@noz-ele/edgca 0.3.0 → 0.5.0

package/README.md

@@ -2,7 +2,7 @@
 
 > [日本語](https://github.com/noz-ele/EdgCA/blob/main/docs/jp/README.md) | English
 
-EdgCA is a small TypeScript library that issues mTLS client certificates from a self-managed CA on Cloudflare Workers-compatible runtimes. It supports internal keygen, CSR-based enrollment (PKCS#10 + proof-of-possession), and PFX (PKCS#12) export for OS keystore import.
+EdgCA is a small TypeScript library that issues mTLS client certificates and document-signing certificates from a self-managed CA on Cloudflare Workers-compatible runtimes. It supports internal keygen, CSR-based enrollment for mTLS leaves (PKCS#10 + proof-of-possession), and PFX (PKCS#12) export for OS keystore import.
 
 The scope is intentionally narrow:
 
@@ -10,6 +10,7 @@ The scope is intentionally narrow:
 - Issue an intermediate CA from a root CA.
 - Issue an mTLS client certificate and private key from an intermediate CA.
 - Issue an mTLS client certificate from a caller-provided public key (no private key returned). Pairs with the CSR helpers below.
+- Issue a document-signing certificate (RFC 9336 `id-kp-documentSigning`) and private key from a CA. Used as the signer cert for CAdES / CMS / ASiC-style document signatures, which are produced by separate tooling.
 - Parse a PKCS#10 CSR (subject, requested SAN, public key, raw extensions/attributes) and verify its proof-of-possession signature.
 - Decide whether a received client certificate was issued by your own CA.
 - Encode/decode certificates as PEM/DER. Keys are exchanged as `CryptoKey` only — the library never returns or accepts string forms (PEM, JWK, etc.) of private keys.
@@ -22,7 +23,9 @@ ECDSA on **NIST P-256, P-384, and P-521** is supported throughout (signing, veri
 
 ## Contents
 
+- [CLI](#cli) — `npx edgca …` one-liners for the four most common tasks
 - [Quick Start](#quick-start) — root → intermediate → client cert (incl. PFX bundling)
+- [Issue a document-signing certificate](#issue-a-document-signing-certificate) — RFC 9336 `id-kp-documentSigning` leaf
 - [Verify on Cloudflare Worker](#verify-cloudflare-worker) — confirm a cert was issued by your CA
 - [Issue from a CSR](#issue-from-a-csr) — accept a caller-managed key via PKCS#10 + POP
 - [Subject](#subject) · [Scope](#scope) · [Key Handling](#key-handling) · [Development](#development) · [API Documentation](#api-documentation)
@@ -39,6 +42,66 @@ npm install @noz-ele/edgca
 
 ESM-only (`"type": "module"`). Runs on any runtime where `globalThis.crypto.subtle` is available (Cloudflare Workers, Node.js 20+, modern browsers, etc.). CommonJS `require` is not supported.
 
+## CLI
+
+EdgCA ships a small zero-dependency CLI (`bin: edgca`) for the four most common one-shot tasks. It is a thin wrapper over the library API and uses `node:util.parseArgs` — no transitive dependencies are pulled in for non-CLI consumers.
+
+> `npx` runs the CLI **without installing** it — it fetches the package into npm's local cache, executes the `bin`, and leaves your project's `node_modules` / `package.json` untouched. Use this for one-shot tasks (creating a local dev CA, building a PFX). For repeated use, install globally with `npm install -g @noz-ele/edgca` and then call `edgca …` directly.
+
+All commands write outputs to the **current working directory**. Filenames are derived from `--name` (default: `root` / `intermediate` / `client`). Cert files are `<name>.crt.pem`, private keys are PKCS#8 PEM at `<name>.key.pem`, and full chains (when relevant) are `<name>.chain.pem`.
+
+```sh
+# 1. Create a root CA (default: P-256, 3650 days)
+npx @noz-ele/edgca create-root-ca --subject "CN=My Test Root,O=Acme,C=JP"
+# → ./root.crt.pem, ./root.key.pem
+
+# 2. Issue an intermediate CA from that root
+npx @noz-ele/edgca issue-intermediate-ca \
+  --ca-cert root.crt.pem --ca-key root.key.pem \
+  --subject "CN=My Intermediate,O=Acme"
+# → ./intermediate.crt.pem, ./intermediate.key.pem, ./intermediate.chain.pem
+
+# 3. Issue an mTLS client cert from the intermediate
+npx @noz-ele/edgca issue-client \
+  --ca-cert intermediate.crt.pem --ca-key intermediate.key.pem \
+  --ca-chain intermediate.chain.pem \
+  --subject "CN=alice" \
+  --dns-name alice.example.test --ip 10.0.0.1 \
+  --days 365
+# → ./client.crt.pem, ./client.key.pem, ./client.chain.pem
+
+# 4. Bundle a cert + key (+ optional chain) into a password-protected PFX
+npx @noz-ele/edgca pem-to-pfx \
+  --cert client.crt.pem --key client.key.pem --chain client.chain.pem \
+  --password "hunter2"
+# → ./client.pfx   (defaults to <cert-basename>.pfx next to --cert)
+```
+
+Flags summary (run `npx @noz-ele/edgca --help` to see this in your terminal):
+
+```
+edgca create-root-ca         --subject <dn>
+                             [--days 3650] [--curve P-256|P-384|P-521]
+                             [--name root]
+
+edgca issue-intermediate-ca  --ca-cert <pem> --ca-key <pem>
+                             --subject <dn>
+                             [--days 1825] [--curve P-256|P-384|P-521]
+                             [--name intermediate]
+
+edgca issue-client           --ca-cert <pem> --ca-key <pem> [--ca-chain <pem>]
+                             --subject <dn>
+                             [--dns-name <name>]... [--ip <addr>]...
+                             [--days 365] [--name client]
+
+edgca pem-to-pfx             --cert <pem> --key <pem> --password <pw>
+                             [--chain <pem>] [--out <pfx>]
+```
+
+`--subject` accepts an OpenSSL-style DN string (`"CN=foo,O=bar,C=JP"`); short names are case-insensitive (`CN`/`O`/`OU`/`C`/`ST`/`L`/`E`/`DC`/`SERIALNUMBER`/`STREET`/`POSTALCODE`/`TITLE`/`GIVENNAME`/`SURNAME`/`UID`), and dotted OID attributes (`1.2.840.113549.1.9.1=...`) are accepted as-is. Private keys are read/written as PKCS#8 PEM (`-----BEGIN PRIVATE KEY-----`); SEC1 (`EC PRIVATE KEY`) is not supported.
+
+> ⚠ The CLI is a convenience wrapper for local testing and one-shot operational tasks. For programmatic use in a server, Worker, or browser, call the library API directly — that way private keys stay in `CryptoKey` form and never touch disk. See [Key Handling](#key-handling) for the rationale.
+
 ## Quick Start
 
 ```ts
@@ -119,6 +182,46 @@ The implementation is environment-agnostic (WebCrypto only, no Node-specific API
 
 The `@noz-ele/edgca/pkcs12` subpath is provided so consumers that only need PFX assembly can import it without pulling in the CA / CSR / verify modules.
 
+## Issue a document-signing certificate
+
+`issueDocumentSigningCert` issues a leaf intended for signing arbitrary documents (CAdES detached, CMS, ASiC-E containers, etc., which are produced by separate tooling — not by EdgCA). It is **not** an mTLS client certificate: the EKU is `id-kp-documentSigning` (RFC 9336), and `keyUsage` carries `digitalSignature, contentCommitment` instead of just `digitalSignature`. SAN is intentionally not accepted; the signer is identified by Subject DN.
+
+```ts
+import {
+  createRootCA,
+  issueIntermediateCA,
+  issueDocumentSigningCert
+} from "@noz-ele/edgca";
+
+const root = await createRootCA({
+  subject: [{ type: "CN", value: "dev-root" }],
+  days: 3650
+});
+
+const intermediate = await issueIntermediateCA({
+  ca: root,
+  subject: [{ type: "CN", value: "dev-intermediate" }],
+  days: 365
+});
+
+const signer = await issueDocumentSigningCert({
+  ca: intermediate,
+  subject: [
+    { type: "CN", value: "Alice (Document Signer)" },
+    { type: "O", value: "Example" }
+  ],
+  days: 365
+});
+
+// signer.certPem        — the signing certificate
+// signer.certChainPem   — full chain to embed alongside the signature (signer + intermediate + root)
+// signer.privateKey     — secret CryptoKey, used by the document-signing tool to produce the signature
+```
+
+The returned shape is `IssuedDocumentSigningCertificate` (structurally identical to `IssuedClientCertificate`; the distinct name flags the EKU profile). The same `exportPkcs12` flow used for mTLS leaves works here too if you need to bundle the signer cert + key into a PFX for tools that consume PKCS#12.
