@blamejs/pki 0.6.11 → 0.6.13

package/CHANGELOG.md

@@ -4,6 +4,31 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.6.13 — 2026-09-01
+
+pki.sigstore.verifyBundle now reports which transparency-log entry attested a bundle: the verdict carries `logIndex` and `logId` so a caller can locate the exact Rekor record it verified against.
+
+### Added
+
+- pki.sigstore.verifyBundle's verdict carries `logIndex` (the attested Rekor entry's global log index) and `logId` (the log's key id, hex) beside `integratedTime`, so a caller can fetch or audit the exact transparency-log record the bundle was verified against instead of re-deriving it.
+
+## v0.6.12 — 2026-08-31
+
+Three verify verbs that returned a bare boolean now return a verdict object naming the checks they had hidden, a canonical `valid` field is present on every object verify verdict so `if (res.valid)` reads the same everywhere, and revocation, digest, and provenance data omitted before is surfaced.
+
+### Added
+
+- Every object verify verdict now carries a canonical `valid` boolean beside its existing terminal, so `if (res.valid)` reads the verdict the same way across the toolkit: pki.sigstore.verifyBundle, pki.csr.verify, pki.crmf.verifyPop (top and per message), pki.attrcert.verify, pki.webauthn.verify, pki.webauthn.verifyAssertion, pki.ocsp.verifyRequest (`valid` is `signed && signatureValid`), pki.ct.verifySctList (`valid` is `policyOk`), and pki.pkcs12.open (`valid` is the store's verified integrity: the password MAC for a password store, or the CMS signature for a public-key store). The existing fields (`verified`, `policyOk`, `macVerified`, and the rest) are unchanged. The multi-state string verdicts (pki.ocsp.verify `status`, pki.scep `status`) keep their terminal and do not gain a `valid` alias, since a boolean cannot carry their states.
+- pki.ocsp.verify and pki.path.verifyOcspResponse surface `revocationTime` (the revocation instant) beside `revocationReason` on a revoked verdict, for long-term validation.
+- pki.cms.verify's primary signer node carries `digestAlgorithm`, the digest the countersignature node already reported, so a caller reading a signer's verdict learns it without a second parse.
+- pki.sigstore.verifyBundle carries `predicateTypeChecked`, so a caller that did not pin `opts.predicateType` learns the in-toto predicate went unverified rather than assuming it was checked.
+
+### Changed
+
+- pki.crl.verify returns `{ valid, issuerMaySign, signatureValid, issuer, code?, reason? }` instead of a bare boolean. The boolean hid whether the signing certificate was this CRL's issuer and asserted `cRLSign` in its keyUsage, so a CRL minted under an end-entity certificate of the same CA verified as that CA's own. `valid` is `issuerMaySign && signatureValid`; the signature is now checked even when the issuer may not sign, so `signatureValid` is always reported. To upgrade, read `res.valid` where you read the boolean. This is a silent break for an unmigrated `if (await pki.crl.verify(...))`, which now reads an object as always-true.
+- pki.pkcs12.verifyMac returns `{ valid, macAlgorithm, macAlgorithmName, iterationCount }` instead of a bare boolean, so a caller can reject a legacy SHA-1 integrity MAC by inspecting `macAlgorithmName` rather than accepting any authenticated store. To upgrade, read `res.valid`. Silent break for an unmigrated boolean test.
+- pki.ct.verifySctWithLogList returns `{ valid, logId, logIdHex, operator, logState, timestamp }` instead of a bare boolean, surfacing which trusted log accepted the SCT and when for a policy decision. To upgrade, read `res.valid`. Silent break for an unmigrated boolean test.
+
 ## v0.6.11 — 2026-08-31
 
 pki.path.validate and pki.tsp.verify now take the trust store under the option name trustAnchors, the spelling the other verify verbs already use, accepting one anchor or an array; and pki.acme.client gains opts.resignKeys, which re-signs a request under an alternative account-key algorithm when a CA reports badSignatureAlgorithm.

package/MIGRATING.md

@@ -14,6 +14,31 @@ The toolkit has no `deprecate()`-marked surface awaiting removal.
 
 Listed newest-first.
 
+### v0.6.12 — `pki.crl.verify, pki.pkcs12.verifyMac, and pki.ct.verifySctWithLogList`
+
+Each returned a bare boolean and now returns a verdict object; read `res.valid` where you read the boolean.
+
+A bare boolean hides which checks ran. Each of these three verbs now returns an object whose
+`valid` field is the boolean it used to return, alongside the checks and data it had dropped:
+
+- `pki.crl.verify` -> `{ valid, issuerMaySign, signatureValid, issuer, code?, reason? }`
+- `pki.pkcs12.verifyMac` -> `{ valid, macAlgorithm, macAlgorithmName, iterationCount }`
+- `pki.ct.verifySctWithLogList` -> `{ valid, logId, logIdHex, operator, logState, timestamp }`
+
+```js
+if (await pki.crl.verify(crl, { cert }))       // used to be the verdict; now an always-true object
+
+var res = await pki.crl.verify(crl, { cert });
+if (res.valid) { /* ... */ }
+```
+
+This is a SILENT break: the old return was a boolean, so an unmigrated `if (await verify(...))`
+reads the new object as truthy and accepts what it used to reject. Switch every such test to
+`res.valid`. The new fields let a caller act on the detail the boolean hid: `pki.crl.verify`
+reports whether the certificate was allowed to sign the CRL (`issuerMaySign`) separately from the
+signature (`signatureValid`); `pki.pkcs12.verifyMac` names the integrity algorithm so a legacy
+SHA-1 MAC can be refused; `pki.ct.verifySctWithLogList` carries the resolved trusted-log record.
+
 ### v0.6.11 — `pki.path.validate(path, opts) and pki.tsp.verify(token, data, opts)`
 
