@quantakrypto/qprobe 0.4.4 → 0.6.0

package/dist/x509.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"x509.d.ts","sourceRoot":"","sources":["../src/x509.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AA4B1D,+EAA+E;AAC/E,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAa/C;AAED,0EAA0E;AAC1E,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAM7E;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAc7E"}
+{"version":3,"file":"x509.d.ts","sourceRoot":"","sources":["../src/x509.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AA4B1D,+EAA+E;AAC/E,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAa/C;AAED,0EAA0E;AAC1E,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAM7E;AAED,UAAU,aAAa;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAc7E"}

package/dist/x509.js.map

@@ -1 +1 @@
-{"version":3,"file":"x509.js","sourceRoot":"","sources":["../src/x509.ts"],"names":[],"mappings":"AAuBA,uEAAuE;AACvE,SAAS,OAAO,CAAC,GAAW,EAAE,GAAW;IACvC,IAAI,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM;QAAE,MAAM,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,YAAY,GAAG,GAAG,GAAG,CAAC,CAAC;IAC3B,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;QACf,MAAM,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,YAAY,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM;YAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAC9F,GAAG,GAAG,CAAC,CAAC;QACR,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YAAE,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;QACrE,YAAY,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,MAAM,UAAU,GAAG,YAAY,GAAG,GAAG,CAAC;IACtC,IAAI,UAAU,GAAG,GAAG,CAAC,MAAM;QAAE,MAAM,IAAI,UAAU,CAAC,4BAA4B,CAAC,CAAC;IAChF,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC7D,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;IAClD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjB,KAAK,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,GAAG,CAAC,UAAU,CAAC,oBAAoB,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,yCAAyC;IACjG,IAAI,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC;QAAE,OAAO,OAAO,CAAC,CAAC,kBAAkB;IACzE,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,aAAa;QAAE,OAAO,OAAO,CAAC,CAAC,kBAAkB;IACtF,IAAI,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,gBAAgB;IACvE,OAAO,SAAS,CAAC;AACnB,CAAC;AAOD;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,6BAA6B;QAC3D,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACxC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,iCAAiC;QAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,8BAA8B;QACrE,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM;QACxD,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAC1C,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5E,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC","sourcesContent":["/**\n * Minimal, hand-rolled DER/X.509 parsing to extract a certificate's SIGNATURE\n * algorithm — i.e. the algorithm the issuing CA used to sign it. `node:tls`\n * exposes the leaf's public-key type but not how it was signed, and the signature\n * is the forgeable-at-Q-day part, so we read it from the raw DER.\n *\n *   Certificate ::= SEQUENCE {\n *     tbsCertificate      SEQUENCE,           -- skipped\n *     signatureAlgorithm  AlgorithmIdentifier -- SEQUENCE { OID, params } -- read\n *     signatureValue      BIT STRING }\n *\n * Pure byte work over Buffers; unit-tested with crafted DER. No crypto performed.\n */\nimport type { AlgorithmFamily } from \"@quantakrypto/core\";\n\n/** A DER TLV header: tag, content offset, content length. */\ninterface Tlv {\n  tag: number;\n  contentStart: number;\n  contentEnd: number;\n  next: number;\n}\n\n/** Read one DER TLV header starting at `off`. Throws on truncation. */\nfunction readTlv(buf: Buffer, off: number): Tlv {\n  if (off + 2 > buf.length) throw new RangeError(\"truncated DER\");\n  const tag = buf[off];\n  let len = buf[off + 1];\n  let contentStart = off + 2;\n  if (len & 0x80) {\n    const n = len & 0x7f;\n    if (n === 0 || n > 4 || contentStart + n > buf.length) throw new RangeError(\"bad DER length\");\n    len = 0;\n    for (let i = 0; i < n; i++) len = (len << 8) | buf[contentStart + i];\n    contentStart += n;\n  }\n  const contentEnd = contentStart + len;\n  if (contentEnd > buf.length) throw new RangeError(\"DER length overruns buffer\");\n  return { tag, contentStart, contentEnd, next: contentEnd };\n}\n\n/** Decode a DER OID value (the bytes inside the OID TLV) to dotted-decimal. */\nexport function decodeOid(bytes: Buffer): string {\n  if (bytes.length === 0) return \"\";\n  const first = bytes[0];\n  const arcs = [Math.floor(first / 40), first % 40];\n  let value = 0;\n  for (let i = 1; i < bytes.length; i++) {\n    value = (value << 7) | (bytes[i] & 0x7f);\n    if ((bytes[i] & 0x80) === 0) {\n      arcs.push(value);\n      value = 0;\n    }\n  }\n  return arcs.join(\".\");\n}\n\n/** Map a signature-algorithm OID to a classical family (or undefined). */\nexport function oidToSignatureFamily(oid: string): AlgorithmFamily | undefined {\n  if (oid.startsWith(\"1.2.840.113549.1.1\")) return \"RSA\"; // PKCS#1 *WithRSAEncryption + RSASSA-PSS\n  if (oid.startsWith(\"1.2.840.10045.4\")) return \"ECDSA\"; // ecdsa-with-SHA*\n  if (oid === \"1.3.101.112\" || oid === \"1.3.101.113\") return \"EdDSA\"; // Ed25519 / Ed448\n  if (oid.startsWith(\"1.2.840.10040.4.3\")) return \"DSA\"; // dsa-with-sha1\n  return undefined;\n}\n\nexport interface CertSignature {\n  oid: string;\n  family?: AlgorithmFamily;\n}\n\n/**\n * Extract the signatureAlgorithm OID (and mapped family) from a DER certificate.\n * Returns undefined if the DER can't be parsed.\n */\nexport function certSignatureAlgorithm(der: Buffer): CertSignature | undefined {\n  try {\n    const cert = readTlv(der, 0); // outer Certificate SEQUENCE\n    if (cert.tag !== 0x30) return undefined;\n    const tbs = readTlv(der, cert.contentStart); // tbsCertificate SEQUENCE (skip)\n    const sigAlg = readTlv(der, tbs.next); // signatureAlgorithm SEQUENCE\n    if (sigAlg.tag !== 0x30) return undefined;\n    const oidTlv = readTlv(der, sigAlg.contentStart); // OID\n    if (oidTlv.tag !== 0x06) return undefined;\n    const oid = decodeOid(der.subarray(oidTlv.contentStart, oidTlv.contentEnd));\n    return { oid, family: oidToSignatureFamily(oid) };\n  } catch {\n    return undefined;\n  }\n}\n"]}
+{"version":3,"file":"x509.js","sourceRoot":"","sources":["../src/x509.ts"],"names":[],"mappings":"AAuBA,uEAAuE;AACvE,SAAS,OAAO,CAAC,GAAW,EAAE,GAAW;IACvC,IAAI,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM;QAAE,MAAM,IAAI,UAAU,CAAC,eAAe,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACvB,IAAI,YAAY,GAAG,GAAG,GAAG,CAAC,CAAC;IAC3B,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;QACf,MAAM,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,YAAY,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM;YAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAC9F,GAAG,GAAG,CAAC,CAAC;QACR,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YAAE,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;QACrE,YAAY,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,MAAM,UAAU,GAAG,YAAY,GAAG,GAAG,CAAC;IACtC,IAAI,UAAU,GAAG,GAAG,CAAC,MAAM;QAAE,MAAM,IAAI,UAAU,CAAC,4BAA4B,CAAC,CAAC;IAChF,OAAO,EAAE,GAAG,EAAE,YAAY,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC7D,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,KAAK,GAAG,EAAE,CAAC,CAAC;IAClD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,KAAK,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjB,KAAK,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACxB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,GAAG,CAAC,UAAU,CAAC,oBAAoB,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,yCAAyC;IACjG,IAAI,GAAG,CAAC,UAAU,CAAC,iBAAiB,CAAC;QAAE,OAAO,OAAO,CAAC,CAAC,kBAAkB;IACzE,IAAI,GAAG,KAAK,aAAa,IAAI,GAAG,KAAK,aAAa;QAAE,OAAO,OAAO,CAAC,CAAC,kBAAkB;IACtF,IAAI,GAAG,CAAC,UAAU,CAAC,mBAAmB,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,gBAAgB;IACvE,OAAO,SAAS,CAAC;AACnB,CAAC;AAOD;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,6BAA6B;QAC3D,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACxC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,iCAAiC;QAC9E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,8BAA8B;QACrE,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM;QACxD,IAAI,MAAM,CAAC,GAAG,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAC1C,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5E,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC","sourcesContent":["/**\n * Minimal, hand-rolled DER/X.509 parsing to extract a certificate's SIGNATURE\n * algorithm — i.e. the algorithm the issuing CA used to sign it. `node:tls`\n * exposes the leaf's public-key type but not how it was signed, and the signature\n * is the forgeable-at-Q-day part, so we read it from the raw DER.