+
+There is no `issueDocumentSigningCertForPublicKey` (CSR variant) in v1, and EdgCA does not produce CAdES / CMS / ASiC containers itself — see [docs/en/NON_GOALS.md](https://github.com/noz-ele/EdgCA/blob/main/docs/en/NON_GOALS.md) for the rationale.
+
 ## Verify (Cloudflare Worker)
 
 > ⚠ **What this is — and is not**
@@ -283,6 +386,7 @@ In scope:
 - Root CA creation.
 - Intermediate CA issuance.
 - mTLS client certificate issuance (with internal key generation, or from a caller-provided public key).
+- Document-signing certificate issuance with EKU `id-kp-documentSigning` (RFC 9336) and `keyUsage digitalSignature, contentCommitment` — internal key generation only, no SAN.
 - CSR (PKCS#10) parsing and proof-of-possession signature verification.
 - Identity check that a cert was issued by your own CA (`verifyClientCertificateIssuedBy`, with optional time-validity check).
 - PEM/DER helpers (certificates only — keys are exchanged as `CryptoKey`).
@@ -291,7 +395,10 @@ In scope:
 
 Intentionally out of scope:
 
-- Server certificate issuance.
+- Server certificate issuance. Leaf scope is mTLS client certs and document-signing certs only.
+- Document-signing certificate issuance from a caller-provided public key (`issueDocumentSigningCertForPublicKey`) — not in v1.
+- SAN (`dnsNames` / `ipAddresses` / `emailAddresses`) on document-signing leaves.
+- CAdES / CMS / PAdES / XAdES / ASiC document signing or container building. EdgCA only issues the signing certificate; producing a signed document or container is a separate concern.
 - Public chain-validation APIs.
 - Extracting time fields from a cert. `verifyClientCertificateIssuedBy`'s `validity` option performs the time check, but the `notBefore` / `notAfter` values are passed in by the caller from `cf.tlsClientAuth`.
 - CRL, OCSP, revocation databases, revocation checks.

package/dist/ca.d.ts

@@ -1,7 +1,8 @@
-import type { CertificateAuthority, CreateRootCAOptions, ImportCertificateAuthorityOptions, IssueClientCertForPublicKeyOptions, IssueClientCertOptions, IssueIntermediateCAOptions, IssuedClientCertificate, IssuedClientCertificateForPublicKey } from "./types.js";
+import type { CertificateAuthority, CreateRootCAOptions, ImportCertificateAuthorityOptions, IssueClientCertForPublicKeyOptions, IssueClientCertOptions, IssueDocumentSigningCertOptions, IssueIntermediateCAOptions, IssuedClientCertificate, IssuedClientCertificateForPublicKey, IssuedDocumentSigningCertificate } from "./types.js";
 export declare function createRootCA(options: CreateRootCAOptions): Promise<CertificateAuthority>;
 export declare function issueIntermediateCA(options: IssueIntermediateCAOptions): Promise<CertificateAuthority>;
 export declare function issueClientCert(options: IssueClientCertOptions): Promise<IssuedClientCertificate>;
 export declare function issueClientCertForPublicKey(options: IssueClientCertForPublicKeyOptions): Promise<IssuedClientCertificateForPublicKey>;
+export declare function issueDocumentSigningCert(options: IssueDocumentSigningCertOptions): Promise<IssuedDocumentSigningCertificate>;
 export declare function importCertificateAuthority(options: ImportCertificateAuthorityOptions): Promise<CertificateAuthority>;
 //# sourceMappingURL=ca.d.ts.map

package/dist/ca.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ca.d.ts","sourceRoot":"","sources":["../src/ca.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,iCAAiC,EACjC,kCAAkC,EAClC,sBAAsB,EACtB,0BAA0B,EAC1B,uBAAuB,EACvB,mCAAmC,EAEpC,MAAM,YAAY,CAAC;AAapB,wBAAsB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA0B9F;AAED,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAgC5G;AAED,wBAAsB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAqBvG;AAED,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,mCAAmC,CAAC,CAkB9C;AAuDD,wBAAsB,0BAA0B,CAAC,OAAO,EAAE,iCAAiC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAe1H"}
+{"version":3,"file":"ca.d.ts","sourceRoot":"","sources":["../src/ca.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EACV,oBAAoB,EACpB,mBAAmB,EACnB,iCAAiC,EACjC,kCAAkC,EAClC,sBAAsB,EACtB,+BAA+B,EAC/B,0BAA0B,EAC1B,uBAAuB,EACvB,mCAAmC,EACnC,gCAAgC,EAEjC,MAAM,YAAY,CAAC;AAcpB,wBAAsB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CA0B9F;AAED,wBAAsB,mBAAmB,CAAC,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAgC5G;AAED,wBAAsB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAoBvG;AAED,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,kCAAkC,GAC1C,OAAO,CAAC,mCAAmC,CAAC,CAiB9C;AAuED,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,+BAA+B,GACvC,OAAO,CAAC,gCAAgC,CAAC,CAoB3C;AAED,wBAAsB,0BAA0B,CAAC,OAAO,EAAE,iCAAiC,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAe1H"}

package/dist/ca.js

@@ -3,7 +3,7 @@ import { assertKeyPairMatches, curveOf, exportSpki, generateKeyPair, keyIdentifi
 import { encodeName } from "./name.js";
 import { certificateToPem, pemToDer, pemToDerWithLabel, splitPemBlocks } from "./pem.js";
 import { parseCertificateDer } from "./parser.js";
-import { authorityKeyIdentifierExtension, basicConstraintsCaExtension, basicConstraintsLeafExtension, buildCertificate, buildTbsCertificate, extendedKeyUsageClientAuthExtension, keyUsageExtension, subjectAltNameExtension, subjectKeyIdentifierExtension } from "./x509.js";
+import { authorityKeyIdentifierExtension, basicConstraintsCaExtension, basicConstraintsLeafExtension, buildCertificate, buildTbsCertificate, extendedKeyUsageClientAuthExtension, extendedKeyUsageDocumentSigningExtension, keyUsageExtension, subjectAltNameExtension, subjectKeyIdentifierExtension } from "./x509.js";
 export async function createRootCA(options) {
     const keyPair = await resolveKeyPair(options.keyPair);
     const issuerCurve = curveOf(keyPair.privateKey);
@@ -65,14 +65,12 @@ export async function issueIntermediateCA(options) {
 }
 export async function issueClientCert(options) {
     const keyPair = await generateKeyPair();
-    const built = await buildClientCertificate(options.ca, keyPair.publicKey, {
+    const built = await buildLeafCertificate(options.ca, keyPair.publicKey, {
         subject: options.subject,
         days: options.days,
         notBefore: options.notBefore,
-        serialNumber: options.serialNumber,
-        dnsNames: options.dnsNames,
-        ipAddresses: options.ipAddresses
-    });
+        serialNumber: options.serialNumber
+    }, clientCertProfileExtensions(options.dnsNames, options.ipAddresses));
     return {
         certPem: built.certPem,
         certDer: built.certDer,
@@ -82,42 +80,36 @@ export async function issueClientCert(options) {
     };
 }
 export async function issueClientCertForPublicKey(options) {
-    const built = await buildClientCertificate(options.ca, options.publicKey, {
+    const built = await buildLeafCertificate(options.ca, options.publicKey, {
         subject: options.subject,
         days: options.days,
         notBefore: options.notBefore,
-        serialNumber: options.serialNumber,
-        dnsNames: options.dnsNames,
-        ipAddresses: options.ipAddresses
-    });
+        serialNumber: options.serialNumber
+    }, clientCertProfileExtensions(options.dnsNames, options.ipAddresses));
     return {
         certPem: built.certPem,
         certDer: built.certDer,
         certChainPem: built.certChainPem
     };
 }
-async function buildClientCertificate(ca, subjectPublicKey, content) {
+async function buildLeafCertificate(ca, subjectPublicKey, identity, profileExtensions) {
     const issuer = await parseIssuer(ca);
     const issuerChainPem = ca.issuerChainPem;
     assertCanIssueCertificate(issuer);
     const issuerCurve = curveOf(ca.privateKey);
-    const subjectNameDer = encodeName(content.subject);
+    const subjectNameDer = encodeName(identity.subject);
     const spki = await exportSpki(subjectPublicKey);
     const subjectKeyIdentifier = await keyIdentifierFromSpki(spki);
     const authorityKeyIdentifier = issuer.subjectKeyIdentifier ?? await keyIdentifierFromSpki(issuer.subjectPublicKeyInfoDer);
-    const san = subjectAltNameExtension(content.dnsNames, content.ipAddresses);
     const extensions = [
-        basicConstraintsLeafExtension(),
-        keyUsageExtension(["digitalSignature"]),
-        extendedKeyUsageClientAuthExtension(),
+        ...profileExtensions,
         subjectKeyIdentifierExtension(subjectKeyIdentifier),
-        authorityKeyIdentifierExtension(authorityKeyIdentifier),
-        ...(san ? [san] : [])
+        authorityKeyIdentifierExtension(authorityKeyIdentifier)
     ];
     const { tbsCertificateDer } = buildTbsCertificate({
-        serialNumber: content.serialNumber,
-        notBefore: content.notBefore,
-        days: content.days,
+        serialNumber: identity.serialNumber,
+        notBefore: identity.notBefore,
+        days: identity.days,
         issuerNameDer: issuer.subjectNameDer,
         subjectNameDer,
         subjectPublicKeyInfoDer: spki,
@@ -133,6 +125,38 @@ async function buildClientCertificate(ca, subjectPublicKey, content) {
         certChainPem: joinPemChain([certPem, ca.certPem, issuerChainPem])
     };
 }
+function clientCertProfileExtensions(dnsNames, ipAddresses) {
+    const san = subjectAltNameExtension(dnsNames, ipAddresses);
+    return [
+        basicConstraintsLeafExtension(),
+        keyUsageExtension(["digitalSignature"]),
+        extendedKeyUsageClientAuthExtension(),
+        ...(san ? [san] : [])
+    ];
+}
+function documentSigningProfileExtensions() {
+    return [
