@vanaheimr/cose 0.9.0

package/dist/resolve.d.ts

@@ -0,0 +1,29 @@
+import type { CoseAlgorithm } from './algorithm.ts';
+import type { CoseHeaders } from './headers.ts';
+/** Either an answer, or the reason there is none. */
+export type Resolved<T> = {
+    readonly ok: true;
+    readonly value: T;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};
+/**
+ * Which algorithm to verify with.
+ *
+ * An algorithm stated in the *unprotected* bucket is not covered by the
+ * signature and can therefore be changed by anyone on the path. It is not
+ * silently trusted: the caller has to name the expected algorithm to accept
+ * it, deliberately, which is the difference between a verifier that resists an
+ * algorithm-substitution attack and one that documents that it does.
+ */
+export declare function resolveAlgorithm(protectedHeader: CoseHeaders, unprotectedHeader: CoseHeaders, expected: CoseAlgorithm | null, what: string): Resolved<CoseAlgorithm>;
+/**
+ * Which payload the signature is computed over: the one carried within the
+ * message, or the detached one supplied by the caller.
+ *
+ * Supplying both is rejected, because there would be no way to tell which of
+ * the two a verification result refers to.
+ */
+export declare function resolvePayload(carried: Uint8Array | null, detached: Uint8Array | null, what: string): Resolved<Uint8Array>;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../src/resolve.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAQ,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAU,cAAc,CAAC;AAGpD,qDAAqD;AACrD,MAAM,MAAM,QAAQ,CAAC,CAAC,IAChB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GACzC;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAGtD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,eAAe,EAAI,WAAW,EAC9B,iBAAiB,EAAE,WAAW,EAC9B,QAAQ,EAAW,aAAa,GAAG,IAAI,EACvC,IAAI,EAAe,MAAM,GAAG,QAAQ,CAAC,aAAa,CAAC,CA2BnF;AAGD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAG,UAAU,GAAG,IAAI,EAC3B,QAAQ,EAAE,UAAU,GAAG,IAAI,EAC3B,IAAI,EAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC,CAgBrE"}

package/dist/sign.d.ts

@@ -0,0 +1,82 @@
+import type { CborValue } from './cbor.ts';
+import type { Verification } from './errors.ts';
+import { CoseHeaders } from './headers.ts';
+import type { CoseKey } from './key.ts';
+import { CoseSignature } from './signature.ts';
+import type { Sign1Options, VerifyOptions } from './sign1.ts';
+/** The CBOR tag of a COSE_Sign message. */
+export declare const COSE_SIGN_TAG = 98;
+/** The context string of a COSE_Sign signature [RFC 9052, Section 4.4]. */
+export declare const SIGNATURE_CONTEXT = "Signature";
+export declare class CoseSign {
+    /** The serialized protected bucket of the body, exactly as signed. */
+    readonly protectedHeaderBytes: Uint8Array;
+    /** The protected header parameters of the body, which every signature covers. */
+    readonly protectedHeader: CoseHeaders;
+    /** The unprotected header parameters of the body, which none of them covers. */
+    readonly unprotectedHeader: CoseHeaders;
+    /** The signed payload, or null when it is detached. */
+    readonly payload: Uint8Array | null;
+    /** The signatures, in the order they travel. */
+    readonly signatures: readonly CoseSignature[];
+    /** Whether this message is wrapped within CBOR tag 98. */
+    readonly isTagged: boolean;
+    constructor(protectedHeaderBytes: Uint8Array, unprotectedHeader: CoseHeaders | null, payload: Uint8Array | null, signatures: readonly CoseSignature[], isTagged?: boolean);
+    /** Whether the payload is detached. */
+    get isDetached(): boolean;
+    /**
+     * The encoded Sig_structure of one signature of a COSE_Sign message
+     * [RFC 9052, Section 4.4]:
+     *
+     * <code>
+     * Sig_structure = [
+     *     context        : "Signature",
+     *     body_protected : empty_or_serialized_map,
+     *     sign_protected : empty_or_serialized_map,
+     *     external_aad   : bstr,
+     *     payload        : bstr
+     * ]
+     * </code>
+     */
+    static toBeSigned(bodyProtectedHeaderBytes: Uint8Array, signatureProtectedHeaderBytes: Uint8Array, payload: Uint8Array, externalAad?: Uint8Array | null): Uint8Array;
+    /** The encoded Sig_structure of one signature of this message. */
+    toBeSigned(signature: CoseSignature, options?: {
+        externalAad?: Uint8Array | null;
+        detachedPayload?: Uint8Array | null;
+    }): Uint8Array;
+    /**
+     * Sign a payload, producing a message with one signature.
+     *
+     * The body's protected bucket stays empty: what a signer has to say about
+     * its own signature — its algorithm, its key identifier — belongs to that
+     * signature rather than to the body every other signer shares.
+     */
+    static sign(payload: Uint8Array, key: CoseKey, options?: Sign1Options): CoseSign;
+    /**
+     * Return a copy of this message with one more signature.
+     *
+     * The existing signatures are untouched and stay valid, because no
+     * signature ever covers another.
+     */
+    addSignature(key: CoseKey, options?: Sign1Options & {
+        detachedPayload?: Uint8Array | null;
+    }): CoseSign;
+    /** Verify one signature of this message. */
+    verify(signature: CoseSignature, key: CoseKey, options?: VerifyOptions): Verification;
+    /**
+     * The first signature this key verifies, or null.
+     *
+     * Signatures are tried in wire order. A signature that states its
+     * algorithm in the unprotected bucket only still needs an expected
+     * algorithm to be accepted, here as everywhere else — which the key
+     * supplies when it carries one, and otherwise nobody does.