 The trust anchor option is now `trustAnchors` (a single anchor or an array); the former singular `trustAnchor` is removed and refused by name.

package/lib/attrcert-sign.js

@@ -776,7 +776,7 @@ function _unsupportedCritical(ac) {
 
 /**
  * @primitive pki.attrcert.verify
- * @signature pki.attrcert.verify(ac, issuer, opts) -> Promise<{ verified, signatureValid, validityChecked, targetingChecked, revocationChecked, noRevAvail, holderBindingChecked, issuerPathChecked, holder, issuer, attributes, extensions, notBefore, notAfter, serialNumberHex, reason }>
+ * @signature pki.attrcert.verify(ac, issuer, opts) -> Promise<{ valid, verified, signatureValid, validityChecked, targetingChecked, revocationChecked, noRevAvail, holderBindingChecked, issuerPathChecked, holder, issuer, attributes, extensions, notBefore, notAfter, serialNumberHex, reason }>
  * @since 0.5.15
  * @status stable
  * @spec RFC 5755 sec. 5
@@ -949,6 +949,7 @@ function _verify(ac, issuer, opts) {
     noRevAvail: false,
     holderBindingChecked: false,   // item 1 needs the holder's certificate, which this verb is not given
     issuerPathChecked: false,      // items 2 and 3 need the issuer's chain, likewise
+    valid: false,                  // canonical toolkit-wide verdict alias, tracks `verified`
     verified: false,
     reason: undefined,
   };
@@ -1028,6 +1029,7 @@ function _verify(ac, issuer, opts) {
     }
 
     result.verified = true;
+    result.valid = true;
     return result;
   });
 }

package/lib/cms-verify.js

@@ -873,6 +873,9 @@ async function _verify(input, opts) {
     verdict.signedAttributesPresent = !!siOne.signedAttrsBytes;
     // The authenticated attributes themselves, bound to this signer's verdict (read only when ok).
     verdict.signedAttributes = _surfaceSignedAttrs(siOne);
+    // The SignerInfo digestAlgorithm on the primary signer node (the countersignature node already
+    // carries it), so a caller reading a signer's verdict learns the digest without re-parsing.
+    verdict.digestAlgorithm = siOne.digestAlgorithm.name;
     intrinsic.push(signers, verdict);
   }
   // The content type travels with the verdict. An operator applying a policy of their own -- "I only

