@blamejs/pki 0.5.4 → 0.5.5

package/lib/trust.js

@@ -289,7 +289,7 @@ function _trustEntry(obj) {
 
 function _mkAnchor(cert, meta) {
   var spki = cert.subjectPublicKeyInfo;
-  return {
+  var entry = {
     name: cert.subject,                    // the object with .rdns (name chaining)
     publicKey: spki.bytes,                 // the full SPKI SEQUENCE TLV
     algorithm: spki.algorithm.oid,         // the SPKI public-key algorithm OID
@@ -300,6 +300,76 @@ function _mkAnchor(cert, meta) {
     label: meta.label,
     mozillaCaPolicy: meta.mozillaCaPolicy,
   };
+  // A trust anchor IS the pair (name, key) -- RFC 5280 sec. 6.1.1 -- so those two fields are one
+  // fact about one certificate, and they were derived here from one. `anchor()` re-derives them
+  // rather than reading them back, so an entry rebuilt with a substituted key cannot carry the
+  // store's NAME and its per-purpose trust metadata over to a key the store never vouched for.
+  // Recorded off the object, so rebuilding the entry loses the record along with the binding.
+  // COPIED, not aliased. The record and the entry would otherwise hold the same Buffer and the same
+  // name object, so overwriting the entry's publicKey in place -- otherSpki.copy(entry.publicKey)
+  // for an equal-length key -- would overwrite the record with it, and re-deriving would hand back
+  // exactly the substituted key. A record that changes with the thing it is meant to pin is not one.
+  //
+  // The store's METADATA is recorded with them, and for the stronger reason: `purposes` IS the
+  // authorization -- it is what the purpose gate reads to decide whether this root may vouch for
+  // TLS -- and `distrustAfter` is the date that authorization ends. Pinning the key while reading
+  // the authorization off the mutable entry pins the less important half: `entry.purposes.serverAuth
+  // = true` would then produce a server-auth anchor from a root the store marked for e-mail only,
+  // and deleting a distrust date would outlast the store's own policy. Everything the anchor asserts
+  // now comes from what the store read.
+  _DERIVED_FROM.set(entry, {
+    // The RDN entries are copied too, not just the arrays holding them: a shallow slice shares
+    // every attribute object, so editing one in place would still reach the record.
+    name: _copyName(cert.subject),
+    publicKey: Buffer.from(spki.bytes),
+    algorithm: spki.algorithm.oid,
+    parameters: spki.algorithm.parameters == null ? spki.algorithm.parameters : Buffer.from(spki.algorithm.parameters),
+    purposes: _copyPurposes(meta.purposes),
+    distrustAfter: _copyDistrustAfter(meta.distrustAfter),
+  });
+  return entry;
+}
+var _DERIVED_FROM = new WeakMap();
+
+// The per-purpose distrust dates, with fresh Date objects. A Date is mutable, so handing back the
+// entry's own would let a consumer move the date this anchor is judged against.
+// The three trust bits, normalized to booleans. Read by the purpose gate and handed back on every
+// anchor, so it is built fresh from whichever source is authoritative rather than shared.
+function _copyPurposes(src) {
+  return {
+    serverAuth: !!src && src.serverAuth === true,
+    emailProtection: !!src && src.emailProtection === true,
+    codeSigning: !!src && src.codeSigning === true,
+  };
+}
+
+function _copyDistrustAfter(src) {
+  var out = {};
+  if (!src || typeof src !== "object") return out;
+  Object.keys(src).forEach(function (k) {
+    out[k] = src[k] instanceof Date ? new Date(src[k].getTime()) : src[k];
+  });
+  return out;
+}
+
+// A parsed Name, copied FAITHFULLY: every field the parser assigns, at every level, with nothing
+// mutable shared. Used on both sides of the record -- writing it in and handing it out -- so
+// neither direction shares an object with the caller.
+//
+// Faithful rather than "the fields the path validator reads", because this Name is handed back on
+// pki.trust.anchor and is the same structure pki.schema.x509.parse produces. A copy that keeps the
+// subset one consumer needs silently degrades it for every other reader -- an attribute would lose
+// its registry `name`, so a caller walking anchor.name.rdns would see a different shape depending
+// on whether the anchor came from a store entry or straight from the parser. Each attribute value
+// is a string and so needs no copy of its own; the DER does.
+function _copyName(name) {
+  if (!name || !Array.isArray(name.rdns)) return name;
+  var out = Object.assign({}, name);
+  out.rdns = name.rdns.map(function (rdn) {
+    return Array.isArray(rdn) ? rdn.map(function (atv) { return Object.assign({}, atv); }) : rdn;
+  });
+  out.bytes = Buffer.isBuffer(name.bytes) ? Buffer.from(name.bytes) : name.bytes;
+  return out;
 }
 
