@blamejs/pki 0.4.14 → 0.5.0

package/lib/est.js

@@ -40,9 +40,12 @@
  *   certificates are in any order", RFC 5272 sec. 4.1) -- `findIssuedCert` picks
  *   the issued certificate by a public-key match, never a positional guess. The
  *   serverkeygen encrypted-key part's EnvelopedData is surfaced structurally
- *   (ciphertext raw, decryption external). /fullcmc is recognized and rejected
- *   with a precise `est/fullcmc-not-supported` (deferred to the CMC format
- *   module). DER-only where DER, fail-closed everywhere.
+ *   (ciphertext raw, decryption external). A /fullcmc response is CLASSIFIED:
+ *   a 200 may carry either arm RFC 7030 sec. 4.3.2 permits (`certs-only` or
+ *   `CMC-response`), and a 404 or 501 is the distinct `not-implemented`
+ *   verdict -- this service absent, rather than a transport fault. Reading the
+ *   CMC message itself is the CMC module's job. DER-only where DER,
+ *   fail-closed everywhere.
  *
  * @card
  *   EST (RFC 7030 / 8951 / 9908) client -- the cacerts / simpleenroll / simplereenroll
@@ -60,6 +63,12 @@ var pkcs8 = require("./schema-pkcs8");
 var key = require("./key");
 var csr = require("./schema-csr");
 var csrattrsFmt = require("./schema-csrattrs");   // aliased: the `csrattrs` name is the verb + the public export
+var cmcVerify = require("./cmc-verify");          // /fullcmc interprets its response through the CMC layer
+var cmcFmt = require("./schema-cmc");             // to read back which keys the submitted request asked to certify
+var OID_CMC_TRANSACTION_ID = oid.byName("id-cmc-transactionId");
+var OID_CMC_SENDER_NONCE = oid.byName("id-cmc-senderNonce");
+var OID_CMC_DATA_RETURN = oid.byName("id-cmc-dataReturn");
+var crmfFmt = require("./schema-crmf");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
 var httpTransport = require("./http-transport");
@@ -94,6 +103,7 @@ var OPERATIONS = ["cacerts", "simpleenroll", "simplereenroll", "fullcmc", "serve
  * decoded DER against `DER_MAX_BYTES` (`est/too-large`).
  *
  * @example
+ *   var der = pki.asn1.build.sequence([pki.asn1.build.integer(1n)]);
  *   var roundTripped = pki.est.transferDecode(pki.est.transferEncode(der));
  */
 function transferDecode(body) {
@@ -128,6 +138,7 @@ function transferDecode(body) {
  * (senders need not insert whitespace, RFC 8951 sec. 3.1).
  *
  * @example
+ *   var der = pki.asn1.build.sequence([pki.asn1.build.integer(1n)]);
  *   var body = pki.est.transferEncode(der);
  */
 function transferEncode(der) {
@@ -144,8 +155,14 @@ function transferEncode(der) {
 function _multipartBoundary(contentType) {
   var ct = String(contentType || "");
   if (!/^multipart\/mixed\s*(;|$)/i.test(ct)) return null;
-  var m = /;\s*boundary\s*=\s*("([^"]+)"|([^;\s]+))/i.exec(ct);
-  return m ? (m[2] !== undefined ? m[2] : m[3]) : null;
+  // Two boundaries name two different splits of the same body; there is no reading
+  // of that header, so it is refused rather than resolved by taking the first.
+  var bp = _ctParam(ct, "boundary");
+  if (bp.duplicated) {
+    throw E("est/bad-multipart",
+      "the multipart Content-Type declares more than one boundary, so where the parts begin is ambiguous (RFC 2045 sec. 5.1)");
+  }
+  return bp.value;
 }
 
 // Split a multipart/mixed body into its parts, each { headers, contentType,
@@ -211,6 +228,16 @@ function splitMultipartMixed(body, contentType) {
  * `EstError` (`est/not-certs-only`, `est/no-certificates`).
  *
  * @example
+ *   var b = pki.asn1.build;
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var certDer = await pki.x509.sign({ subject: "Example CA", subjectPublicKey: await pki.key.export(pair.publicKey),
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") },
+ *     { key: await pki.key.export(pair.privateKey) });
+ *   // the certs-only Simple PKI Response shape (RFC 7030 sec. 4.1.3): a SignedData
+ *   // v1 over id-data with no eContent, the certificates, and an EMPTY signerInfos
+ *   var caCertsDer = b.sequence([b.oid("1.2.840.113549.1.7.2"), b.explicit(0, b.sequence([
+ *     b.integer(1n), b.set([]), b.sequence([b.oid("1.2.840.113549.1.7.1")]),
+ *     b.contextConstructed(0, certDer), b.set([])]))]);
  *   var r = pki.est.parseCertsOnly(caCertsDer);
  *   r.certificates;   // -> [Buffer, ...] raw, unordered
  */
@@ -333,20 +360,39 @@ function _splitContentTypeParams(s) {
 // like application/pkcs8evil yields that literal, not application/pkcs8), and
 // parameters are read token-by-token honoring quoted-strings so a smime-type-like
 // substring inside another quoted parameter value is NOT taken as smime-type.
-function _partMediaType(contentType) {
+// A named Content-Type parameter, plus whether the header declared it MORE THAN
+// ONCE. RFC 2045 sec. 5.1 gives a parameter at most one value, so a header stating
+// two is ambiguous -- and taking the first would let the position of a duplicate,
+// not the sender, decide how the body is read. `smime-type` selects which response
+// arm this is and `boundary` decides where the parts begin, so in both cases the
+// choice is the whole answer. Reported rather than thrown here: each boundary
+// refuses in its own terms, and the error path must not let a bad label displace
+// the HTTP fault it arrived with.
+function _ctParam(contentType, name) {
   var segs = _splitContentTypeParams(String(contentType || ""));
-  var mediaMatch = /^\s*([a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*)\s*$/i.exec(segs[0]);
-  var smimeType = null;
+  var value = null, count = 0;
   for (var i = 1; i < segs.length; i++) {
     var eq = segs[i].indexOf("=");
     if (eq === -1) continue;
-    if (segs[i].slice(0, eq).trim().toLowerCase() !== "smime-type") continue;
+    if (segs[i].slice(0, eq).trim().toLowerCase() !== name) continue;
+    count++;
+    if (count > 1) continue;
     var val = segs[i].slice(eq + 1).trim();
     if (val.length >= 2 && val.charAt(0) === '"' && val.charAt(val.length - 1) === '"') val = val.slice(1, -1);
-    smimeType = val.toLowerCase();
-    break;
+    value = val;
   }
-  return { media: mediaMatch ? mediaMatch[1].toLowerCase() : null, smimeType: smimeType };
+  return { value: value, duplicated: count > 1 };
+}
+
+function _partMediaType(contentType) {
+  var segs = _splitContentTypeParams(String(contentType || ""));
+  var mediaMatch = /^\s*([a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*)\s*$/i.exec(segs[0]);
+  var st = _ctParam(contentType, "smime-type");
+  return {
+    media: mediaMatch ? mediaMatch[1].toLowerCase() : null,
+    smimeType: st.value === null ? null : st.value.toLowerCase(),
+    ambiguous: st.duplicated,
+  };
 }
 
 function parseServerKeygenResponse(body, contentType, opts) {
@@ -356,6 +402,13 @@ function parseServerKeygenResponse(body, contentType, opts) {
   var keyPart = null, certPart = null, encrypted = false;
   for (var i = 0; i < parts.length; i++) {
     var pt = _partMediaType(parts[i].contentType);
+    // Same rule on a PART header: smime-type tells the encrypted key part from the
+    // cleartext one and from the certificate part, so two of them leave which part
+    // this is undecided.
