@blamejs/pki 0.5.39 → 0.6.1

package/lib/ocsp.js

@@ -32,6 +32,7 @@ var ocspSchema = require("./schema-ocsp");
 var pathValidate = require("./path-validate");
 var signScheme = require("./sign-scheme");
 var ocspVerify = require("./ocsp-verify");
+var ocspRequestVerify = require("./ocsp-request-verify");   // path-validate (required above) injects its signature engine into this seam at load
 var webcrypto = require("./webcrypto");
 var subtle = webcrypto.webcrypto.subtle;
 var guard = require("./guard-all");
@@ -579,9 +580,164 @@ function _responseNonce(parsed) {
   return null;
 }
 
+var _VERIFY_REQUEST_OPTS = { certs: 1 };
+// Parsed from BYTES so the signature, the algorithm that verifies it and the tbsRequest it covers
+// are bound to one byte string, the same discipline pki.ocsp.verify follows for a response. A
+// BufferSource is SNAPSHOT first: parseRequest surfaces tbsRequest / signature / embedded certs as
+// views into it, and the signature check awaits, so without a copy a caller could mutate the buffer
+// mid-verification and be judged on bytes other than the parser read. A PEM string decodes to a
+// fresh buffer already; parseRequest owns that decode and a non-bytes input is its typed refusal.
+function _requestFromBytes(request) {
+  if (guard.bytes.isByteSource(request)) request = guard.bytes.snapshotSource(request, OcspError, "ocsp/bad-input", "the OCSP request");
+  return ocspSchema.parseRequest(request);
+}
+function _reqVerdict(parsed, extra) {
+  return {
+    signed: extra.signed, signatureValid: extra.signatureValid,
+    signerCert: extra.signerCert != null ? extra.signerCert : null,
+    signerCerts: extra.signerCerts != null ? extra.signerCerts : [],
+    certs: extra.certs != null ? extra.certs : [],
+    signerSubject: extra.signerSubject != null ? extra.signerSubject : null,
+    requestorName: parsed.requestorName, requestList: parsed.requestList,
+    requestExtensions: parsed.requestExtensions, version: parsed.version,
+    reason: extra.reason != null ? extra.reason : null,
+  };
+}
+// Collect EVERY candidate certificate whose key verified the request signature. RFC 6960 sec. 4.1.1
+// certs is an unordered SEQUENCE OF Certificate, and several may share the signing key (an expired
+// certificate carried beside its renewal), so all matches are surfaced rather than one
+// position-dependent pick: the responder builds a trusted path to one of them to select a usable
+// one, and no valid match is hidden behind an unusable one that happened to appear first. `strict` separates the
+// responder's own opts.certs (a malformed entry is its config error, a typed throw) from the
+// request's untrusted embedded certs (a malformed one is skipped, never fatal).
+async function _findRequestSigners(candidates, strict, parsed, sig, sigBits) {
+  var parsedList = [];
+  for (var i = 0; i < candidates.length; i++) {
+    try { parsedList.push({ der: candidates[i], cert: x509.parse(candidates[i]) }); }
+    catch (e) { if (strict) throw _err("ocsp/bad-signer-cert", "an opts.certs entry does not parse as an X.509 certificate", e); }
+  }
+  // The certs surfaced for path building are the PARSEABLE ones: a malformed embedded entry (skipped
+  // above rather than fatal) is excluded so it is never handed to pki.path.build as a candidate.
+  var parseable = parsedList.map(function (p) { return p.der; });
+  // signerCerts is every candidate whose key VERIFIES the request signature, identified by the
+  // verification itself rather than by comparing encoded key bytes. A request carries one signature
+  // under one key, but that key can appear across several certificates in the unordered certs field
+  // (an expired certificate beside its renewal), and the one key can be encoded differently between
+  // them -- rsaEncryption with NULL versus absent parameters, an EC point compressed versus
+  // uncompressed -- so a byte comparison would drop a genuine match, while a coincidental byte match