 function _datesEqual(x, y) {
@@ -700,26 +770,67 @@ function parseCcadbCsv(text) {
  *     { time: new Date("2026-06-01T00:00:00Z"), trustAnchor: anchor, checkPurpose: "serverAuth" });
  */
 function anchor(entry, opts) {
-  if (!entry || typeof entry !== "object" || !Buffer.isBuffer(entry.publicKey) ||
-      typeof entry.algorithm !== "string" || !entry.name || !Array.isArray(entry.name.rdns)) {
+  if (!entry || typeof entry !== "object") {
     throw E("trust/bad-input", "anchor expects a trust-store entry ({ name, publicKey, algorithm, ... })");
   }
   opts = opts || {};
+  // Where this entry came from a store, everything the anchor asserts is read from the record the
+  // store minted, not from the entry -- the entry is a plain object the caller holds and can write
+  // to. `purposes` is the authorization itself, so an entry whose serverAuth bit was flipped after
+  // parsing must not open the gate, and a distrust date deleted from it must not outlive the
+  // store's policy.
+  var derived = _DERIVED_FROM.get(entry);
+  var meta = derived || entry;
+  // The tuple-shape check runs on the ENTRY only when there is no record, because only then are the
+  // entry's own fields what the anchor is built from. With a record, an entry a caller has since
+  // emptied still anchors to exactly what the store read: the answer does not depend on the object
+  // the caller is holding, in either direction. Without one, the caller is asserting a bare
+  // (name, key) anchor of their own and its shape is what there is to check.
+  if (!derived && (!Buffer.isBuffer(entry.publicKey) || typeof entry.algorithm !== "string" ||
+      !entry.name || !Array.isArray(entry.name.rdns))) {
+    throw E("trust/bad-input", "anchor expects a trust-store entry ({ name, publicKey, algorithm, ... })");
+  }
   if (opts.purpose !== undefined) {
     if (PURPOSES.indexOf(opts.purpose) === -1) {
       throw E("trust/bad-input", "anchor: opts.purpose must be one of " + PURPOSES.join(" | "));
     }
-    if (!entry.purposes || entry.purposes[opts.purpose] !== true) {
+    if (!meta.purposes || meta.purposes[opts.purpose] !== true) {
       throw E("trust/purpose-not-trusted", "this root is not a trusted delegator for " + opts.purpose);
     }
   }
+  // Where this entry came from a store, the (name, key) pair is re-derived from the certificate it
+  // was read out of rather than read back off the entry. Both halves are one fact about one
+  // certificate, so an entry rebuilt with a substituted publicKey would otherwise carry the store's
+  // name and its per-purpose trust metadata onto a key the store never vouched for. An entry a
+  // caller built themselves has no such record and is their own assertion, which is what a bare
+  // trust-anchor tuple is.
+  //
+  // An entry carrying the store's METADATA is claiming to be a store entry. The metadata is the
+  // root program's statement -- these purposes, until this date -- and it is a statement about a
+  // KEY. Without the record there is nothing binding it to the key the entry now names, so a copy
+  // with a substituted publicKey would carry the program's word onto a key it never saw. A caller
+  // asserting a bare (name, key) anchor of their own carries no metadata and is unaffected.
+  if (!derived && (entry.purposes != null || (entry.distrustAfter && Object.keys(entry.distrustAfter).length))) {
+    throw E("trust/bad-input", "this entry carries a trust store's per-purpose metadata but is not the entry the store produced -- it has been rebuilt, and the metadata is a statement about the key the store read, not about whichever key the copy now names. Pass pki.trust.parseCertdata / parseCcadbCsv output unmodified");
+  }
+  // Copies OUT as well as in. Handing back the record's own Buffer lets a consumer write through
+  // the returned anchor into the record -- copy an equal-length SPKI over anchor.publicKey and the
+  // next anchor() call re-derives the substituted key while still carrying the store's purposes and
+  // distrust dates. Guarding only the write INTO the record leaves the same door open in the other
+  // direction, so every call hands back fresh values.
   return {
-    name: entry.name,
-    publicKey: entry.publicKey,
-    algorithm: entry.algorithm,
-    parameters: entry.parameters !== undefined ? entry.parameters : null,
-    distrustAfter: entry.distrustAfter || {},
-    purposes: entry.purposes || { serverAuth: false, emailProtection: false, codeSigning: false },
+    name: _copyName(meta.name),
+    publicKey: Buffer.isBuffer(meta.publicKey) ? Buffer.from(meta.publicKey) : meta.publicKey,
+    algorithm: meta.algorithm,
+    parameters: Buffer.isBuffer(meta.parameters) ? Buffer.from(meta.parameters)
+      : (meta.parameters !== undefined ? meta.parameters : null),
+    // The METADATA comes from the same source as the key, and is copied for the same reason on the
+    // way out: handing back the record's own object let a consumer write
+    // `anchor(entry).purposes.serverAuth = true` and have the next call pass a gate the store never
+    // opened. `distrustAfter` holds Dates, which are mutable in the same way. Everything on this
+    // object is fresh, so two anchors from one entry share nothing.
+    distrustAfter: _copyDistrustAfter(meta.distrustAfter),
+    purposes: _copyPurposes(meta.purposes),
   };
 }
 