+    if (pt.ambiguous) {
+      throw E("est/bad-multipart",
+        "a serverkeygen response part declares more than one smime-type, so which part it is cannot be told from it (RFC 2045 sec. 5.1)");
+    }
     if (pt.media === "application/pkcs8") { keyPart = parts[i]; encrypted = false; }
     else if (pt.media === "application/pkcs7-mime" && pt.smimeType === "server-generated-key") { keyPart = parts[i]; encrypted = true; }
     // The certificate part exactly matches the /simpleenroll response
@@ -412,19 +465,37 @@ function parseServerKeygenResponse(body, contentType, opts) {
 // PKI message type (CMC-response, ...) is not accepted; cacerts mandates only the
 // media type (sec. 4.1.3). Matched token-wise, not by prefix, so a look-alike like
 // "application/pkcs7-mimeevil" is rejected.
+// smimeTypes is a LIST for every row that constrains it, rather than a scalar on some
+// rows and a list on others: /fullcmc legitimately answers with either arm, and one
+// shape for the field keeps the comparison below single-branch.
 var CONTENT_TYPE_BY_OP = {
   cacerts: { media: "application/pkcs7-mime" },
-  simpleenroll: { media: "application/pkcs7-mime", smimeType: "certs-only" },
-  simplereenroll: { media: "application/pkcs7-mime", smimeType: "certs-only" },
+  simpleenroll: { media: "application/pkcs7-mime", smimeTypes: ["certs-only"] },
+  simplereenroll: { media: "application/pkcs7-mime", smimeTypes: ["certs-only"] },
+  // RFC 7030 sec. 4.3.2: a 200 /fullcmc response is application/pkcs7-mime whose
+  // smime-type is EITHER certs-only (the CA answered with a Simple PKI Response) or
+  // CMC-response (a Full PKI Response). Both are conforming and the CA chooses.
+  // Spelled lowercase here and compared case-insensitively: RFC 5273 sec. 3 prose
+  // writes "CMC-Request"/"CMC-Response" while its own Table 1 and RFC 7030 write
+  // "CMC-request"/"CMC-response", so a case-sensitive match would reject a
+  // conforming server depending on which sentence its author read.
+  fullcmc: { media: "application/pkcs7-mime", smimeTypes: ["certs-only", "cmc-response"] },
   serverkeygen: { media: "multipart/mixed" },
   csrattrs: { media: "application/csrattrs" },
 };
 
-// The operations whose responses this client classifies. /fullcmc is a real EST
-// path (paths() emits its URL) but its CMC response is deferred to the CMC
-// module, so classifying one is an explicit unsupported-operation fault rather
-// than a silently-accepted 200 whose content-type went unchecked.
-var CLASSIFIABLE_OPS = ["cacerts", "simpleenroll", "simplereenroll", "serverkeygen", "csrattrs"];
+// The operations whose responses this client classifies.
+var CLASSIFIABLE_OPS = ["cacerts", "simpleenroll", "simplereenroll", "fullcmc", "serverkeygen", "csrattrs"];
+
+// RFC 7030 sec. 4.3.2: on /fullcmc a 404 OR a 501 means "this service is not
+// implemented" -- a distinct, non-error verdict the caller can act on.
+//
+// That makes THREE meanings for 404 across this classifier, so they are listed
+// together rather than as branches accumulated one release at a time:
+//   /csrattrs  404 -> none-available (sec. 4.5.2)
+//   /fullcmc   404 -> not-implemented (sec. 4.3.2), and 501 likewise
+//   every other op  -> est/http-error
+var NOT_IMPLEMENTED_OPS = { fullcmc: 1 };
 
 /**
  * @primitive  pki.est.classifyResponse
@@ -455,20 +526,40 @@ function classifyResponse(status, headers, body, opts) {
   opts = opts || {};
   var op = opts.op;
   // Fail closed on an operation whose response this client cannot validate:
-  // /fullcmc is recognized-but-deferred, and any other named op is a typo. An
+  // A named op this client cannot validate is a typo, not a pass. An
   // absent op is the caller opting out of the content-type gate (generic
   // status handling) and stays permissive.
-  if (op === "fullcmc") throw E("est/fullcmc-not-supported", "the /fullcmc operation is recognized but its CMC response is not supported by this client (RFC 7030 sec. 4.3)");
   if (op !== undefined && op !== null && CLASSIFIABLE_OPS.indexOf(op) === -1) throw E("est/unsupported-operation", "unrecognized EST operation " + JSON.stringify(op));
-  var h = {};
-  Object.keys(headers || {}).forEach(function (k) { h[k.toLowerCase()] = headers[k]; });
+  // Normalized ONCE, through the reader that refuses a field carried under two
+  // spellings. Folding the map with last-value-wins here while another stage reads
+  // the exact key is how the two could pick different values out of the same
+  // response -- and the whole point of this function is to decide what the body is.
+  // Content-Type, Retry-After and Location are SINGLETON fields: each carries one
+  // value that decides one thing -- how to read the body, how long to wait, where to
+  // go -- so two of them is an ambiguity, refused rather than resolved by order.
+  // WWW-Authenticate is a LIST field (RFC 9110 sec. 11.6.1: a challenge per element),
+  // where repetition is the field working as defined; its values are combined the way
+  // sec. 5.3 permits a recipient to combine list-field lines, so every challenge the
+  // server offered reaches the scheme scan.
+  var h = {
+    "content-type": _ciHeader(headers, "content-type"),
+    "retry-after": _ciHeader(headers, "retry-after"),
+    "location": _ciHeader(headers, "location"),
+    "www-authenticate": _ciHeaderList(headers, "www-authenticate"),
+  };
   if (status === 200) {
     var spec = CONTENT_TYPE_BY_OP[op];
     var ct = h["content-type"] || "";
     if (spec) {
       var pt = _partMediaType(ct);
-      if (pt.media !== spec.media || (spec.smimeType && pt.smimeType !== spec.smimeType)) {
-        throw E("est/bad-content-type", "a 200 " + op + " response must carry content-type " + spec.media + (spec.smimeType ? "; smime-type=" + spec.smimeType : "") + ", got " + JSON.stringify(ct));
+      // _partMediaType already lowercases smimeType, and the table's entries are
+      // lowercase, so this comparison is case-insensitive on both sides.
+      // A duplicated smime-type is not a value the whitelist can be applied to:
+      // one of the two might be on it while the other is not, and matching the
+      // first would pass a header that also declares something else.
+      var smimeOk = !pt.ambiguous && (!spec.smimeTypes || spec.smimeTypes.indexOf(pt.smimeType) !== -1);
+      if (pt.media !== spec.media || !smimeOk) {
+        throw E("est/bad-content-type", "a 200 " + op + " response must carry content-type " + spec.media + (spec.smimeTypes ? "; smime-type=" + spec.smimeTypes.join(" or ") : "") + ", got " + JSON.stringify(ct));
       }
     }
     return { status: "ok", contentType: ct };
@@ -483,8 +574,12 @@ function classifyResponse(status, headers, body, opts) {
     var parsed = retryAfter.parse(raStr, { now: opts.now, E: E, code: "est/bad-retry-after" });
     return { status: "retry", retryAfter: raStr, retryAfterSeconds: parsed.retryAfterSeconds, retryAfterDate: parsed.retryAfterDate };
   }
+  // 501 is meaningful ONLY as the /fullcmc not-implemented signal; on every other
+  // operation it stays an ordinary 5xx and falls through to est/http-error below.