+  // under a different algorithm would be a false one. Verifying each candidate answers both exactly,
+  // through the algorithm-confusion gate (RFC 9814 sec. 4) in the shared engine. The work is bounded:
+  // the parser already caps the certificate count at OCSP_MAX_CERTS, and the engine returns false
+  // (never throws) for a candidate whose key does not match the signature, so a non-signer is skipped
+  // rather than aborting the verdict.
+  var matches = [];
+  for (var j = 0; j < parsedList.length; j++) {
+    if (await ocspRequestVerify.verifyRequestSignature(sig.signatureAlgorithm, sigBits, parsedList[j].cert.subjectPublicKeyInfo.bytes, parsed.tbsRequestBytes)) {
+      matches.push({ der: parsedList[j].der, subject: parsedList[j].cert.subject });
+    }
+  }
+  return { matches: matches, parseable: parseable };
+}
+// The verdict from `_findRequestSigners`: signerCerts is every match (so the caller's trust decision
+// does not depend on ordering), signerCert / signerSubject the first for the common single-signer
+// case. `certs` is every PARSEABLE certificate the request carried (or opts.certs supplied), so the
+// responder has the intermediates it needs to chain a signer to an anchor -- those do not sign the
+// request, so they never appear in signerCerts. No match is signatureValid:false with the reason.
+function _signerVerdict(parsed, found, failReason) {
+  if (!found.matches.length) return _reqVerdict(parsed, { signed: true, signatureValid: false, certs: found.parseable, reason: failReason });
+  return _reqVerdict(parsed, {
+    signed: true, signatureValid: true, signerCert: found.matches[0].der,
+    signerCerts: found.matches.map(function (m) { return m.der; }), certs: found.parseable,
+    signerSubject: { dn: found.matches[0].subject.dn, rdns: found.matches[0].subject.rdns }, reason: null,
+  });
+}
+
+/**
+ * @primitive  pki.ocsp.verifyRequest
+ * @signature  pki.ocsp.verifyRequest(request, opts?) -> Promise<{ signed, signatureValid, signerCert, signerCerts, certs, signerSubject, requestorName, requestList, requestExtensions, version, reason }>
+ * @since      0.6.0
+ * @status     stable
+ * @spec       RFC 6960
+ * @related    pki.ocsp.buildRequest, pki.ocsp.verify, pki.schema.ocsp.parseRequest, pki.csr.verify
+ *
+ * The responder-side counterpart to `pki.ocsp.buildRequest`: verify a client's signed OCSP request
+ * (RFC 6960 sec. 4.1.1). Signing a request is OPTIONAL, so an unsigned request is not an error; it is
+ * reported with `signed: false` and authenticates no requestor. For a signed request the requestor's
+ * signature over the exact `tbsRequest` is checked under the public key of the requestor certificate
+ * the request carries, through the same certification-path signature engine `pki.ocsp.verify` uses
+ * for a response (with its EdDSA low-order-point and algorithm-confusion gates). `request` is DER
+ * `Buffer` / `Uint8Array` or a PEM `OCSP REQUEST` string, parsed from bytes so the signature, its
+ * algorithm and the covered `tbsRequest` are one byte string and cannot be split.
+ *
+ * `signatureValid` means only that a certificate's key made this signature over this request. It
+ * says nothing about whether that certificate is trusted: `signerCerts` is every certificate the
+ * request carries whose key verified the signature (RFC 6960 sec. 4.1.1 certs is unordered, and a
+ * key may appear under an expired certificate beside its renewal), so the responder builds a trusted
+ * path to one of them rather than depend on ordering. `signerCert` and the decoded `signerSubject`
+ * are the first of those, the common single-signer case. `certs` is every parseable certificate the
+ * request carried (or opts.certs supplied), including intermediates that do not sign and so are absent
+ * from `signerCerts`: the responder passes it as the `opts.candidates` pool to `pki.path.build`, which
+ * discovers and validates the ordered path from a `signerCerts` entry (leaf) up to a trust anchor.
