@noz-ele/edgca 0.5.2 → 0.6.0

package/README.md

@@ -2,40 +2,43 @@
 
 > [日本語](https://github.com/noz-ele/EdgCA/blob/main/docs/jp/README.md) | English
 
-EdgCA is a small TypeScript library for issuing mTLS client certificates and document-signing certificates from a self-managed CA on Cloudflare Workers-compatible runtimes.
+EdgCA is a small TypeScript library for issuing mTLS client certificates and document-signing certificates from a self-managed CA, and for bounded certificate validation against explicit trust anchors, on Cloudflare Workers-compatible runtimes.
 
 ## Features
 
 - **WebCrypto-only, zero runtime dependencies.** All cryptographic operations go through `globalThis.crypto.subtle`. The same code runs on Cloudflare Workers, Node.js 20+, and modern browsers without polyfills or bundler shims.
-- **Lightweight.** v0.5.2 — tarball **45.2 kB** · unpacked **167.3 kB** · 73 files. No transitive dependencies; the CLI uses only `node:util.parseArgs`. (Re-measured on every release.)
+- **Lightweight.** v0.6.0 — tarball **49.8 kB** · unpacked **192.8 kB** · 76 files. No transitive dependencies; the CLI uses only `node:util.parseArgs`. (Re-measured on every release.)
 - **CA hierarchy (two-level).** Create a self-signed root CA and, optionally, issue an intermediate CA from it. Three or more levels of intermediates are intentionally out of scope.
 - **PFX (PKCS#12) bundling.** Wrap a cert + private key (and optional chain) into a password-protected `.pfx` / `.p12` for OS keystore import (Win11+, macOS 15+, iOS/iPadOS 18+, modern Linux). Algorithm-agnostic — accepts arbitrary PKCS#8 DER bytes (ECDSA, RSA, Ed25519, …).
 - **mTLS client certificate issuance.** Issue a leaf with internal key generation, or from a caller-managed key via the CSR path below.
 - **PKCS#10 CSR support.** Build a CSR (with proof-of-possession), parse a received CSR (subject, requested SAN, public key, raw extensions/attributes), verify its POP signature, and issue a cert from a CSR's public key without ever handling the private key.
 - **Document-signing certificates (RFC 9336).** Issue a leaf with EKU `id-kp-documentSigning`, usable as the signer cert for CAdES / CMS / ASiC tooling (containers themselves are built separately).
-- **Issuance check.** Decide whether a received client certificate was issued by your own CA (issuer-identity match — not full mTLS verification).
+- **Issuance check.** Decide whether a received client certificate was issued by your own CA (issuer-identity match — not full mTLS verification).
+- **Bounded chain validation.** Validate a caller-ordered `leaf → intermediate → trusted root` chain, including signatures, validity, CA constraints, and target purpose. Automatic PKI path building and revocation are intentionally out of scope.
 - **PEM/DER encode/decode** for certificates and PKCS#10 CSRs.
 - **Secret key hygiene at the API boundary.** Private keys flow through the public API only as `CryptoKey` (issuance path) or `Uint8Array` PKCS#8 bytes (`exportPkcs12`); never as `string`. JS strings are immutable and stay on the heap until GC, so they cannot be wiped — secret material must not be held in that form. PEM ↔ CryptoKey conversion is the caller's job (so the lifetime of any string representation stays under caller control).
 
 ### Supported algorithms
 
-- **Issuance layer**: ECDSA on NIST P-256 / P-384 / P-521 (with the standard SHA-256 / SHA-384 / SHA-512 pairings). RSA, EdDSA, and other curves are intentionally out of scope at issuance.
+- **Issuance layer**: ECDSA on NIST P-256 / P-384 / P-521 (with the standard SHA-256 / SHA-384 / SHA-512 pairings). RSA, EdDSA, and other curves are intentionally out of scope at issuance.
+- **Verification layer**: the same ECDSA NIST P-256 / P-384 / P-521 set. It is intentionally not a general algorithm verifier.
 - **PFX bundling (`exportPkcs12`)**: algorithm-agnostic — accepts any PKCS#8 DER bytes verbatim.
 
-> ⚠ **Not a PKI runtime.** EdgCA is an issuance toolkit, not a general-purpose PKI library or runtime. It does **not** provide chain validation, revocation (CRL/OCSP), key storage, or rotation. `verifyClientCertificateIssuedBy` is **not** mTLS verification and does **not** authenticate the presenter — see [Verify](#verify-cloudflare-worker) below. Operating a CA safely is the caller's responsibility. Full list: [docs/en/NON_GOALS.md](https://github.com/noz-ele/EdgCA/blob/main/docs/en/NON_GOALS.md).
+> ⚠ **Not a general PKI runtime.** Chain validation is limited to a caller-ordered hierarchy no deeper than `root → intermediate → leaf`, with explicit trusted roots. EdgCA does not provide automatic path building, AIA fetching, OS trust-store access, revocation (CRL/OCSP), key storage, or rotation. Certificate validation also does not prove that the presenter holds the private key — see [Verify](#verify-cloudflare-worker) below. Full list: [docs/en/NON_GOALS.md](https://github.com/noz-ele/EdgCA/blob/main/docs/en/NON_GOALS.md).
 
 ## Contents
 
 - [CLI](#cli) — `npx edgca …` one-liners for the four most common tasks
 - [Quick Start](#quick-start) — root → intermediate → client cert (incl. PFX bundling)
 - [Issue a document-signing certificate](#issue-a-document-signing-certificate) — RFC 9336 `id-kp-documentSigning` leaf
-- [Verify on Cloudflare Worker](#verify-cloudflare-worker) — confirm a cert was issued by your CA
+- [Verify on Cloudflare Worker](#verify-cloudflare-worker) — confirm a cert was issued by your CA
+- [Certificate chain verification](#certificate-chain-verification) — validate an explicit chain to a trusted root
 - [Issue from a CSR](#issue-from-a-csr) — accept a caller-managed key via PKCS#10 + POP
 - [Subject](#subject) · [Scope](#scope) · [Key Handling](#key-handling) · [Development](#development) · [API Documentation](#api-documentation)
 
 ## Status
 
-EdgCA is in **v0.3.x — early stabilization**. The author is currently validating the library against real Cloudflare Workers deployments, and the API surface may still shift. To keep that validation focused, **external Issues and PRs are temporarily restricted** and will be re-opened once the API settles. Reading, cloning, forking, and `npm install` are unaffected.
+EdgCA is in **v0.6.x — early stabilization**. The author is currently validating the library against real Cloudflare Workers deployments, and the API surface may still shift. To keep that validation focused, **external Issues and PRs are temporarily restricted** and will be re-opened once the API settles. Reading, cloning, forking, and `npm install` are unaffected.
 
