIssuer")) throw _err("crl/bad-input", _CERT_ISSUER_DEFERRED);
+        // RFC 5280 sec. 5.3 -- a recognized entry extension is held to the profile even via the escape hatch:
+        // its fixed criticality AND a well-formed value of the right type (reasonCode an ENUMERATED in the
+        // legal set, invalidityDate a GeneralizedTime).
+        if (Object.prototype.hasOwnProperty.call(REQUIRED_ENTRY_CRITICALITY, extnId)) {
+          if ((xnode.children.length === 3) !== REQUIRED_ENTRY_CRITICALITY[extnId]) throw _err("crl/bad-input", "pre-encoded entry extension " + (oid.name(extnId) || extnId) + " has the wrong criticality (RFC 5280 sec. 5.3 requires it " + (REQUIRED_ENTRY_CRITICALITY[extnId] ? "critical" : "non-critical") + ")");
+          var einner = _extInner(xnode, oid.name(extnId) || extnId);
+          if (extnId === O("reasonCode")) {
+            if (einner.tagClass !== "universal" || einner.tagNumber !== TAGS.ENUMERATED) throw _err("crl/bad-reason-code", "pre-encoded reasonCode value must be an ENUMERATED (RFC 5280 sec. 5.3.1)");
+            var rc = asn1.read.enumerated(einner);
+            if (!Object.prototype.hasOwnProperty.call(CRL_REASON, rc.toString())) throw _err("crl/bad-reason-code", "pre-encoded reasonCode " + rc + " is undefined or reserved (RFC 5280 sec. 5.3.1)");
+            if (rc === 8n && !isDelta) throw _err("crl/bad-reason-code", "removeFromCRL(8) may appear only in a delta CRL (RFC 5280 sec. 5.3.1)");
+          } else if (extnId === O("invalidityDate")) {
+            if (einner.tagClass !== "universal" || einner.tagNumber !== TAGS.GENERALIZED_TIME) throw _err("crl/bad-input", "pre-encoded invalidityDate value must be a GeneralizedTime (RFC 5280 sec. 5.3.2)");
+            try { asn1.read.time(einner); } catch (e) { throw _err("crl/bad-input", "pre-encoded invalidityDate is not a well-formed GeneralizedTime (RFC 5280 sec. 5.3.2)", e); }
+          }
+        }
+        entryExts.push(b.raw(der));
+      });
+    }
+    if (entryExts.length) { anyExt = true; children.push(b.sequence(entryExts)); }
+    return b.sequence(children);
+  });
+  return { entries: entries, anyExt: anyExt };
+}
+
+// ---- the primitives --------------------------------------------------------
+
+function _parseIssuerCert(cert) {
+  var parsed = (Buffer.isBuffer(cert) || typeof cert === "string") ? x509Schema.parse(cert) : cert;
+  if (!parsed || !parsed.tbsBytes || !parsed.subjectPublicKeyInfo) throw _err("crl/bad-input", "issuer.cert must be a certificate DER/PEM or a parsed certificate");
+  return parsed;
+}
+
+// RFC 5280 sec. 4.2.1.3 -- a certificate whose key signs CRLs asserts the cRLSign keyUsage bit. When the
+// issuer certificate carries a keyUsage extension it MUST include cRLSign, or the CRL it signs is rejected
+// by a conforming relying party (pki.path.crlChecker included). Mirrors x509-sign's keyCertSign gate; a
+// certificate with no keyUsage extension is unrestricted.
+function _assertIssuerCanSignCrl(issuerCert) {
+  var kuExt = (issuerCert.extensions || []).filter(function (e) { return e.oid === O("keyUsage"); })[0];
+  if (!kuExt) return;
+  var ku;
+  try { ku = EXT_DECODERS[O("keyUsage")](kuExt.value); }
+  catch (e) { if (e instanceof CrlError) throw e; throw _err("crl/bad-input", "the issuer certificate keyUsage is malformed", e); }
+  if (ku.cRLSign !== true) throw _err("crl/bad-input", "the issuer certificate keyUsage does not assert cRLSign -- it cannot sign CRLs (RFC 5280 sec. 4.2.1.3)");
+}
+
+function _sign(spec, issuer, opts) {
+  opts = opts || {};
+  if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("crl/bad-input", "the CRL spec must be an object");
+  issuer = issuer || {};
+  if (issuer.key == null) throw _err("crl/bad-input", "a signing key (issuer.key, a PKCS#8 private key) is required");
+
+  // Resolve the issuer name + signing-key SPKI. `{ cert }` supplies both; else `{ name|spec.issuer, publicKey }`.
+  var issuerDer, issuerSpki, issuerCert = null;
+  if (issuer.cert != null) {
+    issuerCert = _parseIssuerCert(issuer.cert);
+    _assertIssuerCanSignCrl(issuerCert);
+    issuerDer = pkiBuild.tbsNameField(issuerCert, "subject");
+    issuerSpki = issuerCert.subjectPublicKeyInfo.bytes;
+  } else {
+    issuerSpki = _reqDer(issuer.publicKey, "issuer.publicKey (the issuer SPKI DER)");
+    _assertValidSpki(issuerSpki, "issuer.publicKey");
+    var dnSource = issuer.name != null ? issuer.name : spec.issuer;
+    if (dnSource == null) throw _err("crl/bad-issuer", "an issuer distinguished name is required (issuer.name or spec.issuer) when no issuer.cert is given");
+    issuerDer = _encodeName(dnSource);
+  }
+  // RFC 5280 sec. 5.1.2.3 -- the issuer MUST be a non-empty distinguished name.
+  if (_isEmptyName(issuerDer)) throw _err("crl/bad-issuer", "issuer must be a non-empty distinguished name (RFC 5280 sec. 5.1.2.3)");
+
+  // thisUpdate (required) + nextUpdate (optional; MUST NOT precede thisUpdate). _timeDer validates each date
+  // and applies the RFC 5280 sec. 5.1.2.4/.5 UTCTime<=2049-else-GeneralizedTime cutover.
+  if (spec.thisUpdate == null) throw _err("crl/bad-input", "thisUpdate is required (RFC 5280 sec. 5.1.2.4)");
+  var thisU = _timeDer(spec.thisUpdate, "thisUpdate");
+  var nextU = null;
+  if (spec.nextUpdate != null) {
+    nextU = _timeDer(spec.nextUpdate, "nextUpdate");
+    // allow:nan-date-comparison-unguarded -- both operands are guard.time.assertValid'd via _timeDer on the
+    // two lines above (thisUpdate + nextUpdate), so an Invalid Date throws before this comparison.
+    if (spec.nextUpdate.getTime() < spec.thisUpdate.getTime()) throw _err("crl/bad-input", "nextUpdate must not be before thisUpdate (RFC 5280 sec. 5.1.2.5)");
+  }
+
+  var extResult = _buildCrlExtensions(spec, { issuerCert: issuerCert, issuerSpki: issuerSpki });
+  var crlExts = extResult.exts;
+  var revoked = spec.revoked != null ? _buildRevoked(spec.revoked, extResult.isDelta) : { entries: [], anyExt: false };
+  // RFC 5280 sec. 5.1.2.1 -- v2 iff any CRL or entry extension is present, else v1 (version omitted).
+  var version = (crlExts.length || revoked.anyExt) ? 2 : 1;
+
+  // The signature scheme resolves from the SIGNING key's SPKI algorithm (the whole registry, for free).
+  var scheme = signScheme.resolveSignScheme(_certLikeFromSpki(issuerSpki), { combinedRsaSig: true, pss: opts.pss, digestAlgorithm: opts.digestAlgorithm }, true, _signE);
+
+  var tbsChildren = [];
+  if (version === 2) tbsChildren.push(b.integer(1n));   // bare INTEGER(1), NOT a [0] EXPLICIT tag like a certificate
+  tbsChildren.push(scheme.sigAlgId);                    // signature == signatureAlgorithm (sec. 5.1.1.2), single source
+  tbsChildren.push(issuerDer);
+  tbsChildren.push(thisU);
+  if (nextU) tbsChildren.push(nextU);
+  if (revoked.entries.length) tbsChildren.push(b.sequence(revoked.entries));   // omit the field when empty (sec. 5.1.2.6)
+  if (crlExts.length) tbsChildren.push(b.explicit(0, b.sequence(crlExts)));    // crlExtensions [0] EXPLICIT
+  var tbsDer = b.sequence(tbsChildren);
+
+  return signScheme.signOverTbs(scheme, issuer.key, tbsDer, _signE).then(function (sig) {
+    // The signature MUST verify under the issuer public key before returning, or the CRL would be rejected
+    // downstream (composite returns a promise; the classical/PQC path throws synchronously on a mismatch).
+    return Promise.resolve(_assertSignatureVerifies(tbsDer, sig, issuerSpki, scheme)).then(function () {
+      var crlDer = b.sequence([tbsDer, scheme.sigAlgId, b.bitString(sig, 0)]);
+      return opts.pem ? crlSchema.pemEncode(crlDer, "X509 CRL") : crlDer;
