{ "$comment": "Machine-generated public surface of pkinative (the single entry point src/index.ts) — the ground truth for agents, since dist/*.d.ts is not committed. Fields that cannot be read mechanically are null, never guessed. Functions carry `params`, `returns` and `throws` (the @throws classes) from their TSDoc; interfaces carry `members`, every field with its type, inherited ones first; a type alias carries its whole union in `signature`. Regenerate with `npm run docs:api`; the verify-docs rule api-json-sync enforces freshness.", "package": "pkinative", "source": "src/index.ts", "exportCount": 294, "exports": [ { "name": "ANY_EXTENDED_KEY_USAGE", "kind": "constant", "module": "src/path/path-purpose.ts", "signature": "export const ANY_EXTENDED_KEY_USAGE = '2.5.29.37.0'", "summary": "`2.5.29.37.0`, anyExtendedKeyUsage — every purpose (RFC 5280 §4.2.1.12).", "throws": null, "params": null, "returns": null, "members": null }, { "name": "AccessDescription", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface AccessDescription", "summary": "One access method and where to reach it.", "throws": null, "params": null, "returns": null, "members": [ { "name": "accessMethod", "type": "string", "optional": false, "summary": "e.g. `1.3.6.1.5.5.7.48.1` (ocsp) or `1.3.6.1.5.5.7.48.2` (caIssuers)." }, { "name": "accessLocation", "type": "GeneralName", "optional": false, "summary": "Where to reach it, usually a `uniformResourceIdentifier`." } ] }, { "name": "AlgorithmIdentifier", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface AlgorithmIdentifier", "summary": "An AlgorithmIdentifier (RFC 5280 §4.1.1.2).", "throws": null, "params": null, "returns": null, "members": [ { "name": "oid", "type": "string", "optional": false, "summary": "The algorithm OID, e.g. `1.2.840.113549.1.1.11`." }, { "name": "parameters", "type": "Asn1Node | undefined", "optional": false, "summary": "The parameters, or `undefined` when the field is absent." }, { "name": "der", "type": "Uint8Array", "optional": false, "summary": "The exact encoding of the AlgorithmIdentifier." } ] }, { "name": "Asn1Node", "kind": "type", "module": "src/types/asn1-types.ts", "signature": "export interface Asn1Node", "summary": "One decoded tag-length-value, with its exact position in the input.", "throws": null, "params": null, "returns": null, "members": [ { "name": "tagClass", "type": "TagClass", "optional": false, "summary": "The two leading bits of the identifier octet." }, { "name": "tagNumber", "type": "number", "optional": false, "summary": "The tag number." }, { "name": "constructed", "type": "boolean", "optional": false, "summary": "Whether the value is built from other values (bit 6 of the identifier octet): `children` is populated exactly when this is true." }, { "name": "offset", "type": "number", "optional": false, "summary": "Absolute offset of the identifier octet in the decoded input." }, { "name": "headerLength", "type": "number", "optional": false, "summary": "Identifier and length octets (the `0x80` octet included for the indefinite form)." }, { "name": "contentLength", "type": "number", "optional": false, "summary": "Content octets, excluding the end-of-contents marker of the indefinite form." }, { "name": "indefinite", "type": "boolean", "optional": false, "summary": "True only for a BER indefinite-length value; always false under DER." }, { "name": "bytes", "type": "Uint8Array", "optional": false, "summary": "The whole encoding of this value, exactly as it appears in the input." }, { "name": "content", "type": "Uint8Array", "optional": false, "summary": "The content octets (for a constructed value, the concatenated encodings of its children)." }, { "name": "children", "type": "readonly Asn1Node[]", "optional": false, "summary": "The decoded children of a constructed value; empty for a primitive value." } ] }, { "name": "Asn1String", "kind": "type", "module": "src/types/asn1-types.ts", "signature": "export interface Asn1String", "summary": "A decoded character string with its original content octets.", "throws": null, "params": null, "returns": null, "members": [ { "name": "stringType", "type": "Asn1StringType", "optional": false, "summary": "Which of the eight string types it was encoded as — the charset that decided how `raw` became `value`." }, { "name": "value", "type": "string", "optional": false, "summary": "The decoded text." }, { "name": "raw", "type": "Uint8Array", "optional": false, "summary": "The content octets before decoding, for a comparison by bytes." } ] }, { "name": "Asn1StringType", "kind": "type", "module": "src/types/asn1-types.ts", "signature": "export type Asn1StringType = 'utf8' | 'numeric' | 'printable' | 'teletex' | 'ia5' | 'visible' | 'universal' | 'bmp'", "summary": "The character string types pkinative decodes.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "Attribute", "kind": "type", "module": "src/types/cms-types.ts", "signature": "export interface Attribute", "summary": "One `Attribute` (RFC 5652 §5.3): a type and a non-empty set of values.", "throws": null, "params": null, "returns": null, "members": [ { "name": "oid", "type": "string", "optional": false, "summary": "The attribute type." }, { "name": "values", "type": "readonly Uint8Array[]", "optional": false, "summary": "Each `AttributeValue`, as its exact DER, in encoded order." }, { "name": "der", "type": "Uint8Array", "optional": false, "summary": "The whole `Attribute` SEQUENCE, exactly as encoded." } ] }, { "name": "AttributeTypeAndValue", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface AttributeTypeAndValue", "summary": "One attribute of a distinguished name (RFC 5280 §4.1.2.4).", "throws": null, "params": null, "returns": null, "members": [ { "name": "type", "type": "string", "optional": false, "summary": "The attribute type OID, e.g. `2.5.4.3` (commonName)." }, { "name": "value", "type": "Asn1String | undefined", "optional": false, "summary": "The decoded value when it is a character string; `undefined` for a value of any other ASN.1 type." }, { "name": "valueDer", "type": "Uint8Array", "optional": false, "summary": "The exact encoding of the value: tag, length and content." } ] }, { "name": "AuthorityInfoAccessExtension", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface AuthorityInfoAccessExtension extends ExtensionBase", "summary": "authorityInfoAccess (RFC 5280 §4.2.2.1).", "throws": null, "params": null, "returns": null, "members": [ { "name": "oid", "type": "string", "optional": false, "summary": "The extnID, in dotted notation, e.g. `2.5.29.19` (basicConstraints)." }, { "name": "critical", "type": "boolean", "optional": false, "summary": "Whether the issuer marked the extension critical: a relying party that does not understand a critical extension must reject the certificate." }, { "name": "valueDer", "type": "Uint8Array", "optional": false, "summary": "The content of extnValue: the DER encoding of the extension value." }, { "name": "kind", "type": "'authorityInfoAccess'", "optional": false, "summary": "Discriminant; `getExtension(cert, 'authorityInfoAccess')` returns this type." }, { "name": "descriptions", "type": "readonly AccessDescription[]", "optional": false, "summary": "Where to reach the issuer's OCSP responder and its own certificate, in encoded order." } ] }, { "name": "AuthorityKeyIdentifierExtension", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface AuthorityKeyIdentifierExtension extends ExtensionBase", "summary": "authorityKeyIdentifier (RFC 5280 §4.2.1.1).", "throws": null, "params": null, "returns": null, "members": [ { "name": "oid", "type": "string", "optional": false, "summary": "The extnID, in dotted notation, e.g. `2.5.29.19` (basicConstraints)." }, { "name": "critical", "type": "boolean", "optional": false, "summary": "Whether the issuer marked the extension critical: a relying party that does not understand a critical extension must reject the certificate." }, { "name": "valueDer", "type": "Uint8Array", "optional": false, "summary": "The content of extnValue: the DER encoding of the extension value." }, { "name": "kind", "type": "'authorityKeyIdentifier'", "optional": false, "summary": "Discriminant; `getExtension(cert, 'authorityKeyIdentifier')` returns this type." }, { "name": "keyIdentifier", "type": "Uint8Array | undefined", "optional": false, "summary": "The issuing key's identifier, to match against its subjectKeyIdentifier; `undefined` when absent." }, { "name": "authorityCertIssuer", "type": "readonly GeneralName[] | undefined", "optional": false, "summary": "The issuing certificate's own issuer; `undefined` when absent." }, { "name": "authorityCertSerialNumber", "type": "SerialNumber | undefined", "optional": false, "summary": "The issuing certificate's serial; `undefined` when absent." } ] }, { "name": "BasicConstraintsExtension", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface BasicConstraintsExtension extends ExtensionBase", "summary": "basicConstraints (RFC 5280 §4.2.1.9).", "throws": null, "params": null, "returns": null, "members": [ { "name": "oid", "type": "string", "optional": false, "summary": "The extnID, in dotted notation, e.g. `2.5.29.19` (basicConstraints)." }, { "name": "critical", "type": "boolean", "optional": false, "summary": "Whether the issuer marked the extension critical: a relying party that does not understand a critical extension must reject the certificate." }, { "name": "valueDer", "type": "Uint8Array", "optional": false, "summary": "The content of extnValue: the DER encoding of the extension value." }, { "name": "kind", "type": "'basicConstraints'", "optional": false, "summary": "Discriminant; `getExtension(cert, 'basicConstraints')` returns this type." }, { "name": "cA", "type": "boolean", "optional": false, "summary": "Whether the subject is a CA." }, { "name": "pathLenConstraint", "type": "number | undefined", "optional": false, "summary": "How many intermediates may follow this certificate in a path; `undefined` means unlimited, and it is meaningful only when `cA` is true." } ] }, { "name": "BitString", "kind": "type", "module": "src/types/asn1-types.ts", "signature": "export interface BitString", "summary": "A BIT STRING: the octets and the number of unused bits in the last one (0–7).", "throws": null, "params": null, "returns": null, "members": [ { "name": "bytes", "type": "Uint8Array", "optional": false, "summary": "The octets, most significant bit first." }, { "name": "unusedBits", "type": "number", "optional": false, "summary": "How many bits of the final octet are padding, 0 to 7." } ] }, { "name": "BuildCertificatePathInput", "kind": "type", "module": "src/path/path-build.ts", "signature": "export interface BuildCertificatePathInput extends Omit", "summary": "What to build from, and everything needed to judge each candidate.", "throws": null, "params": null, "returns": null, "members": [ { "name": "leaf", "type": "Certificate", "optional": false, "summary": "The certificate a path is wanted for." }, { "name": "candidates", "type": "readonly Certificate[]", "optional": false, "summary": "Every certificate that may appear in the path, in any order, duplicates and irrelevant entries included." }, { "name": "purposes", "type": "readonly string[] | undefined", "optional": true, "summary": "KeyPurposeId OIDs every certificate on the path must permit, checked **during** the search rather than after it." } ] }, { "name": "BuildCertificatePathReport", "kind": "type", "module": "src/path/path-build.ts", "signature": "export interface BuildCertificatePathReport extends ValidateCertificatePathReport", "summary": "A path that was tried, and what §6 made of it.", "throws": null, "params": null, "returns": null, "members": [ { "name": "valid", "type": "boolean", "optional": false, "summary": "True only when `reasons` is empty; the two are one answer, not two." }, { "name": "reasons", "type": "readonly PkiReason[]", "optional": false, "summary": "Every reason the answer is no, not just the first." }, { "name": "path", "type": "readonly Certificate[]", "optional": false, "summary": "The path actually walked, leaf first, ending at the trust anchor when one was reached." }, { "name": "explored", "type": "number", "optional": false, "summary": "How many candidate paths were explored before this answer." } ] }, { "name": "Certificate", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface Certificate", "summary": "A parsed X.509 certificate.", "throws": null, "params": null, "returns": null, "members": [ { "name": "der", "type": "Uint8Array", "optional": false, "summary": "The whole certificate encoding." }, { "name": "tbsDer", "type": "Uint8Array", "optional": false, "summary": "The tbsCertificate encoding — the bytes the signature covers." }, { "name": "version", "type": "1 | 2 | 3", "optional": false, "summary": "The profile version, already decoded from the encoded 0, 1 or 2; only a v3 certificate may carry extensions." }, { "name": "serialNumber", "type": "SerialNumber", "optional": false, "summary": "The issuer-assigned serial, unique per issuer — the pair (issuer, serialNumber) identifies a certificate." }, { "name": "signatureAlgorithm", "type": "AlgorithmIdentifier", "optional": false, "summary": "The outer signatureAlgorithm." }, { "name": "tbsSignatureAlgorithm", "type": "AlgorithmIdentifier", "optional": false, "summary": "tbsCertificate.signature, which RFC 5280 requires to equal `signatureAlgorithm`." }, { "name": "signatureValue", "type": "BitString", "optional": false, "summary": "The signature over `tbsDer`." }, { "name": "issuer", "type": "DistinguishedName", "optional": false, "summary": "Who issued the certificate — matched against the subject of the issuing certificate by encoded bytes." }, { "name": "validity", "type": "Validity", "optional": false, "summary": "When the certificate is valid." }, { "name": "subject", "type": "DistinguishedName", "optional": false, "summary": "Who the certificate is about." }, { "name": "subjectPublicKeyInfo", "type": "SubjectPublicKeyInfo", "optional": false, "summary": "The subject's public key, discriminated by `kind`." }, { "name": "issuerUniqueId", "type": "BitString | undefined", "optional": false, "summary": "issuerUniqueID, or `undefined` when absent." }, { "name": "subjectUniqueId", "type": "BitString | undefined", "optional": false, "summary": "subjectUniqueID, or `undefined` when absent." }, { "name": "extensions", "type": "readonly Extension[]", "optional": false, "summary": "Every extension in encoded order; empty when the field is absent." }, { "name": "diagnostics", "type": "readonly PkiDiagnostic[]", "optional": false, "summary": "Every diagnostic the parse recorded, in emission order." } ] }, { "name": "CertificateDescription", "kind": "type", "module": "src/types/build-types.ts", "signature": "export interface CertificateDescription", "summary": "What a certificate is built from.", "throws": null, "params": null, "returns": null, "members": [ { "name": "serialNumber", "type": "bigint | Uint8Array", "optional": false, "summary": "The serial." }, { "name": "issuerDer", "type": "Uint8Array | undefined", "optional": true, "summary": "The issuer name, as the **DER of the issuing certificate's subject**." }, { "name": "issuer", "type": "NameDescription | undefined", "optional": true, "summary": "The issuer name to build, when there is no certificate to copy it from." }, { "name": "subject", "type": "NameDescription", "optional": false, "summary": "The subject name to build." }, { "name": "subjectDer", "type": "Uint8Array | undefined", "optional": true, "summary": "The subject name as DER, used instead of `subject` when given." }, { "name": "notBefore", "type": "number", "optional": false, "summary": "Start of validity, in epoch milliseconds." }, { "name": "notAfter", "type": "number", "optional": false, "summary": "End of validity, in epoch milliseconds." }, { "name": "subjectPublicKey", "type": "Uint8Array", "optional": false, "summary": "The subject's public key, as a complete SubjectPublicKeyInfo in DER — `new Uint8Array(await crypto.subtle.exportKey('spki', publicKey))`." }, { "name": "extensions", "type": "readonly ExtensionDescription[] | undefined", "optional": true, "summary": "The extensions, in the order they are placed." } ] }, { "name": "CertificateList", "kind": "type", "module": "src/types/crl-types.ts", "signature": "export interface CertificateList", "summary": "A parsed `CertificateList` (RFC 5280 §5.1).", "throws": null, "params": null, "returns": null, "members": [ { "name": "der", "type": "Uint8Array", "optional": false, "summary": "The whole CRL, as a zero-copy view of the input." }, { "name": "tbsDer", "type": "Uint8Array", "optional": false, "summary": "The `tbsCertList` bytes the signature covers." }, { "name": "version", "type": "1 | 2", "optional": false, "summary": "`1` for v1, `2` for v2 (the encoded INTEGER is 0 or 1)." }, { "name": "signatureAlgorithm", "type": "AlgorithmIdentifier", "optional": false, "summary": "The algorithm the outer signature was made with." }, { "name": "tbsSignatureAlgorithm", "type": "AlgorithmIdentifier", "optional": false, "summary": "`tbsCertList.signature`; RFC 5280 §5.1.1.2 requires it to equal the outer one." }, { "name": "signatureValue", "type": "BitString", "optional": false, "summary": "The signature over `tbsDer`, as a BIT STRING of whole octets." }, { "name": "issuer", "type": "DistinguishedName", "optional": false, "summary": "The CA that issued this list." }, { "name": "thisUpdate", "type": "PkiTime", "optional": false, "summary": "When this list was