+ * The responder then confirms that certificate is authorized to sign the request -- its `keyUsage`,
+ * where present, must assert `digitalSignature` (RFC 5280 sec. 4.2.1.3, since the certificate signed
+ * the request) -- and compares its subject to the `requestorName` it expects. The decoded
+ * `requestList`, `requestExtensions` and `version` are
+ * returned so the CertIDs being asked about need no re-parse.
+ *
+ * @opts
+ *   - `certs`  An array of certificates (DER `Buffer` / `Uint8Array` or PEM strings) supplying the
+ *              requestor certificate when the request omits its own `certs` (RFC 6960 lets them
+ *              travel out of band); every entry whose key verifies is surfaced in `signerCerts`,
+ *              and is ignored when the request embeds its own certificates.
+ *
+ * @example
+ *   var pair = await pki.key.generate("Ed25519");
+ *   var key = await pki.key.export(pair.privateKey), spki = await pki.key.export(pair.publicKey);
+ *   var caDer = await pki.x509.sign({ subject: "OCSP CA", subjectPublicKey: spki,
+ *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2027-01-01T00:00:00Z") }, { key: key });
+ *   var request = await pki.ocsp.buildRequest({ cert: caDer, issuer: caDer },
+ *     { signer: { cert: caDer, key: key }, requestorName: pki.schema.x509.parse(caDer).subject.bytes });
+ *   var v = await pki.ocsp.verifyRequest(request);
+ *   // v.signed && v.signatureValid -> for a signerCerts entry, pki.path.build(entry, { candidates:
+ *   // v.certs, trustAnchors, time }) discovers and validates the path (several signerCerts may share
+ *   // the key, e.g. an expired one beside its renewal); confirm that entry's keyUsage asserts
+ *   // digitalSignature, then bind its subject to the requestor you expect before honoring v.requestList.
+ */
+async function verifyRequest(request, opts) {
+  opts = guard.identifier.optionsObject(opts, _err, "ocsp/bad-input", "pki.ocsp.verifyRequest options");
+  guard.identifier.assertKnownKeys(opts, _VERIFY_REQUEST_OPTS, _err, "ocsp/bad-input",
+    "pki.ocsp.verifyRequest has an unknown option (out-of-band requestor certificates are `certs`): ");
+  var parsed = _requestFromBytes(request);
+  var sig = parsed.optionalSignature;
+  if (sig == null) {
+    return _reqVerdict(parsed, { signed: false, signatureValid: false,
+      reason: "the OCSP request is unsigned (RFC 6960 sec. 4.1.1 makes optionalSignature OPTIONAL); no requestor is authenticated" });
+  }
+  // sig.signature is the raw signature the parser already refused unless octet-aligned; the seam
+  // re-checks alignment, so it is handed the BIT STRING shape the seam verifies.
+  var sigBits = { unusedBits: 0, bytes: sig.signature };
+  // Prefer the certificates the request carries; fall back to opts.certs only when it carries none.
+  if (sig.certs.length) {
+    return _signerVerdict(parsed, await _findRequestSigners(sig.certs, false, parsed, sig, sigBits),
+      "the OCSP request signature does not verify over tbsRequest under any certificate the request carries (RFC 6960 sec. 4.1.1)");
+  }
+  var suppliedCerts = [];
+  if (opts.certs != null) {
+    var list = pkiBuild.reqDenseArray(opts.certs, "opts.certs", _err, "ocsp/bad-input");
+    for (var i = 0; i < list.length; i++) suppliedCerts.push(_normCertDer(list[i], "an opts.certs entry"));
+  }
+  if (!suppliedCerts.length) {
+    return _reqVerdict(parsed, { signed: true, signatureValid: false,
+      reason: "the signed OCSP request carries no certificate and opts.certs was not supplied, so its signature cannot be verified" });
+  }
+  return _signerVerdict(parsed, await _findRequestSigners(suppliedCerts, true, parsed, sig, sigBits),
+    "the OCSP request signature does not verify over tbsRequest under any opts.certs entry");
+}
+
 module.exports = {
   buildRequest: buildRequest,
   sign: sign,
   buildErrorResponse: buildErrorResponse,
   verify: verify,
+  verifyRequest: verifyRequest,
 };

