@blamejs/pki 0.6.44 → 0.6.46

package/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.6.46 — 2026-09-06
+
+A Sigstore bundle can be checked against the certificate-transparency logs that recorded the signing certificate.
+
+### Added
+
+- pki.sigstore.verifyBundle accepts opts.ctLogs, an array of { keyId, spki, validFor? } in the same shape it takes for the Rekor keys, so an operator builds both from the one trusted-root document. When supplied, the certificate-transparency receipt Fulcio embeds in the signing certificate (RFC 6962 section 3.2) is verified: the logged entry is reconstructed from the certificate as it stood before the receipt was added, bound to the key hash of the certificate that issued it, and checked under the key of the pinned log the receipt names. At least one receipt must verify against a pinned log, which is the RFC 6962 section 3.3 floor. A log's validFor window is read at the instant the receipt was signed, since that is when the key was the log's rather than when the artifact was later logged, and a receipt dated after the instant being validated at is not counted (section 5.2); with no opts.time that instant is the end of the Rekor entry's own second, which allows for the entry recording whole seconds while a receipt carries milliseconds and accepts nothing beyond it. The verdict gains sctChecked, saying whether the check ran, and validScts, counting the receipts that verified. A receipt that verifies against no pinned log, and a certificate carrying no receipt at all, are each refused with sigstore/sct-unverified or sigstore/sct-missing rather than passing quietly. The check is opt-in: a caller that supplies no ctLogs verifies exactly as before and reads sctChecked false, while an empty array is refused with sigstore/bad-input rather than read as a policy that checks nothing.
+
+## v0.6.45 — 2026-09-06
+
+A certification path reaching a certificate signed with a stateful hash-based key validates without a separate call.
+
+### Added
+
+- pki.path.validate verifies a certificate signed with the RFC 9802 stateful hash-based algorithm id-alg-hss-lms-hashsig, and pki.crl.verify a certificate revocation list signed with it, which RFC 9802 section 6 provides for alongside the certificate. The signature covers the whole tbsCertificate rather than a digest of it (section 7.1); the RFC 8554 public key is read from the subjectPublicKey BIT STRING and the signature from signatureValue, neither carrying further ASN.1 wrapping (sections 5 and 6); the algorithm identifier carries no parameters; and the subject public key must name the algorithm the signature names, so a certificate advertising one algorithm over a key of another is refused. A key or signature the engine cannot read is a path/bad-signature verdict, never a pass. Every other section 6.1 check is unchanged, so an expired or otherwise faulty HSS certificate fails for the reason it should. A certificate carrying any of the three stateful hash-based keys, HSS, XMSS or XMSS^MT, is also held to the RFC 9802 section 6 key-usage rule whichever algorithm signed it, reported as the hbsKeyUsage check and refused with path/hbs-key-usage: a certification authority's certificate must assert at least one of digitalSignature, nonRepudiation, keyCertSign or cRLSign, an end entity's at least one of digitalSignature, nonRepudiation or cRLSign, and neither may assert any value outside its own list, so a key offered for encryption is refused. An absent keyUsage extension is unrestricted. The end-to-end proof is the self-signed certificate published in RFC 9802 Appendix A, which now validates through pki.path.validate. Signing remains out of scope: a stateful key's one-time state belongs in hardware that owns it.
+
 ## v0.6.44 — 2026-09-06
 
 An enrollment client reaches a certification authority through a proxy that demands Digest authentication.