produced." }, { "name": "nextUpdate", "type": "PkiTime | undefined", "optional": false, "summary": "Absent in a CRL that promises no successor, which RFC 5280 discourages." }, { "name": "extensions", "type": "readonly Extension[]", "optional": false, "summary": "`crlExtensions`, decoded; empty when there are none." }, { "name": "crlNumber", "type": "bigint | undefined", "optional": false, "summary": "`cRLNumber` (RFC 5280 §5.2.3), or undefined when absent." }, { "name": "isDelta", "type": "boolean", "optional": false, "summary": "Whether `deltaCRLIndicator` (§5.2.4) is present — a delta CRL is not a full one." }, { "name": "baseCrlNumber", "type": "bigint | undefined", "optional": false, "summary": "`BaseCRLNumber` (§5.2.4), the `cRLNumber` of the complete list this delta describes the changes since; `undefined` on a list that is not a delta." }, { "name": "issuingDistributionPoint", "type": "IssuingDistributionPoint | undefined", "optional": false, "summary": "`issuingDistributionPoint` (§5.2.5), or `undefined` when absent — in which case the list covers everything its CA issued." }, { "name": "entryCount", "type": "number", "optional": false, "summary": "Entries in `revokedCertificates`, counted by walking rather than decoding." }, { "name": "diagnostics", "type": "readonly PkiDiagnostic[]", "optional": false, "summary": "Profile concerns found while reading the envelope, in encoded order." } ] }, { "name": "CertificatePoliciesExtension", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface CertificatePoliciesExtension extends ExtensionBase", "summary": "certificatePolicies (RFC 5280 §4.2.1.4).", "throws": null, "params": null, "returns": null, "members": [ { "name": "oid", "type": "string", "optional": false, "summary": "The extnID, in dotted notation, e.g. `2.5.29.19` (basicConstraints)." }, { "name": "critical", "type": "boolean", "optional": false, "summary": "Whether the issuer marked the extension critical: a relying party that does not understand a critical extension must reject the certificate." }, { "name": "valueDer", "type": "Uint8Array", "optional": false, "summary": "The content of extnValue: the DER encoding of the extension value." }, { "name": "kind", "type": "'certificatePolicies'", "optional": false, "summary": "Discriminant; `getExtension(cert, 'certificatePolicies')` returns this type." }, { "name": "policies", "type": "readonly PolicyInformation[]", "optional": false, "summary": "The policies this certificate was issued under, in encoded order." } ] }, { "name": "CertificationRequest", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface CertificationRequest", "summary": "A parsed PKCS#10 certification request (RFC 2986 §4).", "throws": null, "params": null, "returns": null, "members": [ { "name": "der", "type": "Uint8Array", "optional": false, "summary": "The whole request encoding." }, { "name": "tbsDer", "type": "Uint8Array", "optional": false, "summary": "The certificationRequestInfo encoding — the bytes the signature covers." }, { "name": "version", "type": "0", "optional": false, "summary": "The encoded version: `0`, the only one RFC 2986 defines (v1)." }, { "name": "subject", "type": "DistinguishedName", "optional": false, "summary": "The name the requester asks to be certified under; its `der` is what a CA copies into the certificate." }, { "name": "subjectPublicKeyInfo", "type": "SubjectPublicKeyInfo", "optional": false, "summary": "The public key the requester asks to have certified — and the key its signature is checked with." }, { "name": "attributes", "type": "readonly CsrAttribute[]", "optional": false, "summary": "Every attribute in encoded order; empty when the request asks for nothing beyond its subject and key." }, { "name": "extensions", "type": "readonly Extension[] | undefined", "optional": false, "summary": "The extensions requested through the `extensionRequest` attribute (RFC 2985 §5.4.2), decoded as a certificate's would be; `undefined` when the request carries none." }, { "name": "challengePassword", "type": "string | undefined", "optional": false, "summary": "The `challengePassword` attribute (RFC 2985 §5.4.1), or `undefined` when absent." }, { "name": "signatureAlgorithm", "type": "AlgorithmIdentifier", "optional": false, "summary": "The signature algorithm." }, { "name": "signatureValue", "type": "BitString", "optional": false, "summary": "The signature over `tbsDer`, made with the private half of `subjectPublicKeyInfo`." }, { "name": "diagnostics", "type": "readonly PkiDiagnostic[]", "optional": false, "summary": "Every diagnostic the parse recorded, in emission order." } ] }, { "name": "CertificationRequestDescription", "kind": "type", "module": "src/types/build-types.ts", "signature": "export interface CertificationRequestDescription", "summary": "What a PKCS#10 certification request is built from.", "throws": null, "params": null, "returns": null, "members": [ { "name": "subject", "type": "NameDescription", "optional": false, "summary": "The subject name to build." }, { "name": "subjectDer", "type": "Uint8Array | undefined", "optional": true, "summary": "The subject name as DER, used instead of `subject` when given." }, { "name": "subjectPublicKey", "type": "Uint8Array", "optional": false, "summary": "The requester's public key, as a complete SubjectPublicKeyInfo in DER." }, { "name": "extensions", "type": "readonly ExtensionDescription[] | undefined", "optional": true, "summary": "Extensions to request, carried in the `extensionRequest` attribute (PKCS#9, OID 1.2.840.113549.1.9.14)." } ] }, { "name": "CheckExtendedKeyUsageOptions", "kind": "type", "module": "src/path/path-purpose.ts", "signature": "export interface CheckExtendedKeyUsageOptions", "summary": "Options of checkExtendedKeyUsage.", "throws": null, "params": null, "returns": null, "members": [ { "name": "restrictIssuers", "type": "boolean | undefined", "optional": true, "summary": "Apply a CA's own `extKeyUsage` to what it issued." }, { "name": "requireExplicitPurpose", "type": "boolean | undefined", "optional": true, "summary": "Require the end-entity certificate to carry `extKeyUsage` and name the purpose explicitly." } ] }, { "name": "CheckOcspStatusInput", "kind": "type", "module": "src/revocation/ocsp-check.ts", "signature": "export interface CheckOcspStatusInput", "summary": "What to check, and everything needed to judge it.", "throws": null, "params": null, "returns": null, "members": [ { "name": "response", "type": "OcspResponse", "optional": false, "summary": "The parsed response." }, { "name": "expected", "type": "{", "optional": false, "summary": "The `CertID` that was asked about, as `encodeOcspCertId` produced it." }, { "name": "at", "type": "number", "optional": false, "summary": "The instant to judge at, in epoch milliseconds." }, { "name": "signatureVerified", "type": "boolean | undefined", "optional": true, "summary": "Whether the responder's signature verified." }, { "name": "responderAuthorized", "type": "boolean | undefined", "optional": true, "summary": "Whether the signer is authorised to answer for this CA (RFC 6960 §4.2.2.2)." }, { "name": "signer", "type": "Certificate | undefined", "optional": true, "summary": "The certificate whose key verified the signature — the CA itself, or the delegate it issued — when you hold it." }, { "name": "onDiagnostic", "type": "PkiDiagnosticHandler | undefined", "optional": true, "summary": "Receive the diagnostics this decision raises — what the response says about itself that §4.2 asks it not to, none of which touches the verdict." }, { "name": "nonce", "type": "Uint8Array | undefined", "optional": true, "summary": "The nonce that was sent, if any." }, { "name": "requireNonce", "type": "boolean | undefined", "optional": true, "summary": "Report a missing nonce echo as a mismatch." }, { "name": "staleTolerance", "type": "number | undefined", "optional": true, "summary": "Accept a response whose `nextUpdate` has passed, up to this many milliseconds." }, { "name": "futureTolerance", "type": "number | undefined", "optional": true, "summary": "Refuse a response whose `thisUpdate` is more than this far in the future." } ] }, { "name": "CheckRevocationInput", "kind": "type", "module": "src/revocation/crl-check.ts", "signature": "export interface CheckRevocationInput", "summary": "What to check, and everything needed to judge it.", "throws": null, "params": null, "returns": null, "members": [ { "name": "certificate", "type": "Certificate", "optional": false, "summary": "The certificate whose status is in question." }, { "name": "crl", "type": "CertificateList", "optional": false, "summary": "The parsed list." }, { "name": "crlDer", "type": "Uint8Array", "optional": false, "summary": "The same bytes `parseCertificateList` was given — the walk needs them." }, { "name": "at", "type": "number", "optional": false, "summary": "The instant to judge at, in epoch milliseconds." }, { "name": "signatureVerified", "type": "boolean | undefined", "optional": true, "summary": "Whether the CRL's signature was verified against a key entitled to sign it." }, { "name": "staleTolerance", "type": "number | undefined", "optional": true, "summary": "Accept a list whose `nextUpdate` has passed, up to this many milliseconds." }, { "name": "delta", "type": "DeltaCrlInput | undefined", "optional": true, "summary": "A delta CRL (RFC 5280 §5.2.4) describing the changes since `crl`." }, { "name": "limits", "type": "Partial | undefined", "optional": true, "summary": "Overrides for any subset of `DEFAULT_PKI_LIMITS`, applied to the walk of the entries." }, { "name": "onDiagnostic", "type": "PkiDiagnosticHandler | undefined", "optional": true, "summary": "Receive every diagnostic the walk raises — an entry extension that is malformed and dropped — instead of the default once-per-code `console.warn`." } ] }, { "name": "CheckServerNameOptions", "kind": "type", "module": "src/path/path-server-name.ts", "signature": "export interface CheckServerNameOptions", "summary": "Options of checkServerName.", "throws": null, "params": null, "returns": null, "members": [ { "name": "allowCommonNameFallback", "type": "boolean | undefined", "optional": true, "summary": "Fall back to `commonName` when the certificate carries no `dNSName` and no `iPAddress`." }, { "name": "path", "type": "readonly Certificate[] | undefined", "optional": true, "summary": "The validated certification path, leaf first, as `validateCertificatePath` and `verifyCertificateChain` report it in `path`." }, { "name": "allowWildcards", "type": "boolean | undefined", "optional": true, "summary": "Accept a wildcard certificate at all." } ] }, { "name": "CpsQualifier", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface CpsQualifier", "summary": "A CPS pointer qualifier.", "throws": null, "params": null, "returns": null, "members": [ { "name": "kind", "type": "'cps'", "optional": false, "summary": "Discriminant: switch on it to narrow a `PolicyQualifier` to this alternative." }, { "name": "oid", "type": "string", "optional": false, "summary": "The qualifier OID, `1.3.6.1.5.5.7.2.1`." }, { "name": "uri", "type": "string", "optional": false, "summary": "Where the certification practice statement is published." } ] }, { "name": "CreateOcspRequestOptions", "kind": "type", "module": "src/revocation/ocsp-request.ts", "signature": "export interface CreateOcspRequestOptions", "summary": "Options of createOcspRequest.", "throws": null, "params": null, "returns": null, "members": [ { "name": "hashAlgorithm", "type": "OcspHashAlgorithm | undefined", "optional": true, "summary": "The digest for the two issuer hashes." }, { "name": "nonce", "type": "Uint8Array | undefined", "optional": true, "summary": "A nonce (RFC 6960 §4.4.1), which binds the response to this request." } ] }, { "name": "CreateSignedDataInput", "kind": "type", "module": "src/build/build-signed-data.ts", "signature": "export interface CreateSignedDataInput", "summary": "What `createSignedData` signs, and what it writes around the signature.", "throws": null, "params": null, "returns": null, "members": [ { "name": "content", "type": "Uint8Array | undefined", "optional": true, "summary": "The content to sign." }, { "name": "contentDigest", "type": "Uint8Array | undefined", "optional": true, "summary": "The content's digest, already computed with the signer's digest — the detached, pre-hashed case of a PDF signature, whose signer hashes the `/ByteRange` itself." }, { "name": "detached", "type": "boolean | undefined", "optional": true, "summary": "Omit `eContent`, so the signature travels without what it signs." }, { "name": "contentType", "type": "string | undefined", "optional": true, "summary": "`eContentType`, and the value of the `contentType` attribute." }, { "name": "certificate", "type": "Certificate", "optional": false, "summary": "The signer's parsed certificate." }, { "name": "sid", "type": "'issuerAndSerialNumber' | 'subjectKeyIdentifier' | undefined", "optional": true, "summary": "How the SignerInfo names the certificate." }, { "name": "certificates", "type": "readonly Uint8Array[] | undefined", "optional": true, "summary": "Further certificates to embed verbatim, typically the chain." }, { "name": "crls", "type": "readonly Uint8Array[] | undefined", "optional": true, "summary": "Revocation lists to embed verbatim, each a `CertificateList` or an `other [1]` RevocationInfoChoice." }, { "name": "signingTime", "type": "number | undefined", "optional": true, "summary": "The time the signer claims, in epoch milliseconds, truncated to whole seconds (RFC 5652 §11.3 forbids a fraction)." }, { "name": "signingCertificateV2", "type": "boolean | undefined", "optional": true, "summary": "Write SigningCertificateV2 (RFC 5035), binding the signature to this certificate and not merely to its key." }, { "name": "algorithmProtection", "type": "boolean | undefined", "optional": true, "summary": "Write CMSAlgorithmProtection (RFC 6211), the signer's own signed statement of the algorithms it used." }, { "name": "signedAttributes", "type": "readonly Uint8Array[] | undefined", "optional": true, "summary": "Further signed attributes, each one `Attribute` encoding, written verbatim — e.g. adbe-revocationInfoArchival." }, { "name": "unsignedAttributes", "type": "readonly Uint8Array[] | undefined", "optional": true, "summary": "Unsigned attributes, each one `Attribute` encoding, written verbatim — e.g. a timestamp token already in hand." } ] }, { "name": "CreateTimeStampRequestOptions", "kind": "type", "module": "src/cms/tsp-request.ts", "signature": "export interface CreateTimeStampRequestOptions", "summary": "Options of createTimeStampRequest.", "throws": null, "params": null, "returns": null, "members": [ { "name": "hashAlgorithm", "type": "TimeStampHashAlgorithm | undefined", "optional": true, "summary": "The digest `hash` was computed with." }, { "name": "nonce", "type": "bigint | undefined", "optional": true, "summary": "A nonce (RFC 3161 §2.4.1), which the TSA must echo in the token." }, { "name": "policy", "type": "string | undefined", "optional": true, "summary": "The TSA policy to issue under; the TSA's default when absent." }, { "name": "certReq", "type": "boolean | undefined", "optional": true, "summary": "Ask the TSA to include its certificate in the token." } ] }, { "name": "CrlDistributionPointsExtension", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface CrlDistributionPointsExtension extends ExtensionBase", "summary": "cRLDistributionPoints (RFC 5280 §4.2.1.13).", "throws": null, "params": null, "returns": null, "members": [ { "name": "oid", "type": "string", "optional": false, "summary": "The extnID, in dotted notation, e.g. `2.5.29.19` (basicConstraints)." }, { "name": "critical", "type": "boolean", "optional": false, "summary": "Whether the issuer marked the extension critical: a relying party that does not understand a critical extension must reject the certificate." }, { "name": "valueDer", "type": "Uint8Array", "optional": false, "summary": "The content of extnValue: the DER encoding of the extension value." }, { "name": "kind", "type": "'crlDistributionPoints'", "optional": false, "summary": "Discriminant; `getExtension(cert, 'crlDistributionPoints')` returns this type." }, { "name": "points", "type": "readonly DistributionPoint[]", "optional": false, "summary": "Where the revocation lists are, in encoded order." } ] }, { "name": "CrlReason", "kind": "type", "module": "src/types/crl-types.ts", "signature": "export type CrlReason = | 'unspecified' | 'keyCompromise' | 'cACompromise' | 'affiliationChanged' | 'superseded' | 'cessationOfOperation' | 'certificateHold' | 'removeFromCRL' | 'privilegeWithdrawn' | 'aACompromise'", "summary": "The `CRLReason` values of RFC 5280 §5.3.1.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "CsrAttribute", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface CsrAttribute", "summary": "One attribute of a PKCS#10 request (RFC 2986 §4.1): a type and its values, kept as DER.", "throws": null, "params": null, "returns": null, "members": [ { "name": "oid", "type": "string", "optional": false, "summary": "The attribute type OID, e.g. `1.2.840.113549.1.9.14` (extensionRequest)." }, { "name": "values", "type": "readonly Uint8Array[]", "optional": false, "summary": "The exact encoding of each value — tag, length and content — in encoded order." } ] }, { "name": "DEFAULT_PKI_LIMITS", "kind": "constant", "module": "src/core/pki-limits.ts", "signature": "export const DEFAULT_PKI_LIMITS: PkiLimits = /*#__PURE__*/ Object.freeze({ maxInputBytes: 64 * 1024 * 1024, maxDepth: 64, maxNodes: 200_000, maxIntegerBytes: 8192, maxOidBytes: 256, maxBerSegments: 10_000, maxPemBlocks: 10_000, maxExtensions: 256, maxGeneralNames: 10_000, maxNameAttributes: 1024, maxPolicies: 1024, maxChainLength: 10, maxPolicyNodes: 4096, maxRevokedCertificates: 1_000_000, maxOcspSingleResponses: 256, maxPathsExplored: 1000, maxSignerInfos: 64, maxAttributes: 256, maxCmsCertificatesAndCrls: 1024, maxKdfIterations: 10_000_000, maxPkcs12Bags: 4096, maxPkcs12KdfIterations: 10_000_000, })", "summary": "Default security bounds — the safe path for untrusted input.