@blamejs/pki 0.5.39 → 0.6.0

package/CHANGELOG.md

@@ -4,7 +4,19 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## v0.5.39 — 2026-08-30
+## v0.6.0 — 2026-08-30
+
+The toolkit's public APIs graduate to stable, and pki.ocsp.verifyRequest verifies a signed OCSP request for responder implementers.
+
+### Added
+
+- pki.ocsp.verifyRequest(request, opts?) verifies a signed OCSP request (RFC 6960 sec. 4.1.1) for a responder implementer. It checks the requestor's signature over the exact tbsRequest under the public key of the requestor certificate embedded in the request, or supplied through opts.certs when the request carries none, using the same signature engine pki.ocsp.verify applies to a response. The verdict is { signed, signatureValid, signerCert, signerCerts, certs, signerSubject, requestorName, requestList, requestExtensions, version, reason }. Signing a request is optional under RFC 6960, so an unsigned request reports signed:false rather than an error, and signatureValid speaks only to the cryptographic check. Because the request's certificate field is unordered and a key may appear under an expired certificate beside its renewal, signerCerts lists every certificate whose key verified the signature, while certs is every parseable certificate the request carried, including intermediates that do not sign; the responder passes certs as the candidate pool to pki.path.build to discover and validate a trusted path to a signerCerts entry, confirms that certificate asserts digitalSignature keyUsage (RFC 5280 sec. 4.2.1.3, since it signed the request), then binds its subject to the identity expected, rather than depending on the position of the single signerCert.
+
+### Changed
+
+- The public APIs that previously carried an experimental status are now stable and covered by the stable-upgrade policy: a deprecation warning ships at least one minor release before any removal, and a minor release makes no silent breaking change. The graduation bar is a settled governing standard, a wire format proven correct, and a frozen public surface. Where a surface graduates without fully meeting that bar, the relaxation is named here. On interop: pki.tls certificate compression (RFC 8879), pki.ocsp.verifyRequest, and the CMC surface (pki.cmc and pki.schema.cmc, RFC 5272) have no independent implementation in the interop harness, so their own decoders are their only cross-check. On the shared network transport: the EST (pki.est), ACME (pki.acme), and networked CMP (pki.cmp) clients and pki.path.build's opt-in AIA fetching compose the shared node:https transport (pki.transport), whose fail-closed contract still gains requirements as each client composes it. On the governing standard: pki.schema.c509 tracks the draft-ietf-cose-cbor-encoded-cert Internet-Draft, Certificate Transparency tracks the Experimental RFC 6962 (the standardized CT v2 is RFC 9162), composite post-quantum signature support tracks the LAMPS composite-signature drafts, and Sigstore bundle verification tracks the evolving Sigstore bundle spec rather than a settled RFC. On surface stability: pki.lint ships a representative CA/Browser Forum Baseline Requirements subset that will gain rules over time, pki.webauthn.verifyAssertion's verdict shape is frozen as of this release and grows only additively, and pki.hpke wires the classical DHKEM modes with the post-quantum modes added later. In each case the public surface is stable, and any change a later standard revision, an added rule, or continued transport hardening requires is handled under the deprecation policy.
+
+## v0.5.39 — 2026-08-29
 
 pki.cmc.build and pki.cmp.build verify an embedded PKCS#10 request's proof-of-possession and refuse one whose self-signature does not verify.
 

package/README.md

@@ -192,10 +192,11 @@ var ok  = await subtle.verify({ name: "ML-DSA-65" }, kp.publicKey, sig, data); /
 
 ## What ships today
 
-Everything below is callable now; nothing is a stub. The core codec and the
-certificate-reading surface are stable under the deprecation policy; the rest
-carries a per-primitive `@status` on its wiki page, and
-[LTS-CALENDAR.md](LTS-CALENDAR.md) explains what experimental excludes. The
+Everything below is callable now; nothing is a stub. The whole documented
+surface is stable under the deprecation policy: a deprecation warning ships at
+least one minor release before any removal, and a minor release makes no silent
+breaking change. Each primitive's `@status` appears on its wiki page, and
+[LTS-CALENDAR.md](LTS-CALENDAR.md) explains the status lifecycle. The
 table is an index — the per-function reference, generated from the source
 comment blocks, is at [pkijs.com](https://pkijs.com).
 