+    });
+  }, function (e) {
+    if (e instanceof CrlError) throw e;
+    throw _err("crl/bad-input", "signing the CRL failed -- the signing key does not match the resolved algorithm or is invalid", e);
+  });
+}
+
+/**
+ * @primitive pki.crl.sign
+ * @signature pki.crl.sign(spec, issuer, opts?) -> Promise<Buffer|string>
+ * @since 0.3.9
+ * @status experimental
+ * @spec RFC 5280 sec. 5, RFC 9882, RFC 9814
+ * @defends crl-forgery (CWE-347)
+ * @related pki.schema.crl.parse, pki.crl.verify, pki.path.crlChecker
+ *
+ * Build, sign, and DER-encode an X.509 certificate revocation list. `spec` describes the CRL --
+ * `thisUpdate` / `nextUpdate` (`Date`s), an optional `crlNumber`, a `revoked` array (each entry a
+ * `serialNumber` + `revocationDate` with an optional `reason` or `invalidityDate`),
+ * and an optional `extensions` object (`authorityKeyIdentifier`, `issuingDistributionPoint`,
+ * `deltaCRLIndicator`, `freshestCRL`, `authorityInfoAccess`) or an array of pre-encoded `Extension` DER.
+ * `issuer` is the signing side: `{ cert, key }` takes the issuer DN + SPKI from a CA certificate;
+ * `{ name, publicKey, key }` (or `spec.issuer` + `{ publicKey, key }`) supplies them explicitly. The
+ * signature algorithm is resolved from the signing key, so every algorithm the toolkit signs with (RSA
+ * PKCS#1 v1.5 / PSS, ECDSA, EdDSA, ML-DSA, SLH-DSA, composite) is available without a per-algorithm branch.
+ *
+ * The version is derived from the field set (v2 when any CRL or entry extension is present, else v1). The
+ * outer `signatureAlgorithm` is emitted from the same source as `tbsCertList.signature` (sec. 5.1.1.2); an
+ * empty revocation list omits `revokedCertificates` rather than emitting an empty SEQUENCE (sec. 5.1.2.6);
+ * `reasonCode` is an ENUMERATED and `invalidityDate` is always GeneralizedTime (sec. 5.3.1/5.3.2);
+ * per-extension criticality is fixed by the RFC; and the produced signature is verified under the issuer
+ * key before return. A violation throws a typed `CrlError`.
+ *
+ * @opts
+ *   - `pem` (boolean) -- return a PEM `X509 CRL` string instead of DER.
+ *   - `pss` (boolean) -- sign an RSA key with RSASSA-PSS rather than PKCS#1 v1.5.
+ *   - `digestAlgorithm` (string) -- override the message digest where the algorithm permits a choice.
+ * @example
+ *   var der = await pki.crl.sign({
+ *     thisUpdate: new Date("2026-01-01T00:00:00Z"), nextUpdate: new Date("2026-02-01T00:00:00Z"),
+ *     crlNumber: 7n,
+ *     revoked: [{ serialNumber: 0x1234n, revocationDate: new Date("2026-01-15T00:00:00Z"), reason: "keyCompromise" }],
+ *     extensions: { authorityKeyIdentifier: true },
+ *   }, { cert: signerCertDer, key: signerKeyPkcs8 });
+ *   pki.schema.crl.parse(der).revokedCertificates[0].serialNumberHex;   // "1234"
+ */
+function sign(spec, issuer, opts) { return Promise.resolve().then(function () { return _sign(spec, issuer, opts); }); }
+
+function _coerceCrl(crl) {
+  if (Buffer.isBuffer(crl) || typeof crl === "string") return crlSchema.parse(crl);
+  if (crl && typeof crl === "object" && crl.tbsBytes && crl.signatureValue && crl.signatureAlgorithm) return crl;
+  throw _err("crl/bad-input", "crl must be a CRL DER Buffer, a PEM string, or a parsed CRL (from pki.schema.crl.parse)");
+}
+
+function _resolveIssuerSpki(issuer) {
+  if (issuer == null) throw _err("crl/bad-input", "an issuer is required to verify a CRL");
+  if (Buffer.isBuffer(issuer)) { _assertValidSpki(issuer, "issuer SPKI"); return issuer; }
+  if (issuer.cert != null) return _parseIssuerCert(issuer.cert).subjectPublicKeyInfo.bytes;
+  if (issuer.publicKey != null) { var spki = _reqDer(issuer.publicKey, "issuer.publicKey"); _assertValidSpki(spki, "issuer.publicKey"); return spki; }
+  if (issuer.subjectPublicKeyInfo && issuer.subjectPublicKeyInfo.bytes) return issuer.subjectPublicKeyInfo.bytes;   // a parsed certificate
+  throw _err("crl/bad-input", "issuer must be { cert }, { publicKey } (SPKI DER), or a raw SPKI Buffer");
+}
+
+/**
+ * @primitive pki.crl.verify
+ * @signature pki.crl.verify(crl, issuer) -> Promise<boolean>
+ * @since 0.3.9
+ * @status experimental
+ * @spec RFC 5280 sec. 5.1.1.3, RFC 9814
+ * @defends crl-signature-bypass (CWE-347)
+ * @related pki.crl.sign, pki.path.crlChecker, pki.schema.crl.parse
+ *
+ * Verify a CRL's signature over its exact parsed `tbsCertList` bytes under the issuer public key. `crl`
+ * is a DER `Buffer`, a PEM string, or a parsed CRL; `issuer` is `{ cert }` (DER/PEM/parsed), `{ publicKey }`
+ * (SPKI DER), or a raw SPKI `Buffer`. Verification composes the one path-validation signature engine
+ * `pki.path.crlChecker` uses -- the same algorithm-confusion (RFC 9814 sec. 4 key-OID == sig-OID) and
+ * EdDSA low-order-point gates -- so there is no second, weaker CRL verifier. It fails closed to `false` on
+ * any resolution, import, or verification fault; malformed input throws a typed `CrlError`. This checks the
+ * signature only -- issuer authorization, currency, and distribution-point scope are `pki.path.crlChecker`.
+ *
+ * @example
+ *   var ok = await pki.crl.verify(crlDer, { publicKey: signerSpki });   // true / false
+ */
+function verify(crl, issuer) { return Promise.resolve().then(function () { return _verify(crl, issuer); }); }
+function _verify(crl, issuer) {
+  var parsed = _coerceCrl(crl);
+  var spki = _resolveIssuerSpki(issuer);
+  return crlVerify.verifyCrlSignature(parsed, spki);
+}
+
+function _serialHexOf(serial) {
+  var v;
+  if (typeof serial === "bigint") v = serial;
+  else if (typeof serial === "number") { if (!Number.isSafeInteger(serial)) throw _err("crl/bad-input", "serialNumber number must be a safe integer (pass a BigInt, hex string, or Buffer)"); v = BigInt(serial); }
+  else if (typeof serial === "string") { try { v = BigInt(serial); } catch (e) { throw _err("crl/bad-input", "serialNumber string must be a decimal or 0x-hex integer", e); } }
+  else if (Buffer.isBuffer(serial)) { v = serial.length ? BigInt("0x" + serial.toString("hex")) : 0n; }
+  else throw _err("crl/bad-input", "serialNumber must be a BigInt, integer, hex string, or Buffer");
+  if (v <= 0n) throw _err("crl/bad-input", "serialNumber must be a positive integer");
+  // Match schema-crl's serialNumberHex: the DER INTEGER content octets (preserving sign padding).
+  return asn1.decode(b.integer(v)).content.toString("hex");
+}
+
+/**
+ * @primitive pki.crl.isRevoked
+ * @signature pki.crl.isRevoked(crl, serialNumber) -> entry | null
+ * @since 0.3.9
+ * @status experimental
+ * @spec RFC 5280 sec. 5.1.2.6
+ * @related pki.crl.verify, pki.schema.crl.parse
+ *
+ * Look a certificate serial number up in a CRL's `revokedCertificates` list. `crl` is a DER `Buffer`, a
+ * PEM string, or a parsed CRL; `serialNumber` is a `BigInt`, a safe integer, a decimal / `0x`-hex string,
+ * or a magnitude `Buffer`. Returns the matching revoked-certificate entry (`{ serialNumber, serialNumberHex,
+ * revocationDate, crlEntryExtensions }`) or `null` when the serial is not listed. A structural lookup only --
+ * it does NOT verify the CRL signature or its currency; call `pki.crl.verify` / `pki.path.crlChecker` for that.
+ *
+ * @example
+ *   pki.crl.isRevoked(crlDer, 0x1234n) ? "revoked" : "not listed";
+ */
+function isRevoked(crl, serialNumber) {
+  var parsed = _coerceCrl(crl);
+  var hex = _serialHexOf(serialNumber);
+  for (var i = 0; i < parsed.revokedCertificates.length; i++) {
+    if (parsed.revokedCertificates[i].serialNumberHex === hex) return parsed.revokedCertificates[i];
+  }
+  return null;
+}
+
+module.exports = { sign: sign, verify: verify, isRevoked: isRevoked };