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "DecodeAsn1Options", "kind": "type", "module": "src/types/asn1-types.ts", "signature": "export interface DecodeAsn1Options extends PkiParseOptions", "summary": "Options of `decodeAsn1` and `decodeAsn1Sequence`.", "throws": null, "params": null, "returns": null, "members": [ { "name": "encodingRules", "type": "EncodingRules | undefined", "optional": true, "summary": "`'der'` (default) or `'ber'`." }, { "name": "limits", "type": "Partial | undefined", "optional": true, "summary": "Overrides for any subset of `DEFAULT_PKI_LIMITS`." }, { "name": "strict", "type": "boolean | undefined", "optional": true, "summary": "Escalate every diagnostic to a thrown `PkiError` with code `PKI_STRICT_DIAGNOSTIC`." }, { "name": "onDiagnostic", "type": "PkiDiagnosticHandler | undefined", "optional": true, "summary": "Receive every diagnostic instead of the default once-per-code `console.warn`." }, { "name": "allowTrailingData", "type": "boolean | undefined", "optional": true, "summary": "Accept bytes after the outermost value (`decodeAsn1` only)." } ] }, { "name": "DecodeExtensionValueOptions", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface DecodeExtensionValueOptions extends PkiParseOptions", "summary": "Options of `decodeExtensionValue`.", "throws": null, "params": null, "returns": null, "members": [ { "name": "encodingRules", "type": "EncodingRules | undefined", "optional": true, "summary": "`'der'` (default) or `'ber'`." }, { "name": "limits", "type": "Partial | undefined", "optional": true, "summary": "Overrides for any subset of `DEFAULT_PKI_LIMITS`." }, { "name": "strict", "type": "boolean | undefined", "optional": true, "summary": "Escalate every diagnostic to a thrown `PkiError` with code `PKI_STRICT_DIAGNOSTIC`." }, { "name": "onDiagnostic", "type": "PkiDiagnosticHandler | undefined", "optional": true, "summary": "Receive every diagnostic instead of the default once-per-code `console.warn`." }, { "name": "critical", "type": "boolean | undefined", "optional": true, "summary": "The criticality to report on the result and to check against (default `false`)." } ] }, { "name": "DecodePemOptions", "kind": "type", "module": "src/types/pem-types.ts", "signature": "export interface DecodePemOptions", "summary": "Options of `decodePem`.", "throws": null, "params": null, "returns": null, "members": [ { "name": "mode", "type": "'strict' | 'lax' | undefined", "optional": true, "summary": "`'strict'` (default) accepts the RFC 7468 strict grammar: exact boundary lines, 64-character base64 lines, no headers." }, { "name": "label", "type": "string | undefined", "optional": true, "summary": "Require every block to carry this label (e.g. `CERTIFICATE`)." }, { "name": "limits", "type": "Partial | undefined", "optional": true, "summary": "Overrides for `maxInputBytes` (text length) and `maxPemBlocks`." }, { "name": "strict", "type": "boolean | undefined", "optional": true, "summary": "Escalate every diagnostic to a thrown `PkiError` with code `PKI_STRICT_DIAGNOSTIC`." }, { "name": "onDiagnostic", "type": "PkiDiagnosticHandler | undefined", "optional": true, "summary": "Receive every diagnostic instead of the default once-per-code `console.warn`." } ] }, { "name": "DecodedExtensionKind", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export type DecodedExtensionKind = Exclude", "summary": "The kinds `getExtension` looks up: every decoded extension, one per certificate.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "DecryptPrivateKeyOptions", "kind": "type", "module": "src/types/key-types.ts", "signature": "export interface DecryptPrivateKeyOptions extends PkiParseOptions", "summary": "Options of `decryptPrivateKey`: the parse options, the password, and the algorithm the key inside will sign with.", "throws": null, "params": null, "returns": null, "members": [ { "name": "encodingRules", "type": "EncodingRules | undefined", "optional": true, "summary": "`'der'` (default) or `'ber'`." }, { "name": "limits", "type": "Partial | undefined", "optional": true, "summary": "Overrides for any subset of `DEFAULT_PKI_LIMITS`." }, { "name": "strict", "type": "boolean | undefined", "optional": true, "summary": "Escalate every diagnostic to a thrown `PkiError` with code `PKI_STRICT_DIAGNOSTIC`." }, { "name": "onDiagnostic", "type": "PkiDiagnosticHandler | undefined", "optional": true, "summary": "Receive every diagnostic instead of the default once-per-code `console.warn`." }, { "name": "password", "type": "Uint8Array | string", "optional": false, "summary": "The password." }, { "name": "algorithm", "type": "SignatureAlgorithm", "optional": false, "summary": "The algorithm the key inside signs with." } ] }, { "name": "DeltaCrlInput", "kind": "type", "module": "src/revocation/crl-check.ts", "signature": "export interface DeltaCrlInput", "summary": "One delta CRL, and what is known about it.", "throws": null, "params": null, "returns": null, "members": [ { "name": "crl", "type": "CertificateList", "optional": false, "summary": "The parsed delta." }, { "name": "crlDer", "type": "Uint8Array", "optional": false, "summary": "The same bytes `parseCertificateList` was given." }, { "name": "signatureVerified", "type": "boolean | undefined", "optional": true, "summary": "Whether a key entitled to sign it did." } ] }, { "name": "DirectoryAttribute", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface DirectoryAttribute", "summary": "One X.501 `Attribute` of subjectDirectoryAttributes: a type and its values.", "throws": null, "params": null, "returns": null, "members": [ { "name": "oid", "type": "string", "optional": false, "summary": "The attribute type, e.g. `1.3.6.1.5.5.7.9.1` (dateOfBirth)." }, { "name": "values", "type": "readonly Uint8Array[]", "optional": false, "summary": "Each `AttributeValue`, as its exact DER, in encoded order — at least one." }, { "name": "der", "type": "Uint8Array", "optional": false, "summary": "The whole `Attribute` SEQUENCE, exactly as encoded." } ] }, { "name": "DirectoryGeneralName", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface DirectoryGeneralName extends GeneralNameBase", "summary": "`directoryName [4]`.", "throws": null, "params": null, "returns": null, "members": [ { "name": "der", "type": "Uint8Array", "optional": false, "summary": "The exact encoding of the GeneralName, its context tag included." }, { "name": "kind", "type": "'directoryName'", "optional": false, "summary": "Discriminant: switch on it to narrow a `GeneralName` to this alternative." }, { "name": "name", "type": "DistinguishedName", "optional": false, "summary": "The name, in the same shape as `certificate.subject`." } ] }, { "name": "DistinguishedName", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface DistinguishedName", "summary": "A distinguished name.", "throws": null, "params": null, "returns": null, "members": [ { "name": "rdns", "type": "readonly RelativeDistinguishedName[]", "optional": false, "summary": "The relative distinguished names in encoded order — the reverse of the RFC 4514 string order." }, { "name": "der", "type": "Uint8Array", "optional": false, "summary": "The exact encoding of the Name, the bytes a name comparison by octets uses." } ] }, { "name": "DistributionPoint", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface DistributionPoint", "summary": "One distribution point.", "throws": null, "params": null, "returns": null, "members": [ { "name": "fullName", "type": "readonly GeneralName[] | undefined", "optional": false, "summary": "Where the CRL is published, usually a `uniformResourceIdentifier`; `undefined` when absent." }, { "name": "nameRelativeToCRLIssuer", "type": "RelativeDistinguishedName | undefined", "optional": false, "summary": "The point named relative to the CRL issuer; `undefined` when absent." }, { "name": "reasons", "type": "readonly ReasonFlag[] | undefined", "optional": false, "summary": "Which revocation reasons this point covers; `undefined` means all of them, which is not the same as an empty list." }, { "name": "cRLIssuer", "type": "readonly GeneralName[] | undefined", "optional": false, "summary": "Who issues the CRL when it is not the certificate's own issuer; `undefined` when absent." } ] }, { "name": "EcCurve", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export type EcCurve = 'P-256' | 'P-384' | 'P-521'", "summary": "The NIST curves RFC 5480 names.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "EcPublicKeyInfo", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface EcPublicKeyInfo extends PublicKeyInfoBase", "summary": "An elliptic-curve key (RFC 5480).", "throws": null, "params": null, "returns": null, "members": [ { "name": "algorithm", "type": "AlgorithmIdentifier", "optional": false, "summary": "The algorithm the key belongs to, with its parameters; `kind` is pkinative's reading of it." }, { "name": "publicKey", "type": "BitString", "optional": false, "summary": "The subjectPublicKey BIT STRING." }, { "name": "der", "type": "Uint8Array", "optional": false, "summary": "The exact encoding of the SubjectPublicKeyInfo." }, { "name": "kind", "type": "'ec'", "optional": false, "summary": "Discriminant: switch on it to narrow a `SubjectPublicKeyInfo` to this alternative." }, { "name": "namedCurve", "type": "string | undefined", "optional": false, "summary": "The namedCurve OID; `undefined` when the parameters are not a named curve." }, { "name": "curve", "type": "EcCurve | undefined", "optional": false, "summary": "The curve name when `namedCurve` is P-256, P-384 or P-521." }, { "name": "pointFormat", "type": "'uncompressed' | 'compressed'", "optional": false, "summary": "Read from the point's first octet: `0x04` is uncompressed, `0x02` and `0x03` compressed." }, { "name": "point", "type": "Uint8Array", "optional": false, "summary": "The encoded point, format octet included." } ] }, { "name": "EncodingRules", "kind": "type", "module": "src/types/pki-types.ts", "signature": "export type EncodingRules = 'der' | 'ber'", "summary": "`der` (default) refuses every BER-only construct; `ber` accepts them with a diagnostic.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "EncryptedPrivateKeyInfo", "kind": "type", "module": "src/types/key-types.ts", "signature": "export interface EncryptedPrivateKeyInfo", "summary": "RFC 5958 §3 `EncryptedPrivateKeyInfo`: a scheme and ciphertext.", "throws": null, "params": null, "returns": null, "members": [ { "name": "der", "type": "Uint8Array", "optional": false, "summary": "The whole structure, as a zero-copy view of the input." }, { "name": "encryption", "type": "PasswordEncryption", "optional": false, "summary": "How the key was encrypted." }, { "name": "encryptedData", "type": "Uint8Array", "optional": false, "summary": "The ciphertext, as a zero-copy view." }, { "name": "diagnostics", "type": "readonly PkiDiagnostic[]", "optional": false, "summary": "Profile concerns found while reading, in encoded order." } ] }, { "name": "EssCertId", "kind": "type", "module": "src/types/cms-types.ts", "signature": "export interface EssCertId", "summary": "One `ESSCertID` (RFC 2634 §5.4.1) or `ESSCertIDv2` (RFC 5035 §4): a hash of a certificate the signer commits to having signed with.", "throws": null, "params": null, "returns": null, "members": [ { "name": "hashAlgorithm", "type": "string", "optional": false, "summary": "The digest `certHash` was computed with, as Web Crypto names it — SHA-1 for v1, SHA-256 when a v2 omits it — or the dotted OID when it is a digest pkinative does not compute." }, { "name": "certHash", "type": "Uint8Array", "optional": false, "summary": "The digest of the whole certificate DER." }, { "name": "issuerSerial", "type": "{", "optional": false, "summary": "`issuerSerial`, when the signer included it; `undefined` otherwise." } ] }, { "name": "ExtendedKeyUsageExtension", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface ExtendedKeyUsageExtension extends ExtensionBase", "summary": "extKeyUsage (RFC 5280 §4.2.1.12).", "throws": null, "params": null, "returns": null, "members": [ { "name": "oid", "type": "string", "optional": false, "summary": "The extnID, in dotted notation, e.g. `2.5.29.19` (basicConstraints)." }, { "name": "critical", "type": "boolean", "optional": false, "summary": "Whether the issuer marked the extension critical: a relying party that does not understand a critical extension must reject the certificate." }, { "name": "valueDer", "type": "Uint8Array", "optional": false, "summary": "The content of extnValue: the DER encoding of the extension value." }, { "name": "kind", "type": "'extendedKeyUsage'", "optional": false, "summary": "Discriminant; `getExtension(cert, 'extendedKeyUsage')` returns this type." }, { "name": "purposes", "type": "readonly string[]", "optional": false, "summary": "KeyPurposeId OIDs, e.g. `1.3.6.1.5.5.7.3.1` (serverAuth)." } ] }, { "name": "Extension", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export type Extension = | BasicConstraintsExtension | KeyUsageExtension | ExtendedKeyUsageExtension | SubjectAltNameExtension | IssuerAltNameExtension | SubjectKeyIdentifierExtension | AuthorityKeyIdentifierExtension | NameConstraintsExtension | CertificatePoliciesExtension | PolicyMappingsExtension | PolicyConstraintsExtension | InhibitAnyPolicyExtension | AuthorityInfoAccessExtension | SubjectInfoAccessExtension | CrlDistributionPointsExtension | FreshestCrlExtension | SignedCertificateTimestampListExtension | OcspNoCheckExtension | SubjectDirectoryAttributesExtension | UnknownExtension | RawExtension", "summary": "A certificate extension, discriminated by `kind`.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "ExtensionBase", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface ExtensionBase", "summary": "The fields every extension carries (RFC 5280 §4.1.2.9).", "throws": null, "params": null, "returns": null, "members": [ { "name": "oid", "type": "string", "optional": false, "summary": "The extnID, in dotted notation, e.g. `2.5.29.19` (basicConstraints)." }, { "name": "critical", "type": "boolean", "optional": false, "summary": "Whether the issuer marked the extension critical: a relying party that does not understand a critical extension must reject the certificate." }, { "name": "valueDer", "type": "Uint8Array", "optional": false, "summary": "The content of extnValue: the DER encoding of the extension value." } ] }, { "name": "ExtensionDescription", "kind": "type", "module": "src/types/build-types.ts", "signature": "export interface ExtensionDescription", "summary": "One extension to place in a certificate or request.", "throws": null, "params": null, "returns": null, "members": [ { "name": "oid", "type": "string", "optional": false, "summary": "The extension OID." }, { "name": "critical", "type": "boolean | undefined", "optional": true, "summary": "Whether a relying party that does not understand it must reject the certificate." }, { "name": "value", "type": "Uint8Array", "optional": false, "summary": "The DER encoding of the extension's value — what goes inside `extnValue`'s OCTET STRING." } ] }, { "name": "ExternalSigner", "kind": "type", "module": "src/types/crypto-types.ts", "signature": "export interface ExternalSigner", "summary": "A signer whose key pkinative never sees at all — a hardware security module, a smart card, a cloud KMS, a remote signing service.", "throws": null, "params": null, "returns": null, "members": [ { "name": "algorithm", "type": "SignatureAlgorithm", "optional": false, "summary": "The algorithm the signer uses, which decides the OID written into the structure." }, { "name": "produceSignature", "type": "(data: Uint8Array) => Promise | Uint8Array", "optional": false, "summary": "Sign `data` — the exact bytes the signature covers, not a digest of them — and return the signature **as `crypto.subtle.sign` would**: raw `r ‖ s` for ECDSA, which pkinative converts to DER, and the plain octets for every other family." } ] }, { "name": "FindRevocationOptions", "kind": "type", "module": "src/revocation/crl-parse.ts", "signature": "export interface FindRevocationOptions extends PkiParseOptions", "summary": "What findRevocation takes beyond the ordinary parse options.", "throws": null, "params": null, "returns": null, "members": [ { "name": "encodingRules", "type": "EncodingRules | undefined", "optional": true, "summary": "`'der'` (default) or `'ber'`." }, { "name": "limits", "type": "Partial | undefined", "optional": true, "summary": "Overrides for any subset of `DEFAULT_PKI_LIMITS`." }, { "name": "strict", "type": "boolean | undefined", "optional": true, "summary": "Escalate every diagnostic to a thrown `PkiError` with code `PKI_STRICT_DIAGNOSTIC`." }, { "name": "onDiagnostic", "type": "PkiDiagnosticHandler | undefined", "optional": true, "summary": "Receive every diagnostic instead of the default once-per-code `console.warn`." }, { "name": "issuerDer", "type": "Uint8Array | undefined", "optional": true, "summary": "The encoded `issuer` of the certificate being asked about." } ] }, { "name": "FingerprintAlgorithm", "kind": "type", "module": "src/types/hash-types.ts", "signature": "export type FingerprintAlgorithm = 'SHA-1' | 'SHA-256' | 'SHA-384' | 'SHA-512'", "summary": "The digest algorithms a fingerprint can use, named as Web Crypto names them.