package/lib/validator-cose.js

@@ -156,6 +156,90 @@ function credentialKey(node, E, code, unsupportedCode) {
   // CANONICAL CTAP2 COSE_Key: exactly the type's parameters, nothing more.
   var expectedParams = kty === 2n ? 5 : 4;
   if (node.children.length !== expectedParams) throw bad("the COSE_Key carries parameters beyond the canonical set for its key type (WebAuthn sec. 6.5.1)");
+  return assertKeyMaterial(key, E, code, unsupportedCode);
+}
+
+// assertKeyMaterial(key, E, code, unsupportedCode) -> key | throws
+//
+// The rules about the KEY, split from the rules about its CBOR encoding, because the
+// toolkit accepts a stored credential key in two forms and both reach a signature
+// verification. `pki.webauthn.verifyAssertion` takes the COSE bytes or the object
+// `pki.webauthn.verify` returned; the bytes went through every check below and the
+// object went through none, so the same 1-byte modulus was refused as a credential key
+// in one form and imported for verification in the other. A caller stores whichever
+// form their datastore round-trips, which is not a choice about how carefully their
+// credential is checked.
+//
+// Everything above this line is about the ENCODING -- a CBOR map, integer labels, byte
+// strings, the canonical parameter count -- and can only be asked of bytes. Everything
+// here is about the key, and is asked of both.
+//
+// @enforced-by behavioral -- key-material rules have no rename-proof code shape distinct
+//   from ordinary length and byte comparisons; the RED vectors that drive BOTH accepted
+//   forms of a stored credential key (the COSE bytes and the object) through
+//   pki.webauthn.verifyAssertion with an undersized modulus, e = 1, a curve/length
+//   mismatch and a short OKP x are the guard.
+function assertKeyMaterial(key, E, code, unsupportedCode) {
+  function bad(msg, cause) { return new E(code, msg, cause); }
+  if (!key || typeof key !== "object") throw bad("a credential key must be a decoded COSE_Key object");
+  // ONE read of each field, into a plain object, before anything is checked or used.
+  //
+  // The object form comes from the caller, so any of these can be an accessor. One that THROWS
+  // turns a validation into a raw fault -- the thing this function exists to prevent -- and one
+  // that returns DIFFERENT values on successive reads makes the field that was checked and the
+  // field that is used two different values, which is the check defeated rather than merely
+  // reported badly. Reading each exactly once settles both, and settles them for every field
+  // rather than for the ones a particular branch happens to reach.
+  try {
+    key = { kty: key.kty, alg: key.alg, crv: key.crv, x: key.x, y: key.y, n: key.n, e: key.e };
+  } catch (e) { throw bad("a credential key field could not be read", e); }
+  // Then the TYPE and the VALUE. BigInt() throws a raw TypeError on a Symbol and on undefined, and
+  // a raw RangeError on a fractional or non-finite number, so "it is a number" is not the check --
+  // "it is an integer" is. EVERY integer label the branches below read, not the two the dispatch
+  // happens to need first:
+  // crv indexes a lookup table, and a Symbol thrown at a property read is the same raw fault as a
+  // Symbol thrown at BigInt(). The decoded form gets these from the CBOR reader, which has already
+  // established them; the object form gets them from the caller, so this is where they are settled.
+  // A BigInt is bounded too. COSE labels are small registry integers, and an unbounded one converts
+  // to Infinity, which then throws a raw RangeError at the next conversion -- the same defeat as a
+  // fractional number, reached by a value that IS an integer. "It is an integer" is not the whole