@@ -240,7 +241,7 @@ comment blocks, is at [pkijs.com](https://pkijs.com).
 | `pki.cms` | CMS signing, verification, encryption, and compression (RFC 5652). `sign(content, signers, opts)` produces a SignedData (§5), attached or detached, with one or many signers over RSA, RSASSA-PSS, ECDSA, EdDSA, the post-quantum ML-DSA-44/65/87 (RFC 9882) and SLH-DSA (all twelve FIPS 205 sets, RFC 9814), and composite ML-DSA pairing ML-DSA with a traditional RSA, ECDSA, or EdDSA key (accepted only when both components verify, draft-ietf-lamps-cms-composite-sigs). It builds the signed attributes (content-type, message-digest, signing-time) as canonical DER, signs the exact §5.4 preimage, and emits a DER `Buffer` or PEM. The content may also be an async iterable of byte chunks, which signs a large detached payload without holding it in memory: the payload is hashed incrementally under every signer's digest algorithm in one pass, and `verify` accepts the same streamed form as its `content` option. A signer may also be key-only — `{ key, spki, keyIdentifier }` with no certificate — which RFC 5272 §3.2 requires when a Full PKI Request's signer is the key of a certification request that request carries: the signer identifier takes the subjectKeyIdentifier form carrying the identifier the request declares, the signature scheme resolves from the request's own public key, and no certificate is embedded. `verify(input, opts)` parses a SignedData over the strict `pki.schema.cms` codec, locates each SignerInfo's signer certificate by its issuerAndSerialNumber or subjectKeyIdentifier, and checks the signature over the exact §5.4 preimage: with signed attributes present it confirms the message-digest attribute equals the content digest and verifies over the DER re-encoding of the SignedAttributes (the on-wire `[0]` tag replaced by a universal SET OF), and otherwise directly over the content. It returns a per-signer verdict with the matched signer certificate. `valid` and `trusted` are separate claims and neither implies the other: a SignedData carries its own certificates, so `valid` says the signature is sound under one of them and nothing about who signed, while `trusted` says every signer chained to a root named in `opts.trustAnchors`, validated through the same RFC 5280 path engine `pki.path.validate` uses. Without anchors there is nothing to chain to and `trusted` is `false`; anchors that cannot be read throw, rather than reading as untrusted. An unrecognized option is refused rather than ignored. `countersign(cms, signers, opts)` adds a countersignature (§11.4) — a `SignerInfo` over the countersigned SignerInfo's signature value, any signer algorithm, nestable, with the primary bytes preserved so it still verifies — attached as the id-countersignature unsigned attribute; `verify` returns each countersignature's verdict under `signers[i].countersignatures` and every unsigned attribute — including an RFC 3161 timestamp token, attachable via `sign`'s `unsignedAttributes` — under `signers[i].unsignedAttrs`, surfaced unauthenticated. `encrypt(content, recipients, opts)` produces an EnvelopedData, AuthEnvelopedData (AES-GCM, the authenticated default), or EncryptedData, with recipients auto-dispatched off the certificate key to key transport (RSAES-OAEP; v1.5 is never emitted), key agreement (ephemeral-static ECDH over P-256/384/521 with the X9.63 KDF, and X25519/X448 with HKDF), symmetric key wrap, password (PBKDF2 with RFC 3211 PWRI-KEK), or the post-quantum ML-KEM KEMRecipientInfo (RFC 9629/9936), wrapping one fresh content key for every recipient. The content may also be an async iterable of byte chunks, streamed through the AES-GCM or AES-CBC content cipher so a large plaintext is encrypted without being buffered whole; the ciphertext is assembled before the definite-length encryptedContent is emitted, byte-for-byte the buffered form. `decrypt(input, keyMaterial, opts)` recovers the content through the matching arm and returns it with an `authenticated` flag; every secret-dependent failure collapses to one uniform `cms/decrypt-failed` verdict (Bleichenbacher, EFAIL, and password-oracle freedom), and PKCS#1 v1.5 is decrypt-only under the RFC 3218 implicit-rejection countermeasure. With `opts.stream: true` the recovered `content` is an async iterable of plaintext chunks instead of a single Buffer, for a payload too large to hold whole; the authenticated modes (AuthEnvelopedData, AuthenticatedData, AES-GCM) verify integrity before the iterable yields, so a forged message throws before any plaintext is exposed, while a CBC EnvelopedData or EncryptedData yields the plaintext as the cipher produces it. Every key-establishment secret the toolkit allocates is wiped once used, on the failing path as well as the succeeding one: the KEM shared secret and its derived key-encryption key, the raw ECDH / X25519 / X448 agreement secret, a password-derived key-encryption key, and the content-encryption key itself, cleared once the message is complete since all recipients share it. Caller-supplied key material is never written to (best-effort; NIST SP 800-227 §4.2, RFC 9629 §7). `authenticate(content, recipients, opts)` produces an `id-ct-authData` (§9): cleartext content plus an HMAC-SHA-256/384/512 MAC, authenticated but not encrypted, with the fresh MAC key wrapped for every recipient through the same RecipientInfo model. The MAC covers the authenticated attributes (content-type and message-digest) re-tagged to the EXPLICIT SET OF (§9.2), or the content octets directly; `decrypt` recovers the MAC key, recomputes the MAC and independently the message-digest (§9.3), and releases the content only after both pass, with every secret-dependent failure collapsing to the uniform `cms/decrypt-failed`. `compress(content, opts)` and `decompress(input, opts)` produce and consume a CompressedData (RFC 3274; ZLIB, version 0, id-alg-zlibCompress); decompress bounds the uncompressed output at 16 MiB and stops before it is materialized, so a decompression bomb fails closed as `cms/decompress-too-large`. Compression is a size transform with no integrity or confidentiality (RFC 8551 §2.4.5). Fail-closed with typed `cms/*` errors — `sign`, `verify`, `countersign`, `encrypt`, `authenticate`, `decrypt`, `compress`, `decompress` |
 | `pki.smime` | S/MIME message assembly, verification, encryption, and compression over the CMS layer (RFC 8551). `sign(content, signers, opts)` wraps a MIME entity in either form: `multipart/signed`, where the content stays readable in any MUA and a detached CMS SignedData rides alongside as `application/pkcs7-signature` with a matching `micalg`, or `application/pkcs7-mime; smime-type=signed-data`, where the whole entity is a base64 CMS SignedData. The signed bytes are the entity's §3.1.1 canonical form with CRLF line endings, and `verify(message, opts)` unwraps both forms and recomputes over the same canonicalizer, so a transport that re-wraps line endings still verifies while a tampered part fails. `encrypt(content, recipients, opts)` envelopes a MIME entity as an opaque `application/pkcs7-mime` message and `decrypt(message, keyMaterial, opts)` opens one, as `smime-type=authEnveloped-data` (AES-GCM, confidentiality and integrity, the default) or `smime-type=enveloped-data` (AES-CBC, confidentiality only, so `decrypt` reports `authenticated: false`, the §3.3 no-integrity caveat). The `smime-type` is derived from the CMS body rather than the header, and decryption is fail-closed and oracle-free. The crypto is entirely `pki.cms.sign` / `verify` / `encrypt` / `decrypt`, so it is algorithm-agnostic: any RSA / RSASSA-PSS / ECDSA / EdDSA / ML-DSA / SLH-DSA signer and any RSA-OAEP / ECDH / X25519 / X448 / AES-KW / PBKDF2 / ML-KEM recipient carries through. As with `cms.verify`, `verify` returns the per-signer verdict plus the recovered content, and `valid` and `trusted` are separate claims: `valid` says the signature is sound under a certificate the message carried, `trusted` says every signer chained to a root named in `opts.trustAnchors`. Anchoring here is validated for email at both ends of the chain — the signer certificate must carry `emailProtection` (RFC 8551 §4.4.4) and the anchor's own trust metadata must permit that purpose, since a root can be distrusted for email while remaining a good TLS root. Override either with `requiredEku` / `checkPurpose`. `compress(content, opts)` and `decompress(message, opts)` add the opaque `application/pkcs7-mime; smime-type=compressed-data; name=smime.p7z` frame (§3.6, RFC 3274), a size transform with no integrity or confidentiality (§2.4.5), bounded against a bomb; the recovered content, which may itself be signed or enveloped, is returned for the caller to re-verify. Header protection (RFC 9788): `sign` and `encrypt` take `opts.protectHeaders`, which inlines the caller's `opts.headers` on the Cryptographic Payload root (its Content-Type gaining `hp="clear"` when signed or `hp="cipher"` when encrypted) so the CMS signature or encryption covers them, defeating a transport that rewrites or reads Subject, From, and the rest. `verify` and `decrypt` surface the authenticated inner set as `protectedHeaders` plus `headerProtection { present, mode, fromMismatch, confidential, legacy }`, so a tampered outer header cannot alter it and `fromMismatch` flags an outer From that disagrees. Encryption applies a Header Confidentiality Policy: the default `hcp_baseline` obscures the outer Subject to `[...]` and removes Comments and Keywords, so the real values live only in the ciphertext, and `decrypt` recovers them. Every emitted header routes through a fail-closed injection guard that rejects a CR, LF, or NUL value and a non-ftext name, and a malformed or contradictory `hp` wrap fails closed as `smime/bad-header-protection` rather than silently downgrading. The CMS crypto is unchanged. Inbound legacy RFC 8551 header protection is recognized opt-in: `verify` and `decrypt` with `opts.legacyHeaderProtection` detect a legacy `message/rfc822`-wrapped payload by the RFC 9788 §4.10.1 four-condition identification and surface the inner headers under `headerProtection.legacy = { headers, mode, fromMismatch, confidential }`, where `headers` is an ordered `[{ name, value }]` array retaining legally repeated fields such as `Received`. Those never appear in `protectedHeaders` and never set `present: true`. Because a legacy message is structurally indistinguishable from an ordinary forwarded `message/rfc822`, this is an explicit heuristic (§4.10.2, "no strong end-to-end guarantees"): a caller keying trust off `present` or `protectedHeaders` is never misled, and only one that explicitly reads `headerProtection.legacy.headers` and cross-checks `legacy.fromMismatch` consumes it. It is off by default, and a nested crypto layer, an inner `hp=`, a non-`message/rfc822` payload, or a duplicate Content-Type reports `legacy: null`. Bidirectionally interoperable with `openssl smime` and `openssl cms`. Fail-closed with typed `smime/*` errors — `sign`, `verify`, `encrypt`, `decrypt`, `compress`, `decompress` |
