@blamejs/pki 0.2.30 → 0.2.31

package/CHANGELOG.md

@@ -4,6 +4,19 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.2.31 — 2026-07-16
+
+X.509 certificates now decode the RFC 3739 / ETSI EN 319 412-5 qualified-certificate qcStatements extension, and the sigstore verifier gains a low-order EdDSA public-key gate.
+
+### Added
+
+- The toolkit decodes the RFC 3739 sec. 3.2.6 / ETSI EN 319 412-5 qualified-certificate qcStatements extension (id-pe-qcStatements). The decoded statements -- QcCompliance (EU-qualified), QcLimitValue (reliance limit), QcSSCD (key in a QSCD), QcType (certificate purpose: esign / eseal / web), QcRetentionPeriod, QcPDS (disclosure-statement URLs), QcCClegislation (country of qualification), QcIdentMethod, QcQSCDlegislation, and the PKIX SemanticsInformation -- are decoded and validated by the toolkit's certificate-extension decoders and rendered by pki.inspect. An unknown statementId is preserved opaque (its raw bytes, semantics not executed); a malformed shape fails closed with a typed error.
+
+### Security
+
+- The sigstore keyless-bundle verifier now routes an Ed25519/Ed448 Fulcio leaf or Rekor log public key through the shared full-order Edwards-point gate before verification. A low-order OKP key (which node imports without complaint and which can verify a forged EdDSA signature) is rejected at key-parse (sigstore/bad-key) instead of being handed to verify -- the same defense the webauthn and certification-path EdDSA verifiers already apply.
+- Certification-path validation rejects a CRITICAL qcStatements extension (RFC 5280 sec. 6.1.4). A critical qualified-certificate statement asserts semantics a relying party must enforce -- a QcLimitValue reliance limit, a QcType certificate purpose -- and the validator does not enforce them, so treating the extension as processed would let a caller rely on a certificate outside its asserted qualified-certificate constraints; it is left unprocessed and fails as an unrecognized critical extension. A non-critical qcStatements is informational and does not affect the verdict; the extension is still decoded for pki.inspect and lint, and the linter flags a critical qcStatements as an unrecognized critical extension for the same reason -- structural decodability is not validation processing.
+
 ## v0.2.30 — 2026-07-16
 
 C509 CBOR-encoded certificates arrive as pki.schema.c509.parse: decode the compact CBOR profile of X.509 in both its natively-signed and X.509-re-encoded forms, reconstructing the original DER byte-for-byte so the original signature still verifies.

package/README.md

@@ -203,7 +203,7 @@ is callable today; nothing below is a stub.
 | `pki.oid` | Two-way OID ↔ name registry — `name`, `byName`, `register`, `toArcs`/`fromArcs`, `toDER`/`fromDER`; seeded with RFC 5280 + NIST PQC arcs |
 | `pki.webcrypto` | A W3C WebCrypto (`SubtleCrypto`) engine over `node:crypto` — `sign`/`verify`/`encrypt`/`decrypt`/`deriveBits`/`digest`/`generateKey`/`importKey`/`exportKey` across RSA, ECDSA, ECDH, Ed25519/Ed448, AES, HMAC, HKDF, PBKDF2, SHA — **and** post-quantum ML-DSA-44/65/87 and SLH-DSA signatures, plus ML-KEM-512/768/1024 key generation and certificate/PKCS#8 import — the RFC 9935 seed / expandedKey / both private-key CHOICE is validated fail-closed, so an OpenSSL-legacy bare-seed or an internally inconsistent key is rejected with a typed error (KEM encapsulation lands with CMS KEM-decrypt). Zero-dependency, OpenSSL-interoperable |
 | `pki.schema` | The schema family — `parse` detects which PKI format DER / PEM encodes and routes to the right parser, `all` enumerates the registered formats, and the engine + per-format members are grouped here |
-| `pki.schema.x509` | Parse DER / PEM certificates into structured, validated fields — `parse`, `pemDecode`, `pemEncode` |
+| `pki.schema.x509` | Parse DER / PEM certificates into structured, validated fields, with named + partly-decoded extensions — including the RFC 3739 / ETSI EN 319 412-5 qualified-certificate `qcStatements` (EU-qualified declaration, reliance limit, QSCD flag, certificate type, retention, PDS URLs, country of qualification; unknown statements preserved opaque), fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.c509` | Parse C509 CBOR-encoded certificates (draft-ietf-cose-cbor-encoded-cert) — the compact CBOR profile of X.509, decoded fail-closed under deterministic CBOR; an explicit `parse` call (CBOR, not DER, so not auto-routed) |
 | `pki.schema.crl` | Parse DER / PEM X.509 CRLs per RFC 5280 §5 — revoked serials with real-`Date` revocation times, named + partly-decoded extensions, fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.csr` | Parse DER / PEM PKCS#10 certification requests per RFC 2986 — subject DN, public key, requested attributes, signature, fail-closed — `parse`, `pemDecode`, `pemEncode` |