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "FormatFingerprintOptions", "kind": "type", "module": "src/types/hash-types.ts", "signature": "export interface FormatFingerprintOptions", "summary": "Options of `formatFingerprint`.", "throws": null, "params": null, "returns": null, "members": [ { "name": "separator", "type": "string | undefined", "optional": true, "summary": "Placed between octets; `':'` by default." }, { "name": "letterCase", "type": "'upper' | 'lower' | undefined", "optional": true, "summary": "`'upper'` (default) or `'lower'` hexadecimal digits." } ] }, { "name": "FreshestCrlExtension", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface FreshestCrlExtension extends ExtensionBase", "summary": "freshestCRL (RFC 5280 §4.2.1.15).", "throws": null, "params": null, "returns": null, "members": [ { "name": "oid", "type": "string", "optional": false, "summary": "The extnID, in dotted notation, e.g. `2.5.29.19` (basicConstraints)." }, { "name": "critical", "type": "boolean", "optional": false, "summary": "Whether the issuer marked the extension critical: a relying party that does not understand a critical extension must reject the certificate." }, { "name": "valueDer", "type": "Uint8Array", "optional": false, "summary": "The content of extnValue: the DER encoding of the extension value." }, { "name": "kind", "type": "'freshestCRL'", "optional": false, "summary": "Discriminant; `getExtension(cert, 'freshestCRL')` returns this type." }, { "name": "points", "type": "readonly DistributionPoint[]", "optional": false, "summary": "Where the delta CRLs are, in encoded order." } ] }, { "name": "GeneralName", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export type GeneralName = | OtherGeneralName | TextGeneralName | OpaqueGeneralName | DirectoryGeneralName | IpAddressGeneralName | RegisteredIdGeneralName", "summary": "One GeneralName (RFC 5280 §4.2.1.6), discriminated by `kind`.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "GeneralNameDescription", "kind": "type", "module": "src/build/build-structures.ts", "signature": "export type GeneralNameDescription = /** `[1]`, `[2]` and `[6]`: an IA5String, implicitly tagged, so it stays primitive. */ | { readonly kind: 'dNSName' | 'rfc822Name' | 'uniformResourceIdentifier'", "summary": "A GeneralName this encoder writes.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "GeneralSubtree", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface GeneralSubtree", "summary": "One permitted or excluded subtree of name constraints.", "throws": null, "params": null, "returns": null, "members": [ { "name": "base", "type": "GeneralName", "optional": false, "summary": "The name the subtree is rooted at; its `kind` decides how a candidate name is matched (RFC 5280 §4.2.1.10)." }, { "name": "minimum", "type": "number", "optional": false, "summary": "The minimum depth." }, { "name": "maximum", "type": "number | undefined", "optional": false, "summary": "The maximum depth; `undefined` when absent, which RFC 5280 requires." } ] }, { "name": "ImportPrivateKeyOptions", "kind": "type", "module": "src/types/key-types.ts", "signature": "export interface ImportPrivateKeyOptions extends PkiParseOptions", "summary": "Options of `importPrivateKey`: the parse options, and the algorithm the key will sign with when the key alone does not say.", "throws": null, "params": null, "returns": null, "members": [ { "name": "encodingRules", "type": "EncodingRules | undefined", "optional": true, "summary": "`'der'` (default) or `'ber'`." }, { "name": "limits", "type": "Partial | undefined", "optional": true, "summary": "Overrides for any subset of `DEFAULT_PKI_LIMITS`." }, { "name": "strict", "type": "boolean | undefined", "optional": true, "summary": "Escalate every diagnostic to a thrown `PkiError` with code `PKI_STRICT_DIAGNOSTIC`." }, { "name": "onDiagnostic", "type": "PkiDiagnosticHandler | undefined", "optional": true, "summary": "Receive every diagnostic instead of the default once-per-code `console.warn`." }, { "name": "algorithm", "type": "SignatureAlgorithm | undefined", "optional": true, "summary": "The algorithm the key signs with." } ] }, { "name": "InhibitAnyPolicyExtension", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface InhibitAnyPolicyExtension extends ExtensionBase", "summary": "inhibitAnyPolicy (RFC 5280 §4.2.1.14).", "throws": null, "params": null, "returns": null, "members": [ { "name": "oid", "type": "string", "optional": false, "summary": "The extnID, in dotted notation, e.g. `2.5.29.19` (basicConstraints)." }, { "name": "critical", "type": "boolean", "optional": false, "summary": "Whether the issuer marked the extension critical: a relying party that does not understand a critical extension must reject the certificate." }, { "name": "valueDer", "type": "Uint8Array", "optional": false, "summary": "The content of extnValue: the DER encoding of the extension value." }, { "name": "kind", "type": "'inhibitAnyPolicy'", "optional": false, "summary": "Discriminant; `getExtension(cert, 'inhibitAnyPolicy')` returns this type." }, { "name": "skipCerts", "type": "number", "optional": false, "summary": "How many further certificates may still rely on anyPolicy; 0 forbids it from this certificate on." } ] }, { "name": "IpAddressGeneralName", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface IpAddressGeneralName extends GeneralNameBase", "summary": "`iPAddress [7]`: an address, and in name constraints its mask.", "throws": null, "params": null, "returns": null, "members": [ { "name": "der", "type": "Uint8Array", "optional": false, "summary": "The exact encoding of the GeneralName, its context tag included." }, { "name": "kind", "type": "'iPAddress'", "optional": false, "summary": "Discriminant: switch on it to narrow a `GeneralName` to this alternative." }, { "name": "version", "type": "4 | 6", "optional": false, "summary": "4 or 6, decided by the octet count, not by anything the certificate asserts." }, { "name": "address", "type": "string", "optional": false, "summary": "Dotted decimal for IPv4, RFC 5952 text for IPv6." }, { "name": "mask", "type": "string | undefined", "optional": false, "summary": "The mask in the same notation, present only in name constraints." }, { "name": "bytes", "type": "Uint8Array", "optional": false, "summary": "The octets: 4 or 16, doubled with the mask in name constraints." } ] }, { "name": "IssuerAltNameExtension", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface IssuerAltNameExtension extends ExtensionBase", "summary": "issuerAltName (RFC 5280 §4.2.1.7).", "throws": null, "params": null, "returns": null, "members": [ { "name": "oid", "type": "string", "optional": false, "summary": "The extnID, in dotted notation, e.g. `2.5.29.19` (basicConstraints)." }, { "name": "critical", "type": "boolean", "optional": false, "summary": "Whether the issuer marked the extension critical: a relying party that does not understand a critical extension must reject the certificate." }, { "name": "valueDer", "type": "Uint8Array", "optional": false, "summary": "The content of extnValue: the DER encoding of the extension value." }, { "name": "kind", "type": "'issuerAltName'", "optional": false, "summary": "Discriminant; `getExtension(cert, 'issuerAltName')` returns this type." }, { "name": "names", "type": "readonly GeneralName[]", "optional": false, "summary": "Alternative names of the issuer, in encoded order." } ] }, { "name": "IssuingDistributionPoint", "kind": "type", "module": "src/types/crl-types.ts", "signature": "export interface IssuingDistributionPoint", "summary": "`issuingDistributionPoint` (RFC 5280 §5.2.5) — what a list declares itself to be about.", "throws": null, "params": null, "returns": null, "members": [ { "name": "fullName", "type": "readonly GeneralName[] | undefined", "optional": false, "summary": "`distributionPoint` as a `fullName`, or `undefined` when the field names nothing or is relative." }, { "name": "nameRelativeToCRLIssuer", "type": "RelativeDistinguishedName | undefined", "optional": false, "summary": "`distributionPoint` named relative to the CRL issuer; `undefined` when absent." }, { "name": "onlyContainsUserCerts", "type": "boolean", "optional": false, "summary": "The list covers only certificates that are not CAs." }, { "name": "onlyContainsCACerts", "type": "boolean", "optional": false, "summary": "The list covers only CA certificates." }, { "name": "onlySomeReasons", "type": "readonly ReasonFlag[] | undefined", "optional": false, "summary": "The revocation reasons this list covers; `undefined` means all of them, which is not the same as an empty list." }, { "name": "indirectCRL", "type": "boolean", "optional": false, "summary": "The list carries entries for CAs other than its own issuer, each named by a `certificateIssuer` entry extension." }, { "name": "onlyContainsAttributeCerts", "type": "boolean", "optional": false, "summary": "The list covers only attribute certificates (X.509 §12), which this library does not parse — so it covers nothing here." } ] }, { "name": "KEY_PURPOSES", "kind": "constant", "module": "src/path/path-purpose.ts", "signature": "export const KEY_PURPOSES: Readonly>", "summary": "The five purposes RFC 5280 §4.2.1.12 names, by the names it gives them.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "KEY_USAGE_BITS", "kind": "constant", "module": "src/build/build-structures.ts", "signature": "export const KEY_USAGE_BITS: ReadonlyMap = /*#__PURE__*/ readOnlyMap('KEY_USAGE_BITS', KEY_USAGE_ENTRIES)", "summary": "The `KeyUsage` bit positions of RFC 5280 §4.2.1.3, in their defined order.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "KeyUsageExtension", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface KeyUsageExtension extends ExtensionBase", "summary": "keyUsage (RFC 5280 §4.2.1.3).", "throws": null, "params": null, "returns": null, "members": [ { "name": "oid", "type": "string", "optional": false, "summary": "The extnID, in dotted notation, e.g. `2.5.29.19` (basicConstraints)." }, { "name": "critical", "type": "boolean", "optional": false, "summary": "Whether the issuer marked the extension critical: a relying party that does not understand a critical extension must reject the certificate." }, { "name": "valueDer", "type": "Uint8Array", "optional": false, "summary": "The content of extnValue: the DER encoding of the extension value." }, { "name": "kind", "type": "'keyUsage'", "optional": false, "summary": "Discriminant; `getExtension(cert, 'keyUsage')` returns this type." }, { "name": "usages", "type": "readonly KeyUsageName[]", "optional": false, "summary": "The asserted usages, in bit order." }, { "name": "bits", "type": "BitString", "optional": false, "summary": "The raw BIT STRING, for a bit beyond `decipherOnly` that `usages` cannot name." } ] }, { "name": "KeyUsageName", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export type KeyUsageName = | 'digitalSignature' | 'nonRepudiation' | 'keyEncipherment' | 'dataEncipherment' | 'keyAgreement' | 'keyCertSign' | 'cRLSign' | 'encipherOnly' | 'decipherOnly'", "summary": "The named bits of KeyUsage, in bit order (RFC 5280 §4.2.1.3).", "throws": null, "params": null, "returns": null, "members": null }, { "name": "MatchDnsNameOptions", "kind": "type", "module": "src/path/path-server-name.ts", "signature": "export interface MatchDnsNameOptions", "summary": "Options of matchDnsName.", "throws": null, "params": null, "returns": null, "members": [ { "name": "allowWildcards", "type": "boolean | undefined", "optional": true, "summary": "Let a wildcard match at all." } ] }, { "name": "MessageImprint", "kind": "type", "module": "src/types/tsp-types.ts", "signature": "export interface MessageImprint", "summary": "`MessageImprint` (RFC 3161 §2.4.1): the hash of the stamped data, and how it was computed.", "throws": null, "params": null, "returns": null, "members": [ { "name": "hashAlgorithm", "type": "AlgorithmIdentifier", "optional": false, "summary": "The digest algorithm." }, { "name": "hashedMessage", "type": "Uint8Array", "optional": false, "summary": "The digest." } ] }, { "name": "NameAttribute", "kind": "type", "module": "src/types/build-types.ts", "signature": "export interface NameAttribute", "summary": "One `AttributeTypeAndValue` of a distinguished name.", "throws": null, "params": null, "returns": null, "members": [ { "name": "type", "type": "string", "optional": false, "summary": "The attribute type OID, e.g. `2.5.4.3` for commonName." }, { "name": "value", "type": "string | Uint8Array", "optional": false, "summary": "The value." }, { "name": "stringType", "type": "'utf8' | 'printable' | 'ia5' | 'numeric' | undefined", "optional": true, "summary": "How a string value is encoded." } ] }, { "name": "NameConstraintsExtension", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface NameConstraintsExtension extends ExtensionBase", "summary": "nameConstraints (RFC 5280 §4.2.1.10).", "throws": null, "params": null, "returns": null, "members": [ { "name": "oid", "type": "string", "optional": false, "summary": "The extnID, in dotted notation, e.g. `2.5.29.19` (basicConstraints)." }, { "name": "critical", "type": "boolean", "optional": false, "summary": "Whether the issuer marked the extension critical: a relying party that does not understand a critical extension must reject the certificate." }, { "name": "valueDer", "type": "Uint8Array", "optional": false, "summary": "The content of extnValue: the DER encoding of the extension value." }, { "name": "kind", "type": "'nameConstraints'", "optional": false, "summary": "Discriminant; `getExtension(cert, 'nameConstraints')` returns this type." }, { "name": "permittedSubtrees", "type": "readonly GeneralSubtree[] | undefined", "optional": false, "summary": "The only subtrees names may fall in; `undefined` when the field is absent, which is not the same as an empty list." }, { "name": "excludedSubtrees", "type": "readonly GeneralSubtree[] | undefined", "optional": false, "summary": "The subtrees names must not fall in; `undefined` when the field is absent." } ] }, { "name": "NameDescription", "kind": "type", "module": "src/types/build-types.ts", "signature": "export type NameDescription = ReadonlyArray", "summary": "A distinguished name to build: one array per RDN, most significant first — `[[{ type: '2.5.4.6', value: 'US' }], [{ type: '2.5.4.3', value: 'Example CA' }]]` is `C=US, CN=Example CA`, with `US` a PrintableString and `Example CA` a UTF8String, as RFC 5280 Appendix A.1 defines them.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "NoticeReference", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface NoticeReference", "summary": "The organization and notice numbers of a user notice.", "throws": null, "params": null, "returns": null, "members": [ { "name": "organization", "type": "Asn1String", "optional": false, "summary": "The organization the notice numbers are defined by." }, { "name": "noticeNumbers", "type": "readonly bigint[]", "optional": false, "summary": "Which notices of that organization apply." } ] }, { "name": "OCSP_NONCE_OID", "kind": "constant", "module": "src/revocation/ocsp-check.ts", "signature": "export const OCSP_NONCE_OID = '1.3.6.1.5.5.7.48.1.2'", "summary": "`id-pkix-ocsp-nonce`, RFC 6960 §4.4.1.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "OID_REGISTRY", "kind": "constant", "module": "src/oid/oid-registry.ts", "signature": "export const OID_REGISTRY: readonly OidRegistryEntry[] = /*#__PURE__*/ buildRegistry(GROUPS)", "summary": "Every registered object identifier, grouped by area and frozen.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "OcspBasicResponse", "kind": "type", "module": "src/types/ocsp-types.ts", "signature": "export interface OcspBasicResponse", "summary": "A parsed `BasicOCSPResponse` (RFC 6960 §4.2.1).", "throws": null, "params": null, "returns": null, "members": [ { "name": "tbsDer", "type": "Uint8Array", "optional": false, "summary": "The `tbsResponseData` bytes the signature covers." }, { "name": "responderId", "type": "OcspResponderId", "optional": false, "summary": "How the responder named itself — by name, or by a hash of its key." }, { "name": "producedAt", "type": "PkiTime", "optional": false, "summary": "When the responder signed this response." }, { "name": "responses", "type": "readonly OcspSingleResponse[]", "optional": false, "summary": "One answer per certificate asked about, in the order the responder gave them." }, { "name": "signatureAlgorithm", "type": "AlgorithmIdentifier", "optional": false, "summary": "The algorithm the responder signed with." }, { "name": "signatureValue", "type": "{ readonly bytes: Uint8Array; readonly unusedBits: number }", "optional": false, "summary": "The signature over `tbsDer`, as a BIT STRING of whole octets." }, { "name": "certificates", "type": "readonly Uint8Array[]", "optional": false, "summary": "Certificates the responder attached to help a client build a path to it." }, { "name": "extensions", "type": "readonly Extension[]", "optional": false, "summary": "`responseExtensions`, decoded; the nonce echo lives here." } ] }, { "name": "OcspCertId", "kind": "type", "module": "src/types/ocsp-types.ts", "signature": "export interface OcspCertId", "summary": "The `CertID` of RFC 6960 §4.1.1: which certificate a question or an answer is about.", "throws": null, "params": null, "returns": null, "members": [ { "name": "hashAlgorithm", "type": "AlgorithmIdentifier", "optional": false, "summary": "The algorithm the two hashes were computed with, usually SHA-1 (RFC 6960 §4.1.1)." }, { "name": "issuerNameHash", "type": "Uint8Array", "optional": false, "summary": "Hash of the issuer's encoded `Name` — the DER of the field, not a rendering." }, { "name": "issuerKeyHash", "type": "Uint8Array", "optional": false, "summary": "Hash of the issuer's `subjectPublicKey` BIT STRING content, excluding the tag and the unused-bits octet." }, { "name": "serialNumber", "type": "SerialNumber", "optional": false, "summary": "The serial of the certificate being asked about." } ] }, { "name": "OcspCertStatus", "kind": "type", "module": "src/types/ocsp-types.ts", "signature": "export type OcspCertStatus = | { readonly kind: 'good' } | { readonly kind: 'revoked'", "summary": "One certificate's status (RFC 6960 §4.2.1).", "throws": null, "params": null, "returns": null, "members": null }, { "name": "OcspHashAlgorithm", "kind": "type", "module": "src/revocation/ocsp-request.ts", "signature": "export type OcspHashAlgorithm = 'SHA-1' | 'SHA-256'", "summary": "The digests RFC 6960 §4.3 lets a `CertID` use.