+  if (status === 501 && NOT_IMPLEMENTED_OPS[op]) return { status: "not-implemented", httpStatus: status };
   if (status === 204 || status === 404) {
     if (op === "csrattrs") return { status: "none-available" };
+    if (status === 404 && NOT_IMPLEMENTED_OPS[op]) return { status: "not-implemented", httpStatus: status };
     throw E("est/http-error", "HTTP " + status + " is not a valid " + op + " response");
   }
   if (status >= 300 && status < 400) return { status: "redirect", location: h["location"] || null };
@@ -808,8 +903,17 @@ function _drive(method, url, body, headers, opts, transport, budgets) {
       // The transport contract returns lowercased headers, but the injectable seam only promises
       // { status, headers, body }; normalize here so a redirect Location / WWW-Authenticate from an
       // injected transport using ordinary HTTP casing is read correctly (never missed as absent).
-      var h = {};
-      Object.keys(res.headers || {}).forEach(function (k) { h[k.toLowerCase()] = res.headers[k]; });
+      //
+      // Through the SAME accessors classifyResponse uses, not a fold of its own: a
+      // last-value-wins fold keeps one line of a field that arrived under two
+      // spellings, so a usable challenge sent before an unusable one would vanish
+      // and the exchange would be refused for offering nothing this client speaks.
+      // Location is a singleton, so a second one is an ambiguity and refused;
+      // WWW-Authenticate is a list, so every challenge is kept.
+      var h = {
+        location: _ciHeader(res.headers, "location"),
+        "www-authenticate": _ciHeaderList(res.headers, "www-authenticate"),
+      };
       var status = res.status;
       if (status >= 300 && status < 400) {
         if (redirects >= budgets.maxRedirects) throw E("est/too-many-redirects", "the redirect chain exceeded maxRedirects=" + budgets.maxRedirects + " (RFC 7030 sec. 3.2.1)");
@@ -960,6 +1064,662 @@ function _certsResult(op, res, opts, csrSpki) {
   return { certificate: issued, chain: chain, certificates: parsed.certificates };
 }
 
+// ---- /fullcmc (RFC 7030 sec. 4.3) ---------------------------------------
+
+/**
+ * @primitive  pki.est.fullcmc
+ * @signature  pki.est.fullcmc(baseUrl, request, opts?) -> Promise<verdict | { retry, retryAfterSeconds }>
+ * @since      0.4.16
+ * @status     experimental
+ * @spec       RFC 7030, RFC 8951, RFC 5273, RFC 5272
+ * @related    pki.cmc.build, pki.cmc.verify, pki.est.simpleenroll
+ *
+ * Enroll through the full CMC message layer: POST a Full PKI Request (from `pki.cmc.build`, as a
+ * DER Buffer or a PEM `CMS` block) to `<baseUrl>/.well-known/est/fullcmc` as
+ * `application/pkcs7-mime; smime-type=CMC-request`, base64 per RFC 8951, over the shared
+ * `pki.transport`.
+ *
+ * A 200 answers with EITHER `smime-type=certs-only` (a Simple PKI Response) or
+ * `smime-type=CMC-response` (a Full PKI Response) -- RFC 7030 sec. 4.3.2 names both, and the label
+ * must agree with the bytes. Either way the result is the `pki.cmc.verify` verdict shape, so a
+ * caller reads one `outcome` (`issued` / `pending` / `confirm-required` / `pop-required` /
+ * `rejected`) regardless of which arm the server chose. Pass `transactionId` / `senderNonce` /
+ * `dataReturn` to have the exchange bound to the request that was sent.
+ *
+ * A 404 **or** a 501 is the distinct `est/not-implemented` verdict -- support for this verb is
+ * OPTIONAL on both sides (sec. 4.3). A 202 surfaces its Retry-After rather than sleeping. A
+ * rejection carries a CMC response (sec. 4.3.2 makes it a MUST), which is decoded and attached to
+ * a typed `est/cmc-failed` as `err.cmc` and `err.httpStatus` -- but a body that cannot be read
+ * never masks the HTTP fault it arrived with.
+ *
+ * On the `certs-only` arm the issued certificates are identified by PUBLIC-KEY MATCH against the
+ * requests that were submitted -- the only identification RFC 5272 sec. 4.1 sanctions, since "the
+ * certificates are in any order" -- and EVERY certification request in the message must be answered
+ * before the exchange reads as `issued` -- a key wanted by N requests needs N certificates, so a
+ * bag that answers only some of them, or none, is a refusal rather than a partial success. That arm
+ * carries no controls, so it cannot echo a Transaction Identifier, Sender Nonce or Data Return: a
+ * request that sent those asked for replay binding it cannot provide -- the key match is not one,
+ * since an old response for the same key still matches -- and it is refused as
+ * `est/unbound-response` rather than accepted with silently none of what was asked for. They are
+ * surfaced as `issuedCertificates` (with `certificate` the first), distinct from `certificates`,
+ * which is the whole returned bag including any chain. Where the requested keys are distinct that
+ * list is in request order; where several requests deliberately SHARE one key it is not, and does
+ * not claim to be -- the public key is the only identification sec. 4.1 sanctions, so when it is
+ * shared nothing in the response says which of those requests a given certificate answers. That arm reports `signatureVerified: false`: a certs-only body is
+ * a degenerate SignedData with no signers by definition, so its security rests on the authenticated
+ * TLS channel, not on a signature.
+ *
+ * Every EST transport gate holds unchanged, including on a bootstrap enrollment: https-only, an
+ * explicit trust anchor required, redirect and size bounds. A Publish Trust Anchors control in the
+ * response is SURFACED, never acted on (RFC 5272 sec. 6.15 makes accepting one a manual decision).
+ *
+ * @opts
+ *   - `transport` / `tls` / `label` / `timeout` / `maxResponseBytes` / `maxRedirects` / `now` -- as pki.est.cacerts.
+ *   - `transactionId` / `senderNonce` / `dataReturn` -- what the request sent, for the exchange binding.
+ *   - `responderCerts` -- EXTRA certificates for CMC signer lookup, for a response that does not carry
+ *     its own signer; the certificates the response carries are searched either way. The carrier's
+ *     signature MUST be verified (RFC 5272 sec. 3.2.1.3.4), so a `CMC-response` whose signer is found
+ *     nowhere and which does not name the opt-out below is refused.
+ *   - `responseRecipient` -- key material for a response carried in AuthenticatedData, in the shape
+ *     `pki.cms.decrypt` takes. Its MAC is then checked and the verdict reports
+ *     `signatureVerified: true`, rather than the carrier being reachable only unauthenticated.
+ *   - `allowUnverifiedResponse` -- accept a `CMC-response` whose signer certificate cannot be found,
+ *     without checking its signature; the verdict then reports `signatureVerified: false`. For an
+ *     unauthenticated bootstrap only, and it never excuses a signature that is present and wrong.
+ *   - `username` / `password` / `allowCrossOriginRedirect` -- as pki.est.simpleenroll.