package/README.md

@@ -246,10 +246,10 @@ comment blocks, is at [pkijs.com](https://pkijs.com).
 | `pki.ct` | Certificate Transparency (RFC 6962). `parseSctList` decodes the `SignedCertificateTimestampList` a certificate or OCSP response carries, a TLS-presentation-language payload inside the §3.3 double DER wrap, into per-SCT log id, exact `timestamp` (BigInt), named signature algorithm, and raw signature. `reconstructSignedData` rebuilds the exact `digitally-signed` preimage, and `verifySct` verifies an SCT signature against a log's public key, routing an ECDSA signature through the strict DER-conformance gate and verifying through the crypto engine, resolving true or false and throwing a typed error on a structural fault. On the producing side, `encodeSctList` builds the extension value byte for byte as the exact inverse of `parseSctList`, and `signSct` performs a log's signing step. For trust, `parseLogList` ingests the CT log-list JSON into constraint-carrying trusted logs, recomputing each log's id as SHA-256 of its key and refusing a disagreeing id (a swapped key, §3.2) and decoding the state and temporal-interval constraints; `verifySctWithLogList` resolves the log key from an SCT's log id, enforces the state (usable, qualified, and readonly trusted; retired only before retirement; pending and rejected refused) and the temporal-interval window, then delegates the signature check to `verifySct`. `verifyLogListSignature(json, signature, publicKey)` verifies the detached `log_list.sig` over the raw log-list bytes against a caller-pinned signer key (RSASSA-PKCS1-v1.5/SHA-256 and an EC P-256 arm, with forgeable-key defenses failing closed), cross-checked against `openssl dgst`. `fetchLogList(opts)` turns that chain into a live client: it GETs the `log_list.json` and its detached `log_list.sig` over `pki.transport`, verifies the detached signature over the raw fetched bytes against a caller-pinned distributor key before parsing, so an unverified document is never parsed, read, cached, or surfaced, then ingests the same bytes through `parseLogList` and returns the trusted-log set plus the surfaced `version` and `timestamp`. Above the per-SCT layer, `verifySctList` renders a certificate-level verdict over every SCT a certificate carries (§3.3), reporting how many distinct trusted logs verified an SCT (so a duplicated SCT cannot inflate the count) and from how many distinct trusted operators against a caller's CT policy (`minScts` and `minOperators`, both defaulting to the RFC floor of one), where a policy shortfall is a verdict and a per-SCT failure is a recorded row rather than a thrown call; `x509CertEntry` reconstructs the precertificate log entry from a final certificate by removing the SCT-list extension from its TBSCertificate as byte surgery, so its embedded SCTs verify end to end (§3.2). The toolkit bakes in no vendor URL or key, TLS trust is explicit with `rejectUnauthorized` always on, each response is size-capped before the trust chain, and the transport is injectable so the whole path is testable offline — `parseSctList`, `reconstructSignedData`, `verifySct`, `encodeSctList`, `signSct`, `parseLogList`, `verifySctWithLogList`, `verifySctList`, `x509CertEntry`, `verifyLogListSignature`, `fetchLogList` |
 | `pki.merkle` | Merkle-tree proof verification (RFC 6962 / RFC 9162). `leafHash`, `nodeHash`, and `emptyRootHash` build the domain-separated (0x00 leaf, 0x01 node) SHA-256 tree hashes. `verifyInclusion` folds an audit proof back to a root, and `verifyConsistency` reconstructs both the old and new root, which is the append-only guarantee; each is constant-time-compared to a trusted checkpoint root. Fail-closed on bad geometry, sync hashing, transport-free — `leafHash`, `nodeHash`, `emptyRootHash`, `verifyInclusion`, `verifyConsistency` |
 | `pki.trust` | Mozilla and CCADB trust-store ingestion. `parseCertdata` reads the NSS `certdata.txt` object stream and `parseCcadbCsv` the CCADB CSV export, both into one constraint-carrying anchor shape: the per-purpose trust bits, where only `CKT_NSS_TRUSTED_DELEGATOR` grants, and the per-purpose distrust-after dates the bare root list omits. Certificate and trust objects pair by byte-exact issuer and serial rather than adjacency and are cross-checked against the parsed DER, so metadata cannot attach to the wrong root. `anchor()` hands an entry to `pki.path.validate({ trustAnchors, checkPurpose })`, and `anchor(entry, { nameConstraints })` attaches the namespace a root program trusts a root for when that is narrower than the root certificate states, a `{ permitted, excluded }` pair of `{ tag, base }` subtrees that `validate` seeds as the RFC 5280 §6.1.1(h)(i) initial value, intersecting with each certificate's own constraints. Offline, fail-closed, bounded — `parseCertdata`, `parseCcadbCsv`, `anchor` |
-| `pki.shbs` | Stateful hash-based signature verification: HSS/LMS (RFC 8554), carried in X.509 by RFC 9802 and in CMS by RFC 9708, profiled by NIST SP 800-208 for CNSA 2.0 firmware signing. `verify` checks an HSS signature, where every level must pass, and `verifyLms` a single-tree LMS, over the raw public-key and signature blobs the parsers already surface. Pure public-input SHA-256 and SHAKE256 hashing, a data-driven typecode registry, and bounds-before-slice reads; a malformed blob throws a typed `ShbsError` while a well-formed but wrong signature returns `false`. Verification only by design, since stateful signing needs atomic one-time-key state that belongs in an HSM — `verify`, `verifyLms` |
+| `pki.shbs` | Stateful hash-based signature verification: HSS/LMS (RFC 8554), carried in X.509 by RFC 9802 and in CMS by RFC 9708, profiled by NIST SP 800-208 for CNSA 2.0 firmware signing. `verify` checks an HSS signature, where every level must pass, and `verifyLms` a single-tree LMS, over the raw public-key and signature blobs the parsers already surface. Pure public-input SHA-256 and SHAKE256 hashing, a data-driven typecode registry, and bounds-before-slice reads; a malformed blob throws a typed `ShbsError` while a well-formed but wrong signature returns `false`. Verification only by design, since stateful signing needs atomic one-time-key state that belongs in an HSM. `pki.path.validate` verifies an HSS-signed certificate on its own, so a chain reaching one needs no separate call: the signature covers the whole tbsCertificate rather than a digest of it (RFC 9802 §7.1), and a CertificateList naming the algorithm takes the same route. It is proven against the self-signed certificate RFC 9802 Appendix A publishes — `verify`, `verifyLms` |
 | `pki.hpke` | Hybrid Public Key Encryption (RFC 9180), the encrypt-to-a-public-key primitive behind TLS ECH, MLS, and OHTTP. `setupS` and `setupR` establish a sender or recipient context (KEM encapsulation plus the HKDF key schedule); the context's `seal` and `open` AEAD-encrypt with a sequence-counter nonce, and `export` derives further secrets; the module-level `seal` and `open` are single-shot wrappers. DHKEM (P-256, P-521, X25519, X448) by HKDF-SHA256/SHA512 by AES-GCM / ChaCha20Poly1305 / export-only, across all four modes, proven against the RFC 9180 Appendix A vectors. DHKEM(P-384) and HKDF-SHA384 are RFC-registered but Appendix A ships no vector for them, so they fail closed until an authoritative KAT exists. Pure composition over `node:crypto`; ML-KEM and X-Wing are a registry data-row extension pending stable drafts — `suites`, `setupS`, `setupR`, `seal`, `open` |
 | `pki.kem` | Composite ML-KEM key establishment (draft-ietf-lamps-pq-composite-kem), a post-quantum ML-KEM hybridized with a traditional RSA-OAEP, ECDH, X25519, or X448 so the established secret holds if either component is later broken. `encapsulate` turns a recipient's composite `SubjectPublicKeyInfo` into a 256-bit shared secret and a ciphertext; `decapsulate` recovers the same secret from the ciphertext and the composite PKCS#8 private key. Each component KEM runs independently and the two secrets are mixed through a SHA3-256 combiner that binds the traditional ciphertext, the traditional public key, and a per-algorithm label. The twelve algorithms pair ML-KEM-768 and ML-KEM-1024 with RSA-OAEP 2048/3072/4096, ECDH over P-256/P-384/P-521 and brainpoolP256r1/P384r1, X25519, and X448, each verified against the draft Appendix G known-answer vectors; a malformed key or ciphertext, an unsupported algorithm, or a component decapsulation failure throws a typed `KemError` — `encapsulate`, `decapsulate` |
-| `pki.sigstore` | Offline verifier for a Sigstore bundle, the artifact `npm publish --provenance` produces and the registry serves. `verifyBundle` composes five fail-closed legs against caller-pinned trust (Fulcio CA roots and Rekor log keys, never trusted from the bundle): the DSSE signature over its PAE preimage under the Fulcio leaf key, the ephemeral Fulcio certificate chain validated as of the Rekor log time, the RFC 9162 inclusion proof folded to a Rekor-signed tree root, the log entry bound to this exact signature, and the in-toto SLSA subject digest the caller confirms against the published artifact. It reuses the X.509 parser, the RFC 5280 path validator, and the Merkle verifier; the net-new codecs are the DSSE PAE byte-builder and a fail-closed JSON reader. `verified: true` says the artifact was signed and logged, not that a party you trust signed it — Fulcio issues to anyone who completes an OIDC flow, so who signed is decided only by `opts.identity`, and `identityChecked` reports which of its fields were compared. An identity policy naming no field, or a field name that is not one of the three, is refused rather than satisfied — either would accept every signer while reading as a policy in force — `pae`, `parseBundle`, `verifyBundle` |