 ## Install
 
@@ -43,7 +46,19 @@ EdgCA is in **v0.3.x — early stabilization**. The author is currently validati
 npm install @noz-ele/edgca
 ```
 
-ESM-only (`"type": "module"`). Runs on any runtime where `globalThis.crypto.subtle` is available (Cloudflare Workers, Node.js 20+, modern browsers, etc.). CommonJS `require` is not supported.
+ESM-only (`"type": "module"`). Runs on any runtime where `globalThis.crypto.subtle` is available (Cloudflare Workers, Node.js 20+, modern browsers, etc.). CommonJS `require` is not supported.
+
+### Package entry points
+
+The root `@noz-ele/edgca` entry point remains an aggregate surface for compatibility. Use a purpose-specific subpath when you want an issuance-only bundle to avoid statically importing the verification implementation regardless of tree shaking:
+
+```ts
+import { createRootCA, issueClientCert } from "@noz-ele/edgca/issuer";
+import { verifyCertificateChain } from "@noz-ele/edgca/verify";
+import { exportPkcs12 } from "@noz-ele/edgca/pkcs12";
+```
+
+`./issuer` owns CA creation/import and intermediate/leaf issuance. `./verify` validates direct issuers and chains using public certificates only; it does not statically import the issuer module. The package remains `sideEffects: false`.
 
 ## CLI
 
@@ -241,7 +256,7 @@ There is no `issueDocumentSigningCertForPublicKey` (CSR variant) in v1, and EdgC
 >
 > Also out of scope (not checked by this function): `BasicConstraints CA=false`, `EKU clientAuth`, revocation, and chain walking.
 
-This section assumes a deployment where **Cloudflare has already extracted the client certificate** and exposes it to your application via `request.cf.tlsClientAuth`. EdgCA participates in neither the TLS handshake nor DER parsing of the cert; it consumes the values Cloudflare hands you and performs the issuance check above.
+This section assumes a deployment where **Cloudflare has already extracted the client certificate** and exposes it to your application via `request.cf.tlsClientAuth`. EdgCA does not participate in the TLS handshake; it parses the certificate fields needed for the issuance check above.
 
 ### Formats Cloudflare exposes after extraction
 
@@ -323,7 +338,36 @@ export default {
 
 - Omitting `validity` performs only the identity check (issuer DN + AKI/SKI + signature). If you instead inline the time check as two comparisons in the application, the result is equivalent.
 - "Not issued by us" and "outside the validity window" return `false`; malformed PEM/DER throws. The two error categories are deliberately split.
-- Pass the **direct issuer (one cert)** as `ca`. Verifying a leaf issued via an intermediate against the root will return `false` — chain walking is not performed.
+- Pass the **direct issuer (one cert)** as `ca`. Verifying a leaf issued via an intermediate against the root will return `false` — chain walking is not performed.
+
+## Certificate chain verification
+
+The `@noz-ele/edgca/verify` surface validates a direct issuer or a bounded chain using public certificates only. No CA private key is required.
+
+```ts
+import { verifyCertificateChain } from "@noz-ele/edgca/verify";
+
+const result = await verifyCertificateChain({
+  certificatePem: clientPem,
+  // Direct issuer first. EdgCA accepts zero or one intermediate.
+  intermediateCertificatesPem: [intermediatePem],
+  // No OS trust store is consulted; trust anchors are explicit.
+  trustedRootCertificatesPem: [rootPem],
+  purpose: "clientAuth"
+});
+
+if (!result.valid) {
+  throw new Error(
+    `certificate chain rejected at ${result.certificateIndex}: ${result.reason}`
+  );
+}
+```
+
+The verifier checks each child/issuer DN, AKI/SKI, and signature; DER validity times; issuer `BasicConstraints`, `keyCertSign`, and `pathLenConstraint`; the requested target purpose; duplicate and unsupported critical extensions; and inner/outer signature-algorithm consistency. The terminal issuer must be one of the explicitly supplied trusted-root certificates.
+
+This is not an automatic PKI path builder. The caller supplies intermediates in order, and the supported maximum is `root → intermediate → leaf`. EdgCA does not fetch AIA URLs, consult an OS trust store, check CRL/OCSP, verify TLS proof-of-possession, or perform server hostname matching. A valid chain does not prove that the presenter holds the leaf private key.
+
+The existing `verifyClientCertificateIssuedBy` remains unchanged for compatibility. New code should use `verifyCertificateIssuedBy` for one direct link or `verifyCertificateChain` to reach an explicit trusted root.
 
 ## Issue from a CSR
 
@@ -393,7 +437,10 @@ In scope:
 - mTLS client certificate issuance (with internal key generation, or from a caller-provided public key).
 - Document-signing certificate issuance with EKU `id-kp-documentSigning` (RFC 9336) and `keyUsage digitalSignature, contentCommitment` — internal key generation only, no SAN.
 - CSR (PKCS#10) parsing and proof-of-possession signature verification.
-- Identity check that a cert was issued by your own CA (`verifyClientCertificateIssuedBy`, with optional time-validity check).
+- Identity check that a cert was issued by your own CA (`verifyClientCertificateIssuedBy`, with optional time-validity check).
+- Direct public-certificate issuer validation (`verifyCertificateIssuedBy`).
+- Caller-ordered chain validation up to `root → intermediate → leaf` (`verifyCertificateChain`), including DER validity, CA/Key Usage/EKU/path-length constraints, and critical-extension policy.
+- Purpose-specific entry points (`@noz-ele/edgca/issuer` and `@noz-ele/edgca/verify`).
 - PEM/DER helpers (certificates only — keys are exchanged as `CryptoKey`).
 - PFX (PKCS#12) export of an issued cert + private key with PBES2 (PBKDF2-HMAC-SHA-256 + AES-256-CBC) and HMAC-SHA-256 MAC, scoped to modern consumers (Win11+, Server 2019+, macOS 15+, iOS/iPadOS 18+).
 - Basic Constraints, Key Usage, Extended Key Usage, Subject Alternative Name, SKI, AKI.
@@ -404,9 +451,12 @@ Intentionally out of scope:
 - Document-signing certificate issuance from a caller-provided public key (`issueDocumentSigningCertForPublicKey`) — not in v1.
 - SAN (`dnsNames` / `ipAddresses` / `emailAddresses`) on document-signing leaves.
 - CAdES / CMS / PAdES / XAdES / ASiC document signing or container building. EdgCA only issues the signing certificate; producing a signed document or container is a separate concern.
-- Public chain-validation APIs.
-- Extracting time fields from a cert. `verifyClientCertificateIssuedBy`'s `validity` option performs the time check, but the `notBefore` / `notAfter` values are passed in by the caller from `cf.tlsClientAuth`.
-- CRL, OCSP, revocation databases, revocation checks.
+- Automatic PKI path building from unordered certificates, issuer discovery, or AIA fetching.
+- OS/runtime trust-store access; trusted roots must be supplied explicitly.
+- Chains with two or more intermediate CAs.
+- Parsing Cloudflare-specific textual times. The verification module reads DER certificate times; the legacy API still accepts caller-supplied validity values.
+- CRL, OCSP, revocation databases, revocation checks.
+- TLS-handshake proof-of-possession and server hostname/SAN identity verification.
 - Key storage, encryption-at-rest, rotation-state persistence, and integration with KV/D1/R2/Secrets.
 - RSA, EdDSA, other elliptic curves (CSRs signed with these algorithms are rejected at parse time).
 - Legacy PKCS#12 algorithms (3DES, RC2, SHA-1 PBE), PBMAC1, empty passwords, crlBag / secretBag / nested safeContents, and consumers older than the modern targets above are intentionally not produced or supported by `exportPkcs12`.
@@ -423,13 +473,16 @@ EdgCA only handles key generation, signing, and SPKI export of public keys. Wher
 
 ### Bringing your own CA key (recommended)
 
-Root and intermediate CAs are long-lived. To keep key management on the caller's side, `createRootCA` and `issueIntermediateCA` accept an existing `keyPair: CryptoKeyPair`. This lets the caller's key-management infrastructure handle the full key lifecycle (generation, storage, rotation) consistently — including the choice of persistence format — which is the recommended path.
+Root and intermediate CAs are long-lived. To keep key management on the caller's side, `createRootCA` and `issueIntermediateCA` accept an existing `keyPair: CryptoKeyPair`. This lets the caller's key-management infrastructure handle the full key lifecycle (generation, storage, rotation) consistently — including the choice of persistence format — which is the recommended path.
+
+EdgCA verifies a supplied public/private pair with a sign/verify round trip before issuance. If the private key is imported with `extractable: false`, its public key cannot be reconstructed by exporting that private key; persist and import the public SPKI separately.
 
 ```ts
 // Restore a CryptoKeyPair from whatever persistence format you use.
-// Below is one example that converts PKCS#8 PEM stored in a vault.
-async function loadKeyPair(label: string): Promise<CryptoKeyPair> {
-  const pkcs8 = pemToDer(loadFromVault(`${label}-private-pem`));
+// Below is one example that imports separately stored PKCS#8 and SPKI PEM.
+async function loadKeyPair(label: string): Promise<CryptoKeyPair> {
+  const pkcs8 = pemToDer(loadFromVault(`${label}-private-pem`));
+  const spki = pemToDer(loadFromVault(`${label}-public-pem`));
   const privateKey = await crypto.subtle.importKey(
     "pkcs8",
     pkcs8,
@@ -437,14 +490,9 @@ async function loadKeyPair(label: string): Promise<CryptoKeyPair> {
     /* extractable */ false,
     ["sign"]
   );
-  // Derive the matching public key. If you also persist the public key as
-  // SPKI, import that directly instead of round-tripping through JWK.
-  const jwk = await crypto.subtle.exportKey("jwk", privateKey);
-  delete jwk.d;
-  jwk.key_ops = ["verify"];
-  const publicKey = await crypto.subtle.importKey(
-    "jwk",
-    jwk,
+  const publicKey = await crypto.subtle.importKey(
+    "spki",
+    spki,
     { name: "ECDSA", namedCurve: "P-256" },
     true,
     ["verify"]

package/SECURITY.md

@@ -10,16 +10,17 @@ Do not open public issues for security reports. We will respond on a best-effort
 
 ## Scope
 
-EdgCA is a stateless certificate-issuance toolkit for Cloudflare Workers-compatible runtimes. The following are **in scope** for security reports:
+EdgCA is a stateless certificate-issuance and bounded-validation toolkit for Cloudflare Workers-compatible runtimes. The following are **in scope** for security reports:
 
 - Incorrect ASN.1 / DER encoding of issued certificates that could mislead a verifier.
 - Cryptographic signature or KDF misuse, including incorrect use of `globalThis.crypto.subtle`.
 - Memory-safety problems, infinite loops, or unbounded allocations triggered by malformed PEM/DER input to public functions.
 - Public-API surface that allows a caller to produce a certificate that violates the documented invariants (e.g., `issueIntermediateCA` producing `pathLenConstraint > 0`).
+- Incorrect acceptance or rejection by the documented direct-issuer and bounded-chain validation policies.
 
