@blamejs/pki 0.6.29 → 0.6.31

package/lib/webauthn.js

@@ -17,7 +17,7 @@
  *   `pki.path.validate` is the caller's step: this module verifies the statement, not
  *   the certificate chain. A verifier, not a ceremony client: the relying party
  *   supplies the clientDataHash + any trust anchors; this module never touches a
- *   socket. Fail-closed -- every malformed shape or failed check throws a typed
+ *   socket. Fail-closed: every malformed shape or failed check throws a typed
  *   `WebauthnError`, never a partial verdict.
  * @spec W3C WebAuthn Level 3 sec. 6.5 / 8, RFC 9052 (COSE)
  * @card Verify a WebAuthn / passkey attestation (packed / tpm / android-key / apple / fido-u2f / none).
@@ -119,8 +119,8 @@ function _decodeCoseKey(node) {
  * @spec       RFC 9052, W3C WebAuthn Level 3 sec. 6.5.1
  * @related    pki.webauthn.verify, pki.webauthn.verifyAssertion
  *
- * Decode a bare COSE_Key -- the credential public key a relying party stored at
- * registration -- back into the object `verifyAssertion` takes. `pki.webauthn.verify`
+ * Decode a bare COSE_Key, the credential public key a relying party stored at
+ * registration, back into the object `verifyAssertion` takes. `pki.webauthn.verify`
  * returns that object, but the durable form is bytes: the object carries `Buffer`
  * values, so a JSON round trip through a datastore yields
  * `{"type":"Buffer","data":[...]}` in place of the object that went in, and existing
@@ -279,7 +279,7 @@ function _findExt(cert, oidName) {
  * authData}`) and its authenticatorData, fail-closed. `authData` carries the decoded
  * rpIdHash / flags / signCount and, when the AT flag is set, the attestedCredentialData
  * (aaguid, credentialId, and the decoded COSE `credentialPublicKey`). `authDataBytes`
- * is the raw authenticatorData -- the exact bytes an attestation signature covers.
+ * is the raw authenticatorData, the exact bytes an attestation signature covers.
  * A malformed object throws `webauthn/bad-attestation-object`.
  *
  * @example
@@ -820,7 +820,7 @@ function _checkAndroidKeyDescription(cert, clientDataHash) {
  * The verdict field is `attestationVerified`, and the name is the point: a sound
  * attestation statement is not the same claim as an acceptable registration. The
  * statement says nothing about which relying party asked for it, or whether a user
- * was present -- so an attestation naming another origin's RP ID, with user presence
+ * was present, so an attestation naming another origin's RP ID, with user presence
  * clear, is perfectly sound and must not be registered. Supply `expectedRpId`,
  * `requireUserPresence`, `requireUserVerification` and `allowedAlgorithms` and those
  * are checked here; `bindingChecked` reports which ran, so a check that passed can be
@@ -834,18 +834,18 @@ function _checkAndroidKeyDescription(cert, clientDataHash) {
  * The verdict also carries what a relying party must STORE to run a later login:
  * `credentialId`, `credentialPublicKey` and the initial `signCount`. The credential key
  * comes back in both forms: the decoded object, and `credentialPublicKeyBytes`, which is
- * what a credential row should hold -- the object carries `Buffer` values, so a JSON round
+ * what a credential row should hold. The object carries `Buffer` values, so a JSON round
  * trip through a datastore returns `{"type":"Buffer","data":[...]}` in place of the object
  * that went in. `pki.webauthn.parseCoseKey` reads those bytes back, and
  * `verifyAssertion` accepts either form.
  *
- * @intro This verifies the attestation STATEMENT -- the signature and the format's
+ * @intro This verifies the attestation STATEMENT: the signature and the format's
  *   structural bindings (the x5c leaf key == credential key, the apple nonce, the tpm
  *   certInfo Name/extraData, the android KeyDescription, the fido-u2f verificationData).
  *   Chaining the returned `trustPath` (the x5c certificates in `pki.path.validate`
- *   order -- anchor-adjacent first, leaf last) to a trusted root is a separate step,
+ *   order: anchor-adjacent first, leaf last) to a trusted root is a separate step,
  *   and there are three ways to take it. Pass `opts.metadata`, a
- *   `pki.webauthn.verifyMetadataBlob` result -- and the authenticator's registered
+ *   `pki.webauthn.verifyMetadataBlob` result. The authenticator's registered
  *   attestation roots are resolved from its own identifier and the trust path is
  *   required to reach one, so an unlisted or revoked model is refused and never
  *   reported as verified. Pass `opts.rootCertificates` and the path is required to
@@ -858,7 +858,7 @@ function _checkAndroidKeyDescription(cert, clientDataHash) {
  *   roots are a stronger claim than a static pin and its status reports can
  *   disqualify a model those roots would still accept. `anchoredTo` reports which
  *   route ran, naming every route that contributed and joining them with `+` when more
- *   than one did -- `"metadata"`, `"rootCertificates"`, and `"safetyNetRoots"` for the
+ *   than one did: `"metadata"`, `"rootCertificates"`, and `"safetyNetRoots"` for the
  *   android-safetynet chain, which anchors through the roots that format requires whether