\n *\n *   Certificate ::= SEQUENCE {\n *     tbsCertificate      SEQUENCE,           -- skipped\n *     signatureAlgorithm  AlgorithmIdentifier -- SEQUENCE { OID, params } -- read\n *     signatureValue      BIT STRING }\n *\n * Pure byte work over Buffers; unit-tested with crafted DER. No crypto performed.\n */\nimport type { AlgorithmFamily } from \"@quantakrypto/core\";\n\n/** A DER TLV header: tag, content offset, content length. */\ninterface Tlv {\n  tag: number;\n  contentStart: number;\n  contentEnd: number;\n  next: number;\n}\n\n/** Read one DER TLV header starting at `off`. Throws on truncation. */\nfunction readTlv(buf: Buffer, off: number): Tlv {\n  if (off + 2 > buf.length) throw new RangeError(\"truncated DER\");\n  const tag = buf[off];\n  let len = buf[off + 1];\n  let contentStart = off + 2;\n  if (len & 0x80) {\n    const n = len & 0x7f;\n    if (n === 0 || n > 4 || contentStart + n > buf.length) throw new RangeError(\"bad DER length\");\n    len = 0;\n    for (let i = 0; i < n; i++) len = (len << 8) | buf[contentStart + i];\n    contentStart += n;\n  }\n  const contentEnd = contentStart + len;\n  if (contentEnd > buf.length) throw new RangeError(\"DER length overruns buffer\");\n  return { tag, contentStart, contentEnd, next: contentEnd };\n}\n\n/** Decode a DER OID value (the bytes inside the OID TLV) to dotted-decimal. */\nexport function decodeOid(bytes: Buffer): string {\n  if (bytes.length === 0) return \"\";\n  const first = bytes[0];\n  const arcs = [Math.floor(first / 40), first % 40];\n  let value = 0;\n  for (let i = 1; i < bytes.length; i++) {\n    value = (value << 7) | (bytes[i] & 0x7f);\n    if ((bytes[i] & 0x80) === 0) {\n      arcs.push(value);\n      value = 0;\n    }\n  }\n  return arcs.join(\".\");\n}\n\n/** Map a signature-algorithm OID to a classical family (or undefined). */\nexport function oidToSignatureFamily(oid: string): AlgorithmFamily | undefined {\n  if (oid.startsWith(\"1.2.840.113549.1.1\")) return \"RSA\"; // PKCS#1 *WithRSAEncryption + RSASSA-PSS\n  if (oid.startsWith(\"1.2.840.10045.4\")) return \"ECDSA\"; // ecdsa-with-SHA*\n  if (oid === \"1.3.101.112\" || oid === \"1.3.101.113\") return \"EdDSA\"; // Ed25519 / Ed448\n  if (oid.startsWith(\"1.2.840.10040.4.3\")) return \"DSA\"; // dsa-with-sha1\n  return undefined;\n}\n\ninterface CertSignature {\n  oid: string;\n  family?: AlgorithmFamily;\n}\n\n/**\n * Extract the signatureAlgorithm OID (and mapped family) from a DER certificate.\n * Returns undefined if the DER can't be parsed.\n */\nexport function certSignatureAlgorithm(der: Buffer): CertSignature | undefined {\n  try {\n    const cert = readTlv(der, 0); // outer Certificate SEQUENCE\n    if (cert.tag !== 0x30) return undefined;\n    const tbs = readTlv(der, cert.contentStart); // tbsCertificate SEQUENCE (skip)\n    const sigAlg = readTlv(der, tbs.next); // signatureAlgorithm SEQUENCE\n    if (sigAlg.tag !== 0x30) return undefined;\n    const oidTlv = readTlv(der, sigAlg.contentStart); // OID\n    if (oidTlv.tag !== 0x06) return undefined;\n    const oid = decodeOid(der.subarray(oidTlv.contentStart, oidTlv.contentEnd));\n    return { oid, family: oidToSignatureFamily(oid) };\n  } catch {\n    return undefined;\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@quantakrypto/qprobe",
-  "version": "0.4.4",
+  "version": "0.6.0",
   "description": "qProbe — actively inspect live TLS/SSH endpoints you OWN for post-quantum readiness (hybrid KEX, classical certs). Gated behind an ownership attestation. Zero runtime dependencies.",
   "license": "Apache-2.0",
   "author": "Dandelion Labs <hello@dandelionlabs.io> (https://dandelionlabs.io)",
@@ -37,7 +37,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@quantakrypto/core": "0.4.4"
+    "@quantakrypto/core": "0.6.0"
   },
   "scripts": {
     "build": "tsc -b",