package/lib/crl-verify.js

@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- the ONE CRL signature-verify seam, shared by pki.path.crlChecker and pki.crl.verify so both
+// route through the SAME signature engine (algorithm-confusion + EdDSA low-order + composite gates) and no
+// second, weaker CRL verifier can drift. path-validate owns that engine (_verifyWithSpki) and injects it
+// here at its module load (setEngine). Keeping the seam in this internal module -- rather than on
+// path-validate's module.exports -- keeps it OFF the public pki.path surface (it takes the path-internal
+// SubjectPublicKeyInfo bytes, not a documented issuer shape). NOT wired into index.js; reached only by require.
+
+var guard = require("./guard-all");
+
+var _engine = null;   // path-validate's _verifyWithSpki, injected at path-validate's module load via setEngine.
+
+function setEngine(verifyWithSpki) { _engine = verifyWithSpki; }
+
+// Verify a parsed CRL's signature over its raw tbsCertList bytes under the issuer SubjectPublicKeyInfo DER.
+// Fail-closed to false on a non-octet-aligned signature or any engine fault (the engine never throws out).
+function verifyCrlSignature(crl, spkiBytes) {
+  // _engine is injected by path-validate at its module load (setEngine); pki.crl.sign requires path-validate
+  // for exactly that side-effect, so the engine is always set before a verify runs.
+  if (!guard.crypto.isOctetAligned(crl.signatureValue)) return Promise.resolve(false);   // non-octet-aligned signature
+  return _engine(crl.signatureAlgorithm, crl.signatureValue.bytes, spkiBytes, crl.tbsBytes);
+}
+
+module.exports = { setEngine: setEngine, verifyCrlSignature: verifyCrlSignature };

package/lib/inspect.js

@@ -27,6 +27,10 @@ var constants = require("./constants");
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
 var x509 = require("./schema-x509");
+var crl = require("./schema-crl");
+var csr = require("./schema-csr");
+var cms = require("./schema-cms");
+var schemaAll = require("./schema-all");
 var pkix = require("./schema-pkix");
 var guard = require("./guard-all");
 