package/lib/crl-sign.js

@@ -637,7 +637,7 @@ function _issuerMaySign(parsed, cert) {
 
 /**
  * @primitive pki.crl.verify
- * @signature pki.crl.verify(crl, issuer) -> Promise<boolean>
+ * @signature pki.crl.verify(crl, issuer) -> Promise<{ valid, issuerMaySign, signatureValid, issuer, code?, reason? }>
  * @since 0.3.9
  * @status stable
  * @spec RFC 5280 sec. 5.1.1.3, RFC 9814
@@ -648,17 +648,19 @@ function _issuerMaySign(parsed, cert) {
  * is a DER `Buffer`, a PEM string, or a parsed CRL; `issuer` is `{ cert }` (DER/PEM/parsed), `{ publicKey }`
  * (SPKI DER), or a raw SPKI `Buffer`. Verification composes the one path-validation signature engine
  * `pki.path.crlChecker` uses -- the same algorithm-confusion (RFC 9814 sec. 4 key-OID == sig-OID) and
- * EdDSA low-order-point gates -- so there is no second, weaker CRL verifier. It fails closed to `false` on
- * any resolution, import, or verification fault; malformed input throws a typed `CrlError`.
+ * EdDSA low-order-point gates -- so there is no second, weaker CRL verifier. The verdict's `valid` is
+ * `false` on any verification fault, and `signatureValid` reports the signature check on its own; malformed
+ * input throws a typed `CrlError`.
  *
  * Given a certificate in place of a bare key, it also asks what only a certificate can answer: that
  * the certificate is the issuer this CRL names, and that its keyUsage, when it carries one, asserts
- * `cRLSign` (RFC 5280 sec. 4.2.1.3, the same rule this module's signing side already enforces). Either
- * failing is `false`: a statement about the CRL, not about the caller's input, so trying each candidate
- * issuer in turn still works. A signature verifying says only that SOME key signed these bytes; without
- * those two questions a CRL minted under an end-entity certificate of the same CA verified as that CA's.
- * Handed a bare SPKI there is no certificate to carry either restriction, and the signature is all that
- * is checked. Currency and distribution-point scope remain `pki.path.crlChecker`.
+ * `cRLSign` (RFC 5280 sec. 4.2.1.3, the same rule this module's signing side already enforces). Those two
+ * are `issuerMaySign`, reported beside `signatureValid` so a caller sees which held: `valid` is their
+ * conjunction. A signature verifying says only that SOME key signed these bytes, so a bare `valid` boolean
+ * would let a CRL minted under an end-entity certificate of the same CA read as that CA's own. Handed a bare
+ * SPKI there is no certificate to carry either restriction, so `issuerMaySign` is `true` and only the
+ * signature is checked. `issuer` is the CRL's issuer name; on a failure `code` / `reason` name which check
+ * failed. Currency and distribution-point scope remain `pki.path.crlChecker`.
  *
  * @example
  *   var pair = await pki.key.generate("Ed25519");
@@ -669,17 +671,29 @@ function _issuerMaySign(parsed, cert) {
  *     extensions: { basicConstraints: { cA: true }, keyUsage: ["keyCertSign", "cRLSign"] } }, { key: signerKeyPkcs8 });
  *   var crlDer = await pki.crl.sign({ thisUpdate: new Date("2026-01-01T00:00:00Z"), crlNumber: 1n, revoked: [] },
  *     { cert: signerCertDer, key: signerKeyPkcs8 });
- *   var ok = await pki.crl.verify(crlDer, { publicKey: signerSpki });   // true / false
+ *   var res = await pki.crl.verify(crlDer, { publicKey: signerSpki });   // { valid, signatureValid, issuerMaySign, issuer }
  */
 function verify(crl, issuer) { return guard.async.deferred(function () { return _verify(crl, issuer); }); }
 function _verify(crl, issuer) {
   var parsed = _coerceCrl(crl);
   var resolved = _resolveIssuer(issuer);
-  // Asked BEFORE the signature: a certificate that may not sign CRLs, or that is not this CRL's
-  // issuer, is a caller-configuration answer that does not depend on the math, and spending a
-  // verification on it would let the cheaper question be answered by the more expensive one.
-  if (resolved.cert && !_issuerMaySign(parsed, resolved.cert)) return false;
-  return crlVerify.verifyCrlSignature(parsed, resolved.spki);
+  // A bare SPKI carries no certificate, so the two cert-only questions cannot be asked and only the
+  // signature is checked (issuerMaySign is then reported true). Both checks are surfaced on the verdict:
+  // a bare `true` used to hide whether the signer was ALLOWED to sign this CRL, so `if (verify(...))`
+  // accepted a CRL minted under an end-entity certificate of the same CA as that CA's own.
+  var issuerMaySign = resolved.cert ? _issuerMaySign(parsed, resolved.cert) : true;
+  return crlVerify.verifyCrlSignature(parsed, resolved.spki).then(function (sigOk) {
+    var signatureValid = sigOk === true;
+    var valid = issuerMaySign && signatureValid;
+    var out = { valid: valid, issuerMaySign: issuerMaySign, signatureValid: signatureValid, issuer: parsed.issuer };
+    if (!valid) {
+      out.code = !issuerMaySign ? "crl/issuer-may-not-sign" : "crl/bad-signature";
+      out.reason = !issuerMaySign
+        ? "the issuer certificate is not this CRL's issuer, or its keyUsage does not assert cRLSign (RFC 5280 sec. 4.2.1.3)"
+        : "the CRL signature did not verify under the issuer key";
+    }
+    return out;
+  });
 }
 
 function _serialHexOf(serial) {

package/lib/crmf-sign.js

@@ -632,7 +632,7 @@ function _verifyOne(msg) {
     subjectBound: false,
     publicKey: (t && t.publicKey && t.publicKey.bytes) || null,
   };
-  function settle(extra) { return Promise.resolve(Object.assign({}, base, extra)); }
+  function settle(extra) { var v = Object.assign({}, base, extra); v.valid = v.verified === true; return Promise.resolve(v); }   // `valid` is the canonical toolkit-wide alias of this message's `verified`
 
   var popo = msg.popo;
   if (popo == null) {
@@ -679,7 +679,7 @@ function _verifyOne(msg) {
   var bound = !pin;
   return crmfVerify.verifyPopSignature(popo, spki, preimage).then(function (ok) {
     return Object.assign({}, base, {
-      verified: ok === true, method: "signature", cryptographicallyVerified: ok === true,
+      valid: ok === true, verified: ok === true, method: "signature", cryptographicallyVerified: ok === true,
       subject: bound ? base.subject : null,
       subjectBound: bound,
       publicKey: spki || null,
@@ -690,7 +690,7 @@ function _verifyOne(msg) {
 