+     */
+    verifyAny(key: CoseKey, options?: VerifyOptions): CoseSignature | null;
+    /** Parse a COSE_Sign message, tagged or untagged. */
+    static parse(input: Uint8Array | CborValue): CoseSign;
+    /** A CBOR representation of this message. */
+    toCbor(): CborValue;
+    /** The CBOR encoding of this message. */
+    toBytes(): Uint8Array;
+}
+//# sourceMappingURL=sign.d.ts.map

package/dist/sign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../src/sign.ts"],"names":[],"mappings":"AAuCA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAyB,WAAW,CAAC;AAE9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAsB,aAAa,CAAC;AAEhE,OAAO,EAAE,WAAW,EACqB,MAAS,cAAc,CAAC;AACjE,OAAO,KAAK,EAAE,OAAO,EAAE,MAA2B,UAAU,CAAC;AAE7D,OAAO,EAAE,aAAa,EAAE,MAA0B,gBAAgB,CAAC;AAEnE,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAO,YAAY,CAAC;AAG/D,2CAA2C;AAC3C,eAAO,MAAM,aAAa,KAAK,CAAC;AAEhC,2EAA2E;AAC3E,eAAO,MAAM,iBAAiB,cAAc,CAAC;AAG7C,qBAAa,QAAQ;IAEjB,sEAAsE;IACtE,SAAgB,oBAAoB,EAAG,UAAU,CAAC;IAElD,iFAAiF;IACjF,SAAgB,eAAe,EAAQ,WAAW,CAAC;IAEnD,gFAAgF;IAChF,SAAgB,iBAAiB,EAAM,WAAW,CAAC;IAEnD,uDAAuD;IACvD,SAAgB,OAAO,EAAgB,UAAU,GAAG,IAAI,CAAC;IAEzD,gDAAgD;IAChD,SAAgB,UAAU,EAAa,SAAS,aAAa,EAAE,CAAC;IAEhE,0DAA0D;IAC1D,SAAgB,QAAQ,EAAe,OAAO,CAAC;gBAG5B,oBAAoB,EAAE,UAAU,EAChC,iBAAiB,EAAK,WAAW,GAAG,IAAI,EACxC,OAAO,EAAe,UAAU,GAAG,IAAI,EACvC,UAAU,EAAY,SAAS,aAAa,EAAE,EAC9C,QAAQ,UAAoB;IAe/C,uCAAuC;IACvC,IAAW,UAAU,IAAI,OAAO,CAE/B;IAGD;;;;;;;;;;;;;OAaG;WACW,UAAU,CAAC,wBAAwB,EAAO,UAAU,EACzC,6BAA6B,EAAE,UAAU,EACzC,OAAO,EAAwB,UAAU,EACzC,WAAW,GAAoB,UAAU,GAAG,IAAW,GAAG,UAAU;IAa7F,kEAAkE;IAC3D,UAAU,CAAC,SAAS,EAAE,aAAa,EACxB,OAAO,GAAE;QAAE,WAAW,CAAC,EAAM,UAAU,GAAG,IAAI,CAAC;QACpC,eAAe,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;KAAO,GAAG,UAAU;IAiBpF;;;;;;OAMG;WACW,IAAI,CAAC,OAAO,EAAE,UAAU,EACnB,GAAG,EAAM,OAAO,EAChB,OAAO,GAAE,YAAiB,GAAG,QAAQ;IAqBxD;;;;;OAKG;IACI,YAAY,CAAC,GAAG,EAAE,OAAO,EACZ,OAAO,GAAE,YAAY,GAAG;QACpB,eAAe,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;KAAO,GAAG,QAAQ;IAmB7E,4CAA4C;IACrC,MAAM,CAAC,SAAS,EAAE,aAAa,EACxB,GAAG,EAAQ,OAAO,EAClB,OAAO,GAAI,aAAkB,GAAG,YAAY;IA6C1D;;;;;;;OAOG;IACI,SAAS,CAAC,GAAG,EAAM,OAAO,EAChB,OAAO,GAAE,aAAkB,GAAG,aAAa,GAAG,IAAI;IAYnE,qDAAqD;WACvC,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ;IA8C5D,6CAA6C;IACtC,MAAM,IAAI,SAAS;IAc1B,yCAAyC;IAClC,OAAO,IAAI,UAAU;CAI/B"}

package/dist/sign1.d.ts

@@ -0,0 +1,273 @@
+import type { CoseAlgorithm } from './algorithm.ts';
+import type { CborValue } from './cbor.ts';
+import type { NotVerified, Verification } from './errors.ts';
+import { CoseHeaders } from './headers.ts';
+import type { CoseKey } from './key.ts';
+import { CoseSignature } from './signature.ts';
+import { CoseCertificateChain, CoseCertificateHash } from './x5chain.ts';
+import type { X509Certificate } from './x509.ts';
+/** The CBOR tag of a COSE_Sign1 message. */
+export declare const COSE_SIGN1_TAG = 18;
+/** The context string of a COSE_Sign1 signature [RFC 9052, Section 4.4]. */
+export declare const SIGNATURE_CONTEXT = "Signature1";
+/**
+ * The context string of a countersignature that also covers the signature it
+ * countersigns [RFC 9338, Section 3.3].
+ */
+export declare const COUNTERSIGNATURE_CONTEXT = "CounterSignatureV2";
+/** What a signer may choose beyond the payload and the key. */
+export interface Sign1Options {
+    /** A key identifier for the unprotected bucket, defaulting to the key's own. */
+    readonly keyIdentifier?: Uint8Array | null;
+    /** Data signed along with the payload without travelling in the message. */
+    readonly externalAad?: Uint8Array | null;
+    /** Whether to omit the payload from the message. */
+    readonly detachPayload?: boolean;
+    /** Whether to wrap the message within CBOR tag 18. Defaults to true. */
+    readonly tagged?: boolean;
+    /**
+     * Whether to rewrite a CBOR payload in the deterministic encoding of
+     * RFC 8949 Section 4.2.1 before signing it, so that a receiver who parses
+     * and re-serializes the record arrives at the very bytes the signature
+     * covers. Defaults to true. A payload that is not CBOR is signed as it is.