  *   or not either other route was asked for. It is `null` only when nothing anchored the
  *   path. On the mixed metadata/pinned-root route `metadata` still carries the
@@ -1091,14 +1091,14 @@ void constants;
  * @spec FIDO Metadata Service v3.0 sec. 3.1, RFC 7515
  * @related pki.webauthn.verify, pki.webauthn.metadataFor
  *
- * Verify a FIDO Metadata Service BLOB -- the signed catalogue of every registered
- * authenticator model, its attestation roots, and its certification status, and
+ * Verify a FIDO Metadata Service BLOB (the signed catalogue of every registered
+ * authenticator model, its attestation roots, and its certification status), and
  * return its entries indexed by aaguid for lookup. `blob` is caller-supplied bytes or
  * a string; retrieval is out of scope, so this never touches the network.
  *
  * The BLOB is a JWS. Its signature is checked under the certificate in its own header,
  * that chain is validated to one of `opts.rootCertificates`, and only THEN is the
- * payload read -- a BLOB that does not verify never reaches the JSON parser. `no` must
+ * payload read. A BLOB that does not verify never reaches the JSON parser. `no` must
  * exceed `opts.previousNo` (rollback) and `nextUpdate` must not have passed
  * (freshness). Every failure is a typed `webauthn/metadata-*` throw, never a partial
  * result.
@@ -1224,7 +1224,7 @@ var CLIENT_DATA_TYPE = Object.assign(Object.create(null), { "webauthn.create": 1
  * @defends webauthn-ceremony-confusion (CWE-345)
  * @related pki.webauthn.verify, pki.webauthn.verifyAssertion
  *
- * Decode the `clientDataJSON` a ceremony returns -- the half of a WebAuthn response
+ * Decode the `clientDataJSON` a ceremony returns, the half of a WebAuthn response
  * the signature covers by digest but that no signature check ever looks inside.
  * Parsed through the shared fail-closed JSON guard (bounded bytes and depth,
  * fatal UTF-8, duplicate members refused, no prototype pollution), because these
@@ -1233,7 +1233,7 @@ var CLIENT_DATA_TYPE = Object.assign(Object.create(null), { "webauthn.create": 1
  * value; `type`, `origin`, `crossOrigin` and `topOrigin` come back as they were.
  *
  * Supply `expectedType`, `expectedChallenge`, `expectedOrigin` and
- * `expectedTopOrigin` and each is checked here -- the challenge in constant time
+ * `expectedTopOrigin` and each is checked here: the challenge in constant time
  * and by full value, the origins whole and case-sensitively. `checked`
  * reports which ran, so a check that passed is distinguishable from one that never
  * happened. `expectedType` is worth setting on every call: the ceremony a response
@@ -1418,7 +1418,7 @@ var _ASSERT_OPTS = Object.assign(Object.create(null), {
  *
  * Verify an authentication assertion's signature: the authenticator signs
  * `authenticatorData || SHA-256(clientDataJSON)` as raw bytes with the credential
- * key registered earlier -- no COSE_Sign1 wrapper, so a COSE message verifier is
+ * key registered earlier: no COSE_Sign1 wrapper, so a COSE message verifier is
  * the wrong tool and fails on structure before it ever reaches the signature. An
  * ES256 assertion signature is an ASN.1 DER `SEQUENCE { r, s }`, converted here
  * with the same order-aware reader the attestation path uses, so an r or s outside
@@ -1428,10 +1428,13 @@ var _ASSERT_OPTS = Object.assign(Object.create(null), {
  * registered credential key produced this response. What makes the response
  * ACCEPTABLE is the sec. 7.2 binding, and the caller owns most of it. Supply
  * `expectedRpId`, `requireUserPresence`, `requireUserVerification` and
- * `allowedAlgorithms` and they are checked here -- `bindingChecked` reports which
+ * `allowedAlgorithms` and they are checked here. `bindingChecked` reports which
  * ones ran, so a check that passed is distinguishable from one that never
- * happened. The CHALLENGE and the ORIGIN stay with the caller: both live in
- * clientDataJSON and are compared against state only the relying party has.
+ * happened. Supply `expectedChallenge`, `expectedOrigin`, or `expectedTopOrigin`
+ * together with `clientDataJSON` and the challenge and origin are checked here
+ * against it; omit them and they stay with the caller to compare against the
+ * clientDataJSON this call surfaces. Passing them with only `clientDataHash`
+ * throws, because there is no clientDataJSON to check them against.
  *
  * Pass `previousSignCount` (the value stored at registration or the last login) and
  * the sec. 7.2 step 21 counter rule is applied: a counter that fails to advance is
@@ -1447,6 +1450,7 @@ var _ASSERT_OPTS = Object.assign(Object.create(null), {
  *   credentialPublicKey -- the stored COSE key (as parseAttestationObject surfaced it)
  *   previousSignCount -- the stored counter, enabling the sec. 7.2 step 21 rule
  *   expectedRpId, requireUserPresence, requireUserVerification, allowedAlgorithms: the bindings above
+ *   expectedChallenge, expectedOrigin, expectedTopOrigin -- checked against clientDataJSON when supplied (needs clientDataJSON, not clientDataHash)
  *
  * @example
  *   // requires: `assertion` -- credential.response from navigator.credentials.get();

