@blamejs/pki 0.8.7 → 0.8.10

package/lib/schema-sec1.js

@@ -0,0 +1,244 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * @module     pki.schema.sec1
+ * @nav        Schema
+ * @title      SEC1
+ * @fullname   SEC1 EC private keys, the EC PRIVATE KEY encoding
+ * @order      146
+ * @slug       sec1
+ *
+ * @intro
+ *   The elliptic-curve private-key encoding of RFC 5915: `ECPrivateKey`, the
+ *   `EC PRIVATE KEY` PEM block OpenSSL writes and appliances still emit. `parse`
+ *   reads one into its version, scalar, curve and stored public point, and
+ *   `encode` writes it back.
+ *
+ *   The curve is what fixes the scalar's width, so the parameters field is
+ *   required here even though the ASN.1 marks it optional: without it there is no
+ *   width to hold the scalar to, and a scalar of the wrong width is a different
+ *   key. RFC 5915 sec. 3 states the scalar as `ceiling(log2(n)/8)` octets with its
+ *   leading zeros intact, so a short one is refused and never padded into place.
+ *
+ *   The parameters field carries a named curve and nothing else. RFC 5480
+ *   sec. 2.1.1 says a specified curve and an implicit curve MUST NOT appear, and
+ *   each is refused by name, so the message says which one arrived.
+ *
+ *   The stored public key is surfaced as the bytes it carries. It is the
+ *   encoding's own copy of the public half, not the key's identity: a verb that
+ *   needs that half derives it from the scalar, so a stored point that disagrees
+ *   cannot decide anything.
+ *
+ * @card
+ *   Read and write the RFC 5915 `ECPrivateKey`, DER or PEM, with the scalar held
+ *   to its curve's width and the parameters field held to a named curve.
+ */
+
+var asn1 = require("./asn1-der");
+var schema = require("./schema-engine");
+var pkix = require("./schema-pkix");
+var oid = require("./oid");
+var frameworkError = require("./framework-error");
+var intrinsic = require("./guard-intrinsic");
+
+var Sec1Error = frameworkError.Sec1Error;
+var PemError = frameworkError.PemError;
+
+var NS = pkix.makeNS("sec1", Sec1Error, oid);
+
+var LABEL = "EC PRIVATE KEY";
+
+/** @internal The scalar width each curve fixes, `ceiling(log2(n)/8)` over the curve's order
+ * (RFC 5915 sec. 3). A curve with no row here is one this toolkit cannot hold a scalar to, which
+ * is a refusal, since guessing the width would accept a key of the wrong size. */
+var CURVE_SCALAR_BYTES = intrinsic.assign(intrinsic.create(null), {
+  "prime256v1": 32,
+  "secp384r1": 48,
+  "secp521r1": 66,
+  "secp256k1": 32,
+  "brainpoolP256r1": 32,
+  "brainpoolP384r1": 48,
+  "brainpoolP512r1": 64,
+});
+
+/** @internal RFC 5480 sec. 2.2 writes the point's first octet as the form: 0x04 uncompressed,
+ * 0x02 and 0x03 compressed. The hybrid forms 0x06 and 0x07 are named there as MUST NOT, and every
+ * other value names no form at all. The width follows from the form and the curve. */
+function _assertPoint(point, scalarBytes) {
+  if (point.length === 0) {
+    throw NS.E("sec1/bad-public-key", "the stored public key is empty (RFC 5480 sec. 2.2)");
+  }
+  var form = point[0];
+  if (form === 0x06 || form === 0x07) {
+    throw NS.E("sec1/bad-public-key", "the hybrid point forms 0x06 and 0x07 are refused (RFC 5480 sec. 2.2)");
+  }
+  if (form === 0x04) {
+    if (point.length !== 1 + 2 * scalarBytes) {
+      throw NS.E("sec1/bad-public-key", "an uncompressed point is 1 + 2 * " + scalarBytes + " octets on this curve, got " + point.length);
+    }
+    return;
+  }
+  if (form === 0x02 || form === 0x03) {
+    if (point.length !== 1 + scalarBytes) {
+      throw NS.E("sec1/bad-public-key", "a compressed point is 1 + " + scalarBytes + " octets on this curve, got " + point.length);
+    }
+    return;
+  }