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var key = await pki.key.export(pair.privateKey);
+ *   var spki = await pki.key.export(pair.publicKey);
+ *   var cert = await pki.x509.sign({ subject: "device.example", subjectPublicKey: spki,
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: key });
+ *   var csr = await pki.csr.sign({ subject: "device.example", subjectPublicKey: spki }, { key: key });
+ *   var request = await pki.cmc.build({ requests: [{ tcr: csr }] }, { cert: cert, key: key });
+ *   // a 202 means the CA queued the request -- the verb surfaces the delay, never sleeps
+ *   var r = await pki.est.fullcmc("https://ca.example", request,
+ *     { transport: function () { return Promise.resolve({ status: 202, headers: { "retry-after": "60" }, body: "" }); } });
+ *   r.retry && r.retryAfterSeconds;   // 60
+ */
+function fullcmc(baseUrl, request, opts) {
+  opts = opts || {};
+  // Everything this exchange MEANS is captured synchronously, before a single
+  // deferred turn: the request bytes (copied), the keys they ask to have
+  // certified, and the state the response will be checked against. Doing it
+  // inside the promise body below would be a turn too late -- a caller that
+  // mutates the buffer or flips allowUnverifiedResponse on the line after this
+  // call has already changed them by then, which is the easiest version of the
+  // race to hit and the one that would skip the signature check.
+  var der, wanted, sent;
+  try {
+    if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw E("est/bad-input", "pki.est.fullcmc options must be an object");
+    der = _cmcRequestDer(request);
+    // Confirm this IS a Full PKI Request before any of it goes over the wire. The
+    // bytes are about to be labelled `smime-type=CMC-request`, so a PKIResponse or
+    // an unparseable blob handed in by mistake would be POSTed to a CA under a
+    // label that does not describe it -- and, since only an `issued` outcome is
+    // correlated, could still come back as a pending or rejected verdict, making
+    // the mistake look like a protocol answer. A caller error belongs at the entry
+    // point, not on the network.
+    wanted = _requestedPublicKeys(der);
+    // The exchange state is READ BACK OUT OF THE REQUEST, not taken on the caller's
+    // word. A value supplied here that the request does not actually carry would
+    // have the response checked against a binding this exchange never sent -- and a
+    // replayed response echoing that value would satisfy it. What the request says
+    // is the only thing that can bind the answer to it.
+    sent = _cmcSent(opts, der);
+    // The TRANSPORT options are pinned here too, not only the binding state. They
+    // decide where this request goes and what trust it goes under -- transport,
+    // tls, credentials, redirect policy.
+    opts = _shallowCopy(opts);
+    // And the request is STARTED here, synchronously, rather than in a deferred
+    // turn. That is what actually closes the window: a copy only reaches as deep
+    // as it is written, so nested config (opts.tls and its anchors) would still be
+    // the caller's to change while the request sat queued. Handing the options to
+    // _client before yielding leaves no turn in which any of them, at any depth,
+    // can differ from what this call was made with.
+    var body = transferEncode(der);
+    return _client("fullcmc", "POST", baseUrl, body,
+      { accept: "application/pkcs7-mime", "content-type": "application/pkcs7-mime; smime-type=CMC-request" }, opts)
+      .then(function (res) { return _fullcmcResult(res, opts, wanted, sent); });
+  } catch (e) {
+    return Promise.reject(e);   // the surface stays promise-rejecting, never throwing
+  }
+}
+
+/**
+ * Tie a returned certificate bag back to the requests it claims to answer, for
+ * BOTH response arms -- the rule is one rule, so it lives in one place rather than
+ * being restated per arm where one arm can quietly lose it.
+ *
+ * Every certification request the message submitted must be answered before the
+ * exchange reads as an issuance: a bag holding a CA chain, someone else's
+ * certificate, or only some of the requested keys is a partial or unrelated answer,
+ * not a success. Matching is by public key, the only identification RFC 5272
+ * sec. 4.1 sanctions ("the certificates are in any order" -- position means
+ * nothing).
+ *
+ * Each certificate is CONSUMED as it is matched, so two requests that share a
+ * public key -- CSRs for different subjects, say -- need two certificates rather
+ * than matching the same one twice and reporting an unanswered request as answered.
+ */
+function _correlateIssued(bag, wanted, arm) {
+  if (!wanted.length) {
+    throw E("est/no-issued-cert",
+      "this /fullcmc request declared no certification request whose key a returned certificate could be " +
+      "matched against, so a " + arm + " response cannot be read as an issuance (RFC 5272 sec. 4.1)");
+  }
+  // Counted PER DISTINCT KEY, because "how many certificates should match this
+  // key?" is answered by how many requests asked for it. Two requests may share a
+  // public key deliberately -- different subjects for one key -- and a CA
+  // answering both returns two certificates for it. Rejecting the second as
+  // ambiguous would refuse the complete, correct response; requiring only one
+  // would let a half-answer pass. So the count must agree exactly.
+  var byKey = {};
+  wanted.forEach(function (k) {
+    var hex = k.toString("hex");
+    if (!byKey[hex]) byKey[hex] = { key: k, want: 0, have: null };
+    byKey[hex].want += 1;
+  });
+  Object.keys(byKey).forEach(function (hex) {
+    var e = byKey[hex];
+    e.have = _allMatching(bag || [], e.key);
+    if (e.have.length < e.want) {
+      throw E("est/no-issued-cert",
+        "the /fullcmc " + arm + " response carried " + e.have.length + " certificate(s) for a public key " +
+        e.want + " certification request(s) asked to have certified, so it does not answer this request " +
+        "(RFC 5272 sec. 4.1)");
+    }
+    if (e.have.length > e.want) {
+      throw E("est/ambiguous-issued-cert",
+        "the /fullcmc response carried more certificates matching a submitted request key than there were " +
+        "requests for it; the issued certificate is ambiguous (RFC 5272 sec. 4.1)");
+    }
+  });
+  // Each certificate handed out once. Where the requested keys are distinct this
+  // lands in request order; where several requests share ONE key it cannot, and
+  // does not pretend to -- the public key is the only identification RFC 5272
+  // sec. 4.1 sanctions, so when it is shared nothing in the response says which
+  // of those requests a given certificate answers. What is established either way
+  // is the set: every requested key is answered, and by exactly as many
+  // certificates as asked for it.
+  return wanted.map(function (k) { return byKey[k.toString("hex")].have.shift(); });
+}
+
+// Every certificate in the bag whose subject public key is `key`, found through
+// the same public-key match the single-certificate case uses so the two cannot
+// disagree about what "matches" means.
+function _allMatching(bag, key) {
+  var rest = bag.slice(), out = [], hit;
+  while ((hit = findIssuedCert(rest, key)) !== null) {
+    out.push(hit);
+    rest = rest.filter(function (c) { return c !== hit; });
+  }
+  return out;
+}
+
+// The public keys the submitted Full PKI Request asked to have certified. A
+// certs-only answer carries no status and no request reference, so these are the
+// ONLY thing a returned certificate can be tied back to -- and RFC 5272 sec. 4.1
+// forbids identifying the issued certificate positionally ("the certificates are
+// in any order"). Both key-bearing request arms are read; an `orm` arm carries no
+// key and contributes none, and an arm that will not parse contributes none rather
+// than failing the exchange -- the caller still gets a refusal downstream, because
+// an empty set cannot match anything.
+function _requestedPublicKeys(der) {
+  var out = [], body;
+  try { body = cmcFmt.parse(der); }
+  catch (e) {
+    throw E("est/bad-input",
+      "pki.est.fullcmc requires a Full PKI Request (id-cct-PKIData); this input did not parse as one", e);
+  }
+  if (body.kind !== "pkiData") {
+    throw E("est/bad-input",
+      "pki.est.fullcmc sends a Full PKI Request (id-cct-PKIData); this input is a " + body.kind);
+  }
+  (body.requests || []).forEach(function (r) {
+    // A key-bearing arm whose key cannot be read must NOT quietly contribute
+    // nothing. The CMC parser validates these arms only far enough to find their
+    // identity, so a malformed one reaches here; dropping it would leave the
+    // correlation blind to a request that was still sent, and a response covering
+    // only the readable arms would then read as a complete issuance. Refused at
+    // the entry point, like any other request this verb cannot stand behind.