+| `pki.sigstore` | Offline verifier for a Sigstore bundle, the artifact `npm publish --provenance` produces and the registry serves. `verifyBundle` composes five fail-closed legs against caller-pinned trust (Fulcio CA roots and Rekor log keys, never trusted from the bundle): the DSSE signature over its PAE preimage under the Fulcio leaf key, the ephemeral Fulcio certificate chain validated as of the Rekor log time, the RFC 9162 inclusion proof folded to a Rekor-signed tree root, the log entry bound to this exact signature, and the in-toto SLSA subject digest the caller confirms against the published artifact. It reuses the X.509 parser, the RFC 5280 path validator, and the Merkle verifier; the net-new codecs are the DSSE PAE byte-builder and a fail-closed JSON reader. `verified: true` says the artifact was signed and logged, not that a party you trust signed it — Fulcio issues to anyone who completes an OIDC flow, so who signed is decided only by `opts.identity`, and `identityChecked` reports which of its fields were compared. An identity policy naming no field, or a field name that is not one of the three, is refused rather than satisfied — either would accept every signer while reading as a policy in force. A sixth leg is opt-in: pinning the certificate-transparency logs in `opts.ctLogs` checks the receipt Fulcio embeds in the certificate it issues (RFC 6962 §3.2), verified over the certificate as it stood before the receipt was added and under the key of the log that issued it, so the verdict says the signing certificate was public when it was issued rather than handed out quietly. At least one receipt must verify against a pinned log, the verdict reports `sctChecked` and `validScts`, and an empty log set is refused rather than read as a policy that checks nothing — `pae`, `parseBundle`, `verifyBundle` |
 | `pki.inspect` | Human-readable inspection, the pure-JS equivalent of `openssl x509/crl/req/cms -text`. `certificate(pem \| der \| parsed)` renders an OpenSSL-style report: version, serial, signature algorithm, issuer and subject distinguished names, validity, public-key details (curve or modulus size plus the raw point or modulus), every decoded extension with its critical flag, and the signature. `crl`, `csr`, and `cms` render the other formats the same way — a CRL like `openssl crl -text`, a CSR like `openssl req -text`, and a CMS message like `openssl cms -cmsout -print`, with a stable summary for a non-SignedData ContentInfo — and `any(input)` detects the format and routes to the right report. Built over the strict parsers and the two-way OID registry with one set of field renderers, it names extension and algorithm OIDs an OpenSSL build shows only as raw bytes. No OpenSSL dependency, and the format is stable and OpenSSL-familiar rather than pinned to one OpenSSL version. A certificate policy's user notice renders as text, both its explicit text and a notice reference with the notice numbers that identify it, rather than hex, and a malformed part falls back to a hex dump rather than throwing — `certificate`, `crl`, `csr`, `cms`, `any` |
 | `pki.webauthn` | WebAuthn and passkey verification, both halves: offline trust evaluation of a W3C WebAuthn (Level 3) registration, and signature verification of the assertion every login returns. `parseAttestationObject(bytes)` decodes the CBOR attestation object, authenticatorData, and COSE credential key over the strict `pki.cbor` codec; `parseAuthenticatorData(bytes)` reads the bare form an assertion carries through the same parser; `parseClientData(bytes, opts)` decodes the `clientDataJSON` no signature check looks inside, through the shared JSON guard since these are attacker-chosen bytes, returning the challenge decoded so a caller compares bytes rather than spellings, and checking the ceremony type, challenge, and origin when the relying party supplies what it issued. `verifyAssertion(input)` verifies an assertion signature over `authenticatorData \|\| SHA-256(clientDataJSON)` — raw bytes, no COSE_Sign1, an ES256 signature in ASN.1 DER — and applies the §7.2 step 21 counter rule when a stored `previousSignCount` is given, so a counter that fails to advance is refused as a cloned authenticator. `verify(attestationObject, clientDataHash, opts)` checks the attestation-statement signature and each format's structural bindings for packed, tpm, android-key, apple, fido-u2f, and none: the x5c leaf key, the apple nonce, the tpm `certInfo` Name and `extraData` over the `pubArea`, the android `KeyDescription`, and the fido-u2f `verificationData`. It binds the credential public key to each attestation, through the signed authenticatorData for packed and fido-u2f or a cert or `pubArea`-key equality check for android-key, apple, and tpm, and enforces each leaf's certificate requirements. The credential-key check covers the full WebAuthn COSE algorithm set — ES256/384/512, RS256/384/512, PS256/384/512, EdDSA (Ed25519), and the RFC 9864 fully-specified identifiers ESP256/384/512, Ed25519, and Ed448 — validating the public-key point on its curve, rejecting the compressed EC point form, and enforcing a minimally encoded DER ECDSA signature. The verdict field is `attestationVerified`, and `signatureVerified` for an assertion, rather than a bare `verified`, because a sound statement is a different claim from an acceptable ceremony: an attestation naming another origin's RP ID with user presence clear is perfectly sound and must not be registered. Pass `expectedRpId`, `requireUserPresence`, `requireUserVerification`, or `allowedAlgorithms` and those are checked, with `bindingChecked` reporting which ran, so a check that passed can be told from one that never happened. Pass `opts.clientDataJSON` instead of the digest and the client data is read here too: the ceremony type is checked unconditionally, since a login response replayed into a registration is what that rule stops, and the challenge, origin, and top-level origin are checked against what the relying party issued, with `clientData.checked` reporting which comparisons ran. A registration verdict also carries the `credentialId`, `credentialPublicKey`, and initial `signCount` a later login needs. A credential key declaring COSE algorithm `-65535` (RSASSA-PKCS1-v1_5 with SHA-1) is refused unless `allowedAlgorithms` names it, since every signature that credential ever makes would use SHA-1. Anchoring the trust path has two routes: `opts.metadata` resolves the roots the authenticator's own model registered, and `opts.rootCertificates` pins roots directly, which is what anchors the formats FIDO MDS does not cover, Apple's authenticators and the Google hardware-attestation roots among them. `metadata` governs when both are given, and `anchoredTo` names every route that anchored the path, joined with `+` when more than one did: `"metadata"`, `"rootCertificates"`, and `"safetyNetRoots"` for the android-safetynet chain, which anchors through the roots that format requires whether or not either other route was asked for. It is `null` only when nothing anchored the path. `verifyMetadataBlob(blob, opts)` reads a FIDO Metadata Service (MDS v3) BLOB, the signed catalogue of registered authenticator models, verifying its JWS and chaining its signer to an operator-supplied FIDO root before the payload is parsed, with sequence-number rollback and `nextUpdate` freshness checks. Passing the result as `opts.metadata` to `verify` resolves the authenticator's registered attestation roots from its identifier and requires the trust path to fully validate to one of them, refusing an unlisted or revoked model. `metadataAnchors(entry, opts)` applies the same status gate for a caller anchoring the path themselves: a model the catalogue has disqualified registers no anchors. Both of the catalogue's key spaces are covered: an aaguid, and the attestation-certificate key identifiers a U2F authenticator is listed under instead. No FIDO root is bundled, there is no trust-on-first-use, and retrieving the BLOB is out of scope. Fail-closed with typed `webauthn/*` errors — `parseAttestationObject`, `verify`, `verifyMetadataBlob`, `metadataFor`, `metadataAnchors` |
 | `pki.lint` | Certificate linting, the zlint or pkilint of JavaScript. `certificate(pem \| der \| parsed, opts)` walks a parsed certificate and emits graded advisory findings, each with a stable id, a severity (`fatal`, `error`, `warn`, `notice`), a source, a spec-clause citation, and a message, against the RFC 5280 profile plus a representative CA/Browser Forum TLS BR subset: serial sign and size, validity ordering and the SC081v3 reducing validity schedule, keyCertSign coherence, extension criticality (basicConstraints, nameConstraints, policyConstraints and inhibitAnyPolicy must be critical, and keyUsage should be), nameConstraints CA-scope, unknown critical extensions, empty-subject SAN, SKI and AKI presence including the end-entity subjectKeyIdentifier, SAN required and CN-in-SAN, dNSName syntax, serverAuth EKU, weak keys, and the §4.2.1.4 certificate-policy user-notice rules (a VisibleString or BMPString explicitText, a notice past 200 characters, an empty notice, control characters, and a non-NFC UTF8String notice, each at the strength the clause states). Alone among these entries the data path never throws: hostile bytes return a `fatal` `lint/unparseable` finding carrying the strict parser's code, so a whole directory lints without a try/catch, and only config-time misuse throws a typed `LintError` — `certificate`, `rules`, `profiles` |