+  throw NS.E("sec1/bad-public-key", "the stored public key's first octet names no point form (RFC 5480 sec. 2.2)");
+}
+
+var EC_PRIVATE_KEY = schema.seq([
+  schema.field("version", schema.integerLeaf()),
+  schema.field("privateKey", schema.octetString()),
+  /** @internal RFC 5915's module is DEFINITIONS EXPLICIT TAGS, so `[0]` and `[1]` wrap their
+   * values, and do not replace their tags. */
+  /** @internal Read as ANY so the two shapes RFC 5480 sec. 2.1.1 names as MUST NOT, a SEQUENCE
+   * (specifiedCurve) and a NULL (implicitCurve), each get a verdict naming it. The OID reader
+   * would answer both with "expected tag 6", which says nothing about which one arrived. */
+  schema.optional("parameters", schema.any(), { tag: 0, explicit: true }),
+  schema.optional("publicKey", schema.bitString(), { tag: 1, explicit: true }),
+], {
+  assert: "sequence", arity: { min: 2, max: 4 }, code: "sec1/not-an-ec-private-key", what: "ECPrivateKey",
+  build: function (m) {
+    var version = m.fields.version.value;
+    /** @internal RFC 5915 sec. 3 fixes the version at 1. A PKCS#8 PrivateKeyInfo opens with a
+     * version 0 INTEGER and an OCTET STRING too, so this is also what keeps one from reading as
+     * the other. */
+    if (version !== 1n) {
+      throw NS.E("sec1/bad-version", "an ECPrivateKey is version 1 (RFC 5915 sec. 3), got " + version);
+    }
+    if (!m.fields.parameters.present) {
+      throw NS.E("sec1/missing-curve", "an ECPrivateKey read on its own carries its [0] parameters, since the curve is what fixes the scalar's width (RFC 5915 sec. 3)");
+    }
+    var paramNode = m.fields.parameters.value;
+    if (paramNode.tagClass !== "universal" || paramNode.tagNumber !== asn1.TAGS.OBJECT_IDENTIFIER) {
+      throw NS.E("sec1/bad-curve", paramNode.tagClass === "universal" && paramNode.tagNumber === asn1.TAGS.SEQUENCE
+        ? "the parameters field carries a specified curve, which RFC 5480 sec. 2.1.1 refuses; name the curve instead"
+        : (paramNode.tagClass === "universal" && paramNode.tagNumber === asn1.TAGS.NULL
+          ? "the parameters field carries an implicit curve, which RFC 5480 sec. 2.1.1 refuses; name the curve instead"
+          : "the parameters field carries a named curve OBJECT IDENTIFIER and nothing else (RFC 5480 sec. 2.1.1)"));
+    }
+    var curveOid = asn1.read.oid(paramNode);
+    var curve = oid.name(curveOid);
+    var scalarBytes = curve === undefined ? undefined : CURVE_SCALAR_BYTES[curve];
+    if (scalarBytes === undefined) {
+      throw NS.E("sec1/unsupported-curve", "this toolkit holds no scalar width for the curve " + curveOid +
+        (curve === undefined ? "" : " (" + curve + ")"));
+    }
+    var scalar = m.fields.privateKey.value;
+    if (scalar.length !== scalarBytes) {
+      throw NS.E("sec1/bad-private-key", "the private key is " + scalarBytes + " octets on " + curve +
+        ", with its leading zeros (RFC 5915 sec. 3), got " + scalar.length);
+    }
+    var out = { version: intrinsic.Number(version), privateKey: scalar, curve: curve, curveOid: curveOid };
+    if (m.fields.publicKey.present) {
+      var bits = m.fields.publicKey.value;
+      if (bits.unusedBits !== 0) {
+        throw NS.E("sec1/bad-public-key", "the stored public key's BIT STRING holds whole octets");
+      }
+      _assertPoint(bits.bytes, scalarBytes);
+      out.publicKey = bits.bytes;
+    }
+    return out;
+  },
+});
+
+var PARSE_OPTS = intrinsic.assign(intrinsic.create(null), {
+  pemLabel: LABEL, PemError: PemError, ErrorClass: Sec1Error, prefix: "sec1",
+  what: "EC private key", topSchema: EC_PRIVATE_KEY, ns: NS,
+});
+
+/**
+ * @primitive  pki.schema.sec1.parse
+ * @signature  pki.schema.sec1.parse(input, opts) -> key
+ * @since      0.8.8