 | `pki.tsp` | Time-Stamp Protocol (RFC 3161). `sign(messageImprint, tsa, opts)` produces a TimeStampToken: a CMS SignedData over `pki.cms.sign` whose content is a `TSTInfo` carrying the timestamped message imprint, the TSA policy, a serial number, and `genTime` with optional accuracy, nonce, and ordering, plus the §2.4.2 signing-certificate attribute binding the token to the TSA certificate (SHA-2 imprints, any `pki.cms.sign` TSA key). `request` and `parseRequest` build and parse the TimeStampReq a client sends (imprint, requested policy, nonce, certReq); `response` and `parseResponse` handle the TimeStampResp a TSA returns, either a granted status wrapping a token or a rejection with PKIStatus and failure info, with the §2.4.2 status-to-token coupling enforced in both directions. `verify(token, data, opts)` verifies a token fail-closed: the CMS signature over the exact signed bytes, the message imprint recomputed from the data, the TSTInfo content type, the ESSCertID(V2) binding to the TSA certificate, the §2.3 critical timeStamping-only extendedKeyUsage, the request nonce when used, and, with a trust anchor supplied, full certification-path validation of the TSA certificate at the token's `genTime` — judged under the `timeStamping` purpose, so an anchor's own per-purpose trust metadata reaches the decision rather than sitting inert. It returns `{ valid, trusted, genTime, serialNumber, tstInfo, ... }`, where `trusted` is the separate claim that the authority chained to an anchor you named: without one there is nothing to chain to and it is `false`, which is the distinction a timestamp re-read years later turns on — `sign`, `request`, `parseRequest`, `response`, `parseResponse`, `verify` |
-| `pki.ocsp` | Online Certificate Status Protocol (RFC 6960), both the responder and relying-party surface. `buildRequest(query, opts)` builds an OCSPRequest for one or more `{ cert, issuer }` pairs, with the CertID hashed under SHA-1 by default per the RFC 5019 lightweight profile or under SHA-2, plus an optional RFC 9654 nonce and an optional requestor signature. `sign(responseData, responder, opts)` produces a signed BasicOCSPResponse over the exact `ResponseData` DER, from the issuing CA directly or a delegated responder, under any `pki.cms.sign` key including the post-quantum ML-DSA and SLH-DSA sets, with `good`, `revoked` (reason and time), or `unknown` per-certificate status. `buildErrorResponse(status)` produces the unsigned §2.3 error (`tryLater`, `unauthorized`, and the rest). `verify(response, opts)` verifies a response fail-closed against the same hardened gates `pki.path.ocspChecker` runs: the CertID binding, responder authorization (the issuing CA, or a CA-issued delegate bearing id-kp-OCSPSigning and id-pkix-ocsp-nocheck and passing the full out-of-path certificate gates), the signature over `tbsResponseDataBytes`, currency against `thisUpdate` and `nextUpdate`, and the request-nonce echo. It returns `{ status: "good" / "revoked" / "unknown", ... }` and never silently accepts. Transport-free — `buildRequest`, `sign`, `buildErrorResponse`, `verify` |
+| `pki.ocsp` | Online Certificate Status Protocol (RFC 6960), both the responder and relying-party surface. `buildRequest(query, opts)` builds an OCSPRequest for one or more `{ cert, issuer }` pairs, with the CertID hashed under SHA-1 by default per the RFC 5019 lightweight profile or under SHA-2, plus an optional RFC 9654 nonce and an optional requestor signature. `sign(responseData, responder, opts)` produces a signed BasicOCSPResponse over the exact `ResponseData` DER, from the issuing CA directly or a delegated responder, under any `pki.cms.sign` key including the post-quantum ML-DSA and SLH-DSA sets, with `good`, `revoked` (reason and time), or `unknown` per-certificate status. `buildErrorResponse(status)` produces the unsigned §2.3 error (`tryLater`, `unauthorized`, and the rest). `verify(response, opts)` verifies a response fail-closed against the same hardened gates `pki.path.ocspChecker` runs: the CertID binding, responder authorization (the issuing CA, or a CA-issued delegate bearing id-kp-OCSPSigning and id-pkix-ocsp-nocheck and passing the full out-of-path certificate gates), the signature over `tbsResponseDataBytes`, currency against `thisUpdate` and `nextUpdate`, and the request-nonce echo. It returns `{ status: "good" / "revoked" / "unknown", ... }` and never silently accepts. `verifyRequest(request, opts)` is the responder-side inverse of `buildRequest`: it verifies a client's signed request (RFC 6960 §4.1.1) under the requestor certificate the request carries, trying each embedded certificate since the field is unordered, and reports `signed`, `signatureValid`, every certificate whose key verified (`signerCerts`, so a key carried under an expired certificate beside its renewal is not hidden behind ordering) with the first one's decoded subject, the full embedded certificate bag (`certs`, including intermediates for path building), and the request's CertIDs; an unsigned request is reported with `signed: false` rather than refused. Transport-free — `buildRequest`, `sign`, `buildErrorResponse`, `verify`, `verifyRequest` |
 | `pki.ct` | Certificate Transparency (RFC 6962). `parseSctList` decodes the `SignedCertificateTimestampList` a certificate or OCSP response carries, a TLS-presentation-language payload inside the §3.3 double DER wrap, into per-SCT log id, exact `timestamp` (BigInt), named signature algorithm, and raw signature. `reconstructSignedData` rebuilds the exact `digitally-signed` preimage, and `verifySct` verifies an SCT signature against a log's public key, routing an ECDSA signature through the strict DER-conformance gate and verifying through the crypto engine, resolving true or false and throwing a typed error on a structural fault. On the producing side, `encodeSctList` builds the extension value byte for byte as the exact inverse of `parseSctList`, and `signSct` performs a log's signing step. For trust, `parseLogList` ingests the CT log-list JSON into constraint-carrying trusted logs, recomputing each log's id as SHA-256 of its key and refusing a disagreeing id (a swapped key, §3.2) and decoding the state and temporal-interval constraints; `verifySctWithLogList` resolves the log key from an SCT's log id, enforces the state (usable, qualified, and readonly trusted; retired only before retirement; pending and rejected refused) and the temporal-interval window, then delegates the signature check to `verifySct`. `verifyLogListSignature(json, signature, publicKey)` verifies the detached `log_list.sig` over the raw log-list bytes against a caller-pinned signer key (RSASSA-PKCS1-v1.5/SHA-256 and an EC P-256 arm, with forgeable-key defenses failing closed), cross-checked against `openssl dgst`. `fetchLogList(opts)` turns that chain into a live client: it GETs the `log_list.json` and its detached `log_list.sig` over `pki.transport`, verifies the detached signature over the raw fetched bytes against a caller-pinned distributor key before parsing, so an unverified document is never parsed, read, cached, or surfaced, then ingests the same bytes through `parseLogList` and returns the trusted-log set plus the surfaced `version` and `timestamp`. The toolkit bakes in no vendor URL or key, TLS trust is explicit with `rejectUnauthorized` always on, each response is size-capped before the trust chain, and the transport is injectable so the whole path is testable offline — `parseSctList`, `reconstructSignedData`, `verifySct`, `encodeSctList`, `signSct`, `parseLogList`, `verifySctWithLogList`, `verifyLogListSignature`, `fetchLogList` |
 | `pki.merkle` | Merkle-tree proof verification (RFC 6962 / RFC 9162). `leafHash`, `nodeHash`, and `emptyRootHash` build the domain-separated (0x00 leaf, 0x01 node) SHA-256 tree hashes. `verifyInclusion` folds an audit proof back to a root, and `verifyConsistency` reconstructs both the old and new root, which is the append-only guarantee; each is constant-time-compared to a trusted checkpoint root. Fail-closed on bad geometry, sync hashing, transport-free — `leafHash`, `nodeHash`, `emptyRootHash`, `verifyInclusion`, `verifyConsistency` |
 | `pki.trust` | Mozilla and CCADB trust-store ingestion. `parseCertdata` reads the NSS `certdata.txt` object stream and `parseCcadbCsv` the CCADB CSV export, both into one constraint-carrying anchor shape: the per-purpose trust bits, where only `CKT_NSS_TRUSTED_DELEGATOR` grants, and the per-purpose distrust-after dates the bare root list omits. Certificate and trust objects pair by byte-exact issuer and serial rather than adjacency and are cross-checked against the parsed DER, so metadata cannot attach to the wrong root. `anchor()` hands an entry to `pki.path.validate({ trustAnchor, checkPurpose })`. Offline, fail-closed, bounded — `parseCertdata`, `parseCcadbCsv`, `anchor` |

