@simplewebauthn/server 14.0.0 → 14.0.2

package/esm/authentication/verifyAuthenticationResponse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyAuthenticationResponse.d.ts","sourceRoot":"","sources":["../../src/authentication/verifyAuthenticationResponse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAC1B,eAAe,EACf,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAM3B,OAAO,KAAK,EAAE,4CAA4C,EAAE,MAAM,6CAA6C,CAAC;AAIhH;;GAEG;AACH,MAAM,MAAM,gCAAgC,GAAG,UAAU,CAAC,OAAO,4BAA4B,CAAC,CAAC,CAAC,CAAC,CAAC;AAElG;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE;IACP,QAAQ,EAAE,0BAA0B,CAAC;IACrC,iBAAiB,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAChC,UAAU,EAAE,kBAAkB,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,kBAAkB,CAAC,EAAE;QACnB,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;KAChD,CAAC;CACH,GACA,OAAO,CAAC,8BAA8B,CAAC,CAgQzC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,8BAA8B,GAAG;IAC3C,QAAQ,EAAE,OAAO,CAAC;IAClB,kBAAkB,EAAE;QAClB,YAAY,EAAE,eAAe,CAAC;QAC9B,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,OAAO,CAAC;QACtB,oBAAoB,EAAE,oBAAoB,CAAC;QAC3C,kBAAkB,EAAE,OAAO,CAAC;QAC5B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,6BAA6B,CAAC,EAAE,4CAA4C,CAAC;KAC9E,CAAC;CACH,CAAC"}
+{"version":3,"file":"verifyAuthenticationResponse.d.ts","sourceRoot":"","sources":["../../src/authentication/verifyAuthenticationResponse.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,0BAA0B,EAC1B,eAAe,EACf,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAM3B,OAAO,KAAK,EAAE,4CAA4C,EAAE,MAAM,6CAA6C,CAAC;AAQhH;;GAEG;AACH,MAAM,MAAM,gCAAgC,GAAG,UAAU,CAAC,OAAO,4BAA4B,CAAC,CAAC,CAAC,CAAC,CAAC;AAElG;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,4BAA4B,CAChD,OAAO,EAAE;IACP,QAAQ,EAAE,0BAA0B,CAAC;IACrC,iBAAiB,EAAE,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAClC,YAAY,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAChC,UAAU,EAAE,kBAAkB,CAAC;IAC/B,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACjC,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACtC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,kBAAkB,CAAC,EAAE;QACnB,gBAAgB,CAAC,EAAE,2BAA2B,CAAC;KAChD,CAAC;CACH,GACA,OAAO,CAAC,8BAA8B,CAAC,CA6QzC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,MAAM,8BAA8B,GAAG;IAC3C,QAAQ,EAAE,OAAO,CAAC;IAClB,kBAAkB,EAAE;QAClB,YAAY,EAAE,eAAe,CAAC;QAC9B,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,OAAO,CAAC;QACtB,oBAAoB,EAAE,oBAAoB,CAAC;QAC3C,kBAAkB,EAAE,OAAO,CAAC;QAC5B,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,MAAM,CAAC;QACb,6BAA6B,CAAC,EAAE,4CAA4C,CAAC;KAC9E,CAAC;CACH,CAAC"}

package/esm/authentication/verifyAuthenticationResponse.js

@@ -5,6 +5,10 @@ import { parseAuthenticatorData } from '../helpers/parseAuthenticatorData.js';
 import { parseBackupFlags } from '../helpers/parseBackupFlags.js';
 import { matchExpectedRPID } from '../helpers/matchExpectedRPID.js';
 import { isoBase64URL, isoUint8Array } from '../helpers/iso/index.js';
+import { decodeCredentialPublicKey } from '../helpers/decodeCredentialPublicKey.js';
+import { COSEKEYS, isPQCCOSEAlg } from '../helpers/cose.js';
+import { SettingsService } from '../services/settingsService.js';
+import { PQCNotSupportedError } from '../errors/index.js';
 /**
  * Verify that the user has legitimately completed the authentication process
  *
@@ -187,6 +191,14 @@ export async function verifyAuthenticationResponse(options) {
         // on the device without going through this site
         throw new Error(`Response counter value ${counter} was lower than expected ${credential.counter}`);
     }
+    const decodedPublicKey = decodeCredentialPublicKey(credential.publicKey);
+    const pubKeyAlg = decodedPublicKey.get(COSEKEYS.alg);
+    if (typeof pubKeyAlg !== 'number') {
+        throw new Error('Credential public key was missing numeric alg');
+    }
+    if (isPQCCOSEAlg(pubKeyAlg) && !SettingsService.runtimeSupportsPQC()) {
+        throw new PQCNotSupportedError(pubKeyAlg);
+    }
     const { credentialDeviceType, credentialBackedUp } = parseBackupFlags(flags);
     const toReturn = {
         verified: await verifySignature({