package/lib/inspect.js

@@ -317,6 +317,24 @@ var EXT_RENDERERS = {
     if (decoded.pathLenConstraint != null) s += ", pathlen:" + decoded.pathLenConstraint;
     return inner + s;
   },
+  qcStatements: function (decoded, inner) {
+    return decoded.map(function (s) {
+      var label = inner + (s.name || s.statementId), info = s.info;
+      if (!info) return label;                                                              // presence-only (QcCompliance / QcSSCD)
+      if (info.opaque) return label + " (opaque)";
+      if (typeof info.amount !== "undefined") return label + ": " + info.amount + " " + info.currency + (info.exponent ? " x10^" + info.exponent : "");   // QcLimitValue
+      if (typeof info.years !== "undefined") return label + ": " + info.years + " years";   // QcRetentionPeriod
+      if (info.typeNames) return label + ": " + info.typeNames.map(function (n, i) { return n || info.types[i]; }).join(", ");         // QcType
+      if (info.methodNames) return label + ": " + info.methodNames.map(function (n, i) { return n || info.methods[i]; }).join(", ");   // QcIdentMethod
+      if (info.locations) return label + ": " + info.locations.map(function (l) { return l.url + " (" + l.language + ")"; }).join(", "); // QcPDS
+      if (info.countries) return label + ": " + info.countries.join(", ");                  // QcCClegislation / QcQSCDlegislation
+      if (typeof info.semanticsIdentifier !== "undefined") {                                // SemanticsInformation (id-qcs)
+        var nra = info.nameRegistrationAuthorities && info.nameRegistrationAuthorities.length;
+        return label + (info.semanticsIdentifier ? ": " + info.semanticsIdentifier : "") + (nra ? " (" + nra + " NRA)" : "");
+      }
+      return label;
+    }).join("\n");
+  },
   subjectAltName: _renderAltName,
   issuerAltName: _renderAltName,
   certificatePolicies: function (decoded, inner) {

package/lib/lint.js

@@ -244,7 +244,17 @@ function _subjectCNs(cert) {
 // policyMappings, which the table decodes) and correctly scoped to EXTENSION OIDs: an
 // algorithm / EKU-purpose OID the name registry happens to resolve is NOT in the decoder
 // table, so a critical extension carrying such an OID is still flagged.
-function _isUnknownExtension(extOid) { return !EXT_DECODERS[extOid]; }
+//
+// The one exception: an extension the table DECODES for display but whose CRITICAL semantics
+// the toolkit does not enforce. qcStatements decodes (for pki.inspect / this linter) yet a
+// critical instance asserts qualified-certificate constraints (a reliance limit, a certificate
+// purpose) no consumer here processes -- path-validate rejects a critical qcStatements as
+// unrecognized-critical for exactly that reason. Structural decodability is not validation
+// processing, so a critical qcStatements is still flagged here, keeping lint consistent with
+// certification-path validation.
+var _DECODE_ONLY_UNPROCESSED_CRITICAL = {};
+_DECODE_ONLY_UNPROCESSED_CRITICAL[oid.byName("qcStatements")] = true;
+function _isUnknownExtension(extOid) { return !EXT_DECODERS[extOid] || _DECODE_ONLY_UNPROCESSED_CRITICAL[extOid] === true; }
 