+        basicConstraintsLeafExtension(),
+        keyUsageExtension(["digitalSignature", "contentCommitment"]),
+        extendedKeyUsageDocumentSigningExtension()
+    ];
+}
+export async function issueDocumentSigningCert(options) {
+    const keyPair = await generateKeyPair();
+    const built = await buildLeafCertificate(options.ca, keyPair.publicKey, {
+        subject: options.subject,
+        days: options.days,
+        notBefore: options.notBefore,
+        serialNumber: options.serialNumber
+    }, documentSigningProfileExtensions());
+    return {
+        certPem: built.certPem,
+        certDer: built.certDer,
+        privateKey: keyPair.privateKey,
+        publicKey: keyPair.publicKey,
+        certChainPem: built.certChainPem
+    };
+}
 export async function importCertificateAuthority(options) {
     const issuerChainPem = options.issuerChainPem ?? "";
     assertIssuerChainPem(issuerChainPem);

package/dist/cli/commands/create-root-ca.d.ts

@@ -0,0 +1,2 @@
+export declare function createRootCaCommand(args: string[]): Promise<void>;
+//# sourceMappingURL=create-root-ca.d.ts.map

package/dist/cli/commands/create-root-ca.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create-root-ca.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/create-root-ca.ts"],"names":[],"mappings":"AAMA,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBvE"}

package/dist/cli/commands/create-root-ca.js

@@ -0,0 +1,26 @@
+import { parseArgs } from "node:util";
+import { createRootCA, generateKeyPair } from "../../index.js";
+import { parseDnString } from "../dn.js";
+import { parseCurveFlag, parseDaysFlag, requireString } from "../flags.js";
+import { writeCaTriplet } from "../io.js";
+export async function createRootCaCommand(args) {
+    const { values } = parseArgs({
+        args,
+        options: {
+            subject: { type: "string" },
+            days: { type: "string", default: "3650" },
+            curve: { type: "string", default: "P-256" },
+            name: { type: "string", default: "root" }
+        },
+        strict: true
+    });
+    const subject = parseDnString(requireString(values.subject, "--subject"));
+    const days = parseDaysFlag(values.days);
+    const curve = parseCurveFlag(values.curve);
+    const basename = values.name;
+    const keyPair = await generateKeyPair(curve);
+    const ca = await createRootCA({ subject, days, keyPair });
+    const written = await writeCaTriplet(ca, ".", basename);
+    console.log(`wrote ${written.certPath}`);
+    console.log(`wrote ${written.keyPath}`);
+}

package/dist/cli/commands/issue-client.d.ts

@@ -0,0 +1,2 @@
+export declare function issueClientCommand(args: string[]): Promise<void>;
+//# sourceMappingURL=issue-client.d.ts.map

package/dist/cli/commands/issue-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue-client.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/issue-client.ts"],"names":[],"mappings":"AAMA,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA2CtE"}

package/dist/cli/commands/issue-client.js

@@ -0,0 +1,46 @@
+import { parseArgs } from "node:util";
+import { issueClientCert } from "../../index.js";
+import { parseDnString } from "../dn.js";
+import { parseDaysFlag, requireString } from "../flags.js";
+import { loadCaFromDisk, writeIssuedLeafTriplet } from "../io.js";
+export async function issueClientCommand(args) {
+    const { values } = parseArgs({
+        args,
+        options: {
+            "ca-cert": { type: "string" },
+            "ca-key": { type: "string" },
+            "ca-chain": { type: "string" },
+            subject: { type: "string" },
+            "dns-name": { type: "string", multiple: true, default: [] },
+            ip: { type: "string", multiple: true, default: [] },
+            days: { type: "string", default: "365" },
+            name: { type: "string", default: "client" }
+        },
+        strict: true
+    });
+    const caCertPath = requireString(values["ca-cert"], "--ca-cert");
+    const caKeyPath = requireString(values["ca-key"], "--ca-key");
+    const caChainPath = values["ca-chain"];
+    const subject = parseDnString(requireString(values.subject, "--subject"));
+    const days = parseDaysFlag(values.days);
+    const basename = values.name;
+    const dnsNames = values["dns-name"];
+    const ipAddresses = values.ip;
+    const ca = await loadCaFromDisk({
+        certPath: caCertPath,
+        keyPath: caKeyPath,
+        ...(caChainPath !== undefined ? { chainPath: caChainPath } : {})
+    });
+    const issued = await issueClientCert({
+        ca,
+        subject,
+        days,
+        ...(dnsNames.length > 0 ? { dnsNames } : {}),
+        ...(ipAddresses.length > 0 ? { ipAddresses } : {})
+    });
+    const written = await writeIssuedLeafTriplet(issued, ".", basename);
+    console.log(`wrote ${written.certPath}`);
+    console.log(`wrote ${written.keyPath}`);
+    if (written.chainPath)
+        console.log(`wrote ${written.chainPath}`);
+}

package/dist/cli/commands/issue-intermediate-ca.d.ts

@@ -0,0 +1,2 @@
+export declare function issueIntermediateCaCommand(args: string[]): Promise<void>;
+//# sourceMappingURL=issue-intermediate-ca.d.ts.map

package/dist/cli/commands/issue-intermediate-ca.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue-intermediate-ca.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/issue-intermediate-ca.ts"],"names":[],"mappings":"AAMA,wBAAsB,0BAA0B,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA6B9E"}

package/dist/cli/commands/issue-intermediate-ca.js

@@ -0,0 +1,33 @@
+import { parseArgs } from "node:util";
+import { generateKeyPair, issueIntermediateCA } from "../../index.js";
+import { parseDnString } from "../dn.js";
+import { parseCurveFlag, parseDaysFlag, requireString } from "../flags.js";
+import { loadCaFromDisk, writeCaTriplet } from "../io.js";
+export async function issueIntermediateCaCommand(args) {
+    const { values } = parseArgs({
+        args,
+        options: {
+            "ca-cert": { type: "string" },
+            "ca-key": { type: "string" },
+            subject: { type: "string" },
+            days: { type: "string", default: "1825" },
+            curve: { type: "string", default: "P-256" },
+            name: { type: "string", default: "intermediate" }
+        },
+        strict: true
+    });
+    const caCertPath = requireString(values["ca-cert"], "--ca-cert");
+    const caKeyPath = requireString(values["ca-key"], "--ca-key");
+    const subject = parseDnString(requireString(values.subject, "--subject"));
+    const days = parseDaysFlag(values.days);
+    const curve = parseCurveFlag(values.curve);
+    const basename = values.name;
+    const root = await loadCaFromDisk({ certPath: caCertPath, keyPath: caKeyPath });
+    const keyPair = await generateKeyPair(curve);
+    const intermediate = await issueIntermediateCA({ ca: root, subject, days, keyPair });
+    const written = await writeCaTriplet(intermediate, ".", basename);
+    console.log(`wrote ${written.certPath}`);
+    console.log(`wrote ${written.keyPath}`);
+    if (written.chainPath)
+        console.log(`wrote ${written.chainPath}`);
+}

package/dist/cli/commands/pem-to-pfx.d.ts

@@ -0,0 +1,2 @@
+export declare function pemToPfxCommand(args: string[]): Promise<void>;
+//# sourceMappingURL=pem-to-pfx.d.ts.map

package/dist/cli/commands/pem-to-pfx.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pem-to-pfx.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/pem-to-pfx.ts"],"names":[],"mappings":"AAYA,wBAAsB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA+CnE"}

package/dist/cli/commands/pem-to-pfx.js

@@ -0,0 +1,47 @@
+import { readFile, writeFile } from "node:fs/promises";
+import { parseArgs } from "node:util";
+import { exportPkcs12, importCertificateAuthority, pemToDer, pemToDerWithLabel, splitPemBlocks } from "../../index.js";
+import { requireString } from "../flags.js";
+import { defaultPfxPath, importPkcs8PrivateKeyFromPem } from "../io.js";
+export async function pemToPfxCommand(args) {
+    const { values } = parseArgs({
+        args,
+        options: {
+            cert: { type: "string" },
+            key: { type: "string" },
+            chain: { type: "string" },
+            out: { type: "string" },
+            password: { type: "string" }
+        },
+        strict: true
+    });
+    const certPath = requireString(values.cert, "--cert");
+    const keyPath = requireString(values.key, "--key");
+    const password = requireString(values.password, "--password");
+    const chainPath = values.chain;
+    const outPath = values.out ?? defaultPfxPath(certPath);
+    const [certPem, keyPem, chainPem] = await Promise.all([
+        readFile(certPath, "utf8"),
+        readFile(keyPath, "utf8"),
+        chainPath ? readFile(chainPath, "utf8") : Promise.resolve("")
+    ]);
+    const certDer = pemToDer(certPem);
+    const chainDer = chainPem
+        ? splitPemBlocks(chainPem).map((block) => pemToDerWithLabel(block, "CERTIFICATE"))
+        : [];
+    const privateKey = await importPkcs8PrivateKeyFromPem(keyPem);
+    // Refuse to emit a PFX whose key does not match the leaf cert. The library's
+    // exportPkcs12 does not check this, so without the guard a mismatched pair
+    // silently produces a structurally valid but unusable .pfx file. We discard
+    // the returned CertificateAuthority — only the sign/verify round-trip
+    // performed inside importCertificateAuthority matters here.