+     */
+    readonly canonicalizePayload?: boolean;
+}
+/** What a verifier may have to supply. */
+export interface VerifyOptions {
+    /** The data that was signed along with the payload. */
+    readonly externalAad?: Uint8Array | null;
+    /** The payload, when the message carries a detached one. */
+    readonly detachedPayload?: Uint8Array | null;
+    /**
+     * The algorithm the caller expects, required whenever the message states
+     * its algorithm within the unprotected bucket only.
+     */
+    readonly expectedAlgorithm?: CoseAlgorithm | null;
+    /**
+     * Header parameters the caller processes itself, and which a `crit`
+     * header parameter may therefore demand.
+     */
+    readonly alsoUnderstood?: readonly CborValue[];
+}
+/** What a verifier working from a certificate chain may supply beyond that. */
+export interface CertificateChainVerifyOptions extends VerifyOptions {
+    /**
+     * The instant to check the certificates' validity periods at, now by
+     * default. Worth passing whenever the answer has to be reproducible: an
+     * archived message re-checked years later is checked against the
+     * certificates of its own time, not of today.
+     */
+    readonly at?: Date;
+}
+/**
+ * The outcome of verifying against a certificate chain.
+ *
+ * A success names the certificate whose key verified, because "it verified" is
+ * only half of what the caller asked: the other half is *who*, and a chain
+ * exists precisely to answer that.
+ */
+export type CertificateChainVerification = {
+    readonly verified: true;
+    readonly signer: X509Certificate;
+} | NotVerified;
+export declare class CoseSign1 {
+    /**
+     * The serialized protected bucket, exactly as signed and as received: a
+     * zero-length byte string when there are no protected header parameters.
+     */
+    readonly protectedHeaderBytes: Uint8Array;
+    /** The protected header parameters, which the signature covers. */
+    readonly protectedHeader: CoseHeaders;
+    /**
+     * The unprotected header parameters, which the signature does not cover
+     * and which therefore must not be trusted after a successful verification.
+     */
+    readonly unprotectedHeader: CoseHeaders;
+    /** The signed payload, or null when it is detached. */
+    readonly payload: Uint8Array | null;
+    /** The signature: `r ‖ s`, each half zero-padded, never DER. */
+    readonly signature: Uint8Array;
+    /**
+     * Whether this message is wrapped within CBOR tag 18. The tag is not
+     * covered by the signature, but it is preserved so that a parsed message
+     * re-encodes to the very same bytes.
+     */
+    readonly isTagged: boolean;
+    constructor(protectedHeaderBytes: Uint8Array, unprotectedHeader: CoseHeaders | null, payload: Uint8Array | null, signature: Uint8Array, isTagged?: boolean);
+    /** Whether the payload is detached. */
+    get isDetached(): boolean;
+    /**
+     * The signature algorithm, taken from the protected bucket and only
+     * otherwise from the unprotected one.
+     */
+    get algorithm(): CoseAlgorithm | null;
+    /** The key identifier, protected bucket first. */
+    get keyIdentifier(): Uint8Array | null;
+    /**
+     * The encoded Sig_structure of a COSE_Sign1 message
+     * [RFC 9052, Section 4.4], which is the byte string an ECDSA signer
+     * actually signs:
+     *
+     * <code>
+     * Sig_structure = [
+     *     context      : "Signature1",
+     *     protected    : empty_or_serialized_map,
+     *     external_aad : bstr,
+     *     payload      : bstr
+     * ]
+     * </code>
+     *
+     * This is public on purpose. Whenever the signing key does not live in
+     * this process — a meter, a smart card, a hardware security module — this
+     * is the input to hand over.
+     */
+    static toBeSigned(protectedHeaderBytes: Uint8Array, payload: Uint8Array, externalAad?: Uint8Array | null): Uint8Array;
+    /** The encoded Sig_structure of this message. */
+    toBeSigned(options?: {
+        externalAad?: Uint8Array | null;
+        detachedPayload?: Uint8Array | null;
+    }): Uint8Array;
+    /**
+     * Sign a payload, placing the algorithm within the protected bucket and
+     * the key identifier within the unprotected one — the layout of the
+     * examples of RFC 9052 and of virtually every deployed COSE message.
+     */
+    static sign(payload: Uint8Array, key: CoseKey, options?: Sign1Options): CoseSign1;
+    /**
+     * Sign a payload with the algorithm taken from the application context
+     * rather than from the message: the protected bucket stays empty and only
+     * the key identifier travels.
+     *
+     * This is the leanest signed COSE message there is, and for a protocol
+     * that already agrees on its algorithm it is also the safest arrangement:
+     * an algorithm that is not in the message cannot be tampered with on the
+     * way, whereas one within the unprotected bucket can. The price is that
+     * agility becomes a property of the profile rather than of the message.
+     */
+    static signWithApplicationAlgorithm(payload: Uint8Array, key: CoseKey, options?: Sign1Options): CoseSign1;
+    /**
+     * Sign a payload with full control over both header buckets.
+     *
+     * The signature algorithm is taken from the protected bucket, because an
+     * algorithm that is not covered by the signature could be changed by
+     * anyone on the way.
+     */
+    static signWithHeaders(payload: Uint8Array, key: CoseKey, protectedHeader: CoseHeaders, unprotectedHeader?: CoseHeaders | null, options?: Sign1Options, applicationAlgorithm?: CoseAlgorithm | null): CoseSign1;
+    /**
+     * Verify the signature of this message.