+ * @status     stable
+ * @spec       RFC 5915
+ * @related    pki.schema.sec1.encode, pki.schema.pkcs8.parse
+ *
+ * Read an RFC 5915 `ECPrivateKey`, as DER bytes or an `EC PRIVATE KEY` PEM block,
+ * into `{ version, privateKey, curve, curveOid, publicKey }`. The scalar and the
+ * stored point are `Buffer`s, and `curve` is the registry name of the named curve
+ * the key carries.
+ *
+ * The parameters field is required, because the curve is what fixes the scalar's
+ * width and a scalar of the wrong width is a different key. It carries a named
+ * curve and nothing else: a specified curve and an implicit curve are both refused
+ * with `sec1/bad-curve`, which RFC 5480 sec. 2.1.1 states as a MUST NOT.
+ *
+ * The stored public key is the encoding's own copy of the public half, not the key's
+ * identity. A verb that needs that half derives it from the scalar.
+ *
+ * @example
+ *   // requires: der -- an ECPrivateKey, from `openssl ecparam -genkey` or an appliance
+ *   var key = pki.schema.sec1.parse(der);
+ *   key.version;    // 1
+ *   key.curve;      // "prime256v1"
+ */
+var parse = pkix.makeParser(PARSE_OPTS);
+
+/**
+ * @primitive  pki.schema.sec1.encode
+ * @signature  pki.schema.sec1.encode(key) -> Buffer
+ * @since      0.8.8
+ * @status     stable
+ * @spec       RFC 5915
+ * @related    pki.schema.sec1.parse
+ *
+ * Write an `ECPrivateKey` back to DER from the shape `parse` returns, with the
+ * parameters field always present, which RFC 5915 sec. 3 asks of a generator. A key
+ * read and written again produces the bytes it came from.
+ *
+ * @example
+ *   // requires: der -- an ECPrivateKey, from `openssl ecparam -genkey` or an appliance
+ *   pki.schema.sec1.encode(pki.schema.sec1.parse(der)).equals(der);   // true
+ */
+function encode(key) {
+  if (key === null || typeof key !== "object") {
+    throw NS.E("sec1/bad-input", "encode takes the object parse returns");
+  }
+  var curveOid = key.curveOid;
+  if (typeof curveOid !== "string") {
+    var named = typeof key.curve === "string" ? oid.byName(key.curve) : undefined;
+    if (typeof named !== "string") {
+      throw NS.E("sec1/bad-input", "encode needs the key's named curve, as curveOid or a registered curve name");
+    }
+    curveOid = named;
+  }
+  var kids = [asn1.build.integer(intrinsic.BigInt(key.version === undefined ? 1 : key.version)),
+    asn1.build.octetString(key.privateKey),
+    asn1.build.explicit(0, asn1.build.oid(curveOid))];
+  if (key.publicKey !== undefined && key.publicKey !== null) {
+    kids[3] = asn1.build.explicit(1, asn1.build.bitString(key.publicKey, 0));
+  }
+  return asn1.build.sequence(kids);
+}
+
+function pemDecode(text) { return pkix.pemDecode(text, LABEL, PemError); }
+function pemEncode(der) { return pkix.pemEncode(der, LABEL, PemError); }
+
+/** @internal RFC 5915 sec. 3: `ECPrivateKey ::= SEQUENCE { version INTEGER, privateKey OCTET
+ * STRING, parameters [0] ECParameters OPTIONAL, publicKey [1] BIT STRING OPTIONAL }`. Structure
+ * alone does not separate this from every other SEQUENCE opening that way, which is why nothing
+ * routes to it from bare bytes; it answers for a caller that already has the armor label. */
+function matches(root) {
+  var k = pkix.rootSequenceChildren(root, 2, 4);
+  if (!k) return false;
+  if (!schema.isUniversal(k[0], asn1.TAGS.INTEGER)) return false;
+  if (!schema.isUniversal(k[1], asn1.TAGS.OCTET_STRING)) return false;
+  var last = -1;
+  for (var i = 2; i < k.length; i++) {
+    if (!schema.isContextInRange(k[i], 0, 1) || k[i].tagNumber <= last) return false;
+    last = k[i].tagNumber;
+  }
+  return true;
+}
+
+module.exports = {
+  parse: parse,
+  matches: matches,
+  encode: encode,
+  pemDecode: pemDecode,
+  pemEncode: pemEncode,
+};