@@ -590,8 +594,395 @@ function certificate(input) {
   return L.join("\n") + "\n";
 }
 
+// ---- CRL / CSR / CMS coercion (the _parse model, per format) -----------------
+
+// Each fast-path completeness check mirrors _looksParsed: a bare/partial object
+// with only the marker field is NOT a parsed result, so it throws the documented
+// typed inspect/bad-input rather than dereferencing a missing field.
+function _looksParsedCrl(o) {
+  return typeof o.version === "number" && o.issuer && typeof o.issuer === "object" &&
+    o.thisUpdate != null && Array.isArray(o.revokedCertificates) && Array.isArray(o.crlExtensions) &&
+    o.signatureAlgorithm && typeof o.signatureAlgorithm === "object";
+}
+function _looksParsedCsr(o) {
+  return typeof o.version === "number" && o.subject && typeof o.subject === "object" &&
+    o.subjectPublicKeyInfo && typeof o.subjectPublicKeyInfo === "object" &&
+    Array.isArray(o.attributes) && o.signatureAlgorithm && typeof o.signatureAlgorithm === "object";
+}
+function _looksParsedCms(o) {
+  if (typeof o.contentType !== "string" || typeof o.contentTypeName !== "string" || typeof o.version !== "number") return false;
+  // A real parse result is one of the six dispatched content types AND carries that type's
+  // required structural fields (_CMS_SHAPE). An unrecognized contentType, or a recognized one
+  // missing its fields, is not a parse result: fail closed as inspect/bad-input, not a partial render.
+  var shape = _CMS_SHAPE[o.contentType];
+  return shape ? shape(o) : false;
+}
+// The shared inspect coercion boundary, composed by every direct inspector AND any():
+// pemLabel:null unwraps a PEM string OR a PEM-armored Buffer (a .pem read with
+// fs.readFileSync) under ANY block label -- so an aliased label (PKCS7 for CMS,
+// CRL for an X509 CRL) routes like any() instead of hitting a canonical-label
+// mismatch -- while a raw DER Buffer / Uint8Array passes through the detached-store guard.
+var _INSPECT_ENTRY = { pemLabel: null, PemError: InspectError, ErrorClass: InspectError, prefix: "inspect" };
+// A parameterized _parse clone: marker field, fast-path completeness check, then
+// the shared label-agnostic coercion to DER, then parse(der) inside try.
+function _coerce(input, spec) {
+  if (input && typeof input === "object" && !Buffer.isBuffer(input) && !(input instanceof Uint8Array) && input[spec.marker] !== undefined) {
+    if (!spec.looksParsed(input)) throw _err("inspect/bad-input", "input has a " + spec.marker + " property but is not a complete " + spec.parsedName + " result");
+    return input;
+  }
+  var der;
+  // Compose the ONE coercion every format parser + any() use, so a PEM string and a
+  // PEM-armored Buffer unwrap under any label (not just the format's canonical one)
+  // and a detached-store Buffer fails closed here, not divergently per inspector.
+  try { der = pkix.coerceToDer(input, _INSPECT_ENTRY); }
+  catch (e) { throw _err("inspect/bad-input", "input must be a parsed " + spec.what + ", a DER Buffer, or a PEM block", e); }
+  try { return spec.parse(der); }
+  catch (e) { throw _err(spec.badCode, "input is not a well-formed " + spec.what, e); }
+}
+function _parseCrl(input) { return _coerce(input, { marker: "thisUpdate", looksParsed: _looksParsedCrl, parsedName: "pki.schema.crl.parse", parse: crl.parse, badCode: "inspect/bad-crl", what: "X.509 CRL" }); }
+function _parseCsr(input) { return _coerce(input, { marker: "certificationRequestInfoBytes", looksParsed: _looksParsedCsr, parsedName: "pki.schema.csr.parse", parse: csr.parse, badCode: "inspect/bad-csr", what: "PKCS#10 certification request" }); }
+function _parseCms(input) { return _coerce(input, { marker: "contentType", looksParsed: _looksParsedCms, parsedName: "pki.schema.cms.parse", parse: cms.parse, badCode: "inspect/bad-cms", what: "CMS message" }); }
+
+// ---- shared attribute-value renderer (CSR attributes + CMS signed/unsigned) ---
+
+// Attribute/extension dispatch keys on the STABLE OID, never the display name a
+// pki.oid.register() override can change (the schema stores the overridden name).
+var OID_EXTENSION_REQUEST = oid.byName("extensionRequest");
+var OID_CONTENT_TYPE = oid.byName("contentType");
+var OID_MESSAGE_DIGEST = oid.byName("messageDigest");
+var OID_SIGNING_TIME = oid.byName("signingTime");
+
+// Decode the known content-binding attribute types for display; anything else, or
+// a decode failure, falls back to printable-or-hex. Never throws once parsed.
+// Keyed on the attribute's OID (stable), not its display name (register-mutable).
+function _attrValue(typeOid, rawDer, inner) {
+  try {
+    if (typeOid === OID_CONTENT_TYPE) { var ct = asn1.read.oid(asn1.decode(rawDer)); return inner + (oid.name(ct) || ct); }
+    if (typeOid === OID_MESSAGE_DIGEST) return _hexColon(asn1.read.octetString(asn1.decode(rawDer)), { wrap: 16, indent: inner.length });
+    if (typeOid === OID_SIGNING_TIME) return inner + _date(asn1.read.time(asn1.decode(rawDer)));
+  } catch (_e) { /* fall through to the raw fallback */ }
+  return _fallback(rawDer, inner);
+}
+
+// ---- CRL report --------------------------------------------------------------
+
+// The CRL decoder PRE-DECODES three extension values to a JS type (not the raw
+// Buffer the shared _extension consumes): cRLNumber -> BigInt, reasonCode ->
+// Number, invalidityDate -> Date. Dispatch on the STABLE OID exactly as the decoder
+// does (schema-crl decodeExt), NOT the display name -- pki.oid.register() can override
+// a built-in name, which would skip these branches and hand _extension a non-Buffer
+// value (rendering "(empty)" for the CRL number or reason). deltaCRLIndicator is a
+// raw-Buffer extension the decoder does NOT pre-decode, but its value is a bare INTEGER
+// (BaseCRLNumber) the operator needs in decimal to relate a delta CRL to its base -- so