+     *
+     * A failed verification is not an exception — it is the expected outcome
+     * of checking untrusted data — so the reason travels in the result.
+     */
+    verify(key: CoseKey, options?: VerifyOptions): Verification;
+    /**
+     * The certificate chain of this message, from either header bucket.
+     *
+     * A chain that travels in a message is untrusted input, and reading one
+     * says nothing at all about it — {@link verifyWithCertificateChain} has to
+     * walk it to an anchor first. Throws when the parameter is present but is
+     * not a `COSE_X509`, rather than pretending there is none.
+     */
+    get certificateChain(): CoseCertificateChain | null;
+    /**
+     * The certificate thumbprint of this message, from either header bucket.
+     *
+     * Throws when the parameter is present but is not a `COSE_CertHash`.
+     */
+    get certificateThumbprint(): CoseCertificateHash | null;
+    /**
+     * Verify this message against a certificate chain rather than against a
+     * public key somebody handed over: the chain travels within the message,
+     * is walked to one of the given trust anchors, and the key of its
+     * end-entity certificate is then the key the signature has to verify with.
+     *
+     * That last step is what turns a chain into an answer. A chain that
+     * validates beautifully says nothing whatsoever about the message it
+     * arrived with unless the key it ends in is the key that signed, so the
+     * two are never checked apart from one another here.
+     *
+     * The X.509 header parameters become understood *by this call* rather than
+     * by the library, which is why a `crit` demanding `x5chain` is accepted
+     * here and refused by {@link verify}: whoever verifies with a bare public
+     * key has not looked at any certificate and must not claim otherwise.
+     */
+    verifyWithCertificateChain(trustAnchors: readonly X509Certificate[], options?: CertificateChainVerifyOptions): CertificateChainVerification;
+    /**
+     * The countersignatures of this message [RFC 9338], which live in the
+     * unprotected bucket under label 11.
+     *
+     * A message carrying one holds it bare; a message carrying several holds
+     * an array of them. The two shapes are told apart by the kind of the first
+     * element, because a bare countersignature starts with its protected
+     * bucket, a byte string, whereas an array of them starts with an array.
+     */
+    get countersignatures(): readonly CoseSignature[];
+    /**
+     * The encoded Countersign_structure [RFC 9338, Section 3.3].
+     *
+     * Six elements rather than four, and the difference is not cosmetic. It
+     * names the body's protected bucket *and* the countersigner's, and its
+     * last element carries the signature being countersigned — which is what
+     * makes this "I vouch for that signature" rather than "I signed the same
+     * thing". The countersignature of RFC 8152 covered the payload but not the
+     * signature, so it never actually attested to having seen it.
+     *
+     * `other_fields` is an array holding the one signature, not a bare byte
+     * string.
+     */
+    static toBeCountersigned(bodyProtectedHeaderBytes: Uint8Array, countersignatureProtectedHeaderBytes: Uint8Array, payload: Uint8Array, signature: Uint8Array, externalAad?: Uint8Array | null): Uint8Array;
+    /** The encoded Countersign_structure of one countersignature of this message. */
+    toBeCountersigned(countersignature: CoseSignature, options?: {
+        externalAad?: Uint8Array | null;
+        detachedPayload?: Uint8Array | null;
+    }): Uint8Array;
+    /**
+     * Return a copy of this message with one more countersignature.
+     *
+     * Countersignatures live in the unprotected bucket, which no signature
+     * covers, so this leaves the body signature, the protected bucket and the
+     * payload byte-identical: the message stays valid for everybody, including
+     * readers that ignore label 11 entirely.
+     */
+    addCountersignature(key: CoseKey, options?: Sign1Options & {
+        detachedPayload?: Uint8Array | null;
+    }): CoseSign1;
+    /**
+     * Verify one countersignature of this message.
+     *
+     * This says nothing about whether the body signature itself is valid —
+     * that is a separate question with a separate key, and answering both at
+     * once would hide which of the two failed.
+     */
+    verifyCountersignature(countersignature: CoseSignature, key: CoseKey, options?: VerifyOptions): Verification;
+    /**
+     * Parse a COSE_Sign1 message.
+     *
+     * Both the tagged and the untagged form are accepted; which one it was is
+     * remembered, as the CBOR tag is not covered by the signature but is part
+     * of the bytes on the wire.
+     */
+    static parse(input: Uint8Array | CborValue): CoseSign1;
+    /** A CBOR representation of this message. */
+    toCbor(): CborValue;
+    /** The CBOR encoding of this message. */
+    toBytes(): Uint8Array;
+    /**
+     * A copy of this message without its payload, e.g. because the payload
+     * travels elsewhere.
+     *
+     * The signature stays valid: it never covered the message, only the
+     * Sig_structure.
+     */
+    detach(): CoseSign1;
+    /** A copy of this message carrying the given payload again. */
+    attach(payload: Uint8Array): CoseSign1;
+}
+/**
+ * The last step every verification shares: the arithmetic, and the two ways of
+ * failing that are not a wrong signature.