 // RSA-modulus / EC-curve helpers for the weak-key lint. Each returns null when the key
 // material cannot be read as expected (a malformed RSA modulus, or EC parameters that are

package/lib/oid.js

@@ -80,7 +80,20 @@ var FAMILIES = {
   // aaControls sec. 7.4, ac-proxying sec. 7.2).
   pkixAccess: { base: [1, 3, 6, 1, 5, 5, 7, 1], of: {
     authorityInfoAccess: 1, acAuditIdentity: 4, aaControls: 6, acProxying: 10,
-    acmeIdentifier: 31 } },
+    acmeIdentifier: 31,
+    // id-pe-qcStatements (RFC 3739 sec. 3.2.6) -- the qualified-certificate-statements extension.
+    qcStatements: 3 } },
+
+  // RFC 3739 sec. 3.2.6.1 id-qcs -- the PKIX QCStatement statementIds carrying SemanticsInformation.
+  pkixQcSyntax: { base: [1, 3, 6, 1, 5, 5, 7, 11], of: { qcsPkixQCSyntaxV1: 1, qcsPkixQCSyntaxV2: 2 } },
+
+  // ETSI EN 319 412-5 qualified-certificate statements (esi4-qcStatement-N) on the id-etsi-qcs arc.
+  etsiQcs: { base: [0, 4, 0, 1862, 1], of: {
+    qcCompliance: 1, qcLimitValue: 2, qcRetentionPeriod: 3, qcSSCD: 4, qcPDS: 5,
+    qcType: 6, qcCClegislation: 7, qcIdentMethod: 8, qcQSCDlegislation: 9 } },
+
+  // ETSI EN 319 412-5 QcType member OIDs (the certificate-purpose types) on the id-etsi-qct arc.
+  etsiQcType: { base: [0, 4, 0, 1862, 1, 6], of: { qctEsign: 1, qctEseal: 2, qctWeb: 3 } },
 
   // id-aca -- RFC 5755 attribute-certificate attribute types on the id-pkix 10 arc:
   // authenticationInfo sec. 4.4.1 .. group sec. 4.4.4, plus encAttrs sec. 7.1 (the encrypted-

package/lib/path-validate.js

@@ -91,6 +91,12 @@ var PROCESSED_EXTENSIONS = {};
 // validateCriticalExtensionStructure via the registered decoder. freshestCRL
 // stays OUT: sec. 4.2.1.15 requires it non-critical and the validator does not
 // consult it (no delta merge), so a critical instance fails unrecognized.
+// qcStatements is deliberately NOT processed: a critical QC statement (QcLimitValue reliance limit,
+// QcType certificate purpose) asserts qualified-certificate semantics a relying party MUST enforce, and
+// this validator does not enforce them (nor expose a handler to). Marking it processed would let a caller
+// treat a certificate as valid outside its asserted critical QC constraints, so a critical qcStatements
+// fails as an unrecognized-critical extension (RFC 5280 sec. 6.1.4); a non-critical instance is
+// informational and does not affect the verdict. The extension is still decoded for pki.inspect / lint.
 [OID.basicConstraints, OID.keyUsage, OID.nameConstraints, OID.certificatePolicies,
  OID.policyMappings, OID.policyConstraints, OID.inhibitAnyPolicy, OID.subjectAltName,
  OID.extKeyUsage, OID.cRLDistributionPoints].

package/lib/schema-pkix.js

@@ -571,7 +571,10 @@ function distributionPointName(ns, node, code) {
 // inside. Each decoder takes that raw Buffer and returns the decoded value, or
 // throws a typed `<prefix>/bad-*` code, mirroring the CRL's fail-closed
 // `decodeExt` pattern (asn1.decode -> read.* / schema.walk, wrapped). Returns
-// { byOid } keyed by dotted OID so a consumer dispatches by ext.oid.
+// { byOid } keyed by dotted OID so a consumer dispatches by ext.oid. The decoded
+// set spans the RFC 5280 sec. 4.2.1 extensions plus the RFC 3739 sec. 3.2.6 /
+// ETSI EN 319 412-5 qualified-certificate `qcStatements` extension (each known
+// statement decoded, an unknown statementId preserved opaque).
 var _T = asn1.TAGS;
 