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "OcspNoCheckExtension", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface OcspNoCheckExtension extends ExtensionBase", "summary": "id-pkix-ocsp-nocheck (RFC 6960 §4.2.2.2.1).", "throws": null, "params": null, "returns": null, "members": [ { "name": "oid", "type": "string", "optional": false, "summary": "The extnID, in dotted notation, e.g. `2.5.29.19` (basicConstraints)." }, { "name": "critical", "type": "boolean", "optional": false, "summary": "Whether the issuer marked the extension critical: a relying party that does not understand a critical extension must reject the certificate." }, { "name": "valueDer", "type": "Uint8Array", "optional": false, "summary": "The content of extnValue: the DER encoding of the extension value." }, { "name": "kind", "type": "'ocspNoCheck'", "optional": false, "summary": "Discriminant; `getExtension(cert, 'ocspNoCheck')` returns this type." } ] }, { "name": "OcspResponderId", "kind": "type", "module": "src/types/ocsp-types.ts", "signature": "export type OcspResponderId = /** `byName [1]`: the responder's `Name`, as its encoded DER. */ | { readonly kind: 'byName'", "summary": "How a responder identified itself (RFC 6960 §4.2.1).", "throws": null, "params": null, "returns": null, "members": null }, { "name": "OcspResponse", "kind": "type", "module": "src/types/ocsp-types.ts", "signature": "export interface OcspResponse", "summary": "A parsed `OCSPResponse` (RFC 6960 §4.2.1).", "throws": null, "params": null, "returns": null, "members": [ { "name": "der", "type": "Uint8Array", "optional": false, "summary": "The whole response, as a zero-copy view of the input." }, { "name": "status", "type": "OcspResponseStatus", "optional": false, "summary": "`successful`, or one of the six ways a responder declines to answer." }, { "name": "basicResponse", "type": "OcspBasicResponse | undefined", "optional": false, "summary": "Present only when `status` is `'successful'`; the protocol carries no body otherwise." }, { "name": "diagnostics", "type": "readonly PkiDiagnostic[]", "optional": false, "summary": "Profile concerns found while reading, in encoded order." } ] }, { "name": "OcspResponseStatus", "kind": "type", "module": "src/types/ocsp-types.ts", "signature": "export type OcspResponseStatus = | 'successful' | 'malformedRequest' | 'internalError' | 'tryLater' | 'sigRequired' | 'unauthorized'", "summary": "The `OCSPResponseStatus` of RFC 6960 §4.2.1.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "OcspSingleResponse", "kind": "type", "module": "src/types/ocsp-types.ts", "signature": "export interface OcspSingleResponse", "summary": "One `SingleResponse` (RFC 6960 §4.2.1).", "throws": null, "params": null, "returns": null, "members": [ { "name": "certId", "type": "OcspCertId", "optional": false, "summary": "Which certificate this answer is about." }, { "name": "status", "type": "OcspCertStatus", "optional": false, "summary": "Good, revoked or unknown — three states, and unknown is not good." }, { "name": "thisUpdate", "type": "PkiTime", "optional": false, "summary": "When the responder knew this status to be correct." }, { "name": "nextUpdate", "type": "PkiTime | undefined", "optional": false, "summary": "When newer information will be available; absent means the responder has no successor to promise." }, { "name": "extensions", "type": "readonly Extension[]", "optional": false, "summary": "`singleExtensions`, decoded; empty when there are none." } ] }, { "name": "OctetPublicKeyInfo", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface OctetPublicKeyInfo extends PublicKeyInfoBase", "summary": "A key whose subjectPublicKey is the raw key octets (RFC 8410; ML-DSA: RFC 9881, key sizes of FIPS 204).", "throws": null, "params": null, "returns": null, "members": [ { "name": "algorithm", "type": "AlgorithmIdentifier", "optional": false, "summary": "The algorithm the key belongs to, with its parameters; `kind` is pkinative's reading of it." }, { "name": "publicKey", "type": "BitString", "optional": false, "summary": "The subjectPublicKey BIT STRING." }, { "name": "der", "type": "Uint8Array", "optional": false, "summary": "The exact encoding of the SubjectPublicKeyInfo." }, { "name": "kind", "type": "'ed25519' | 'ed448' | 'x25519' | 'x448' | 'ml-dsa-44' | 'ml-dsa-65' | 'ml-dsa-87'", "optional": false, "summary": "Discriminant, which also names the algorithm; switch on it to narrow a `SubjectPublicKeyInfo`." }, { "name": "key", "type": "Uint8Array", "optional": false, "summary": "The raw key octets: the subjectPublicKey content, with no structure of its own." } ] }, { "name": "OidRegistryEntry", "kind": "type", "module": "src/oid/oid-registry.ts", "signature": "export interface OidRegistryEntry", "summary": "One registered object identifier.", "throws": null, "params": null, "returns": null, "members": [ { "name": "oid", "type": "string", "optional": false, "summary": "Dotted-decimal form, e.g. `2.5.29.17`." }, { "name": "name", "type": "string", "optional": false, "summary": "Display name, e.g. `subjectAltName`." }, { "name": "standard", "type": "string", "optional": false, "summary": "The defining standard, e.g. `RFC 5280`." } ] }, { "name": "OpaqueGeneralName", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface OpaqueGeneralName extends GeneralNameBase", "summary": "`x400Address [3]` and `ediPartyName [5]`, kept as their tagged node.", "throws": null, "params": null, "returns": null, "members": [ { "name": "der", "type": "Uint8Array", "optional": false, "summary": "The exact encoding of the GeneralName, its context tag included." }, { "name": "kind", "type": "'x400Address' | 'ediPartyName'", "optional": false, "summary": "Discriminant, which also says which of the two undecoded forms this is." }, { "name": "value", "type": "Asn1Node", "optional": false, "summary": "The tagged node, undecoded: neither form has a profile RFC 5280 defines." } ] }, { "name": "OpenPkcs12Options", "kind": "type", "module": "src/verify/verify-pkcs12.ts", "signature": "export interface OpenPkcs12Options extends PkiParseOptions", "summary": "What `openPkcs12` takes.", "throws": null, "params": null, "returns": null, "members": [ { "name": "encodingRules", "type": "EncodingRules | undefined", "optional": true, "summary": "`'der'` (default) or `'ber'`." }, { "name": "limits", "type": "Partial | undefined", "optional": true, "summary": "Overrides for any subset of `DEFAULT_PKI_LIMITS`." }, { "name": "strict", "type": "boolean | undefined", "optional": true, "summary": "Escalate every diagnostic to a thrown `PkiError` with code `PKI_STRICT_DIAGNOSTIC`." }, { "name": "onDiagnostic", "type": "PkiDiagnosticHandler | undefined", "optional": true, "summary": "Receive every diagnostic instead of the default once-per-code `console.warn`." }, { "name": "password", "type": "Uint8Array | string", "optional": false, "summary": "The password." }, { "name": "allowUnverifiedIntegrity", "type": "boolean | undefined", "optional": true, "summary": "Accept a container whose integrity cannot be checked — a MAC keyed with RFC 7292 Appendix B, which is most files written before OpenSSL 3.4, or no MAC at all — and report it `valid`." }, { "name": "rsaAlgorithm", "type": "Extract | undefined", "optional": true, "summary": "What an RSA key will sign with." } ] }, { "name": "OpenPkcs12Report", "kind": "type", "module": "src/verify/verify-pkcs12.ts", "signature": "export interface OpenPkcs12Report", "summary": "What `openPkcs12` found.", "throws": null, "params": null, "returns": null, "members": [ { "name": "valid", "type": "boolean", "optional": false, "summary": "Whether everything was opened, and its integrity verified or explicitly waived." }, { "name": "integrity", "type": "'verified' | 'unverified' | 'mismatch'", "optional": false, "summary": "`verified` for a matching RFC 9579 MAC; `unverified` when it could not be checked; `mismatch` when it did not match, in which case nothing was decrypted." }, { "name": "pkcs12", "type": "Pkcs12 | undefined", "optional": false, "summary": "The container as parsed, or `undefined` when it could not be." }, { "name": "keys", "type": "readonly Pkcs12Key[]", "optional": false, "summary": "Every private key, in encoded order." }, { "name": "certificates", "type": "readonly Certificate[]", "optional": false, "summary": "Every certificate that parsed, in encoded order — the keys' own and any chain the file carries." }, { "name": "crls", "type": "readonly Uint8Array[]", "optional": false, "summary": "Every CRL bag's DER, in encoded order." }, { "name": "reasons", "type": "readonly PkiReason[]", "optional": false, "summary": "Why `valid` is false; empty when it is true." } ] }, { "name": "OtherGeneralName", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface OtherGeneralName extends GeneralNameBase", "summary": "`otherName [0]`: a type OID and a value of that type.", "throws": null, "params": null, "returns": null, "members": [ { "name": "der", "type": "Uint8Array", "optional": false, "summary": "The exact encoding of the GeneralName, its context tag included." }, { "name": "kind", "type": "'otherName'", "optional": false, "summary": "Discriminant: switch on it to narrow a `GeneralName` to this alternative." }, { "name": "typeId", "type": "string", "optional": false, "summary": "The OID that says how to read `value`." }, { "name": "value", "type": "Asn1Node", "optional": false, "summary": "The value inside the explicit `[0]` tag." } ] }, { "name": "ParseCertificateOptions", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface ParseCertificateOptions extends PkiParseOptions", "summary": "Options of `parseCertificate` and `parseCertificationRequest`.", "throws": null, "params": null, "returns": null, "members": [ { "name": "encodingRules", "type": "EncodingRules | undefined", "optional": true, "summary": "`'der'` (default) or `'ber'`." }, { "name": "limits", "type": "Partial | undefined", "optional": true, "summary": "Overrides for any subset of `DEFAULT_PKI_LIMITS`." }, { "name": "strict", "type": "boolean | undefined", "optional": true, "summary": "Escalate every diagnostic to a thrown `PkiError` with code `PKI_STRICT_DIAGNOSTIC`." }, { "name": "onDiagnostic", "type": "PkiDiagnosticHandler | undefined", "optional": true, "summary": "Receive every diagnostic instead of the default once-per-code `console.warn`." }, { "name": "decodeExtensions", "type": "boolean | undefined", "optional": true, "summary": "Decode every recognised extension (default `true`)." } ] }, { "name": "ParseSignedDataOptions", "kind": "type", "module": "src/types/cms-types.ts", "signature": "export interface ParseSignedDataOptions extends PkiParseOptions", "summary": "What `parseSignedData` takes beyond the ordinary parse options.", "throws": null, "params": null, "returns": null, "members": [ { "name": "encodingRules", "type": "EncodingRules | undefined", "optional": true, "summary": "`'der'` (default) or `'ber'`." }, { "name": "limits", "type": "Partial | undefined", "optional": true, "summary": "Overrides for any subset of `DEFAULT_PKI_LIMITS`." }, { "name": "strict", "type": "boolean | undefined", "optional": true, "summary": "Escalate every diagnostic to a thrown `PkiError` with code `PKI_STRICT_DIAGNOSTIC`." }, { "name": "onDiagnostic", "type": "PkiDiagnosticHandler | undefined", "optional": true, "summary": "Receive every diagnostic instead of the default once-per-code `console.warn`." }, { "name": "allowTrailingData", "type": "boolean | undefined", "optional": true, "summary": "Accept bytes after the `ContentInfo`, and ignore them." } ] }, { "name": "PasswordEncryption", "kind": "type", "module": "src/types/key-types.ts", "signature": "export interface PasswordEncryption", "summary": "A password-based encryption scheme as found, whether or not pkinative will open it.", "throws": null, "params": null, "returns": null, "members": [ { "name": "algorithm", "type": "AlgorithmIdentifier", "optional": false, "summary": "The scheme, as encoded — PBES2's OID, or a PKCS#12 / PKCS#5 v1.5 scheme's." }, { "name": "pbes2", "type": "Pbes2Parameters | undefined", "optional": false, "summary": "The PBES2 parameters, or `undefined` when the scheme is one pkinative refuses." }, { "name": "scheme", "type": "string", "optional": false, "summary": "The scheme in words — `PBES2 (PBKDF2 with HMAC-SHA-256, AES-256-CBC)`, or the name of a refused one such as `pbeWithSHAAnd3-KeyTripleDES-CBC` — so a tool can say what a file is protected with before anyone types a password." } ] }, { "name": "Pbes2Parameters", "kind": "type", "module": "src/types/key-types.ts", "signature": "export interface Pbes2Parameters", "summary": "PBES2 (RFC 8018 §6.2) with PBKDF2 and AES-CBC — the one password-based scheme pkinative opens.", "throws": null, "params": null, "returns": null, "members": [ { "name": "salt", "type": "Uint8Array", "optional": false, "summary": "PBKDF2's salt, as a zero-copy view." }, { "name": "iterations", "type": "number", "optional": false, "summary": "PBKDF2's iteration count, already checked against `maxKdfIterations`." }, { "name": "prf", "type": "Pbkdf2Prf", "optional": false, "summary": "PBKDF2's PRF; `SHA-1` when the parameters omit it, as RFC 8018 §A.2 defaults." }, { "name": "keyBits", "type": "128 | 192 | 256", "optional": false, "summary": "The AES key size, in bits, from the cipher OID (and equal to PBKDF2's `keyLength` when that is present)." }, { "name": "iv", "type": "Uint8Array", "optional": false, "summary": "AES-CBC's initialisation vector, 16 octets." }, { "name": "cipherOid", "type": "string", "optional": false, "summary": "The cipher OID — `aes128-CBC-PAD`, `aes192-CBC-PAD` or `aes256-CBC-PAD`." } ] }, { "name": "Pbkdf2Prf", "kind": "type", "module": "src/types/key-types.ts", "signature": "export type Pbkdf2Prf = SignatureHash", "summary": "The PBKDF2 pseudo-random functions pkinative derives with — the HMACs Web Crypto implements.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "PemBlock", "kind": "type", "module": "src/types/pem-types.ts", "signature": "export interface PemBlock", "summary": "One `-----BEGIN label-----` … `-----END label-----` block.", "throws": null, "params": null, "returns": null, "members": [ { "name": "label", "type": "string", "optional": false, "summary": "The label, e.g. `CERTIFICATE` (may be empty, as RFC 7468 allows)." }, { "name": "bytes", "type": "Uint8Array", "optional": false, "summary": "The decoded binary payload." }, { "name": "headers", "type": "readonly (readonly [name: string, value: string])[]", "optional": false, "summary": "RFC 1421 encapsulated headers, in order — only ever non-empty in lax mode." }, { "name": "offset", "type": "number", "optional": false, "summary": "Character offset of the `-----BEGIN` line in the text." } ] }, { "name": "Pkcs12", "kind": "type", "module": "src/types/key-types.ts", "signature": "export interface Pkcs12", "summary": "RFC 7292 §4 `PFX`, read but not opened.", "throws": null, "params": null, "returns": null, "members": [ { "name": "der", "type": "Uint8Array", "optional": false, "summary": "The whole structure, as a zero-copy view of the input." }, { "name": "version", "type": "3", "optional": false, "summary": "Always 3; any other version is refused." }, { "name": "authenticatedSafe", "type": "Uint8Array", "optional": false, "summary": "The bytes the MAC covers: the content of the `authSafe` data's OCTET STRING." }, { "name": "contents", "type": "readonly SafeContentsInfo[]", "optional": false, "summary": "The AuthenticatedSafe's entries, in encoded order." }, { "name": "mac", "type": "Pkcs12Mac | undefined", "optional": false, "summary": "The `macData`, or `undefined` when the file carries none." }, { "name": "diagnostics", "type": "readonly PkiDiagnostic[]", "optional": false, "summary": "Profile concerns found while reading, in encoded order." } ] }, { "name": "Pkcs12Key", "kind": "type", "module": "src/verify/verify-pkcs12.ts", "signature": "export interface Pkcs12Key", "summary": "One private key the container holds, and what became of it.", "throws": null, "params": null, "returns": null, "members": [ { "name": "path", "type": "string", "optional": false, "summary": "Where it was, e.g. `authSafe[1].bags[0]`." }, { "name": "localKeyId", "type": "Uint8Array | undefined", "optional": false, "summary": "Its `localKeyId`, when it has one." }, { "name": "friendlyName", "type": "string | undefined", "optional": false, "summary": "Its `friendlyName`, when it has one." }, { "name": "certificate", "type": "Certificate | undefined", "optional": false, "summary": "The certificate sharing its `localKeyId`, when there is one." }, { "name": "signingKey", "type": "SigningKey | undefined", "optional": false, "summary": "The key, non-extractable, ready for `createCertificate` or `createSignedData`; `undefined` when it could not be opened — the reasons say why." } ] }, { "name": "Pkcs12Mac", "kind": "type", "module": "src/types/key-types.ts", "signature": "export interface Pkcs12Mac", "summary": "A PKCS#12 `MacData`, described.", "throws": null, "params": null, "returns": null, "members": [ { "name": "kind", "type": "Pkcs12MacKind", "optional": false, "summary": "Which construction." }, { "name": "algorithm", "type": "AlgorithmIdentifier", "optional": false, "summary": "The `digestAlgorithm` of the `DigestInfo`, as encoded — `id-PBMAC1` under RFC 9579." }, { "name": "mac", "type": "Uint8Array", "optional": false, "summary": "The MAC octets." }, { "name": "salt", "type": "Uint8Array", "optional": false, "summary": "`macSalt`." }, { "name": "iterations", "type": "number", "optional": false, "summary": "`iterations`, defaulting to 1." }, { "name": "pbmac1", "type": "{", "optional": false, "summary": "Under PBMAC1, what the MAC key is derived with and which HMAC it keys; otherwise `undefined`." } ] }, { "name": "Pkcs12MacKind", "kind": "type", "module": "src/types/key-types.ts", "signature": "export type Pkcs12MacKind = /** RFC 9579 PBMAC1: HMAC under a PBKDF2 key. Verifiable. */ | 'pbmac1' /** RFC 7292 §5.1 with the Appendix B KDF — iterated hashing with byte arithmetic over the password. Not verifiable here, in any version. */ | 'pkcs12-kdf'", "summary": "The two ways RFC 7292 and RFC 9579 compute a PKCS#12 MAC — one of which pkinative cannot check.