# pkinative

> Zero-dependency TypeScript toolkit for public-key infrastructure data: strict ASN.1 DER (BER on request), RFC 7468 PEM, object identifiers and complete RFC 5280 X.509 certificate parsing with every standard extension, CWE-tagged resource limits, stable error codes and a conformance gate over x509-limbo, NIST PKITS, Wycheproof and the text of RFC 5280. One API for every runtime with Web Crypto: tested in CI on Node.js 22 (Linux, Windows, macOS) and 24 (Linux), with Deno, Bun and headless Chromium smoke tests and an advisory run on Node.js 26; other Web Crypto runtimes such as Workers are expected to work, not tested in CI. It installs from npm: `npm install pkinative`. Beyond reading, it verifies and creates signatures through Web Crypto, reads, verifies and builds PKCS#10 certification requests, validates RFC 5280 §6 paths with CRL and OCSP revocation, reads, builds and verifies CMS SignedData and RFC 3161 timestamps, hashes public data (SHA-1/256/384/512, SHAKE256), and opens PKCS#8 keys and PKCS#12 files (PBES2 only) into non-extractable signing keys. Six RFC requirement inventories (5280, 5652, 3161, 6960, 7292, 7468) hold it sentence by sentence to the pinned texts.

pkinative never implements secret-dependent cryptography in TypeScript; signing and verification are one call to Web Crypto with the caller's key. Every failure is a PkiError subclass with a stable `code`; profile concerns are diagnostics (`onDiagnostic`, `strict: true`, `certificate.diagnostics`). There is no PEM-to-certificate shortcut: compose `decodePem` and `parseCertificate`.

## Start here

- [Agent brief](https://pkinative.dev/agent-brief.md): what to import, what to catch, what not to write
- [Quick start](https://pkinative.dev/guides/quickstart.md): read a certificate, extensions, diagnostics, errors, limits
- [API manifest](https://pkinative.dev/assets/api.json): every public export with module, signature, summary and thrown error classes

## Guides

- [Use cases](https://pkinative.dev/guides/use-cases.md): inventory, pinning, chains, revocation, CMS signatures (`createSignedData`, `verifySignedData`) RFC 3161 timestamps (`verifyTimeStampToken`, `addTimeStampToken`, `atTimeStamp`), and private keys and PKCS#12 (`openPkcs12`, `decryptPrivateKey`, `allowUnverifiedIntegrity`)
- [Security model](https://pkinative.dev/guides/security.md): strict DER, the twenty-two limits, typed failures, the cryptography boundary
- [Conformance](https://pkinative.dev/guides/conformance.md): x509-limbo, NIST PKITS, Wycheproof, RFC 5280 clause by clause, OpenSSL differential
- [Standards](https://pkinative.dev/guides/standards.md): every ISO/IEC, ITU-T and IETF standard pkinative touches, its evidence and its gaps — a self-assessment, not a certification
- [Errors, diagnostics and reasons](https://pkinative.dev/guides/errors.md): every error, reason and diagnostic code with its cause and remedy
- [CLI reference](https://pkinative.dev/guides/cli.md): pkinative-cli — every command, flag, exit code and error class of the `pkinative` command, and its `--json` agent contract
- [CLI use cases](https://pkinative.dev/guides/use-cases-cli.md): a CI chain-and-expiry gate, offline revocation, signing and time-stamping a release, auditing a PKCS#12
- [MCP server](https://pkinative.dev/guides/mcp.md): pkinative-mcp — client configuration, the 34 tools, seven prompts, resources, error and security models
- [MCP use cases](https://pkinative.dev/guides/use-cases-mcp.md): an agent triaging a failing chain, issuing a test certificate, offline revocation, opening keys safely
- [Choosing a library and a surface](https://pkinative.dev/guides/choose.md): when to use pkinative, when another tool is the right one, and library, CLI or MCP server for each capability

## Data

- [Error registry](https://pkinative.dev/data/errors.json): code, class, cause, remedy, standard, CWE
- [Diagnostic registry](https://pkinative.dev/data/diagnostics.json): code, severity, cause, remedy, standard
- [Limits](https://pkinative.dev/data/limits.json): the named resource bounds with defaults and CWE
- [Capabilities](https://pkinative.dev/data/surfaces.json): what pkinative does, the exports, CLI command lines and MCP tools that do it, since when
- [CLI surface](https://pkinative.dev/data/cli-surface.json): the pkinative-cli commands, flags, exit codes and error classes, from its own capability manifest
- [Ecosystem](https://pkinative.dev/assets/ecosystem.json): versions, milestones, corpus pins and counts

## Ecosystem

pkinative is the engine; two published satellites, each its own repository and npm package pinning `pkinative ^1.0.0`, expose it without code. Both run offline and carry pkinative's `PKI_*` codes verbatim.

- [pkinative-cli](https://github.com/Nizoka/pkinative-cli): `npm install --global pkinative-cli`, binary `pkinative` — 18 commands, 53 invocations, `--json` envelope (exit 0 / 1 / 2), 13 error classes, JSON Schemas (`pkinative schema`); agent contract: https://github.com/Nizoka/pkinative-cli/blob/main/docs/AGENT_CONTRACT.md
- [pkinative-mcp](https://github.com/Nizoka/pkinative-mcp): `npx -y pkinative-mcp`, registry name `io.github.Nizoka/pkinative-mcp` — 34 tools, seven prompts, `pkinative://output/{+path}` resources, stdio and Streamable HTTP; agent contract: https://github.com/Nizoka/pkinative-mcp/blob/main/docs/AGENT_CONTRACT.md
- [Playgrounds](https://pkinative.dev/playgrounds/): the library in a browser tab, a CLI command builder and an MCP tool explorer

## Optional

- [Full documentation](https://pkinative.dev/llms-full.txt): this file, the README and every guide in one text
- [Executable recipes](https://pkinative.dev/llms-recipes.txt): every recipe, CI-tested
- [Documentation index](https://pkinative.dev/llms-index.json): artefacts and guides with sizes and anchors
- [Source](https://github.com/Nizoka/pkinative): repository, AGENTS.md, CHANGELOG.md, ROADMAP.md