@vanaheimr/cose 0.9.0

package/dist/x5chain.d.ts

@@ -0,0 +1,98 @@
+import type { CoseAlgorithm } from './algorithm.ts';
+import type { CborValue } from './cbor.ts';
+import type { Verification } from './errors.ts';
+import type { CoseKey } from './key.ts';
+import { X509Certificate } from './x509.ts';
+/** How a chain is to be validated. */
+export interface ChainValidationOptions {
+    /**
+     * The instant to check the validity periods at, now by default.
+     *
+     * Worth passing whenever the answer has to be reproducible — a conformance
+     * vector, an archived message, a signature being re-checked years later —
+     * because "now" makes the same input give different answers on different
+     * days.
+     */
+    readonly at?: Date;
+}
+/**
+ * A `COSE_X509` [RFC 9360, Section 2] — a chain of X.509 certificates.
+ *
+ * ```
+ * COSE_X509 = bstr / [ 2*certs: bstr ]
+ * ```
+ *
+ * A single certificate is a bare byte string; two or more form an array. The
+ * order is end-entity first, then whoever signed it, and so on. The trust
+ * anchor need not be present — the recipient is expected to have it already,
+ * which is what makes it an anchor.
+ *
+ * A chain proves nothing on its own. It becomes an answer only once
+ * {@link validate} has walked it to an anchor the recipient configured, and
+ * once the key of its end-entity certificate turns out to be the key that
+ * verified the signature — which is
+ * {@link CoseSign1.verifyWithCertificateChain}'s half of the job.
+ */
+export declare class CoseCertificateChain {
+    /** The certificates, end-entity first. */
+    readonly certificates: readonly X509Certificate[];
+    constructor(certificates: readonly X509Certificate[]);
+    /** The certificate holding the key that is expected to have signed. */
+    get endEntity(): X509Certificate;
+    /** The public key of the end-entity certificate. */
+    publicKey(): CoseKey;
+    /** Read a `COSE_X509` from its CBOR form. */
+    static fromCbor(value: CborValue): CoseCertificateChain;
+    /** The CBOR form: a bare byte string for one certificate, an array for several. */
+    toCbor(): CborValue;
+    /**
+     * Walk this chain to one of the given trust anchors.
+     *
+     * Every certificate within its validity period, every certificate signed
+     * by the next one, every issuing certificate actually allowed to issue,
+     * the last one either an anchor or issued by one, and the end-entity
+     * certificate allowed to sign.
+     *
+     * This answers "does this chain lead somewhere I trust". It does *not*
+     * answer whether the key of the end-entity certificate is the key that
+     * signed the message — without that binding a perfectly valid chain says
+     * nothing about the message it travelled with.
+     *
+     * Not checked, and the same list as Styx so that the two agree about what
+     * a pass means: revocation, name constraints, certificate policies, and
+     * path length beyond the CA flag.
+     */
+    validate(trustAnchors: readonly X509Certificate[], options?: ChainValidationOptions): Verification;
+    toString(): string;
+}
+/**
+ * A `COSE_CertHash` [RFC 9360, Section 2] — the hash of a DER encoded
+ * certificate, as `x5t` carries it.
+ *
+ * ```
+ * COSE_CertHash = [ hashAlg: (int / tstr), hashValue: bstr ]
+ * ```
+ */
+export declare class CoseCertificateHash {
+    /** The hash algorithm the thumbprint was computed with. */
+    readonly algorithm: CoseAlgorithm;
+    /** The hash of the certificate's DER encoding. */
+    readonly value: Uint8Array;
+    constructor(algorithm: CoseAlgorithm, value: Uint8Array);
+    /** Compute the thumbprint of a certificate, with SHA-256 unless told otherwise. */
+    static from(certificate: X509Certificate, algorithm?: CoseAlgorithm): CoseCertificateHash;
+    /** Read a `COSE_CertHash` from its CBOR form. */
+    static fromCbor(value: CborValue): CoseCertificateHash;
+    /** The CBOR form. */
+    toCbor(): CborValue;
+    /**
+     * Whether this thumbprint names the given certificate.
+     *
+     * A thumbprint that names a *different* certificate than the one that
+     * travelled is not a detail to shrug at: the message states which
+     * certificate it means, and the chain offers another. One of the two is
+     * wrong and there is no way to tell which.
+     */
+    matches(certificate: X509Certificate): Verification;
+}
+//# sourceMappingURL=x5chain.d.ts.map