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "PkiBaseErrorCode", "kind": "type", "module": "src/types/pki-errors.ts", "signature": "export type PkiBaseErrorCode = | 'PKI_INVALID_INPUT' // the input has the wrong type (not a Uint8Array, not a string) | 'PKI_INVALID_OPTION' // an option value fails validation | 'PKI_API_MISUSE' // a caller contract violation (e.g. DER-encoding an indefinite-length node) | 'PKI_STRICT_DIAGNOSTIC' // strict: true escalated a diagnostic | 'PKI_INTERNAL'", "summary": "Codes carried by the base PkiError (usage and invariant faults).", "throws": null, "params": null, "returns": null, "members": null }, { "name": "PkiBuildOptions", "kind": "type", "module": "src/types/build-types.ts", "signature": "export interface PkiBuildOptions", "summary": "Options of every function that builds a structure from a description — the certificate, the request, the SignedData and the encoders they share.", "throws": null, "params": null, "returns": null, "members": [ { "name": "limits", "type": "Partial | undefined", "optional": true, "summary": "Bounds on what is built; each function names under `@throws` the limits that apply to it." } ] }, { "name": "PkiCertificateError", "kind": "class", "module": "src/types/pki-errors.ts", "signature": "export class PkiCertificateError extends PkiError", "summary": "The DER is well formed but does not match the RFC 5280 certificate structure.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "PkiCertificateErrorCode", "kind": "type", "module": "src/types/pki-errors.ts", "signature": "export type PkiCertificateErrorCode = | 'PKI_X509_STRUCTURE_INVALID' // the certificate does not match the RFC 5280 ASN.1 module (CWE-1286) | 'PKI_X509_VERSION_INVALID' // a version other than v1, v2 or v3 (CWE-1286) | 'PKI_X509_NAME_INVALID' // a malformed distinguished name (CWE-1286) | 'PKI_X509_VALIDITY_INVALID' // a malformed validity period (CWE-1286) | 'PKI_X509_SPKI_INVALID' // a malformed subject public key info (CWE-1286) | 'PKI_X509_UNIQUE_ID_INVALID' // a malformed or misplaced unique identifier (CWE-1286) | 'PKI_X509_EXTENSIONS_EMPTY' // an extensions field with no extension (CWE-1286) | 'PKI_X509_EXTENSION_DUPLICATE' // the same extension OID twice (CWE-694) | 'PKI_X509_EXTENSION_MALFORMED' // a recognised extension whose value does not match its definition (CWE-1286) | 'PKI_X509_GENERAL_NAME_INVALID'", "summary": "Codes carried by PkiCertificateError: the RFC 5280 certificate structure.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "PkiCmsError", "kind": "class", "module": "src/types/pki-errors.ts", "signature": "export class PkiCmsError extends PkiError", "summary": "The DER is well formed but does not match the RFC 5652 CMS or RFC 3161 timestamp structure it was read as.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "PkiCmsErrorCode", "kind": "type", "module": "src/types/pki-errors.ts", "signature": "export type PkiCmsErrorCode = | 'PKI_CMS_STRUCTURE_INVALID' // the value does not match the RFC 5652 or RFC 3161 ASN.1 module (CWE-1286) | 'PKI_CMS_CONTENT_TYPE_UNEXPECTED' // a ContentInfo of another type than the one asked for, e.g. enveloped-data (CWE-843) | 'PKI_CMS_VERSION_UNSUPPORTED' // a SignedData or TSTInfo version the syntax does not define (CWE-1286) | 'PKI_CMS_CONTENT_NOT_OCTET_STRING'", "summary": "Codes carried by PkiCmsError: the DER is well formed but is not the RFC 5652 or RFC 3161 structure it was read as.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "PkiCryptoError", "kind": "class", "module": "src/types/pki-errors.ts", "signature": "export class PkiCryptoError extends PkiError", "summary": "pkinative could not decide whether a signature is valid.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "PkiCryptoErrorCode", "kind": "type", "module": "src/types/pki-errors.ts", "signature": "export type PkiCryptoErrorCode = | 'PKI_CRYPTO_UNAVAILABLE' // the host exposes no crypto.subtle to verify with (CWE-693) | 'PKI_CRYPTO_ALGORITHM_UNSUPPORTED' // pkinative maps no Web Crypto algorithm to this signature OID (CWE-757) | 'PKI_CRYPTO_KEY_UNSUPPORTED' // the host refused to import the public key, or its kind has no Web Crypto form (CWE-757) | 'PKI_CRYPTO_ALGORITHM_REFUSED' // pkinative can compute this signature but will not treat it as evidence (CWE-327) | 'PKI_CRYPTO_DECRYPTION_FAILED'", "summary": "Codes carried by PkiCryptoError: pkinative could not **decide**.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "PkiDiagnostic", "kind": "type", "module": "src/types/pki-types.ts", "signature": "export interface PkiDiagnostic", "summary": "One non-fatal conformance concern.", "throws": null, "params": null, "returns": null, "members": [ { "name": "code", "type": "PkiDiagnosticCode", "optional": false, "summary": "The stable identifier." }, { "name": "severity", "type": "PkiDiagnosticSeverity", "optional": false, "summary": "How much it matters: `'warning'` for something a strict reader would refuse, `'info'` for something merely worth knowing." }, { "name": "message", "type": "string", "optional": false, "summary": "What was found and what it means, without the `pkinative: ` prefix." }, { "name": "standard", "type": "string", "optional": false, "summary": "The clause the concern cites, e.g. `RFC 5280 §4.1.2.2`." }, { "name": "path", "type": "string", "optional": false, "summary": "Where in the structure, e.g. `tbsCertificate.serialNumber`; empty for the whole input." }, { "name": "offset", "type": "number | undefined", "optional": false, "summary": "Absolute byte offset of the value concerned, when known." } ] }, { "name": "PkiDiagnosticCode", "kind": "type", "module": "src/types/pki-types.ts", "signature": "export type PkiDiagnosticCode", "summary": "Every diagnostic code.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "PkiDiagnosticHandler", "kind": "type", "module": "src/types/pki-types.ts", "signature": "export type PkiDiagnosticHandler = (diagnostic: PkiDiagnostic) => void", "summary": "Receives every diagnostic of an operation; replaces the default `console.warn` sink.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "PkiDiagnosticSeverity", "kind": "type", "module": "src/types/pki-types.ts", "signature": "export type PkiDiagnosticSeverity = 'warning' | 'info'", "summary": "`warning`: a profile violation a verifier may refuse.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "PkiEncodingError", "kind": "class", "module": "src/types/pki-errors.ts", "signature": "export class PkiEncodingError extends PkiError", "summary": "The input violates the syntax of X.690, of an OBJECT IDENTIFIER or of RFC 7468.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "PkiEncodingErrorCode", "kind": "type", "module": "src/types/pki-errors.ts", "signature": "export type PkiEncodingErrorCode = | 'PKI_ASN1_TRUNCATED' // a header or content runs past the end of the input (CWE-125) | 'PKI_ASN1_TAG_INVALID' // a high-tag-number form is non-minimal or overflows (CWE-1286) | 'PKI_ASN1_LENGTH_INVALID' // the reserved length octet 0xFF (CWE-1286) | 'PKI_ASN1_LENGTH_NON_MINIMAL' // DER: a length not in its shortest form (CWE-436) | 'PKI_ASN1_LENGTH_OVERFLOW' // a declared length exceeds its enclosing value (CWE-130) | 'PKI_ASN1_INDEFINITE_LENGTH_FORBIDDEN' // DER: the indefinite length form (CWE-436) | 'PKI_ASN1_CONSTRUCTED_STRING_FORBIDDEN' // DER: a string type in constructed form (CWE-436) | 'PKI_ASN1_CONSTRUCTED_FORM_INVALID' // a universal type in the wrong form (CWE-1286) | 'PKI_ASN1_EOC_UNEXPECTED' // an end-of-contents marker where none may appear (CWE-1286) | 'PKI_ASN1_TRAILING_DATA' // bytes after the outermost value (CWE-436) | 'PKI_ASN1_UNEXPECTED_TAG' // a value of another type where one type is required (CWE-1286) | 'PKI_ASN1_BOOLEAN_INVALID' // a BOOLEAN that is not one octet, or not 0x00/0xFF under DER (CWE-436) | 'PKI_ASN1_INTEGER_INVALID' // an empty or non-minimal INTEGER (CWE-436) | 'PKI_ASN1_INTEGER_UNREPRESENTABLE' // an IN…", "summary": "Codes carried by PkiEncodingError: X.690, OID and RFC 7468 syntax.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "PkiError", "kind": "class", "module": "src/types/pki-errors.ts", "signature": "export class PkiError extends Error", "summary": "Base class for every error thrown by pkinative.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "PkiErrorCode", "kind": "type", "module": "src/types/pki-errors.ts", "signature": "export type PkiErrorCode = | PkiBaseErrorCode | PkiEncodingErrorCode | PkiCertificateErrorCode | PkiLimitErrorCode | PkiCryptoErrorCode | PkiCmsErrorCode | PkiKeyErrorCode", "summary": "Every stable error code pkinative can throw.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "PkiKeyError", "kind": "class", "module": "src/types/pki-errors.ts", "signature": "export class PkiKeyError extends PkiError", "summary": "A PKCS#8 or PKCS#12 structure pkinative cannot or will not open.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "PkiKeyErrorCode", "kind": "type", "module": "src/types/pki-errors.ts", "signature": "export type PkiKeyErrorCode = | 'PKI_KEY_STRUCTURE_INVALID' // the value does not match the RFC 5958 or RFC 7292 ASN.1 module (CWE-1286) | 'PKI_KEY_VERSION_UNSUPPORTED' // a PrivateKeyInfo or PFX version the syntax does not define (CWE-1286) | 'PKI_KEY_ENCRYPTION_UNSUPPORTED' // a password scheme other than PBES2 + PBKDF2 + AES-CBC, e.g. RFC 7292 Appendix B, RC2, 3DES (CWE-327) | 'PKI_KEY_MAC_UNSUPPORTED'", "summary": "Codes carried by PkiKeyError: a PKCS#8 or PKCS#12 structure that is well-formed DER but not what pkinative will open.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "PkiLimitError", "kind": "class", "module": "src/types/pki-errors.ts", "signature": "export class PkiLimitError extends PkiError", "summary": "A configured security bound from PkiLimits was exceeded, or the override is invalid.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "PkiLimitErrorCode", "kind": "type", "module": "src/types/pki-errors.ts", "signature": "export type PkiLimitErrorCode = | 'PKI_LIMIT_EXCEEDED' // a configured PkiLimits bound was exceeded (CWE-400) | 'PKI_LIMIT_INVALID'", "summary": "Codes carried by PkiLimitError.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "PkiLimits", "kind": "type", "module": "src/types/pki-types.ts", "signature": "export interface PkiLimits", "summary": "The named security bounds every loop over untrusted input consults.", "throws": null, "params": null, "returns": null, "members": [ { "name": "maxInputBytes", "type": "number", "optional": false, "summary": "Maximum size of one input, in bytes for DER or characters for PEM." }, { "name": "maxDepth", "type": "number", "optional": false, "summary": "Maximum nesting depth of constructed ASN.1 values." }, { "name": "maxNodes", "type": "number", "optional": false, "summary": "Maximum number of ASN.1 values decoded from one input." }, { "name": "maxIntegerBytes", "type": "number", "optional": false, "summary": "Maximum content length of one INTEGER, in bytes." }, { "name": "maxOidBytes", "type": "number", "optional": false, "summary": "Maximum content length of one OBJECT IDENTIFIER, in bytes." }, { "name": "maxBerSegments", "type": "number", "optional": false, "summary": "Maximum number of segments joined from one BER constructed string." }, { "name": "maxPemBlocks", "type": "number", "optional": false, "summary": "Maximum number of PEM blocks read from one text." }, { "name": "maxExtensions", "type": "number", "optional": false, "summary": "Maximum number of extensions in one certificate." }, { "name": "maxGeneralNames", "type": "number", "optional": false, "summary": "Maximum number of GeneralName entries in one field." }, { "name": "maxNameAttributes", "type": "number", "optional": false, "summary": "Maximum number of attributes in one distinguished name." }, { "name": "maxPolicies", "type": "number", "optional": false, "summary": "Maximum number of policies or policy mappings in one extension." }, { "name": "maxChainLength", "type": "number", "optional": false, "summary": "Maximum number of certificates a certification path may hold." }, { "name": "maxPolicyNodes", "type": "number", "optional": false, "summary": "Maximum number of live nodes in the RFC 5280 valid_policy_tree." }, { "name": "maxRevokedCertificates", "type": "number", "optional": false, "summary": "Maximum number of entries walked in one CRL revokedCertificates list." }, { "name": "maxOcspSingleResponses", "type": "number", "optional": false, "summary": "Maximum number of SingleResponse entries in one OCSP response." }, { "name": "maxPathsExplored", "type": "number", "optional": false, "summary": "Maximum number of candidate paths explored while building one." }, { "name": "maxSignerInfos", "type": "number", "optional": false, "summary": "Maximum number of SignerInfo entries in one SignedData — each costs a signature verification." }, { "name": "maxAttributes", "type": "number", "optional": false, "summary": "Maximum number of attributes in one attribute set — a CMS signer's signed or unsigned set, a PKCS#8 key's, a PKCS#12 bag's." }, { "name": "maxCmsCertificatesAndCrls", "type": "number", "optional": false, "summary": "Maximum number of certificates plus revocation entries a SignedData carries — the signer search walks them." }, { "name": "maxKdfIterations", "type": "number", "optional": false, "summary": "Maximum PBKDF2 iteration count honoured in one derivation — a count the file declares, and the host then runs." }, { "name": "maxPkcs12Bags", "type": "number", "optional": false, "summary": "Maximum number of SafeBags read from one PKCS#12, across every SafeContents." }, { "name": "maxPkcs12KdfIterations", "type": "number", "optional": false, "summary": "Maximum PBKDF2 iterations one PKCS#12 costs in total — its PBMAC1 MAC, every encrypted SafeContents and every shrouded key together." } ] }, { "name": "PkiParseOptions", "kind": "type", "module": "src/types/pki-types.ts", "signature": "export interface PkiParseOptions", "summary": "Options shared by every parsing function.", "throws": null, "params": null, "returns": null, "members": [ { "name": "encodingRules", "type": "EncodingRules | undefined", "optional": true, "summary": "`'der'` (default) or `'ber'`." }, { "name": "limits", "type": "Partial | undefined", "optional": true, "summary": "Overrides for any subset of `DEFAULT_PKI_LIMITS`." }, { "name": "strict", "type": "boolean | undefined", "optional": true, "summary": "Escalate every diagnostic to a thrown `PkiError` with code `PKI_STRICT_DIAGNOSTIC`." }, { "name": "onDiagnostic", "type": "PkiDiagnosticHandler | undefined", "optional": true, "summary": "Receive every diagnostic instead of the default once-per-code `console.warn`." } ] }, { "name": "PkiReason", "kind": "type", "module": "src/types/pki-reasons.ts", "signature": "export interface PkiReason", "summary": "One reason a validation said no.", "throws": null, "params": null, "returns": null, "members": [ { "name": "code", "type": "PkiReasonCode", "optional": false, "summary": "Which reason this is." }, { "name": "message", "type": "string", "optional": false, "summary": "What happened and what the caller can do about it." }, { "name": "standard", "type": "string", "optional": false, "summary": "The clause that decides the case, e.g. `RFC 5280 §6.1.3`." }, { "name": "path", "type": "string", "optional": false, "summary": "Where in the input, e.g. `path[1].tbsCertificate.validity`." }, { "name": "errorCode", "type": "string | undefined", "optional": true, "summary": "For `PKI_REASON_INPUT_MALFORMED` only: the code that would have been thrown." }, { "name": "limit", "type": "string | undefined", "optional": true, "summary": "For `PKI_REASON_LIMIT_EXCEEDED` only: the `PkiLimits` key that stopped the search." } ] }, { "name": "PkiReasonCode", "kind": "type", "module": "src/types/pki-reasons.ts", "signature": "export type PkiReasonCode = // ── The input, wrapped rather than duplicated ── /** The bytes are not the structure they claim to be. `errorCode` carries the `PkiErrorCode` that would have been thrown. */ | 'PKI_REASON_INPUT_MALFORMED' // ── The certificate, on its own ── /** The validation instant is before `notBefore`. */ | 'PKI_REASON_NOT_YET_VALID' /** The validation instant is after `notAfter`. */ | 'PKI_REASON_EXPIRED' /** No name in the certificate matches the host or address the caller asked about. */ | 'PKI_REASON_NAME_MISMATCH' /** A certificate on the path does not permit the purpose the caller needs (RFC 5280 §4.2.1.12). */ | 'PKI_REASON_PURPOSE_NOT_PERMITTED' /** A critical extension no implementation here recognises", "summary": "Why a validation said no.