+  // check either; "it is an integer this code can carry" is.
+  var MAX = BigInt(Number.MAX_SAFE_INTEGER);
+  function _isInt(v) {
+    if (typeof v === "bigint") return v <= MAX && v >= -MAX;
+    return typeof v === "number" && Number.isSafeInteger(v);
+  }
+  if (!_isInt(key.kty)) throw bad("a COSE_Key kty (label 1) must be an integer");
+  if (!_isInt(key.alg)) throw bad("a COSE_Key alg (label 3) must be an integer");
+  if (key.crv !== undefined && key.crv !== null && !_isInt(key.crv)) throw bad("a COSE_Key crv (label -1) must be an integer");
+  // ONE representation from here down. A label may arrive as a Number or a BigInt -- a CBOR reader
+  // hands out BigInt, an object built in JavaScript is likelier to hold Number -- and everything
+  // below compares with === against the Number-keyed profile table and the curve tables. Accepting
+  // both forms at the gate and then comparing only one is a check that answers by how the caller
+  // happened to spell the value; the decoded arm normalizes here too, for the same reason.
+  key.kty = Number(key.kty);
+  key.alg = Number(key.alg);
+  if (key.crv !== undefined && key.crv !== null) key.crv = Number(key.crv);
+  var kty = BigInt(key.kty);
+  if (kty === 2n) {
+    var el2 = EC2_CRV_LEN[key.crv];
+    if (!Buffer.isBuffer(key.x) || !Buffer.isBuffer(key.y)) throw bad("an EC2 COSE_Key must carry crv (-1), x (-2), and y (-3)");
+    if (!el2 || key.x.length !== el2 || key.y.length !== el2) throw bad("an EC2 COSE_Key x/y length is inconsistent with its curve");
+  } else if (kty === 1n) {
+    var okp2 = OKP_CRV[key.crv];
+    if (!okp2 || !Buffer.isBuffer(key.x) || key.x.length !== okp2.len) throw bad("an OKP COSE_Key must be Ed25519 (crv 6) or Ed448 (crv 7) with a matching-length x (-2)");
+  } else if (kty === 3n) {
+    if (!Buffer.isBuffer(key.n) || !key.n.length || !Buffer.isBuffer(key.e) || !key.e.length) throw bad("an RSA COSE_Key must carry n (-1) and e (-2)");
+    if (key.n[0] === 0) throw bad("an RSA COSE_Key modulus (-1) must be minimally encoded, with no leading zero byte (RFC 8230 sec. 4)");
+    if (key.e[0] === 0) throw bad("an RSA COSE_Key exponent (-2) must be minimally encoded, with no leading zero byte (RFC 8230 sec. 4)");
+    var bits = _modulusBits(key.n);
+    if (bits < RSA_MIN_MODULUS_BITS) throw bad("an RSA COSE_Key modulus (-1) is " + bits + " bits, below the " + RSA_MIN_MODULUS_BITS + "-bit minimum");
+    if (key.e.length > RSA_MAX_EXPONENT_BYTES) throw bad("an RSA COSE_Key exponent (-2) is longer than " + RSA_MAX_EXPONENT_BYTES + " bytes");
+    if ((key.e[key.e.length - 1] & 1) === 0) throw bad("an RSA COSE_Key exponent (-2) must be odd");
+    if (key.e.length === 1 && key.e[0] <= 1) throw bad("an RSA COSE_Key exponent (-2) must be greater than 1 -- e = 1 makes RSA the identity function");
+  } else {
+    throw bad("unsupported COSE_Key kty " + Number(key.kty));
+  }
   // PROFILE: the declared alg must match the key type (and, for EC2, the curve).
   var prof = ALG_PROFILE[String(key.alg)];
   // An algorithm this verifier does not implement is NOT a malformed key. The key can be perfectly
@@ -173,7 +257,7 @@ function credentialKey(node, E, code, unsupportedCode) {
   // OpenSSL does NOT validate an OKP (Ed25519/Ed448) point on import -- an all-zeroes key
   // parses, and even verifies a trivial signature -- so an OKP point needs an explicit
   // on-curve + full-order (non-low-order) check (RFC 8032 decode + the cofactor check).
-  if (kty === 1n && !edwardsPoint.validate(key.x, key.crv)) throw bad("the OKP credential public key is not a valid, full-order Edwards point");
+  if (Number(key.kty) === 1 && !edwardsPoint.validate(key.x, key.crv)) throw bad("the OKP credential public key is not a valid, full-order Edwards point");
   return key;
 }
 
