@blamejs/pki 0.2.19 → 0.2.20

package/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.2.20 — 2026-07-15
+
+A WebAuthn attestation object whose attestation statement is not a CBOR map is now rejected with a typed webauthn/bad-attestation-object at parse instead of surfacing an untyped error from a format verifier, and the strict CBOR codec gains pki.cbor.read.mapGet -- a keyed map lookup that asserts the map's major type inside the accessor.
+
+### Added
+
+- pki.cbor.read.mapGet(node, key) -- the keyed lookup over a decoded CBOR map (RFC 8949 major type 5). A text-string key matches text-string map keys; an integer key (a safe-integer number or a BigInt, as COSE labels are) matches integer map keys; matching never coerces across the two. It returns the value node, or null when the map has no such entry -- decode already enforced key uniqueness, so at most one entry can match. A non-map node throws cbor/unexpected-major, and a key that is neither a text string nor an integer throws a TypeError.
+
+### Changed
+
+- A WebAuthn attestation object whose attStmt is not a CBOR map is now classified as a malformed attestation object -- webauthn/bad-attestation-object, thrown at parse for every attestation format -- where it previously surfaced as a per-format webauthn/bad-att-stmt or an untyped error depending on the CBOR type carried.
+
+### Fixed
+
+- pki.webauthn.parseAttestationObject and pki.webauthn.verify no longer throw a raw TypeError when the attestation object's attStmt is a CBOR array: the attestation-statement field walk read the array's children as key/value pairs and dereferenced undefined. The attestation object's attStmt shape is now validated at parse (WebAuthn sec. 6.5.4), and the statement walk reads its pairs through pki.cbor.read.map, which asserts the major type -- malformed hostile bytes are a typed webauthn/* verdict, never an untyped crash.
+
 ## v0.2.19 — 2026-07-14
 
 The RFC 3161 Time-Stamp Protocol surface is complete: pki.tsp.request and pki.tsp.response build and parse the protocol's request and response messages, and pki.tsp.verify verifies a timestamp token end to end -- the CMS signature, the message imprint, the ESSCertID(V2) certificate binding, the critical timeStamping-only extendedKeyUsage, and full validation of the TSA certificate at the token's own genTime.

package/README.md

@@ -199,7 +199,7 @@ is callable today; nothing below is a stub.
 | Namespace | What it does |
 |---|---|
 | `pki.asn1` | Strict, bounded DER codec — `decode` (zero-copy node tree), `encode`, `build.*` canonical-DER value builders, `read.*` typed readers, `TAGS`, OID-content encode/decode |
-| `pki.cbor` | Strict, bounded RFC 8949 deterministic CBOR codec — `decode` (zero-copy node tree) + `read.*` typed leaf readers, fail-closed on every non-canonical shape (indefinite length, non-minimal argument, unsorted / duplicate map keys, non-shortest float, trailing bytes) |
+| `pki.cbor` | Strict, bounded RFC 8949 deterministic CBOR codec — `decode` (zero-copy node tree) + `read.*` typed leaf readers incl. the keyed map lookup `read.mapGet` (text or COSE-label integer key, the map's major type asserted in the accessor), fail-closed on every non-canonical shape (indefinite length, non-minimal argument, unsorted / duplicate map keys, non-shortest float, trailing bytes) |
 | `pki.oid` | Two-way OID ↔ name registry — `name`, `byName`, `register`, `toArcs`/`fromArcs`, `toDER`/`fromDER`; seeded with RFC 5280 + NIST PQC arcs |
 | `pki.webcrypto` | A W3C WebCrypto (`SubtleCrypto`) engine over `node:crypto` — `sign`/`verify`/`encrypt`/`decrypt`/`deriveBits`/`digest`/`generateKey`/`importKey`/`exportKey` across RSA, ECDSA, ECDH, Ed25519/Ed448, AES, HMAC, HKDF, PBKDF2, SHA — **and** post-quantum ML-DSA-44/65/87 and SLH-DSA signatures, plus ML-KEM-512/768/1024 key generation (KEM encapsulation on the roadmap). Zero-dependency, OpenSSL-interoperable |
 | `pki.schema` | The schema family — `parse` detects which PKI format DER / PEM encodes and routes to the right parser, `all` enumerates the registered formats, and the engine + per-format members are grouped here |

