sm-crypto-wasm 0.3.0 → 0.7.0

package/dist/x509/parse.js

@@ -0,0 +1,436 @@
+/**
+ * X.509 证书解析（只读）。
+ *
+ * 支持 DER / PEM / base64 输入；不做链校验、不拉 CRL/OCSP。
+ *
+ * 严格性（红线 #3）：
+ * - 单个证书必须恰好是一个完整 DER 对象，尾部多余字节直接拒绝；
+ * - X.509 路径不使用 BER indefinite-length；
+ * - 未知扩展 / 未知算法 / 未知 Name 属性不抛错，保留原始值（红线 #9）。
+ */
+import { Asn1Class, expectSequence, expectUniversal, parseDer, parseDerAll, readBitString, readBoolean, readInteger, readOctetString, readOid, readString, readTime, UniversalTag, } from '../asn1/index.js';
+import { decodeOid } from '../asn1/oid.js';
+import { base64ToBytes, bytesToHex, hexToBytes } from '../runtime/convert.js';
+import * as sm3 from '../sm3/index.js';
+import { CertificateError } from './errors.js';
+import { parseAuthorityKeyIdentifier, parseBasicConstraints, parseExtendedKeyUsage, parseKeyUsage, parseSubjectAltName, parseSubjectKeyIdentifier, } from './extensions.js';
+import { NAME_OID_LABELS, OID_AUTHORITY_KEY_IDENTIFIER, OID_BASIC_CONSTRAINTS, OID_COMMON_NAME, OID_COUNTRY, OID_EMAIL_ADDRESS, OID_EXTENDED_KEY_USAGE, OID_ID_EC_PUBLIC_KEY, OID_KEY_USAGE, OID_LOCALITY, OID_ORGANIZATION, OID_ORGANIZATIONAL_UNIT, OID_RSA_ENCRYPTION, OID_RSA_SIGNATURE_PREFIX, OID_SM2_CURVE, OID_STATE, OID_SUBJECT_ALT_NAME, OID_SUBJECT_KEY_IDENTIFIER, } from './oids.js';
+import { sha256Hex } from './sha256.js';
+import { isUsableSm2PublicKey, isWithinValidity, verifyCertificateSignature, } from './verify.js';
+// ---------- 公开入口 ----------
+/**
+ * 解析单张证书。
+ *
+ * @param input PEM 字符串、base64 字符串、hex 字符串或 DER 字节。
+ * @throws CertificateError 结构非法、截断或尾部有多余字节。
+ */
+export function parseCertificate(input) {
+    const der = decodeCertificateInput(input);
+    try {
+        return certificateFromNode(parseDer(der));
+    }
+    catch (err) {
+        if (err instanceof CertificateError)
+            throw err;
+        throw new CertificateError(`parseCertificate: ${errorMessage(err)}`, { cause: err });
+    }
+}
+/**
+ * 解析一个或多个证书（PEM bundle / 连续 DER）。
+ *
+ * @throws CertificateError 任一证书结构非法。
+ */
+export function parseCertificates(input) {
+    if (typeof input === 'string') {
+        const text = input.trim();
+        const blocks = extractPemBlocks(text);
+        if (blocks.length > 0) {
+            return blocks.map((block) => parseCertificate(block));
+        }
+        return [parseCertificate(text)];
+    }
+    if (isPemText(input)) {
+        return parseCertificates(new TextDecoder().decode(input));
+    }
+    let nodes;
+    try {
+        nodes = parseDerAll(input);
+    }
+    catch (err) {
+        throw new CertificateError(`parseCertificates: ${errorMessage(err)}`, { cause: err });
+    }
+    if (nodes.length === 0)
+        throw new CertificateError('parseCertificates: empty input');
+    return nodes.map((node) => {
+        try {
+            return certificateFromNode(node);
+        }
+        catch (err) {
+            if (err instanceof CertificateError)
+                throw err;
+            throw new CertificateError(`parseCertificates: ${errorMessage(err)}`, { cause: err });
+        }
+    });
+}
+// ---------- 输入解码 ----------
+function decodeCertificateInput(input) {
+    if (input instanceof Uint8Array) {
+        if (input.length === 0)
+            throw new CertificateError('parseCertificate: empty input');