package/esm/errors/index.d.ts

@@ -0,0 +1,17 @@
+import type { COSEALG } from '../helpers/cose.js';
+/**
+ * Base error class that helps disambiguate SimpleWebAuthn library errors from other library errors
+ */
+export declare class SimpleWebAuthnError extends Error {
+    code: SimpleWebAuthnErrorCode;
+    constructor({ message, code, cause }: {
+        message: string;
+        code: SimpleWebAuthnErrorCode;
+        cause?: Error;
+    });
+}
+export declare class PQCNotSupportedError extends SimpleWebAuthnError {
+    constructor(alg: COSEALG);
+}
+export type SimpleWebAuthnErrorCode = 'RUNTIME_NO_PQC_SUPPORT' | 'CERTIFICATE_PATH_VERIFICATION_FAILED';
+//# sourceMappingURL=index.d.ts.map

package/esm/errors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/errors/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAGlD;;GAEG;AACH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,IAAI,EAAE,uBAAuB,CAAC;gBAElB,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QACpC,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,EAAE,uBAAuB,CAAC;QAC9B,KAAK,CAAC,EAAE,KAAK,CAAC;KACf;CAKF;AAED,qBAAa,oBAAqB,SAAQ,mBAAmB;gBAC/C,GAAG,EAAE,OAAO;CAKzB;AAED,MAAM,MAAM,uBAAuB,GAC/B,wBAAwB,GACxB,sCAAsC,CAAC"}

package/esm/errors/index.js

@@ -0,0 +1,24 @@
+import { mapCoseAlgToWebCryptoKeyAlgName } from '../helpers/iso/isoCrypto/mapCoseAlgToWebCryptoKeyAlgName.js';
+/**
+ * Base error class that helps disambiguate SimpleWebAuthn library errors from other library errors
+ */
+export class SimpleWebAuthnError extends Error {
+    constructor({ message, code, cause }) {
+        super(message, { cause });
+        Object.defineProperty(this, "code", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        this.name = 'SimpleWebAuthnError';
+        this.code = code;
+    }
+}
+export class PQCNotSupportedError extends SimpleWebAuthnError {
+    constructor(alg) {
+        const webCryptoAlg = mapCoseAlgToWebCryptoKeyAlgName(alg);
+        const message = `This runtime's WebCrypto.subtle does not support use of ${webCryptoAlg}`;
+        super({ message, code: 'RUNTIME_NO_PQC_SUPPORT' });
+    }
+}

package/esm/helpers/convertX509PublicKeyToCOSE.d.ts

@@ -1,4 +1,4 @@
-import { COSEPublicKey } from './cose.js';
+import { type COSEPublicKey } from './cose.js';
 import type { Uint8Array_ } from '../types/index.js';
 export declare function convertX509PublicKeyToCOSE(x509Certificate: Uint8Array_): COSEPublicKey;
 //# sourceMappingURL=convertX509PublicKeyToCOSE.d.ts.map

package/esm/helpers/convertX509PublicKeyToCOSE.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"convertX509PublicKeyToCOSE.d.ts","sourceRoot":"","sources":["../../src/helpers/convertX509PublicKeyToCOSE.ts"],"names":[],"mappings":"AAKA,OAAO,EAIL,aAAa,EAGd,MAAM,WAAW,CAAC;AAEnB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,wBAAgB,0BAA0B,CACxC,eAAe,EAAE,WAAW,GAC3B,aAAa,CA+Ff"}
+{"version":3,"file":"convertX509PublicKeyToCOSE.d.ts","sourceRoot":"","sources":["../../src/helpers/convertX509PublicKeyToCOSE.ts"],"names":[],"mappings":"AAMA,OAAO,EAKL,KAAK,aAAa,EAInB,MAAM,WAAW,CAAC;AAEnB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,wBAAgB,0BAA0B,CACxC,eAAe,EAAE,WAAW,GAC3B,aAAa,CAsGf"}