package/lib/schema-tsp.js

@@ -455,8 +455,10 @@ function parseToken(input, callerOpts) {
  * @related    pki.schema.tsp.parse
  *
  * Extract the DER bytes from a PEM block (RFC 3161 defines no standard label, so the
- * first block is taken unless `label` is given). Throws `PemError` on a missing
- * envelope or a non-base64 body.
+ * a block of any label is accepted unless `label` is given). The text holds one
+ * object: a file of several is refused with `pem/multiple-blocks` and read with
+ * `pki.schema.pem.decodeBundle`. Throws `PemError` on a missing envelope or a
+ * non-base64 body.
  *
  * @example
  *   var req = pki.tsp.request({ hashAlgorithm: "sha256", hashedMessage: Buffer.from(await pki.webcrypto.subtle.digest("SHA-256", Buffer.from("hello"))) }, {});

package/lib/schema-x509.js

@@ -51,8 +51,10 @@ var PemError = frameworkError.PemError;
  * Extract the DER bytes from a PEM block (default label `CERTIFICATE`, the
  * RFC 7468 sec. 5 armor, the canonical-label default every sibling format
  * applies). Pass a `label` to enforce a different block type, or an explicit
- * `null` to take the first block of any type. Throws `PemError` on a
- * missing / mismatched envelope or a non-base64 body.
+ * `null` to accept a block of any type. The text holds one object: a file of
+ * several is refused with `pem/multiple-blocks` and read with
+ * `pki.schema.pem.decodeBundle`. Throws `PemError` on a missing / mismatched
+ * envelope or a non-base64 body.
  *
  * @example
  *   var pair = await pki.key.generate("Ed25519");

package/lib/sigstore.js

@@ -1055,6 +1055,13 @@ async function _verifyChain(leaf, chainDers, fulcioRoots, timeMs) {
 