package/lib/cbor-det.js

@@ -415,6 +415,52 @@ function readMap(node) {
   return node.children;
 }
 
+/**
+ * @primitive  pki.cbor.read.mapGet
+ * @signature  pki.cbor.read.mapGet(node, key) -> valueNode | null
+ * @since      0.2.20
+ * @status     experimental
+ * @spec       RFC 8949 sec. 3.1 (major type 5)
+ *
+ * The value node of the map entry whose key equals `key` -- a text string
+ * (matched against text-string keys) or an integer (a safe-integer number or a
+ * BigInt, matched against integer keys, as COSE labels are) -- or null when the
+ * map has no such entry. Key matching never coerces across types: a text key
+ * only matches a text-string key node, an integer key only an integer key node.
+ * At most one entry can match -- decode already enforced key uniqueness. This is
+ * the single keyed-lookup home over a decoded map: a consumer composes it (or
+ * `read.map`) rather than walking `children` as pairs, so a lookup can never
+ * pair-index a non-map's children (single nodes, whose pair index reads
+ * undefined). Throws `cbor/unexpected-major` when `node` is not a map -- a
+ * lookup on a non-map is malformed input, never an absent-entry verdict -- and
+ * a TypeError for a key that is neither a text string nor an integer.
+ *
+ * @example
+ *   pki.cbor.read.mapGet(node, "fmt"); // -> valueNode | null
+ *   pki.cbor.read.mapGet(node, 3);     // a COSE alg label -> valueNode | null
+ */
+function readMapGet(node, key) {
+  _expectMajor(node, 5, "read.mapGet");
+  var wantText = typeof key === "string";
+  if (!wantText) {
+    if (typeof key === "number") {
+      if (!Number.isSafeInteger(key)) throw new TypeError("read.mapGet: a numeric key must be a safe integer");
+      key = BigInt(key);
+    } else if (typeof key !== "bigint") {
+      throw new TypeError("read.mapGet: key must be a text string or an integer");
+    }
+  }
+  for (var i = 0; i < node.children.length; i++) {
+    var k = node.children[i][0];
+    if (wantText) {
+      if (k.majorType === 3 && readTextString(k) === key) return node.children[i][1];
+    } else if ((k.majorType === 0 || k.majorType === 1) && readInt(k) === key) {
+      return node.children[i][1];
+    }
+  }
+  return null;
+}
+
 /**
  * @primitive  pki.cbor.read.boolean
  * @signature  pki.cbor.read.boolean(node) -> false
@@ -550,6 +596,8 @@ function readTime(node) {
   }
   var ns = Number(secs);
   var d = new Date(ns < 0 ? -constants.TIME.seconds(-ns) : constants.TIME.seconds(ns));
+  // Coverage residual -- the epoch-window bound above already rejects any value the
+  // Date constructor cannot represent, so this backstop is defense-in-depth.
   if (isNaN(d.getTime())) throw new CborError("cbor/bad-time", "epoch time out of range");
   return d;
 }
@@ -586,6 +634,7 @@ module.exports = {
     textString:     readTextString,
     array:          readArray,
     map:            readMap,
+    mapGet:         readMapGet,
     boolean:        readBoolean,
     nullValue:      readNull,
     undefinedValue: readUndefined,

package/lib/validator-cose.js

@@ -64,19 +64,6 @@ var ALG_PROFILE = {
   "-257": { kty: 3 }, "-258": { kty: 3 }, "-259": { kty: 3 }, "-37": { kty: 3 }, "-65535": { kty: 3 },
 };
 