@@ -216,6 +300,7 @@ function toSpki(key, E, code) {
 
 module.exports = {
   credentialKey: credentialKey,
+  assertKeyMaterial: assertKeyMaterial,
   toSpki: toSpki,
   EC2_CRV_LEN: EC2_CRV_LEN,
   EC2_CRV_OID: EC2_CRV_OID,

package/lib/validator-tpm.js

@@ -221,12 +221,17 @@ function normalizeObjectAttributePolicy(policy, E, code) {
       // either of which could match a key this policy was written to exclude, including the
       // Empty Policy. An entry that is not a Buffer or a canonical even-length hex string is a
       // caller error, and it fails here rather than becoming a digest nobody intended.
+      // Through guard.encoding.hex, which owns the alphabet, the even-length rule and the
+      // canonical round-trip -- the same three checks written here by hand, and now written
+      // once. It also decodes, so the hex path cannot validate one string and decode another.
       allow = ap.allow.map(function (entry, i) {
         if (Buffer.isBuffer(entry)) return entry;
-        if (typeof entry !== "string" || entry.length === 0 || entry.length % 2 !== 0 || !/^[0-9a-fA-F]+$/.test(entry)) {
-          throw new E(code, "opts.tpmPolicy.authPolicy.allow[" + i + "] must be a Buffer or an even-length hex string");
+        var label = "opts.tpmPolicy.authPolicy.allow[" + i + "]";
+        if (typeof entry !== "string" || entry.length === 0) {
+          throw new E(code, label + " must be a Buffer or an even-length hex string");
         }
-        return Buffer.from(entry, "hex");
+        return guard.encoding.hex(entry, null, function (c, m) { return new E(c, m); }, code,
+          label + " must be a Buffer or an even-length hex string --");
       });
     }
   }