+        if (isPemText(input))
+            return decodeCertificateInput(new TextDecoder().decode(input));
+        return input;
+    }
+    if (typeof input !== 'string') {
+        throw new TypeError('parseCertificate: expected string or Uint8Array');
+    }
+    const text = input.trim();
+    if (text.length === 0)
+        throw new CertificateError('parseCertificate: empty input');
+    const block = extractPemBlocks(text)[0];
+    if (block !== undefined)
+        return pemBodyToDer(block);
+    // 非 PEM：依次尝试 hex 与 base64，以“能否解析出完整 DER 对象”为准。
+    const candidates = [];
+    const compact = text.replace(/\s+/g, '');
+    if (/^[0-9a-fA-F]+$/.test(compact) && compact.length % 2 === 0) {
+        candidates.push(hexToBytes(compact, 'certificate'));
+    }
+    try {
+        candidates.push(base64ToBytes(compact, 'certificate'));
+    }
+    catch {
+        // 不是 base64；保留 hex 候选（若也没有，下面统一报错）。
+    }
+    for (const candidate of candidates) {
+        try {
+            parseDer(candidate);
+            return candidate;
+        }
+        catch {
+            // 换下一个候选。
+        }
+    }
+    throw new CertificateError('parseCertificate: input is neither PEM, hex nor base64 DER');
+}
+function extractPemBlocks(text) {
+    const blocks = [];
+    const re = /-----BEGIN CERTIFICATE-----([\s\S]*?)-----END CERTIFICATE-----/g;
+    for (;;) {
+        const match = re.exec(text);
+        if (match === null)
+            break;
+        blocks.push(match[0]);
+    }
+    return blocks;
+}
+function pemBodyToDer(pem) {
+    const match = /-----BEGIN CERTIFICATE-----([\s\S]*?)-----END CERTIFICATE-----/.exec(pem);
+    if (match === null)
+        throw new CertificateError('parseCertificate: missing CERTIFICATE PEM block');
+    const body = match[1].replace(/\s+/g, '');
+    try {
+        return base64ToBytes(body, 'certificate');
+    }
+    catch (err) {
+        throw new CertificateError('parseCertificate: invalid base64 in PEM block', { cause: err });
+    }
+}
+function isPemText(bytes) {
+    const prefix = '-----BEGIN ';
+    if (bytes.length < prefix.length)
+        return false;
+    for (let i = 0; i < prefix.length; i++) {
+        if (bytes[i] !== prefix.charCodeAt(i))
+            return false;
+    }
+    return true;
+}
+// ---------- Certificate ----------
+function certificateFromNode(top) {
+    const kids = expectSequence(top, 'Certificate');
+    if (kids.length !== 3) {
+        throw new CertificateError(`Certificate: expected 3 elements, got ${kids.length}`);
+    }
+    const tbsNode = expectUniversal(kids[0], UniversalTag.Sequence, 'tbsCertificate');
+    const signatureAlgorithm = parseAlgorithmIdentifier(kids[1], 'signatureAlgorithm');
+    const signatureValue = new Uint8Array(readBitString(expectUniversal(kids[2], UniversalTag.BitString, 'signatureValue'), 'signatureValue').bytes);
+    const tbs = parseTbsCertificate(tbsNode);
+    const raw = copy(top.raw);
+    const publicKeyAlgorithm = classifyPublicKey(tbs.subjectPublicKeyInfo.algorithm);
+    const subjectPublicKey = tbs.subjectPublicKeyInfo.publicKey;
+    const supported = publicKeyAlgorithm === 'SM2' &&
+        (subjectPublicKey.length === 64 ||
+            (subjectPublicKey.length === 65 && subjectPublicKey[0] === 0x04));