+    await importCertificateAuthority({ certPem, privateKey });
+    const pfx = await exportPkcs12({
+        certDer,
+        ...(chainDer.length > 0 ? { chainDer } : {}),
+        privateKey,
+        password: new TextEncoder().encode(password)
+    });
+    await writeFile(outPath, pfx);
+    console.log(`wrote ${outPath}`);
+}

package/dist/cli/dn.d.ts

@@ -0,0 +1,3 @@
+import type { Subject } from "../types.js";
+export declare function parseDnString(input: string): Subject;
+//# sourceMappingURL=dn.d.ts.map

package/dist/cli/dn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dn.d.ts","sourceRoot":"","sources":["../../src/cli/dn.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,OAAO,EAGR,MAAM,aAAa,CAAC;AAQrB,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAoBpD"}

package/dist/cli/dn.js

@@ -0,0 +1,65 @@
+import { SUBJECT_ATTRIBUTE_OIDS } from "../oids.js";
+const SHORT_NAMES = new Set(Object.keys(SUBJECT_ATTRIBUTE_OIDS));
+const DOTTED_OID = /^\d+(?:\.\d+)+$/;
+export function parseDnString(input) {
+    const parts = [];
+    for (const raw of splitTopLevel(input, ",")) {
+        const part = raw.trim();
+        if (part === "")
+            continue;
+        const eq = part.indexOf("=");
+        if (eq < 0) {
+            throw new Error(`Invalid DN component (missing '='): ${part}`);
+        }
+        const rawKey = part.slice(0, eq).trim();
+        const value = unescape(part.slice(eq + 1).trim());
+        if (rawKey === "")
+            throw new Error(`Invalid DN component (empty key): ${part}`);
+        if (value === "")
+            throw new Error(`Invalid DN component (empty value): ${part}`);
+        const type = resolveAttributeType(rawKey);
+        parts.push({ type, value });
+    }
+    if (parts.length === 0) {
+        throw new Error("Subject is empty");
+    }
+    return parts;
+}
+function resolveAttributeType(raw) {
+    const upper = raw.toUpperCase();
+    if (SHORT_NAMES.has(upper)) {
+        return upper;
+    }
+    if (DOTTED_OID.test(raw)) {
+        return raw;
+    }
+    throw new Error(`Unsupported DN attribute: ${raw}`);
+}
+function splitTopLevel(input, sep) {
+    const out = [];
+    let current = "";
+    let escaped = false;
+    for (const ch of input) {
+        if (escaped) {
+            current += ch;
+            escaped = false;
+            continue;
+        }
+        if (ch === "\\") {
+            current += ch;
+            escaped = true;
+            continue;
+        }
+        if (ch === sep) {
+            out.push(current);
+            current = "";
+            continue;
+        }
+        current += ch;
+    }
+    out.push(current);
+    return out;
+}
+function unescape(value) {
+    return value.replace(/\\(.)/g, "$1");
+}

package/dist/cli/flags.d.ts

@@ -0,0 +1,8 @@
+import type { SupportedCurve } from "../index.js";
+export declare class UsageError extends Error {
+    name: string;
+}
+export declare function parseDaysFlag(value: string): number;
+export declare function parseCurveFlag(value: string): SupportedCurve;
+export declare function requireString(value: string | undefined, flagName: string): string;
+//# sourceMappingURL=flags.d.ts.map

package/dist/cli/flags.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"flags.d.ts","sourceRoot":"","sources":["../../src/cli/flags.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAElD,qBAAa,UAAW,SAAQ,KAAK;IAC1B,IAAI,SAAgB;CAC9B;AASD,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CASnD;AAID,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,CAK5D;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAKjF"}

package/dist/cli/flags.js

@@ -0,0 +1,32 @@
+export class UsageError extends Error {
+    name = "UsageError";
+}
+// Accept only positive decimal integers with no leading zero, surrounding
+// whitespace, sign, scientific notation, or fractional part. Number() is too
+// permissive (it accepts " 365 ", "1e3", "0x10", "01", "1.0", and silently
+// rounds beyond MAX_SAFE_INTEGER), which would let surprising values slip
+// past CLI validation into the issuance API.
+const POSITIVE_DECIMAL_INTEGER = /^[1-9]\d*$/;
+export function parseDaysFlag(value) {
+    if (!POSITIVE_DECIMAL_INTEGER.test(value)) {
+        throw new UsageError(`--days must be a positive decimal integer, got: ${JSON.stringify(value)}`);
+    }
+    const n = Number(value);
+    if (!Number.isSafeInteger(n)) {
+        throw new UsageError(`--days exceeds the safe integer range: ${value}`);
+    }
+    return n;
+}
+const SUPPORTED_CURVES = ["P-256", "P-384", "P-521"];
+export function parseCurveFlag(value) {
+    if (SUPPORTED_CURVES.includes(value)) {
+        return value;
+    }
+    throw new UsageError(`--curve must be one of P-256, P-384, P-521 (got: ${value})`);
+}
+export function requireString(value, flagName) {
+    if (value === undefined || value === "") {
+        throw new UsageError(`${flagName} is required`);
+    }
+    return value;
+}

package/dist/cli/io.d.ts

@@ -0,0 +1,19 @@
+import { type CertificateAuthority, type IssuedClientCertificate } from "../index.js";
+export declare function importPkcs8PrivateKeyFromPem(pem: string): Promise<CryptoKey>;
+export declare function cryptoKeyToPkcs8Pem(key: CryptoKey): Promise<string>;
+export interface WriteCaResult {
+    certPath: string;
+    keyPath: string;
+    chainPath?: string;
+}
+export declare function writeCaTriplet(ca: CertificateAuthority, outDir: string, basename: string): Promise<WriteCaResult>;
+export declare function writeIssuedLeafTriplet(issued: IssuedClientCertificate, outDir: string, basename: string): Promise<WriteCaResult>;
+export declare function stripLeafFromChain(leafPem: string, chainPem: string): string;
+export interface LoadCaInput {
+    certPath: string;
+    keyPath: string;
+    chainPath?: string;
+}
+export declare function loadCaFromDisk(input: LoadCaInput): Promise<CertificateAuthority>;
+export declare function defaultPfxPath(certPath: string): string;
+//# sourceMappingURL=io.d.ts.map

package/dist/cli/io.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"io.d.ts","sourceRoot":"","sources":["../../src/cli/io.ts"],"names":[],"mappings":"AAEA,OAAO,EAQL,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC7B,MAAM,aAAa,CAAC;AAKrB,wBAAsB,4BAA4B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAmBlF;AAED,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAGzE;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,cAAc,CAClC,EAAE,EAAE,oBAAoB,EACxB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,CAAC,CAoBxB;AAED,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,uBAAuB,EAC/B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,aAAa,CAAC,CAoBxB;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAQ5E;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,cAAc,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAWtF;AAED,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOvD"}

package/dist/cli/io.js

@@ -0,0 +1,92 @@
+import { readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { arrayBufferFromBytes, bytesEqual, encodePem, importCertificateAuthority, pemToDer, pemToDerWithLabel, splitPemBlocks } from "../index.js";
+const EC_CURVES = ["P-256", "P-384", "P-521"];
+export async function importPkcs8PrivateKeyFromPem(pem) {
+    const der = pemToDerWithLabel(pem, "PRIVATE KEY");
+    let lastError;
+    for (const namedCurve of EC_CURVES) {
+        try {
+            return await crypto.subtle.importKey("pkcs8", arrayBufferFromBytes(der), { name: "ECDSA", namedCurve }, true, ["sign"]);
+        }
+        catch (err) {
+            lastError = err;
+        }
+    }
+    throw new Error(`Unable to import PRIVATE KEY as ECDSA P-256/P-384/P-521 PKCS#8: ${describe(lastError)}`);
+}
+export async function cryptoKeyToPkcs8Pem(key) {
+    const der = new Uint8Array(await crypto.subtle.exportKey("pkcs8", key));
+    return encodePem("PRIVATE KEY", der);
+}
+export async function writeCaTriplet(ca, outDir, basename) {
+    const certPath = path.join(outDir, `${basename}.crt.pem`);
+    const keyPath = path.join(outDir, `${basename}.key.pem`);
+    const keyPem = await cryptoKeyToPkcs8Pem(ca.privateKey);
+    const writes = [
+        writeFile(certPath, ca.certPem, "utf8"),
+        writeFile(keyPath, keyPem, "utf8")
+    ];
+    const hasChain = ca.issuerChainPem.trim().length > 0;
+    const chainPath = hasChain ? path.join(outDir, `${basename}.chain.pem`) : undefined;
+    if (hasChain && chainPath) {
+        writes.push(writeFile(chainPath, ca.issuerChainPem, "utf8"));
+    }
+    await Promise.all(writes);
+    return chainPath !== undefined
+        ? { certPath, keyPath, chainPath }
+        : { certPath, keyPath };
+}
+export async function writeIssuedLeafTriplet(issued, outDir, basename) {
+    const certPath = path.join(outDir, `${basename}.crt.pem`);
+    const keyPath = path.join(outDir, `${basename}.key.pem`);
+    const chainPath = path.join(outDir, `${basename}.chain.pem`);
+    const keyPem = await cryptoKeyToPkcs8Pem(issued.privateKey);
+    // The library's `certChainPem` is a fullchain (leaf + issuers) suitable for
+    // nginx-style server config. The CLI convention for `*.chain.pem` is the
+    // issuer-only chain (no leaf), matching what `pem-to-pfx --chain` expects.