package/lib/webauthn-mds.js

@@ -212,24 +212,16 @@ function _isAnchorItself(cert, anchor) {
 // a hand-built object literal satisfies it too and then raises a raw TypeError from deep inside the
 // path validator, which is an untyped throw escaping a public verb.
 function _asCert(v, label) {
-  // A certificate arriving as BYTES arrives in whichever byte form the caller holds -- the same set
-  // every other byte argument in this namespace takes. A DataView or an ArrayBuffer over identical
-  // DER is the identical certificate, and refusing one of them makes the accepted set depend on how
-  // the caller happened to receive the file rather than on what it contains.
-  if (ArrayBuffer.isView(v) || v instanceof ArrayBuffer) {
-    v = guard.bytes.source(v, WebauthnError, "webauthn/bad-input", label);
-  }
-  if (v && typeof v === "object" && !Buffer.isBuffer(v) && !(v instanceof Uint8Array) &&
-      v.subject && v.subjectPublicKeyInfo && Buffer.isBuffer(v.subjectPublicKeyInfo.bytes) &&
-      v.signatureAlgorithm && typeof v.signatureAlgorithm.oid === "string" &&
-      // `validity` is what separates a certificate from the other signed structures that carry a
-      // subject, a public key and a signature algorithm: a parsed certification request has all
-      // three and would otherwise be installed as a trust anchor.
-      v.validity && v.validity.notBefore !== undefined) {
-    return v;
-  }
-  try { return x509.parse(v); }
-  catch (e) { throw _err("webauthn/bad-input", label + " is not a decodable certificate", e); }
+  // Through the shared certificate door: these become the anchors a metadata BLOB's signer chain is
+  // judged against, and an anchor's identity is its subject and its key. A caller-assembled object
+  // could carry a real root's subject beside a substituted key -- every field well-formed, nothing
+  // for a shape test to catch -- so the object is re-derived from the bytes its parser read instead.
+  // Bytes in any form (a Buffer, a typed-array view, a DataView, an ArrayBuffer) are parsed here;
+  // refusing one of those would make the accepted set depend on how the caller received the file.
+  return guard.parsed.acceptDerived(v, "certificate", function (bytes) {
+    try { return x509.parse(bytes); }
+    catch (e) { throw _err("webauthn/bad-input", label + " is not a decodable certificate", e); }
+  }, _err, "webauthn/bad-input", label);
 }
 
 // Verify a FIDO Metadata Service BLOB and return its entries indexed for lookup. `blob` is the

package/lib/webauthn.js

@@ -572,8 +572,13 @@ function _snapshotRoots(supplied) {
     if (_isBufferSource(root)) {
       return guard.bytes.snapshotSource(root, WebauthnError, "webauthn/bad-input", "opts.rootCertificates[]");
     }
-    if (root && typeof root === "object") return _cloneParsed(root, 0);
-    return root;   // a PEM string is immutable
+    // A PARSED certificate is kept AS IT IS, not deep-copied. The copy was this function's way of
+    // stopping a caller mutating a root after it was accepted, and it solved that by making a
+    // detached twin -- which loses the parser's record, so the door below could no longer re-derive
+    // the anchor from the bytes it was read from. The record is the stronger form of the same
+    // protection: the anchor is re-parsed from those bytes, so an edit made afterwards, at any depth,
+    // is discarded rather than copied. Cloning would trade that for a snapshot of a mutable object.
+    return root;   // a PEM string is immutable; a parsed certificate carries its own provenance
   });
 }
 