package/esm/helpers/convertX509PublicKeyToCOSE.js

@@ -1,8 +1,9 @@
 import { AsnParser } from '@peculiar/asn1-schema';
 import { Certificate } from '@peculiar/asn1-x509';
 import { ECParameters, id_ecPublicKey, id_secp256r1, id_secp384r1 } from '@peculiar/asn1-ecc';
+import { id_ml_dsa_44, id_ml_dsa_65, id_ml_dsa_87 } from '@peculiar/asn1-x509-post-quantum';
 import { id_rsaEncryption, RSAPublicKey } from '@peculiar/asn1-rsa';
-import { COSECRV, COSEKEYS, COSEKTY, } from './cose.js';
+import { COSEALG, COSECRV, COSEKEYS, COSEKTY, } from './cose.js';
 import { mapX509SignatureAlgToCOSEAlg } from './mapX509SignatureAlgToCOSEAlg.js';
 export function convertX509PublicKeyToCOSE(x509Certificate) {
     let cosePublicKey = new Map();
@@ -11,8 +12,7 @@ export function convertX509PublicKeyToCOSE(x509Certificate) {
      */
     const x509 = AsnParser.parse(x509Certificate, Certificate);
     const { tbsCertificate } = x509;
-    const { subjectPublicKeyInfo, signature: _tbsSignature } = tbsCertificate;
-    const signatureAlgorithm = _tbsSignature.algorithm;
+    const { subjectPublicKeyInfo } = tbsCertificate;
     const publicKeyAlgorithmID = subjectPublicKeyInfo.algorithm.algorithm;
     if (publicKeyAlgorithmID === id_ecPublicKey) {
         /**
@@ -22,12 +22,15 @@ export function convertX509PublicKeyToCOSE(x509Certificate) {
             throw new Error('Certificate public key was missing parameters (EC2)');
         }
         const ecParameters = AsnParser.parse(new Uint8Array(subjectPublicKeyInfo.algorithm.parameters), ECParameters);
-        let crv = -999;
+        let alg;
+        let crv;
         const { namedCurve } = ecParameters;
         if (namedCurve === id_secp256r1) {
+            alg = COSEALG.ES256;
             crv = COSECRV.P256;
         }
         else if (namedCurve === id_secp384r1) {
+            alg = COSEALG.ES384;
             crv = COSECRV.P384;
         }
         else {
@@ -48,7 +51,7 @@ export function convertX509PublicKeyToCOSE(x509Certificate) {
         }
         const coseEC2PubKey = new Map();
         coseEC2PubKey.set(COSEKEYS.kty, COSEKTY.EC2);
-        coseEC2PubKey.set(COSEKEYS.alg, mapX509SignatureAlgToCOSEAlg(signatureAlgorithm));
+        coseEC2PubKey.set(COSEKEYS.alg, alg);
         coseEC2PubKey.set(COSEKEYS.crv, crv);
         coseEC2PubKey.set(COSEKEYS.x, x);
         coseEC2PubKey.set(COSEKEYS.y, y);
@@ -61,11 +64,24 @@ export function convertX509PublicKeyToCOSE(x509Certificate) {
         const rsaPublicKey = AsnParser.parse(subjectPublicKeyInfo.subjectPublicKey, RSAPublicKey);
         const coseRSAPubKey = new Map();
         coseRSAPubKey.set(COSEKEYS.kty, COSEKTY.RSA);
-        coseRSAPubKey.set(COSEKEYS.alg, mapX509SignatureAlgToCOSEAlg(signatureAlgorithm));
+        /**
+         * The algorithm ID is too ambiguous to know what this alg should really be. But practically
+         * speaking `shaHashOverride` is always specified when verifying signatures with RSA public keys
+         * which ultimately overrides this sensible default. Using RS256 also gets the correct WebCrypto
+         * alg name later on in verifyRSA.ts
+         */
+        coseRSAPubKey.set(COSEKEYS.alg, COSEALG.RS256);
         coseRSAPubKey.set(COSEKEYS.n, new Uint8Array(rsaPublicKey.modulus));
         coseRSAPubKey.set(COSEKEYS.e, new Uint8Array(rsaPublicKey.publicExponent));
         cosePublicKey = coseRSAPubKey;
     }
+    else if ([id_ml_dsa_44, id_ml_dsa_65, id_ml_dsa_87].indexOf(publicKeyAlgorithmID) >= 0) {
+        const coseAKPPubKey = new Map();
+        coseAKPPubKey.set(COSEKEYS.kty, COSEKTY.AKP);
+        coseAKPPubKey.set(COSEKEYS.alg, mapX509SignatureAlgToCOSEAlg(publicKeyAlgorithmID));
+        coseAKPPubKey.set(COSEKEYS.pub, new Uint8Array(subjectPublicKeyInfo.subjectPublicKey));
+        cosePublicKey = coseAKPPubKey;
+    }
     else {
         throw new Error(`Certificate public key contained unexpected algorithm ID ${publicKeyAlgorithmID}`);
     }