+ */
+declare function verifySignature(algorithm: CoseAlgorithm, key: CoseKey, toBeSigned: Uint8Array, signature: Uint8Array): Verification;
+export { verifySignature };
+//# sourceMappingURL=sign1.d.ts.map

package/dist/sign1.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign1.d.ts","sourceRoot":"","sources":["../src/sign1.ts"],"names":[],"mappings":"AA8BA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAqB,gBAAgB,CAAC;AAGnE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAyB,WAAW,CAAC;AAE9D,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAS,aAAa,CAAC;AAChE,OAAO,EAAE,WAAW,EACqB,MAAS,cAAc,CAAC;AACjE,OAAO,KAAK,EAAE,OAAO,EAAE,MAA2B,UAAU,CAAC;AAI7D,OAAO,EAAE,aAAa,EAAE,MAA0B,gBAAgB,CAAC;AACnE,OAAO,EAAE,oBAAoB,EACpB,mBAAmB,EAAE,MAAoB,cAAc,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAmB,WAAW,CAAC;AAG9D,4CAA4C;AAC5C,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB,eAAe,CAAC;AAE9C;;;GAGG;AACH,eAAO,MAAM,wBAAwB,uBAAuB,CAAC;AAG7D,+DAA+D;AAC/D,MAAM,WAAW,YAAY;IAEzB,gFAAgF;IAChF,QAAQ,CAAC,aAAa,CAAC,EAAG,UAAU,GAAG,IAAI,CAAC;IAE5C,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAK,UAAU,GAAG,IAAI,CAAC;IAE5C,oDAAoD;IACpD,QAAQ,CAAC,aAAa,CAAC,EAAG,OAAO,CAAC;IAElC,wEAAwE;IACxE,QAAQ,CAAC,MAAM,CAAC,EAAU,OAAO,CAAC;IAElC;;;;;OAKG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAG,OAAO,CAAC;CAE3C;AAGD,0CAA0C;AAC1C,MAAM,WAAW,aAAa;IAE1B,uDAAuD;IACvD,QAAQ,CAAC,WAAW,CAAC,EAAS,UAAU,GAAG,IAAI,CAAC;IAEhD,4DAA4D;IAC5D,QAAQ,CAAC,eAAe,CAAC,EAAK,UAAU,GAAG,IAAI,CAAC;IAEhD;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAG,aAAa,GAAG,IAAI,CAAC;IAEnD;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAM,SAAS,SAAS,EAAE,CAAC;CAEtD;AAGD,+EAA+E;AAC/E,MAAM,WAAW,6BAA8B,SAAQ,aAAa;IAEhE;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAG,IAAI,CAAC;CAEvB;AAGD;;;;;;GAMG;AACH,MAAM,MAAM,4BAA4B,GAClC;IAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;CAAE,GAC7D,WAAW,CAAC;AAGlB,qBAAa,SAAS;IAElB;;;OAGG;IACH,SAAgB,oBAAoB,EAAG,UAAU,CAAC;IAElD,mEAAmE;IACnE,SAAgB,eAAe,EAAQ,WAAW,CAAC;IAEnD;;;OAGG;IACH,SAAgB,iBAAiB,EAAM,WAAW,CAAC;IAEnD,uDAAuD;IACvD,SAAgB,OAAO,EAAgB,UAAU,GAAG,IAAI,CAAC;IAEzD,gEAAgE;IAChE,SAAgB,SAAS,EAAc,UAAU,CAAC;IAElD;;;;OAIG;IACH,SAAgB,QAAQ,EAAe,OAAO,CAAC;gBAG5B,oBAAoB,EAAE,UAAU,EAChC,iBAAiB,EAAK,WAAW,GAAG,IAAI,EACxC,OAAO,EAAe,UAAU,GAAG,IAAI,EACvC,SAAS,EAAa,UAAU,EAChC,QAAQ,UAAoB;IAY/C,uCAAuC;IACvC,IAAW,UAAU,IAAI,OAAO,CAE/B;IAED;;;OAGG;IACH,IAAW,SAAS,IAAI,aAAa,GAAG,IAAI,CAE3C;IAED,kDAAkD;IAClD,IAAW,aAAa,IAAI,UAAU,GAAG,IAAI,CAE5C;IAKD;;;;;;;;;;;;;;;;;OAiBG;WACW,UAAU,CAAC,oBAAoB,EAAE,UAAU,EAChC,OAAO,EAAe,UAAU,EAChC,WAAW,GAAW,UAAU,GAAG,IAAW,GAAG,UAAU;IAYpF,iDAAiD;IAC1C,UAAU,CAAC,OAAO,GAAE;QAAE,WAAW,CAAC,EAAM,UAAU,GAAG,IAAI,CAAC;QACpC,eAAe,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;KAAO,GAAG,UAAU;IAgBpF;;;;OAIG;WACW,IAAI,CAAC,OAAO,EAAE,UAAU,EACnB,GAAG,EAAM,OAAO,EAChB,OAAO,GAAE,YAAiB,GAAG,SAAS;IAsBzD;;;;;;;;;;OAUG;WACW,4BAA4B,CAAC,OAAO,EAAE,UAAU,EACnB,GAAG,EAAM,OAAO,EAChB,OAAO,GAAE,YAAiB,GAAG,SAAS;IAuBjF;;;;;;OAMG;WACW,eAAe,CAAC,OAAO,EAAgB,UAAU,EACjC,GAAG,EAAoB,OAAO,EAC9B,eAAe,EAAQ,WAAW,EAClC,iBAAiB,GAAM,WAAW,GAAG,IAAW,EAChD,OAAO,GAAgB,YAAuB,EAC9C,oBAAoB,GAAG,aAAa,GAAG,IAAW,GAAG,SAAS;IAyC5F;;;;;OAKG;IACI,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,GAAE,aAAkB,GAAG,YAAY;IAoCtE;;;;;;;OAOG;IACH,IAAW,gBAAgB,IAAI,oBAAoB,GAAG,IAAI,CAUzD;IAGD;;;;OAIG;IACH,IAAW,qBAAqB,IAAI,mBAAmB,GAAG,IAAI,CAU7D;IAGD;;;;;;;;;;;;;;;OAeG;IACI,0BAA0B,CAAC,YAAY,EAAE,SAAS,eAAe,EAAE,EACxC,OAAO,GAAO,6BAAkC,GAAG,4BAA4B;IAyDjH;;;;;;;;OAQG;IACH,IAAW,iBAAiB,IAAI,SAAS,aAAa,EAAE,CAevD;IAGD;;;;;;;;;;;;OAYG;WACW,iBAAiB,CAAC,wBAAwB,EAAc,UAAU,EAChD,oCAAoC,EAAE,UAAU,EAChD,OAAO,EAA+B,UAAU,EAChD,SAAS,EAA6B,UAAU,EAChD,WAAW,GAA2B,UAAU,GAAG,IAAW,GAAG,UAAU;IAc3G,iFAAiF;IAC1E,iBAAiB,CAAC,gBAAgB,EAAE,aAAa,EAC/B,OAAO,GAAE;QAAE,WAAW,CAAC,EAAM,UAAU,GAAG,IAAI,CAAC;QACpC,eAAe,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;KAAO,GAAG,UAAU;IAkB3F;;;;;;;OAOG;IACI,mBAAmB,CAAC,GAAG,EAAE,OAAO,EACZ,OAAO,GAAE,YAAY,GAAG;QACpB,eAAe,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;KAAO,GAAG,SAAS;IAkDrF;;;;;;OAMG;IACI,sBAAsB,CAAC,gBAAgB,EAAE,aAAa,EAC/B,GAAG,EAAe,OAAO,EACzB,OAAO,GAAW,aAAkB,GAAG,YAAY;IAsCjF;;;;;;OAMG;WACW,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS;IA8C7D,6CAA6C;IACtC,MAAM,IAAI,SAAS;IAc1B,yCAAyC;IAClC,OAAO,IAAI,UAAU;IAK5B;;;;;;OAMG;IACI,MAAM,IAAI,SAAS;IAM1B,+DAA+D;IACxD,MAAM,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS;CAUhD;AAGD;;;GAGG;AACH,iBAAS,eAAe,CAAC,SAAS,EAAG,aAAa,EACzB,GAAG,EAAS,OAAO,EACnB,UAAU,EAAE,UAAU,EACtB,SAAS,EAAG,UAAU,GAAG,YAAY,CAoB7D;AAGD,OAAO,EAAE,eAAe,EAAE,CAAC"}

package/dist/signature.d.ts

@@ -0,0 +1,43 @@
+/**
+ * One signature of a multi-signer message [RFC 9052, Section 4.1], and the
+ * very same structure once more as a countersignature [RFC 9338].
+ *
+ * <code>
+ * COSE_Signature = [
+ *     protected   : bstr .cbor header_map,
+ *     unprotected : header_map,
+ *     signature   : bstr
+ * ]
+ * </code>
+ *
+ * It carries header buckets of its own, which is what lets every party sign
+ * with its own algorithm and its own key.
+ */
+import type { CoseAlgorithm } from './algorithm.ts';
+import type { CborValue } from './cbor.ts';
+import { CoseHeaders } from './headers.ts';
+export declare class CoseSignature {
+    /** The serialized protected bucket, exactly as signed and as received. */
+    readonly protectedHeaderBytes: Uint8Array;
+    /** The protected header parameters, which this signature covers. */
+    readonly protectedHeader: CoseHeaders;
+    /** The unprotected header parameters, which it does not. */
+    readonly unprotectedHeader: CoseHeaders;
+    /** The signature: `r ‖ s`, never DER. */
+    readonly signature: Uint8Array;
+    constructor(protectedHeaderBytes: Uint8Array, unprotectedHeader: CoseHeaders | null, signature: Uint8Array);
+    /**
+     * The signature algorithm, taken from the protected bucket and only
+     * otherwise from the unprotected one.
+     */
+    get algorithm(): CoseAlgorithm | null;
+    /** The key identifier, protected bucket first. */
+    get keyIdentifier(): Uint8Array | null;
+    /** Parse a three-element COSE_Signature. */
+    static parse(value: CborValue): CoseSignature;
+    /** A CBOR representation of this signature. */
+    toCbor(): CborValue;
+    /** The CBOR encoding of this signature. */
+    toBytes(): Uint8Array;
+}
+//# sourceMappingURL=signature.d.ts.map

package/dist/signature.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signature.d.ts","sourceRoot":"","sources":["../src/signature.ts"],"names":[],"mappings":"AAMA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAa,gBAAgB,CAAC;AAE3D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAiB,WAAW,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAE,MAAoB,cAAc,CAAC;AAGzD,qBAAa,aAAa;IAEtB,0EAA0E;IAC1E,SAAgB,oBAAoB,EAAG,UAAU,CAAC;IAElD,oEAAoE;IACpE,SAAgB,eAAe,EAAQ,WAAW,CAAC;IAEnD,4DAA4D;IAC5D,SAAgB,iBAAiB,EAAM,WAAW,CAAC;IAEnD,yCAAyC;IACzC,SAAgB,SAAS,EAAc,UAAU,CAAC;gBAG/B,oBAAoB,EAAE,UAAU,EAChC,iBAAiB,EAAK,WAAW,GAAG,IAAI,EACxC,SAAS,EAAa,UAAU;IAUnD;;;OAGG;IACH,IAAW,SAAS,IAAI,aAAa,GAAG,IAAI,CAE3C;IAED,kDAAkD;IAClD,IAAW,aAAa,IAAI,UAAU,GAAG,IAAI,CAE5C;IAGD,4CAA4C;WAC9B,KAAK,CAAC,KAAK,EAAE,SAAS,GAAG,aAAa;IA0BpD,+CAA+C;IACxC,MAAM,IAAI,SAAS;IAW1B,2CAA2C;IACpC,OAAO,IAAI,UAAU;CAI/B"}

package/dist/x509.d.ts

@@ -0,0 +1,144 @@
+import type { Asn1Node } from './asn1.ts';
+import type { CoseAlgorithm } from './algorithm.ts';
+import type { CoseCurve } from './curve.ts';
+import type { DigestAlgorithm } from './ecdsa.ts';
+import type { Verification } from './errors.ts';
+import { CoseKey } from './key.ts';
+/** One attribute of a distinguished name. */
+export interface NameAttribute {
+    /** The attribute type, in dotted decimal. */
+    readonly oid: string;
+    /** The attribute value, as text. */
+    readonly value: string;
+}
+/**
+ * A distinguished name.