+// decode it here for display (best-effort: a malformed value falls through to hex).
+// Delegate every other raw-value extension (AKI / IDP / freshestCRL / certificateIssuer)
+// to the shared _extension verbatim.
+var OID_CRL_NUMBER = oid.byName("cRLNumber");
+var OID_REASON_CODE = oid.byName("reasonCode");
+var OID_INVALIDITY_DATE = oid.byName("invalidityDate");
+var OID_DELTA_CRL_INDICATOR = oid.byName("deltaCRLIndicator");
+function _crlExtension(ext, pad) {
+  var label = EXT_LABEL[ext.name] || ext.name || ext.oid;
+  var header = pad + label + ":" + (ext.critical ? " critical" : "");
+  var inner = pad + "    ";
+  if (ext.oid === OID_CRL_NUMBER && typeof ext.value === "bigint") return header + "\n" + inner + String(ext.value);
+  if (ext.oid === OID_REASON_CODE && typeof ext.value === "number") return header + "\n" + inner + (NAMES.CRL_REASON[ext.value] || String(ext.value));
+  if (ext.oid === OID_INVALIDITY_DATE && ext.value instanceof Date) return header + "\n" + inner + _date(ext.value);
+  if (ext.oid === OID_DELTA_CRL_INDICATOR && Buffer.isBuffer(ext.value)) {
+    try { return header + "\n" + inner + "BaseCRLNumber: " + String(asn1.read.integer(asn1.decode(ext.value))); }
+    catch (_e) { /* malformed BaseCRLNumber -> fall through to the shared _extension (hex) */ }
+  }
+  return _extension(ext, pad);
+}
+
+/**
+ * @primitive pki.inspect.crl
+ * @signature pki.inspect.crl(input) -> string
+ * @since 0.3.8
+ * @status experimental
+ * @spec RFC 5280
+ * @related pki.schema.crl.parse, pki.inspect.certificate
+ *
+ * Render a certificate revocation list as an `openssl crl -text`-familiar text
+ * report: issuer, Last/Next Update, the CRL extensions, each revoked entry (serial,
+ * revocation date, entry extensions), and the signature. `input` is a PEM string, a
+ * DER Buffer, or a `pki.schema.crl.parse` result; a non-CRL throws
+ * `inspect/bad-crl`, a wrong-type input `inspect/bad-input`. A malformed individual
+ * extension renders as hex rather than failing the report.
+ *
+ * @example
+ *   pki.inspect.crl(crlDer).split("\n")[0]; // "Certificate Revocation List (CRL):"
+ */
+function crlReport(input) {
+  var c = _parseCrl(input);
+  var L = ["Certificate Revocation List (CRL):"];
+  L.push("        Version " + c.version + " (0x" + (c.version - 1).toString(16) + ")");
+  L.push("    Signature Algorithm: " + _algName(c.signatureAlgorithm));
+  L.push("        Issuer: " + _dnString(c.issuer));
+  L.push("        Last Update: " + _date(c.thisUpdate));
+  L.push("        Next Update: " + (c.nextUpdate ? _date(c.nextUpdate) : "NONE"));
+  if (c.crlExtensions.length) {
+    L.push("        CRL extensions:");
+    c.crlExtensions.forEach(function (ext) { L.push(_crlExtension(ext, "            ")); });
+  }
+  if (c.revokedCertificates.length) {
+    L.push("Revoked Certificates:");
+    c.revokedCertificates.forEach(function (e) {
+      L.push("    " + _serial(e, 8));
+      L.push("        Revocation Date: " + _date(e.revocationDate));
+      if ((e.crlEntryExtensions || []).length) {
+        L.push("        CRL entry extensions:");
+        e.crlEntryExtensions.forEach(function (ext) { L.push(_crlExtension(ext, "            ")); });
+      }
+    });
+  } else {
+    L.push("No Revoked Certificates.");
+  }
+  L.push("    Signature Algorithm: " + _algName(c.signatureAlgorithm));
+  var sig = c.signatureValue && (c.signatureValue.bytes || c.signatureValue);
+  if (Buffer.isBuffer(sig)) { L.push("    Signature Value:"); L.push(_hexColon(sig, { wrap: 16, indent: 8 })); }
+  return L.join("\n") + "\n";
+}
+
+// ---- CSR report --------------------------------------------------------------
+
+function _attribute(attr, pad) {
+  var inner = pad + "    ";
+  // extensionRequest carries decoded RFC 5280 extensions (the cert-extension shape)
+  // -> render each through the shared _extension, identically to a certificate's.
+  if (attr.type === OID_EXTENSION_REQUEST && Array.isArray(attr.extensions)) {
+    var lines = [pad + "Requested Extensions:"];
+    attr.extensions.forEach(function (ext) { lines.push(_extension(ext, inner)); });
+    return lines.join("\n");
+  }
+  var header = pad + (attr.name || oid.name(attr.type) || attr.type) + ":";
+  var vals = (attr.values || []).map(function (v) { return _attrValue(attr.type, v, inner); });
+  return vals.length ? header + "\n" + vals.join("\n") : header;
+}
+
+/**
+ * @primitive pki.inspect.csr
+ * @signature pki.inspect.csr(input) -> string
+ * @since 0.3.8
+ * @status experimental
+ * @spec RFC 2986
+ * @related pki.schema.csr.parse, pki.inspect.certificate
+ *
+ * Render a PKCS#10 certification request as an `openssl req -text`-familiar text
+ * report: subject, the subject public key, the requested extensions and other
+ * attributes, and the signature. `input` is a PEM string, a DER Buffer, or a
+ * `pki.schema.csr.parse` result; a non-CSR throws `inspect/bad-csr`, a wrong-type
+ * input `inspect/bad-input`. Best-effort like `certificate`.
+ *
+ * @example
+ *   pki.inspect.csr(csrDer).split("\n")[0]; // "Certificate Request:"
+ */
+function csrReport(input) {
+  var c = _parseCsr(input);
+  var L = ["Certificate Request:", "    Data:"];
+  L.push("        Version: " + c.version + " (0x" + (c.version - 1).toString(16) + ")");
+  L.push("        Subject: " + _dnString(c.subject));
+  L.push("        Subject Public Key Info:");
+  L.push(_keyBlock(c.subjectPublicKeyInfo, "            "));
+  L.push("        Attributes:");
+  if (c.attributes.length) c.attributes.forEach(function (attr) { L.push(_attribute(attr, "            ")); });
+  else L.push("            (none)");
+  L.push("    Signature Algorithm: " + _algName(c.signatureAlgorithm));
+  var sig = c.signatureValue && (c.signatureValue.bytes || c.signatureValue);
+  if (Buffer.isBuffer(sig)) { L.push("    Signature Value:"); L.push(_hexColon(sig, { wrap: 16, indent: 8 })); }