 // assertPolicyQualifiers(qNode, fail) -- RFC 5280 sec. 4.2.1.4: a PolicyInformation's
@@ -916,7 +919,120 @@ function certExtensionDecoders(ns) {
     if (typeof d !== "string") throw new TypeError("certExtensionDecoders: " + JSON.stringify(nm) + " is not a registered OID name");
     return d;
   }
+  // qcStatements ::= SEQUENCE OF QCStatement (RFC 3739 sec. 3.2.6). QCStatement ::= SEQUENCE {
+  // statementId OBJECT IDENTIFIER, statementInfo ANY DEFINED BY statementId OPTIONAL }. Known statementIds
+  // (RFC 3739 id-qcs + the ETSI EN 319 412-5 esi4 catalog) decode their statementInfo; an unknown statementId
+  // is preserved OPAQUE (the RFC 3739 open type), never rejected. The DEFINED-BY selection is an OID re-dispatch.
+  function _qcStr(node, tag, C, what) {
+    if (!node || node.tagClass !== "universal" || node.tagNumber !== tag) throw ns.E(C, what);
+    try { return asn1.read.string(node); } catch (e) { throw ns.E(C, what, e); }
+  }
+  function _qcOidSeq(node, C, what) {   // a non-empty SEQUENCE OF OBJECT IDENTIFIER
+    if (!node || node.tagClass !== "universal" || node.tagNumber !== _T.SEQUENCE || !node.children || !node.children.length) throw ns.E(C, what + " must be a non-empty SEQUENCE OF OBJECT IDENTIFIER");
+    return node.children.map(function (c) {
+      if (c.tagClass !== "universal" || c.tagNumber !== _T.OBJECT_IDENTIFIER) throw ns.E(C, what + " members must be OBJECT IDENTIFIERs");
+      try { return asn1.read.oid(c); } catch (e) { throw ns.E(C, what + " member is not a valid OID", e); }
+    });
+  }
+  function _qcPresenceOnly(nm) { return function (node, C) { if (node) throw ns.E(C, nm + " carries no statementInfo (ETSI EN 319 412-5)"); return null; }; }
+  function _qcSemantics(node, C) {   // SemanticsInformation, WITH COMPONENTS at least one field present
+    if (node === null) return null;   // statementInfo OPTIONAL for id-qcs syntax statements
+    if (node.tagClass !== "universal" || node.tagNumber !== _T.SEQUENCE || !node.children || !node.children.length) throw ns.E(C, "SemanticsInformation must be a SEQUENCE with at least one field (RFC 3739 sec. 3.2.6.1)");
+    var sid = null, i = 0;
+    if (node.children[0].tagClass === "universal" && node.children[0].tagNumber === _T.OBJECT_IDENTIFIER) {
+      try { sid = asn1.read.oid(node.children[0]); } catch (e) { throw ns.E(C, "SemanticsInformation semanticsIdentifier must be an OID", e); }
+      i++;
+    }
+    var nras = [];
+    if (node.children[i]) {
+      // nameRegistrationAuthorities ::= SEQUENCE SIZE (1..MAX) OF GeneralName -- decode + fully validate
+      // each element through the shared GeneralName decoder (context tag [0]..[8] + per-alternative
+      // structure), rather than surfacing arbitrary bytes as a name-registration authority.
+      nras = schema.walk(generalNames(ns, { decodeValue: true, code: C }), node.children[i], ns).result.names;
+      i++;
+    }
+    if (i !== node.children.length) throw ns.E(C, "SemanticsInformation has unexpected trailing fields");
+    return { semanticsIdentifier: sid, nameRegistrationAuthorities: nras };
+  }
+  var qcInfoByOid = {};
+  qcInfoByOid[O("qcCompliance")] = _qcPresenceOnly("QcCompliance");
+  qcInfoByOid[O("qcSSCD")] = _qcPresenceOnly("QcSSCD");
+  qcInfoByOid[O("qcsPkixQCSyntaxV1")] = _qcSemantics;
+  qcInfoByOid[O("qcsPkixQCSyntaxV2")] = _qcSemantics;
+  qcInfoByOid[O("qcType")] = function (node, C) {
+    var oids = _qcOidSeq(node, C, "QcType");   // SIZE(1) in EN 319 412-5 V2.5.1; accept >=1 for legacy certs
+    return { types: oids, typeNames: oids.map(function (d) { return ns.oid.name(d) || null; }) };
+  };
+  qcInfoByOid[O("qcRetentionPeriod")] = function (node, C) {
+    if (!node) throw ns.E(C, "QcRetentionPeriod requires an INTEGER statementInfo");
+    return { years: guard.range.uint31(readInt(node, C, "QcRetentionPeriod"), ns.E, C, "QcRetentionPeriod (years)") };
+  };
+  qcInfoByOid[O("qcLimitValue")] = function (node, C) {   // MonetaryValue ::= SEQUENCE { currency, amount, exponent }
+    if (!node || node.tagClass !== "universal" || node.tagNumber !== _T.SEQUENCE || !node.children || node.children.length !== 3) throw ns.E(C, "QcLimitValue must be a MonetaryValue SEQUENCE { currency, amount, exponent }");
+    var cur = node.children[0], currency;
+    if (cur.tagClass === "universal" && cur.tagNumber === _T.PRINTABLE_STRING) {
+      // Route through _qcStr so a disallowed PrintableString byte surfaces the decoder's typed
+      // bad-qc-statement error, not a leaked asn1/bad-printable-string from the raw leaf read.
+      currency = _qcStr(cur, _T.PRINTABLE_STRING, C, "QcLimitValue alphabetic currency must be a PrintableString");
+      if (currency.length !== 3) throw ns.E(C, "QcLimitValue alphabetic currency must be a 3-letter ISO 4217 code");
+    } else if (cur.tagClass === "universal" && cur.tagNumber === _T.INTEGER) {