+    var before = out.length;
+    var keyBearing = !!(r.certificationRequestBytes || r.certReqMsgBytes);
+    try {
+      if (r.certificationRequestBytes) {
+        var spki = csr.parse(r.certificationRequestBytes).subjectPublicKeyInfo;
+        if (spki && Buffer.isBuffer(spki.bytes)) out.push(spki.bytes);
+        if (out.length === before) _unreadableArm();
+        return;
+      }
+      if (r.certReqMsgBytes) {
+        // pki.schema.crmf reads CertReqMessages (SEQUENCE OF CertReqMsg); the CMC
+        // arm holds ONE CertReqMsg, so it is wrapped rather than decoded here --
+        // the CRMF rules stay in the CRMF parser instead of being restated.
+        var msgs = crmfFmt.parse(asn1.build.sequence([r.certReqMsgBytes])).messages;
+        var msg0 = msgs && msgs[0];
+        var tmpl = msg0 && msg0.certReq && msg0.certReq.certTemplate;
+        // RFC 4211 sec. 4.1: the requested key may be absent from the CertTemplate
+        // and carried in the signature POP's POPOSigningKeyInput instead -- a form
+        // this toolkit's own CRMF parser accepts and surfaces. Reading only the
+        // template would refuse a conforming request before it was ever sent.
+        var pk = (tmpl && tmpl.publicKey) ||
+          (msg0 && msg0.popo && msg0.popo.poposkInput && msg0.popo.poposkInput.publicKey);
+        var pkBytes = Buffer.isBuffer(pk) ? pk : (pk && pk.bytes);
+        if (Buffer.isBuffer(pkBytes)) out.push(pkBytes);
+        if (out.length === before) _unreadableArm();
+      }
+    } catch (e) {
+      if (!keyBearing) return;   // an orm arm carries no key and is not expected to
+      throw (e && e.code === "est/bad-input") ? e : E("est/bad-input",
+        "a certification request in this Full PKI Request could not be read, so a response could not be " +
+        "tied back to it; pki.est.fullcmc will not send a request it cannot check the answer to", e);
+    }
+  });
+  return out;
+}
+
+function _unreadableArm() {
+  throw E("est/bad-input", "a certification request in this Full PKI Request declares no readable public key");
+}
+
+// What the caller retained, threaded to pki.cmc.verify -- the exchange binding
+// AND the carrier-authentication inputs. Built in one place so the success and
+// rejection arms cannot drift apart about what this exchange is.
+// Captured SYNCHRONOUSLY, before the request goes out, and with the byte buffers
+// copied. Everything here is read again only after the transport resolves, so
+// reading the caller's live options at that point would let an object mutated
+// during the round trip decide the checks -- and flipping allowUnverifiedResponse
+// mid-flight would skip the signature check the default posture requires.
+// pki.cmc.verify freezes its own inputs too; this is the wrapper's half of the
+// same rule, because by the time it calls verify the damage would already be done.
+function _cmcSent(opts, der) {
+  var carried = _requestBinding(der);
+  // A caller-supplied value must AGREE with the request. Silently preferring one
+  // over the other would leave the response checked against something the request
+  // may never have carried; refusing the disagreement keeps the two honest.
+  _assertAgrees("transactionId", opts.transactionId, carried.transactionId);
+  _assertAgrees("senderNonce", opts.senderNonce, carried.senderNonce);
+  _assertAgrees("dataReturn", opts.dataReturn, carried.dataReturn);
+  return {
+    transactionId: carried.transactionId,
+    senderNonce: _copyBytes(carried.senderNonce),
+    dataReturn: _copyBytes(carried.dataReturn),
+    bodyPartIDs: carried.bodyPartIDs,
+    // The nested paths travel with the flat identifiers: a status may name a body part inside a
+    // nested message this request carried, and forwarding only the flat set would leave every
+    // such reference unconfirmable and therefore refused.
+    bodyPartPaths: carried.bodyPartPaths,
+    certs: Array.isArray(opts.responderCerts) ? opts.responderCerts.map(_copyBytes) : opts.responderCerts,
+    // The AuthenticatedData carrier's key material. Without this the verb could
+    // reach that carrier only through the unauthenticated opt-out -- the capability
+    // would exist one layer down and be unreachable from the one operators call.
+    recipient: _copyRecipient(opts.responseRecipient),
+    allowUnverified: opts.allowUnverifiedResponse === true,
+  };
+}
+
+// EVERY byte form the parsers and crypto routines downstream accept, not just the two most
+// common: a DataView or a bare ArrayBuffer arrives by the same door as a Buffer, and the values
+// this copies -- the nonce the response must echo, the certificates that authenticate it, the
+// recipient key material -- are all read after the transport resolves. Covering only Buffer and
+// Uint8Array would leave those forms aliased across the request's whole flight, which is the same
+// window this exists to close, open for exactly the inputs that came in by the wider door.
+// A DataView is copied over its OWN window, not the whole backing buffer it happens to sit in.
+function _copyBytes(v) {
+  if (Buffer.isBuffer(v) || v instanceof Uint8Array) return Buffer.from(v);
+  if (ArrayBuffer.isView(v)) return Buffer.from(new Uint8Array(v.buffer, v.byteOffset, v.byteLength));
+  if (v instanceof ArrayBuffer) return Buffer.from(new Uint8Array(v));
+  return v;
+}
+
+// The exchange-binding controls the request ACTUALLY carries (RFC 5272 sec. 6.6
+// Transaction Identifier / Sender Nonce, sec. 6.4 Data Return). These are what the
+// response has to echo, so they are read from the bytes going out rather than from
+// a parallel claim that could disagree with them.
+function _requestBinding(der) {
+  var out = { transactionId: undefined, senderNonce: undefined, dataReturn: undefined, bodyPartIDs: undefined,
+    bodyPartPaths: undefined };
+  // Parsed WITHOUT a fallback. The caller reaches this only after the request has
+  // already been confirmed to be a Full PKI Request, so a parse failure here is
+  // impossible rather than expected -- and defaulting to "no binding" if it ever
+  // became possible is the wrong answer anyway: a request whose controls could not
+  // be read would face no echo requirement at all, which is a weaker exchange than
+  // the one being sent. Letting the typed decode error propagate keeps it closed.
+  var body = cmcFmt.parse(der);
+  // Every identifier this request actually carries. A status in the response names
+  // the body parts it is ABOUT, and a status naming a body part that was never
+  // sent is not an answer to this request -- so the client keeps the set it can
+  // check that claim against, the same way it keeps the transaction and nonce.
+  // Collected from all four sequences because RFC 5272 sec. 3.2.1 draws every
+  // identifier from ONE space; a status may legitimately reference a control or a
+  // content info, not only a certification request.
+  var ids = [];
+  var paths = [];
+  [body.requests, body.controls, body.cmsSequence, body.otherMsgs].forEach(function (list) {
+    (list || []).forEach(function (el) {
+      if (el && el.bodyPartID != null) { ids.push(el.bodyPartID); paths.push([el.bodyPartID]); }
+    });
+  });
+  // A cmsSequence element carries a NESTED CMS message, which may itself be a Full PKI
+  // Request (sec. 3.2.1), and a response identifies a body part inside one by the path
+  // [outer, inner...]. This client composed that nested message, so it can confirm such a
+  // path -- but only by reading the message back, which is what this does. A nested message
+  // this parser cannot read back yields no retained path, so a status naming a part inside
+  // it is still refused: what cannot be read cannot be confirmed.