+    const extensions = tbs.extensions;
+    const cert = {
+        version: tbs.version,
+        serialNumber: tbs.serialNumber,
+        serialNumberHex: tbs.serialNumber.toString(16),
+        signatureAlgorithm,
+        issuer: tbs.issuer,
+        validity: tbs.validity,
+        subject: tbs.subject,
+        subjectPublicKeyInfo: tbs.subjectPublicKeyInfo,
+        extensions,
+        signatureValue,
+        tbsCertificate: copy(tbsNode.raw),
+        raw,
+        subjectPublicKey,
+        publicKeyAlgorithm,
+        supported,
+        keyUsage: extensionValue(extensions, OID_KEY_USAGE, parseKeyUsage),
+        basicConstraints: extensionValue(extensions, OID_BASIC_CONSTRAINTS, parseBasicConstraints),
+        subjectAltNames: extensionValue(extensions, OID_SUBJECT_ALT_NAME, parseSubjectAltName) ?? [],
+        extendedKeyUsage: extensionValue(extensions, OID_EXTENDED_KEY_USAGE, parseExtendedKeyUsage) ?? [],
+        subjectKeyIdentifier: extensionValue(extensions, OID_SUBJECT_KEY_IDENTIFIER, parseSubjectKeyIdentifier),
+        authorityKeyIdentifier: extensionValue(extensions, OID_AUTHORITY_KEY_IDENTIFIER, parseAuthorityKeyIdentifier),
+        getExtension(oid) {
+            return extensions.find((ext) => ext.oid === oid);
+        },
+        checkValidity(at = new Date()) {
+            return isWithinValidity(cert.validity, at);
+        },
+        verifySignature(issuer, opts = {}) {
+            if (!cert.supported)
+                return false;
+            const publicKey = resolveIssuerPublicKey(issuer);
+            if (publicKey === null)
+                return false;
+            return verifyCertificateSignature(cert, publicKey, opts);
+        },
+        fingerprint(hash = 'sm3') {
+            if (hash === 'sm3')
+                return sm3.hash(raw);
+            if (hash === 'sha256')
+                return sha256Hex(raw);
+            throw new TypeError(`fingerprint: unsupported hash "${String(hash)}"`);
+        },
+    };
+    return cert;
+}
+function parseTbsCertificate(tbsNode) {
+    const kids = expectSequence(tbsNode, 'TBSCertificate');
+    let index = 0;
+    let version = 1;
+    const first = kids[0];
+    if (first !== undefined && first.cls === Asn1Class.ContextSpecific && first.tag === 0) {
+        const inner = first.children?.[0];
+        const rawVersion = Number(readInteger(expectUniversal(inner, UniversalTag.Integer, 'version')));
+        if (rawVersion < 0 || rawVersion > 2) {
+            throw new CertificateError(`TBSCertificate: unsupported version ${rawVersion}`);
+        }
+        version = (rawVersion + 1);
+        index = 1;
+    }
+    const serialNode = kids[index++];
+    const serialNumber = serialNode
+        ? readInteger(serialNode, 'serialNumber')
+        : (() => {
+            throw new CertificateError('TBSCertificate: missing serialNumber');
+        })();
+    // TBS 内签名算法（与外层应一致；这里只解析，不做强一致断言）。
+    parseAlgorithmIdentifier(kids[index++], 'signature');
+    const issuer = parseName(kids[index++], 'issuer');
+    const validity = parseValidity(kids[index++]);
+    const subject = parseName(kids[index++], 'subject');
+    const spkiNode = expectUniversal(kids[index++], UniversalTag.Sequence, 'subjectPublicKeyInfo');
+    const subjectPublicKeyInfo = parseSpki(spkiNode);