package/lib/path-validate.js

@@ -33,6 +33,7 @@
 var webcrypto = require("./webcrypto");
 var pkix = require("./schema-pkix");
 var oid = require("./oid");
+var ct = require("./ct");
 var errors = require("./framework-error");
 var asn1 = require("./asn1-der");
 var schema = require("./schema-engine");
@@ -44,6 +45,7 @@ var crlVerify = require("./crl-verify");
 var csrVerify = require("./csr-verify");
 var crmfVerify = require("./crmf-verify");
 var attrcertVerify = require("./attrcert-verify");
+var ocspRequestVerify = require("./ocsp-request-verify");
 var cmpVerify = require("./cmp-verify");
 var cmsVerify = require("./cms-verify");
 var cmpSession = require("./cmp-session");
@@ -1277,17 +1279,73 @@ function validateCriticalExtensionStructure(cert) {
 // inputs appear together. A grep of one function would have shipped a list missing four real
 // options and rejected callers that work today.
 var _VALIDATE_OPTS = {
-  checkPurpose: 1, historicalMode: 1, initialAnyPolicyInhibit: 1, initialExcludedSubtrees: 1,
-  initialExplicitPolicy: 1, initialPermittedSubtrees: 1, initialPolicyMappingInhibit: 1,
-  maxPathCerts: 1, maxPolicyNodes: 1, requireRevocation: 1, requiredEku: 1, revocationChecker: 1,
-  softFail: 1, time: 1, trustAnchor: 1, userInitialPolicySet: 1, verifier: 1
+  checkPurpose: 1, ctLogList: 1, ctPolicy: 1, historicalMode: 1, initialAnyPolicyInhibit: 1,
+  initialExcludedSubtrees: 1, initialExplicitPolicy: 1, initialPermittedSubtrees: 1,
+  initialPolicyMappingInhibit: 1, maxPathCerts: 1, maxPolicyNodes: 1, requireRevocation: 1,
+  requiredEku: 1, revocationChecker: 1, softFail: 1, time: 1, trustAnchor: 1,
+  userInitialPolicySet: 1, verifier: 1
 };
 