package/lib/acme.js

@@ -502,7 +502,7 @@ var TRANSITIONS = {
  * @primitive  pki.acme.assertTransition
  * @signature  pki.acme.assertTransition(kind, from, to) -> void
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 8555
  * @related    pki.acme.validate
  *
@@ -534,7 +534,7 @@ var ERROR_NAMESPACE = "urn:ietf:params:acme:error:";
  * @primitive  pki.acme.validateProblem
  * @signature  pki.acme.validateProblem(obj) -> obj
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 8555, RFC 7807, RFC 9773
  * @related    pki.acme.validate
  *
@@ -571,7 +571,7 @@ function validateProblem(obj) {
  * @primitive  pki.acme.validate
  * @signature  pki.acme.validate(kind, obj) -> obj
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 8555, RFC 9773
  * @related    pki.acme.identify, pki.acme.validateProblem
  *
@@ -603,7 +603,7 @@ function validate(kind, obj) {
  * @primitive  pki.acme.identify
  * @signature  pki.acme.identify(obj) -> string
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 8555, RFC 9773
  * @related    pki.acme.validate
  *
@@ -648,7 +648,7 @@ async function _sha256(bytes) { return Buffer.from(await subtle.digest("SHA-256"
  * @primitive  pki.acme.keyAuthorization
  * @signature  pki.acme.keyAuthorization(token, accountJwk) -> Promise<string>
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 8555, RFC 7638
  * @related    pki.acme.http01, pki.acme.dns01, pki.acme.tlsAlpn01Extension
  *
@@ -673,7 +673,7 @@ async function keyAuthorization(token, accountJwk) {
  * @primitive  pki.acme.http01
  * @signature  pki.acme.http01(token, accountJwk) -> Promise<{ path, body }>
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 8555
  * @related    pki.acme.keyAuthorization
  *
@@ -697,7 +697,7 @@ async function http01(token, accountJwk) {
  * @primitive  pki.acme.dns01
  * @signature  pki.acme.dns01(token, accountJwk, domain) -> Promise<{ name, value }>
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 8555
  * @related    pki.acme.keyAuthorization
  *
@@ -732,7 +732,7 @@ var _extCtx = { E: function (c, m, cause) { return new AcmeError(c, m, cause); }
  * @primitive  pki.acme.tlsAlpn01Extension
  * @signature  pki.acme.tlsAlpn01Extension(token, accountJwk) -> Promise<Buffer>
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 8737
  * @related    pki.acme.verifyTlsAlpn01
  *
@@ -768,7 +768,7 @@ function _readAcmeIdentifier(extnValue) {
  * @primitive  pki.acme.verifyTlsAlpn01
  * @signature  pki.acme.verifyTlsAlpn01(certDer, token, accountJwk, identifier) -> Promise<void>
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 8737, RFC 8738
  * @related    pki.acme.tlsAlpn01Extension
  *
@@ -868,7 +868,7 @@ function _signOuter(o, payloadObj) {
  * @primitive  pki.acme.postAsGet
  * @signature  pki.acme.postAsGet(opts) -> Promise<object>
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 8555
  * @related    pki.acme.newOrder
  *
@@ -912,7 +912,7 @@ function _assertContacts(contacts) {
  * @primitive  pki.acme.newAccount
  * @signature  pki.acme.newAccount(opts) -> Promise<object>
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 8555
  * @related    pki.acme.externalAccountBinding
  *
@@ -955,7 +955,7 @@ var _HMAC_HASH = { HS256: "SHA-256", HS384: "SHA-384", HS512: "SHA-512" };
  * @primitive  pki.acme.externalAccountBinding
  * @signature  pki.acme.externalAccountBinding(opts) -> Promise<object>
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 8555
  * @related    pki.acme.newAccount
  *
@@ -1019,7 +1019,7 @@ function _validateOrderIdentifier(id) {
  * @primitive  pki.acme.newOrder
  * @signature  pki.acme.newOrder(opts) -> Promise<object>
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 8555, RFC 9773
  * @related    pki.acme.finalize, pki.acme.ariCertId
  *
@@ -1049,7 +1049,7 @@ function newOrder(o) {
  * @primitive  pki.acme.newAuthz
  * @signature  pki.acme.newAuthz(opts) -> flattened JWS
  * @since      0.3.29
- * @status     experimental
+ * @status     stable
  * @spec       RFC 8555, RFC 8555 sec. 7.4.1
  * @related    pki.acme.newOrder, pki.acme.client
  *
@@ -1288,7 +1288,7 @@ function _assertCsrIdentifiers(parsedCsr, identifiers) {
  * @primitive  pki.acme.finalize
  * @signature  pki.acme.finalize(opts) -> Promise<object>
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 8555
  * @related    pki.acme.newOrder
  *
@@ -1326,7 +1326,7 @@ async function finalize(o) {
  * @primitive  pki.acme.challengeResponse
  * @signature  pki.acme.challengeResponse(opts) -> Promise<object>
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 8555
  * @related    pki.acme.http01, pki.acme.dns01
  *
@@ -1356,7 +1356,7 @@ function challengeResponse(o) {
  * @primitive  pki.acme.deactivate
  * @signature  pki.acme.deactivate(opts) -> Promise<object>
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 8555
  * @related    pki.acme.validate
  *
@@ -1382,7 +1382,7 @@ function deactivate(o) {
  * @primitive  pki.acme.revokeCert
  * @signature  pki.acme.revokeCert(opts) -> Promise<object>
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 8555, RFC 5280
  * @related    pki.acme.ariCertId
  *
@@ -1428,7 +1428,7 @@ function revokeCert(o) {
  * @primitive  pki.acme.keyChange
  * @signature  pki.acme.keyChange(opts) -> Promise<object>
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 8555
  * @related    pki.acme.newAccount
  *
@@ -1472,7 +1472,7 @@ async function keyChange(o) {
  * @primitive  pki.acme.ariCertId
  * @signature  pki.acme.ariCertId(certDer) -> string
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 9773
  * @related    pki.acme.parseAriCertId, pki.acme.newOrder
  *
@@ -1510,7 +1510,7 @@ function ariCertId(certDer) {
  * @primitive  pki.acme.parseAriCertId
  * @signature  pki.acme.parseAriCertId(certId) -> { keyIdentifier, serial }
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 9773
  * @related    pki.acme.ariCertId
  *
@@ -1536,7 +1536,7 @@ function parseAriCertId(certId) {
  * @primitive  pki.acme.validateRenewalInfo
  * @signature  pki.acme.validateRenewalInfo(obj) -> obj
  * @since      0.1.25
- * @status     experimental
+ * @status     stable
  * @spec       RFC 9773
  * @related    pki.acme.validate
  *
@@ -2173,7 +2173,7 @@ function _parseLinkAlternates(headers, base) {
  * @primitive  pki.acme.client
  * @signature  pki.acme.client(directoryUrl, opts) -> client
  * @since      0.3.18
- * @status     experimental
+ * @status     stable
  * @spec       RFC 8555, RFC 8737, RFC 8738, RFC 9773
  * @related    pki.acme.newOrder, pki.transport.https
  *

package/lib/cmc-verify.js

@@ -282,7 +282,7 @@ function _governingStatus(statuses, outcome) {
  * @primitive  pki.cmc.verify
  * @signature  pki.cmc.verify(response, sent?) -> Promise<verdict>
  * @since      0.4.16
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5272, RFC 5273, RFC 6402
  * @defends    cmc-response-replay (CWE-294)
  * @related    pki.schema.cmc.parse, pki.path.validate, pki.cms.verify
@@ -688,7 +688,7 @@ function _shape(body, sent, signatureVerified, bound) {
  * @primitive  pki.cmc.build
  * @signature  pki.cmc.build(spec, signer, opts?) -> Promise<Buffer|string>
  * @since      0.4.16
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5272, RFC 6402
  * @defends    enrollment-request-substitution (CWE-345)
  * @related    pki.cmc.verify, pki.schema.cmc.parse, pki.cms.sign

package/lib/cmp-build.js

@@ -1138,7 +1138,7 @@ function wellKnownUrl(base, opts) {
  * @primitive  pki.cmp.transfer
  * @signature  pki.cmp.transfer(url, message, opts?) -> Promise<{ response, responseBytes, status, contentType, tls }>
  * @since      0.3.19
- * @status     experimental
+ * @status     stable
  * @spec       RFC 9811, RFC 9810
  * @related    pki.cmp.build, pki.cmp.wellKnownUrl, pki.schema.cmp.parse, pki.transport.https
  *
@@ -1181,7 +1181,7 @@ function wellKnownUrl(base, opts) {
  * @primitive  pki.cmp.wellKnownUrl
  * @signature  pki.cmp.wellKnownUrl(base, opts?) -> string
  * @since      0.3.19
- * @status     experimental
+ * @status     stable
  * @spec       RFC 9811, RFC 8615
  * @related    pki.cmp.transfer
  *

package/lib/cmp-session.js

@@ -390,7 +390,7 @@ function _certConfHash(certDer) {
  * @primitive  pki.cmp.session
  * @signature  pki.cmp.session(opts) -> session
  * @since      0.3.27
- * @status     experimental
+ * @status     stable
  * @spec       RFC 9810, RFC 9811, RFC 9483
  * @related    pki.cmp.build, pki.cmp.verify, pki.cmp.transfer
  *