package/lib/composite-sig.js

@@ -8,6 +8,7 @@ var oid = require("./oid");
 var webcrypto = require("./webcrypto");
 var validator = require("./validator-all");
 var edwardsPoint = require("./edwards-point");
+var _verdictOf = require("./guard-verdict").of;
 var subtle = webcrypto.webcrypto.subtle;
 var _b = asn1.build;
 
@@ -96,20 +97,23 @@ function _verifyTradComponent(trad, tradPK, tradSig, mprime, E, badSig) {
   return Promise.resolve(false);
 }
 
+/** @internal Every verdict this returns carries its own `then`: resolving a promise reads that property
+ * off the value, so an inherited accessor would run with the verdict as its receiver and could hand the
+ * caller a different object than the one the comparison produced (see guard-verdict). */
 function compositeVerify(spkiBytes, sigBytes, message, d, E, unsupported, badSig) {
   if (d.trad.unsupported) {
-    return Promise.resolve({ ok: false, code: unsupported,
-      error: new E(unsupported, "composite " + d.name + ": " + d.trad.unsupported) });
+    return Promise.resolve(_verdictOf({ ok: false, code: unsupported,
+      error: new E(unsupported, "composite " + d.name + ": " + d.trad.unsupported) }));
   }
   var rawKey;
   try {
     var bs = asn1.read.bitString(asn1.decode(spkiBytes).children[1]);
     if (bs.unusedBits !== 0) throw new E(badSig, "composite subjectPublicKey has unused bits");
     rawKey = bs.bytes;
-  } catch (e) { return Promise.resolve({ ok: false, code: _codeOf(e, badSig), error: e }); }
+  } catch (e) { return Promise.resolve(_verdictOf({ ok: false, code: _codeOf(e, badSig), error: e })); }
   if (rawKey.length <= d.mldsaPk || sigBytes.length <= d.mldsaSig) {
-    return Promise.resolve({ ok: false, code: badSig,
-      error: new E(badSig, "composite key/signature shorter than the fixed ML-DSA component") });
+    return Promise.resolve(_verdictOf({ ok: false, code: badSig,
+      error: new E(badSig, "composite key/signature shorter than the fixed ML-DSA component") }));
   }
   var mldsaPK = rawKey.subarray(0, d.mldsaPk), tradPK = rawKey.subarray(d.mldsaPk);
   var mldsaSig = sigBytes.subarray(0, d.mldsaSig), tradSig = sigBytes.subarray(d.mldsaSig);
@@ -118,8 +122,8 @@ function compositeVerify(spkiBytes, sigBytes, message, d, E, unsupported, badSig
     var mldsaP = subtle.importKey("spki", _mldsaSpki(d.mldsaOid, mldsaPK), { name: d.mldsa }, false, ["verify"])
       .then(function (mk) { return subtle.verify({ name: d.mldsa, context: d.label }, mk, mldsaSig, mprime); });
     var tradP = _verifyTradComponent(d.trad, tradPK, tradSig, mprime, E, badSig);
-    return Promise.all([mldsaP, tradP]).then(function (r) { return { ok: r[0] === true && r[1] === true }; });
-  }).catch(function (e) { return { ok: false, code: _codeOf(e, badSig), error: e }; });
+    return Promise.all([mldsaP, tradP]).then(function (r) { return _verdictOf({ ok: r[0] === true && r[1] === true }); });
+  }).catch(function (e) { return _verdictOf({ ok: false, code: _codeOf(e, badSig), error: e }); });
 }
 