package/lib/webcrypto.js

@@ -20,7 +20,7 @@
  *   Unlike the browser's built-in `crypto.subtle`, this engine is
  *   **PQC-first without being PQC-only**: the FIPS 204 ML-DSA and FIPS
  *   205 SLH-DSA signature suites sit alongside the full classical set PKI
- *   still runs on -- RSASSA-PKCS1-v1_5, RSA-PSS, RSA-OAEP, ECDSA, ECDH,
+ *   still runs on: RSASSA-PKCS1-v1_5, RSA-PSS, RSA-OAEP, ECDSA, ECDH,
  *   Ed25519 / Ed448, AES-GCM / CBC / KW, HMAC, HKDF, PBKDF2, the SHA family
  *   (including legacy SHA-1 for old certificates and signatures), and the
  *   SHAKE128 / SHAKE256 extendable-output functions as message digests.
@@ -193,8 +193,8 @@ var SECRET_KEY_NAMES = intrinsic.assign(intrinsic.create(null), { "AES-GCM": tru
  *
  * Opaque handle to key material, matching the W3C `CryptoKey` shape:
  * `{ type, extractable, algorithm, usages }`. The underlying
- * `node:crypto` KeyObject is non-enumerable and never serialized --
- * extract material only through `subtle.exportKey`, and only when the key
+ * `node:crypto` KeyObject is non-enumerable and never serialized.
+ * Extract material only through `subtle.exportKey`, and only when the key
  * was created `extractable`. Instances are produced by
  * `subtle.generateKey` / `subtle.importKey`; the constructor is rarely
  * called directly.

package/lib/x509-sign.js

@@ -195,13 +195,13 @@ function _hasCriticalSan(extSpec) {
  * @defends forged-certificate-issuance (CWE-347)
  * @related pki.schema.x509.parse, pki.path.validate, pki.cms.sign
  *
- * Build, sign, and DER-encode an X.509 certificate. `spec` describes the certificate to issue --
+ * Build, sign, and DER-encode an X.509 certificate. `spec` describes the certificate to issue:
  * `subject` (a string CN, an array of RDNs, or raw Name DER), `subjectPublicKey` (the SPKI DER of the
  * key being certified), `notBefore` / `notAfter` (`Date`s), an optional `serialNumber`, and an optional
  * `extensions` object. `issuer` is the signing side: `{ key }` alone issues a self-signed certificate
  * (issuer = subject, signed with the subject's own key); `{ name, publicKey, key }` or `{ cert, key }`
- * issues a CA-signed one. The signing key `key` is a WebCrypto `CryptoKey` -- a `pki.key.generate`
- * private key passed directly, without exporting -- or a PKCS#8 private key as DER (`Buffer`) or PEM
+ * issues a CA-signed one. The signing key `key` is a WebCrypto `CryptoKey` (a `pki.key.generate`
+ * private key passed directly, without exporting) or a PKCS#8 private key as DER (`Buffer`) or PEM
  * (`string`); a public or secret CryptoKey, or a `node:crypto` KeyObject, is refused. A `subjectAltName`
  * (or any `GeneralName`) entry may be a form object (`{ dNSName: "..." }`) or a bare string classified
  * fail-closed into its form (`"host.example"`, `"a@b.example"`, `"10.0.0.1"`, `"https://host.example/"`).
@@ -213,8 +213,8 @@ function _hasCriticalSan(extSpec) {
  * (positive, <= 20 octets), the validity UTCTime/GeneralizedTime cutover, the DER DEFAULT omissions
  * (v1 tag, `critical=FALSE`, `cA=FALSE`), and the CA cross-field rules (keyCertSign and
  * pathLenConstraint require cA=TRUE) are all enforced; a violation throws a typed `CertificateError`.
- * Where the spec carries raw DER -- a `Name` Buffer, a pre-encoded `Extension`, an issuer `publicKey`
- * SPKI -- a structural fault throws `CertificateError`, while a malformed leaf inside those bytes
+ * Where the spec carries raw DER (a `Name` Buffer, a pre-encoded `Extension`, an issuer `publicKey`
+ * SPKI), a structural fault throws `CertificateError`, while a malformed leaf inside those bytes
  * throws `Asn1Error`, the same two-error contract the parsers present.
  *
  * @opts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.29",
+  "version": "0.6.31",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:e72c9e5f-07a6-48ad-bf71-a361b1470bef",
+  "serialNumber": "urn:uuid:692adf4f-5fb7-41cd-94f6-da6509e828d9",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-03T05:34:38.589Z",
+    "timestamp": "2026-09-04T15:47:45.151Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.29",
+      "bom-ref": "@blamejs/pki@0.6.31",
       "type": "application",
       "name": "pki",
-      "version": "0.6.29",
+      "version": "0.6.31",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.29",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.31",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.29",
+      "ref": "@blamejs/pki@0.6.31",
       "dependsOn": []
     }
   ]