 /**
  * @primitive pki.crmf.verifyPop
- * @signature pki.crmf.verifyPop(messages) -> Promise<{ verified, messages: [{ verified, method, cryptographicallyVerified, certReqId, subject, subjectBound, publicKey, reason }] }>
+ * @signature pki.crmf.verifyPop(messages) -> Promise<{ valid, verified, messages: [{ valid, verified, method, cryptographicallyVerified, certReqId, subject, subjectBound, publicKey, reason }] }>
  * @since 0.5.14
  * @status stable
  * @spec RFC 4211 sec. 4.1
@@ -736,7 +736,8 @@ function verifyPop(messages) { return guard.async.deferred(function () { return
 function _verifyPop(messages) {
   var parsed = _coerceMessages(messages);
   return Promise.all(parsed.messages.map(_verifyOne)).then(function (out) {
-    return { verified: out.length > 0 && out.every(function (m) { return m.verified === true; }), messages: out };
+    var allVerified = out.length > 0 && out.every(function (m) { return m.verified === true; });
+    return { valid: allVerified, verified: allVerified, messages: out };
   });
 }
 

package/lib/csr-sign.js

@@ -181,7 +181,7 @@ function _coerceCsr(request) {
 
 /**
  * @primitive pki.csr.verify
- * @signature pki.csr.verify(request) -> Promise<{ verified, subject, subjectPublicKeyInfo, attributes, certificationRequestInfoBytes }>
+ * @signature pki.csr.verify(request) -> Promise<{ valid, verified, subject, subjectPublicKeyInfo, attributes, certificationRequestInfoBytes }>
  * @since 0.5.13
  * @status stable
  * @spec RFC 2986 sec. 4.2
@@ -237,6 +237,7 @@ function _verify(request) {
   var parsed = _coerceCsr(request);
   return Promise.resolve(csrVerify.verifyCsrSignature(parsed)).then(function (ok) {
     return {
+      valid: ok === true,   // canonical toolkit-wide verdict alias, beside the verb's own `verified`
       verified: ok === true,
       subject: parsed.subject,
       subjectPublicKeyInfo: parsed.subjectPublicKeyInfo,

package/lib/ct.js

@@ -813,7 +813,7 @@ function _resolveNotAfter(entry, opts) {
 
 /**
  * @primitive  pki.ct.verifySctWithLogList
- * @signature  pki.ct.verifySctWithLogList(entry, sct, logList, opts?) -> Promise<boolean>
+ * @signature  pki.ct.verifySctWithLogList(entry, sct, logList, opts?) -> Promise<{ valid, logId, logIdHex, operator, logState, timestamp }>
  * @since      0.2.28
  * @status     stable
  * @spec       RFC 6962
@@ -827,8 +827,10 @@ function _resolveNotAfter(entry, opts) {
  * `opts.certNotAfter`, must fall in `[start_inclusive, end_exclusive)`, and a windowed log with no
  * resolvable notAfter is `ct/temporal-interval`, never silently skipped). Then the crypto is delegated to
  * the shipped `verifySct(entry, sct, log.key)` (which independently re-checks `logId == SHA-256(key)`).
- * Resolves `true` for a valid signature from a trusted, in-window log; `false` on a cryptographic
- * mismatch (a verdict); throws a typed `CtError` on any structural / trust failure.
+ * The verdict's `valid` is `true` for a valid signature from a trusted, in-window log and `false` on a
+ * cryptographic mismatch; `logId` / `logIdHex` / `operator` / `logState` / `timestamp` carry the resolved
+ * log record so a caller can record which trusted log accepted the SCT and when, for a policy decision,
+ * without re-deriving them. It throws a typed `CtError` on any structural / trust failure.
  *
  * @opts certNotAfter A `Date` -- the covered certificate's notAfter for the temporal-interval gate (required for a precert entry).
  * @example
@@ -846,7 +848,7 @@ function _resolveNotAfter(entry, opts) {
  *     description: "Example Log", log_id: logId.toString("base64"), key: logSpki.toString("base64"),
  *     url: "https://ct.example/log/", mmd: 86400,
  *     state: { usable: { timestamp: "2026-01-01T00:00:00Z" } } }] }] }), "utf8"));
- *   var ok = await pki.ct.verifySctWithLogList(sctEntry, embeddedSct, logList);
+ *   var res = await pki.ct.verifySctWithLogList(sctEntry, embeddedSct, logList);   // { valid, logId, logIdHex, operator, logState, timestamp }
  */
 // The pure, NON-THROWING log resolution + state + temporal classifier shared by verifySctWithLogList
 // (which throws the mapped code on a non-ok status) and verifySctList (which records the code into a
@@ -887,7 +889,18 @@ async function verifySctWithLogList(entry, sct, logList, opts) {
   opts = opts || {};
   var c = _classifyLog(sct, logList, entry, opts);
   if (c.status !== "ok") throw _ctErr(c.code, c.message);
-  return verifySct(entry, sct, c.log.key);   // the shipped crypto verdict (re-checks the logId binding)
+  // The crypto verdict alone hid WHICH trusted log accepted the SCT and when. Surface the resolved log
+  // record so a caller can record the operator / log state / timestamp for a policy decision instead of
+  // re-deriving them, rather than reading a bare boolean that drops the whole record it just resolved.
+  var valid = await verifySct(entry, sct, c.log.key);   // re-checks the logId binding
+  return {
+    valid: valid,
+    logId: c.log.logId,
+    logIdHex: c.log.logIdHex,
+    operator: c.log.operator,
+    logState: c.log.state.name,
+    timestamp: sct.timestamp,
+  };
 }
 