 function resolveCompositeDescriptor(sigAlg, E, unsupported) {

package/lib/path-validate.js

@@ -52,12 +52,17 @@ var cmpSession = require("./cmp-session");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
 var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
+var _resolve = intrinsic.uncurry(intrinsic.promiseResolve);
 var constants = require("./constants");
 var validator = require("./validator-all");
 var cms = require("./schema-cms");
 var httpTransport = require("./http-transport");
 var net = require("net");
 var compositeSig = require("./composite-sig");
+/** @internal Captured at load: `pki.shbs` is the same module object the public surface exposes, and its
+ * `verify` is a writable property, so reading it when a signature is checked would let whoever wrote it
+ * last decide the verdict. */
+var _shbsHssVerify = require("./shbs").verify;
 var edwardsPoint = require("./edwards-point");
 
 var PathError = errors.PathError;
@@ -116,6 +121,7 @@ function _sig(name, verify, imp, params, ecdsa, sameKeyOid) {
   if (verify.name === "Ed25519") entry.eddsa = 6;
   else if (verify.name === "Ed448") entry.eddsa = 7;
   SIG_ALGS[oid.byName(name)] = entry;
+  return entry;
 }
 _sig("sha256WithRSAEncryption", { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, "null");
 _sig("sha384WithRSAEncryption", { name: "RSASSA-PKCS1-v1_5", hash: "SHA-384" }, { name: "RSASSA-PKCS1-v1_5", hash: "SHA-384" }, "null");
@@ -135,6 +141,13 @@ _sig("id-ml-dsa-87", { name: "ML-DSA-87" }, { name: "ML-DSA-87" }, "absent", fal
   _sig("id-slh-dsa-" + set, { name: wc }, { name: wc }, "absent", false, true);
 });
 
+/** @internal RFC 9802: a stateful hash-based signature over the whole tbsCertificate rather than a digest
+ * of it (sec. 7.1), with the RFC 8554 public key carried directly in the subjectPublicKey BIT STRING and the
+ * signature directly in signatureValue, neither with any further ASN.1 wrapping (sec. 5, sec. 6). It verifies
+ * through the toolkit's own engine rather than the crypto engine, so the descriptor names that route instead
+ * of an import. Verification only: signing a stateful key belongs in hardware that owns the state. */
+_sig("id-alg-hss-lms-hashsig", { name: "HSS-LMS" }, null, "absent", false, true).shbs = true;
+
 var OID_RSA_PSS = oid.byName("rsassaPss");
 var OID_MGF1 = oid.byName("mgf1");
 var HASH_BY_OID = intrinsic.create(null);
@@ -244,6 +257,46 @@ function compositeKeyUsageCheck(cert) {
   return { ok: true };
 }
 
+var STATEFUL_HBS_OIDS = intrinsic.create(null);
+["id-alg-hss-lms-hashsig", "id-alg-xmss-hashsig", "id-alg-xmssmt-hashsig"].forEach(function (n) { STATEFUL_HBS_OIDS[oid.byName(n)] = true; });
+
+/** @internal RFC 9802 sec. 6 states the rule twice, and the two differ: a certification authority's
+ * certificate may assert keyCertSign, an end entity's may not. Both must assert at least one of the values
+ * their list names, and neither may assert any value outside it. An absent extension is unrestricted, as
+ * RFC 5280 sec. 4.2.1.3 has it. */
+/** @internal Whether the certificate states that it is a certification authority. An extension that does
+ * not decode leaves the stricter end-entity rule in force. */
+function _isCaCert(cert) {
+  var bc;
+  try { bc = decodeExt(cert, OID.basicConstraints); }
+  // allow:swallow-unverified a basicConstraints that cannot be read is refused by its own check
+  catch (_e) { return false; }
+  return !!(bc && bc.value && bc.value.cA === true);
+}
+
+function statefulHbsKeyUsageCheck(cert, isCa) {
+  var ku;
+  try { ku = decodeExt(cert, OID.keyUsage); }
+  catch (e) { return { ok: false, code: "path/hbs-key-usage", error: e }; }
+  if (!ku) return { ok: true };
+  var v = ku.value;
+  var where = isCa ? "a certification authority" : "an end entity";
+  var allowed = isCa ? "digitalSignature, nonRepudiation, keyCertSign or cRLSign"
+    : "digitalSignature, nonRepudiation or cRLSign";
+  var asserted = v.digitalSignature || v.nonRepudiation || v.cRLSign || v.keyCertSign;
+  if (!asserted) {
+    return { ok: false, code: "path/hbs-key-usage",
+      error: E("path/hbs-key-usage", "a stateful hash-based key in " + where + " certificate must assert at least one of " + allowed + " (RFC 9802 sec. 6)") };
+  }
+  var forbidden = v.keyEncipherment || v.dataEncipherment || v.keyAgreement || v.encipherOnly ||
+    v.decipherOnly || (!isCa && v.keyCertSign) || (v.reservedBitsSet === true);
+  if (forbidden) {
+    return { ok: false, code: "path/hbs-key-usage",
+      error: E("path/hbs-key-usage", "a stateful hash-based key in " + where + " certificate must assert no keyUsage value outside " + allowed + " (RFC 9802 sec. 6)") };
+  }
+  return { ok: true };
+}
+
 var ML_KEM_OIDS = intrinsic.create(null);
 ["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"].forEach(function (n) { ML_KEM_OIDS[oid.byName(n)] = true; });
 
@@ -269,14 +322,38 @@ function _importVerifyKey(spkiBytes, d) {
   return subtle.importKey("spki", spkiBytes, d.imp, false, ["verify"]);
 }
 