+    let extensions = [];
+    for (; index < kids.length; index++) {
+        const node = kids[index];
+        if (node === undefined)
+            continue;
+        if (node.cls === Asn1Class.ContextSpecific && node.tag === 3) {
+            extensions = parseExtensions(node);
+        }
+        // [1] issuerUniqueID / [2] subjectUniqueID 与未知尾部字段：忽略。
+    }
+    return { version, serialNumber, issuer, validity, subject, subjectPublicKeyInfo, extensions };
+}
+function parseValidity(node) {
+    const kids = expectSequence(node, 'validity');
+    if (kids.length < 2)
+        throw new CertificateError('validity: expected notBefore and notAfter');
+    return {
+        notBefore: readTime(kids[0], 'notBefore'),
+        notAfter: readTime(kids[1], 'notAfter'),
+    };
+}
+function parseSpki(node) {
+    const kids = expectSequence(node, 'subjectPublicKeyInfo');
+    if (kids.length < 2)
+        throw new CertificateError('subjectPublicKeyInfo: missing public key');
+    const algorithm = parseAlgorithmIdentifier(kids[0], 'subjectPublicKeyInfo.algorithm');
+    const bits = readBitString(kids[1], 'subjectPublicKey');
+    return {
+        algorithm,
+        publicKey: new Uint8Array(bits.bytes),
+        raw: copy(node.raw),
+    };
+}
+function parseAlgorithmIdentifier(node, what) {
+    const kids = expectSequence(node, what);
+    const first = kids[0];
+    if (first === undefined)
+        throw new CertificateError(`${what}: missing algorithm OID`);
+    const oid = readOid(first, what);
+    const parameterNode = kids[1];
+    if (parameterNode === undefined)
+        return { oid };
+    return {
+        oid,
+        parameters: new Uint8Array(parameterNode.value),
+        parametersRaw: copy(parameterNode.raw),
+    };
+}
+// ---------- Name ----------
+function parseName(node, what) {
+    const rdns = expectSequence(node, what);
+    const attributes = [];
+    for (const rdn of rdns) {
+        const set = expectUniversal(rdn, UniversalTag.Set, what);
+        const atvs = set.children;
+        if (!atvs)
+            continue;
+        for (const atv of atvs) {
+            const parts = expectSequence(atv, what);
+            const typeNode = parts[0];
+            const valueNode = parts[1];
+            if (typeNode === undefined || valueNode === undefined) {
+                throw new CertificateError(`${what}: malformed AttributeTypeAndValue`);
+            }
+            attributes.push({
+                oid: readOid(typeNode, what),
+                value: decodeAttributeValue(valueNode),
+                raw: copy(atv.raw),
+            });
+        }
+    }
+    const find = (oid) => attributes.find((attribute) => attribute.oid === oid)?.value;
+    return {
+        commonName: find(OID_COMMON_NAME),
+        organization: find(OID_ORGANIZATION),
+        organizationalUnit: find(OID_ORGANIZATIONAL_UNIT),
+        country: find(OID_COUNTRY),
+        state: find(OID_STATE),
+        locality: find(OID_LOCALITY),
+        emailAddress: find(OID_EMAIL_ADDRESS),
+        attributes,
+        raw: copy(node.raw),
+        toString() {
+            return attributes.map((a) => formatNameAttribute(a.oid, a.value)).join(',');
+        },
+    };
+}
+function decodeAttributeValue(node) {
+    try {