 // Options verifySctList reads. All optional; the defaults are the RFC 6962 sec. 3.3 floor (>= 1).
@@ -1030,6 +1043,7 @@ async function verifySctList(entry, list, logList, opts) {
   var operatorCount = operators.length;
   var policyOk = validScts >= minScts && operatorCount >= minOperators;
   return {
+    valid: policyOk,   // canonical toolkit-wide verdict alias, beside this verb's `policyOk`
     policyOk: policyOk, totalScts: scts.length + unknownScts, validScts: validScts, unknownScts: unknownScts,
     operatorCount: operatorCount, operators: operators, required: { minScts: minScts, minOperators: minOperators },
     results: results,

package/lib/ocsp-verify.js

@@ -227,7 +227,7 @@ function makeOcspVerify(deps) {
         // allow:nan-date-comparison-unguarded -- revocationTime is codec-parsed (NaN-rejected); a NaN check time makes this FAIL CLOSED (sawGood stays unset -> not treated good), and `time` is validated at the pki.ocsp.verify / path.verifyOcspResponse entry points.
         if (historical && guard.time.isDate(st.revocationTime) &&
           guard.time.instantOf(st.revocationTime) > guard.time.instantOf(time)) { out.sawGood = true; }
-        else if (!out.revoked) { out.revoked = { revocationReason: st.revocationReason || null, reason: "certificate reported revoked by an authorized OCSP responder" + (st.revocationReason ? " (" + st.revocationReason + ")" : "") }; }
+        else if (!out.revoked) { out.revoked = { revocationReason: st.revocationReason || null, revocationTime: guard.time.isDate(st.revocationTime) ? st.revocationTime : null, reason: "certificate reported revoked by an authorized OCSP responder" + (st.revocationReason ? " (" + st.revocationReason + ")" : "") }; }
       } else if (st.type === "good") { out.sawGood = true; }
       else { out.sawUnknownStatus = true; }
     }

package/lib/ocsp.js

@@ -462,7 +462,7 @@ function buildErrorResponse(status) {
 
 /**
  * @primitive pki.ocsp.verify
- * @signature pki.ocsp.verify(response, opts) -> Promise<{ status, responderAuthorized, signatureValid, thisUpdate, nextUpdate, revocationReason?, nonceMatched?, reason }>
+ * @signature pki.ocsp.verify(response, opts) -> Promise<{ status, responderAuthorized, signatureValid, thisUpdate, nextUpdate, revocationReason?, revocationTime?, nonceMatched?, reason }>
  * @since 0.2.22
  * @status stable
  * @spec RFC 6960, RFC 9654, RFC 5019
@@ -593,6 +593,7 @@ function _requestFromBytes(request) {
 }
 function _reqVerdict(parsed, extra) {
   return {
+    valid: extra.signed === true && extra.signatureValid === true,   // canonical alias: the request was signed AND the signature verified
     signed: extra.signed, signatureValid: extra.signatureValid,
     signerCert: extra.signerCert != null ? extra.signerCert : null,
     signerCerts: extra.signerCerts != null ? extra.signerCerts : [],
@@ -654,7 +655,7 @@ function _signerVerdict(parsed, found, failReason) {
 
 /**
  * @primitive  pki.ocsp.verifyRequest
- * @signature  pki.ocsp.verifyRequest(request, opts?) -> Promise<{ signed, signatureValid, signerCert, signerCerts, certs, signerSubject, requestorName, requestList, requestExtensions, version, reason }>
+ * @signature  pki.ocsp.verifyRequest(request, opts?) -> Promise<{ valid, signed, signatureValid, signerCert, signerCerts, certs, signerSubject, requestorName, requestList, requestExtensions, version, reason }>
  * @since      0.6.0
  * @status     stable
  * @spec       RFC 6960

package/lib/path-validate.js

@@ -2583,7 +2583,7 @@ function ocspChecker(responses) {
       for (var k = 0; k < parsed.length; k++) {
         var v = await ocspCore.evaluateResponse(parsed[k], cert, issuer, issuerKeyBits, issuerNameCandidates, time, historical);
         if (v.revoked && !revokedResult) {
-          revokedResult = { status: "revoked", revocationReason: v.revoked.revocationReason, reason: v.revoked.reason };
+          revokedResult = { status: "revoked", revocationReason: v.revoked.revocationReason, revocationTime: v.revoked.revocationTime, reason: v.revoked.reason };
         }
         if (v.sawGood) sawGood = true;
         if (v.sawUnknownStatus) sawUnknownStatus = true;
@@ -2602,7 +2602,7 @@ function ocspChecker(responses) {
 