+/** @internal The RFC 8554 public key the SubjectPublicKeyInfo carries, and the verdict on a signature over
+ * `message`. A key or signature the engine cannot read is a refusal, never a pass. */
+function _shbsVerify(spkiBytes, sigBytes, message) {
+  var rawKey;
+  /** @internal An RFC 8554 public key is a whole number of octets, and the codec accepts a BIT STRING that
+   * declares unused bits as long as they are zero, so the same key admits a second encoding unless the
+   * count is checked. The signature is held to the same rule by its caller. */
+  try {
+    var bits = asn1.read.bitString(asn1.decode(spkiBytes).children[1]);
+    if (!guard.crypto.isOctetAligned(bits)) {
+      return guard.verdict.of({ ok: false, code: "path/bad-signature",
+        error: E("path/bad-signature", "an HSS subjectPublicKey must be a whole number of octets, and this one declares " + bits.unusedBits + " unused bits") });
+    }
+    rawKey = bits.bytes;
+  } catch (e) { return guard.verdict.of({ ok: false, code: pathCode(e, "path/bad-signature"), error: e }); }
+  try {
+    return guard.verdict.of({ ok: _shbsHssVerify(rawKey, message, sigBytes) === true });
+  } catch (e) { return guard.verdict.of({ ok: false, code: pathCode(e, "path/bad-signature"), error: e }); }
+}
+
 function builtinVerify(state, cert) {
   var d;
   try {
     d = resolveDescriptor(cert.signatureAlgorithm);
     assertKeyMatchesSigAlg(state.workingPublicKey, cert.signatureAlgorithm.oid, d);
-  } catch (e) { return Promise.resolve({ ok: false, code: pathCode(e, "path/unsupported-algorithm"), error: e }); }
-  if (!guard.crypto.isOctetAligned(cert.signatureValue)) return Promise.resolve({ ok: false, code: "path/bad-signature" });
+  /** @internal Resolving reads `then` off the value, so a synchronous verdict is built with an own one:
+   * an inherited accessor would otherwise run with the verdict as its receiver and hand the caller a
+   * different object (see guard-verdict). */
+  } catch (e) { return _resolve(Promise, guard.verdict.of({ ok: false, code: pathCode(e, "path/unsupported-algorithm"), error: e })); }
+  if (!guard.crypto.isOctetAligned(cert.signatureValue)) return _resolve(Promise, guard.verdict.of({ ok: false, code: "path/bad-signature" }));
   if (d.composite) return compositeSig.compositeVerify(state.workingPublicKey, cert.signatureValue.bytes, cert.tbsBytes, d.composite, PathError, "path/unsupported-algorithm", "path/bad-signature");
+  if (d.shbs) return _resolve(Promise, _shbsVerify(state.workingPublicKey, cert.signatureValue.bytes, cert.tbsBytes));
   var key;
   return _importVerifyKey(state.workingPublicKey, d).then(function (k) {
     key = k;
@@ -875,6 +952,26 @@ function validateCriticalExtensionStructure(cert) {
  * re-entrant: no input object is mutated. An empty path or a missing anchor
  * throws a typed `PathError`.
  *
+ * A certificate signed with the RFC 9802 stateful hash-based algorithm
+ * `id-alg-hss-lms-hashsig` is verified like any other, through the toolkit's own
+ * HSS engine rather than the crypto engine. The signature covers the whole
+ * tbsCertificate rather than a digest of it (RFC 9802 7.1), the RFC 8554 public
+ * key is read from the subjectPublicKey BIT STRING and the signature from
+ * signatureValue with no further ASN.1 wrapping (5, 6), the algorithm identifier
+ * carries no parameters, and the subject public key must name the algorithm the
+ * signature names. A `pki.crl.verify` CertificateList naming it takes the same
+ * route, which 6 provides for. Signing is out of scope: a stateful key's
+ * one-time state belongs in hardware that owns it.
+ *
+ * A certificate carrying any of the three stateful hash-based keys, HSS, XMSS or
+ * XMSS^MT, is held to the RFC 9802 6 key-usage rule whichever algorithm signed
+ * it, reported as the `hbsKeyUsage` check and refused with `path/hbs-key-usage`.
+ * The rule differs by role: a certification authority's certificate must assert
+ * at least one of digitalSignature, nonRepudiation, keyCertSign or cRLSign, an
+ * end entity's at least one of digitalSignature, nonRepudiation or cRLSign, and
+ * neither may assert any value outside its own list. An absent keyUsage is
+ * unrestricted, as RFC 5280 4.2.1.3 has it.
+ *
  * `valid` alone cannot say whether revocation was ever established, so
  * `revocationChecked` answers separately, taking the WEAKEST outcome on the
  * path: `false` when no `revocationChecker` was supplied, `"determined"` when
@@ -1077,6 +1174,12 @@ async function validate(path, opts) {
       if (!cku.ok) failed = true;
     }
 
+    if (STATEFUL_HBS_OIDS[cert.subjectPublicKeyInfo.algorithm.oid]) {
+      var hku = statefulHbsKeyUsageCheck(cert, _isCaCert(cert));
+      guard.list.append(checks, { name: "hbsKeyUsage", ok: hku.ok, code: hku.ok ? undefined : hku.code });
+      if (!hku.ok) failed = true;
+    }
+
     if (ML_KEM_OIDS[cert.subjectPublicKeyInfo.algorithm.oid]) {
       var kku = kemKeyUsageCheck(cert);
       guard.list.append(checks,{ name: "kemKeyUsage", ok: kku.ok, code: kku.ok ? undefined : kku.code });
@@ -1653,6 +1756,9 @@ function _verifyWithSpki(sigAlg, rawSig, spkiBytes, tbsBytes) {
     assertKeyMatchesSigAlg(spkiBytes, sigAlg.oid, d);
   } catch (_e) { return Promise.resolve(false); }
   if (d.composite) return compositeSig.compositeVerify(spkiBytes, rawSig, tbsBytes, d.composite, PathError, "path/unsupported-algorithm", "path/bad-signature").then(function (r) { return r.ok === true; });
+  /** @internal RFC 9802 sec. 6 names the CertificateList as well as the Certificate, so a revocation list
+   * signed with a stateful hash-based key reaches the same engine the certificate path uses. */
+  if (d.shbs) return _resolve(Promise, _shbsVerify(spkiBytes, rawSig, tbsBytes).ok === true);
   return _importVerifyKey(spkiBytes, d).then(function (key) {
     var sig = rawSig;
     if (d.ecdsa) sig = validator.sig.ecdsaDerToP1363(sig, key.algorithm.namedCurve, PathError, "path/bad-signature");

package/lib/sigstore.js

@@ -35,6 +35,7 @@ var pkix = require("./schema-pkix");
 var pathValidate = require("./path-validate");
 var merkle = require("./merkle");
 var oid = require("./oid");
+var ct = require("./ct");
 var edwardsPoint = require("./edwards-point");
 
 var C = constants;
@@ -387,6 +388,81 @@ function _pathToAnchor(leaf, anchor, intBySubject) {
   return null;
 }
 