+    // Strip the leaf out by DER match so the file faithfully represents an
+    // issuer-only chain regardless of where the leaf sits in certChainPem.
+    const issuerOnlyChainPem = stripLeafFromChain(issued.certPem, issued.certChainPem);
+    await Promise.all([
+        writeFile(certPath, issued.certPem, "utf8"),
+        writeFile(keyPath, keyPem, "utf8"),
+        writeFile(chainPath, issuerOnlyChainPem, "utf8")
+    ]);
+    return { certPath, keyPath, chainPath };
+}
+export function stripLeafFromChain(leafPem, chainPem) {
+    const leafDer = pemToDer(leafPem);
+    const issuerBlocks = splitPemBlocks(chainPem).filter((block) => {
+        const blockDer = pemToDerWithLabel(block, "CERTIFICATE");
+        return !bytesEqual(blockDer, leafDer);
+    });
+    if (issuerBlocks.length === 0)
+        return "";
+    return issuerBlocks.join("\n") + "\n";
+}
+export async function loadCaFromDisk(input) {
+    const [certPem, keyPem, chainPem] = await Promise.all([
+        readFile(input.certPath, "utf8"),
+        readFile(input.keyPath, "utf8"),
+        input.chainPath ? readFile(input.chainPath, "utf8") : Promise.resolve("")
+    ]);
+    return importCertificateAuthority({
+        certPem,
+        privateKey: await importPkcs8PrivateKeyFromPem(keyPem),
+        issuerChainPem: chainPem
+    });
+}
+export function defaultPfxPath(certPath) {
+    const dir = path.dirname(certPath);
+    const base = path
+        .basename(certPath)
+        .replace(/\.crt\.pem$/i, "")
+        .replace(/\.pem$/i, "");
+    return path.join(dir, `${base}.pfx`);
+}
+function describe(err) {
+    if (err instanceof Error)
+        return err.message;
+    return String(err);
+}

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+import { createRootCaCommand } from "./cli/commands/create-root-ca.js";
+import { issueClientCommand } from "./cli/commands/issue-client.js";
+import { issueIntermediateCaCommand } from "./cli/commands/issue-intermediate-ca.js";
+import { pemToPfxCommand } from "./cli/commands/pem-to-pfx.js";
+import { UsageError } from "./cli/flags.js";
+const USAGE = `Usage:
+  edgca create-root-ca --subject <dn> [--days 3650] [--curve P-256] [--name root]
+
+  edgca issue-intermediate-ca --ca-cert <pem> --ca-key <pem>
+                              --subject <dn>
+                              [--days 1825] [--curve P-256] [--name intermediate]
+
+  edgca issue-client --ca-cert <pem> --ca-key <pem> [--ca-chain <pem>]
+                     --subject <dn>
+                     [--dns-name <name>]... [--ip <addr>]...
+                     [--days 365] [--name client]
+
+  edgca pem-to-pfx --cert <pem> --key <pem> --password <pw>
+                   [--chain <pem>] [--out <pfx>]
+`;
+async function main() {
+    const [sub, ...rest] = process.argv.slice(2);
+    switch (sub) {
+        case "create-root-ca":
+            await createRootCaCommand(rest);
+            return;
+        case "issue-intermediate-ca":
+            await issueIntermediateCaCommand(rest);
+            return;
+        case "issue-client":
+            await issueClientCommand(rest);
+            return;
+        case "pem-to-pfx":
+            await pemToPfxCommand(rest);
+            return;
+        case undefined:
+        case "-h":
+        case "--help":
+            process.stdout.write(USAGE);
+            return;
+        default:
+            process.stderr.write(`unknown subcommand: ${sub}\n\n${USAGE}`);
+            process.exitCode = 2;
+            return;
+    }
+}
+main().catch((err) => {
+    const message = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`${message}\n`);
+    process.exitCode = err instanceof UsageError ? 2 : 1;
+});

package/dist/csr.d.ts

@@ -22,4 +22,16 @@ export interface ParsedCertificateSigningRequest {
 }
 export declare function parseCertificateSigningRequest(input: string | Uint8Array): Promise<ParsedCertificateSigningRequest>;
 export declare function verifyCertificateSigningRequestSignature(csr: ParsedCertificateSigningRequest): Promise<boolean>;
+export interface CreateCertificateSigningRequestInput {
+    subject: Subject;
+    keyPair: CryptoKeyPair;
+    dnsNames?: readonly string[];
+    ipAddresses?: readonly string[];
+    extensions?: readonly CertificateSigningRequestExtension[];
+}
+export interface CreatedCertificateSigningRequest {
+    der: Uint8Array;
+    pem: string;
+}
+export declare function createCertificateSigningRequest(input: CreateCertificateSigningRequestInput): Promise<CreatedCertificateSigningRequest>;
 //# sourceMappingURL=csr.d.ts.map

package/dist/csr.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csr.d.ts","sourceRoot":"","sources":["../src/csr.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,OAAO,EAAwB,MAAM,YAAY,CAAC;AAkBhE,MAAM,WAAW,kCAAkC;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,UAAU,CAAC;CACtB;AAED,MAAM,WAAW,kCAAkC;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,SAAS,CAAC;IACrB,uBAAuB,EAAE,UAAU,CAAC;IACpC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,mBAAmB,EAAE,SAAS,kCAAkC,EAAE,CAAC;IACnE,eAAe,EAAE,SAAS,kCAAkC,EAAE,CAAC;IAC/D,qBAAqB,EAAE,MAAM,CAAC;IAC9B,YAAY,EAAE,UAAU,CAAC;IACzB,2BAA2B,EAAE,UAAU,CAAC;CACzC;AAED,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,MAAM,GAAG,UAAU,GACzB,OAAO,CAAC,+BAA+B,CAAC,CAwE1C;AAED,wBAAsB,wCAAwC,CAC5D,GAAG,EAAE,+BAA+B,GACnC,OAAO,CAAC,OAAO,CAAC,CAElB"}