 
 var SAN_OID = oid.byName("subjectAltName");
+/** @internal The shared table's entry, so the SAN this verb reads is read under the rules every
+ * other consumer of a GeneralNames reads it under. It is built on the certificate namespace rather
+ * than this module's, so a malformed name raises a CertificateError that `_identity` re-types to
+ * `sigstore/bad-certificate` with that fault as its cause. That is the code this module already
+ * reports for a certificate it cannot read, so the fix adds no new code to the public surface. */
+var _sanDecoder = pkix.certExtensionDecoders(
+  pkix.makeNS("x509", frameworkError.CertificateError, oid)).byOid[SAN_OID];
 var FULCIO_PREFIX = _join(_arraySlice(_split(oid.byName("otherName"), "."), 0, -1), ".") + ".";
 function _identity(leaf) {
   var out = { san: null, extensions: _create(null) };
@@ -1072,29 +1079,36 @@ function _identity(leaf) {
   return out;
 }
 var GN_TYPE = _assign(_create(null), { 1: "rfc822Name", 2: "dNSName", 6: "uri" });
+/** @internal The GeneralNames come from the shared extension decoder, which is where the RFC 5280
+ * sec. 4.2.1.6 rules live: at least one name, a non-empty IA5String for the text forms, and no
+ * control byte inside one (CVE-2009-2408). Reading the SEQUENCE here instead left this verb
+ * accepting a dNSName carrying a NUL or a CR and handing it on as the signer's identity.
+ *
+ * The one-identity rule counts every name the SAN carries, not the subset this verb turns into an
+ * identity string. Counting only the recognized forms let a certificate pair a URI with an
+ * iPAddress and pass as single-identity, with the second binding invisible to the caller's policy
+ * -- which is the thing the rule exists to stop. A SAN of one name this verb has no string form
+ * for still yields null, so a policy gates on the null rather than on a name nothing read. */
 function _sanValue(ext) {
-  var seq = asn1.decode(ext.value);
-  var names = [];
-  for (var i = 0; i < (seq.children || []).length; i++) {
-    var n = seq.children[i];
-    if (n.tagClass !== "context") continue;
-    var val = null;
-    if (!n.constructed && GN_TYPE[n.tagNumber]) {
-      val = { type: GN_TYPE[n.tagNumber], value: _bufToString(asn1.read.octetStringImplicit(n, n.tagNumber), "utf8") };
-    } else if (n.constructed && n.tagNumber === 0 && (n.children || []).length >= 2) {
-      var inner = (n.children[1].children || [])[0] || n.children[1];
-      var v;
-      try {
-        v = asn1.read.string(inner);
-      } catch (_e) {
-        v = null;
-      }
-      val = { type: "otherName", oid: asn1.read.oid(n.children[0]), value: v };
-    }
-    if (val) guard.list.append(names, val);
+  /** @internal The shared decoder is the gate: it applies the sec. 4.2.1.6 rules and throws on a
+   * name that breaks one. What it returns is a GeneralNames view rather than the codec nodes the
+   * mapping below reads, so the count comes from it and the one name is then taken from the raw
+   * decode, which carries the node shape `octetStringImplicit` and the otherName walk need. */
+  var validated = _sanDecoder(ext.value).names || [];
+  if (validated.length > 1) throw _err("sigstore/bad-certificate", "the Fulcio certificate carries multiple SAN identities");
+  var n = (asn1.decode(ext.value).children || [])[0];
+  if (!n || n.tagClass !== "context") return null;
+  if (!n.constructed && GN_TYPE[n.tagNumber]) {
+    return { type: GN_TYPE[n.tagNumber], value: _bufToString(asn1.read.octetStringImplicit(n, n.tagNumber), "utf8") };
+  }
+  if (n.constructed && n.tagNumber === 0 && (n.children || []).length >= 2) {
+    var inner = (n.children[1].children || [])[0] || n.children[1];
+    var v;
+    try { v = asn1.read.string(inner); }
+    catch (_e) { v = null; }      // allow:swallow-unverified an otherName body with no string form has no identity string, which the caller's policy then gates on
+    return { type: "otherName", oid: asn1.read.oid(n.children[0]), value: v };
   }
-  if (names.length > 1) throw _err("sigstore/bad-certificate", "the Fulcio certificate carries multiple SAN identities");
-  return names[0] || null;
+  return null;
 }
 function _fulcioExtValue(ext, leafArc) {
   if (!_isBuffer(ext.value)) throw _err("sigstore/bad-certificate", "Fulcio extension " + ext.oid + " has no value");

package/lib/trust.js

@@ -383,8 +383,8 @@ function _copyDistrustAfter(src) {
 function _copyName(name) {
   if (!name || !Array.isArray(name.rdns)) return name;
   var out = Object.assign({}, name);
-  out.rdns = name.rdns.map(function (rdn) {
-    return Array.isArray(rdn) ? rdn.map(function (atv) { return Object.assign({}, atv); }) : rdn;
+  out.rdns = guard.list.copyMap(name.rdns, function (rdn) {
+    return Array.isArray(rdn) ? guard.list.copyMap(rdn, function (atv) { return Object.assign({}, atv); }) : rdn;
   });
   out.bytes = Buffer.isBuffer(name.bytes) ? Buffer.from(name.bytes) : name.bytes;
   return out;

package/lib/tsp-sign.js

@@ -34,6 +34,9 @@ var pkiBuild = require("./pki-build");
 var constants = require("./constants");
 var TspError = frameworkError.TspError;
 var _NS = pkix.makeNS("tsp", TspError, oid);
+/** @internal The shared certificate-extension decoders, so an extension this module reads is read
+ * under the rules every other consumer reads it under rather than under a second set written here. */
+var _EXT_DECODERS = pkix.certExtensionDecoders(_NS).byOid;
 var b = asn1.build;
 function _err(code, message, cause) { return new TspError(code, message, cause); }
 