 The following are **out of scope** (see [docs/en/NON_GOALS.md](docs/en/NON_GOALS.md) for the full list and rationale):
 
-- Chain validation, revocation (CRL/OCSP), key storage, rotation — EdgCA does not provide them.
+- Automatic PKI path building, AIA fetching, OS trust-store access, revocation (CRL/OCSP), key storage, and rotation — EdgCA does not provide them.
 - Operational misuse of issued material (leaked private keys, logging secrets, weak storage).
 - Caller-controlled inputs producing wrong outputs by design ("garbage in, garbage out" behavior is documented; e.g., `importCertificateAuthority` does not cryptographically validate that `issuerChainPem` actually issued `certPem`).
 - `verifyClientCertificateIssuedBy` not authenticating the presenter — by design, this function only verifies issuance, not proof-of-possession of the private key. See the Verify section of the README for details.

package/dist/ca.js

@@ -185,6 +185,7 @@ function assertIssuerChainPem(chainPem) {
 }
 async function resolveKeyPair(provided) {
     if (provided !== undefined) {
+        await assertKeyPairMatches(provided.privateKey, provided.publicKey);
         return provided;
     }
     return generateKeyPair();

package/dist/index.d.ts

@@ -4,6 +4,6 @@ export { certificateToPem, csrToPem, encodePem, pemToDer, pemToDerWithLabel, spl
 export { generateKeyPair, type SupportedCurve } from "./crypto.js";
 export { arrayBufferFromBytes, bytesEqual } from "./bytes.js";
 export { exportPkcs12, type ExportPkcs12Input } from "./pkcs12.js";
-export { verifyClientCertificateIssuedBy, type VerifyClientCertificateIssuedByOptions, type VerifyClientCertificateValidity } from "./verify.js";
+export { verifyCertificateChain, verifyCertificateIssuedBy, verifyClientCertificateIssuedBy, type CertificateChainVerificationResult, type CertificateVerificationFailureReason, type CertificateVerificationPurpose, type VerifyCertificateChainOptions, type VerifyCertificateIssuedByOptions, type VerifyClientCertificateIssuedByOptions, type VerifyClientCertificateValidity } from "./verify.js";
 export type { CertificateAuthority, CreateRootCAOptions, ImportCertificateAuthorityOptions, IssueClientCertForPublicKeyOptions, IssueClientCertOptions, IssueDocumentSigningCertOptions, IssueIntermediateCAOptions, IssuedClientCertificate, IssuedClientCertificateForPublicKey, IssuedDocumentSigningCertificate, SerialNumber, ShortSubjectAttributeType, Subject, SubjectAttribute, SubjectAttributeType } from "./types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,0BAA0B,EAC1B,eAAe,EACf,2BAA2B,EAC3B,wBAAwB,EACxB,mBAAmB,EACpB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,EAC9B,wCAAwC,EACxC,KAAK,kCAAkC,EACvC,KAAK,kCAAkC,EACvC,KAAK,oCAAoC,EACzC,KAAK,gCAAgC,EACrC,KAAK,+BAA+B,EACrC,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,gBAAgB,EAChB,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,iBAAiB,EACjB,cAAc,EACf,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EACL,+BAA+B,EAC/B,KAAK,sCAAsC,EAC3C,KAAK,+BAA+B,EACrC,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,iCAAiC,EACjC,kCAAkC,EAClC,sBAAsB,EACtB,+BAA+B,EAC/B,0BAA0B,EAC1B,uBAAuB,EACvB,mCAAmC,EACnC,gCAAgC,EAChC,YAAY,EACZ,yBAAyB,EACzB,OAAO,EACP,gBAAgB,EAChB,oBAAoB,EACrB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,0BAA0B,EAC1B,eAAe,EACf,2BAA2B,EAC3B,wBAAwB,EACxB,mBAAmB,EACpB,MAAM,SAAS,CAAC;AACjB,OAAO,EACL,+BAA+B,EAC/B,8BAA8B,EAC9B,wCAAwC,EACxC,KAAK,kCAAkC,EACvC,KAAK,kCAAkC,EACvC,KAAK,oCAAoC,EACzC,KAAK,gCAAgC,EACrC,KAAK,+BAA+B,EACrC,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,gBAAgB,EAChB,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,iBAAiB,EACjB,cAAc,EACf,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,KAAK,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EACL,sBAAsB,EACtB,yBAAyB,EACzB,+BAA+B,EAC/B,KAAK,kCAAkC,EACvC,KAAK,oCAAoC,EACzC,KAAK,8BAA8B,EACnC,KAAK,6BAA6B,EAClC,KAAK,gCAAgC,EACrC,KAAK,sCAAsC,EAC3C,KAAK,+BAA+B,EACrC,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,iCAAiC,EACjC,kCAAkC,EAClC,sBAAsB,EACtB,+BAA+B,EAC/B,0BAA0B,EAC1B,uBAAuB,EACvB,mCAAmC,EACnC,gCAAgC,EAChC,YAAY,EACZ,yBAAyB,EACzB,OAAO,EACP,gBAAgB,EAChB,oBAAoB,EACrB,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -4,4 +4,4 @@ export { certificateToPem, csrToPem, encodePem, pemToDer, pemToDerWithLabel, spl
 export { generateKeyPair } from "./crypto.js";
 export { arrayBufferFromBytes, bytesEqual } from "./bytes.js";
 export { exportPkcs12 } from "./pkcs12.js";
-export { verifyClientCertificateIssuedBy } from "./verify.js";
+export { verifyCertificateChain, verifyCertificateIssuedBy, verifyClientCertificateIssuedBy } from "./verify.js";

package/dist/issuer.d.ts

@@ -0,0 +1,3 @@
+export { createRootCA, importCertificateAuthority, issueClientCert, issueClientCertForPublicKey, issueDocumentSigningCert, issueIntermediateCA } from "./ca.js";
+export type { CertificateAuthority, CreateRootCAOptions, ImportCertificateAuthorityOptions, IssueClientCertForPublicKeyOptions, IssueClientCertOptions, IssueDocumentSigningCertOptions, IssueIntermediateCAOptions, IssuedClientCertificate, IssuedClientCertificateForPublicKey, IssuedDocumentSigningCertificate, SerialNumber, ShortSubjectAttributeType, Subject, SubjectAttribute, SubjectAttributeType } from "./types.js";
+//# sourceMappingURL=issuer.d.ts.map

package/dist/issuer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issuer.d.ts","sourceRoot":"","sources":["../src/issuer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,0BAA0B,EAC1B,eAAe,EACf,2BAA2B,EAC3B,wBAAwB,EACxB,mBAAmB,EACpB,MAAM,SAAS,CAAC;AAEjB,YAAY,EACV,oBAAoB,EACpB,mBAAmB,EACnB,iCAAiC,EACjC,kCAAkC,EAClC,sBAAsB,EACtB,+BAA+B,EAC/B,0BAA0B,EAC1B,uBAAuB,EACvB,mCAAmC,EACnC,gCAAgC,EAChC,YAAY,EACZ,yBAAyB,EACzB,OAAO,EACP,gBAAgB,EAChB,oBAAoB,EACrB,MAAM,YAAY,CAAC"}

package/dist/issuer.js

@@ -0,0 +1 @@
+export { createRootCA, importCertificateAuthority, issueClientCert, issueClientCertForPublicKey, issueDocumentSigningCert, issueIntermediateCA } from "./ca.js";

package/dist/parser.d.ts

@@ -1,18 +1,41 @@
+export interface ParsedKeyUsage {
+    digitalSignature: boolean;
+    contentCommitment: boolean;
+    keyCertSign: boolean;
+    cRLSign: boolean;
+}
 export interface ParsedCertificate {
     der: Uint8Array;
     tbsCertificateDer: Uint8Array;
     signatureDer: Uint8Array;
+    signatureAlgorithmOid: string;
+    tbsSignatureAlgorithmOid: string;
+    signatureAlgorithmMatches: boolean;
     issuerNameDer: Uint8Array;
     subjectNameDer: Uint8Array;
     subjectPublicKeyInfoDer: Uint8Array;
     publicKey: CryptoKey;
+    notBeforeMs?: number;
+    notAfterMs?: number;
+    basicConstraintsPresent: boolean;
     isCA: boolean;
     pathLenConstraint?: number;
+    keyUsagePresent: boolean;
+    keyUsage: ParsedKeyUsage;
     keyCertSign: boolean;
+    extendedKeyUsagePresent: boolean;
+    extendedKeyUsageOids: readonly string[];
     subjectKeyIdentifier?: Uint8Array;
     authorityKeyIdentifier?: Uint8Array;
+    duplicateExtensionOids: readonly string[];
+    unsupportedCriticalExtensionOids: readonly string[];
+}
+export interface ParsedCertificateForVerification extends ParsedCertificate {
+    notBeforeMs: number;
+    notAfterMs: number;
 }
 export declare function extractCertificateSpkiDer(der: Uint8Array): Uint8Array;
 export declare function parseCertificateDer(der: Uint8Array): Promise<ParsedCertificate>;
+export declare function parseCertificateDerForVerification(der: Uint8Array): Promise<ParsedCertificateForVerification>;
 export declare function assertIssuerSubjectMatches(issuer: ParsedCertificate, issued: ParsedCertificate): void;
 //# sourceMappingURL=parser.d.ts.map