 /**
  * @primitive  pki.path.verifyOcspResponse
- * @signature  pki.path.verifyOcspResponse(response, cert, issuerCert, time, opts?) -> Promise<{ status, responderAuthorized, signatureValid, matched, thisUpdate, nextUpdate, revocationReason?, reason }>
+ * @signature  pki.path.verifyOcspResponse(response, cert, issuerCert, time, opts?) -> Promise<{ status, responderAuthorized, signatureValid, matched, thisUpdate, nextUpdate, revocationReason?, revocationTime?, reason }>
  * @since       0.2.22
  * @status      stable
  * @spec        RFC 6960
@@ -2728,7 +2728,7 @@ function _verifyOcspParsed(parsedResponse, cert, issuerCert, time, opts) {
     try { issuerKeyBits = ocspVerify.ocspKeyValue(issuerCert.subjectPublicKeyInfo.bytes); }
     catch (_e) { return unbound("the issuer public key could not be read to recompute the OCSP CertID"); }
     return ocspCore.evaluateResponse(parsedResponse, cert, issuerCtx, issuerKeyBits, issuerNameCandidates, time, opts.historicalMode === true).then(function (v) {
-      if (v.revoked) return { status: "revoked", responderAuthorized: true, signatureValid: true, matched: true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, revocationReason: v.revoked.revocationReason, reason: v.revoked.reason };
+      if (v.revoked) return { status: "revoked", responderAuthorized: true, signatureValid: true, matched: true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, revocationReason: v.revoked.revocationReason, revocationTime: v.revoked.revocationTime, reason: v.revoked.reason };
       if (v.sawGood) return { status: "good", responderAuthorized: true, signatureValid: true, matched: true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, reason: "good" };
       return { status: "unknown", responderAuthorized: v.responderAuthorized === true, signatureValid: v.signatureValid === true, matched: v.matched === true, thisUpdate: v.thisUpdate, nextUpdate: v.nextUpdate, reason: v.reason };
     });

package/lib/pkcs12-build.js

@@ -50,6 +50,7 @@ var pkix = require("./schema-pkix");
 var pkiBuild = require("./pki-build");   // reqDenseArray: reject a sparse/nullish caller array as a typed pkcs12/bad-input
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
+var _toLower = intrinsic.uncurry(String.prototype.toLowerCase);   // bound at load so a replaced String.prototype.toLowerCase cannot steer a hash-name comparison
 var frameworkError = require("./framework-error");
 var C = require("./constants");
 
@@ -779,7 +780,7 @@ async function _build(spec, opts) {
 
 /**
  * @primitive pki.pkcs12.verifyMac
- * @signature pki.pkcs12.verifyMac(pfx, password, opts?) -> Promise<boolean>
+ * @signature pki.pkcs12.verifyMac(pfx, password, opts?) -> Promise<{ valid, macAlgorithm, macAlgorithmName, iterationCount }>
  * @since 0.3.11
  * @status stable
  * @spec RFC 7292 sec. 5.1, RFC 9579
@@ -792,8 +793,11 @@ async function _build(spec, opts) {
  * came from one place. `Object.assign`, spread and a JSON round-trip drop the mark. The password is BMPString+NULL encoded (RFC 7292 App. B.1), the MAC is
  * recomputed over the store's exact AuthenticatedSafe byte range (`macedBytes`) using the store's own MAC
  * parameters -- the classic Appendix B (ID=3) HMAC or the RFC 9579 PBMAC1 -- and constant-time-compared to
- * the stored MAC value. Returns `true` / `false` for the password match; throws `Pkcs12Error` on a MAC-less
- * or public-key-integrity store, or an unsupported MAC algorithm (never a falsy verdict standing in for an error).
+ * the stored MAC value. The verdict's `valid` is the password match, and `macAlgorithm` (`hmac` or `pbmac1`),
+ * `macAlgorithmName` (the digest / scheme, e.g. `sha1`, `sha256`), and `iterationCount` name the integrity
+ * algorithm the store used, so a caller can reject a legacy SHA-1 MAC by inspecting them rather than
+ * accepting any `valid` store. Throws `Pkcs12Error` on a MAC-less or public-key-integrity store, or an
+ * unsupported MAC algorithm (never a falsy verdict standing in for an error).
  *
  * @example
  *   var pair = await pki.key.generate("Ed25519");
@@ -801,13 +805,24 @@ async function _build(spec, opts) {
  *   var signerCertDer = await pki.x509.sign({ subject: "Signer", subjectPublicKey: await pki.key.export(pair.publicKey),
  *     notBefore: new Date("2026-01-01T00:00:00Z"), notAfter: new Date("2036-01-01T00:00:00Z") }, { key: signerKeyPkcs8 });
  *   var p12 = await pki.pkcs12.build({ key: signerKeyPkcs8, cert: signerCertDer }, { password: 'changeit' });
- *   var ok = await pki.pkcs12.verifyMac(p12, 'changeit');
+ *   var res = await pki.pkcs12.verifyMac(p12, 'changeit');   // { valid, macAlgorithm, macAlgorithmName, iterationCount }
  */
 async function verifyMac(pfx, password, opts) {
   if (opts != null && typeof opts === "object" && !Buffer.isBuffer(opts)) {
     guard.identifier.assertKnownKeys(opts, _VERIFY_MAC_OPTS, _err, "pkcs12/bad-input", "pki.pkcs12.verifyMac has an unknown option ");
   }
-  return _verifyMacOfStore(_storeFromBytes(pfx), password, opts);
+  var m = _storeFromBytes(pfx);
+  // _verifyMacOfStore throws pkcs12/bad-input for a store carrying no password MAC, so m.mac is present
+  // once it returns. Surface the MAC algorithm the store used so a caller can reject an integrity
+  // algorithm it does not accept (e.g. a legacy SHA-1 classic MAC), instead of a bare boolean that hides it.
+  var valid = await _verifyMacOfStore(m, password, opts);
+  var isHmac = m.mac.kind === "hmac";
+  return {
+    valid: valid,
+    macAlgorithm: m.mac.kind,
+    macAlgorithmName: isHmac ? _toLower(m.mac.hashName || "") : m.mac.pbmac1.schemeName,
+    iterationCount: isHmac ? m.mac.iterations : m.mac.pbmac1.kdf.iterationCount,
+  };
 }
 