package/esm/helpers/cose.d.ts

@@ -135,4 +135,5 @@ export declare enum COSEALG {
     RS1 = -65535
 }
 export declare function isCOSEAlg(alg: number | undefined): alg is COSEALG;
+export declare function isPQCCOSEAlg(alg: COSEALG): boolean;
 //# sourceMappingURL=cose.d.ts.map

package/esm/helpers/cose.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cose.d.ts","sourceRoot":"","sources":["../../src/helpers/cose.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;;;GAUG;AAEH;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAE1B,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,OAAO,GAAG,SAAS,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,OAAO,GAAG,SAAS,CAAC;IAE5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9C,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,MAAM,GAAG,SAAS,CAAC;IAC3C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAE9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,MAAM,GAAG,SAAS,CAAC;IAC3C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAC9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAE9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAC9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAE9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,WAAW,GAAG,SAAS,CAAC;IAEhD,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAClD,CAAC;AAEF;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;;;;GAKG;AACH,oBAAY,QAAQ;IAClB,GAAG,IAAI;IACP,GAAG,IAAI;IACP,GAAG,KAAK;IACR,CAAC,KAAK;IACN,CAAC,KAAK;IACN,CAAC,KAAK;IACN,CAAC,KAAK;IACN,GAAG,KAAK;CACT;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,GAAG,IAAI;IACP,GAAG,IAAI;IACP,GAAG,IAAI;IACP,GAAG,IAAI;CACR;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,CAEjE;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,IAAI,IAAI;IACR,IAAI,IAAI;IACR,IAAI,IAAI;IACR,OAAO,IAAI;IACX,SAAS,IAAI;CACd;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,CAEjE;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,KAAK,KAAK;IACV,KAAK,KAAK;IACV,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,MAAM,MAAM;IACZ,SAAS,MAAM;IACf,SAAS,MAAM;IACf,SAAS,MAAM;IACf,KAAK,OAAO;IACZ,KAAK,OAAO;IACZ,KAAK,OAAO;IACZ,GAAG,SAAS;CACb;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,CAEjE"}
+{"version":3,"file":"cose.d.ts","sourceRoot":"","sources":["../../src/helpers/cose.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD;;;;;;;;;;GAUG;AAEH;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG;IAE1B,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,OAAO,GAAG,SAAS,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,OAAO,GAAG,SAAS,CAAC;IAE5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;CAC9C,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,MAAM,GAAG,SAAS,CAAC;IAC3C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAE9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,MAAM,GAAG,SAAS,CAAC;IAC3C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAC9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAE9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAC9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,GAAG,WAAW,GAAG,SAAS,CAAC;IAE9C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;IAC/C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAChD,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,GAAG;IAE7C,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,GAAG,WAAW,GAAG,SAAS,CAAC;IAEhD,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,GAAG,IAAI,CAAC;CAClD,CAAC;AAEF;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,GAC3B,aAAa,IAAI,gBAAgB,CAGnC;AAED;;;;;GAKG;AACH,oBAAY,QAAQ;IAClB,GAAG,IAAI;IACP,GAAG,IAAI;IACP,GAAG,KAAK;IACR,CAAC,KAAK;IACN,CAAC,KAAK;IACN,CAAC,KAAK;IACN,CAAC,KAAK;IACN,GAAG,KAAK;CACT;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,GAAG,IAAI;IACP,GAAG,IAAI;IACP,GAAG,IAAI;IACP,GAAG,IAAI;CACR;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,CAEjE;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,IAAI,IAAI;IACR,IAAI,IAAI;IACR,IAAI,IAAI;IACR,OAAO,IAAI;IACX,SAAS,IAAI;CACd;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,CAEjE;AAED;;;;GAIG;AACH,oBAAY,OAAO;IACjB,KAAK,KAAK;IACV,KAAK,KAAK;IACV,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,KAAK,MAAM;IACX,MAAM,MAAM;IACZ,SAAS,MAAM;IACf,SAAS,MAAM;IACf,SAAS,MAAM;IACf,KAAK,OAAO;IACZ,KAAK,OAAO;IACZ,KAAK,OAAO;IACZ,GAAG,SAAS;CACb;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,IAAI,OAAO,CAEjE;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAElD"}