package/dist/parser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../src/parser.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,UAAU,CAAC;IAChB,iBAAiB,EAAE,UAAU,CAAC;IAC9B,YAAY,EAAE,UAAU,CAAC;IACzB,aAAa,EAAE,UAAU,CAAC;IAC1B,cAAc,EAAE,UAAU,CAAC;IAC3B,uBAAuB,EAAE,UAAU,CAAC;IACpC,SAAS,EAAE,SAAS,CAAC;IACrB,IAAI,EAAE,OAAO,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,EAAE,OAAO,CAAC;IACrB,oBAAoB,CAAC,EAAE,UAAU,CAAC;IAClC,sBAAsB,CAAC,EAAE,UAAU,CAAC;CACrC;AAQD,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU,CA+BrE;AAED,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAkErF;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAIrG"}
+{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../src/parser.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,cAAc;IAC7B,gBAAgB,EAAE,OAAO,CAAC;IAC1B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,UAAU,CAAC;IAChB,iBAAiB,EAAE,UAAU,CAAC;IAC9B,YAAY,EAAE,UAAU,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,wBAAwB,EAAE,MAAM,CAAC;IACjC,yBAAyB,EAAE,OAAO,CAAC;IACnC,aAAa,EAAE,UAAU,CAAC;IAC1B,cAAc,EAAE,UAAU,CAAC;IAC3B,uBAAuB,EAAE,UAAU,CAAC;IACpC,SAAS,EAAE,SAAS,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uBAAuB,EAAE,OAAO,CAAC;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,EAAE,OAAO,CAAC;IACzB,QAAQ,EAAE,cAAc,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;IACrB,uBAAuB,EAAE,OAAO,CAAC;IACjC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,oBAAoB,CAAC,EAAE,UAAU,CAAC;IAClC,sBAAsB,CAAC,EAAE,UAAU,CAAC;IACpC,sBAAsB,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,gCAAgC,EAAE,SAAS,MAAM,EAAE,CAAC;CACrD;AAED,MAAM,WAAW,gCAAiC,SAAQ,iBAAiB;IACzE,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAoBD,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU,CAyBrE;AAID,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAKrF;AAKD,wBAAsB,kCAAkC,CACtD,GAAG,EAAE,UAAU,GACd,OAAO,CAAC,gCAAgC,CAAC,CAM3C;AAkGD,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAIrG"}