+var OID_SCT_LIST = oid.byName("signedCertificateTimestampList");
+
+/** @internal The certificate-transparency logs a caller pins, in the shape the Rekor keys take: an
+ * operator builds both from the one trusted-root document. An empty array is refused rather than read
+ * as "no logs to check against", which would turn an opted-in check into a silent pass. */
+function _normCtLogs(ctLogs) {
+  if (!Array.isArray(ctLogs)) throw _err("sigstore/bad-input", "ctLogs must be an array of { keyId, spki, validFor? }");
+  if (ctLogs.length === 0) throw _err("sigstore/bad-input", "ctLogs is empty; omit the option to skip the certificate-transparency check rather than supplying no logs");
+  return ctLogs.map(function (l, i) {
+    if (l === null || typeof l !== "object") throw _err("sigstore/bad-input", "ctLogs[" + i + "] must be { keyId, spki, validFor? }");
+    if (!Buffer.isBuffer(l.keyId)) throw _err("sigstore/bad-input", "ctLogs[" + i + "].keyId must be the log id as a Buffer");
+    if (!Buffer.isBuffer(l.spki)) throw _err("sigstore/bad-input", "ctLogs[" + i + "].spki must be the log's SubjectPublicKeyInfo DER");
+    return { keyId: l.keyId, spki: l.spki, validFor: l.validFor || null };
+  });
+}
+
+/** @internal RFC 6962 sec. 3.2: Fulcio logs the certificate as it issues it and embeds the log's
+ * receipt, so the receipt covers the certificate WITHOUT that extension, under the issuer's key hash.
+ * `pki.ct.x509CertEntry` reconstructs exactly that entry from the final certificate, and each receipt
+ * is checked against the log the caller pinned for it. At least one must verify, which is the sec. 3.3
+ * floor; a receipt from a log the caller did not pin counts for nothing. */
+async function _verifyEmbeddedScts(leaf, leafDer, issuer, ctLogs, timeMs, atMs) {
+  if (ctLogs === undefined || ctLogs === null) return { checked: false, validScts: 0 };
+  var logs = _normCtLogs(ctLogs);
+  var ext = null;
+  var exts = leaf.extensions || [];
+  for (var i = 0; i < exts.length; i++) { if (exts[i].oid === OID_SCT_LIST) { ext = exts[i]; break; } }
+  if (!ext) {
+    throw _err("sigstore/sct-missing", "ctLogs was supplied but the Fulcio certificate carries no signedCertificateTimestampList extension (RFC 6962 sec. 3.3)");
+  }
+  var entry, list;
+  try {
+    entry = ct.x509CertEntry(leafDer, issuer);
+    list = ct.parseSctList(ext.value);
+  } catch (e) { throw _err("sigstore/sct-unverified", "the embedded certificate-transparency receipt could not be read: " + e.message, e); }
+  var valid = 0;
+  for (var s = 0; s < list.scts.length; s++) {
+    var sct = list.scts[s];
+    /** @internal A log key's window says when that key was the log's, so the receipt is held to the
+     * window as it stood when the receipt was signed, not when the artifact was later logged. */
+    var log = _ctLogFor(logs, sct.logId, _sctMs(sct));
+    if (!log) continue;
+    /** @internal RFC 6962 sec. 5.2: a client rejects a receipt dated after the instant it is checking
+     * at, which a log cannot have issued yet. The reference is the caller's own `opts.time` and never
+     * the Rekor entry time, which records whole seconds while a receipt carries milliseconds, so a
+     * receipt issued in the same second as the entry would read as dated after it. The bound is the end
+     * of that second instead, so the granularity is allowed for and nothing later is. The timestamp is a
+     * BigInt and a relational comparison against a Number is exact for both. */
+    if (sct.timestamp != null && sct.timestamp > atMs) continue;
+    if (await _sctVerifies(entry, sct, log.spki)) valid += 1;
+  }
+  if (valid < 1) {
+    throw _err("sigstore/sct-unverified", "no embedded certificate-transparency receipt verified against a pinned log (RFC 6962 sec. 3.3)");
+  }
+  return { checked: true, validScts: valid };
+}
+
+/** @internal A receipt the verifier refuses structurally counted as verified would be the whole leg
+ * lost, so a fault is an unverified receipt and the next one is still tried. */
+function _sctVerifies(entry, sct, spki) {
+  return ct.verifySct(entry, sct, spki).then(function (ok) { return ok === true; }, function () { return false; });
+}
+
+/** @internal A receipt's own instant, in milliseconds. The parser's `timestampMs` is this same value
+ * wherever it is representable, and above 2^53 there is no reachable instant either way. */
+function _sctMs(sct) { return Number(sct.timestamp || 0); }
+
+function _ctLogFor(logs, logIdBytes, timeMs) {
+  var want = Buffer.isBuffer(logIdBytes) ? logIdBytes : Buffer.from(logIdBytes || []);
+  for (var i = 0; i < logs.length; i++) {
+    if (logs[i].keyId.equals(want) && _inWindow(timeMs, logs[i].validFor)) return logs[i];
+  }
+  return null;
+}
+
 async function _verifyChain(leaf, chainDers, fulcioRoots, timeMs) {
   var roots = _normRoots(fulcioRoots);
   var bundleLinks = chainDers.slice(1).map(function (d, i) { return _parseCert(d, "bundle intermediate [" + i + "]"); });
@@ -408,7 +484,11 @@ async function _verifyChain(leaf, chainDers, fulcioRoots, timeMs) {
         trustAnchors: { name: anchor.subject, publicKey: spki.bytes, algorithm: spki.algorithm.oid, parameters: spki.algorithm.parameters },
         requiredEku: ["codeSigning"],
       });
-      if (res.valid) return;
+      /** @internal The path is anchor-proximal first and leaf last, so the certificate directly above
+       * the leaf issued it, and the anchor did when the leaf sits alone. Returning it here is what lets
+       * the certificate-transparency leg reconstruct the logged entry without resolving the issuer a
+       * second time, from a chain this leg has already validated. */
+      if (res.valid) return { issuer: path.length > 1 ? path[path.length - 2] : anchor };
       lastErr = _err("sigstore/chain-invalid", "the Fulcio certificate chain is not valid as of the log time");
     } catch (e) {
       lastErr = _err("sigstore/chain-invalid", "the Fulcio certificate chain failed validation: " + e.message, e);
@@ -468,7 +548,7 @@ function _fulcioExtValue(ext, leafArc) {
 