 // The MAC computation over a store this module has ALREADY parsed from bytes. Separate from the
@@ -819,7 +834,7 @@ async function _verifyMacOfStore(m, password, opts) {
   var expected = m.mac.macValue;
   var computed;
   if (m.mac.kind === "hmac") {
-    var node = (m.mac.hashName || "").toLowerCase();
+    var node = _toLower(m.mac.hashName || "");
     if (!P12_KDF_UV[node]) throw _err("pkcs12/unsupported-algorithm", "unsupported classic MAC hash " + m.mac.hashName);
     // The iteration count and salt are attacker-controlled work factors: bound them BEFORE the KDF runs.
     _capWork(m.mac.iterations, m.mac.macSalt, opts, undefined, CLASSIC_MAC_MAX_ITERATIONS);
@@ -937,7 +952,10 @@ async function open(pfx, password, opts) {
   // PBES2 uses UTF-8 (the pinned interop convention), a legacy App. C scheme uses the BMPString+NULL form (the
   // App. B.1 encoding the classic MAC also uses) -- both distinct from the public-key integrity keypair. A
   // wrong bag password fails at the first encrypted bag as the uniform pkcs12/decrypt-failed.
-  var out = { integrityMode: m.integrityMode, macVerified: macVerified, signers: signers, keys: [], certs: [], crls: [], secrets: [] };
+  // `valid` is the integrity verdict: open THROWS on an integrity failure for both a password MAC and a
+  // public-key CMS signature, so a returned store with either mode is verified; only an allowUnauthenticated
+  // (MAC-less) store reaches here unverified. macVerified alone would read false for a valid public-key store.
+  var out = { valid: macVerified || m.integrityMode === "public-key", integrityMode: m.integrityMode, macVerified: macVerified, signers: signers, keys: [], certs: [], crls: [], secrets: [] };
   var i;
   var kdfBudget = { rounds: KDF_MAX_ROUNDS };   // aggregate KDF work budget for this whole open(), both schemes
   for (i = 0; i < m.safeBags.length; i++) _openBag(m.safeBags[i], password, opts, out, 0, kdfBudget);

package/lib/sigstore.js

@@ -411,7 +411,10 @@ function _verifyRekor(te, envelope, rekorKeys, leafDer) {
   if (!setOk) throw _err("sigstore/unattested-time", "the Rekor SET (the signed source of integratedTime) did not verify -- the log time is not attested and cannot date the Fulcio certificate");
   var t = Number(te.integratedTime);
   if (!Number.isFinite(t) || t < 0) throw _err("sigstore/bad-tlog-entry", "the transparency-log entry has a malformed integratedTime");
-  return t;
+  // Surface which attested Rekor log entry this is: the global log index and the log's key id (hex), so a
+  // caller can locate the exact transparency-log record for an audit rather than re-deriving it.
+  var li = Number(te.logIndex);
+  return { integratedTime: t, logIndex: Number.isFinite(li) ? li : null, logId: te.logId && te.logId.keyId ? _b64(te.logId.keyId, "logId.keyId").toString("hex") : null };
 }
 
 // ---- Fulcio chain leg (RFC 5280 path validation, as-of the log time) ----------
@@ -647,8 +650,11 @@ function _statement(payload, payloadType, expectedPredicate) {
  * of the Rekor log time; the Rekor inclusion proof folded to a Rekor-signed root;
  * the log entry bound to this exact signature; and the in-toto SLSA statement.
  * Any leg failing throws a typed `sigstore/*` error. On success returns
- * `{ verified: true, payload, statement, subjects, predicateType, predicate,
- * identity, identityChecked, integratedTime }`. `payload` is the raw verified
+ * `{ valid: true, verified: true, payload, statement, subjects, predicateType, predicate,
+ * identity, identityChecked, predicateTypeChecked, integratedTime, logIndex, logId }` (`valid` is the
+ * canonical toolkit-wide verdict alias of `verified`, `predicateTypeChecked` says whether a pinned
+ * `opts.predicateType` was checked, and `logIndex` / `logId` identify the attested Rekor log entry).
+ * `payload` is the raw verified
  * envelope bytes (never a re-serialization), and the caller confirms a
  * `subjects[].digest` matches the published artifact.
  *
@@ -706,13 +712,14 @@ async function verifyBundle(bundle, opts) {
   // verifies (and binds this signature), rejecting only if none do.
   var tlogs = Array.isArray(vm.tlogEntries) ? vm.tlogEntries : [];
   if (!tlogs.length) throw _err("sigstore/bad-bundle", "a keyless bundle requires at least one transparency-log entry");
-  var integratedTime = null, lastErr = null;
+  var rekor = null, lastErr = null;
   for (var ti = 0; ti < tlogs.length; ti++) {
     if (!tlogs[ti] || typeof tlogs[ti] !== "object") { lastErr = _err("sigstore/bad-bundle", "a transparency-log entry is not an object"); continue; }
-    try { integratedTime = _verifyRekor(tlogs[ti], env, rekorKeys, leafDer); break; }
+    try { rekor = _verifyRekor(tlogs[ti], env, rekorKeys, leafDer); break; }
     catch (e) { lastErr = e; }
   }
-  if (integratedTime === null) throw lastErr;
+  if (rekor === null) throw lastErr;
+  var integratedTime = rekor.integratedTime;
 