+  _collectNestedPaths(body.cmsSequence, [], paths, 0);
+  out.bodyPartIDs = ids;
+  out.bodyPartPaths = paths;
+  (body.controls || []).forEach(function (c) {
+    var field = c.attrType === OID_CMC_TRANSACTION_ID ? "transactionId"
+      : c.attrType === OID_CMC_SENDER_NONCE ? "senderNonce"
+        : c.attrType === OID_CMC_DATA_RETURN ? "dataReturn" : null;
+    if (!field) return;                                   // not a binding control
+    // Duplicates are ambiguous, and ambiguity here decides what the response must
+    // echo: taking the last would bind the answer to one of two values the request
+    // sent, chosen arbitrarily. pki.cmc.verify already refuses duplicate binding
+    // controls on the response; the request side is held to the same rule rather
+    // than shipping a message whose own binding cannot be read one way.
+    if (out[field] !== undefined) {
+      throw E("est/bad-input",
+        "the Full PKI Request carries more than one " + field + " control, so there is no single value " +
+        "the response can be bound to (RFC 5272 sec. 6.6 / 6.4)");
+    }
+    // A binding control that is PRESENT but unreadable must not decay into
+    // "absent". Doing so would drop the replay check for a request that carries
+    // the control -- the response would then face no echo requirement at all,
+    // which is a weaker exchange than the one being sent. An unreadable security
+    // control is a refusal, not a default.
+    var v = c.values && c.values.length === 1 ? c.values[0] : null;
+    if (!v) {
+      throw E("est/bad-input",
+        "the Full PKI Request's " + field + " control must carry exactly one value (RFC 5272 sec. 6.6 / 6.4)");
+    }
+    try {
+      out[field] = field === "transactionId"
+        ? asn1.read.integer(asn1.decode(v))
+        : asn1.read.octetString(asn1.decode(v));
+    } catch (e) {
+      throw E("est/bad-input",
+        "the Full PKI Request's " + field + " control could not be read, so the response could not be " +
+        "checked against it; a request is not sent under a binding that cannot be enforced", e);
+    }
+  });
+  return out;
+}
+
+// Every body-part path reachable inside the nested messages this request carries, so a status
+// naming one can be confirmed rather than refused outright. Descends only into a nested message
+// this parser reads back as a PKIData: anything else yields no path, and a status naming a part
+// inside it stays a refusal, because a reference that cannot be checked is not one to accept.
+// The depth cap bounds the walk; a request nested deeper than this is composed by nobody in
+// practice, and stopping simply leaves those paths unretained -- which refuses, not accepts.
+var NESTED_PATH_DEPTH_CAP = 8;
+function _collectNestedPaths(list, prefix, out, depth) {
+  if (depth >= NESTED_PATH_DEPTH_CAP) return;
+  (list || []).forEach(function (el) {
+    if (!el || el.bodyPartID == null || !el.contentInfoBytes) return;
+    var inner;
+    // A nested element that cannot be read back as a Full PKI Request contributes no path, by
+    // either route: the read throws, or it succeeds and yields some other content type. Both land
+    // on the same refusal downstream -- a status naming a part inside it finds no retained path --
+    // so neither can widen what the response may report on. Nothing is absorbed here that a
+    // verdict then rests on; the absence of a path IS the fail-closed answer.
+    try { inner = cmcFmt.parse(el.contentInfoBytes); }
+    catch (_e) { /* allow:swallow-unverified the outer request must itself parse for this to run, which already rejects a malformed nested ContentInfo; a payload that survives that and still fails to read back lands on the same no-path refusal the non-pkiData route below takes, which the vectors drive */ return; }
+    if (!inner || inner.kind !== "pkiData") return;
+    var path = prefix.concat([el.bodyPartID]);
+    [inner.requests, inner.controls, inner.cmsSequence, inner.otherMsgs].forEach(function (l) {
+      (l || []).forEach(function (e2) { if (e2 && e2.bodyPartID != null) out.push(path.concat([e2.bodyPartID])); });
+    });
+    _collectNestedPaths(inner.cmsSequence, path, out, depth + 1);
+  });
+}
+
+function _assertAgrees(name, supplied, carried) {
+  if (supplied == null) return;
+  var same;
+  if (Buffer.isBuffer(supplied) || supplied instanceof Uint8Array) {
+    same = Buffer.isBuffer(carried) && Buffer.from(supplied).equals(carried);
+  } else {
+    // Through the shared authoring guard, not a bare BigInt(): a `number` above
+    // Number.MAX_SAFE_INTEGER has already lost the digits that distinguish it from
+    // its neighbour, so converting it here would compare a value the caller never
+    // wrote. A transaction identifier is an unbounded INTEGER on the wire; large
+    // ones are passed as a bigint, and this says so rather than rounding.
+    same = carried != null &&
+      guard.range.authoredInteger(supplied, E, "est/bad-input", "opts." + name) === BigInt(carried);
+  }
+  if (!same) {
+    throw E("est/bad-input",
+      "opts." + name + " does not match the " + name + " control the Full PKI Request carries; the " +
+      "response is checked against what was sent, so the two must agree (RFC 5272 sec. 6.6 / 6.4)");
+  }
+}
+
+// The recipient descriptor, one level deep with its byte values copied -- key
+// material is read after the round trip like everything else in this snapshot.
+function _copyRecipient(r) {
+  if (!r || typeof r !== "object") return r;
+  var out = {}, k;
+  for (k in r) { if (Object.prototype.hasOwnProperty.call(r, k)) out[k] = _copyBytes(r[k]); }
+  return out;
+}
+
+// Own enumerable properties, one level, plus a copy of `auth`. The extra level is
+// not decoration: credentials are the one nested object read AFTER an await --
+// _drive reads the scheme, the username and password, and the Digest policy only
+// once a 401 comes back -- so leaving it shared would let an options object
+// mutated during the round trip change which credentials go out, or turn on a
+// digest algorithm the request did not start with. Everything else here is either
+// read before the request leaves or is a value the caller means to own (a
+// transport function, a tls config).
+function _shallowCopy(o) {
+  var out = {}, k;
+  for (k in o) { if (Object.prototype.hasOwnProperty.call(o, k)) out[k] = o[k]; }
+  if (out.auth && typeof out.auth === "object") {
+    var a = {}, ak;
+    for (ak in out.auth) { if (Object.prototype.hasOwnProperty.call(out.auth, ak)) a[ak] = out.auth[ak]; }
+    out.auth = a;
+  }
+  return out;
+}
+
+// The Full PKI Request bytes: a DER Buffer, or a PEM CMS block. Anything else is
+// a caller mistake caught before the transport is touched.
+function _cmcRequestDer(request) {
+  // COPIED, not aliased: these bytes are parsed now (for the requested keys) and
+  // transmitted later, so sharing the caller's buffer would let the two disagree.
+  if (Buffer.isBuffer(request)) return Buffer.from(request);
+  if (request instanceof Uint8Array) return Buffer.from(request);
+  if (typeof request === "string") return cms.pemDecode(request);
+  throw E("est/bad-input", "pki.est.fullcmc requires the Full PKI Request as DER bytes or a PEM CMS block");
+}
+
+// The result function for /fullcmc. Deliberately NOT _certsResult: the two differ
+// on the point RFC 7030 sec. 4.2.3 and sec. 4.3.2 disagree about. On the sibling
+// enroll verbs a Simple PKI Response on an error only MAY be present; on
+// /fullcmc "A CMC response with the content-type of application/pkcs7-mime MUST
+// be included in the response data for any CMC error response", so the CMC
+// verdict is decoded and surfaced. What must NOT happen is the decode failing and
+// taking the HTTP fault with it -- an unreadable error body leaves the fault
+// reported as itself.