+// The opt-in Certificate Transparency gate (RFC 6962). When opts.ctLogList is supplied, the target's
+// embedded SCTs are verified against the trusted log-list and the caller's CT policy, and the verdict is
+// recorded on the target's checks. Fail-closed: a target that declares a CT policy but carries no
+// SCT-list extension is refused. Reached only through opts.ctLogList, so every existing caller is
+// unaffected. The SCT-list extension OID is looked up through the shared registry, never a literal.
+var OID_SCT_LIST = oid.byName("signedCertificateTimestampList");
+async function ctGateCheck(leaf, certs, anchor, ctLogList, ctPolicy, n, at) {
+  var exts = leaf.extensions || [], sctExt = null;
+  for (var i = 0; i < exts.length; i++) {
+    if (exts[i] && (exts[i].oid === OID_SCT_LIST || exts[i].name === "signedCertificateTimestampList")) { sctExt = exts[i]; break; }
+  }
+  if (sctExt == null) return { name: "ct", ok: false, code: "path/ct-required" };
+  // The leaf's issuer contributes issuerKeyHash: the certificate that signed it (certs[n-2] in the
+  // anchor->target order), or the anchor itself when the target is validated directly beneath it.
+  var issuer = n >= 2 ? certs[n - 2] : { subjectPublicKeyInfo: { bytes: anchor.publicKey } };
+  var entry, list;
+  try {
+    entry = ct.x509CertEntry(leaf, issuer);
+    list = ct.parseSctList(sctExt.value);
+  } catch (e) {
+    return { name: "ct", ok: false, code: pathCode(e, "path/ct-required") };
+  }
+  // verifySctList throws only for a mis-shaped caller configuration (a bad ctPolicy threshold value, a
+  // ctLogList that is not a parseLogList result): that is the caller's error, surfaced at the path
+  // boundary as path/bad-input rather than leaking the ct/* domain code of a layer they did not call.
+  // verifySctList throws only for a mis-shaped caller configuration (a bad ctPolicy threshold value, a
+  // ctLogList that is not a parseLogList result): that is the caller's error, surfaced at the path
+  // boundary as path/bad-input rather than leaking the ct/* domain code of a layer they did not call.
+  var verdict;
+  try {
+    verdict = await ct.verifySctList(entry, list, ctLogList,
+      { minScts: ctPolicy.minScts, minOperators: ctPolicy.minOperators, certNotAfter: leaf.validity.notAfter, at: at });
+  } catch (e) {
+    if (e && e.isPkiError) throw E("path/bad-input", "validate: the CT policy or log-list is invalid (" + (e.code || "ct/bad-input") + "): " + e.message);
+    throw e;
+  }
+  return { name: "ct", ok: verdict.policyOk === true, code: verdict.policyOk ? undefined : "path/ct-policy-not-met" };
+}
+
 async function validate(path, opts) {
   opts = guard.identifier.optionsObject(opts, E, "path/bad-input", "validate: opts");
   guard.identifier.assertKnownKeys(opts, _VALIDATE_OPTS, E, "path/bad-input",
     "pki.path.validate has an unknown option. The anchor here is `trustAnchor`, singular; " +
     "pki.path.build takes `trustAnchors`. The unknown option was: ");
+  // A CT policy without a log-list cannot be enforced -- refuse it at entry rather than silently
+  // skipping the CT gate and returning a valid path the caller believes was CT-checked (fail-closed).
+  if (opts.ctPolicy != null && opts.ctLogList == null) throw E("path/bad-input", "validate: opts.ctPolicy requires opts.ctLogList (the trusted CT log-list to verify the certificate's SCTs against)");
+  // Validate the CT policy's KEYS at entry: a misspelled key (e.g. `minSCTs`) would otherwise read as
+  // undefined and silently default to the RFC floor of 1, applying a weaker policy than the caller asked
+  // for. The values are validated by verifySctList when the gate runs.
+  // Validate the whole CT configuration at entry, independent of whether the target carries an SCT
+  // extension, so a malformed policy or log-list is always path/bad-input -- never masked as a
+  // per-certificate path/ct-required just because the target happens to lack SCTs.
+  if (opts.ctLogList != null) {
+    if (typeof opts.ctLogList !== "object" || opts.ctLogList.byLogId == null) throw E("path/bad-input", "validate: opts.ctLogList must be a pki.ct.parseLogList result");
+    var ctp = guard.identifier.optionsObject(opts.ctPolicy, E, "path/bad-input", "validate: opts.ctPolicy");
+    guard.identifier.assertKnownKeys(ctp, { minScts: 1, minOperators: 1 }, E, "path/bad-input", "validate: opts.ctPolicy has an unknown key (the CT policy keys are minScts / minOperators): ");
+    if (ctp.minScts != null && (typeof ctp.minScts !== "number" || !intrinsic.isInteger(ctp.minScts) || ctp.minScts < 1)) throw E("path/bad-input", "validate: opts.ctPolicy.minScts must be a positive integer");
+    if (ctp.minOperators != null && (typeof ctp.minOperators !== "number" || !intrinsic.isInteger(ctp.minOperators) || ctp.minOperators < 1)) throw E("path/bad-input", "validate: opts.ctPolicy.minOperators must be a positive integer");
+  }
   if (!intrinsic.isArray(path)) throw E("path/bad-input", "validate: path must be an array of certificates");
   // Bound the per-cert asymmetric-verify work BEFORE parsing an untrusted bundle
   // (the policy-tree cap guards CVE-2023-0464-style blow-up; this guards linear
@@ -1606,6 +1664,15 @@ async function validate(path, opts) {
     failed = true;
   }
 