+  return L.join("\n") + "\n";
+}
+
+// ---- CMS report --------------------------------------------------------------
+
+// Dispatch on the STABLE contentType OID, never the display name: pki.oid.register()
+// lets an application override the built-in "signedData" name, and dispatching on the
+// mutable name would then misroute a valid SignedData to the generic summary.
+var OID_SIGNED_DATA = oid.byName("signedData");
+// pki.schema.cms.parse dispatches ONLY these six RFC 5652 content types (every other
+// OID throws cms/unsupported- or cms/unknown-content-type -- it never yields an object).
+// Each maps to a predicate over the REQUIRED (non-OPTIONAL) fields of its top-level
+// SEQUENCE, so the parsed-object fast path in _looksParsedCms accepts a genuine parse
+// result but a partial/hand-built object (the type OID + name + version, none of the
+// structural fields) fails closed as inspect/bad-input -- the documented boundary.
+function _isObj(x) { return !!x && typeof x === "object"; }
+var _CMS_SHAPE = {};
+_CMS_SHAPE[OID_SIGNED_DATA] = function (o) { return Array.isArray(o.digestAlgorithms) && _isObj(o.encapContentInfo) && Array.isArray(o.signerInfos); };            // sec. 5.1
+_CMS_SHAPE[oid.byName("envelopedData")] = function (o) { return Array.isArray(o.recipientInfos) && _isObj(o.encryptedContentInfo); };                                // sec. 6.1
+_CMS_SHAPE[oid.byName("encryptedData")] = function (o) { return _isObj(o.encryptedContentInfo); };                                                                  // sec. 8
+_CMS_SHAPE[oid.byName("authData")] = function (o) { return Array.isArray(o.recipientInfos) && _isObj(o.macAlgorithm) && _isObj(o.encapContentInfo) && Buffer.isBuffer(o.mac); }; // sec. 9.1
+_CMS_SHAPE[oid.byName("authEnvelopedData")] = function (o) { return Array.isArray(o.recipientInfos) && _isObj(o.encryptedContentInfo) && Buffer.isBuffer(o.mac); };                // RFC 5083 (build surfaces encryptedContentInfo)
+_CMS_SHAPE[oid.byName("compressedData")] = function (o) { return _isObj(o.compressionAlgorithm) && _isObj(o.encapContentInfo); };                                   // RFC 3274
+
+// Coverage residuals in the report assemblers -- verified-hard-to-reach, not gaps:
+//   * The `x.bytes || x` / `oid.name(o) || o` / `a.name || oid.name || a.type` fallbacks are
+//     belts for shapes the strict parsers never produce (a parsed CSR always carries
+//     signatureValue.bytes; a decoded algorithm always names its OID) -- they mirror
+//     certificate()'s own defensive fallbacks.
+//   * The embedded-CRL delegation and the CONTEXT-tagged embedded-element summary need a CMS
+//     carrying a crls element or an attribute-certificate CHOICE alternative, and the
+//     AuthenticatedData macAlgorithm / countersignature-unsignedAttrs arms need CMS shapes the
+//     toolkit's own producers (cms.sign / encrypt / compress) do not emit; every such arm is
+//     driven best-effort (never throws) and its structural sibling (embedded Certificate,
+//     envelopedData recipientInfo, CompressedData compressionAlgorithm, signed attributes) is
+//     covered.
+
+// An embedded certificate/CRL element {bytes,tagClass,tagNumber}: a UNIVERSAL
+// SEQUENCE is a real Certificate/CertificateList -> delegate to the full sub-report
+// (guarded; a one-line summary on any failure); a CONTEXT-tagged CHOICE alternative
+// (attribute certificate / other) renders a one-line tag+size summary, never parsed.
+function _cmsEmbedded(kind, el, pad) {
+  if (el.tagClass === "universal") {
+    try {
+      var sub = (kind === "CRL") ? crlReport(el.bytes) : certificate(el.bytes);
+      return pad + kind + ":\n" + sub.replace(/\n$/, "").split("\n").map(function (l) { return pad + "    " + l; }).join("\n");
+    } catch (_e) { /* fall through to the summary */ }
+  }
+  return pad + kind + " [" + el.tagClass + " " + el.tagNumber + "] (" + el.bytes.length + " bytes)";
+}
+
+function _signerInfoAttrs(title, attrs, pad) {
+  var lines = [pad + title + ":"];
+  var inner = pad + "    ";
+  attrs.forEach(function (a) {
+    var vals = (a.values || []).map(function (v) { return _attrValue(a.type, v, inner + "    "); });
+    lines.push(inner + (a.name || oid.name(a.type) || a.type) + ":");
+    vals.forEach(function (v) { lines.push(v); });
+  });
+  return lines.join("\n");
+}
+
+function _signerInfo(si, pad) {
+  var inner = pad + "    ";
+  var L = [pad + "SignerInfo:", inner + "Version: " + si.version];
+  if (si.sid && si.sid.serialNumberHex !== undefined) {
+    L.push(inner + "Issuer: " + _dnString(si.sid.issuer));
+    L.push(inner + _serial(si.sid, pad.length + 8));
+  } else if (si.sid && Buffer.isBuffer(si.sid.subjectKeyIdentifier)) {
+    L.push(inner + "Subject Key Identifier: " + _hexColon(si.sid.subjectKeyIdentifier, {}));
+  }
+  L.push(inner + "Digest Algorithm: " + _algName(si.digestAlgorithm));
+  if (si.signedAttrs && si.signedAttrs.length) L.push(_signerInfoAttrs("Signed Attributes", si.signedAttrs, inner));
+  L.push(inner + "Signature Algorithm: " + _algName(si.signatureAlgorithm));
+  if (si.unsignedAttrs && si.unsignedAttrs.length) L.push(_signerInfoAttrs("Unsigned Attributes", si.unsignedAttrs, inner));
+  if (Buffer.isBuffer(si.signature)) { L.push(inner + "Signature Value:"); L.push(_hexColon(si.signature, { wrap: 16, indent: pad.length + 8 })); }
+  return L.join("\n");
+}
+
+/**
+ * @primitive pki.inspect.cms
+ * @signature pki.inspect.cms(input) -> string
+ * @since 0.3.8
+ * @status experimental
+ * @spec RFC 5652
+ * @related pki.schema.cms.parse, pki.inspect.certificate
+ *
+ * Render a CMS message as an `openssl cms -cmsout -print`-familiar text report. A
+ * SignedData shows the content type, digest algorithms, encapsulated content,
+ * embedded certificates/CRLs, and each SignerInfo (signer identifier, algorithms,