+      currency = guard.range.int(readInt(cur, C, "QcLimitValue numeric currency"), 1n, 999n, ns.E, C, "QcLimitValue numeric currency (ISO 4217, 1..999)");
+    } else throw ns.E(C, "QcLimitValue currency must be a PrintableString(3) or INTEGER(1..999)");
+    return {
+      currency: currency,
+      // MonetaryValue amount and exponent are unconstrained INTEGERs (the amount non-negative in practice);
+      // bound each only to the safe-integer range so it narrows to a Number losslessly -- an artificial
+      // tighter bound (uint31, or a small exponent window) would false-reject a valid MonetaryValue, and a
+      // wider one would round silently and mis-state the limit.
+      amount: guard.range.int(readInt(node.children[1], C, "QcLimitValue amount"), 0n, 9007199254740991n, ns.E, C, "QcLimitValue amount"),
+      exponent: guard.range.int(readInt(node.children[2], C, "QcLimitValue exponent"), -9007199254740991n, 9007199254740991n, ns.E, C, "QcLimitValue exponent"),
+    };
+  };
+  qcInfoByOid[O("qcCClegislation")] = function (node, C) {   // SEQUENCE OF CountryName (PrintableString SIZE 2)
+    if (!node || node.tagClass !== "universal" || node.tagNumber !== _T.SEQUENCE || !node.children || !node.children.length) throw ns.E(C, "QcCClegislation must be a non-empty SEQUENCE OF CountryName");
+    return { countries: node.children.map(function (c) { var v = _qcStr(c, _T.PRINTABLE_STRING, C, "QcCClegislation CountryName must be a PrintableString"); if (v.length !== 2) throw ns.E(C, "QcCClegislation CountryName must be a 2-letter ISO 3166-1 code"); return v; }) };
+  };
+  qcInfoByOid[O("qcPDS")] = function (node, C) {   // PdsLocations ::= SEQUENCE OF PdsLocation { url IA5, language Printable(2) }
+    if (!node || node.tagClass !== "universal" || node.tagNumber !== _T.SEQUENCE || !node.children || !node.children.length) throw ns.E(C, "QcPDS must be a non-empty SEQUENCE OF PdsLocation");
+    return { locations: node.children.map(function (loc) {
+      if (loc.tagClass !== "universal" || loc.tagNumber !== _T.SEQUENCE || !loc.children || loc.children.length !== 2) throw ns.E(C, "a QcPDS PdsLocation must be a SEQUENCE { url, language }");
+      var lang = _qcStr(loc.children[1], _T.PRINTABLE_STRING, C, "a QcPDS language must be a PrintableString");
+      if (lang.length !== 2) throw ns.E(C, "a QcPDS language must be a 2-letter ISO 639-1 code");
+      return { url: _qcStr(loc.children[0], _T.IA5_STRING, C, "a QcPDS url must be an IA5String"), language: lang };
+    }) };
+  };
+  // ETSI EN 319 412-5 V2.5.1 additions: QcIdentMethod (SEQUENCE OF OID, like QcType) and
+  // QcQSCDlegislation (SEQUENCE OF CountryName, like QcCClegislation) -- registered ids, decoded.
+  qcInfoByOid[O("qcIdentMethod")] = function (node, C) {
+    var oids = _qcOidSeq(node, C, "QcIdentMethod");
+    return { methods: oids, methodNames: oids.map(function (d) { return ns.oid.name(d) || null; }) };
+  };
+  qcInfoByOid[O("qcQSCDlegislation")] = function (node, C) {
+    if (!node || node.tagClass !== "universal" || node.tagNumber !== _T.SEQUENCE || !node.children || !node.children.length) throw ns.E(C, "QcQSCDlegislation must be a non-empty SEQUENCE OF CountryName");
+    return { countries: node.children.map(function (c) { var v = _qcStr(c, _T.PRINTABLE_STRING, C, "QcQSCDlegislation CountryName must be a PrintableString"); if (v.length !== 2) throw ns.E(C, "QcQSCDlegislation CountryName must be a 2-letter ISO 3166-1 code"); return v; }) };
+  };
+  function qcStatements(buf) {
+    var C = ns.prefix + "/bad-qc-statements", CS = ns.prefix + "/bad-qc-statement";
+    var kids = seqChildren(buf, C, "QCStatements");
+    if (!kids.length) throw ns.E(C, "QCStatements must contain at least one QCStatement (RFC 3739 sec. 3.2.6)");
+    var out = [];   // QCStatements ::= SEQUENCE OF QCStatement -- RFC 3739 imposes no statementId uniqueness; decode every statement in wire order (a linter may flag a repeat, the decoder must not drop it)
+    for (var i = 0; i < kids.length; i++) {
+      var st = kids[i];
+      if (st.tagClass !== "universal" || st.tagNumber !== _T.SEQUENCE || !st.children || st.children.length < 1 || st.children.length > 2) {
+        throw ns.E(CS, "each QCStatement must be a SEQUENCE of a statementId and an OPTIONAL statementInfo");
+      }
+      var id;
+      try { id = asn1.read.oid(st.children[0]); } catch (e) { throw ns.E(CS, "a QCStatement statementId must be an OBJECT IDENTIFIER", e); }
+      var infoNode = st.children.length === 2 ? st.children[1] : null;
+      var decoder = qcInfoByOid[id];
+      var info = decoder ? decoder(infoNode, CS) : { opaque: true, bytes: infoNode ? infoNode.bytes : null };
+      out.push({ statementId: id, name: ns.oid.name(id) || null, info: info });
+    }
+    return out;
+  }
+
   var byOid = {};
+  byOid[O("qcStatements")] = qcStatements;
   byOid[O("basicConstraints")] = basicConstraints;
   byOid[O("keyUsage")] = keyUsage;
   byOid[O("nameConstraints")] = nameConstraints;