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "PkiTime", "kind": "type", "module": "src/types/asn1-types.ts", "signature": "export interface PkiTime", "summary": "A decoded time: the instant, and the text it was decoded from.", "throws": null, "params": null, "returns": null, "members": [ { "name": "type", "type": "TimeType", "optional": false, "summary": "Which type it was encoded as." }, { "name": "epochMilliseconds", "type": "number", "optional": false, "summary": "Milliseconds since 1970-01-01T00:00:00Z (negative before 1970)." }, { "name": "text", "type": "string", "optional": false, "summary": "The time exactly as encoded, e.g. `250101000000Z`." } ] }, { "name": "PolicyConstraintsExtension", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface PolicyConstraintsExtension extends ExtensionBase", "summary": "policyConstraints (RFC 5280 §4.2.1.11).", "throws": null, "params": null, "returns": null, "members": [ { "name": "oid", "type": "string", "optional": false, "summary": "The extnID, in dotted notation, e.g. `2.5.29.19` (basicConstraints)." }, { "name": "critical", "type": "boolean", "optional": false, "summary": "Whether the issuer marked the extension critical: a relying party that does not understand a critical extension must reject the certificate." }, { "name": "valueDer", "type": "Uint8Array", "optional": false, "summary": "The content of extnValue: the DER encoding of the extension value." }, { "name": "kind", "type": "'policyConstraints'", "optional": false, "summary": "Discriminant; `getExtension(cert, 'policyConstraints')` returns this type." }, { "name": "requireExplicitPolicy", "type": "number | undefined", "optional": false, "summary": "How many further certificates may be issued before an acceptable policy becomes mandatory; `undefined` when the field is absent." }, { "name": "inhibitPolicyMapping", "type": "number | undefined", "optional": false, "summary": "How many further certificates may be issued before policy mapping is forbidden; `undefined` when the field is absent." } ] }, { "name": "PolicyInformation", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface PolicyInformation", "summary": "One entry of certificatePolicies.", "throws": null, "params": null, "returns": null, "members": [ { "name": "policyIdentifier", "type": "string", "optional": false, "summary": "The policy OID; `2.5.29.32.0` is anyPolicy." }, { "name": "qualifiers", "type": "readonly PolicyQualifier[]", "optional": false, "summary": "Qualifiers of this policy, in encoded order; empty when the field is absent." } ] }, { "name": "PolicyMapping", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface PolicyMapping", "summary": "One issuer-to-subject policy mapping.", "throws": null, "params": null, "returns": null, "members": [ { "name": "issuerDomainPolicy", "type": "string", "optional": false, "summary": "The policy as the issuer names it." }, { "name": "subjectDomainPolicy", "type": "string", "optional": false, "summary": "The policy it is equivalent to in the subject's domain." } ] }, { "name": "PolicyMappingsExtension", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface PolicyMappingsExtension extends ExtensionBase", "summary": "policyMappings (RFC 5280 §4.2.1.5).", "throws": null, "params": null, "returns": null, "members": [ { "name": "oid", "type": "string", "optional": false, "summary": "The extnID, in dotted notation, e.g. `2.5.29.19` (basicConstraints)." }, { "name": "critical", "type": "boolean", "optional": false, "summary": "Whether the issuer marked the extension critical: a relying party that does not understand a critical extension must reject the certificate." }, { "name": "valueDer", "type": "Uint8Array", "optional": false, "summary": "The content of extnValue: the DER encoding of the extension value." }, { "name": "kind", "type": "'policyMappings'", "optional": false, "summary": "Discriminant; `getExtension(cert, 'policyMappings')` returns this type." }, { "name": "mappings", "type": "readonly PolicyMapping[]", "optional": false, "summary": "The equivalences asserted, in encoded order." } ] }, { "name": "PolicyQualifier", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export type PolicyQualifier = CpsQualifier | UserNoticeQualifier | UnknownPolicyQualifier", "summary": "One policy qualifier, discriminated by `kind`.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "PrivateKeyInfo", "kind": "type", "module": "src/types/key-types.ts", "signature": "export interface PrivateKeyInfo", "summary": "RFC 5958 `OneAsymmetricKey` (PKCS#8 `PrivateKeyInfo` when version 0) — described, never exposed: the `privateKey` octets are not a field.", "throws": null, "params": null, "returns": null, "members": [ { "name": "der", "type": "Uint8Array", "optional": false, "summary": "The whole structure, as a zero-copy view of the input." }, { "name": "version", "type": "0 | 1", "optional": false, "summary": "0 (`v1`, RFC 5208) or 1 (`v2`, RFC 5958, which may carry the public key)." }, { "name": "algorithm", "type": "AlgorithmIdentifier", "optional": false, "summary": "The private key algorithm, as encoded." }, { "name": "kind", "type": "PrivateKeyKind", "optional": false, "summary": "What the algorithm OID names." }, { "name": "curve", "type": "EcCurve | undefined", "optional": false, "summary": "For an EC key, the curve named in the algorithm parameters, when Web Crypto implements it; otherwise `undefined`." }, { "name": "attributes", "type": "readonly Attribute[]", "optional": false, "summary": "The `[0]` attributes, in encoded order; empty when absent." }, { "name": "publicKey", "type": "BitString | undefined", "optional": false, "summary": "The `[1]` public key of a version 1 structure, or `undefined`." }, { "name": "diagnostics", "type": "readonly PkiDiagnostic[]", "optional": false, "summary": "Profile concerns found while reading, in encoded order." } ] }, { "name": "PrivateKeyKind", "kind": "type", "module": "src/types/key-types.ts", "signature": "export type PrivateKeyKind = 'rsa' | 'rsa-pss' | 'ec' | 'ed25519' | 'ed448' | 'unknown'", "summary": "The kinds of private key a PrivateKeyInfo can name that pkinative recognises.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "RawExtension", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface RawExtension extends ExtensionBase", "summary": "An extension kept as encoded because the parse ran with `decodeExtensions: false`.", "throws": null, "params": null, "returns": null, "members": [ { "name": "oid", "type": "string", "optional": false, "summary": "The extnID, in dotted notation, e.g. `2.5.29.19` (basicConstraints)." }, { "name": "critical", "type": "boolean", "optional": false, "summary": "Whether the issuer marked the extension critical: a relying party that does not understand a critical extension must reject the certificate." }, { "name": "valueDer", "type": "Uint8Array", "optional": false, "summary": "The content of extnValue: the DER encoding of the extension value." }, { "name": "kind", "type": "'raw'", "optional": false, "summary": "Discriminant." } ] }, { "name": "ReadStringOptions", "kind": "type", "module": "src/types/asn1-types.ts", "signature": "export interface ReadStringOptions extends PkiParseOptions", "summary": "Options of `readString`: the type of an implicitly tagged string.", "throws": null, "params": null, "returns": null, "members": [ { "name": "encodingRules", "type": "EncodingRules | undefined", "optional": true, "summary": "`'der'` (default) or `'ber'`." }, { "name": "limits", "type": "Partial | undefined", "optional": true, "summary": "Overrides for any subset of `DEFAULT_PKI_LIMITS`." }, { "name": "strict", "type": "boolean | undefined", "optional": true, "summary": "Escalate every diagnostic to a thrown `PkiError` with code `PKI_STRICT_DIAGNOSTIC`." }, { "name": "onDiagnostic", "type": "PkiDiagnosticHandler | undefined", "optional": true, "summary": "Receive every diagnostic instead of the default once-per-code `console.warn`." }, { "name": "stringType", "type": "Asn1StringType | undefined", "optional": true, "summary": "Required when the node carries a non-universal (implicit) tag." } ] }, { "name": "ReadTimeOptions", "kind": "type", "module": "src/types/asn1-types.ts", "signature": "export interface ReadTimeOptions extends PkiParseOptions", "summary": "Options of `readTime`: the type of an implicitly tagged time.", "throws": null, "params": null, "returns": null, "members": [ { "name": "encodingRules", "type": "EncodingRules | undefined", "optional": true, "summary": "`'der'` (default) or `'ber'`." }, { "name": "limits", "type": "Partial | undefined", "optional": true, "summary": "Overrides for any subset of `DEFAULT_PKI_LIMITS`." }, { "name": "strict", "type": "boolean | undefined", "optional": true, "summary": "Escalate every diagnostic to a thrown `PkiError` with code `PKI_STRICT_DIAGNOSTIC`." }, { "name": "onDiagnostic", "type": "PkiDiagnosticHandler | undefined", "optional": true, "summary": "Receive every diagnostic instead of the default once-per-code `console.warn`." }, { "name": "timeType", "type": "TimeType | undefined", "optional": true, "summary": "Required when the node carries a non-universal (implicit) tag." } ] }, { "name": "ReasonFlag", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export type ReasonFlag = | 'unused' | 'keyCompromise' | 'cACompromise' | 'affiliationChanged' | 'superseded' | 'cessationOfOperation' | 'certificateHold' | 'privilegeWithdrawn' | 'aACompromise'", "summary": "The named bits of ReasonFlags, in bit order (RFC 5280 §4.2.1.13).", "throws": null, "params": null, "returns": null, "members": null }, { "name": "RegisteredIdGeneralName", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface RegisteredIdGeneralName extends GeneralNameBase", "summary": "`registeredID [8]`.", "throws": null, "params": null, "returns": null, "members": [ { "name": "der", "type": "Uint8Array", "optional": false, "summary": "The exact encoding of the GeneralName, its context tag included." }, { "name": "kind", "type": "'registeredID'", "optional": false, "summary": "Discriminant: switch on it to narrow a `GeneralName` to this alternative." }, { "name": "oid", "type": "string", "optional": false, "summary": "The identifier, in dotted notation." } ] }, { "name": "RelativeDistinguishedName", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export type RelativeDistinguishedName = readonly AttributeTypeAndValue[]", "summary": "A relative distinguished name: one or more attributes, in encoded order.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "RevokedCertificate", "kind": "type", "module": "src/types/crl-types.ts", "signature": "export interface RevokedCertificate", "summary": "One entry of `revokedCertificates` (RFC 5280 §5.1.2.6).", "throws": null, "params": null, "returns": null, "members": [ { "name": "serialNumber", "type": "SerialNumber", "optional": false, "summary": "The revoked certificate's serial." }, { "name": "revocationDate", "type": "PkiTime", "optional": false, "summary": "When the CA says the certificate stopped being trustworthy." }, { "name": "extensions", "type": "readonly Extension[]", "optional": false, "summary": "`crlEntryExtensions`, decoded; empty when the entry has none." }, { "name": "reason", "type": "CrlReason | undefined", "optional": false, "summary": "Reason code from `cRLReason` (RFC 5280 §5.3.1), or undefined when absent." }, { "name": "invalidityDate", "type": "number | undefined", "optional": false, "summary": "`invalidityDate` (RFC 5280 §5.3.2) in epoch milliseconds, or undefined." } ] }, { "name": "RsaPublicKeyInfo", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface RsaPublicKeyInfo extends PublicKeyInfoBase", "summary": "An RSA or RSASSA-PSS key (RFC 3279 §2.3.1, RFC 4055 §1.2).", "throws": null, "params": null, "returns": null, "members": [ { "name": "algorithm", "type": "AlgorithmIdentifier", "optional": false, "summary": "The algorithm the key belongs to, with its parameters; `kind` is pkinative's reading of it." }, { "name": "publicKey", "type": "BitString", "optional": false, "summary": "The subjectPublicKey BIT STRING." }, { "name": "der", "type": "Uint8Array", "optional": false, "summary": "The exact encoding of the SubjectPublicKeyInfo." }, { "name": "kind", "type": "'rsa' | 'rsa-pss'", "optional": false, "summary": "Discriminant: switch on it to narrow a `SubjectPublicKeyInfo` to this alternative." }, { "name": "modulus", "type": "Uint8Array", "optional": false, "summary": "The unsigned big-endian modulus, without its sign octet." }, { "name": "modulusBits", "type": "number", "optional": false, "summary": "The bit length of `modulus`, counted from its most significant set bit — the number \"RSA 2048\" means." }, { "name": "publicExponent", "type": "bigint", "optional": false, "summary": "The public exponent, usually 65537." } ] }, { "name": "SafeBag", "kind": "type", "module": "src/types/key-types.ts", "signature": "export interface SafeBag", "summary": "One RFC 7292 §4.2 SafeBag, read but not opened.", "throws": null, "params": null, "returns": null, "members": [ { "name": "kind", "type": "SafeBagKind", "optional": false, "summary": "What the bag holds." }, { "name": "oid", "type": "string", "optional": false, "summary": "The `bagId`, as encoded." }, { "name": "valueDer", "type": "Uint8Array", "optional": false, "summary": "The `bagValue`, the content of its `[0]` EXPLICIT tag, as exact DER." }, { "name": "friendlyName", "type": "string | undefined", "optional": false, "summary": "`friendlyName` (PKCS#9), when present once with one value." }, { "name": "localKeyId", "type": "Uint8Array | undefined", "optional": false, "summary": "`localKeyId` (PKCS#9), when present once with one value — what ties a key to its certificate." }, { "name": "attributes", "type": "readonly Attribute[]", "optional": false, "summary": "Every `bagAttributes` entry, in encoded order." }, { "name": "certificateDer", "type": "Uint8Array | undefined", "optional": false, "summary": "For a certBag holding an X.509 certificate, its DER; otherwise `undefined`." }, { "name": "crlDer", "type": "Uint8Array | undefined", "optional": false, "summary": "For a crlBag holding an X.509 CRL, its DER; otherwise `undefined`." }, { "name": "encryptedKey", "type": "EncryptedPrivateKeyInfo | undefined", "optional": false, "summary": "For a pkcs8ShroudedKeyBag, the encrypted key; otherwise `undefined`." }, { "name": "privateKey", "type": "PrivateKeyInfo | undefined", "optional": false, "summary": "For a keyBag, the unencrypted key's description; otherwise `undefined`." }, { "name": "path", "type": "string", "optional": false, "summary": "The path of this bag, e.g. `authSafe[1].bags[0]`, for reports and errors." } ] }, { "name": "SafeBagKind", "kind": "type", "module": "src/types/key-types.ts", "signature": "export type SafeBagKind = 'keyBag' | 'pkcs8ShroudedKeyBag' | 'certBag' | 'crlBag' | 'secretBag' | 'safeContentsBag' | 'unknown'", "summary": "The six SafeBag types of RFC 7292 §4.2, and anything else.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "SafeContentsInfo", "kind": "type", "module": "src/types/key-types.ts", "signature": "export interface SafeContentsInfo", "summary": "One ContentInfo of the AuthenticatedSafe: either plain `data` whose bags are read, or password-encrypted `encryptedData` whose bags wait for a password.", "throws": null, "params": null, "returns": null, "members": [ { "name": "encrypted", "type": "boolean", "optional": false, "summary": "Whether the SafeContents is encrypted." }, { "name": "encryption", "type": "PasswordEncryption | undefined", "optional": false, "summary": "How it is encrypted, when it is." }, { "name": "encryptedContent", "type": "Uint8Array | undefined", "optional": false, "summary": "The ciphertext, when it is encrypted." }, { "name": "bags", "type": "readonly SafeBag[]", "optional": false, "summary": "The bags, when it is not encrypted; empty until opened otherwise." }, { "name": "path", "type": "string", "optional": false, "summary": "The path, e.g. `authSafe[0]`." } ] }, { "name": "SerialNumber", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface SerialNumber", "summary": "The serial number (RFC 5280 §4.1.2.2).", "throws": null, "params": null, "returns": null, "members": [ { "name": "bytes", "type": "Uint8Array", "optional": false, "summary": "The two's-complement content octets, exactly as encoded." }, { "name": "hex", "type": "string", "optional": false, "summary": "Lowercase hexadecimal of `bytes`." }, { "name": "value", "type": "bigint", "optional": false, "summary": "The signed value; negative for a serial whose first octet has the high bit set." } ] }, { "name": "ServerIdentity", "kind": "type", "module": "src/path/path-server-name.ts", "signature": "export type ServerIdentity = /** A DNS name, as it appeared in the URL. One trailing dot is ignored. */ | { readonly kind: 'dns'", "summary": "The host or address a caller connected to.