+{"version":3,"file":"csr.d.ts","sourceRoot":"","sources":["../src/csr.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,OAAO,EAAwB,MAAM,YAAY,CAAC;AAmBhE,MAAM,WAAW,kCAAkC;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,UAAU,CAAC;CACtB;AAED,MAAM,WAAW,kCAAkC;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,+BAA+B;IAC9C,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,SAAS,CAAC;IACrB,uBAAuB,EAAE,UAAU,CAAC;IACpC,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,mBAAmB,EAAE,SAAS,kCAAkC,EAAE,CAAC;IACnE,eAAe,EAAE,SAAS,kCAAkC,EAAE,CAAC;IAC/D,qBAAqB,EAAE,MAAM,CAAC;IAC9B,YAAY,EAAE,UAAU,CAAC;IACzB,2BAA2B,EAAE,UAAU,CAAC;CACzC;AAED,wBAAsB,8BAA8B,CAClD,KAAK,EAAE,MAAM,GAAG,UAAU,GACzB,OAAO,CAAC,+BAA+B,CAAC,CAwE1C;AAED,wBAAsB,wCAAwC,CAC5D,GAAG,EAAE,+BAA+B,GACnC,OAAO,CAAC,OAAO,CAAC,CAElB;AAED,MAAM,WAAW,oCAAoC;IACnD,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,aAAa,CAAC;IACvB,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC7B,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,UAAU,CAAC,EAAE,SAAS,kCAAkC,EAAE,CAAC;CAC5D;AAED,MAAM,WAAW,gCAAgC;IAC/C,GAAG,EAAE,UAAU,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,wBAAsB,+BAA+B,CACnD,KAAK,EAAE,oCAAoC,GAC1C,OAAO,CAAC,gCAAgC,CAAC,CAiD3C"}

package/dist/csr.js

@@ -1,8 +1,10 @@
-import { cloneBytes } from "./bytes.js";
-import { importPublicKeySpki, verifyDer } from "./crypto.js";
-import { decodeInteger, decodeOid, readChildren, readElement, readSequenceChildren, TAG } from "./der.js";
+import { cloneBytes, concatBytes } from "./bytes.js";
+import { curveOf, exportSpki, importPublicKeySpki, signDer, signatureAlgorithmOidForCurve, verifyDer } from "./crypto.js";
+import { bitString, decodeInteger, decodeOid, der, integer, oid, readChildren, readElement, readSequenceChildren, sequence, set, TAG } from "./der.js";
+import { encodeName } from "./name.js";
 import { OID, SUBJECT_ATTRIBUTE_OIDS } from "./oids.js";
-import { pemToDerWithLabel, splitPemBlocks } from "./pem.js";
+import { csrToPem, pemToDerWithLabel, splitPemBlocks } from "./pem.js";
+import { extension, subjectAltNameExtension } from "./x509.js";
 const SHORT_NAME_BY_OID = Object.fromEntries(Object.entries(SUBJECT_ATTRIBUTE_OIDS).map(([shortName, oid]) => [oid, shortName]));
 const VALUE_DECODERS = new Map([
     [TAG.UTF8_STRING, (b) => new TextDecoder("utf-8", { fatal: true }).decode(b)],
@@ -15,9 +17,9 @@ const SUPPORTED_SIGNATURE_OIDS = new Set([
     OID.ecdsaWithSha512
 ]);
 export async function parseCertificateSigningRequest(input) {
-    const der = typeof input === "string" ? csrPemToDer(input) : input;
-    const root = readElement(der);
-    if (root.tag !== TAG.SEQUENCE || root.end !== der.length) {
+    const derBytes = typeof input === "string" ? csrPemToDer(input) : input;
+    const root = readElement(derBytes);
+    if (root.tag !== TAG.SEQUENCE || root.end !== derBytes.length) {
         throw new Error("Invalid CSR DER");
     }
     const [requestInfo, signatureAlgorithm, signatureValue] = readSequenceChildren(root);
@@ -62,7 +64,7 @@ export async function parseCertificateSigningRequest(input) {
     const requestedExtensions = extensionRequest
         ? decodeRequestedExtensions(extensionRequest.valuesDer)
         : [];
-    const sanExtension = requestedExtensions.find((extension) => extension.oid === OID.subjectAltName);
+    const sanExtension = requestedExtensions.find((ext) => ext.oid === OID.subjectAltName);
     const { dnsNames, ipAddresses } = sanExtension
         ? decodeSubjectAltName(sanExtension.valueDer)
         : { dnsNames: [], ipAddresses: [] };
@@ -82,6 +84,48 @@ export async function parseCertificateSigningRequest(input) {
 export async function verifyCertificateSigningRequestSignature(csr) {
     return verifyDer(csr.publicKey, csr.signatureDer, csr.certificationRequestInfoDer);
 }
+export async function createCertificateSigningRequest(input) {
+    const privateCurve = curveOf(input.keyPair.privateKey);
+    const publicCurve = curveOf(input.keyPair.publicKey);
+    if (privateCurve !== publicCurve) {
+        throw new Error("CSR keyPair private/public curve mismatch");
+    }
+    const subjectNameDer = encodeName(input.subject);
+    const spki = await exportSpki(input.keyPair.publicKey);
+    const requestedExtensions = collectRequestedExtensions(input.dnsNames, input.ipAddresses, input.extensions);
+    const attributes = [];
+    if (requestedExtensions.length > 0) {
+        attributes.push(sequence(oid(OID.extensionRequest), set(sequence(...requestedExtensions))));
+    }
+    // CertificationRequestInfo.attributes is IMPLICIT [0] SET OF Attribute.
+    // Wire form: tag 0xa0 wrapping the concatenated Attribute SEQUENCEs.
+    const attributesField = der(0xa0, concatBytes(attributes));
+    const certificationRequestInfoDer = sequence(integer(0), subjectNameDer, spki, attributesField);
+    const signatureDer = await signDer(input.keyPair.privateKey, certificationRequestInfoDer);
+    const signatureAlgorithmOid = signatureAlgorithmOidForCurve(privateCurve);
+    const csrDer = sequence(certificationRequestInfoDer, sequence(oid(signatureAlgorithmOid)), bitString(signatureDer));
+    return {
+        der: csrDer,
+        pem: csrToPem(csrDer)
+    };
+}
+function collectRequestedExtensions(dnsNames, ipAddresses, extraExtensions) {
+    const seenOids = new Set();
+    const out = [];
+    const san = subjectAltNameExtension(dnsNames, ipAddresses);
+    if (san) {
+        seenOids.add(OID.subjectAltName);
+        out.push(san);
+    }
+    for (const ext of extraExtensions ?? []) {
+        if (seenOids.has(ext.oid)) {
+            throw new Error(`Duplicate CSR extension OID: ${ext.oid}`);
+        }
+        seenOids.add(ext.oid);
+        out.push(extension(ext.oid, ext.critical, ext.valueDer));
+    }
+    return out;
+}
 function csrPemToDer(pem) {
     // RFC 7468 §7 uses "CERTIFICATE REQUEST"; some legacy tools emit "NEW CERTIFICATE REQUEST".
