@blamejs/pki 0.4.15 → 0.5.1

package/lib/webcrypto.js

@@ -1097,7 +1097,17 @@ SubtleCrypto.prototype.importKey = async function importKey(format, keyData, alg
       var a2 = (name === "HMAC") ? { name: name, hash: _hashObj(alg.hash, "importKey jwk HMAC"), length: kbuf.length * 8 } : { name: name, length: kbuf.length * 8 };
       return new CryptoKey("secret", extractable, a2, usages, s2);
     }
-    var isPrivate = Object.prototype.hasOwnProperty.call(jwk, "d");
+    // The private half is named by the KEY TYPE, not by one spelling. EC and OKP carry it in `d`;
+    // an AKP JWK -- how ML-DSA, ML-KEM and SLH-DSA are represented -- carries it in `priv`.
+    // Testing `d` alone reads every PQC private JWK as public, so a re-import yields a public key
+    // that still announces `usages: ["sign"]` and forces `extractable` true whatever the caller
+    // asked, silently dropping the half that signs.
+    // `priv` is read ONLY for an AKP key, the type that defines it. RFC 7517 sec. 4 requires an
+    // unrecognized member to be ignored, so a member of that name on an EC or OKP JWK is an
+    // extension this implementation has no meaning for -- reading it as private material there
+    // would turn a valid public-key import into a failure.
+    var isPrivate = Object.prototype.hasOwnProperty.call(jwk, "d") ||
+      (jwk.kty === "AKP" && Object.prototype.hasOwnProperty.call(jwk, "priv"));
     var ko = _nodeKey(function () { return isPrivate ? nodeCrypto.createPrivateKey({ key: jwk, format: "jwk" }) : nodeCrypto.createPublicKey({ key: jwk, format: "jwk" }); }, "importKey jwk");
     return new CryptoKey(isPrivate ? "private" : "public", isPrivate ? extractable : true, _algFromImport(name, alg, ko), usages, ko);
   }
@@ -1187,6 +1197,17 @@ function _curveFromKey(ko) {
  * (either), or `raw` (symmetric, or an uncompressed EC / OKP public
  * point). Throws unless the key was created `extractable`.
  *
+ * `raw` is defined for public and secret keys only -- asking for it on a private
+ * key throws `webcrypto/not-supported` rather than answering with the public half.
+ * This matters through `wrapKey`, which forwards the caller's format here: wrapping
+ * a private key as `raw` would otherwise escrow the public key, and unwrapping it
+ * returns a handle announcing `usages: ["sign"]` that cannot sign, with the private
+ * key gone. Use `pkcs8` or `jwk` to serialize a private key.
+ *
+ * A private `jwk` round-trips as a private key for every algorithm, ML-DSA, ML-KEM
+ * and SLH-DSA included: those are `kty: "AKP"` and carry the private half in `priv`
+ * rather than the `d` an EC or OKP key uses.
+ *
  * @example
  *   var keyPair = await pki.webcrypto.subtle.generateKey({ name: "Ed25519" }, true, ["sign", "verify"]);
  *   var spki = await pki.webcrypto.subtle.exportKey("spki", keyPair.publicKey);
@@ -1206,7 +1227,19 @@ SubtleCrypto.prototype.exportKey = async function exportKey(format, key) {
   }
   if (format === "spki") return _toArrayBuffer(key._handle.export({ format: "der", type: "spki" }));
   if (format === "pkcs8") return _toArrayBuffer(key._handle.export({ format: "der", type: "pkcs8" }));
-  if (format === "raw") return _toArrayBuffer(_rawPublic(key));
+  if (format === "raw") {
+    // "raw" is defined for PUBLIC and secret keys; there is no raw private-key serialization for
+    // EC or OKP. Answering a private-key request with the public half hands back the opposite of
+    // what was asked for, with nothing to notice it by -- and `wrapKey` forwards the caller's
+    // format straight here, so a private key wrapped as "raw" escrows the PUBLIC key. Unwrapping
+    // that yields a handle announcing it can sign, which cannot, and the private key is gone.
+    if (key.type !== "public") {
+      throw new WebCryptoError("webcrypto/not-supported",
+        "exportKey: 'raw' is defined for public and secret keys only -- a " + key.type +
+        " key has no raw serialization; use 'pkcs8' or 'jwk'");
+    }
+    return _toArrayBuffer(_rawPublic(key));
+  }
   throw new WebCryptoError("webcrypto/not-supported", "exportKey: unsupported format " + JSON.stringify(format));
 };
 

package/lib/x509-sign.js

@@ -254,6 +254,9 @@ function _hasCriticalSan(extSpec) {
  *   - `pss` (boolean) -- sign an RSA key with RSASSA-PSS rather than PKCS#1 v1.5.
  *   - `digestAlgorithm` (string) -- override the message digest where the algorithm permits a choice.
  * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var signerSpki = await pki.key.export(pair.publicKey);
+ *   var signerKeyPkcs8 = await pki.key.export(pair.privateKey);
  *   var root = await pki.x509.sign(
  *     { subject: "Example Root CA", subjectPublicKey: signerSpki,
  *       notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.4.15",
+  "version": "0.5.1",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:7595bce4-18d5-4ef0-a2a1-6be18d59782d",
+  "serialNumber": "urn:uuid:350d591c-d7d9-431c-8902-3859e2fdad78",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-11T01:35:46.496Z",
+    "timestamp": "2026-08-12T22:09:02.062Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.4.15",
+      "bom-ref": "@blamejs/pki@0.5.1",
       "type": "application",
       "name": "pki",
-      "version": "0.4.15",
+      "version": "0.5.1",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.4.15",
+      "purl": "pkg:npm/%40blamejs/pki@0.5.1",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.4.15",
+      "ref": "@blamejs/pki@0.5.1",
       "dependsOn": []
     }
   ]