@@ -592,13 +597,16 @@ function _applyCallerRoots(res, supplied, vopts, onlyPaths) {
   // would fault on a field it does not have rather than naming the caller's mistake.
   // The same three forms opts.safetyNetRoots takes, since it is the same question.
   var roots = supplied.map(function (root, i) {
-    var cert;
-    try { cert = _isBufferSource(root) ? x509.parse(guard.bytes.source(root, WebauthnError, "webauthn/bad-input", "opts.rootCertificates[" + i + "]")) : (typeof root === "string" ? x509.parse(root) : root); }
-    catch (e) { throw _err("webauthn/bad-input", "opts.rootCertificates[" + i + "] is not a decodable certificate", e); }
-    if (!cert || !cert.subject || !cert.subjectPublicKeyInfo) {
-      throw _err("webauthn/bad-input", "opts.rootCertificates[" + i + "] is not a certificate");
-    }
-    return cert;
+    var label = "opts.rootCertificates[" + i + "]";
+    // These BECOME trust anchors, which is the sharpest form of the rule: the anchor's key is what
+    // the whole attestation chain is judged against, so a caller-assembled certificate carrying a
+    // real root's name beside a substituted key would anchor an attacker's chain. Re-derived from
+    // the bytes its parser read, exactly as at every other certificate door.
+    return guard.parsed.acceptDerived(root, "certificate", function (bytes) {
+      try {
+        return x509.parse(_isBufferSource(bytes) ? guard.bytes.source(bytes, WebauthnError, "webauthn/bad-input", label) : bytes);
+      } catch (e) { throw _err("webauthn/bad-input", label + " is not a decodable certificate", e); }
+    }, _err, "webauthn/bad-input", label);
   });
   // Same rule the metadata route applies: a compound element carrying no
   // certificates makes no claim there is anything to anchor, so it is not a reason to
@@ -1174,14 +1182,15 @@ function _safetyNetHostnameOk(leaf) {
 function _safetyNetChainTrusted(chain, roots, time) {
   var anchors;
   try {
+    // The same door opts.rootCertificates goes through, for the same reason: these become trust
+    // anchors, and an anchor's key is what the chain is judged against.
     anchors = roots.map(function (root, i) {
-      var anchorCert;
-      try { anchorCert = _isBufferSource(root) ? x509.parse(guard.bytes.source(root, WebauthnError, "webauthn/bad-input", "opts.safetyNetRoots[" + i + "]")) : (typeof root === "string" ? x509.parse(root) : root); }
-      catch (e) { throw _err("webauthn/bad-input", "opts.safetyNetRoots[" + i + "] is not a decodable certificate", e); }
-      if (!anchorCert || !anchorCert.subject || !anchorCert.subjectPublicKeyInfo) {
-        throw _err("webauthn/bad-input", "opts.safetyNetRoots[" + i + "] is not a certificate");
-      }
-      return anchorCert;
+      var label = "opts.safetyNetRoots[" + i + "]";
+      return guard.parsed.acceptDerived(root, "certificate", function (bytes) {
+        try {
+          return x509.parse(_isBufferSource(bytes) ? guard.bytes.source(bytes, WebauthnError, "webauthn/bad-input", label) : bytes);
+        } catch (e) { throw _err("webauthn/bad-input", label + " is not a decodable certificate", e); }
+      }, _err, "webauthn/bad-input", label);
     });
   } catch (e) { return Promise.reject(e); }
   return mds.chainToAnchor(chain, anchors, time === undefined ? new Date() : time,
@@ -2228,7 +2237,13 @@ function _snapshotAssertion(input) {
     var key = {}, kk;
     for (kk in out.credentialPublicKey) {
       if (!Object.prototype.hasOwnProperty.call(out.credentialPublicKey, kk)) continue;
-      var v = out.credentialPublicKey[kk];
+      // The read itself can fault: a stored key is a caller-supplied object, so a field may be an
+      // accessor, and one that THROWS would escape as a raw error from the very copy whose job is
+      // to make the descriptor stop being the caller's. The copy is the boundary, so the fault is
+      // named here rather than surfacing from wherever the field was later used.
+      var v;
+      try { v = out.credentialPublicKey[kk]; }
+      catch (e) { throw _err("webauthn/bad-cose-key", "credentialPublicKey." + kk + " could not be read", e); }
       key[kk] = _isBufferSource(v) ? guard.bytes.snapshotSource(v, WebauthnError, "webauthn/bad-input", "credentialPublicKey." + kk) : v;
     }
     out.credentialPublicKey = key;
@@ -2295,7 +2310,14 @@ function verifyAssertion(input) {
     var coseKey = input.credentialPublicKey;
     if (Buffer.isBuffer(coseKey) || ArrayBuffer.isView(coseKey) || coseKey instanceof ArrayBuffer) {
       coseKey = parseCoseKey(coseKey);
-    } else if (!_isPlainObject(coseKey)) {
+    } else if (_isPlainObject(coseKey)) {
+      // The OBJECT form is held to the same rules about the KEY as the bytes form. The bytes went
+      // through the curve/length, RSA modulus-floor and exponent checks; the object went through
+      // none, so one stored credential was refused in one form and imported for signature
+      // verification in the other. Which form a relying party stores is a question about what their
+      // datastore round-trips, not about how carefully their credential is checked.
+      coseKey = validator.cose.assertKeyMaterial(coseKey, WebauthnError, "webauthn/bad-cose-key", "webauthn/unsupported-algorithm");
+    } else {
       throw _err("webauthn/bad-input", "credentialPublicKey must be the stored COSE key -- the object pki.webauthn.verify returned, or its COSE bytes");
     }
     var bindingChecked = _applyBindings(authData, coseKey, input);