package/esm/helpers/cose.js

@@ -100,3 +100,6 @@ export var COSEALG;
 export function isCOSEAlg(alg) {
     return Object.values(COSEALG).indexOf(alg) >= 0;
 }
+export function isPQCCOSEAlg(alg) {
+    return [COSEALG.ML_DSA_44, COSEALG.ML_DSA_65, COSEALG.ML_DSA_87].indexOf(alg) >= 0;
+}

package/esm/helpers/isCertRevoked.d.ts

@@ -1,3 +1,4 @@
+import 'reflect-metadata';
 import { type X509Certificate } from '@peculiar/x509';
 /**
  * A method to pull a CRL from a certificate and compare its serial number to the list of revoked
@@ -5,5 +6,5 @@ import { type X509Certificate } from '@peculiar/x509';
  *
  * CRL certificate structure referenced from https://tools.ietf.org/html/rfc5280#page-117
  */
-export declare function isCertRevoked(cert: X509Certificate): Promise<boolean>;
+export declare function isCertRevoked(certificate: X509Certificate, issuer?: X509Certificate): Promise<boolean>;
 //# sourceMappingURL=isCertRevoked.d.ts.map

package/esm/helpers/isCertRevoked.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"isCertRevoked.d.ts","sourceRoot":"","sources":["../../src/helpers/isCertRevoked.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,eAAe,EAErB,MAAM,gBAAgB,CAAC;AAexB;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAkG3E"}
+{"version":3,"file":"isCertRevoked.d.ts","sourceRoot":"","sources":["../../src/helpers/isCertRevoked.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAC1B,OAAO,EAIL,KAAK,eAAe,EAErB,MAAM,gBAAgB,CAAC;AAexB;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,WAAW,EAAE,eAAe,EAC5B,MAAM,CAAC,EAAE,eAAe,GACvB,OAAO,CAAC,OAAO,CAAC,CA0HlB"}