+        return readString(node, 'Name attribute');
+    }
+    catch {
+        // 未知字符串类型（如私有编码）：保留原始内容，绝不抛错。
+        return `#${bytesToHex(node.value)}`;
+    }
+}
+function formatNameAttribute(oid, value) {
+    const label = NAME_OID_LABELS[oid] ?? oid;
+    return `${label}=${escapeRdnValue(value)}`;
+}
+/** RFC 4514 的最小转义集。 */
+function escapeRdnValue(value) {
+    let out = value.replace(/([,+"\\<>;])/g, '\\$1');
+    if (out.startsWith(' '))
+        out = `\\${out}`;
+    if (out.endsWith(' '))
+        out = `${out.slice(0, -1)}\\ `;
+    if (out.startsWith('#'))
+        out = `\\${out}`;
+    return out;
+}
+// ---------- Extensions ----------
+function parseExtensions(node) {
+    const inner = node.children?.[0];
+    const listNode = expectUniversal(inner, UniversalTag.Sequence, 'extensions');
+    const entries = listNode.children ?? [];
+    return entries.map((entry) => {
+        const kids = expectSequence(entry, 'Extension');
+        const oidNode = kids[0];
+        if (oidNode === undefined)
+            throw new CertificateError('Extension: missing OID');
+        const oid = readOid(oidNode, 'Extension');
+        let index = 1;
+        let critical = false;
+        const criticalNode = kids[index];
+        if (criticalNode !== undefined &&
+            criticalNode.cls === Asn1Class.Universal &&
+            criticalNode.tag === UniversalTag.Boolean) {
+            critical = readBoolean(criticalNode, 'Extension.critical');
+            index++;
+        }
+        const valueNode = kids[index];
+        if (valueNode === undefined)
+            throw new CertificateError(`Extension ${oid}: missing value`);
+        return {
+            oid,
+            critical,
+            value: new Uint8Array(readOctetString(valueNode, `Extension ${oid}`)),
+            raw: copy(entry.raw),
+        };
+    });
+}
+function extensionValue(extensions, oid, parse) {
+    const extension = extensions.find((item) => item.oid === oid);
+    if (extension === undefined)
+        return undefined;
+    try {
+        return parse(extension.value);
+    }
+    catch {
+        // 已知扩展损坏 → 视为缺失（红线 #9：不让真实证书解析失败）。
+        return undefined;
+    }
+}
+// ---------- 辅助 ----------
+function classifyPublicKey(algorithm) {
+    if (algorithm.oid === OID_SM2_CURVE)
+        return 'SM2';
+    if (algorithm.oid === OID_ID_EC_PUBLIC_KEY) {
+        if (algorithm.parameters === undefined)
+            return 'UNKNOWN';
+        try {
+            return decodeOid(algorithm.parameters) === OID_SM2_CURVE ? 'SM2' : 'UNKNOWN';
+        }
+        catch {
+            return 'UNKNOWN';
+        }
+    }
+    if (algorithm.oid === OID_RSA_ENCRYPTION || algorithm.oid.startsWith(OID_RSA_SIGNATURE_PREFIX)) {
+        return 'RSA';
+    }
+    return 'UNKNOWN';
+}
+function resolveIssuerPublicKey(issuer) {
+    if (isCertificateLike(issuer))
+        return issuer.subjectPublicKey;
+    if (issuer.length === 64 || issuer.length === 65) {
+        return isUsableSm2PublicKey(issuer) ? issuer : null;
+    }
+    try {
+        return parseCertificate(issuer).subjectPublicKey;
+    }
+    catch {
+        return null;
+    }
+}
+function isCertificateLike(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        'tbsCertificate' in value &&
+        'subjectPublicKey' in value);