+function _fullcmcResult(res, opts, wanted, sent) {
+  // classifyResponse is the single authority on what an HTTP status means here,
+  // and it THROWS est/http-error on a 4xx/5xx rather than returning a verdict.
+  // So the rejection path runs from its exception: the mandated CMC response is
+  // decoded and, if readable, REPLACES the fault with a richer typed one. If it
+  // cannot be read, the original fault is rethrown untouched -- an unreadable
+  // error body is a worse fault than the status, never a way to lose it.
+  var verdict;
+  try {
+    verdict = classifyResponse(res.status, res.headers, res.body, { op: "fullcmc", now: opts.now });
+  } catch (httpFault) {
+    // ONLY an actual rejection status earns the richer error. classifyResponse also
+    // throws when a NON-error response fails its own validation -- a 200 with a
+    // missing or unrecognized smime-type, a 202 with no Retry-After -- and those
+    // faults are about the response being malformed, not about the CA refusing.
+    // Letting a signed CMC body replace them would let a malformed 200 answer as
+    // though it were a clean rejection, and the validation it failed would never be
+    // reported. The status is read from the response, not from the fault, so a
+    // future fault type cannot quietly opt itself into the upgrade.
+    if (!(res.status >= 400 && res.status <= 599)) throw httpFault;
+    return _tryDecodeCmcFault(res, sent).then(function (cmcErr) { throw cmcErr || httpFault; });
+  }
+
+  if (verdict.status === "not-implemented") {
+    // Takes precedence over any body: the service is absent, so there is no CMC
+    // verdict to read (RFC 7030 sec. 4.3.2 -- 404 or 501).
+    throw E("est/not-implemented",
+      "the EST server does not implement /fullcmc (HTTP " + verdict.httpStatus + "; RFC 7030 sec. 4.3.2)");
+  }
+  if (verdict.status === "retry") {
+    return { retry: true, retryAfterSeconds: verdict.retryAfterSeconds, retryAfterDate: verdict.retryAfterDate };
+  }
+  if (verdict.status !== "ok") {
+    throw E("est/http-error",
+      "an EST /fullcmc response must be HTTP 200 or 202 (RFC 7030 sec. 4.3.2), got " + res.status);
+  }
+
+  var bodyLen = Buffer.isBuffer(res.body) ? res.body.length : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
+  if (bodyLen === 0) throw E("est/empty-body", "a 200 /fullcmc response carried an empty body (RFC 7030 sec. 4.3.2)");
+  var der = transferDecode(res.body);
+
+  // FC5 admits two smime-types, and the LABEL must agree with the BYTES: a
+  // certs-only label over a Full PKI Response (or the reverse) is a server
+  // mislabelling its own body, and accepting either shape under either label
+  // would make the content-type check decorative.
+  // Through the shared case-insensitive accessor: HTTP header names are
+  // case-insensitive (RFC 9110 sec. 5.1), the classifier already reads them that
+  // way, and a second lookup that guessed at two spellings would disagree with it
+  // for a conformant server -- routing a certs-only body down the wrong arm.
+  var pt200 = _partMediaType(_ciHeader(res.headers, "content-type"));
+  // A header declaring BOTH arms selects neither. Taking the first would let the
+  // order of two labels decide which shape the body is read as, on a header whose
+  // whole job here is to say which one it is.
+  if (pt200.ambiguous) {
+    throw E("est/bad-content-type",
+      "the 200 /fullcmc Content-Type declares more than one smime-type, so which response arm this is " +
+      "cannot be told from it (RFC 7030 sec. 4.3.2)");
+  }
+  var smimeType = pt200.smimeType;
+  if (smimeType === "certs-only") {
+    // A certs-only body is a degenerate certificates-only SignedData: it carries no
+    // CMC controls, so it CANNOT echo a Transaction Identifier, Sender Nonce or
+    // Data Return. A client that sent those asked for replay binding, and the
+    // public-key correlation below is not one -- an old response for the same key
+    // still matches. Accepting this arm would silently give none of what was asked
+    // for, so it is refused; a caller who does not need the binding simply does not
+    // send the controls.
+    var unecho = ["transactionId", "senderNonce", "dataReturn"].filter(function (k) {
+      return sent[k] != null;
+    });
+    if (unecho.length) {
+      throw E("est/unbound-response",
+        "the request carried " + unecho.join(" / ") + ", which a certs-only response has no controls to " +
+        "echo, so the replay binding it asked for cannot be checked (RFC 5272 sec. 6.6 / 6.4)");
+    }
+    var certs = parseCertsOnly(der);            // throws est/not-certs-only on a Full PKI Response
+    // A certs-only body says nothing about WHICH request it answers -- no status,
+    // no body-part reference. So the issued certificate is identified the one way
+    // RFC 5272 sec. 4.1 sanctions, by public-key match against what was submitted,
+    // exactly as /simpleenroll and /serverkeygen already do. Without this, a bag
+    // holding only a CA chain -- or a certificate for someone else's key -- reads
+    // as a successful issuance for this request.
+    var issuedCerts = _correlateIssued(certs.certificates, wanted, "certs-only");
+    var issued = issuedCerts[0];
+    // `signatureVerified: false` is stated, not omitted. A certs-only body is a
+    // DEGENERATE certificates-only SignedData -- RFC 5652 sec. 5.2 defines it with
+    // an empty signerInfos set -- so there is no signature here to check, and
+    // demanding one would reject every conformant server. What this arm must not
+    // do is leave the field undefined while the cmc-response arm sets it: a caller
+    // reading `verdict.signatureVerified` would then get a different KIND of answer
+    // depending on which arm the server happened to choose. RFC 7030 secures this
+    // arm through the authenticated TLS channel instead, and the certificates stay
+    // `trusted: false` for the caller to run through pki.path.validate.
+    return { outcome: "issued", certificate: issued, issuedCertificates: issuedCerts,
+      certificates: certs.certificates, crls: certs.crls,
+      controls: [], statuses: [], publishTrustAnchors: null, trusted: false,
+      signatureVerified: false };
+  }
+  // smime-type=cmc-response: the Full PKI Response, interpreted into one verdict.
+  // pki.cmc.verify owns the transaction binding and the status reduction; this
+  // verb only supplies what the caller retained.
+  return cmcVerify.verify(der, sent).then(function (verdict) {
+    // An `issued` verdict is a claim about THIS request, so it is held to the same
+    // correlation as the certs-only arm. A status control saying success while the
+    // bag holds a CA chain, someone else's certificate, or nothing at all does not
+    // make an issuance -- and the status is the server's word, whereas the key
+    // match is checkable. Only `issued` is correlated: pending / pop-required /
+    // confirm-required / rejected are not claims that a certificate was issued.
+    if (verdict.outcome !== "issued") return verdict;
+    // A request that asked for no certificate cannot have one correlated to it. An
+    // orm-only Full PKI Request is exactly that: the other-message arm carries no
+    // certification request and no key, and RFC 5272 lets a server answer it
+    // successfully with its result in the cmsSequence or otherMsgSequence rather
+    // than as an issuance. Reading `issued` there as "a certificate must match"
+    // would make this verb unable to carry that exchange at all. The response's own
+    // certificate bag is still surfaced raw, untrusted, for pki.path.validate.