@@ -76,7 +79,7 @@ function _certDer(c) {
     c = buf.toString("latin1");
   }
   if (typeof c !== "string") throw _err("tsp/bad-input", "the TSA certificate must be a DER BufferSource or a PEM string");
-  var der = pkix.pemDecodeLenient(c, "CERTIFICATE");
+  var der = pkix.pemDecodeLenient(c, "CERTIFICATE", _err, "tsp/bad-input");
   if (der === null) throw _err("tsp/bad-input", "the TSA certificate PEM is not a CERTIFICATE block");
   return der;
 }
@@ -487,12 +490,13 @@ function _checkTsaCertUsage(tsaCertDer) {
   var exts = (cert.extensions || []).filter(function (e) { return e.oid === O("extKeyUsage"); });
   if (exts.length !== 1) return "tsp/bad-eku";
   if (!exts[0].critical) return "tsp/eku-not-critical";
-  var purposes, ekuNode;
-  try { ekuNode = asn1.decode(exts[0].value); }
-  catch (_e) { return "tsp/bad-eku"; }
-  if (ekuNode.tagClass !== "universal" || ekuNode.tagNumber !== asn1.TAGS.SEQUENCE || !ekuNode.children) return "tsp/bad-eku";
-  try { purposes = ekuNode.children.map(function (c) { return asn1.read.oid(c); }); }
-  catch (_e) { return "tsp/bad-eku"; }
+  /** @internal Read through the shared decoder, which is where the sec. 4.2.1.12 rules live: an
+   * ExtKeyUsage carries at least one KeyPurposeId. Reading the SEQUENCE here instead called an
+   * empty one well-formed and then reported it as the wrong PURPOSE, so the same class of fault
+   * answered with a different code here than at every other consumer of this extension. */
+  var purposes;
+  try { purposes = _EXT_DECODERS[O("extKeyUsage")](exts[0].value); }
+  catch (_e) { return "tsp/bad-eku"; }   // allow:swallow-unverified this verb answers with a code rather than throwing, and every malformed shape is the one code
   if (purposes.length !== 1 || purposes[0] !== O("timeStamping")) return "tsp/eku-not-exclusive";
   var ku;
   try { ku = pkix.keyUsageOf(_NS, cert, _err, "tsp/bad-key-usage", "TSA certificate"); }
@@ -508,13 +512,16 @@ function _tsaMatchesCert(tsaBytes, signerCert) {
   if (gn.tagNumber === 4 && gn.value && guard.name.dnEqual(gn.value.rdns, signerCert.subject.rdns, _err, "tsp/tsa-mismatch", "the TSA subject")) return true;
   var sanExt = (signerCert.extensions || []).filter(function (e) { return e.oid === O("subjectAltName"); })[0];
   if (sanExt) {
-    var san;
-    try { san = asn1.decode(sanExt.value); }
-    catch (_e) { return false; }
-    if (san.tagClass === "universal" && san.tagNumber === asn1.TAGS.SEQUENCE && san.children) {
-      for (var i = 0; i < san.children.length; i++) {
-        if (san.children[i].bytes.equals(tsaBytes)) return true;
-      }
+    /** @internal Gated by the shared decoder before the comparison, so a SAN this toolkit refuses
+     * everywhere else cannot be a source of identity here. The match itself stays a comparison of
+     * the encoded GeneralName bytes, which is what "the token names this TSA" means: the name in
+     * the token and the name in the certificate have to be the same name, not merely names that
+     * decode alike. */
+    var names;
+    try { names = _EXT_DECODERS[O("subjectAltName")](sanExt.value).names || []; }
+    catch (_e) { return false; }   // allow:swallow-unverified a SAN that does not decode names no TSA, which is what this verb answers
+    for (var i = 0; i < names.length; i++) {
+      if (names[i].bytes && names[i].bytes.equals(tsaBytes)) return true;
     }
   }
   return false;

package/lib/webauthn.js

@@ -350,7 +350,7 @@ var _FORMAT_SCOPED_BOOLEAN_OPTS = ["verifySafetyNetJws", "requireCtsProfileMatch
 function _cloneParsed(v, depth) {
   if (depth > 64) throw _err("webauthn/bad-input", "opts.rootCertificates[] is nested too deeply to be a parsed certificate");
   if (guard.bytes.isByteSource(v)) return guard.bytes.snapshotSource(v, _err, "webauthn/bad-input", "a byte field of opts.rootCertificates[]");
-  if (Array.isArray(v)) return v.map(function (x) { return _cloneParsed(x, depth + 1); });
+  if (Array.isArray(v)) return guard.list.copyMap(v, function (x) { return _cloneParsed(x, depth + 1); });
   if (guard.time.isDate(v)) return new Date(guard.time.instantOf(v));
   if (v && typeof v === "object") {
     var out = intrinsic.create(null);
@@ -1497,9 +1497,9 @@ function _snapshotAssertion(input) {
     }
     out.credentialPublicKey = key;
   }
-  if (Array.isArray(out.allowedAlgorithms)) out.allowedAlgorithms = out.allowedAlgorithms.slice();
-  if (Array.isArray(out.expectedOrigin)) out.expectedOrigin = out.expectedOrigin.slice();
-  if (Array.isArray(out.expectedTopOrigin)) out.expectedTopOrigin = out.expectedTopOrigin.slice();
+  if (Array.isArray(out.allowedAlgorithms)) out.allowedAlgorithms = guard.list.snapshot(out.allowedAlgorithms);
+  if (Array.isArray(out.expectedOrigin)) out.expectedOrigin = guard.list.snapshot(out.expectedOrigin);
+  if (Array.isArray(out.expectedTopOrigin)) out.expectedTopOrigin = guard.list.snapshot(out.expectedTopOrigin);
   return out;
 }
 