+}
+function copy(bytes) {
+    return new Uint8Array(bytes);
+}
+function errorMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}

package/dist/x509/sha1.d.ts

@@ -0,0 +1,9 @@
+/**
+ * 纯 JS SHA-1（仅用于 SubjectKeyIdentifier 的 OpenSSL 兼容选项）。
+ *
+ * 与 `sha256.ts` 同样的理由：X.509 API 是同步的，不能用 `crypto.subtle`；
+ * `node:crypto` 会破坏浏览器构建。SHA-1 在这里只作为 SKI 的哈希选项
+ * （`subjectKeyIdentifier: { hash: 'sha1' }`），不用于任何安全判断。
+ */
+/** SHA-1 摘要（小写 hex）。 */
+export declare function sha1Hex(input: Uint8Array): string;

package/dist/x509/sha1.js

@@ -0,0 +1,72 @@
+/**
+ * 纯 JS SHA-1（仅用于 SubjectKeyIdentifier 的 OpenSSL 兼容选项）。
+ *
+ * 与 `sha256.ts` 同样的理由：X.509 API 是同步的，不能用 `crypto.subtle`；
+ * `node:crypto` 会破坏浏览器构建。SHA-1 在这里只作为 SKI 的哈希选项
+ * （`subjectKeyIdentifier: { hash: 'sha1' }`），不用于任何安全判断。
+ */
+/** SHA-1 摘要（小写 hex）。 */
+export function sha1Hex(input) {
+    const length = input.length;
+    const paddedLength = Math.ceil((length + 9) / 64) * 64;
+    const buffer = new Uint8Array(paddedLength);
+    buffer.set(input);
+    buffer[length] = 0x80;
+    const view = new DataView(buffer.buffer);
+    view.setUint32(paddedLength - 8, Math.floor(length / 0x20000000));
+    view.setUint32(paddedLength - 4, (length * 8) >>> 0);
+    let h0 = 0x67452301;
+    let h1 = 0xefcdab89;
+    let h2 = 0x98badcfe;
+    let h3 = 0x10325476;
+    let h4 = 0xc3d2e1f0;
+    const w = new Uint32Array(80);
+    for (let offset = 0; offset < paddedLength; offset += 64) {
+        for (let i = 0; i < 16; i++)
+            w[i] = view.getUint32(offset + i * 4);
+        for (let i = 16; i < 80; i++) {
+            const x = w[i - 3] ^ w[i - 8] ^ w[i - 14] ^ w[i - 16];
+            w[i] = rotl(x, 1);
+        }
+        let a = h0;
+        let b = h1;
+        let c = h2;
+        let d = h3;
+        let e = h4;
+        for (let i = 0; i < 80; i++) {
+            let f;
+            let k;
+            if (i < 20) {
+                f = (b & c) | (~b & d);
+                k = 0x5a827999;
+            }
+            else if (i < 40) {
+                f = b ^ c ^ d;
+                k = 0x6ed9eba1;
+            }
+            else if (i < 60) {
+                f = (b & c) | (b & d) | (c & d);
+                k = 0x8f1bbcdc;
+            }
+            else {
+                f = b ^ c ^ d;
+                k = 0xca62c1d6;
+            }
+            const temp = (rotl(a, 5) + f + e + k + w[i]) >>> 0;
+            e = d;
+            d = c;
+            c = rotl(b, 30);
+            b = a;
+            a = temp;
+        }
+        h0 = (h0 + a) >>> 0;
+        h1 = (h1 + b) >>> 0;
+        h2 = (h2 + c) >>> 0;
+        h3 = (h3 + d) >>> 0;
+        h4 = (h4 + e) >>> 0;
+    }
+    return [h0, h1, h2, h3, h4].map((v) => v.toString(16).padStart(8, '0')).join('');
+}
+function rotl(value, shift) {
+    return ((value << shift) | (value >>> (32 - shift))) >>> 0;
+}

package/dist/x509/sha256.d.ts

@@ -0,0 +1,9 @@
+/**
+ * 纯 JS SHA-256（仅用于证书指纹）。
+ *
+ * 不引入新依赖、不新增 wasm：X.509 API 是同步的，无法调用宿主的
+ * `crypto.subtle.digest`；Node 的 `node:crypto` 又会让浏览器构建失败。
+ * 这里实现 FIPS 180-4 的标准算法，输出小写 hex。
+ */
+/** SHA-256 摘要（小写 hex）。 */
+export declare function sha256Hex(input: Uint8Array): string;

package/dist/x509/sha256.js

@@ -0,0 +1,84 @@
+/**
+ * 纯 JS SHA-256（仅用于证书指纹）。
+ *