+  // Opt-in CT gate: verify the target's embedded SCTs and record the verdict on its checks (RFC 6962).
+  if (opts.ctLogList != null) {
+    var ctCheck = await ctGateCheck(certs[n - 1], certs, anchor, opts.ctLogList, opts.ctPolicy || {}, n, opts.time);
+    var target = null;
+    for (var tr = 0; tr < state.results.length; tr++) { if (state.results[tr].index === n - 1) { target = state.results[tr]; break; } }
+    if (target) intrinsic.push(target.checks, ctCheck);
+    if (!ctCheck.ok) failed = true;
+  }
+
   return {
     valid: !failed,
     // What the revocation rule and the anchor's own trust metadata actually decided. `valid` alone
@@ -2369,6 +2436,10 @@ crmfVerify.setEngine(_verifyWithSpki);
 // same way.
 attrcertVerify.setEngine(_verifyWithSpki);
 
+// And for a signed OCSPRequest (RFC 6960 sec. 4.1.1), so pki.ocsp.verifyRequest checks a requestor's
+// signature through the same one engine that verifies a response, never a second, weaker request path.
+ocspRequestVerify.setEngine(_verifyWithSpki);
+
 // ---- the OCSP revocation checker (RFC 6960) -------------------------------
 
 // The OCSP response-verification core (responder authorization + CertID binding + currency +
@@ -3346,7 +3417,7 @@ async function _fetchAiaIssuers(current, aia) {
  * @primitive  pki.path.build
  * @signature  pki.path.build(leaf, opts) -> Promise<{ valid, path, trustAnchor, result, candidatesConsidered, aiaFetches }>
  * @since       0.3.7
- * @status      experimental
+ * @status      stable
  * @spec        RFC 4158, RFC 5280
  * @related     pki.path.validate, pki.schema.x509.parse, pki.trust.parseCertdata
  *

package/lib/schema-c509.js

@@ -2014,7 +2014,7 @@ function _reconstructDer(r, sigNode) {
  * @primitive  pki.schema.c509.parse
  * @signature  pki.schema.c509.parse(bytes) -> { certificateType, serialNumber, serialNumberHex, ... }
  * @since      0.2.30
- * @status     experimental
+ * @status     stable
  * @spec       draft-ietf-cose-cbor-encoded-cert, RFC 8949, RFC 9090, RFC 5280
  *
  * Decode a C509 certificate (draft-ietf-cose-cbor-encoded-cert) from its deterministic-CBOR bytes.
@@ -2274,7 +2274,7 @@ function _encodeC509Array(r) {
  * @primitive  pki.schema.c509.encode
  * @signature  pki.schema.c509.encode(input[, opts]) -> Buffer
  * @since      0.3.4
- * @status     experimental
+ * @status     stable
  * @spec       draft-ietf-cose-cbor-encoded-cert, RFC 8949, RFC 9090
  * @related    pki.schema.c509.parse
  *

package/lib/schema-cmc.js

@@ -667,7 +667,7 @@ function _finishBody(body, where) {
  * @primitive  pki.schema.cmc.parsePkiData
  * @signature  pki.schema.cmc.parsePkiData(der) -> parsed
  * @since      0.4.16
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5272 sec. 3.2.1
  * @related    pki.schema.cmc.parse, pki.schema.cmc.parsePkiResponse
  *
@@ -695,7 +695,7 @@ function parsePkiData(input) {
  * @primitive  pki.schema.cmc.parsePkiResponse
  * @signature  pki.schema.cmc.parsePkiResponse(der) -> parsed
  * @since      0.4.16
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5272 sec. 4.2.1
  * @related    pki.schema.cmc.parse, pki.schema.cmc.parsePkiData
  *
@@ -721,7 +721,7 @@ function parsePkiResponse(input) {
  * @primitive  pki.schema.cmc.parse
  * @signature  pki.schema.cmc.parse(input) -> parsed
  * @since      0.4.16
- * @status     experimental
+ * @status     stable
  * @spec       RFC 5272, RFC 6402
  * @defends    cmc-status-confusion (CWE-20)
  * @related    pki.schema.cmc.parsePkiData, pki.schema.cmc.parsePkiResponse, pki.cms.verify