package/esm/helpers/isCertRevoked.js

@@ -1,3 +1,4 @@
+import 'reflect-metadata';
 import { AuthorityKeyIdentifierExtension, CRLDistributionPointsExtension, SubjectKeyIdentifierExtension, X509Crl, } from '@peculiar/x509';
 import { fetch } from './fetch.js';
 const cacheRevokedCerts = {};
@@ -7,90 +8,110 @@ const cacheRevokedCerts = {};
  *
  * CRL certificate structure referenced from https://tools.ietf.org/html/rfc5280#page-117
  */
-export async function isCertRevoked(cert) {
-    const { extensions } = cert;
+export async function isCertRevoked(certificate, issuer) {
+    if (!issuer) {
+        // We don't have a public key to verify any CRL signature so don't bother continuing
+        return false;
+    }
+    const { extensions } = certificate;
     if (!extensions) {
         return false;
     }
-    let extAuthorityKeyID;
-    let extSubjectKeyID;
-    let extCRLDistributionPoints;
-    extensions.forEach((ext) => {
-        if (ext instanceof AuthorityKeyIdentifierExtension) {
-            extAuthorityKeyID = ext;
-        }
-        else if (ext instanceof SubjectKeyIdentifierExtension) {
-            extSubjectKeyID = ext;
-        }
-        else if (ext instanceof CRLDistributionPointsExtension) {
-            extCRLDistributionPoints = ext;
-        }
+    const extCRLDistributionPoints = extensions.find((ext) => ext instanceof CRLDistributionPointsExtension);
+    // Get all CRL URLs from within the certificate
+    const crlURLs = [];
+    extCRLDistributionPoints?.distributionPoints?.forEach((dPoint) => {
+        dPoint.distributionPoint?.fullName?.forEach((fullName) => {
+            if (fullName.uniformResourceIdentifier) {
+                crlURLs.push(fullName.uniformResourceIdentifier);
+            }
+        });
     });
-    // Check to see if we've got cached info for the cert's CA
-    let keyIdentifier = undefined;
-    if (extAuthorityKeyID && extAuthorityKeyID.keyId) {
-        keyIdentifier = extAuthorityKeyID.keyId;
+    // If no URL(s) is provided then we have nothing to check
+    if (!(crlURLs.length > 0)) {
+        return false;
     }
-    else if (extSubjectKeyID) {
-        /**
-         * We might be dealing with a self-signed root certificate. Check the
-         * Subject key Identifier extension next.
-         */
-        keyIdentifier = extSubjectKeyID.keyId;
+    // Get the issuer's key identifier for part of the cache key and to check against the
+    // certificate's and CRL's AuthorityKeyIdentifier extension
+    const { keyIdentifier: issuerKeyIdentifier, fromExtension: issuerKeyIdentifierFromExtension, } = await getIssuerKeyIdentifier(issuer);
+    const certificateExtAuthorityKeyID = certificate.extensions.find((ext) => ext instanceof AuthorityKeyIdentifierExtension);
+    // When present, assert that certificates's AuthorityKeyIdentifier mirrors
+    // the issuer's SubjectKeyIdentifier
+    if (issuerKeyIdentifierFromExtension &&
+        certificateExtAuthorityKeyID?.keyId &&
+        certificateExtAuthorityKeyID.keyId !== issuerKeyIdentifier) {
+        throw new Error(`Certificate's AuthorityKeyIdentifier did not match issuer's SubjectKeyIdentifier "${issuerKeyIdentifier}"`);
     }
-    if (keyIdentifier) {
-        const cached = cacheRevokedCerts[keyIdentifier];
+    for (const crlURL of crlURLs) {
+        // Key off of issuer public key and CRL URL in case multiple CRLs are specified
+        const cacheKey = `${issuerKeyIdentifier}|${crlURL}`;
+        const cached = cacheRevokedCerts[cacheKey];
         if (cached) {
             const now = new Date();
             // If there's a nextUpdate then make sure we're before it
             if (!cached.nextUpdate || cached.nextUpdate > now) {
-                return cached.revokedCerts.indexOf(cert.serialNumber) >= 0;
+                return cached.revokedCerts.indexOf(certificate.serialNumber) >= 0;
             }
         }
-    }
-    const crlURL = extCRLDistributionPoints?.distributionPoints?.[0].distributionPoint?.fullName?.[0]
-        .uniformResourceIdentifier;
-    // If no URL is provided then we have nothing to check
-    if (!crlURL) {
-        return false;
-    }
-    // Download and read the CRL
-    let certListBytes;
-    try {
-        const respCRL = await fetch(crlURL);
-        certListBytes = await respCRL.arrayBuffer();
-    }
-    catch (_err) {
-        return false;
-    }
-    let data;
-    try {
-        data = new X509Crl(certListBytes);
-    }
-    catch (_err) {
-        // Something was malformed with the CRL, so pass
-        return false;
-    }
-    const newCached = {
-        revokedCerts: [],
-        nextUpdate: undefined,
-    };
-    // nextUpdate
-    if (data.nextUpdate) {
-        newCached.nextUpdate = data.nextUpdate;
-    }
-    // revokedCertificates
-    const revokedCerts = data.entries;
-    if (revokedCerts) {
-        for (const cert of revokedCerts) {
-            const revokedHex = cert.serialNumber;
-            newCached.revokedCerts.push(revokedHex);
+        // Download and read the CRL
+        let crlBytes;
+        try {
+            const respCRL = await fetch(crlURL);
+            crlBytes = await respCRL.arrayBuffer();
+        }
+        catch (_err) {
+            // Some kind of network error occurred so try the next URL
+            continue;
+        }
+        let certCRL;
+        try {
+            certCRL = new X509Crl(crlBytes);
+        }
+        catch (_err) {
+            // Something was malformed with the CRL so try the next URL
+            continue;
+        }
+        const certCRLVerified = await certCRL.verify({ publicKey: issuer.publicKey });
+        if (!certCRLVerified) {
+            throw new Error(`CRL from ${crlURL} failed signature verification against issuer "${issuer.subject}"`);
         }
-        // Cache the results
-        if (keyIdentifier) {
-            cacheRevokedCerts[keyIdentifier] = newCached;
+        // When present, assert that the CRL's AuthorityKeyIdentifier mirrors
+        // the issuer's SubjectKeyIdentifier
+        const crlAKI = certCRL.getExtension(AuthorityKeyIdentifierExtension);
+        if (issuerKeyIdentifierFromExtension &&
+            crlAKI?.keyId &&
+            crlAKI.keyId !== issuerKeyIdentifier) {
+            throw new Error(`CRL from ${crlURL} contained an AuthorityKeyIdentifier that did not match issuer's SubjectKeyIdentifier "${issuerKeyIdentifier}"`);
+        }
+        // Cache the CRL only if a nextUpdate has been provided
+        if (certCRL.nextUpdate) {
+            cacheRevokedCerts[cacheKey] = {
+                revokedCerts: certCRL.entries.map((entry) => entry.serialNumber),
+                nextUpdate: certCRL.nextUpdate,
+            };
+        }
+        // Finally, check entries for revocation status
+        const revoked = certCRL.findRevoked(certificate);
+        if (revoked) {
+            return true;
         }
-        return newCached.revokedCerts.indexOf(cert.serialNumber) >= 0;
     }
     return false;
 }
+/**
+ * Determine a unique key ID for the issuer certificate, based either on its
+ * SubjectKeyIdentifierExtension or by generating the same value using the issuer's public key
+ */
+async function getIssuerKeyIdentifier(issuer) {
+    const issuerSKI = issuer.extensions?.find((ext) => ext instanceof SubjectKeyIdentifierExtension);
+    if (issuerSKI?.keyId) {
+        return { keyIdentifier: issuerSKI.keyId, fromExtension: true };
+    }
+    /**
+     * The issuer carries no SubjectKeyIdentifier extension, so derive one from its public key
+     * (RFC 5280, method 1). This is good enough to keep unrelated CAs from colliding when computing
+     * the revocation cache key, but it's not authoritative enough to reject a certificate over.
+     */
+    const computed = await SubjectKeyIdentifierExtension.create(issuer.publicKey);
+    return { keyIdentifier: computed.keyId, fromExtension: false };
+}