package/dist/parser.js

@@ -1,13 +1,23 @@
 import { bytesEqual } from "./bytes.js";
-import { decodeInteger, decodeOid, readChildren, readElement, readSequenceChildren, TAG } from "./der.js";
+import { decodeInteger, decodeOid, readElement, readSequenceChildren, TAG } from "./der.js";
 import { importPublicKeySpki } from "./crypto.js";
 import { OID } from "./oids.js";
+const EMPTY_KEY_USAGE = {
+    digitalSignature: false,
+    contentCommitment: false,
+    keyCertSign: false,
+    cRLSign: false
+};
+const KNOWN_EXTENSION_OIDS = new Set([
+    OID.basicConstraints,
+    OID.keyUsage,
+    OID.extendedKeyUsage,
+    OID.subjectKeyIdentifier,
+    OID.authorityKeyIdentifier
+]);
 // Read just the SubjectPublicKeyInfo DER from a v3 X.509 certificate without
 // importing the public key. Used by exportPkcs12, which needs the SPKI for
-// localKeyId computation (SHA-1 of the BIT STRING value) regardless of the
-// inner key algorithm. parseCertificateDer below additionally imports the
-// SPKI as an ECDSA CryptoKey for the issuance/verify paths; that import is
-// EC-only and must not be on the pkcs12 path.
+// localKeyId computation regardless of the inner key algorithm.
 export function extractCertificateSpkiDer(der) {
     const certificate = readElement(der);
     if (certificate.tag !== TAG.SEQUENCE || certificate.end !== der.length) {
@@ -18,14 +28,7 @@ export function extractCertificateSpkiDer(der) {
         throw new Error("Invalid certificate structure");
     }
     const tbsChildren = readSequenceChildren(tbsCertificate);
-    const versionTag = tbsChildren[0];
-    if (!versionTag || versionTag.tag !== 0xa0) {
-        throw new Error("Unsupported X.509 version (only v3 is supported)");
-    }
-    const versionInner = readElement(versionTag.value);
-    if (versionInner.tag !== TAG.INTEGER || decodeInteger(versionInner.value) !== 2n) {
-        throw new Error("Unsupported X.509 version (only v3 is supported)");
-    }
+    assertV3(tbsChildren[0]);
     // tbsCertificate (v3) layout:
     //   [0] version [0] EXPLICIT INTEGER 2
     //   [1] serialNumber
@@ -40,54 +43,96 @@ export function extractCertificateSpkiDer(der) {
     }
     return subjectPublicKeyInfo.raw;
 }
+// Compatibility parser used by issuance/import paths. It preserves the
+// historical behavior for unusual-but-parseable imported certificates.
 export async function parseCertificateDer(der) {
+    // Await here (rather than returning the inner promise directly) so runtimes
+    // with eager unhandled-rejection tracking observe this wrapper as the
+    // rejection owner for synchronous parse failures.
+    return await parseCertificateDerInternal(der, false);
+}
+// Strict parser used only by the public verification surface. It reads the
+// certificate's own validity and rejects malformed X.509 structures while
+// reporting policy failures (duplicates/unknown critical extensions) as data.
+export async function parseCertificateDerForVerification(der) {
+    const parsed = await parseCertificateDerInternal(der, true);
+    if (parsed.notBeforeMs === undefined || parsed.notAfterMs === undefined) {
+        throw new Error("Invalid certificate validity");
+    }
+    return parsed;
+}
+async function parseCertificateDerInternal(der, strict) {
     const certificate = readElement(der);
     if (certificate.tag !== TAG.SEQUENCE || certificate.end !== der.length) {
         throw new Error("Invalid certificate DER");
     }
-    const [tbsCertificate, signatureAlgorithm, signatureValue] = readSequenceChildren(certificate);
+    const certificateChildren = readSequenceChildren(certificate);
+    if (strict && certificateChildren.length !== 3) {
+        throw new Error("Invalid certificate structure");
+    }
+    const [tbsCertificate, signatureAlgorithm, signatureValue] = certificateChildren;
     if (!tbsCertificate || !signatureAlgorithm || !signatureValue) {
         throw new Error("Invalid certificate structure");
     }
-    if (signatureValue.tag !== TAG.BIT_STRING || signatureValue.value[0] !== 0) {
+    if (tbsCertificate.tag !== TAG.SEQUENCE || signatureAlgorithm.tag !== TAG.SEQUENCE) {
+        throw new Error("Invalid certificate structure");
+    }
+    if (signatureValue.tag !== TAG.BIT_STRING || signatureValue.value.length < 1 || signatureValue.value[0] !== 0) {
         throw new Error("Invalid certificate signature value");
     }
     const tbsChildren = readSequenceChildren(tbsCertificate);
-    // RFC 5280 §4.1.2.1: version is [0] EXPLICIT INTEGER. EdgCA only emits and
-    // accepts v3 (= INTEGER 2); v1 (field omitted) and v2 (INTEGER 1) are rejected.
-    // See docs/NON_GOALS.md §4.
-    const versionTag = tbsChildren[0];
-    if (!versionTag || versionTag.tag !== 0xa0) {
-        throw new Error("Unsupported X.509 version (only v3 is supported)");
-    }
-    const versionInner = readElement(versionTag.value);
-    if (versionInner.tag !== TAG.INTEGER || decodeInteger(versionInner.value) !== 2n) {
-        throw new Error("Unsupported X.509 version (only v3 is supported)");
+    assertV3(tbsChildren[0]);
+    if (strict && tbsChildren.length < 7) {
+        throw new Error("Invalid certificate TBSCertificate structure");
     }
-    let index = 1;
-    index += 1; // serialNumber
-    index += 1; // signature
-    const issuer = tbsChildren[index++];
-    index += 1; // validity
-    const subject = tbsChildren[index++];
-    const subjectPublicKeyInfo = tbsChildren[index++];
-    if (!issuer || !subject || !subjectPublicKeyInfo) {
+    const tbsSignatureAlgorithm = tbsChildren[2];
+    const issuer = tbsChildren[3];
+    const validity = tbsChildren[4];
+    const subject = tbsChildren[5];
+    const subjectPublicKeyInfo = tbsChildren[6];
+    if (!tbsSignatureAlgorithm || tbsSignatureAlgorithm.tag !== TAG.SEQUENCE ||
+        !issuer || issuer.tag !== TAG.SEQUENCE ||
+        !validity || validity.tag !== TAG.SEQUENCE ||
+        !subject || subject.tag !== TAG.SEQUENCE ||
+        !subjectPublicKeyInfo || subjectPublicKeyInfo.tag !== TAG.SEQUENCE) {
         throw new Error("Invalid certificate TBSCertificate structure");
     }
-    const extensions = tbsChildren.find((element) => element.tag === 0xa3);
-    const parsedExtensions = extensions ? parseExtensions(extensions.value) : {};
+    const signatureAlgorithmOid = parseAlgorithmIdentifier(signatureAlgorithm, strict);
+    const tbsSignatureAlgorithmOid = parseAlgorithmIdentifier(tbsSignatureAlgorithm, strict);
+    const extensionFields = tbsChildren.filter((element) => element.tag === 0xa3);
+    if (strict && extensionFields.length > 1) {
+        throw new Error("Invalid certificate: duplicate extensions field");
+    }
+    const parsedExtensions = extensionFields[0]
+        ? parseExtensions(extensionFields[0].value, strict)
+        : emptyParsedExtensions();
     const publicKey = await importPublicKeySpki(subjectPublicKeyInfo.raw);
+    const parsedValidity = strict ? parseValidity(validity) : undefined;
     const parsed = {
         der,
         tbsCertificateDer: tbsCertificate.raw,
         signatureDer: signatureValue.value.subarray(1),
+        signatureAlgorithmOid,
+        tbsSignatureAlgorithmOid,
+        signatureAlgorithmMatches: bytesEqual(signatureAlgorithm.raw, tbsSignatureAlgorithm.raw),
         issuerNameDer: issuer.raw,
         subjectNameDer: subject.raw,
         subjectPublicKeyInfoDer: subjectPublicKeyInfo.raw,
         publicKey,
+        basicConstraintsPresent: parsedExtensions.basicConstraintsPresent,
         isCA: parsedExtensions.isCA ?? false,
-        keyCertSign: parsedExtensions.keyCertSign ?? false
+        keyUsagePresent: parsedExtensions.keyUsagePresent,
+        keyUsage: parsedExtensions.keyUsage ?? { ...EMPTY_KEY_USAGE },
+        keyCertSign: parsedExtensions.keyUsage?.keyCertSign ?? false,
+        extendedKeyUsagePresent: parsedExtensions.extendedKeyUsagePresent,
+        extendedKeyUsageOids: parsedExtensions.extendedKeyUsageOids ?? [],
+        duplicateExtensionOids: parsedExtensions.duplicateExtensionOids,
+        unsupportedCriticalExtensionOids: parsedExtensions.unsupportedCriticalExtensionOids
     };
+    if (parsedValidity !== undefined) {
+        parsed.notBeforeMs = parsedValidity.notBeforeMs;
+        parsed.notAfterMs = parsedValidity.notAfterMs;
+    }
     if (parsedExtensions.pathLenConstraint !== undefined) {
         parsed.pathLenConstraint = parsedExtensions.pathLenConstraint;
     }
@@ -104,12 +149,22 @@ export function assertIssuerSubjectMatches(issuer, issued) {
         throw new Error("Issued certificate issuer does not match CA subject");
     }
 }
-function parseExtensions(explicitValue) {
+function emptyParsedExtensions() {
+    return {
+        basicConstraintsPresent: false,
+        keyUsagePresent: false,
+        extendedKeyUsagePresent: false,
+        duplicateExtensionOids: [],
+        unsupportedCriticalExtensionOids: []
+    };
+}
+function parseExtensions(explicitValue, strict) {
     const outer = readElement(explicitValue);
-    if (outer.tag !== TAG.SEQUENCE) {
+    if (outer.tag !== TAG.SEQUENCE || (strict && outer.end !== explicitValue.length)) {
         throw new Error("Invalid extensions structure");
     }
-    const parsed = {};
+    const parsed = emptyParsedExtensions();
+    const seen = new Set();
     for (const extension of readSequenceChildren(outer)) {
         const children = readSequenceChildren(extension);
         const oidElement = children[0];
@@ -117,25 +172,40 @@ function parseExtensions(explicitValue) {
             throw new Error("Invalid extension OID");
         }
         let valueIndex = 1;
+        let critical = false;
         if (children[valueIndex]?.tag === TAG.BOOLEAN) {
+            critical = parseBoolean(children[valueIndex], strict);
             valueIndex += 1;
         }
         const value = children[valueIndex];
-        if (!value || value.tag !== TAG.OCTET_STRING) {
+        if (!value || value.tag !== TAG.OCTET_STRING || (strict && children.length !== valueIndex + 1)) {
             throw new Error("Invalid extension value");
         }
         const extensionOid = decodeOid(oidElement.value);
+        if (seen.has(extensionOid) && !parsed.duplicateExtensionOids.includes(extensionOid)) {
+            parsed.duplicateExtensionOids.push(extensionOid);
+        }
+        seen.add(extensionOid);
+        if (critical && !KNOWN_EXTENSION_OIDS.has(extensionOid)) {
+            parsed.unsupportedCriticalExtensionOids.push(extensionOid);
+        }
         if (extensionOid === OID.basicConstraints) {
-            Object.assign(parsed, parseBasicConstraints(value.value));
+            parsed.basicConstraintsPresent = true;
+            Object.assign(parsed, parseBasicConstraints(value.value, strict));
         }
         else if (extensionOid === OID.keyUsage) {
-            parsed.keyCertSign = parseKeyUsage(value.value).keyCertSign;
+            parsed.keyUsagePresent = true;
+            parsed.keyUsage = parseKeyUsage(value.value, strict);
+        }
+        else if (extensionOid === OID.extendedKeyUsage) {
+            parsed.extendedKeyUsagePresent = true;
+            parsed.extendedKeyUsageOids = parseExtendedKeyUsage(value.value, strict);
         }
         else if (extensionOid === OID.subjectKeyIdentifier) {
-            parsed.subjectKeyIdentifier = parseOctetString(value.value);
+            parsed.subjectKeyIdentifier = parseOctetString(value.value, strict);
         }
         else if (extensionOid === OID.authorityKeyIdentifier) {
-            const keyIdentifier = parseAuthorityKeyIdentifier(value.value);
+            const keyIdentifier = parseAuthorityKeyIdentifier(value.value, strict);
             if (keyIdentifier !== undefined) {
                 parsed.authorityKeyIdentifier = keyIdentifier;
             }
@@ -143,42 +213,187 @@ function parseExtensions(explicitValue) {
     }
     return parsed;
 }
-function parseBasicConstraints(value) {
+function parseAlgorithmIdentifier(element, strict) {
+    const children = readSequenceChildren(element);
+    const oidElement = children[0];
+    if (!oidElement || oidElement.tag !== TAG.OBJECT_IDENTIFIER) {
+        throw new Error("Invalid signature AlgorithmIdentifier");
+    }
+    if (strict && children.length !== 1) {
+        throw new Error("ECDSA signature AlgorithmIdentifier must not have parameters");
+    }
+    return decodeOid(oidElement.value);
+}
+function parseValidity(validity) {
+    const children = readSequenceChildren(validity);
+    if (children.length !== 2 || !children[0] || !children[1]) {
+        throw new Error("Invalid certificate validity");
+    }
+    const notBeforeMs = parseDerTime(children[0]);
+    const notAfterMs = parseDerTime(children[1]);
+    if (notBeforeMs > notAfterMs) {
+        throw new Error("Invalid certificate validity range");
+    }
+    return { notBeforeMs, notAfterMs };
+}
+function parseDerTime(element) {
+    const text = asciiString(element.value, "certificate time");
+    let year;
+    let offset;
+    if (element.tag === TAG.UTC_TIME) {
+        if (!/^\d{12}Z$/.test(text)) {
+            throw new Error("Invalid UTCTime");
+        }
+        const shortYear = Number(text.slice(0, 2));
+        year = shortYear >= 50 ? 1900 + shortYear : 2000 + shortYear;
+        offset = 2;
+    }
+    else if (element.tag === TAG.GENERALIZED_TIME) {
+        if (!/^\d{14}Z$/.test(text)) {
+            throw new Error("Invalid GeneralizedTime");
+        }
+        year = Number(text.slice(0, 4));
+        if (year < 1 || year > 9999) {
+            throw new Error("Invalid GeneralizedTime year");
+        }
+        offset = 4;
+    }
+    else {
+        throw new Error("Unsupported certificate time type");
+    }
+    const month = Number(text.slice(offset, offset + 2));
+    const day = Number(text.slice(offset + 2, offset + 4));
+    const hour = Number(text.slice(offset + 4, offset + 6));
+    const minute = Number(text.slice(offset + 6, offset + 8));
+    const second = Number(text.slice(offset + 8, offset + 10));
+    const date = new Date(0);
+    date.setUTCFullYear(year, month - 1, day);
+    date.setUTCHours(hour, minute, second, 0);
+    if (month < 1 || month > 12 || day < 1 || hour > 23 || minute > 59 || second > 59 ||
+        date.getUTCFullYear() !== year || date.getUTCMonth() !== month - 1 ||
+        date.getUTCDate() !== day || date.getUTCHours() !== hour ||
+        date.getUTCMinutes() !== minute || date.getUTCSeconds() !== second) {
+        throw new Error("Invalid certificate time value");
+    }
+    return date.getTime();
+}
+function parseBasicConstraints(value, strict) {
     const root = readElement(value);
+    if (root.tag !== TAG.SEQUENCE || (strict && root.end !== value.length)) {
+        throw new Error("Invalid basicConstraints extension");
+    }
     const children = readSequenceChildren(root);
     const result = { isCA: false };
-    if (children[0]?.tag === TAG.BOOLEAN) {
-        result.isCA = children[0].value[0] !== 0;
+    let index = 0;
+    if (children[index]?.tag === TAG.BOOLEAN) {
+        result.isCA = parseBoolean(children[index], strict);
+        index += 1;
+    }
+    if (children[index]?.tag === TAG.INTEGER) {
+        const decoded = decodeInteger(children[index].value);
+        if (decoded > BigInt(Number.MAX_SAFE_INTEGER)) {
+            throw new Error("basicConstraints pathLenConstraint is too large");
+        }
+        result.pathLenConstraint = Number(decoded);
+        index += 1;
+    }
+    if (strict && index !== children.length) {
+        throw new Error("Invalid basicConstraints extension");
     }
-    const pathLen = children.find((child) => child.tag === TAG.INTEGER);
-    if (pathLen) {
-        result.pathLenConstraint = Number(decodeInteger(pathLen.value));
+    if (strict && result.pathLenConstraint !== undefined && result.isCA !== true) {
+        throw new Error("basicConstraints pathLenConstraint requires CA=true");
     }
     return result;
 }
-function parseKeyUsage(value) {
+function parseKeyUsage(value, strict) {
     const root = readElement(value);
-    if (root.tag !== TAG.BIT_STRING || root.value.length < 2) {
+    if (root.tag !== TAG.BIT_STRING || root.value.length < 2 || (strict && root.end !== value.length)) {
         throw new Error("Invalid keyUsage extension");
     }
+    const unusedBits = root.value[0];
     const bytes = root.value.subarray(1);
+    if (unusedBits > 7) {
+        throw new Error("Invalid keyUsage unused bits");
+    }
+    if (strict && unusedBits > 0 && (bytes[bytes.length - 1] & ((1 << unusedBits) - 1)) !== 0) {
+        throw new Error("Invalid keyUsage padding bits");
+    }
     return {
-        keyCertSign: (bytes[0] & 0x04) !== 0
+        digitalSignature: keyUsageBit(bytes, 0),
+        contentCommitment: keyUsageBit(bytes, 1),
+        keyCertSign: keyUsageBit(bytes, 5),
+        cRLSign: keyUsageBit(bytes, 6)
     };
 }
-function parseOctetString(value) {
+function keyUsageBit(bytes, bit) {
+    const byte = bytes[Math.floor(bit / 8)];
+    return byte !== undefined && (byte & (0x80 >> (bit % 8))) !== 0;
+}
+function parseExtendedKeyUsage(value, strict) {
     const root = readElement(value);
-    if (root.tag !== TAG.OCTET_STRING) {
+    if (root.tag !== TAG.SEQUENCE || (strict && root.end !== value.length)) {
+        throw new Error("Invalid extendedKeyUsage extension");
+    }
+    const children = readSequenceChildren(root);
+    if (strict && children.length === 0) {
+        throw new Error("extendedKeyUsage must contain at least one purpose");
+    }
+    return children.map((child) => {
+        if (child.tag !== TAG.OBJECT_IDENTIFIER) {
+            throw new Error("Invalid extendedKeyUsage purpose");
+        }
+        return decodeOid(child.value);
+    });
+}
+function parseOctetString(value, strict) {
+    const root = readElement(value);
+    if (root.tag !== TAG.OCTET_STRING || (strict && root.end !== value.length)) {
         throw new Error("Invalid OCTET STRING extension payload");
     }
     return root.value;
 }
-function parseAuthorityKeyIdentifier(value) {
+function parseAuthorityKeyIdentifier(value, strict) {
     const root = readElement(value);
+    if (root.tag !== TAG.SEQUENCE || (strict && root.end !== value.length)) {
+        throw new Error("Invalid authorityKeyIdentifier extension");
+    }
+    let keyIdentifier;
     for (const child of readSequenceChildren(root)) {
         if (child.tag === 0x80) {
-            return child.value;
+            if (strict && keyIdentifier !== undefined) {
+                throw new Error("Duplicate authorityKeyIdentifier keyIdentifier");
+            }
+            keyIdentifier = child.value;
+        }
+    }
+    return keyIdentifier;
+}
+function parseBoolean(element, strict) {
+    if (element.value.length !== 1) {
+        throw new Error("Invalid BOOLEAN");
+    }
+    if (strict && element.value[0] !== 0x00 && element.value[0] !== 0xff) {
+        throw new Error("Invalid DER BOOLEAN value");
+    }
+    return element.value[0] !== 0;
+}
+function assertV3(versionTag) {
+    if (!versionTag || versionTag.tag !== 0xa0) {
+        throw new Error("Unsupported X.509 version (only v3 is supported)");
+    }
+    const versionInner = readElement(versionTag.value);
+    if (versionInner.tag !== TAG.INTEGER || versionInner.end !== versionTag.value.length ||
+        decodeInteger(versionInner.value) !== 2n) {
+        throw new Error("Unsupported X.509 version (only v3 is supported)");
+    }
+}
+function asciiString(bytes, name) {
+    let out = "";
+    for (const byte of bytes) {
+        if (byte > 0x7f) {
+            throw new Error(`Invalid non-ASCII ${name}`);
         }
+        out += String.fromCharCode(byte);
     }
-    return undefined;
+    return out;
 }