 var IDENTITY_FIELDS = ["san", "issuer", "sourceRepositoryURI"];
 var IDENTITY_KEYS = Object.assign(Object.create(null), { san: 1, issuer: 1, sourceRepositoryURI: 1 });
-var _VERIFY_BUNDLE_OPTS = Object.assign(Object.create(null), { fulcioRoots: 1, rekorKeys: 1, identity: 1, predicateType: 1, time: 1 });
+var _VERIFY_BUNDLE_OPTS = Object.assign(Object.create(null), { fulcioRoots: 1, rekorKeys: 1, ctLogs: 1, identity: 1, predicateType: 1, time: 1 });
 
 function _checkIdentity(id, policy) {
   // allow:registry-table-inherits-object-prototype -- the identityChecked record an operator reads by field name, whose three keys are the fixed IDENTITY_FIELDS rather than anything the bundle supplies
@@ -525,13 +605,31 @@ function _statement(payload, payloadType, expectedPredicate) {
  * the log entry bound to this exact signature; and the in-toto SLSA statement.
  * Any leg failing throws a typed `sigstore/*` error. On success returns
  * `{ valid: true, verified: true, payload, statement, subjects, predicateType, predicate,
- * identity, identityChecked, predicateTypeChecked, integratedTime, logIndex, logId }` (`valid` is the
+ * identity, identityChecked, predicateTypeChecked, sctChecked, validScts, integratedTime, logIndex, logId }` (`valid` is the
  * canonical toolkit-wide verdict alias of `verified`, `predicateTypeChecked` says whether a pinned
  * `opts.predicateType` was checked, and `logIndex` / `logId` identify the attested Rekor log entry).
  * `payload` is the raw verified
  * envelope bytes (never a re-serialization), and the caller confirms a
  * `subjects[].digest` matches the published artifact.
  *
+ * Fulcio logs every certificate it issues to a certificate-transparency log and
+ * embeds the log's receipt in the certificate (RFC 6962 sec. 3.2). Supplying
+ * `opts.ctLogs` checks it: the receipt is verified over the certificate as it
+ * stood before the receipt was added, under the key of the log that issued it,
+ * and at least one receipt must verify against a pinned log (sec. 3.3). It is
+ * what says the signing certificate was public when it was issued rather than
+ * handed out quietly. The option is opt-in, so a caller that pins no log is
+ * unaffected and `sctChecked` reports `false`; supplying an empty array is
+ * refused rather than read as a policy that checks nothing. `validScts` counts
+ * the receipts that verified.
+ *
+ * A log's `validFor` window is read at the instant the receipt was signed, since
+ * that is when the key was the log's, not at the time the artifact was later
+ * logged. A receipt dated after the instant being validated at is not counted
+ * (RFC 6962 sec. 5.2); with no `opts.time` that instant is the end of the Rekor
+ * entry's own second, which allows for the entry recording whole seconds while a
+ * receipt carries milliseconds, and accepts nothing beyond it.
+ *
  * `verified: true` says the artifact was signed and logged; it says nothing about
  * who. Fulcio issues a certificate to anyone who completes an OIDC flow, so who
  * signed is decided only by `opts.identity`, and `identityChecked` reports which of
@@ -543,6 +641,7 @@ function _statement(payload, payloadType, expectedPredicate) {
  * @opts
  *   fulcioRoots:   Array,      // the Fulcio CA anchors: a DER Buffer or { der, validFor } each
  *   rekorKeys:     Array,      // [{ keyId, spki, validFor? }] the Rekor log public keys
+ *   ctLogs:        Array,      // optional [{ keyId, spki, validFor? }] certificate-transparency logs; when given, the certificate's embedded receipt is checked
  *   identity:      object,     // optional policy: { san, issuer, sourceRepositoryURI }; at least one required when present
  *   predicateType: string,     // optional: require this in-toto predicateType (e.g. the SLSA URI)
  *   time:          Date,       // optional check-date override (default: the Rekor integratedTime)
@@ -586,7 +685,12 @@ async function verifyBundle(bundle, opts) {
   var integratedTime = rekor.integratedTime;
 
   var checkTime = guard.time.isDate(opts.time) ? guard.time.instantOf(opts.time) : C.TIME.seconds(integratedTime);
-  await _verifyChain(leaf, _chainDers(vm), fulcioRoots, checkTime);
+  var chain = await _verifyChain(leaf, _chainDers(vm), fulcioRoots, checkTime);
+  /** @internal With no caller instant the reference is the authenticated log-entry time, whose whole
+   * second is inclusive: a certificate logged in the same second as its entry is not dated after it,
+   * and nothing beyond that second is accepted. */
+  var sctBound = guard.time.isDate(opts.time) ? checkTime : C.TIME.seconds(integratedTime) + 999;
+  var sctResult = await _verifyEmbeddedScts(leaf, leafDer, chain.issuer, opts.ctLogs, checkTime, sctBound);
   var identity = _identity(leaf);
   var identityChecked = _checkIdentity(identity, opts.identity);
 
@@ -603,6 +707,8 @@ async function verifyBundle(bundle, opts) {
     identity: identity,
     identityChecked: identityChecked,
     predicateTypeChecked: opts.predicateType != null,
+    sctChecked: sctResult.checked,
+    validScts: sctResult.validScts,
     integratedTime: integratedTime,
     logIndex: rekor.logIndex,
     logId: rekor.logId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.44",
+  "version": "0.6.46",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3a1167b9-bd57-4112-8a1e-58236cee3f31",
+  "serialNumber": "urn:uuid:664841c0-3588-4832-8e40-6288506a791f",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-06T07:45:11.202Z",
+    "timestamp": "2026-09-06T10:18:22.726Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.44",
+      "bom-ref": "@blamejs/pki@0.6.46",
       "type": "application",
       "name": "pki",
-      "version": "0.6.44",
+      "version": "0.6.46",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.44",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.46",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.44",
+      "ref": "@blamejs/pki@0.6.46",
       "dependsOn": []
     }
   ]