package/esm/helpers/iso/isoCrypto/verifyAKP.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyAKP.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyAKP.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,gBAAgB,EAAa,MAAM,eAAe,CAAC;AAK3E,OAAO,KAAK,EAAmB,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE5E,wBAAwB;AACxB,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;CACnB,GAAG,OAAO,CAAC,OAAO,CAAC,CAkDnB"}
+{"version":3,"file":"verifyAKP.d.ts","sourceRoot":"","sources":["../../../../src/helpers/iso/isoCrypto/verifyAKP.ts"],"names":[],"mappings":"AAAA,OAAO,EAAY,KAAK,gBAAgB,EAAa,MAAM,eAAe,CAAC;AAM3E,OAAO,KAAK,EAAmB,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE5E,wBAAwB;AACxB,wBAAsB,SAAS,CAAC,IAAI,EAAE;IACpC,aAAa,EAAE,gBAAgB,CAAC;IAChC,SAAS,EAAE,WAAW,CAAC;IACvB,IAAI,EAAE,WAAW,CAAC;CACnB,GAAG,OAAO,CAAC,OAAO,CAAC,CA+CnB"}

package/esm/helpers/iso/isoCrypto/verifyAKP.js

@@ -3,6 +3,7 @@ import { isoBase64URL } from '../../index.js';
 import { importJWKKey } from './importJWKKey.js';
 import { getWebCrypto } from './getWebCrypto.js';
 import { mapCoseAlgToWebCryptoKeyAlgName } from './mapCoseAlgToWebCryptoKeyAlgName.js';
+import { PQCNotSupportedError } from '../../../errors/index.js';
 /** AKP, a.k.a ML-DSA */
 export async function verifyAKP(opts) {
     const { cosePublicKey, signature, data } = opts;
@@ -37,7 +38,7 @@ export async function verifyAKP(opts) {
     catch (err) {
         const _err = err;
         if (_err.name === 'NotSupportedError') {
-            throw new Error(`This runtime's WebCrypto.subtle does not support use of ${webCryptoAlg}. See the \`cause\` property of this error for more info`, { cause: err });
+            throw new PQCNotSupportedError(alg);
         }
         else {
             throw err;

package/esm/helpers/mapX509SignatureAlgToCOSEAlg.d.ts

@@ -1,9 +1,6 @@
 import { COSEALG } from './cose.js';
 /**
  * Map X.509 signature algorithm OIDs to COSE algorithm IDs
- *
- * - EC2 OIDs: https://oidref.com/1.2.840.10045.4.3
- * - RSA OIDs: https://oidref.com/1.2.840.113549.1.1
  */
 export declare function mapX509SignatureAlgToCOSEAlg(signatureAlgorithm: string): COSEALG;
 //# sourceMappingURL=mapX509SignatureAlgToCOSEAlg.d.ts.map