     const blocks = splitPemBlocks(pem);

package/dist/index.d.ts

@@ -1,7 +1,9 @@
-export { createRootCA, importCertificateAuthority, issueClientCert, issueClientCertForPublicKey, issueIntermediateCA } from "./ca.js";
-export { parseCertificateSigningRequest, verifyCertificateSigningRequestSignature, type ParsedCertificateSigningRequest, type CertificateSigningRequestExtension, type CertificateSigningRequestAttribute } from "./csr.js";
-export { pemToDer, certificateToPem } from "./pem.js";
+export { createRootCA, importCertificateAuthority, issueClientCert, issueClientCertForPublicKey, issueDocumentSigningCert, issueIntermediateCA } from "./ca.js";
+export { createCertificateSigningRequest, parseCertificateSigningRequest, verifyCertificateSigningRequestSignature, type CertificateSigningRequestAttribute, type CertificateSigningRequestExtension, type CreateCertificateSigningRequestInput, type CreatedCertificateSigningRequest, type ParsedCertificateSigningRequest } from "./csr.js";
+export { certificateToPem, csrToPem, encodePem, pemToDer, pemToDerWithLabel, splitPemBlocks } from "./pem.js";
+export { generateKeyPair, type SupportedCurve } from "./crypto.js";
+export { arrayBufferFromBytes, bytesEqual } from "./bytes.js";
 export { exportPkcs12, type ExportPkcs12Input } from "./pkcs12.js";
 export { verifyClientCertificateIssuedBy, type VerifyClientCertificateIssuedByOptions, type VerifyClientCertificateValidity } from "./verify.js";
-export type { CertificateAuthority, CreateRootCAOptions, ImportCertificateAuthorityOptions, IssueClientCertForPublicKeyOptions, IssueClientCertOptions, IssueIntermediateCAOptions, IssuedClientCertificate, IssuedClientCertificateForPublicKey, SerialNumber, ShortSubjectAttributeType, Subject, SubjectAttribute, SubjectAttributeType } from "./types.js";
+export type { CertificateAuthority, CreateRootCAOptions, ImportCertificateAuthorityOptions, IssueClientCertForPublicKeyOptions, IssueClientCertOptions, IssueDocumentSigningCertOptions, IssueIntermediateCAOptions, IssuedClientCertificate, IssuedClientCertificateForPublicKey, IssuedDocumentSigningCertificate, SerialNumber, ShortSubjectAttributeType, Subject, SubjectAttribute, SubjectAttributeType } from "./types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,0BAA0B,EAC1B,eAAe,EACf,2BAA2B,EAC3B,mBAAmB,EACpB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,8BAA8B,EAC9B,wCAAwC,EACxC,KAAK,+BAA+B,EACpC,KAAK,kCAAkC,EACvC,KAAK,kCAAkC,EACxC,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EACL,+BAA+B,EAC/B,KAAK,sCAAsC,EAC3C,KAAK,+BAA+B,EACrC,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,iCAAiC,EACjC,kCAAkC,EAClC,sBAAsB,EACtB,0BAA0B,EAC1B,uBAAuB,EACvB,mCAAmC,EACnC,YAAY,EACZ,yBAAyB,EACzB,OAAO,EACP,gBAAgB,EAChB,oBAAoB,EACrB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,0BAA0B,EAC1B,eAAe,EACf,2BAA2B,EAC3B,wBAAwB,EACxB,mBAAmB,EACpB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,EAC9B,wCAAwC,EACxC,KAAK,kCAAkC,EACvC,KAAK,kCAAkC,EACvC,KAAK,oCAAoC,EACzC,KAAK,gCAAgC,EACrC,KAAK,+BAA+B,EACrC,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,gBAAgB,EAChB,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,iBAAiB,EACjB,cAAc,EACf,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EACL,+BAA+B,EAC/B,KAAK,sCAAsC,EAC3C,KAAK,+BAA+B,EACrC,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,iCAAiC,EACjC,kCAAkC,EAClC,sBAAsB,EACtB,+BAA+B,EAC/B,0BAA0B,EAC1B,uBAAuB,EACvB,mCAAmC,EACnC,gCAAgC,EAChC,YAAY,EACZ,yBAAyB,EACzB,OAAO,EACP,gBAAgB,EAChB,oBAAoB,EACrB,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,5 +1,7 @@
-export { createRootCA, importCertificateAuthority, issueClientCert, issueClientCertForPublicKey, issueIntermediateCA } from "./ca.js";
-export { parseCertificateSigningRequest, verifyCertificateSigningRequestSignature } from "./csr.js";
-export { pemToDer, certificateToPem } from "./pem.js";
+export { createRootCA, importCertificateAuthority, issueClientCert, issueClientCertForPublicKey, issueDocumentSigningCert, issueIntermediateCA } from "./ca.js";
+export { createCertificateSigningRequest, parseCertificateSigningRequest, verifyCertificateSigningRequestSignature } from "./csr.js";
+export { certificateToPem, csrToPem, encodePem, pemToDer, pemToDerWithLabel, splitPemBlocks } from "./pem.js";
+export { generateKeyPair } from "./crypto.js";
+export { arrayBufferFromBytes, bytesEqual } from "./bytes.js";
 export { exportPkcs12 } from "./pkcs12.js";
 export { verifyClientCertificateIssuedBy } from "./verify.js";

package/dist/oids.d.ts

@@ -14,6 +14,7 @@ export declare const OID: {
     readonly subjectKeyIdentifier: "2.5.29.14";
     readonly authorityKeyIdentifier: "2.5.29.35";
     readonly clientAuth: "1.3.6.1.5.5.7.3.2";
+    readonly documentSigning: "1.3.6.1.5.5.7.3.36";
     readonly extensionRequest: "1.2.840.113549.1.9.14";
     readonly data: "1.2.840.113549.1.7.1";
     readonly encryptedData: "1.2.840.113549.1.7.6";

package/dist/oids.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oids.d.ts","sourceRoot":"","sources":["../src/oids.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAE5D,eAAO,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4BN,CAAC;AAEX,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,yBAAyB,EAAE,MAAM,CAgB5E,CAAC;AAGF,eAAO,MAAM,2BAA2B,EAAE,MAAM,CAAC,yBAAyB,EAAE,MAAM,CAgBjF,CAAC;AAIF,eAAO,MAAM,wBAAwB,MAAM,CAAC"}
+{"version":3,"file":"oids.d.ts","sourceRoot":"","sources":["../src/oids.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAE5D,eAAO,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6BN,CAAC;AAEX,eAAO,MAAM,sBAAsB,EAAE,MAAM,CAAC,yBAAyB,EAAE,MAAM,CAgB5E,CAAC;AAGF,eAAO,MAAM,2BAA2B,EAAE,MAAM,CAAC,yBAAyB,EAAE,MAAM,CAgBjF,CAAC;AAIF,eAAO,MAAM,wBAAwB,MAAM,CAAC"}

package/dist/oids.js

@@ -13,6 +13,7 @@ export const OID = {
     subjectKeyIdentifier: "2.5.29.14",
     authorityKeyIdentifier: "2.5.29.35",
     clientAuth: "1.3.6.1.5.5.7.3.2",
+    documentSigning: "1.3.6.1.5.5.7.3.36",
     extensionRequest: "1.2.840.113549.1.9.14",
     data: "1.2.840.113549.1.7.1",
     encryptedData: "1.2.840.113549.1.7.6",

package/dist/pem.d.ts

@@ -1,5 +1,7 @@
 export declare function certificateToPem(der: Uint8Array): string;
+export declare function csrToPem(der: Uint8Array): string;
 export declare function pemToDer(pem: string): Uint8Array;
 export declare function pemToDerWithLabel(pem: string, label: string): Uint8Array;
 export declare function splitPemBlocks(pem: string): string[];
+export declare function encodePem(label: string, der: Uint8Array): string;
 //# sourceMappingURL=pem.d.ts.map

package/dist/pem.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pem.d.ts","sourceRoot":"","sources":["../src/pem.ts"],"names":[],"mappings":"AAIA,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAExD;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAWhD;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAaxE;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAUpD"}
+{"version":3,"file":"pem.d.ts","sourceRoot":"","sources":["../src/pem.ts"],"names":[],"mappings":"AAIA,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAExD;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,MAAM,CAEhD;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAWhD;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAaxE;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAUpD;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,MAAM,CAShE"}

package/dist/pem.js

@@ -3,6 +3,9 @@ const PEM_LINE_LENGTH = 64;
 export function certificateToPem(der) {
     return encodePem("CERTIFICATE", der);
 }
+export function csrToPem(der) {
+    return encodePem("CERTIFICATE REQUEST", der);
+}
 export function pemToDer(pem) {
     const match = /-----BEGIN (.+?)-----([\s\S]*?)-----END \1-----/.exec(pem);
     if (!match || !match[2]) {
@@ -36,7 +39,7 @@ export function splitPemBlocks(pem) {
     }
     return blocks;
 }
-function encodePem(label, der) {
+export function encodePem(label, der) {
     const base64 = btoa(bytesToBinary(der));
     const lines = [];
     for (let i = 0; i < base64.length; i += PEM_LINE_LENGTH) {

package/dist/types.d.ts

@@ -62,6 +62,20 @@ export interface IssuedClientCertificateForPublicKey {
     certDer: Uint8Array;
     certChainPem: string;
 }
+export interface IssueDocumentSigningCertOptions {
+    ca: CertificateAuthority;
+    subject: Subject;
+    days: number;
+    notBefore?: Date;
+    serialNumber?: SerialNumber;
+}
+export interface IssuedDocumentSigningCertificate {
+    certPem: string;
+    certDer: Uint8Array;
+    privateKey: CryptoKey;
+    publicKey: CryptoKey;
+    certChainPem: string;
+}
 export interface ImportCertificateAuthorityOptions {
     certPem: string;