-// The value node of an integer-labelled COSE_Key parameter (labels are ints), or null.
-function _mapGetInt(node, key) {
-  // Coverage residual -- credentialKey validates node is a majorType-5 map (before any
-  // _mapGetInt call), and cbor-det always gives a map a (truthy) children array, so this
-  // guard cannot fire.
-  if (!node || node.majorType !== 5 || !node.children) return null;
-  for (var i = 0; i < node.children.length; i++) {
-    var k = node.children[i][0];
-    if ((k.majorType === 0 || k.majorType === 1) && cbor.read.int(k) === BigInt(key)) return node.children[i][1];
-  }
-  return null;
-}
-
 // credentialKey(node, E, code) -> the decoded + validated credential public key
 // { kty, alg, crv?, x?, y?, n?, e? }, or throws new E(code, ...). The complete COSE_Key
 // conformance gate for a WebAuthn credential key; a format module MUST route a credential
@@ -90,9 +77,9 @@ function credentialKey(node, E, code) {
   if (!node || node.majorType !== 5) throw bad("a COSE_Key must be a CBOR map (RFC 9052 sec. 7)");
   // Every parameter read maps a wrong-type cbor/* fault to the caller's domain -- a
   // wrong-typed COSE label (x as an integer, kty as a string) is bad input, not a leak.
-  function ib(label) { var n = _mapGetInt(node, label); if (!n) return null; try { return cbor.read.byteString(n); } catch (e) { throw bad("COSE_Key parameter " + label + " must be a byte string", e); } }
-  function ii(label) { var n = _mapGetInt(node, label); if (!n) return null; try { return cbor.read.int(n); } catch (e) { throw bad("COSE_Key parameter " + label + " must be an integer", e); } }
-  var ktyN = _mapGetInt(node, 1), algN = _mapGetInt(node, 3);
+  function ib(label) { var n = cbor.read.mapGet(node, label); if (!n) return null; try { return cbor.read.byteString(n); } catch (e) { throw bad("COSE_Key parameter " + label + " must be a byte string", e); } }
+  function ii(label) { var n = cbor.read.mapGet(node, label); if (!n) return null; try { return cbor.read.int(n); } catch (e) { throw bad("COSE_Key parameter " + label + " must be an integer", e); } }
+  var ktyN = cbor.read.mapGet(node, 1), algN = cbor.read.mapGet(node, 3);
   if (!ktyN) throw bad("a COSE_Key is missing the kty (label 1) parameter");
   if (!algN) throw bad("a COSE_Key is missing the alg (label 3) parameter");
   var kty, algv;
@@ -103,7 +90,7 @@ function credentialKey(node, E, code) {
     key.crv = ii(-1) != null ? Number(ii(-1)) : null;
     // WebAuthn EC2 credential keys MUST use the uncompressed point form: y (-3) is the full
     // y-coordinate byte string, never a CBOR bool sign bit (WebAuthn sec. alg identifier).
-    var yNode = _mapGetInt(node, -3);
+    var yNode = cbor.read.mapGet(node, -3);
     if (yNode && yNode.majorType === 7) throw bad("an EC2 credential key must use the uncompressed point form (a compressed y sign-bit is not permitted for WebAuthn)");
     key.x = ib(-2); key.y = ib(-3);
     if (key.crv == null || !key.x || !key.y) throw bad("an EC2 COSE_Key must carry crv (-1), x (-2), and y (-3)");

package/lib/webauthn.js

@@ -75,20 +75,6 @@ function _coseAlgHash(alg, E) {
   return h;
 }
 
-// ---- CBOR map access over the strict pki.cbor node tree ----------------------
-
-// A decoded CBOR map is a node whose `children` is an array of [keyNode, valNode].
-// Look a text-keyed entry up, or null. The strict codec already rejected a
-// duplicate map key, so at most one match exists.
-function _mapGet(node, key) {
-  if (!node || node.majorType !== 5 || !node.children) return null;
-  for (var i = 0; i < node.children.length; i++) {
-    var k = node.children[i][0];
-    if (k.majorType === 3 && cbor.read.textString(k) === key) return node.children[i][1];
-  }
-  return null;
-}
-
 // ---- authenticatorData bounded reader (WebAuthn sec. 6.1) --------------------
 