package/lib/sigstore.js

@@ -33,6 +33,7 @@ var x509 = require("./schema-x509");
 var pathValidate = require("./path-validate");
 var merkle = require("./merkle");
 var oid = require("./oid");
+var edwardsPoint = require("./edwards-point");
 
 var C = constants;
 var SigstoreError = frameworkError.SigstoreError;
@@ -184,8 +185,18 @@ function _rawVerify(keyObj, data, derSig) {
   return nodeCrypto.verify(hash, data, { key: keyObj, dsaEncoding: "der" }, derSig);
 }
 function _pubFromSpki(spkiDer, label) {
-  try { return nodeCrypto.createPublicKey({ key: spkiDer, format: "der", type: "spki" }); }
+  var key;
+  try { key = nodeCrypto.createPublicKey({ key: spkiDer, format: "der", type: "spki" }); }
   catch (e) { throw _err("sigstore/bad-key", "invalid " + label + " public key", e); }
+  // node imports a low-order (e.g. all-zeroes) OKP public key without complaint, and such a key
+  // verifies a FORGED EdDSA signature -- route an Ed25519/Ed448 SPKI through the shared full-order,
+  // on-curve Edwards-point gate (as the webauthn and path-validation EdDSA paths already do) before it
+  // can be handed to verify.
+  var t = key.asymmetricKeyType;
+  if (t === "ed25519" || t === "ed448") {
+    edwardsPoint.validateSpki(spkiDer, t === "ed25519" ? 6 : 7, SigstoreError, "sigstore/bad-key");
+  }
+  return key;
 }
 // Parse a certificate, re-typing a malformed-DER fault to a sigstore/* error so
 // the caller never sees a raw certificate/* / asn1/* leak from this boundary.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.2.30",
+  "version": "0.2.31",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:fcac8430-97c8-4f4c-a497-dc2f02fb3c6f",
+  "serialNumber": "urn:uuid:c89087a8-9dba-4496-9704-cd639f3c4038",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-16T18:34:40.509Z",
+    "timestamp": "2026-07-16T21:10:43.618Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.2.30",
+      "bom-ref": "@blamejs/pki@0.2.31",
       "type": "application",
       "name": "pki",
-      "version": "0.2.30",
+      "version": "0.2.31",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.2.30",
+      "purl": "pkg:npm/%40blamejs/pki@0.2.31",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.2.30",
+      "ref": "@blamejs/pki@0.2.31",
       "dependsOn": []
     }
   ]