     privateKey: CryptoKey;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,yBAAyB,GACjC,IAAI,GACJ,GAAG,GACH,IAAI,GACJ,GAAG,GACH,IAAI,GACJ,GAAG,GACH,GAAG,GACH,IAAI,GACJ,cAAc,GACd,QAAQ,GACR,YAAY,GACZ,OAAO,GACP,WAAW,GACX,SAAS,GACT,KAAK,CAAC;AAEV,MAAM,MAAM,SAAS,GAAG,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,EAAE,CAAC;AAEvD,MAAM,MAAM,oBAAoB,GAAG,yBAAyB,GAAG,SAAS,CAAC;AAEzE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;AAEzC,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;AAEjE,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,UAAU,CAAC;IACpB,UAAU,EAAE,SAAS,CAAC;IACtB,SAAS,EAAE,SAAS,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,UAAU,CAAC;IACpB,UAAU,EAAE,SAAS,CAAC;IACtB,SAAS,EAAE,SAAS,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB;AAED,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,oBAAoB,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,oBAAoB,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,kCAAkC;IACjD,EAAE,EAAE,oBAAoB,CAAC;IACzB,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,mCAAmC;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,UAAU,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iCAAiC;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,SAAS,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,yBAAyB,GACjC,IAAI,GACJ,GAAG,GACH,IAAI,GACJ,GAAG,GACH,IAAI,GACJ,GAAG,GACH,GAAG,GACH,IAAI,GACJ,cAAc,GACd,QAAQ,GACR,YAAY,GACZ,OAAO,GACP,WAAW,GACX,SAAS,GACT,KAAK,CAAC;AAEV,MAAM,MAAM,SAAS,GAAG,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,EAAE,CAAC;AAEvD,MAAM,MAAM,oBAAoB,GAAG,yBAAyB,GAAG,SAAS,CAAC;AAEzE,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,oBAAoB,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;AAEzC,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,UAAU,CAAC;AAEjE,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,UAAU,CAAC;IACpB,UAAU,EAAE,SAAS,CAAC;IACtB,SAAS,EAAE,SAAS,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,UAAU,CAAC;IACpB,UAAU,EAAE,SAAS,CAAC;IACtB,SAAS,EAAE,SAAS,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB;AAED,MAAM,WAAW,0BAA0B;IACzC,EAAE,EAAE,oBAAoB,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,oBAAoB,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,kCAAkC;IACjD,EAAE,EAAE,oBAAoB,CAAC;IACzB,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,mCAAmC;IAClD,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,UAAU,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,+BAA+B;IAC9C,EAAE,EAAE,oBAAoB,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED,MAAM,WAAW,gCAAgC;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,UAAU,CAAC;IACpB,UAAU,EAAE,SAAS,CAAC;IACtB,SAAS,EAAE,SAAS,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,iCAAiC;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,SAAS,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB"}

package/dist/x509.d.ts

@@ -23,11 +23,14 @@ export declare function basicConstraintsCaExtension(pathLenConstraint: number):
 export declare function basicConstraintsLeafExtension(): Uint8Array;
 export declare function keyUsageExtension(usages: readonly KeyUsageBit[]): Uint8Array;
 export declare function extendedKeyUsageClientAuthExtension(): Uint8Array;
+export declare function extendedKeyUsageDocumentSigningExtension(): Uint8Array;
 export declare function subjectKeyIdentifierExtension(keyIdentifier: Uint8Array): Uint8Array;
 export declare function authorityKeyIdentifierExtension(keyIdentifier: Uint8Array): Uint8Array;
 export declare function subjectAltNameExtension(dnsNames?: readonly string[], ipAddresses?: readonly string[]): Uint8Array | undefined;
+export declare function extension(extensionOid: string, critical: boolean, valueDer: Uint8Array): Uint8Array;
 declare const KEY_USAGE_BITS: {
     readonly digitalSignature: 0;
+    readonly contentCommitment: 1;
     readonly keyCertSign: 5;
     readonly cRLSign: 6;
 };

package/dist/x509.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"x509.d.ts","sourceRoot":"","sources":["../src/x509.ts"],"names":[],"mappings":"AACA,OAAO,EAAiC,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAkBjF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,WAAW,qBAAqB;IACpC,YAAY,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACxC,SAAS,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,UAAU,CAAC;IAC1B,cAAc,EAAE,UAAU,CAAC;IAC3B,uBAAuB,EAAE,UAAU,CAAC;IACpC,UAAU,EAAE,UAAU,EAAE,CAAC;IACzB,WAAW,EAAE,cAAc,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,iBAAiB,EAAE,UAAU,CAAC;IAC9B,eAAe,EAAE,UAAU,CAAC;IAC5B,SAAS,EAAE,IAAI,CAAC;IAChB,QAAQ,EAAE,IAAI,CAAC;CAChB;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,qBAAqB,GAAG,oBAAoB,CAoBtF;AAED,wBAAgB,gBAAgB,CAC9B,iBAAiB,EAAE,UAAU,EAC7B,YAAY,EAAE,UAAU,EACxB,WAAW,EAAE,cAAc,GAC1B,UAAU,CAEZ;AAED,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,cAAc,GAAG,UAAU,CAEnF;AAED,wBAAgB,2BAA2B,CAAC,iBAAiB,EAAE,MAAM,GAAG,UAAU,CAMjF;AAED,wBAAgB,6BAA6B,IAAI,UAAU,CAE1D;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,GAAG,UAAU,CAgB5E;AAED,wBAAgB,mCAAmC,IAAI,UAAU,CAEhE;AAED,wBAAgB,6BAA6B,CAAC,aAAa,EAAE,UAAU,GAAG,UAAU,CAEnF;AAED,wBAAgB,+BAA+B,CAAC,aAAa,EAAE,UAAU,GAAG,UAAU,CAErF;AAED,wBAAgB,uBAAuB,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,EAAE,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,SAAS,CAmC7H;AAuID,QAAA,MAAM,cAAc;;;;CAIV,CAAC;AAEX,KAAK,WAAW,GAAG,MAAM,OAAO,cAAc,CAAC"}
+{"version":3,"file":"x509.d.ts","sourceRoot":"","sources":["../src/x509.ts"],"names":[],"mappings":"AACA,OAAO,EAAiC,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAkBjF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,WAAW,qBAAqB;IACpC,YAAY,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IACxC,SAAS,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,UAAU,CAAC;IAC1B,cAAc,EAAE,UAAU,CAAC;IAC3B,uBAAuB,EAAE,UAAU,CAAC;IACpC,UAAU,EAAE,UAAU,EAAE,CAAC;IACzB,WAAW,EAAE,cAAc,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,iBAAiB,EAAE,UAAU,CAAC;IAC9B,eAAe,EAAE,UAAU,CAAC;IAC5B,SAAS,EAAE,IAAI,CAAC;IAChB,QAAQ,EAAE,IAAI,CAAC;CAChB;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,qBAAqB,GAAG,oBAAoB,CAoBtF;AAED,wBAAgB,gBAAgB,CAC9B,iBAAiB,EAAE,UAAU,EAC7B,YAAY,EAAE,UAAU,EACxB,WAAW,EAAE,cAAc,GAC1B,UAAU,CAEZ;AAED,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,cAAc,GAAG,UAAU,CAEnF;AAED,wBAAgB,2BAA2B,CAAC,iBAAiB,EAAE,MAAM,GAAG,UAAU,CAMjF;AAED,wBAAgB,6BAA6B,IAAI,UAAU,CAE1D;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,GAAG,UAAU,CAgB5E;AAED,wBAAgB,mCAAmC,IAAI,UAAU,CAEhE;AAED,wBAAgB,wCAAwC,IAAI,UAAU,CAErE;AAED,wBAAgB,6BAA6B,CAAC,aAAa,EAAE,UAAU,GAAG,UAAU,CAEnF;AAED,wBAAgB,+BAA+B,CAAC,aAAa,EAAE,UAAU,GAAG,UAAU,CAErF;AAED,wBAAgB,uBAAuB,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,EAAE,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,GAAG,SAAS,CAmC7H;AAaD,wBAAgB,SAAS,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,GAAG,UAAU,CAMnG;AAoHD,QAAA,MAAM,cAAc;;;;;CAKV,CAAC;AAEX,KAAK,WAAW,GAAG,MAAM,OAAO,cAAc,CAAC"}

package/dist/x509.js

@@ -43,6 +43,9 @@ export function keyUsageExtension(usages) {
 export function extendedKeyUsageClientAuthExtension() {
     return extension(OID.extendedKeyUsage, false, sequence(oid(OID.clientAuth)));
 }
+export function extendedKeyUsageDocumentSigningExtension() {
+    return extension(OID.extendedKeyUsage, false, sequence(oid(OID.documentSigning)));
+}
 export function subjectKeyIdentifierExtension(keyIdentifier) {
     return extension(OID.subjectKeyIdentifier, false, octetString(keyIdentifier));
 }
@@ -90,7 +93,7 @@ function assertOptionalStringArray(name, values) {
         throw new Error(`${name} must be an array`);
     }
 }
-function extension(extensionOid, critical, valueDer) {
+export function extension(extensionOid, critical, valueDer) {
     return sequence(oid(extensionOid), ...(critical ? [boolean(true)] : []), octetString(valueDer));
 }
 function encodeSerialNumber(serialNumber) {
@@ -192,6 +195,7 @@ function assertYearInRange(year, fieldName) {
 }
 const KEY_USAGE_BITS = {
     digitalSignature: 0,
+    contentCommitment: 1,
     keyCertSign: 5,
     cRLSign: 6
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noz-ele/edgca",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "description": "A small Cloudflare Workers-friendly toolkit for issuing self-managed CA and mTLS client certificates.",
   "type": "module",
   "license": "MIT",
@@ -49,6 +49,9 @@
     }
   },
   "types": "./dist/index.d.ts",
+  "bin": {
+    "edgca": "./dist/cli.js"
+  },
   "scripts": {
     "build": "tsc -p tsconfig.json",
     "typecheck": "tsc -p tsconfig.json --noEmit",
@@ -61,6 +64,7 @@
   },
   "devDependencies": {
     "@cloudflare/vitest-pool-workers": "^0.15.2",
+    "@types/node": "^25.7.0",
     "@vitest/coverage-istanbul": "^4.1.5",
     "fast-check": "^4.7.0",
     "typescript": "^5.9.3",