 // authData = rpIdHash[32] || flags[1] || signCount[4 BE] || (AT? attestedCredentialData) || (ED? extensions CBOR).
@@ -333,11 +319,16 @@ function parseAttestationObject(bytes) {
   var root;
   try { root = cbor.decode(bytes); } catch (e) { throw _err("webauthn/bad-attestation-object", "the attestation object is not well-formed CBOR", e); }
   if (root.majorType !== 5) throw _err("webauthn/bad-attestation-object", "the attestation object must be a CBOR map { fmt, attStmt, authData }");
-  var fmtN = _mapGet(root, "fmt"), attStmtN = _mapGet(root, "attStmt"), authDataN = _mapGet(root, "authData");
+  var fmtN = cbor.read.mapGet(root, "fmt"), attStmtN = cbor.read.mapGet(root, "attStmt"), authDataN = cbor.read.mapGet(root, "authData");
   // The attestation object is EXACTLY { fmt, attStmt, authData } -- no more, no fewer
   // (WebAuthn 6.5.4); an extra top-level key is a non-canonical envelope, rejected.
   if (root.children.length !== 3 || !fmtN || !attStmtN || !authDataN) throw _err("webauthn/bad-attestation-object", "the attestation object must be exactly { fmt, attStmt, authData }");
   if (fmtN.majorType !== 3) throw _err("webauthn/bad-attestation-object", "attestation object 'fmt' must be a text string");
+  // attStmt is the attestation statement, a CBOR map keyed by field name (WebAuthn 6.5.4);
+  // a non-map attStmt is a malformed attestation OBJECT, rejected here rather than deferred
+  // to a format verifier -- a non-map value (e.g. a CBOR array, whose children are single
+  // nodes, not { key, value } pairs) must never reach the per-field statement walk.
+  if (attStmtN.majorType !== 5) throw _err("webauthn/bad-attestation-object", "attestation object 'attStmt' must be a CBOR map");
   if (authDataN.majorType !== 2) throw _err("webauthn/bad-attestation-object", "attestation object 'authData' must be a byte string");
   var authDataBytes = cbor.read.byteString(authDataN);
   return {
@@ -351,7 +342,7 @@ function parseAttestationObject(bytes) {
 // ---- attestation-format verifiers -------------------------------------------
 