package/dist/verify.d.ts

@@ -9,38 +9,43 @@ export interface VerifyClientCertificateIssuedByOptions {
     certPem: string;
     validity?: VerifyClientCertificateValidity;
 }
+export interface VerifyCertificateIssuedByOptions {
+    certificatePem: string;
+    issuerCertificatePem: string;
+    at?: Date | number;
+}
+export type CertificateVerificationPurpose = "ca" | "clientAuth" | "documentSigning";
+export interface VerifyCertificateChainOptions {
+    certificatePem: string;
+    intermediateCertificatesPem?: readonly string[];
+    trustedRootCertificatesPem: readonly string[];
+    at?: Date | number;
+    purpose?: CertificateVerificationPurpose;
+}
+export type CertificateVerificationFailureReason = "not-yet-valid" | "expired" | "issuer-name-mismatch" | "key-identifier-mismatch" | "invalid-signature" | "issuer-not-ca" | "issuer-key-usage-invalid" | "path-length-exceeded" | "target-profile-invalid" | "invalid-chain-order" | "duplicate-extension" | "signature-algorithm-mismatch" | "unsupported-critical-extension" | "untrusted-root";
+export type CertificateChainVerificationResult = {
+    valid: true;
+    trustedRootIndex: number;
+} | {
+    valid: false;
+    reason: CertificateVerificationFailureReason;
+    certificateIndex: number;
+};
 /**
- * Confirms that `options.certPem` was issued by `options.ca`.
- *
- * This is **not** mTLS verification, and does not even attempt to be.
- * At most it is *issuance verification*: "the presented certificate was
- * issued by the specified CA" — which is **not** the same as authenticating
- * that the presenter is the certificate's legitimate owner.
- *
- * A client certificate is, by design, presentable to anyone, and its
- * contents are trivially copyable. You must assume that anyone could be
- * holding a valid copy. Therefore possession of valid certificate data
- * **never** proves legitimate ownership.
- *
- * Proving legitimate ownership additionally requires verifying possession
- * of the corresponding private key (a signature made by it, verified
- * against the certificate's public key). The TLS handshake's
- * `CertificateVerify` message normally provides this, but the Cloudflare
- * Workers runtime does not expose that signature to the application. On
- * non-Enterprise plans, Cloudflare's TLS layer also does not know about
- * your self-managed CA, so `request.cf.tlsClientAuth.certVerified` will
- * not be `"SUCCESS"` for certificates EdgCA issued. Application code on
- * Workers (Enterprise excluded) has no way to verify proof-of-possession.
- *
- * Implication: anyone who has obtained a copy of a valid certificate
- * (logs, leaked storage, network capture, etc.) can present it and pass
- * this check. Use this as a minimum identity-check layer, not as
- * authentication. For real authentication, use Cloudflare Enterprise mTLS
- * at the TLS layer, or add an application-layer challenge-response that
- * has the client sign a server-issued nonce with its private key.
+ * Verifies one certificate/issuer link using public certificate material only.
+ * This is not proof that a presenter possesses the certificate's private key.
+ */
+export declare function verifyCertificateIssuedBy(options: VerifyCertificateIssuedByOptions): Promise<boolean>;
+/**
+ * Verifies a caller-ordered chain ending at one explicitly supplied trust
+ * anchor. It intentionally does not perform PKI path building or revocation.
+ */
+export declare function verifyCertificateChain(options: VerifyCertificateChainOptions): Promise<CertificateChainVerificationResult>;
+/**
+ * Legacy compatibility API. Its external validity option and direct-issuer
+ * semantics intentionally remain unchanged.
  *
- * Also out of scope (not checked here): `BasicConstraints CA=false`,
- * `EKU clientAuth`, revocation, and chain walking.
+ * This is not mTLS verification and does not authenticate the presenter.
  */
 export declare function verifyClientCertificateIssuedBy(options: VerifyClientCertificateIssuedByOptions): Promise<boolean>;
 //# sourceMappingURL=verify.d.ts.map