+ *
+ * Two names are compared the way RFC 5280 Section 7.1 asks for rather than by
+ * their encodings: a `PrintableString` and a `UTF8String` holding the same
+ * characters name the same entity, and a chain whose issuer field was written
+ * in one and whose subject field was written in the other is a chain, not a
+ * forgery. Byte equality is still tried first, because it is both cheaper and
+ * the case that almost always applies.
+ */
+export declare class X509Name {
+    /** The attributes, outermost relative name first, as they were encoded. */
+    readonly attributes: readonly NameAttribute[];
+    /** The DER encoding, kept because a name is also compared by its bytes. */
+    readonly encoded: Uint8Array;
+    constructor(attributes: readonly NameAttribute[], encoded: Uint8Array);
+    /** Parse an X.501 `Name`, which is a `SEQUENCE OF SET OF` attributes. */
+    static parse(node: Asn1Node, what: string): X509Name;
+    /**
+     * Whether this name and the given one name the same entity.
+     *
+     * The normalization is the practical part of RFC 4518: leading and
+     * trailing whitespace removed, internal runs collapsed to one space, and
+     * case folded. Not implemented, because no certificate in this project's
+     * world uses them: the Unicode mapping and prohibition tables.
+     */
+    equivalentTo(other: X509Name): boolean;
+    /** The name in the usual `CN=…,O=…` notation. */
+    toString(): string;
+}
+/** The `basicConstraints` extension [RFC 5280, Section 4.2.1.9]. */
+export interface BasicConstraints {
+    /** Whether the certified key may sign other certificates. */
+    readonly certificateAuthority: boolean;
+    /** How many intermediates may follow, when the extension says. */
+    readonly pathLength: number | null;
+}
+/**
+ * The bits of the `keyUsage` extension [RFC 5280, Section 4.2.1.3], by name.
+ *
+ * The order is the ASN.1 one and it is load bearing: `digitalSignature` is bit
+ * zero and `keyCertSign` bit five, and those two are the only ones a signature
+ * with a certificate chain turns on.
+ */
+export declare const KeyUsage: {
+    readonly digitalSignature: 0;
+    readonly nonRepudiation: 1;
+    readonly keyEncipherment: 2;
+    readonly dataEncipherment: 3;
+    readonly keyAgreement: 4;
+    readonly keyCertSign: 5;
+    readonly cRLSign: 6;
+    readonly encipherOnly: 7;
+    readonly decipherOnly: 8;
+};
+/**
+ * An X.509 certificate.
+ *
+ * Everything here is what the certificate *says*. None of it is a reason to
+ * believe any of it: that comes from a chain to an anchor, which is
+ * `CoseCertificateChain`'s business.
+ */
+export declare class X509Certificate {
+    /** The DER encoding, exactly as it arrived. */
+    readonly encoded: Uint8Array;
+    /** The `tbsCertificate`, which is the part the signature covers. */
+    readonly tbsBytes: Uint8Array;
+    /** The version, 1 to 3. */
+    readonly version: number;
+    /** The serial number, which may be negative and is often very large. */
+    readonly serialNumber: bigint;
+    /** Who issued this certificate. */
+    readonly issuer: X509Name;
+    /** Whom it was issued to. */
+    readonly subject: X509Name;
+    /** The start of the validity period, inclusive. */
+    readonly notBefore: Date;
+    /** The end of the validity period, inclusive. */
+    readonly notAfter: Date;
+    /** The certified public key. */
+    readonly publicKey: CoseKey;
+    /** How this certificate was signed, as the COSE algorithm it corresponds to. */
+    readonly signatureAlgorithm: CoseAlgorithm;
+    /** The signature, as it was encoded — DER for ECDSA, raw otherwise. */
+    readonly signatureValue: Uint8Array;
+    /** The `basicConstraints` extension, when present. */
+    readonly basicConstraints: BasicConstraints | null;
+    /** The `keyUsage` extension as a bit array, when present. */
+    readonly keyUsage: readonly boolean[] | null;
+    /** The object identifiers of every extension marked critical. */
+    readonly criticalExtensions: readonly string[];
+    private constructor();
+    /**
+     * Parse a DER encoded certificate.
+     *
+     * The `signatureAlgorithm` of the outer structure and the `signature`
+     * field inside the `tbsCertificate` must agree, and it is checked: they
+     * are the same statement written twice, and an implementation that reads
+     * one while verifying with the other can be told two different things at
+     * once.
+     */
+    static parse(der: Uint8Array): X509Certificate;
+    /** Whether this certificate is within its validity period at the given instant. */
+    isValidAt(at: Date): Verification;
+    /** Whether the given key usage bit is set, an absent extension meaning unrestricted. */
+    allows(usage: number): boolean;
+    /** Whether the certified key may sign other certificates. */
+    get isCertificateAuthority(): boolean;
+    /**
+     * Whether this certificate was signed by the given one.
+     *
+     * Both halves are checked and neither implies the other: the issuer field
+     * has to name the candidate's subject, and the signature has to verify
+     * with the candidate's key. A name that matches without a signature is a
+     * claim, and a signature that verifies under a different name is somebody
+     * else's certificate.