+    //
+    // The certs-only arm keeps the opposite rule, and deliberately: that body is
+    // nothing BUT a claim of certificate issuance, so with nothing to match it
+    // against there is no way to say it answers this request.
+    if (!wanted.length) { verdict.issuedCertificates = []; return verdict; }
+    var issuedCerts = _correlateIssued(verdict.certificates, wanted, "CMC-response");
+    verdict.certificate = issuedCerts[0];
+    verdict.issuedCertificates = issuedCerts;
+    return verdict;
+  });
+}
+
+// Decode the CMC response a rejection MUST carry, returning a typed est/cmc-failed
+// with the verdict attached -- or null when it cannot be read, so the caller
+// reports the HTTP fault instead of an asn1/* leak from a body that was never
+// going to parse.
+function _tryDecodeCmcFault(res, sent) {
+  return Promise.resolve().then(function () {
+    var pt = _partMediaType(_ciHeader(res.headers, "content-type"));
+    if (pt.media !== "application/pkcs7-mime") return null;
+    // A header declaring two smime-types cannot vouch for the body either. This
+    // path returns NULL rather than throwing, so the caller reports the HTTP fault
+    // the response actually carried -- replacing a real server error with a
+    // content-type complaint would hide the thing the operator needs to see.
+    if (pt.ambiguous) return null;
+    // The LABEL must agree with the bytes here too. The success path refuses a
+    // certs-only label over a Full PKI Response and the reverse; accepting any
+    // pkcs7-mime on the error path would make that agreement decorative, and would
+    // read a CMC verdict out of a body the server said was something else. RFC 7030
+    // sec. 4.3.2 makes the rejection body a CMC-response.
+    if (String(pt.smimeType || "").toLowerCase() !== "cmc-response") return null;
+    // The SAME binding the success path applies. An error response that does not
+    // echo this exchange's transaction / nonce is not this request's answer, and
+    // attaching it would let a replayed or unrelated failure be reported as the
+    // verdict for the request just sent. A binding failure makes verify reject,
+    // which lands in the catch below and leaves the HTTP fault reported.
+    return cmcVerify.verify(transferDecode(res.body), sent).then(function (verdict) {
+      // Only an actual REJECTION becomes the richer error. A CMC body inside an
+      // HTTP failure that says the request was issued is the server contradicting
+      // itself, and reporting it as "the server rejected the Full PKI Request:
+      // issued" would hand the caller a successful outcome wrapped in a rejection.
+      // Returning null there leaves the HTTP fault standing, which is the honest
+      // report of what happened. RFC 7030 sec. 4.3.2 makes the body a MUST for a
+      // rejection, which is the case this upgrade exists for.
+      if (verdict.outcome !== "rejected") return null;
+      var e = E("est/cmc-failed",
+        "the EST server rejected the Full PKI Request: " + verdict.outcome +
+        (verdict.failInfo ? " (" + verdict.failInfo + ")" : "") + " [HTTP " + res.status + "]");
+      e.cmc = verdict;
+      e.httpStatus = res.status;
+      return e;
+    });
+  // EVERY way the attempt can fail lands here, not just the verify rejection:
+  // transferDecode throws synchronously on a non-base64 body, which is exactly
+  // the shape FC7a is about. Returning null makes the caller rethrow the ORIGINAL
+  // HTTP fault -- nothing is absorbed into a verdict, and the richer error is
+  // only ever an upgrade, never a substitute that loses the status.
+  }).then(null, function () { return null; });
+}
+
 function _enroll(op, baseUrl, csrInput, opts) {
   var csrDer = _csrDer(csrInput);
   var spki = csr.parse(csrDer).subjectPublicKeyInfo;
@@ -986,7 +1746,7 @@ function _enroll(op, baseUrl, csrInput, opts) {
  * anchor on the next call.
  *
  * @opts
- *   - `transport` -- an injected transport(request) -> {status, headers, body}; default pki.transport.https.
+ *   - `transport` -- an injected transport(request) -> {status, headers, body, tls}; default pki.transport.https.
  *   - `tls` -- { anchors, useSystemStore, cert, key, minVersion, servername, checkServerIdentity }.
  *   - `label` -- an OPTIONAL CA label path segment; `timeout` / `maxResponseBytes` / `maxRedirects` -- budgets.
  *   - `now` -- receipt time (epoch ms) to render a 202 Retry-After HTTP-date as seconds.
@@ -1114,12 +1874,47 @@ function _assertConfidentialCipher(res) {
 // A case-insensitive header lookup: the injectable transport seam only promises { status, headers, body }, so a
 // hostile / non-Node transport may deliver "Content-Type" in any casing -- read it case-insensitively (classifyResponse
 // normalizes internally, but the multipart boundary is read from the header directly here).
+// A header, read case-insensitively (RFC 9110 sec. 5.1) -- and refused when the map
+// carries the SAME field under more than one spelling. HTTP header names are
+// case-insensitive, so `content-type` and `Content-Type` are one field with two
+// values; a reader that prefers the exact key and a reader that lowercases into a
+// map keep different ones, and this verb has both. Two stages that disagree about
+// which response arm a body is can accept a response the header declares twice
+// over. That is the same ambiguity a repeated Content-Type PARAMETER raises, at the
+// level of the field itself, and it gets the same answer: refused, not resolved by
+// which spelling was reached first.
+// A LIST field, read case-insensitively and combined across every spelling it
+// arrived under. RFC 9110 sec. 5.3 lets a recipient join multiple lines of a
+// list-based field into one comma-separated value, and sec. 11.6.1 makes
+// WWW-Authenticate exactly that -- one challenge per element. Refusing repetition
+// here would reject a server offering both Digest and Basic, which is not an
+// ambiguity but the field doing its job.
+function _ciHeaderList(headers, name) {
+  headers = headers || {};
+  var lname = name.toLowerCase(), keys = Object.keys(headers), parts = [];
+  for (var i = 0; i < keys.length; i++) {
+    if (keys[i].toLowerCase() !== lname) continue;
+    var v = headers[keys[i]];
+    if (v == null) continue;
+    parts.push(Array.isArray(v) ? v.join(", ") : String(v));
+  }
+  return parts.length ? parts.join(", ") : null;
+}
+
 function _ciHeader(headers, name) {
   headers = headers || {};
-  if (headers[name] !== undefined) return headers[name];
-  var lname = name.toLowerCase(), keys = Object.keys(headers);
-  for (var i = 0; i < keys.length; i++) { if (keys[i].toLowerCase() === lname) return headers[keys[i]]; }
-  return null;
+  var lname = name.toLowerCase(), keys = Object.keys(headers), found = null, n = 0;
+  for (var i = 0; i < keys.length; i++) {
+    if (keys[i].toLowerCase() !== lname) continue;
+    n += 1;
+    if (n === 1) found = headers[keys[i]];
+  }
+  if (n > 1) {
+    throw E("est/bad-content-type",
+      "the response carries more than one " + lname + " header field, so what the body is cannot be told " +
+      "from it (RFC 9110 sec. 5.1: field names are case-insensitive)");
+  }
+  return n === 0 ? null : found;
 }
 
 async function _serverkeygenResult(res, opts, derived) {
@@ -1285,4 +2080,5 @@ module.exports = {
   smimeCapabilitiesAttr: smimeCapabilitiesAttr,
   buildEnrollAttributes: buildEnrollAttributes,
   reenrollGuard: reenrollGuard,
+  fullcmc: fullcmc,
 };