package/lib/x509-sign.js

@@ -286,8 +286,12 @@ function _sign(spec, issuer, opts) {
     issuerDer = subjectDer;
     issuerSpki = spki;
   } else if (issuer.cert != null) {
-    issuerCert = (Buffer.isBuffer(issuer.cert) || typeof issuer.cert === "string") ? x509.parse(issuer.cert) : issuer.cert;
-    if (!issuerCert || !issuerCert.tbsBytes) throw _err("x509/bad-input", "issuer.cert must be a certificate DER/PEM or a parsed certificate");
+    // The CA-ness gate, the issuer name and the signing key are all read off this object, so a
+    // partial one decides them on fields that are not there.
+    // Re-derived from the bytes its parser read. The issuer certificate's subject and key identifier
+    // are copied into the certificate being signed, so they are a claim about who issued it -- an
+    // assembled object could name an issuer whose bytes the signer never saw.
+    issuerCert = guard.parsed.acceptDerived(issuer.cert, "certificate", x509.parse, _err, "x509/bad-input", "issuer.cert");
     issuerPathLen = _assertIssuerIsCa(issuerCert);
     issuerDer = pkiBuild.tbsNameField(issuerCert, "subject");
     issuerSpki = issuerCert.subjectPublicKeyInfo.bytes;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.5.4",
+  "version": "0.5.5",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",
@@ -13,6 +13,10 @@
     "url": "https://github.com/blamejs/pki/issues"
   },
   "main": "index.js",
+  "exports": {
+    ".": "./index.js",
+    "./package.json": "./package.json"
+  },
   "bin": {
     "pki": "bin/pki.js"
   },

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:38c27a59-75b3-42df-a97a-b59d75f2a0e9",
+  "serialNumber": "urn:uuid:e4afed62-75b0-4b79-b65c-4d16c17ee70b",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-15T08:44:34.920Z",
+    "timestamp": "2026-08-15T23:54:15.184Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.5.4",
+      "bom-ref": "@blamejs/pki@0.5.5",
       "type": "application",
       "name": "pki",
-      "version": "0.5.4",
+      "version": "0.5.5",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.5.4",
+      "purl": "pkg:npm/%40blamejs/pki@0.5.5",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.5.4",
+      "ref": "@blamejs/pki@0.5.5",
       "dependsOn": []
     }
   ]