package/lib/webcrypto.js

@@ -1148,13 +1148,24 @@ function isCryptoKeyLike(x) {
 }
 
 // @internal
-function exportAnyKey(key, E, code) {
-  var format = _EXPORT_FORMAT[key && key.type];
+/** @internal `want` names the WebCrypto export format, defaulting to the DER one the key's type
+ * calls for. A key from another implementation can be reached three ways, and which of them works
+ * is a property of the key rather than of the format asked for, so every format is exported
+ * through the same three; a format that went straight to this engine's `exportKey` would refuse a
+ * key this engine did not make while the others returned it. A JWK is an object rather than
+ * bytes, so only the byte formats are wrapped. */
+function exportAnyKey(key, E, code, want) {
+  var format = want || _EXPORT_FORMAT[key && key.type];
   if (!format) throw E(code, "a CryptoKey with a private, public, or secret type is required");
+  if (want === "jwk" && !_EXPORT_FORMAT[key && key.type]) {
+    throw E(code, "a CryptoKey with a private, public, or secret type is required");
+  }
+  var asJwk = format === "jwk";
+  function wrap(b) { return asJwk ? b : _bufferFrom(b); }
   if (key instanceof CryptoKey) {
     return _resolve(Promise)
       .then(function () { return _crypto.subtle.exportKey(format, key); })
-      .then(function (b) { return _bufferFrom(b); });
+      .then(wrap);
   }
   if (!key.extractable) {
     throw E(code, "the CryptoKey comes from a different WebCrypto implementation and is not extractable, so its key material cannot be reached; import it through pki.webcrypto.subtle, or pass the key as DER");
@@ -1162,14 +1173,15 @@ function exportAnyKey(key, E, code) {
   var handle = key._handle;
   if (handle instanceof nodeCrypto.KeyObject && handle.type === key.type) {
     return _resolve(Promise).then(function () {
+      if (asJwk) return handle.export({ format: "jwk" });
       return format === "raw" ? handle.export() : handle.export({ format: "der", type: format });
-    }).then(function (b) { return _bufferFrom(b); }, function (e) {
+    }).then(wrap, function (e) {
       throw E(code, "the CryptoKey comes from a different copy of this WebCrypto engine and its key material could not be read; import it through pki.webcrypto.subtle, or pass the key as DER", e);
     });
   }
   return _resolve(Promise)
     .then(function () { return nodeCrypto.webcrypto.subtle.exportKey(format, key); })
-    .then(function (b) { return _bufferFrom(b); }, function (e) {
+    .then(wrap, function (e) {
       throw E(code, "the CryptoKey comes from a different WebCrypto implementation and could not be exported for re-import; import it through pki.webcrypto.subtle, or pass the key as DER", e);
     });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.7",
+  "version": "0.8.10",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:f6667295-f56b-4c1b-a9a8-6f8889816a2b",
+  "serialNumber": "urn:uuid:4cdebd00-c3c0-4ba6-9d9c-daacb902163c",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-23T18:05:34.573Z",
+    "timestamp": "2026-09-23T19:58:00.767Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.7",
+      "bom-ref": "@blamejs/pki@0.8.10",
       "type": "application",
       "name": "pki",
-      "version": "0.8.7",
+      "version": "0.8.10",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.7",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.10",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.7",
+      "ref": "@blamejs/pki@0.8.10",
       "dependsOn": []
     }
   ]