package/lib/ct.js

@@ -154,7 +154,7 @@ function _parseSct(r, sctLen) {
  * @primitive  pki.ct.parseSctList
  * @signature  pki.ct.parseSctList(extValue) -> { scts, unknownScts, all }
  * @since      0.1.20
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6962, RFC 5246, RFC 8446
  * @related    pki.ct.reconstructSignedData, pki.ct.encodeSctList, pki.schema.x509.parse
  *
@@ -252,7 +252,7 @@ function _u24Bytes(n) {
  * @primitive  pki.ct.reconstructSignedData
  * @signature  pki.ct.reconstructSignedData(entry, sct) -> Buffer
  * @since      0.1.20
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6962
  * @related    pki.ct.parseSctList
  *
@@ -378,7 +378,7 @@ function _spkiAlg(spki) {
  * @primitive  pki.ct.verifySct
  * @signature  pki.ct.verifySct(entry, sct, logPublicKey) -> Promise<boolean>
  * @since      0.2.12
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6962
  * @defends    sct-signature-forgery (CWE-347)
  * @related    pki.ct.parseSctList, pki.ct.reconstructSignedData
@@ -498,7 +498,7 @@ function _encodeSctBody(sct) {
  * @primitive  pki.ct.encodeSctList
  * @signature  pki.ct.encodeSctList(scts) -> Buffer
  * @since      0.2.24
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6962, RFC 5246
  * @related    pki.ct.parseSctList, pki.ct.signSct
  *
@@ -573,7 +573,7 @@ function _logKeyMaterial(logKey) {
  * @primitive  pki.ct.signSct
  * @signature  pki.ct.signSct(entry, logKey, opts?) -> Promise<sct>
  * @since      0.2.24
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6962
  * @related    pki.ct.verifySct, pki.ct.reconstructSignedData, pki.ct.encodeSctList
  *
@@ -723,7 +723,7 @@ function _logsAgree(a, b) {
  * @primitive  pki.ct.parseLogList
  * @signature  pki.ct.parseLogList(json, opts?) -> { logs, byLogId, version, timestamp }
  * @since      0.2.28
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6962
  * @related    pki.ct.verifySctWithLogList, pki.ct.verifySct
  *
@@ -815,7 +815,7 @@ function _resolveNotAfter(entry, opts) {
  * @primitive  pki.ct.verifySctWithLogList
  * @signature  pki.ct.verifySctWithLogList(entry, sct, logList, opts?) -> Promise<boolean>
  * @since      0.2.28
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6962
  * @related    pki.ct.parseLogList, pki.ct.verifySct
  *
@@ -878,7 +878,7 @@ async function verifySctWithLogList(entry, sct, logList, opts) {
  * @primitive  pki.ct.verifyLogListSignature
  * @signature  pki.ct.verifyLogListSignature(json, signature, publicKey) -> Promise<boolean>
  * @since      0.2.29
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6962, RFC 8017
  * @related    pki.ct.parseLogList, pki.ct.verifySct
  *
@@ -1019,7 +1019,7 @@ function _fetchBody(transport, url, req, label) {
  * @primitive  pki.ct.fetchLogList
  * @signature  pki.ct.fetchLogList(opts) -> Promise<{ logs, byLogId, version, timestamp, raw, status, contentType, tls }>
  * @since      0.3.21
- * @status     experimental
+ * @status     stable
  * @spec       RFC 6962
  * @related    pki.ct.parseLogList, pki.ct.verifyLogListSignature, pki.ct.verifySctWithLogList
  *

package/lib/est.js

@@ -162,7 +162,7 @@ function _knownOpts(opts, known, verb) {
  * @primitive  pki.est.transferDecode
  * @signature  pki.est.transferDecode(body) -> Buffer
  * @since      0.1.24
- * @status     experimental
+ * @status     stable
  * @spec       RFC 8951, RFC 4648
  * @related    pki.est.transferEncode
  *
@@ -200,7 +200,7 @@ function transferDecode(body) {
  * @primitive  pki.est.transferEncode
  * @signature  pki.est.transferEncode(der) -> string
  * @since      0.1.24
- * @status     experimental
+ * @status     stable
  * @spec       RFC 8951, RFC 4648
  * @related    pki.est.transferDecode
  *
@@ -389,7 +389,7 @@ function splitMultipartMixed(body, contentType) {
  * @primitive  pki.est.parseCertsOnly
  * @signature  pki.est.parseCertsOnly(der) -> { certificates, crls }
  * @since      0.1.24
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7030, RFC 5272, RFC 5652
  * @related    pki.est.findIssuedCert, pki.schema.cms.parse
  *
@@ -695,7 +695,7 @@ var NOT_IMPLEMENTED_OPS = { fullcmc: 1 };
  * @primitive  pki.est.classifyResponse
  * @signature  pki.est.classifyResponse(status, headers, body, opts?) -> verdict
  * @since      0.1.24
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7030, RFC 8951
  * @related    pki.est.paths, pki.est.parseCertsOnly
  *
@@ -796,7 +796,7 @@ function classifyResponse(status, headers, body, opts) {
  * @primitive  pki.est.paths
  * @signature  pki.est.paths(baseUrl, opts?) -> { cacerts, simpleenroll, ... }
  * @since      0.1.24
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7030
  * @related    pki.est.classifyResponse
  *
@@ -1310,7 +1310,7 @@ function _certsResult(op, res, opts, csrSpki) {
  * @primitive  pki.est.fullcmc
  * @signature  pki.est.fullcmc(baseUrl, request, opts?) -> Promise<verdict | { retry, retryAfterSeconds }>
  * @since      0.4.16
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7030, RFC 8951, RFC 5273, RFC 5272
  * @related    pki.cmc.build, pki.cmc.verify, pki.est.simpleenroll
  *
@@ -2024,7 +2024,7 @@ function _enroll(op, baseUrl, csrInput, opts) {
  * @primitive  pki.est.cacerts
  * @signature  pki.est.cacerts(baseUrl, opts?) -> Promise<{ certificates, crls } | { retry, retryAfterSeconds }>
  * @since      0.3.16
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7030, RFC 8951
  * @related    pki.est.simpleenroll, pki.transport.https
  *
@@ -2068,7 +2068,7 @@ function cacerts(baseUrl, opts) {
  * @primitive  pki.est.simpleenroll
  * @signature  pki.est.simpleenroll(baseUrl, csr, opts?) -> Promise<{ certificate, chain, certificates } | { retry, retryAfterSeconds }>
  * @since      0.3.16
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7030, RFC 5272
  * @related    pki.csr.sign, pki.est.simplereenroll, pki.est.cacerts
  *
@@ -2106,7 +2106,7 @@ function simpleenroll(baseUrl, csrInput, opts) {
  * @primitive  pki.est.simplereenroll
  * @signature  pki.est.simplereenroll(baseUrl, csr, opts?) -> Promise<{ certificate, chain, certificates } | { retry, retryAfterSeconds }>
  * @since      0.3.16
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7030
  * @related    pki.est.simpleenroll, pki.est.reenrollGuard
  *
@@ -2285,7 +2285,7 @@ async function _serverkeygenResult(res, opts, derived) {
  * @primitive  pki.est.serverkeygen
  * @signature  pki.est.serverkeygen(baseUrl, csr, opts?) -> Promise<{ certificates, privateKey } | { certificates, encryptedKey } | { retry, retryAfterSeconds, retryAfterDate }>
  * @since      0.3.28
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7030, RFC 8951
  * @related    pki.est.simpleenroll, pki.est.parseServerKeygenResponse
  *
@@ -2364,7 +2364,7 @@ function _csrattrsResult(res, opts) {
  * @primitive  pki.est.csrattrs
  * @signature  pki.est.csrattrs(baseUrl, opts?) -> Promise<{ available: true, attrs, plan } | { available: false, attrs: null }>
  * @since      0.3.28
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7030, RFC 8951, RFC 9908
  * @related    pki.est.simpleenroll, pki.est.buildEnrollAttributes
  *