package/lib/sigstore.js

@@ -104,7 +104,7 @@ function _jsonParse(input, code, label) {
  * @primitive pki.sigstore.pae
  * @signature pki.sigstore.pae(payloadType, payloadBytes) -> Buffer
  * @since 0.2.3
- * @status experimental
+ * @status stable
  * @spec DSSE
  * @related pki.sigstore.verifyBundle
  *
@@ -150,7 +150,7 @@ function _b64(s, label) {
  * @primitive pki.sigstore.parseBundle
  * @signature pki.sigstore.parseBundle(input) -> bundle
  * @since 0.2.3
- * @status experimental
+ * @status stable
  * @spec Sigstore bundle v0.3
  * @related pki.sigstore.verifyBundle
  *
@@ -637,7 +637,7 @@ function _statement(payload, payloadType, expectedPredicate) {
  * @primitive pki.sigstore.verifyBundle
  * @signature pki.sigstore.verifyBundle(bundle, opts) -> Promise<result>
  * @since 0.2.3
- * @status experimental
+ * @status stable
  * @spec DSSE, Sigstore bundle v0.3, RFC 9162, SLSA provenance v1
  * @related pki.sigstore.parseBundle, pki.sigstore.pae
  *

package/lib/webauthn.js

@@ -1939,7 +1939,7 @@ var CLIENT_DATA_TYPE = Object.assign(Object.create(null), { "webauthn.create": 1
  * @primitive pki.webauthn.parseClientData
  * @signature pki.webauthn.parseClientData(bytes, opts?) -> { type, challenge, origin, crossOrigin, topOrigin, checked }
  * @since 0.5.0
- * @status experimental
+ * @status stable
  * @spec W3C WebAuthn Level 3 sec. 5.8.1 / 7.1 / 7.2
  * @defends webauthn-ceremony-confusion (CWE-345)
  * @related pki.webauthn.verify, pki.webauthn.verifyAssertion
@@ -2126,7 +2126,7 @@ var _CLIENT_DATA_OPTS = Object.assign(Object.create(null), {
  * @primitive pki.webauthn.parseAuthenticatorData
  * @signature pki.webauthn.parseAuthenticatorData(bytes) -> { rpIdHash, flags, signCount, aaguid, credentialId, credentialPublicKey, credentialPublicKeyBytes, extensions }
  * @since 0.5.0
- * @status experimental
+ * @status stable
  * @spec W3C WebAuthn Level 3 sec. 6.1
  * @related pki.webauthn.verifyAssertion, pki.webauthn.parseAttestationObject
  *
@@ -2164,7 +2164,7 @@ var _ASSERT_OPTS = Object.assign(Object.create(null), {
  * @primitive pki.webauthn.verifyAssertion
  * @signature pki.webauthn.verifyAssertion(input) -> Promise<{ signatureVerified, signCount, signCountChecked, flags, rpIdHash, extensions, bindingChecked, clientData }>
  * @since 0.5.0
- * @status experimental
+ * @status stable
  * @spec W3C WebAuthn Level 3 sec. 7.2
  * @defends webauthn-assertion-forgery (CWE-347)
  * @related pki.webauthn.parseAuthenticatorData, pki.webauthn.verify

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.5.39",
+  "version": "0.6.1",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:fc9ede9f-ba2d-47e7-b43e-add5f0d3de40",
+  "serialNumber": "urn:uuid:1d7ac08a-caae-46f2-b074-9a7c370ea22f",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-30T04:06:00.042Z",
+    "timestamp": "2026-08-30T12:52:47.496Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.5.39",
+      "bom-ref": "@blamejs/pki@0.6.1",
       "type": "application",
       "name": "pki",
-      "version": "0.5.39",
+      "version": "0.6.1",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.5.39",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.1",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.5.39",
+      "ref": "@blamejs/pki@0.6.1",
       "dependsOn": []
     }
   ]