package/dist/verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,IAAI,GAAG,MAAM,CAAC;IACzB,QAAQ,EAAE,IAAI,GAAG,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sCAAsC;IACrD,EAAE,EAAE,oBAAoB,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,+BAA+B,CAAC;CAC5C;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAsB,+BAA+B,CACnD,OAAO,EAAE,sCAAsC,GAC9C,OAAO,CAAC,OAAO,CAAC,CAwBlB"}
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEvD,MAAM,WAAW,+BAA+B;IAC9C,SAAS,EAAE,IAAI,GAAG,MAAM,CAAC;IACzB,QAAQ,EAAE,IAAI,GAAG,MAAM,CAAC;IACxB,GAAG,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sCAAsC;IACrD,EAAE,EAAE,oBAAoB,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,+BAA+B,CAAC;CAC5C;AAED,MAAM,WAAW,gCAAgC;IAC/C,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,EAAE,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,8BAA8B,GAAG,IAAI,GAAG,YAAY,GAAG,iBAAiB,CAAC;AAErF,MAAM,WAAW,6BAA6B;IAC5C,cAAc,EAAE,MAAM,CAAC;IACvB,2BAA2B,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAChD,0BAA0B,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,EAAE,CAAC,EAAE,IAAI,GAAG,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,8BAA8B,CAAC;CAC1C;AAED,MAAM,MAAM,oCAAoC,GAC5C,eAAe,GACf,SAAS,GACT,sBAAsB,GACtB,yBAAyB,GACzB,mBAAmB,GACnB,eAAe,GACf,0BAA0B,GAC1B,sBAAsB,GACtB,wBAAwB,GACxB,qBAAqB,GACrB,qBAAqB,GACrB,8BAA8B,GAC9B,gCAAgC,GAChC,gBAAgB,CAAC;AAErB,MAAM,MAAM,kCAAkC,GAC1C;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,GACzC;IACE,KAAK,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,oCAAoC,CAAC;IAC7C,gBAAgB,EAAE,MAAM,CAAC;CAC1B,CAAC;AAIN;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,gCAAgC,GACxC,OAAO,CAAC,OAAO,CAAC,CAUlB;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,kCAAkC,CAAC,CA2F7C;AAED;;;;;GAKG;AACH,wBAAsB,+BAA+B,CACnD,OAAO,EAAE,sCAAsC,GAC9C,OAAO,CAAC,OAAO,CAAC,CAwBlB"}