 function _reqAttr(map, key) {
-  var n = _mapGet(map, key);
+  var n = cbor.read.mapGet(map, key);
   if (!n) throw _err("webauthn/bad-att-stmt", "the attestation statement is missing the '" + key + "' field");
   return n;
 }
@@ -370,7 +361,11 @@ function _sigOf(attStmt) { return _attRead(attStmt, "sig", cbor.read.byteString,
 // non-canonical statement, rejected before any field is trusted (WebAuthn sec. 8.*).
 function _requireAttShape(attStmt, allowed, required) {
   var have = {};
-  if (attStmt && attStmt.children) attStmt.children.forEach(function (kv) {
+  // attStmt is the attestation-statement map (parseAttestationObject established it is a CBOR
+  // map). cbor.read.map asserts the major type and yields the { key, value } pairs -- never a
+  // raw .children walk, whose entries are single nodes (not pairs) for a non-map, so a pair
+  // index would read undefined and throw a raw TypeError instead of failing closed.
+  cbor.read.map(attStmt).forEach(function (kv) {
     // attStmt keys are text strings; a non-text key is a malformed statement,
     // rejected (not silently skipped, which would evade the unexpected-field check).
     if (kv[0].majorType !== 3) throw _err("webauthn/bad-att-stmt", "the attestation statement has a non-text-string field key");
@@ -380,7 +375,7 @@ function _requireAttShape(attStmt, allowed, required) {
   required.forEach(function (k) { if (!have[k]) throw _err("webauthn/bad-att-stmt", "the attestation statement is missing the '" + k + "' field"); });
 }
 function _readX5c(attStmt) {
-  var x5cN = _mapGet(attStmt, "x5c");
+  var x5cN = cbor.read.mapGet(attStmt, "x5c");
   if (!x5cN || x5cN.majorType !== 4 || !x5cN.children || !x5cN.children.length) throw _err("webauthn/bad-att-stmt", "x5c must be a non-empty array of certificates");
   return x5cN.children.map(function (c) {
     var der;
@@ -401,7 +396,7 @@ function _checkAaguidExt(cert, aaguid) { validator.attcert.aaguidExt(cert, aagui
 var VERIFIERS = {
   // packed (WebAuthn 8.2): the x5c arm (Basic/AttCA) or self-attestation.
   packed: function (att, clientDataHash) {
-    var isX5c = !!_mapGet(att.attStmt, "x5c");
+    var isX5c = !!cbor.read.mapGet(att.attStmt, "x5c");
     _requireAttShape(att.attStmt, isX5c ? ["alg", "sig", "x5c"] : ["alg", "sig"], isX5c ? ["alg", "sig", "x5c"] : ["alg", "sig"]);
     var alg = _algOf(att.attStmt), sig = _sigOf(att.attStmt);
     var message = Buffer.concat([att.authDataBytes, clientDataHash]);
@@ -483,7 +478,7 @@ var VERIFIERS = {
   // bind pubArea to the credential key, and verify sig over certInfo with the AIK.
   tpm: function (att, clientDataHash) {
     _requireAttShape(att.attStmt, ["ver", "alg", "sig", "certInfo", "pubArea", "x5c"], ["ver", "alg", "sig", "certInfo", "pubArea", "x5c"]);
-    var verN = _mapGet(att.attStmt, "ver");
+    var verN = cbor.read.mapGet(att.attStmt, "ver");
     if (!verN || verN.majorType !== 3 || cbor.read.textString(verN) !== "2.0") throw _err("webauthn/bad-att-stmt", "tpm attestation 'ver' MUST be \"2.0\" (WebAuthn 8.3)");
     var alg = _algOf(att.attStmt), sig = _sigOf(att.attStmt);
     var pubAreaBytes = _attRead(att.attStmt, "pubArea", cbor.read.byteString, "a byte string");
@@ -526,9 +521,9 @@ var VERIFIERS = {
   // an empty map; there is no statement to verify, so the result carries no trust
   // path. The credential public key still binds via authenticatorData (AT flag).
   none: function (att) {
-    // attStmt MUST BE an empty CBOR map -- reject a missing, non-map, or non-empty
-    // attStmt, not only a non-empty map (WebAuthn 8.7).
-    if (!att.attStmt || att.attStmt.majorType !== 5 || (att.attStmt.children && att.attStmt.children.length !== 0)) {
+    // parseAttestationObject has already established attStmt is a CBOR map; the none format
+    // additionally requires it be EMPTY -- there is no statement to verify (WebAuthn 8.7).
+    if (att.attStmt.children.length !== 0) {
       throw _err("webauthn/bad-att-stmt", "the none attestation statement MUST be an empty map (WebAuthn 8.7)");
     }
     return Promise.resolve(_result("none", "None", [], att));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.2.19",
+  "version": "0.2.20",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:d6e0649c-f4db-4241-8784-6f3c9d3d663f",
+  "serialNumber": "urn:uuid:2c42308d-4c79-437b-8bf2-36089abf8898",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-14T16:14:40.970Z",
+    "timestamp": "2026-07-15T22:55:37.673Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.2.19",
+      "bom-ref": "@blamejs/pki@0.2.20",
       "type": "application",
       "name": "pki",
-      "version": "0.2.19",
+      "version": "0.2.20",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.2.19",
+      "purl": "pkg:npm/%40blamejs/pki@0.2.20",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.2.19",
+      "ref": "@blamejs/pki@0.2.20",
       "dependsOn": []
     }
   ]