package/lib/hpke.js

@@ -455,7 +455,7 @@ var suites = {
  * @primitive pki.hpke.setupS
  * @signature pki.hpke.setupS(suiteIds, recipientPublicKey, opts?) -> { enc, context }
  * @since 0.2.2
- * @status experimental
+ * @status stable
  * @spec RFC 9180
  * @related pki.hpke.setupR, pki.hpke.seal
  *
@@ -495,7 +495,7 @@ function _setupS(ids, pkR, opts) {
  * @primitive pki.hpke.setupR
  * @signature pki.hpke.setupR(suiteIds, enc, recipientPrivateKey, opts?) -> context
  * @since 0.2.2
- * @status experimental
+ * @status stable
  * @spec RFC 9180
  * @related pki.hpke.setupS, pki.hpke.open
  *
@@ -538,7 +538,7 @@ function _setupR(ids, enc, skR, opts) {
  * @primitive pki.hpke.seal
  * @signature pki.hpke.seal(suiteIds, recipientPublicKey, opts, aad, pt) -> { enc, ct }
  * @since 0.2.2
- * @status experimental
+ * @status stable
  * @spec RFC 9180
  * @related pki.hpke.open, pki.hpke.setupS
  *
@@ -574,7 +574,7 @@ function seal(ids, pkR, opts, aad, pt) {
  * @primitive pki.hpke.open
  * @signature pki.hpke.open(suiteIds, enc, recipientPrivateKey, opts, aad, ct) -> pt
  * @since 0.2.2
- * @status experimental
+ * @status stable
  * @spec RFC 9180
  * @related pki.hpke.seal, pki.hpke.setupR
  *

package/lib/http-transport.js

@@ -245,7 +245,7 @@ function _classifyError(e, C) {
  * @primitive  pki.transport.https
  * @signature  pki.transport.https(defaults?) -> transport
  * @since      0.3.16
- * @status     experimental
+ * @status     stable
  * @spec       RFC 7030, RFC 8996
  * @defends    tls-downgrade (CWE-757), server-impersonation (CWE-297), response-flooding (CWE-770), ssrf (CWE-918)
  * @related    pki.est.cacerts, pki.est.simpleenroll

package/lib/lint.js

@@ -714,7 +714,7 @@ function _applyThreshold(report, severity) {
  * @primitive  pki.lint.certificate
  * @signature  pki.lint.certificate(input, opts?) -> LintReport
  * @since      0.2.10
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5280, CA/Browser Forum TLS BR
  * @related    pki.schema.x509.parse, pki.inspect.certificate, pki.path.validate
  *
@@ -772,7 +772,7 @@ function certificate(input, opts) {
  * @primitive  pki.lint.rules
  * @signature  pki.lint.rules(profile?) -> [{id, severity, source, citation}]
  * @since      0.2.10
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5280, CA/Browser Forum TLS BR
  *
  * Enumerate the rule registry (all rules, or one profile's). Each entry exposes its
@@ -790,7 +790,7 @@ function rules(profile) {
  * @primitive  pki.lint.profiles
  * @signature  pki.lint.profiles() -> [string]
  * @since      0.2.10
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5280, CA/Browser Forum TLS BR
  *
  * List the known lint-profile names.

package/lib/ocsp-request-verify.js

@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- the single signature seam for an inbound signed OCSPRequest (RFC 6960 sec. 4.1.1),
+// composed by pki.ocsp.verifyRequest. It routes the request-signature check through the same
+// certification-path signature engine (its EdDSA low-order-point and algorithm-confusion gates
+// included) that pki.ocsp.verify uses for a response and pki.crl.verify / pki.cms.verify use for
+// theirs, so no second, weaker verifier of an untrusted request can drift. The producing side runs
+// its own check over what it just signed (pki.ocsp.buildRequest's signer path); this is the
+// different question a responder asks about a request someone else produced. The slot, the wiring
+// assertion and the octet-alignment refusal are the shared seam (lib/verify-seam.js). It is not
+// wired into index.js and is reached only by require.
+
+var frameworkError = require("./framework-error");
+var seam = require("./verify-seam");
+
+var _seam = seam.makeSeam("ocsp-request-verify", frameworkError.OcspError, "ocsp/bad-input");
+
+// Verify a signed OCSPRequest's signature over its exact tbsRequest bytes under the SPKI of the
+// requestor certificate the request carries (RFC 6960 sec. 4.1.1). Unlike a CSR there is no
+// self-signature: the verifying key is the requestor's, identified to the responder by
+// requestorName and proven by the certificate embedded in (or supplied alongside) the request.
+function verifyRequestSignature(signatureAlgorithm, signature, signerSpkiBytes, tbsRequestBytes) {
+  return _seam.verify(signatureAlgorithm, signature, signerSpkiBytes, tbsRequestBytes);
+}
+
+module.exports = { setEngine: _seam.setEngine, verifyRequestSignature: verifyRequestSignature };

package/lib/ocsp.js

@@ -32,6 +32,7 @@ var ocspSchema = require("./schema-ocsp");
 var pathValidate = require("./path-validate");
 var signScheme = require("./sign-scheme");
 var ocspVerify = require("./ocsp-verify");
+var ocspRequestVerify = require("./ocsp-request-verify");   // path-validate (required above) injects its signature engine into this seam at load
 var webcrypto = require("./webcrypto");
 var subtle = webcrypto.webcrypto.subtle;
 var guard = require("./guard-all");
@@ -579,9 +580,164 @@ function _responseNonce(parsed) {
   return null;
 }
 