   // Leg 3 -- Fulcio chain, validated as of the (trusted) log time; then identity.
   // The instant comes through the time guard's intrinsic read. `getTime` is an ordinary method a
@@ -729,6 +736,7 @@ async function verifyBundle(bundle, opts) {
   var st = _statement(payload, env.payloadType, opts.predicateType);
 
   return {
+    valid: true,   // canonical toolkit-wide verdict alias, beside the verb's own `verified`
     verified: true,
     payload: payload,
     statement: st,
@@ -739,7 +747,15 @@ async function verifyBundle(bundle, opts) {
     // Which identity fields were actually compared. `verified` says the artifact was signed and
     // logged; only these say a signer the caller named was the one who signed it.
     identityChecked: identityChecked,
+    // Whether the caller pinned a predicateType (opts.predicateType) that was checked. The verdict is
+    // only reached when a pinned predicate matched (a mismatch throws sigstore/predicate-mismatch), so
+    // a caller that omitted the pin gets `false` and knows the SLSA predicate went unverified.
+    predicateTypeChecked: opts.predicateType != null,
     integratedTime: integratedTime,
+    // The attested Rekor entry this verdict rests on: `logIndex` is its global log index and `logId` the
+    // log's key id (hex), so a caller can fetch or audit the exact transparency-log record.
+    logIndex: rekor.logIndex,
+    logId: rekor.logId,
   };
 }
 

package/lib/webauthn.js

@@ -1217,7 +1217,10 @@ function _safetyNetChainTrusted(chain, roots, time) {
 // had already decoded -- and a login cannot be verified without them.
 function _result(fmt, attestationType, chain, att) {
   return {
-    attestationVerified: true, fmt: fmt, attestationType: attestationType,
+    // `valid` / `attestationVerified` say the attestation format was validly processed, which the `none`
+    // format (WebAuthn 8.7, no attestation) satisfies too. The ASSURANCE level is `attestationType`
+    // (`None` for none): a relying party that requires cryptographic attestation gates on it, not on `valid`.
+    valid: true, attestationVerified: true, fmt: fmt, attestationType: attestationType,
     trustPath: (chain || []).slice().reverse(),
     aaguid: att.authData.aaguid,
     credentialId: att.authData.credentialId,
@@ -1274,7 +1277,7 @@ function _checkAndroidKeyDescription(cert, clientDataHash) {
 
 /**
  * @primitive pki.webauthn.verify
- * @signature pki.webauthn.verify(attestationObject, clientDataHash?, opts?) -> Promise<{ attestationVerified, fmt, attestationType, trustPath, anchoredTo, aaguid, credentialId, credentialPublicKey, credentialPublicKeyBytes, signCount, flags, rpIdHash, extensions, bindingChecked, clientData }>
+ * @signature pki.webauthn.verify(attestationObject, clientDataHash?, opts?) -> Promise<{ valid, attestationVerified, fmt, attestationType, trustPath, anchoredTo, aaguid, credentialId, credentialPublicKey, credentialPublicKeyBytes, signCount, flags, rpIdHash, extensions, bindingChecked, clientData }>
  * @since 0.2.5
  * @status stable
  * @spec W3C WebAuthn Level 3 sec. 8 / sec. 7.1
@@ -2162,7 +2165,7 @@ var _ASSERT_OPTS = Object.assign(Object.create(null), {
 
 /**
  * @primitive pki.webauthn.verifyAssertion
- * @signature pki.webauthn.verifyAssertion(input) -> Promise<{ signatureVerified, signCount, signCountChecked, flags, rpIdHash, extensions, bindingChecked, clientData }>
+ * @signature pki.webauthn.verifyAssertion(input) -> Promise<{ valid, signatureVerified, signCount, signCountChecked, flags, rpIdHash, extensions, bindingChecked, clientData }>
  * @since 0.5.0
  * @status stable
  * @spec W3C WebAuthn Level 3 sec. 7.2
@@ -2370,6 +2373,7 @@ function verifyAssertion(input) {
         }
       }
       return {
+        valid: true,   // canonical toolkit-wide verdict alias, beside the verb's own `signatureVerified`
         signatureVerified: true,
         signCount: authData.signCount,
         signCountChecked: signCountChecked,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.11",
+  "version": "0.6.13",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:bfbe087f-30ed-484a-ba11-142da30522a8",
+  "serialNumber": "urn:uuid:7a020e1d-6d6a-4d9e-9a8b-d17c7e4fa867",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-31T23:06:26.187Z",
+    "timestamp": "2026-09-01T02:27:31.392Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.11",
+      "bom-ref": "@blamejs/pki@0.6.13",
       "type": "application",
       "name": "pki",
-      "version": "0.6.11",
+      "version": "0.6.13",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.11",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.13",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.11",
+      "ref": "@blamejs/pki@0.6.13",
       "dependsOn": []
     }
   ]