package/dist/verify.js

@@ -1,39 +1,113 @@
 import { bytesEqual } from "./bytes.js";
-import { keyIdentifierFromSpki, verifyDer } from "./crypto.js";
+import { curveOf, keyIdentifierFromSpki, signatureAlgorithmOidForCurve, verifyDer } from "./crypto.js";
+import { OID } from "./oids.js";
 import { pemToDerWithLabel } from "./pem.js";
-import { parseCertificateDer } from "./parser.js";
+import { parseCertificateDer, parseCertificateDerForVerification } from "./parser.js";
 /**
- * Confirms that `options.certPem` was issued by `options.ca`.
- *
- * This is **not** mTLS verification, and does not even attempt to be.
- * At most it is *issuance verification*: "the presented certificate was
- * issued by the specified CA" — which is **not** the same as authenticating
- * that the presenter is the certificate's legitimate owner.
- *
- * A client certificate is, by design, presentable to anyone, and its
- * contents are trivially copyable. You must assume that anyone could be
- * holding a valid copy. Therefore possession of valid certificate data
- * **never** proves legitimate ownership.
- *
- * Proving legitimate ownership additionally requires verifying possession
- * of the corresponding private key (a signature made by it, verified
- * against the certificate's public key). The TLS handshake's
- * `CertificateVerify` message normally provides this, but the Cloudflare
- * Workers runtime does not expose that signature to the application. On
- * non-Enterprise plans, Cloudflare's TLS layer also does not know about
- * your self-managed CA, so `request.cf.tlsClientAuth.certVerified` will
- * not be `"SUCCESS"` for certificates EdgCA issued. Application code on
- * Workers (Enterprise excluded) has no way to verify proof-of-possession.
- *
- * Implication: anyone who has obtained a copy of a valid certificate
- * (logs, leaked storage, network capture, etc.) can present it and pass
- * this check. Use this as a minimum identity-check layer, not as
- * authentication. For real authentication, use Cloudflare Enterprise mTLS
- * at the TLS layer, or add an application-layer challenge-response that
- * has the client sign a server-issued nonce with its private key.
+ * Verifies one certificate/issuer link using public certificate material only.
+ * This is not proof that a presenter possesses the certificate's private key.
+ */
+export async function verifyCertificateIssuedBy(options) {
+    assertObject(options, "options");
+    const at = toEpochMs(options.at ?? Date.now(), "at");
+    const certificate = await parseVerificationCertificate(options.certificatePem, "certificatePem");
+    const issuer = await parseVerificationCertificate(options.issuerCertificatePem, "issuerCertificatePem");
+    if (certificatePolicyFailure(certificate, at, 0))
+        return false;
+    if (certificatePolicyFailure(issuer, at, 1))
+        return false;
+    if (issuerConstraintFailure(issuer, 1))
+        return false;
+    return (await linkFailure(certificate, issuer, 0)) === undefined;
+}
+/**
+ * Verifies a caller-ordered chain ending at one explicitly supplied trust
+ * anchor. It intentionally does not perform PKI path building or revocation.
+ */
+export async function verifyCertificateChain(options) {
+    assertObject(options, "options");
+    const at = toEpochMs(options.at ?? Date.now(), "at");
+    const intermediatePems = options.intermediateCertificatesPem ?? [];
+    if (!Array.isArray(intermediatePems)) {
+        throw new Error("intermediateCertificatesPem must be an array");
+    }
+    if (intermediatePems.length > 1) {
+        throw new Error("intermediateCertificatesPem supports at most one certificate");
+    }
+    if (!Array.isArray(options.trustedRootCertificatesPem) || options.trustedRootCertificatesPem.length === 0) {
+        throw new Error("trustedRootCertificatesPem must be a non-empty array");
+    }
+    if (options.purpose !== undefined &&
+        options.purpose !== "ca" &&
+        options.purpose !== "clientAuth" &&
+        options.purpose !== "documentSigning") {
+        throw new Error("purpose must be ca, clientAuth, or documentSigning");
+    }
+    const target = await parseVerificationCertificate(options.certificatePem, "certificatePem");
+    const intermediates = await Promise.all(intermediatePems.map((pem, index) => parseVerificationCertificate(pem, `intermediateCertificatesPem[${index}]`)));
+    const roots = await Promise.all(options.trustedRootCertificatesPem.map((pem, index) => parseVerificationCertificate(pem, `trustedRootCertificatesPem[${index}]`)));
+    const path = [target, ...intermediates];
+    for (let index = 0; index < intermediates.length; index += 1) {
+        const intermediate = intermediates[index];
+        if (bytesEqual(intermediate.subjectNameDer, intermediate.issuerNameDer)) {
+            return failure("invalid-chain-order", index + 1);
+        }
+    }
+    for (let index = 0; index < path.length; index += 1) {
+        const policyFailure = certificatePolicyFailure(path[index], at, index);
+        if (policyFailure)
+            return policyFailure;
+    }
+    const profileFailure = targetProfileFailure(target, options.purpose);
+    if (profileFailure)
+        return failure(profileFailure, 0);
+    for (let childIndex = 0; childIndex < path.length - 1; childIndex += 1) {
+        const issuerIndex = childIndex + 1;
+        const issuer = path[issuerIndex];
+        const issuerFailure = issuerConstraintFailure(issuer, issuerIndex);
+        if (issuerFailure)
+            return issuerFailure;
+        const pathFailure = pathLengthFailure(issuer, path.slice(0, issuerIndex), issuerIndex);
+        if (pathFailure)
+            return pathFailure;
+        const relationshipFailure = await linkFailure(path[childIndex], issuer, childIndex);
+        if (relationshipFailure)
+            return relationshipFailure;
+    }
+    const terminalChild = path[path.length - 1];
+    const rootIndexInPath = path.length;
+    const candidateRootIndexes = [];
+    for (let index = 0; index < roots.length; index += 1) {
+        if (await issuerIdentityMatches(terminalChild, roots[index])) {
+            candidateRootIndexes.push(index);
+        }
+    }
+    if (candidateRootIndexes.length === 0) {
+        return failure("untrusted-root", rootIndexInPath);
+    }
+    let firstCandidateFailure;
+    for (const trustedRootIndex of candidateRootIndexes) {
+        const root = roots[trustedRootIndex];
+        const checks = [
+            certificatePolicyFailure(root, at, rootIndexInPath),
+            issuerConstraintFailure(root, rootIndexInPath),
+            pathLengthFailure(root, path, rootIndexInPath),
+            await linkFailure(terminalChild, root, path.length - 1),
+            await rootIntegrityFailure(root, rootIndexInPath)
+        ];
+        const candidateFailure = checks.find((check) => check !== undefined);
+        if (!candidateFailure) {
+            return { valid: true, trustedRootIndex };
+        }
+        firstCandidateFailure ??= candidateFailure;
+    }
+    return firstCandidateFailure ?? failure("untrusted-root", rootIndexInPath);
+}
+/**
+ * Legacy compatibility API. Its external validity option and direct-issuer
+ * semantics intentionally remain unchanged.
  *
- * Also out of scope (not checked here): `BasicConstraints CA=false`,
- * `EKU clientAuth`, revocation, and chain walking.
+ * This is not mTLS verification and does not authenticate the presenter.
  */
 export async function verifyClientCertificateIssuedBy(options) {
     if (options.validity && !isWithinValidity(options.validity)) {
@@ -55,6 +129,116 @@ export async function verifyClientCertificateIssuedBy(options) {
     }
     return verifyDer(options.ca.publicKey, cert.signatureDer, cert.tbsCertificateDer);
 }
+async function parseVerificationCertificate(pem, name) {
+    if (typeof pem !== "string" || pem.length === 0) {
+        throw new Error(`${name} must be a non-empty certificate PEM string`);
+    }
+    return parseCertificateDerForVerification(pemToDerWithLabel(pem, "CERTIFICATE"));
+}
+function certificatePolicyFailure(certificate, at, certificateIndex) {
+    if (certificate.duplicateExtensionOids.length > 0) {
+        return failure("duplicate-extension", certificateIndex);
+    }
+    if (!certificate.signatureAlgorithmMatches) {
+        return failure("signature-algorithm-mismatch", certificateIndex);
+    }
+    if (certificate.unsupportedCriticalExtensionOids.length > 0) {
+        return failure("unsupported-critical-extension", certificateIndex);
+    }
+    if (at < certificate.notBeforeMs) {
+        return failure("not-yet-valid", certificateIndex);
+    }
+    if (at > certificate.notAfterMs) {
+        return failure("expired", certificateIndex);
+    }
+    return undefined;
+}
+function issuerConstraintFailure(issuer, certificateIndex) {
+    if (!issuer.basicConstraintsPresent || !issuer.isCA) {
+        return failure("issuer-not-ca", certificateIndex);
+    }
+    if (!issuer.keyUsagePresent || !issuer.keyUsage.keyCertSign) {
+        return failure("issuer-key-usage-invalid", certificateIndex);
+    }
+    return undefined;
+}
+function pathLengthFailure(issuer, certificatesBelow, certificateIndex) {
+    if (issuer.pathLenConstraint === undefined)
+        return undefined;
+    const caCountBelow = certificatesBelow.filter((certificate) => certificate.isCA).length;
+    return caCountBelow > issuer.pathLenConstraint
+        ? failure("path-length-exceeded", certificateIndex)
+        : undefined;
+}
+function targetProfileFailure(target, purpose) {
+    if (purpose === undefined)
+        return undefined;
+    if (purpose === "ca") {
+        return target.basicConstraintsPresent && target.isCA &&
+            target.keyUsagePresent && target.keyUsage.keyCertSign
+            ? undefined
+            : "target-profile-invalid";
+    }
+    if (!target.basicConstraintsPresent || target.isCA || !target.keyUsagePresent) {
+        return "target-profile-invalid";
+    }
+    if (!target.keyUsage.digitalSignature || !target.extendedKeyUsagePresent) {
+        return "target-profile-invalid";
+    }
+    if (purpose === "clientAuth") {
+        return target.extendedKeyUsageOids.includes(OID.clientAuth)
+            ? undefined
+            : "target-profile-invalid";
+    }
+    return target.keyUsage.contentCommitment &&
+        target.extendedKeyUsageOids.includes(OID.documentSigning)
+        ? undefined
+        : "target-profile-invalid";
+}
+async function linkFailure(child, issuer, childIndex) {
+    if (!bytesEqual(child.issuerNameDer, issuer.subjectNameDer)) {
+        return failure("issuer-name-mismatch", childIndex);
+    }
+    if (!(await keyIdentifierMatches(child, issuer))) {
+        return failure("key-identifier-mismatch", childIndex);
+    }
+    const expectedAlgorithmOid = signatureAlgorithmOidForCurve(curveOf(issuer.publicKey));
+    if (child.signatureAlgorithmOid !== expectedAlgorithmOid) {
+        return failure("signature-algorithm-mismatch", childIndex);
+    }
+    if (!(await verifyDer(issuer.publicKey, child.signatureDer, child.tbsCertificateDer))) {
+        return failure("invalid-signature", childIndex);
+    }
+    return undefined;
+}
+async function issuerIdentityMatches(child, issuer) {
+    return bytesEqual(child.issuerNameDer, issuer.subjectNameDer) &&
+        await keyIdentifierMatches(child, issuer);
+}
+async function keyIdentifierMatches(child, issuer) {
+    if (!child.authorityKeyIdentifier || !issuer.subjectKeyIdentifier)
+        return false;
+    return bytesEqual(child.authorityKeyIdentifier, issuer.subjectKeyIdentifier);
+}
+async function rootIntegrityFailure(root, certificateIndex) {
+    if (!bytesEqual(root.issuerNameDer, root.subjectNameDer)) {
+        return failure("issuer-name-mismatch", certificateIndex);
+    }
+    if (!(await keyIdentifierMatches(root, root))) {
+        return failure("key-identifier-mismatch", certificateIndex);
+    }
+    const expectedAlgorithmOid = signatureAlgorithmOidForCurve(curveOf(root.publicKey));
+    if (root.signatureAlgorithmOid !== expectedAlgorithmOid) {
+        return failure("signature-algorithm-mismatch", certificateIndex);
+    }
+    if (!(await verifyDer(root.publicKey, root.signatureDer, root.tbsCertificateDer))) {
+        return failure("invalid-signature", certificateIndex);
+    }
+    return undefined;
+}
+function failure(reason, certificateIndex) {
+    return { valid: false, reason, certificateIndex };
+}
 function isWithinValidity(validity) {
     const notBefore = toEpochMs(validity.notBefore, "validity.notBefore");
     const notAfter = toEpochMs(validity.notAfter, "validity.notAfter");
@@ -71,3 +255,8 @@ function toEpochMs(value, name) {
     }
     return ms;
 }
+function assertObject(value, name) {
+    if (typeof value !== "object" || value === null) {
+        throw new Error(`${name} must be an object`);
+    }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@noz-ele/edgca",
-  "version": "0.5.2",
-  "description": "A small Cloudflare Workers-friendly toolkit for issuing self-managed CA and mTLS client certificates.",
+  "version": "0.6.0",
+  "description": "A small Cloudflare Workers-friendly toolkit for issuing and validating bounded self-managed CA chains.",
   "type": "module",
   "license": "MIT",
   "author": "NOZ-ELE",
@@ -46,6 +46,14 @@
     "./pkcs12": {
       "types": "./dist/pkcs12.d.ts",
       "import": "./dist/pkcs12.js"
+    },
+    "./issuer": {
+      "types": "./dist/issuer.d.ts",
+      "import": "./dist/issuer.js"
+    },
+    "./verify": {
+      "types": "./dist/verify.d.ts",
+      "import": "./dist/verify.js"
     }
   },
   "types": "./dist/index.d.ts",