package/dist/x5chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"x5chain.d.ts","sourceRoot":"","sources":["../src/x5chain.ts"],"names":[],"mappings":"AAuBA,OAAO,KAAK,EAAE,aAAa,EAAE,MAA+B,gBAAgB,CAAC;AAE7E,OAAO,KAAK,EAAE,SAAS,EAAE,MAAmC,WAAW,CAAC;AAExE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAgC,aAAa,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAqC,UAAU,CAAC;AACvE,OAAO,EAAY,eAAe,EAAE,MAAwB,WAAW,CAAC;AAGxE,sCAAsC;AACtC,MAAM,WAAW,sBAAsB;IAEnC;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,CAAC,EAAG,IAAI,CAAC;CAEvB;AAKD;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,oBAAoB;IAE7B,0CAA0C;IAC1C,SAAgB,YAAY,EAAE,SAAS,eAAe,EAAE,CAAC;gBAGtC,YAAY,EAAE,SAAS,eAAe,EAAE;IAU3D,uEAAuE;IACvE,IAAW,SAAS,IAAI,eAAe,CAEtC;IAGD,oDAAoD;IAC7C,SAAS,IAAI,OAAO;IAO3B,6CAA6C;WAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,oBAAoB;IA2C9D,mFAAmF;IAC5E,MAAM,IAAI,SAAS;IAW1B;;;;;;;;;;;;;;;;OAgBG;IACI,QAAQ,CAAC,YAAY,EAAE,SAAS,eAAe,EAAE,EACxC,OAAO,GAAO,sBAA2B,GAAG,YAAY;IA2DjE,QAAQ,IAAI,MAAM;CAI5B;AAmBD;;;;;;;GAOG;AACH,qBAAa,mBAAmB;IAE5B,2DAA2D;IAC3D,SAAgB,SAAS,EAAG,aAAa,CAAC;IAE1C,kDAAkD;IAClD,SAAgB,KAAK,EAAO,UAAU,CAAC;gBAGpB,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU;IAM9D,mFAAmF;WACrE,IAAI,CAAC,WAAW,EAAE,eAAe,EAC5B,SAAS,GAAI,aAAqC,GAAG,mBAAmB;IAU3F,iDAAiD;WACnC,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,mBAAmB;IA6B7D,qBAAqB;IACd,MAAM,IAAI,SAAS;IAK1B;;;;;;;OAOG;IACI,OAAO,CAAC,WAAW,EAAE,eAAe,GAAG,YAAY;CAe7D"}

package/package.json

@@ -0,0 +1,97 @@
+{
+    "name": "@vanaheimr/cose",
+    "version": "0.9.0",
+    "description": "CBOR Object Signing and Encryption (RFC 9052) in TypeScript, on top of the Metrological CBOR codec — the TypeScript counterpart of Vanaheimr Styx's Illias/COSE.",
+    "keywords": [
+        "cose",
+        "cbor",
+        "rfc9052",
+        "rfc9053",
+        "cose-sign1",
+        "signing",
+        "encryption",
+        "mac",
+        "ecdsa",
+        "eddsa",
+        "ml-dsa",
+        "post-quantum",
+        "brainpool",
+        "x509",
+        "metrology",
+        "smart-metering",
+        "e-mobility"
+    ],
+    "homepage": "https://github.com/Vanaheimr/COSE.TS#readme",
+    "bugs": {
+        "url": "https://github.com/Vanaheimr/COSE.TS/issues"
+    },
+    "repository": {
+        "type": "git",
+        "url": "git+https://github.com/Vanaheimr/COSE.TS.git"
+    },
+    "license": "Apache-2.0",
+    "author": "GraphDefined GmbH <achim.friedland@graphdefined.com>",
+    "type": "module",
+    "exports": {
+        ".": {
+            "types": "./dist/index.d.ts",
+            "default": "./dist/index.js"
+        },
+        "./package.json": "./package.json"
+    },
+    "main": "./dist/index.js",
+    "module": "./dist/index.js",
+    "types": "./dist/index.d.ts",
+    "files": [
+        "dist",
+        "README.md",
+        "LICENSE.md",
+        "NOTICE",
+        "CHANGELOG.md"
+    ],
+    "sideEffects": false,
+    "engines": {
+        "node": ">=20"
+    },
+    "publishConfig": {
+        "access": "public"
+    },
+    "scripts": {
+        "build": "npm run build:js && npm run build:types && npm run build:finish",
+        "build:js": "tsup",
+        "build:types": "tsc -p tsconfig.build.json --emitDeclarationOnly",
+        "build:finish": "tsx scripts/finish-build.ts",
+        "clean": "node -e \"import('node:fs').then(fs => fs.rmSync('dist', { recursive: true, force: true }))\"",
+        "docs:api": "typedoc",
+        "lint": "eslint .",
+        "lint:fix": "eslint . --fix",
+        "test": "vitest run",
+        "test:coverage": "vitest run --coverage",
+        "test:fuzz": "vitest run tests/fuzz",
+        "typecheck": "tsc --noEmit && tsc -p tsconfig.browser.json",
+        "verify": "npm run typecheck && npm run lint && npm run build && npm run test && npm run docs:api",
+        "prepublishOnly": "npm run verify"
+    },
+    "dependencies": {
+        "@noble/ciphers": "^2.3.0",
+        "@noble/curves": "^2.3.0",
+        "@noble/hashes": "^2.3.0",
+        "@noble/post-quantum": "^0.7.0",
+        "@vanaheimr/metrological-cbor": "^0.10.0"
+    },
+    "devDependencies": {
+        "@eslint/js": "^10.0.1",
+        "@types/node": "^26.2.0",
+        "@vitest/coverage-v8": "^4.1.11",
+        "esbuild": "^0.28.2",
+        "eslint": "^10.9.0",
+        "fast-check": "^4.9.0",
+        "globals": "^17.11.0",
+        "tsup": "^8.5.1",
+        "tsx": "^4.23.12",
+        "typedoc": "^0.28.20",
+        "typescript": "^6.0.3",
+        "typescript-eslint": "^8.67.0",
+        "vitest": "^4.1.10"
+    }
+}