+ * 不引入新依赖、不新增 wasm：X.509 API 是同步的，无法调用宿主的
+ * `crypto.subtle.digest`；Node 的 `node:crypto` 又会让浏览器构建失败。
+ * 这里实现 FIPS 180-4 的标准算法，输出小写 hex。
+ */
+const K = new Uint32Array([
+    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+]);
+/** SHA-256 摘要（小写 hex）。 */
+export function sha256Hex(input) {
+    const length = input.length;
+    // padding：0x80 + 若干 0 + 8 字节长度，总长为 64 的倍数。
+    const paddedLength = Math.ceil((length + 9) / 64) * 64;
+    const buffer = new Uint8Array(paddedLength);
+    buffer.set(input);
+    buffer[length] = 0x80;
+    const view = new DataView(buffer.buffer);
+    // 长度是 64-bit big-endian（输入实际不会超过 2^32 位，高 32 位取 0）。
+    view.setUint32(paddedLength - 8, Math.floor(length / 0x20000000));
+    view.setUint32(paddedLength - 4, (length * 8) >>> 0);
+    const h = new Uint32Array([
+        0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
+    ]);
+    const w = new Uint32Array(64);
+    for (let offset = 0; offset < paddedLength; offset += 64) {
+        for (let i = 0; i < 16; i++)
+            w[i] = view.getUint32(offset + i * 4);
+        for (let i = 16; i < 64; i++) {
+            const w15 = w[i - 15];
+            const w2 = w[i - 2];
+            const s0 = rotr(w15, 7) ^ rotr(w15, 18) ^ (w15 >>> 3);
+            const s1 = rotr(w2, 17) ^ rotr(w2, 19) ^ (w2 >>> 10);
+            w[i] = (w[i - 16] + s0 + w[i - 7] + s1) >>> 0;
+        }
+        let a = h[0];
+        let b = h[1];
+        let c = h[2];
+        let d = h[3];
+        let e = h[4];
+        let f = h[5];
+        let g = h[6];
+        let hh = h[7];
+        for (let i = 0; i < 64; i++) {
+            const s1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+            const ch = (e & f) ^ (~e & g);
+            const temp1 = (hh + s1 + ch + K[i] + w[i]) >>> 0;
+            const s0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
+            const maj = (a & b) ^ (a & c) ^ (b & c);
+            const temp2 = (s0 + maj) >>> 0;
+            hh = g;
+            g = f;
+            f = e;
+            e = (d + temp1) >>> 0;
+            d = c;
+            c = b;
+            b = a;
+            a = (temp1 + temp2) >>> 0;
+        }
+        h[0] = (h[0] + a) >>> 0;
+        h[1] = (h[1] + b) >>> 0;
+        h[2] = (h[2] + c) >>> 0;
+        h[3] = (h[3] + d) >>> 0;
+        h[4] = (h[4] + e) >>> 0;
+        h[5] = (h[5] + f) >>> 0;
+        h[6] = (h[6] + g) >>> 0;
+        h[7] = (h[7] + hh) >>> 0;
+    }
+    let out = '';
+    for (let i = 0; i < 8; i++)
+        out += h[i].toString(16).padStart(8, '0');
+    return out;
+}
+function rotr(value, shift) {
+    return ((value >>> shift) | (value << (32 - shift))) >>> 0;
+}

package/dist/x509/sig.d.ts

@@ -0,0 +1,20 @@
+/**
+ * SM2 签名值的两种编码转换：
+ * - 裸格式：64 字节 `r ‖ s`（`sm2.sign` 的返回）；
+ * - DER 格式：`SEQUENCE { INTEGER r, INTEGER s }`（X.509 / CMS 要求）。
+ *
+ * 红线 #2：签发给外部系统的证书/CMS 必须是 DER 格式；直接塞裸 `r‖s`
+ * 会产出非标准数据。
+ */
+/**
+ * DER `SEQUENCE { r, s }` → 64 字节 `r ‖ s`。
+ *
+ * @throws CertificateError 结构非法、r/s 为负或超过 32 字节。
+ */
+export declare function derSignatureToRaw(der: Uint8Array, what?: string): Uint8Array;
+/**
+ * 64 字节 `r ‖ s` → DER `SEQUENCE { r, s }`。
+ *
+ * @throws CertificateError 长度不是 64 字节。
+ */
+export declare function rawSignatureToDer(raw: Uint8Array, what?: string): Uint8Array;