+var _VERIFY_REQUEST_OPTS = { certs: 1 };
+// Parsed from BYTES so the signature, the algorithm that verifies it and the tbsRequest it covers
+// are bound to one byte string, the same discipline pki.ocsp.verify follows for a response. A
+// BufferSource is SNAPSHOT first: parseRequest surfaces tbsRequest / signature / embedded certs as
+// views into it, and the signature check awaits, so without a copy a caller could mutate the buffer
+// mid-verification and be judged on bytes other than the parser read. A PEM string decodes to a
+// fresh buffer already; parseRequest owns that decode and a non-bytes input is its typed refusal.
+function _requestFromBytes(request) {
+  if (guard.bytes.isByteSource(request)) request = guard.bytes.snapshotSource(request, OcspError, "ocsp/bad-input", "the OCSP request");
+  return ocspSchema.parseRequest(request);
+}
+function _reqVerdict(parsed, extra) {
+  return {
+    signed: extra.signed, signatureValid: extra.signatureValid,
+    signerCert: extra.signerCert != null ? extra.signerCert : null,
+    signerCerts: extra.signerCerts != null ? extra.signerCerts : [],
+    certs: extra.certs != null ? extra.certs : [],
+    signerSubject: extra.signerSubject != null ? extra.signerSubject : null,
+    requestorName: parsed.requestorName, requestList: parsed.requestList,
+    requestExtensions: parsed.requestExtensions, version: parsed.version,
+    reason: extra.reason != null ? extra.reason : null,
+  };
+}
+// Collect EVERY candidate certificate whose key verified the request signature. RFC 6960 sec. 4.1.1
+// certs is an unordered SEQUENCE OF Certificate, and several may share the signing key (an expired
+// certificate carried beside its renewal), so all matches are surfaced rather than one
+// position-dependent pick: the responder builds a trusted path to one of them to select a usable
+// one, and no valid match is hidden behind an unusable one that happened to appear first. `strict` separates the
+// responder's own opts.certs (a malformed entry is its config error, a typed throw) from the
+// request's untrusted embedded certs (a malformed one is skipped, never fatal).
+async function _findRequestSigners(candidates, strict, parsed, sig, sigBits) {
+  var parsedList = [];
+  for (var i = 0; i < candidates.length; i++) {
+    try { parsedList.push({ der: candidates[i], cert: x509.parse(candidates[i]) }); }
+    catch (e) { if (strict) throw _err("ocsp/bad-signer-cert", "an opts.certs entry does not parse as an X.509 certificate", e); }
+  }
+  // The certs surfaced for path building are the PARSEABLE ones: a malformed embedded entry (skipped
+  // above rather than fatal) is excluded so it is never handed to pki.path.build as a candidate.
+  var parseable = parsedList.map(function (p) { return p.der; });
+  // signerCerts is every candidate whose key VERIFIES the request signature, identified by the
+  // verification itself rather than by comparing encoded key bytes. A request carries one signature
+  // under one key, but that key can appear across several certificates in the unordered certs field
+  // (an expired certificate beside its renewal), and the one key can be encoded differently between
+  // them -- rsaEncryption with NULL versus absent parameters, an EC point compressed versus
+  // uncompressed -- so a byte comparison would drop a genuine match, while a coincidental byte match
+  // under a different algorithm would be a false one. Verifying each candidate answers both exactly,
+  // through the algorithm-confusion gate (RFC 9814 sec. 4) in the shared engine. The work is bounded:
+  // the parser already caps the certificate count at OCSP_MAX_CERTS, and the engine returns false
+  // (never throws) for a candidate whose key does not match the signature, so a non-signer is skipped
+  // rather than aborting the verdict.
+  var matches = [];
+  for (var j = 0; j < parsedList.length; j++) {
+    if (await ocspRequestVerify.verifyRequestSignature(sig.signatureAlgorithm, sigBits, parsedList[j].cert.subjectPublicKeyInfo.bytes, parsed.tbsRequestBytes)) {
+      matches.push({ der: parsedList[j].der, subject: parsedList[j].cert.subject });
+    }
+  }
+  return { matches: matches, parseable: parseable };
+}
+// The verdict from `_findRequestSigners`: signerCerts is every match (so the caller's trust decision
+// does not depend on ordering), signerCert / signerSubject the first for the common single-signer
+// case. `certs` is every PARSEABLE certificate the request carried (or opts.certs supplied), so the
+// responder has the intermediates it needs to chain a signer to an anchor -- those do not sign the
+// request, so they never appear in signerCerts. No match is signatureValid:false with the reason.
+function _signerVerdict(parsed, found, failReason) {
+  if (!found.matches.length) return _reqVerdict(parsed, { signed: true, signatureValid: false, certs: found.parseable, reason: failReason });
+  return _reqVerdict(parsed, {
+    signed: true, signatureValid: true, signerCert: found.matches[0].der,
+    signerCerts: found.matches.map(function (m) { return m.der; }), certs: found.parseable,
+    signerSubject: { dn: found.matches[0].subject.dn, rdns: found.matches[0].subject.rdns }, reason: null,
+  });
+}
+
+/**
+ * @primitive  pki.ocsp.verifyRequest
+ * @signature  pki.ocsp.verifyRequest(request, opts?) -> Promise<{ signed, signatureValid, signerCert, signerCerts, certs, signerSubject, requestorName, requestList, requestExtensions, version, reason }>
+ * @since      0.6.0
+ * @status     stable
+ * @spec       RFC 6960
+ * @related    pki.ocsp.buildRequest, pki.ocsp.verify, pki.schema.ocsp.parseRequest, pki.csr.verify
+ *
+ * The responder-side counterpart to `pki.ocsp.buildRequest`: verify a client's signed OCSP request
+ * (RFC 6960 sec. 4.1.1). Signing a request is OPTIONAL, so an unsigned request is not an error; it is
+ * reported with `signed: false` and authenticates no requestor. For a signed request the requestor's
+ * signature over the exact `tbsRequest` is checked under the public key of the requestor certificate
+ * the request carries, through the same certification-path signature engine `pki.ocsp.verify` uses
+ * for a response (with its EdDSA low-order-point and algorithm-confusion gates). `request` is DER
+ * `Buffer` / `Uint8Array` or a PEM `OCSP REQUEST` string, parsed from bytes so the signature, its
+ * algorithm and the covered `tbsRequest` are one byte string and cannot be split.
+ *
+ * `signatureValid` means only that a certificate's key made this signature over this request. It
+ * says nothing about whether that certificate is trusted: `signerCerts` is every certificate the
+ * request carries whose key verified the signature (RFC 6960 sec. 4.1.1 certs is unordered, and a
+ * key may appear under an expired certificate beside its renewal), so the responder builds a trusted
+ * path to one of them rather than depend on ordering. `signerCert` and the decoded `signerSubject`
+ * are the first of those, the common single-signer case. `certs` is every parseable certificate the
+ * request carried (or opts.certs supplied), including intermediates that do not sign and so are absent
+ * from `signerCerts`: the responder passes it as the `opts.candidates` pool to `pki.path.build`, which
+ * discovers and validates the ordered path from a `signerCerts` entry (leaf) up to a trust anchor.
+ * The responder then confirms that certificate is authorized to sign the request -- its `keyUsage`,
+ * where present, must assert `digitalSignature` (RFC 5280 sec. 4.2.1.3, since the certificate signed
+ * the request) -- and compares its subject to the `requestorName` it expects. The decoded
+ * `requestList`, `requestExtensions` and `version` are
+ * returned so the CertIDs being asked about need no re-parse.
+ *
+ * @opts
+ *   - `certs`  An array of certificates (DER `Buffer` / `Uint8Array` or PEM strings) supplying the
+ *              requestor certificate when the request omits its own `certs` (RFC 6960 lets them
+ *              travel out of band); every entry whose key verifies is surfaced in `signerCerts`,
+ *              and is ignored when the request embeds its own certificates.
+ *
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var key = await pki.key.export(pair.privateKey), spki = await pki.key.export(pair.publicKey);
+ *   var caDer = await pki.x509.sign({ subject: "OCSP CA", subjectPublicKey: spki,
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2027-01-01T00:00:00Z") }, { key: key });
+ *   var request = await pki.ocsp.buildRequest({ cert: caDer, issuer: caDer },
+ *     { signer: { cert: caDer, key: key }, requestorName: pki.schema.x509.parse(caDer).subject.bytes });
+ *   var v = await pki.ocsp.verifyRequest(request);
+ *   // v.signed && v.signatureValid -> for a signerCerts entry, pki.path.build(entry, { candidates:
+ *   // v.certs, trustAnchors, time }) discovers and validates the path (several signerCerts may share
+ *   // the key, e.g. an expired one beside its renewal); confirm that entry's keyUsage asserts
+ *   // digitalSignature, then bind its subject to the requestor you expect before honoring v.requestList.
+ */
+async function verifyRequest(request, opts) {
+  opts = guard.identifier.optionsObject(opts, _err, "ocsp/bad-input", "pki.ocsp.verifyRequest options");
+  guard.identifier.assertKnownKeys(opts, _VERIFY_REQUEST_OPTS, _err, "ocsp/bad-input",
+    "pki.ocsp.verifyRequest has an unknown option (out-of-band requestor certificates are `certs`): ");
+  var parsed = _requestFromBytes(request);
+  var sig = parsed.optionalSignature;
+  if (sig == null) {
+    return _reqVerdict(parsed, { signed: false, signatureValid: false,
+      reason: "the OCSP request is unsigned (RFC 6960 sec. 4.1.1 makes optionalSignature OPTIONAL); no requestor is authenticated" });
+  }
+  // sig.signature is the raw signature the parser already refused unless octet-aligned; the seam
+  // re-checks alignment, so it is handed the BIT STRING shape the seam verifies.
+  var sigBits = { unusedBits: 0, bytes: sig.signature };
+  // Prefer the certificates the request carries; fall back to opts.certs only when it carries none.
+  if (sig.certs.length) {
+    return _signerVerdict(parsed, await _findRequestSigners(sig.certs, false, parsed, sig, sigBits),
+      "the OCSP request signature does not verify over tbsRequest under any certificate the request carries (RFC 6960 sec. 4.1.1)");
+  }
+  var suppliedCerts = [];
+  if (opts.certs != null) {
+    var list = pkiBuild.reqDenseArray(opts.certs, "opts.certs", _err, "ocsp/bad-input");
+    for (var i = 0; i < list.length; i++) suppliedCerts.push(_normCertDer(list[i], "an opts.certs entry"));
+  }
+  if (!suppliedCerts.length) {
+    return _reqVerdict(parsed, { signed: true, signatureValid: false,
+      reason: "the signed OCSP request carries no certificate and opts.certs was not supplied, so its signature cannot be verified" });
+  }
+  return _signerVerdict(parsed, await _findRequestSigners(suppliedCerts, true, parsed, sig, sigBits),
+    "the OCSP request signature does not verify over tbsRequest under any opts.certs entry");
+}
+
 module.exports = {
   buildRequest: buildRequest,
   sign: sign,
   buildErrorResponse: buildErrorResponse,
   verify: verify,
+  verifyRequest: verifyRequest,
 };

package/lib/path-validate.js

@@ -44,6 +44,7 @@ var crlVerify = require("./crl-verify");
 var csrVerify = require("./csr-verify");
 var crmfVerify = require("./crmf-verify");
 var attrcertVerify = require("./attrcert-verify");
+var ocspRequestVerify = require("./ocsp-request-verify");
 var cmpVerify = require("./cmp-verify");
 var cmsVerify = require("./cms-verify");
 var cmpSession = require("./cmp-session");
@@ -2369,6 +2370,10 @@ crmfVerify.setEngine(_verifyWithSpki);
 // same way.
 attrcertVerify.setEngine(_verifyWithSpki);
 