+ * signed/unsigned attributes, signature); a non-SignedData ContentInfo renders a
+ * stable top-field summary. `input` is a PEM string, a DER Buffer, or a
+ * `pki.schema.cms.parse` result; a non-CMS throws `inspect/bad-cms`. Best-effort.
+ *
+ * @example
+ *   pki.inspect.cms(cmsDer).split("\n")[0]; // "CMS ContentInfo:"
+ */
+// A ContentInfo whose content type pki.schema.cms.parse does not dispatch (id-data,
+// digestedData, ...) is a VALID CMS the parser defers, not a malformed message -- render an
+// outer-only summary (the named content type) rather than failing the report.
+function _cmsOuterSummary(input) {
+  var ct = null;
+  try {
+    var der = pkix.coerceToDer(input, _INSPECT_ENTRY);
+    ct = asn1.read.oid(asn1.decode(der).children[0]);
+  } catch (_e) { /* best-effort: name unknown */ }
+  return "CMS ContentInfo:\n    Content Type: " + (ct ? (oid.name(ct) || ct) + " (" + ct + ")" : "unknown") +
+    "\n    (content type not further parsed; outer ContentInfo only)\n";
+}
+
+function cmsReport(input) {
+  var m;
+  try { m = _parseCms(input); }
+  catch (e) {
+    // A ContentInfo whose contentType the parser does not dispatch is a valid CMS, not a malformed
+    // message: a known-but-deferred type (cms/unsupported-content-type, e.g. id-data) or a private/
+    // unregistered OID (cms/unknown-content-type). Either renders the outer-only summary.
+    var cc = e && e.cause && e.cause.code;
+    if (e && e.code === "inspect/bad-cms" && (cc === "cms/unsupported-content-type" || cc === "cms/unknown-content-type")) return _cmsOuterSummary(input);
+    throw e;
+  }
+  var L = ["CMS ContentInfo:"];
+  L.push("    Content Type: " + (m.contentTypeName || oid.name(m.contentType) || m.contentType) + " (" + m.contentType + ")");
+  if (m.contentType === OID_SIGNED_DATA) {
+    L.push("    SignedData:");
+    L.push("        Version: " + m.version);
+    L.push("        Digest Algorithms:");
+    (m.digestAlgorithms || []).forEach(function (a) { L.push("            " + _algName(a)); });
+    if (m.encapContentInfo) {
+      L.push("        Encapsulated Content Info:");
+      L.push("            Content Type: " + (oid.name(m.encapContentInfo.eContentType) || m.encapContentInfo.eContentType) + " (" + m.encapContentInfo.eContentType + ")");
+      L.push("            " + (m.encapContentInfo.eContent == null ? "<no content (detached)>" : (m.encapContentInfo.eContent.length + " content byte(s)")));
+    }
+    (m.certificates || []).forEach(function (el) { L.push(_cmsEmbedded("Certificate", el, "        ")); });
+    (m.crls || []).forEach(function (el) { L.push(_cmsEmbedded("CRL", el, "        ")); });
+    (m.signerInfos || []).forEach(function (si) { L.push(_signerInfo(si, "        ")); });
+  } else {
+    // Non-SignedData: a stable top-field summary (no plaintext to show); never throws.
+    L.push("    " + (m.contentTypeName || "content") + ":");
+    if (m.version != null) L.push("        Version: " + m.version);
+    (m.recipientInfos || []).forEach(function (ri) { L.push("        RecipientInfo: " + (ri.type || "?") + (ri.ridType ? " (" + ri.ridType + ")" : "")); });
+    if (m.encryptedContentInfo) {
+      L.push("        Content Type: " + (oid.name(m.encryptedContentInfo.contentType) || m.encryptedContentInfo.contentType));
+      if (m.encryptedContentInfo.contentEncryptionAlgorithm) L.push("        Content Encryption Algorithm: " + _algName(m.encryptedContentInfo.contentEncryptionAlgorithm));
+    }
+    if (m.macAlgorithm) L.push("        MAC Algorithm: " + _algName(m.macAlgorithm));
+    if (m.compressionAlgorithm) L.push("        Compression Algorithm: " + _algName(m.compressionAlgorithm));
+  }
+  return L.join("\n") + "\n";
+}
+
+// ---- unified detect-and-dispatch ---------------------------------------------
+
+var _INSPECT_BY_FORMAT = { x509: certificate, crl: crlReport, csr: csrReport, cms: cmsReport };
+
+/**
+ * @primitive pki.inspect.any
+ * @signature pki.inspect.any(input) -> string
+ * @since 0.3.8
+ * @status experimental
+ * @spec RFC 5280
+ * @related pki.schema.detectFormat, pki.inspect.certificate
+ *
+ * Detect which PKI format `input` (a PEM string or DER Buffer) encodes and render
+ * it with the matching report -- the inspect analogue of `pki.schema.parse`. Routes
+ * a certificate / CRL / CSR / CMS to `certificate` / `crl` / `csr` / `cms`; a
+ * detected but out-of-scope format (OCSP, TSP, PKCS#8/#12, CRMF, CMP, ...) throws
+ * `inspect/unsupported-format` naming it, and an unrecognized input
+ * `inspect/bad-input`.
+ *
+ * @example
+ *   pki.inspect.any(der);  // routes to the right report by detected format
+ */
+function any(input) {
+  // Unwrap to DER ONCE (any PEM label), detect from the DER, then route the DER Buffer -- the
+  // renderer parses a Buffer directly and never re-applies its own strict PEM label.
+  var der, fmt;
+  try {
+    der = pkix.coerceToDer(input, _INSPECT_ENTRY);
+    fmt = schemaAll.detectFormat(der);   // decodes the root -- a non-DER Buffer throws here, not at coerce
+  } catch (e) { throw _err("inspect/bad-input", "input is not a decodable DER Buffer or PEM string", e); }
+  if (fmt === null) throw _err("inspect/bad-input", "input does not match any registered PKI format");
+  var render = _INSPECT_BY_FORMAT[fmt];
+  if (!render) throw _err("inspect/unsupported-format", "inspect does not support the detected format \"" + fmt + "\" (supported: certificate, crl, csr, cms)");
+  return render(der);
+}
+
 module.exports = {
   certificate: certificate,
+  crl: crlReport,
+  csr: csrReport,
+  cms: cmsReport,
+  any: any,
   // The extension names certificate() renders to their decoded values (vs the raw
   // hex fallback). The inspect test asserts this covers every extension the shared
   // decoders decode, so a newly-decodable extension cannot silently hex-dump.