+     */
+    verifySignedBy(issuer: X509Certificate): Verification;
+    /** The hash of this certificate's DER encoding, which is what `x5t` carries. */
+    thumbprint(hash?: DigestAlgorithm): Uint8Array;
+    /** Whether this is byte for byte the same certificate as the given one. */
+    equals(other: X509Certificate): boolean;
+    toString(): string;
+}
+/** The COSE algorithm a certificate signature identifier corresponds to. */
+export declare const signatureAlgorithmByOid: (oid: string) => CoseAlgorithm | null;
+/** The curve a `SubjectPublicKeyInfo` identifier names. */
+export declare const curveByOid: (oid: string) => CoseCurve | null;
+/** The object identifier of a curve, which is the inverse of {@link curveByOid}. */
+export declare function oidOfCurve(curve: CoseCurve): string | null;
+//# sourceMappingURL=x509.d.ts.map

package/dist/x509.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x509.d.ts","sourceRoot":"","sources":["../src/x509.ts"],"names":[],"mappings":"AAoCA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAuB,WAAW,CAAC;AAE3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAkB,gBAAgB,CAAC;AAEhE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAsB,YAAY,CAAC;AAE5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAgB,YAAY,CAAC;AAG5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAmB,aAAa,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAA6B,UAAU,CAAC;AAyE1D,6CAA6C;AAC7C,MAAM,WAAW,aAAa;IAE1B,6CAA6C;IAC7C,QAAQ,CAAC,GAAG,EAAK,MAAM,CAAC;IAExB,oCAAoC;IACpC,QAAQ,CAAC,KAAK,EAAG,MAAM,CAAC;CAE3B;AAGD;;;;;;;;;GASG;AACH,qBAAa,QAAQ;IAEjB,2EAA2E;IAC3E,SAAgB,UAAU,EAAG,SAAS,aAAa,EAAE,CAAC;IAEtD,2EAA2E;IAC3E,SAAgB,OAAO,EAAM,UAAU,CAAC;gBAGrB,UAAU,EAAE,SAAS,aAAa,EAAE,EAAE,OAAO,EAAE,UAAU;IAM5E,yEAAyE;WAC3D,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ;IA6B3D;;;;;;;OAOG;IACI,YAAY,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO;IAe7C,iDAAiD;IAC1C,QAAQ,IAAI,MAAM;CAQ5B;AAaD,oEAAoE;AACpE,MAAM,WAAW,gBAAgB;IAE7B,6DAA6D;IAC7D,QAAQ,CAAC,oBAAoB,EAAG,OAAO,CAAC;IAExC,kEAAkE;IAClE,QAAQ,CAAC,UAAU,EAAa,MAAM,GAAG,IAAI,CAAC;CAEjD;AAGD;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ;;;;;;;;;;CAUX,CAAC;AAKX;;;;;;GAMG;AACH,qBAAa,eAAe;IAExB,+CAA+C;IAC/C,SAAgB,OAAO,EAAW,UAAU,CAAC;IAE7C,oEAAoE;IACpE,SAAgB,QAAQ,EAAU,UAAU,CAAC;IAE7C,2BAA2B;IAC3B,SAAgB,OAAO,EAAW,MAAM,CAAC;IAEzC,wEAAwE;IACxE,SAAgB,YAAY,EAAM,MAAM,CAAC;IAEzC,mCAAmC;IACnC,SAAgB,MAAM,EAAY,QAAQ,CAAC;IAE3C,6BAA6B;IAC7B,SAAgB,OAAO,EAAW,QAAQ,CAAC;IAE3C,mDAAmD;IACnD,SAAgB,SAAS,EAAS,IAAI,CAAC;IAEvC,iDAAiD;IACjD,SAAgB,QAAQ,EAAU,IAAI,CAAC;IAEvC,gCAAgC;IAChC,SAAgB,SAAS,EAAS,OAAO,CAAC;IAE1C,gFAAgF;IAChF,SAAgB,kBAAkB,EAAE,aAAa,CAAC;IAElD,uEAAuE;IACvE,SAAgB,cAAc,EAAI,UAAU,CAAC;IAE7C,sDAAsD;IACtD,SAAgB,gBAAgB,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAE1D,6DAA6D;IAC7D,SAAgB,QAAQ,EAAU,SAAS,OAAO,EAAE,GAAG,IAAI,CAAC;IAE5D,iEAAiE;IACjE,SAAgB,kBAAkB,EAAE,SAAS,MAAM,EAAE,CAAC;IAGtD,OAAO;IAmCP;;;;;;;;OAQG;WACW,KAAK,CAAC,GAAG,EAAE,UAAU,GAAG,eAAe;IAwFrD,mFAAmF;IAC5E,SAAS,CAAC,EAAE,EAAE,IAAI,GAAG,YAAY;IAaxC,wFAAwF;IACjF,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAUrC,6DAA6D;IAC7D,IAAW,sBAAsB,IAAI,OAAO,CAI3C;IAGD;;;;;;;;OAQG;IACI,cAAc,CAAC,MAAM,EAAE,eAAe,GAAG,YAAY;IAsC5D,gFAAgF;IACzE,UAAU,CAAC,IAAI,GAAE,eAA0B,GAAG,UAAU;IAK/D,2EAA2E;IACpE,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO;IAKvC,QAAQ,IAAI,MAAM;CAI5B;AA+QD,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB,GAAI,KAAK,MAAM,KAAG,aAAa,GAAG,IACvC,CAAC;AAGhC,2DAA2D;AAC3D,eAAO,MAAM,UAAU,GAAI,KAAK,MAAM,KAAG,SAAS,GAAG,IAC1B,CAAC;AAG5B,oFAAoF;AACpF,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,IAAI,CAS1D"}