+// And for a signed OCSPRequest (RFC 6960 sec. 4.1.1), so pki.ocsp.verifyRequest checks a requestor's
+// signature through the same one engine that verifies a response, never a second, weaker request path.
+ocspRequestVerify.setEngine(_verifyWithSpki);
+
 // ---- the OCSP revocation checker (RFC 6960) -------------------------------
 
 // The OCSP response-verification core (responder authorization + CertID binding + currency +
@@ -3346,7 +3351,7 @@ async function _fetchAiaIssuers(current, aia) {
  * @primitive  pki.path.build
  * @signature  pki.path.build(leaf, opts) -> Promise<{ valid, path, trustAnchor, result, candidatesConsidered, aiaFetches }>
  * @since       0.3.7
- * @status      experimental
+ * @status      stable
  * @spec        RFC 4158, RFC 5280
  * @related     pki.path.validate, pki.schema.x509.parse, pki.trust.parseCertdata
  *

package/lib/schema-c509.js

@@ -2014,7 +2014,7 @@ function _reconstructDer(r, sigNode) {
  * @primitive  pki.schema.c509.parse
  * @signature  pki.schema.c509.parse(bytes) -> { certificateType, serialNumber, serialNumberHex, ... }
  * @since      0.2.30
- * @status     experimental
+ * @status     stable
  * @spec       draft-ietf-cose-cbor-encoded-cert, RFC 8949, RFC 9090, RFC 5280
  *
  * Decode a C509 certificate (draft-ietf-cose-cbor-encoded-cert) from its deterministic-CBOR bytes.
@@ -2274,7 +2274,7 @@ function _encodeC509Array(r) {
  * @primitive  pki.schema.c509.encode
  * @signature  pki.schema.c509.encode(input[, opts]) -> Buffer
  * @since      0.3.4
- * @status     experimental
+ * @status     stable
  * @spec       draft-ietf-cose-cbor-encoded-cert, RFC 8949, RFC 9090
  * @related    pki.schema.c509.parse
  *

package/lib/schema-cmc.js

@@ -667,7 +667,7 @@ function _finishBody(body, where) {
  * @primitive  pki.schema.cmc.parsePkiData
  * @signature  pki.schema.cmc.parsePkiData(der) -> parsed
  * @since      0.4.16
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5272 sec. 3.2.1
  * @related    pki.schema.cmc.parse, pki.schema.cmc.parsePkiResponse
  *
@@ -695,7 +695,7 @@ function parsePkiData(input) {
  * @primitive  pki.schema.cmc.parsePkiResponse
  * @signature  pki.schema.cmc.parsePkiResponse(der) -> parsed
  * @since      0.4.16
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5272 sec. 4.2.1
  * @related    pki.schema.cmc.parse, pki.schema.cmc.parsePkiData
  *
@@ -721,7 +721,7 @@ function parsePkiResponse(input) {
  * @primitive  pki.schema.cmc.parse
  * @signature  pki.schema.cmc.parse(input) -> parsed
  * @since      0.4.16
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5272, RFC 6402
  * @defends    cmc-status-confusion (CWE-20)
  * @related    pki.schema.cmc.parsePkiData, pki.schema.cmc.parsePkiResponse, pki.cms.verify

package/lib/sigstore.js

@@ -104,7 +104,7 @@ function _jsonParse(input, code, label) {
  * @primitive pki.sigstore.pae
  * @signature pki.sigstore.pae(payloadType, payloadBytes) -> Buffer
  * @since 0.2.3
- * @status experimental
+ * @status stable
  * @spec DSSE
  * @related pki.sigstore.verifyBundle
  *
@@ -150,7 +150,7 @@ function _b64(s, label) {
  * @primitive pki.sigstore.parseBundle
  * @signature pki.sigstore.parseBundle(input) -> bundle
  * @since 0.2.3
- * @status experimental
+ * @status stable
  * @spec Sigstore bundle v0.3
  * @related pki.sigstore.verifyBundle
  *
@@ -637,7 +637,7 @@ function _statement(payload, payloadType, expectedPredicate) {
  * @primitive pki.sigstore.verifyBundle
  * @signature pki.sigstore.verifyBundle(bundle, opts) -> Promise<result>
  * @since 0.2.3
- * @status experimental
+ * @status stable
  * @spec DSSE, Sigstore bundle v0.3, RFC 9162, SLSA provenance v1
  * @related pki.sigstore.parseBundle, pki.sigstore.pae
  *

package/lib/webauthn.js

@@ -1939,7 +1939,7 @@ var CLIENT_DATA_TYPE = Object.assign(Object.create(null), { "webauthn.create": 1
  * @primitive pki.webauthn.parseClientData
  * @signature pki.webauthn.parseClientData(bytes, opts?) -> { type, challenge, origin, crossOrigin, topOrigin, checked }
  * @since 0.5.0
- * @status experimental
+ * @status stable
  * @spec W3C WebAuthn Level 3 sec. 5.8.1 / 7.1 / 7.2
  * @defends webauthn-ceremony-confusion (CWE-345)
  * @related pki.webauthn.verify, pki.webauthn.verifyAssertion
@@ -2126,7 +2126,7 @@ var _CLIENT_DATA_OPTS = Object.assign(Object.create(null), {
  * @primitive pki.webauthn.parseAuthenticatorData
  * @signature pki.webauthn.parseAuthenticatorData(bytes) -> { rpIdHash, flags, signCount, aaguid, credentialId, credentialPublicKey, credentialPublicKeyBytes, extensions }
  * @since 0.5.0
- * @status experimental
+ * @status stable
  * @spec W3C WebAuthn Level 3 sec. 6.1
  * @related pki.webauthn.verifyAssertion, pki.webauthn.parseAttestationObject
  *
@@ -2164,7 +2164,7 @@ var _ASSERT_OPTS = Object.assign(Object.create(null), {
  * @primitive pki.webauthn.verifyAssertion
  * @signature pki.webauthn.verifyAssertion(input) -> Promise<{ signatureVerified, signCount, signCountChecked, flags, rpIdHash, extensions, bindingChecked, clientData }>
  * @since 0.5.0
- * @status experimental
+ * @status stable
  * @spec W3C WebAuthn Level 3 sec. 7.2
  * @defends webauthn-assertion-forgery (CWE-347)
  * @related pki.webauthn.parseAuthenticatorData, pki.webauthn.verify

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.5.39",
+  "version": "0.6.0",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:fc9ede9f-ba2d-47e7-b43e-add5f0d3de40",
+  "serialNumber": "urn:uuid:9aa382b4-23a6-46b3-b0c6-809ac7fb8e71",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-30T04:06:00.042Z",
+    "timestamp": "2026-08-30T09:44:19.627Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.5.39",
+      "bom-ref": "@blamejs/pki@0.6.0",
       "type": "application",
       "name": "pki",
-      "version": "0.5.39",
+      "version": "0.6.0",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.5.39",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.0",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.5.39",
+      "ref": "@blamejs/pki@0.6.0",
       "dependsOn": []
     }
   ]