package/esm/helpers/mapX509SignatureAlgToCOSEAlg.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mapX509SignatureAlgToCOSEAlg.d.ts","sourceRoot":"","sources":["../../src/helpers/mapX509SignatureAlgToCOSEAlg.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,kBAAkB,EAAE,MAAM,GACzB,OAAO,CAwBT"}
+{"version":3,"file":"mapX509SignatureAlgToCOSEAlg.d.ts","sourceRoot":"","sources":["../../src/helpers/mapX509SignatureAlgToCOSEAlg.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,kBAAkB,EAAE,MAAM,GACzB,OAAO,CA8BT"}

package/esm/helpers/mapX509SignatureAlgToCOSEAlg.js

@@ -1,33 +1,42 @@
+import { id_ecdsaWithSHA256, id_ecdsaWithSHA384, id_ecdsaWithSHA512 } from '@peculiar/asn1-ecc';
+import { id_sha1WithRSAEncryption, id_sha256WithRSAEncryption, id_sha384WithRSAEncryption, id_sha512WithRSAEncryption, } from '@peculiar/asn1-rsa';
+import { id_ml_dsa_44, id_ml_dsa_65, id_ml_dsa_87 } from '@peculiar/asn1-x509-post-quantum';
 import { COSEALG } from './cose.js';
 /**
  * Map X.509 signature algorithm OIDs to COSE algorithm IDs
- *
- * - EC2 OIDs: https://oidref.com/1.2.840.10045.4.3
- * - RSA OIDs: https://oidref.com/1.2.840.113549.1.1
  */
 export function mapX509SignatureAlgToCOSEAlg(signatureAlgorithm) {
     let alg;
-    if (signatureAlgorithm === '1.2.840.10045.4.3.2') {
+    if (signatureAlgorithm === id_ecdsaWithSHA256) {
         alg = COSEALG.ES256;
     }
-    else if (signatureAlgorithm === '1.2.840.10045.4.3.3') {
+    else if (signatureAlgorithm === id_ecdsaWithSHA384) {
         alg = COSEALG.ES384;
     }
-    else if (signatureAlgorithm === '1.2.840.10045.4.3.4') {
+    else if (signatureAlgorithm === id_ecdsaWithSHA512) {
         alg = COSEALG.ES512;
     }
-    else if (signatureAlgorithm === '1.2.840.113549.1.1.11') {
+    else if (signatureAlgorithm === id_sha256WithRSAEncryption) {
         alg = COSEALG.RS256;
     }
-    else if (signatureAlgorithm === '1.2.840.113549.1.1.12') {
+    else if (signatureAlgorithm === id_sha384WithRSAEncryption) {
         alg = COSEALG.RS384;
     }
-    else if (signatureAlgorithm === '1.2.840.113549.1.1.13') {
+    else if (signatureAlgorithm === id_sha512WithRSAEncryption) {
         alg = COSEALG.RS512;
     }
-    else if (signatureAlgorithm === '1.2.840.113549.1.1.5') {
+    else if (signatureAlgorithm === id_sha1WithRSAEncryption) {
         alg = COSEALG.RS1;
     }
+    else if (signatureAlgorithm === id_ml_dsa_44) {
+        alg = COSEALG.ML_DSA_44;
+    }
+    else if (signatureAlgorithm === id_ml_dsa_65) {
+        alg = COSEALG.ML_DSA_65;
+    }
+    else if (signatureAlgorithm === id_ml_dsa_87) {
+        alg = COSEALG.ML_DSA_87;
+    }
     else {
         throw new Error(`Unable to map X.509 signature algorithm ${signatureAlgorithm} to a COSE algorithm`);
     }

package/esm/helpers/validateCertificatePath.d.ts

@@ -1,3 +1,4 @@
+import 'reflect-metadata';
 /**
  * Traverse an array of PEM certificates and ensure they form a proper chain
  * @param x5cCertsPEM Typically the result of `x5c.map(convertASN1toPEM)`

package/esm/helpers/validateCertificatePath.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"validateCertificatePath.d.ts","sourceRoot":"","sources":["../../src/helpers/validateCertificatePath.ts"],"names":[],"mappings":"AAIA;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EAAE,EACrB,eAAe,GAAE,MAAM,EAAO,GAC7B,OAAO,CAAC,OAAO,CAAC,CAqIlB"}
+{"version":3,"file":"validateCertificatePath.d.ts","sourceRoot":"","sources":["../../src/helpers/validateCertificatePath.ts"],"names":[],"mappings":"AAAA,OAAO,kBAAkB,CAAC;AAM1B;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,MAAM,EAAE,EACrB,eAAe,GAAE,MAAM,EAAO,GAC7B,OAAO,CAAC,OAAO,CAAC,CAiLlB"}