package/lib/path-validate.js

@@ -39,6 +39,7 @@ var x509 = require("./schema-x509");
 var crl = require("./schema-crl");
 var ocsp = require("./schema-ocsp");
 var ocspVerify = require("./ocsp-verify");
+var crlVerify = require("./crl-verify");
 var guard = require("./guard-all");
 var constants = require("./constants");
 var validator = require("./validator-all");
@@ -1762,7 +1763,7 @@ function crlChecker(crls) {
         // replayed old CRL must not read "good". Treat it as unusable.
         if (!theCrl.nextUpdate || theCrl.nextUpdate < time) continue;   // stale / no bound
 
-        var sigOk = await verifyCrlSignature(theCrl, issuer);
+        var sigOk = await crlVerify.verifyCrlSignature(theCrl, issuer.workingPublicKey);
         if (!sigOk) continue;                                // unverifiable -> not authoritative
 
         // The CRL is now authoritative + current + verified. An authoritative
@@ -1853,10 +1854,10 @@ function _verifyWithSpki(sigAlg, rawSig, spkiBytes, tbsBytes) {
   }).then(function (ok) { return ok === true; }, function () { return false; });
 }
 
-function verifyCrlSignature(theCrl, issuer) {
-  if (!guard.crypto.isOctetAligned(theCrl.signatureValue)) return Promise.resolve(false);   // non-octet-aligned signature
-  return _verifyWithSpki(theCrl.signatureAlgorithm, theCrl.signatureValue.bytes, issuer.workingPublicKey, theCrl.tbsBytes);
-}
+// Inject this validator's signature engine into the shared internal crl-verify seam, so pki.crl.verify and
+// pki.path.crlChecker both route through this ONE engine (no second, weaker CRL verifier) without exposing
+// the seam on the public pki.path surface.
+crlVerify.setEngine(_verifyWithSpki);
 
 // ---- the OCSP revocation checker (RFC 6960) -------------------------------
 

package/lib/schema-all.js

@@ -290,6 +290,34 @@ function parse(input) {
   throw new SchemaError("schema/unknown-format", "input does not match any registered PKI format (" + all().join(", ") + ")");
 }
 
+/**
+ * @primitive  pki.schema.detectFormat
+ * @signature  pki.schema.detectFormat(input) -> string | null
+ * @since       0.3.8
+ * @status      experimental
+ * @spec        RFC 5280
+ * @related     pki.schema.parse, pki.schema.all
+ *
+ * Detect which registered PKI format `input` (a DER `Buffer` or PEM string)
+ * encodes and return its name -- one of `pki.schema.all()` -- WITHOUT parsing it,
+ * or `null` when the decoded bytes match no registered format. This is the
+ * detection half of `pki.schema.parse`, running the same authoritative `FORMATS`
+ * ordering, exposed for a caller (e.g. `pki.inspect.any`) that needs the format
+ * name rather than the parsed result. Input that does not decode as DER throws the
+ * same coercion / decode error `parse` throws.
+ *
+ * @example
+ *   pki.schema.detectFormat(der);  // "x509" | "crl" | "csr" | "cms" | ... | null
+ */
+function detectFormat(input) {
+  var der = pkix.coerceToDer(input, ENTRY);
+  var root = pkix.decodeRoot(der, ENTRY);
+  for (var i = 0; i < FORMATS.length; i++) {
+    if (FORMATS[i].detect(root)) return FORMATS[i].name;
+  }
+  return null;
+}
+
 // Curated public surface: each format exposes only its operator primitives. The
 // `matches` detector is internal dispatch infrastructure (used by FORMATS above),
 // not an operator API, so it is NOT re-exported here.
@@ -313,4 +341,5 @@ module.exports = {
   smime: { parseSigningCertificate: smime.parseSigningCertificate, parseSigningCertificateV2: smime.parseSigningCertificateV2, parseSmimeCapabilities: smime.parseSmimeCapabilities, decodeAttribute: smime.decodeAttribute },
   all: all,
   parse: parse,
+  detectFormat: detectFormat,
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.3.7",
+  "version": "0.3.9",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",
@@ -72,7 +72,7 @@
     "check:vendor-currency": "node scripts/check-vendor-currency.js"
   },
   "devDependencies": {
-    "c8": "11.0.0",
+    "c8": "12.0.0",
     "esbuild": "0.28.1",
     "eslint": "10.7.0"
   }

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:dc01f613-ee62-4b7d-b2d5-42e3bb2f5560",
+  "serialNumber": "urn:uuid:c2eb240a-1337-4a5a-862e-43dad1701426",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-18T01:11:02.665Z",
+    "timestamp": "2026-07-23T16:52:13.594Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.3.7",
+      "bom-ref": "@blamejs/pki@0.3.9",
       "type": "application",
       "name": "pki",
-      "version": "0.3.7",
+      "version": "0.3.9",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.3.7",
+      "purl": "pkg:npm/%40blamejs/pki@0.3.9",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.3.7",
+      "ref": "@blamejs/pki@0.3.9",
       "dependsOn": []
     }
   ]