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "SignatureAlgorithm", "kind": "type", "module": "src/types/crypto-types.ts", "signature": "export type SignatureAlgorithm = | { readonly name: 'RSASSA-PKCS1-v1_5'", "summary": "A signature algorithm, in the shape that maps onto both an RFC 5280 OID and a Web Crypto parameter object.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "SignatureHash", "kind": "type", "module": "src/types/crypto-types.ts", "signature": "export type SignatureHash = 'SHA-1' | 'SHA-256' | 'SHA-384' | 'SHA-512'", "summary": "The digests RFC 5280 signature algorithms are built on.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "SignatureResult", "kind": "type", "module": "src/types/path-types.ts", "signature": "export interface SignatureResult", "summary": "One already-computed signature result, keyed by the certificate it covers.", "throws": null, "params": null, "returns": null, "members": [ { "name": "certificate", "type": "Certificate", "optional": false, "summary": "The certificate whose signature was checked." }, { "name": "issuer", "type": "Certificate | undefined", "optional": true, "summary": "The issuer the verdict is about, when the caller knows it." }, { "name": "verdict", "type": "SignatureVerdict", "optional": false, "summary": "What came of checking it." }, { "name": "errorCode", "type": "string | undefined", "optional": true, "summary": "For `'not-checked'`: the `PkiCryptoError.code` that explains why." }, { "name": "detail", "type": "string | undefined", "optional": true, "summary": "For `'not-checked'`: the error's own message." } ] }, { "name": "SignatureVerdict", "kind": "type", "module": "src/types/path-types.ts", "signature": "export type SignatureVerdict = 'valid' | 'invalid' | 'not-checked'", "summary": "Whether one certificate's signature was checked against its issuer, and what came of it.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "SignedCertificateTimestampListExtension", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface SignedCertificateTimestampListExtension extends ExtensionBase", "summary": "The Certificate Transparency SCT list (RFC 6962 §3.3), kept in its TLS encoding.", "throws": null, "params": null, "returns": null, "members": [ { "name": "oid", "type": "string", "optional": false, "summary": "The extnID, in dotted notation, e.g. `2.5.29.19` (basicConstraints)." }, { "name": "critical", "type": "boolean", "optional": false, "summary": "Whether the issuer marked the extension critical: a relying party that does not understand a critical extension must reject the certificate." }, { "name": "valueDer", "type": "Uint8Array", "optional": false, "summary": "The content of extnValue: the DER encoding of the extension value." }, { "name": "kind", "type": "'signedCertificateTimestampList'", "optional": false, "summary": "Discriminant; `getExtension(cert, 'signedCertificateTimestampList')` returns this type." }, { "name": "list", "type": "Uint8Array", "optional": false, "summary": "The SignedCertificateTimestampList, TLS-encoded." } ] }, { "name": "SignedData", "kind": "type", "module": "src/types/cms-types.ts", "signature": "export interface SignedData", "summary": "A parsed `ContentInfo` whose `contentType` is `id-signedData` (RFC 5652 §3, §5.1).", "throws": null, "params": null, "returns": null, "members": [ { "name": "der", "type": "Uint8Array", "optional": false, "summary": "The whole `ContentInfo`, as a zero-copy view of the input." }, { "name": "version", "type": "1 | 3 | 4 | 5", "optional": false, "summary": "`1`, `3`, `4` or `5`, as §5.1 derives it from what the structure carries." }, { "name": "digestAlgorithms", "type": "readonly AlgorithmIdentifier[]", "optional": false, "summary": "`digestAlgorithms`: every digest any signer used, in encoded order." }, { "name": "contentType", "type": "string", "optional": false, "summary": "`eContentType` — `id-data` for arbitrary bytes, `id-ct-TSTInfo` for a timestamp token." }, { "name": "content", "type": "Uint8Array | undefined", "optional": false, "summary": "The `eContent` octets; `undefined` when the content is **detached**, which is how a PDF signature and most S/MIME signatures are made." }, { "name": "certificates", "type": "readonly Uint8Array[]", "optional": false, "summary": "Every `certificate` choice of `certificates`, as DER, in encoded order." }, { "name": "crls", "type": "readonly Uint8Array[]", "optional": false, "summary": "Every `CertificateList` of `crls`, as DER, in encoded order." }, { "name": "ocspResponses", "type": "readonly Uint8Array[]", "optional": false, "summary": "Every `OCSPResponse` carried as `other` with `id-ri-ocsp-response` in `crls` (RFC 5940), as DER." }, { "name": "signerInfos", "type": "readonly SignerInfo[]", "optional": false, "summary": "The signers, in encoded order." }, { "name": "diagnostics", "type": "readonly PkiDiagnostic[]", "optional": false, "summary": "Profile concerns found while reading, in encoded order." } ] }, { "name": "Signer", "kind": "type", "module": "src/types/crypto-types.ts", "signature": "export type Signer = SigningKey | ExternalSigner", "summary": "Anything pkinative can sign with.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "SignerIdentifier", "kind": "type", "module": "src/types/cms-types.ts", "signature": "export type SignerIdentifier = | { /** Discriminant: `version` 1 signers use this alternative. */ readonly kind: 'issuerAndSerialNumber'", "summary": "`SignerIdentifier` (RFC 5652 §5.3): which certificate holds the key that signed.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "SignerInfo", "kind": "type", "module": "src/types/cms-types.ts", "signature": "export interface SignerInfo", "summary": "One `SignerInfo` (RFC 5652 §5.3).", "throws": null, "params": null, "returns": null, "members": [ { "name": "version", "type": "1 | 3", "optional": false, "summary": "`1` when `sid` is `issuerAndSerialNumber`, `3` when it is `subjectKeyIdentifier`." }, { "name": "sid", "type": "SignerIdentifier", "optional": false, "summary": "Which certificate holds the signing key." }, { "name": "digestAlgorithm", "type": "AlgorithmIdentifier", "optional": false, "summary": "The digest over the content, and — when `signedAttributes` are present — over them too." }, { "name": "signedAttributes", "type": "readonly Attribute[] | undefined", "optional": false, "summary": "The signed attributes in encoded order; `undefined` when absent, which is not the same as empty." }, { "name": "signedAttributesDer", "type": "Uint8Array | undefined", "optional": false, "summary": "The exact bytes the signature covers when `signedAttributes` are present: the transmitted `[0]` value with its tag replaced by the `SET OF` tag `0x31` (RFC 5652 §5.4)." }, { "name": "signatureAlgorithm", "type": "AlgorithmIdentifier", "optional": false, "summary": "The algorithm the signature was made with — often a bare key algorithm such as `rsaEncryption`, the digest being `digestAlgorithm`." }, { "name": "signature", "type": "Uint8Array", "optional": false, "summary": "The signature value, as the OCTET STRING content." }, { "name": "unsignedAttributes", "type": "readonly Attribute[] | undefined", "optional": false, "summary": "The unsigned attributes in encoded order; `undefined` when absent." }, { "name": "contentType", "type": "string | undefined", "optional": false, "summary": "`contentType` (§11.1), the one attribute that makes the signed attributes bind to what they sign; `undefined` when absent." }, { "name": "messageDigest", "type": "Uint8Array | undefined", "optional": false, "summary": "`messageDigest` (§11.2), the digest of the content the signer committed to; `undefined` when absent." }, { "name": "signingTime", "type": "PkiTime | undefined", "optional": false, "summary": "`signingTime` (§11.3) as the signer **claims** it — nothing vouches for it but the signer." }, { "name": "signingCertificate", "type": "SigningCertificateAttribute | undefined", "optional": false, "summary": "`signingCertificate` or `signingCertificateV2`, whichever is present; `undefined` when neither is." }, { "name": "algorithmProtection", "type": "{", "optional": false, "summary": "`CMSAlgorithmProtection` (RFC 6211): the signer's **signed** statement of the algorithms it used." }, { "name": "timeStampTokens", "type": "readonly Uint8Array[]", "optional": false, "summary": "Every `id-aa-signatureTimeStampToken` (RFC 3161 Appendix A) among the unsigned attributes, each a `ContentInfo` DER that `parseTimeStampToken` reads." }, { "name": "der", "type": "Uint8Array", "optional": false, "summary": "The whole `SignerInfo`, exactly as encoded." } ] }, { "name": "SignerReport", "kind": "type", "module": "src/verify/verify-signed-data.ts", "signature": "export interface SignerReport", "summary": "The verdict on one signer.", "throws": null, "params": null, "returns": null, "members": [ { "name": "index", "type": "number", "optional": false, "summary": "The signer's position in `signerInfos`, in encoded order." }, { "name": "valid", "type": "boolean", "optional": false, "summary": "Whether this signer is valid: intact, timestamps valid, and chaining to a trusted anchor." }, { "name": "intact", "type": "boolean", "optional": false, "summary": "Whether every check that needs no trust store passed: the attributes say what they must, the algorithms agree, the content hashes to the committed digest, the signature verifies, and the key's certificate is the one the signer named." }, { "name": "certificate", "type": "Certificate | undefined", "optional": false, "summary": "The certificate that signed; `undefined` when none could be established." }, { "name": "signingTime", "type": "PkiTime | undefined", "optional": false, "summary": "The time the signer **claims** it signed." }, { "name": "timeStamps", "type": "readonly VerifyTimeStampTokenReport[]", "optional": false, "summary": "Each RFC 3161 timestamp over this signer's signature, verified." }, { "name": "chain", "type": "VerifyCertificateChainReport | undefined", "optional": false, "summary": "The signer's chain, judged; `undefined` when there was no certificate to judge." }, { "name": "reasons", "type": "readonly PkiReason[]", "optional": false, "summary": "Every reason this signer is not valid, with paths under `signerInfos[i]`." } ] }, { "name": "SigningCertificateAttribute", "kind": "type", "module": "src/types/cms-types.ts", "signature": "export interface SigningCertificateAttribute", "summary": "`SigningCertificate` (RFC 2634 §5.4) or `SigningCertificateV2` (RFC 5035 §3).", "throws": null, "params": null, "returns": null, "members": [ { "name": "version", "type": "1 | 2", "optional": false, "summary": "`1` for `id-aa-signingCertificate`, `2` for `id-aa-signingCertificateV2`." }, { "name": "certIds", "type": "readonly EssCertId[]", "optional": false, "summary": "The first entry names the signing certificate; any others constrain the path (RFC 5035 §3)." } ] }, { "name": "SigningKey", "kind": "type", "module": "src/types/crypto-types.ts", "signature": "export interface SigningKey", "summary": "The key that signs, and what it signs with.", "throws": null, "params": null, "returns": null, "members": [ { "name": "key", "type": "CryptoKeyHandle", "optional": false, "summary": "A private `CryptoKey` with the `sign` usage, imported by the caller." }, { "name": "algorithm", "type": "SignatureAlgorithm", "optional": false, "summary": "The algorithm, which decides both the OID written into the structure and the Web Crypto call." } ] }, { "name": "SubjectAltNameExtension", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface SubjectAltNameExtension extends ExtensionBase", "summary": "subjectAltName (RFC 5280 §4.2.1.6).", "throws": null, "params": null, "returns": null, "members": [ { "name": "oid", "type": "string", "optional": false, "summary": "The extnID, in dotted notation, e.g. `2.5.29.19` (basicConstraints)." }, { "name": "critical", "type": "boolean", "optional": false, "summary": "Whether the issuer marked the extension critical: a relying party that does not understand a critical extension must reject the certificate." }, { "name": "valueDer", "type": "Uint8Array", "optional": false, "summary": "The content of extnValue: the DER encoding of the extension value." }, { "name": "kind", "type": "'subjectAltName'", "optional": false, "summary": "Discriminant; `getExtension(cert, 'subjectAltName')` returns this type." }, { "name": "names", "type": "readonly GeneralName[]", "optional": false, "summary": "The identities, in encoded order — where a modern certificate's host names live, not in the subject." } ] }, { "name": "SubjectDirectoryAttributesExtension", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface SubjectDirectoryAttributesExtension extends ExtensionBase", "summary": "subjectDirectoryAttributes (RFC 5280 §4.2.1.8): identification attributes of the subject — nationality, date and place of birth, gender (RFC 3739 §3.2.2).", "throws": null, "params": null, "returns": null, "members": [ { "name": "oid", "type": "string", "optional": false, "summary": "The extnID, in dotted notation, e.g. `2.5.29.19` (basicConstraints)." }, { "name": "critical", "type": "boolean", "optional": false, "summary": "Whether the issuer marked the extension critical: a relying party that does not understand a critical extension must reject the certificate." }, { "name": "valueDer", "type": "Uint8Array", "optional": false, "summary": "The content of extnValue: the DER encoding of the extension value." }, { "name": "kind", "type": "'subjectDirectoryAttributes'", "optional": false, "summary": "Discriminant; `getExtension(cert, 'subjectDirectoryAttributes')` returns this type." }, { "name": "attributes", "type": "readonly DirectoryAttribute[]", "optional": false, "summary": "The attributes, in encoded order, each with its type OID and every value as its exact DER — the value syntax depends on the attribute, and `decodeAsn1` reads it (a dateOfBirth is a GeneralizedTime, a countryOfCitizenship a PrintableString)." } ] }, { "name": "SubjectInfoAccessExtension", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface SubjectInfoAccessExtension extends ExtensionBase", "summary": "subjectInfoAccess (RFC 5280 §4.2.2.2).", "throws": null, "params": null, "returns": null, "members": [ { "name": "oid", "type": "string", "optional": false, "summary": "The extnID, in dotted notation, e.g. `2.5.29.19` (basicConstraints)." }, { "name": "critical", "type": "boolean", "optional": false, "summary": "Whether the issuer marked the extension critical: a relying party that does not understand a critical extension must reject the certificate." }, { "name": "valueDer", "type": "Uint8Array", "optional": false, "summary": "The content of extnValue: the DER encoding of the extension value." }, { "name": "kind", "type": "'subjectInfoAccess'", "optional": false, "summary": "Discriminant; `getExtension(cert, 'subjectInfoAccess')` returns this type." }, { "name": "descriptions", "type": "readonly AccessDescription[]", "optional": false, "summary": "Services the subject itself offers, in encoded order." } ] }, { "name": "SubjectKeyIdentifierExtension", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface SubjectKeyIdentifierExtension extends ExtensionBase", "summary": "subjectKeyIdentifier (RFC 5280 §4.2.1.2).", "throws": null, "params": null, "returns": null, "members": [ { "name": "oid", "type": "string", "optional": false, "summary": "The extnID, in dotted notation, e.g. `2.5.29.19` (basicConstraints)." }, { "name": "critical", "type": "boolean", "optional": false, "summary": "Whether the issuer marked the extension critical: a relying party that does not understand a critical extension must reject the certificate." }, { "name": "valueDer", "type": "Uint8Array", "optional": false, "summary": "The content of extnValue: the DER encoding of the extension value." }, { "name": "kind", "type": "'subjectKeyIdentifier'", "optional": false, "summary": "Discriminant; `getExtension(cert, 'subjectKeyIdentifier')` returns this type." }, { "name": "keyIdentifier", "type": "Uint8Array", "optional": false, "summary": "The identifier octets, as issued." } ] }, { "name": "SubjectPublicKeyInfo", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export type SubjectPublicKeyInfo = RsaPublicKeyInfo | EcPublicKeyInfo | OctetPublicKeyInfo | UnknownPublicKeyInfo", "summary": "A SubjectPublicKeyInfo (RFC 5280 §4.1.2.7), discriminated by `kind`.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "TagClass", "kind": "type", "module": "src/types/asn1-types.ts", "signature": "export type TagClass = 'universal' | 'application' | 'context' | 'private'", "summary": "The class bits of an identifier octet (X.690 §8.1.2.2).", "throws": null, "params": null, "returns": null, "members": null }, { "name": "TextGeneralName", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface TextGeneralName extends GeneralNameBase", "summary": "`rfc822Name [1]`, `dNSName [2]` and `uniformResourceIdentifier [6]`: ASCII text.", "throws": null, "params": null, "returns": null, "members": [ { "name": "der", "type": "Uint8Array", "optional": false, "summary": "The exact encoding of the GeneralName, its context tag included." }, { "name": "kind", "type": "'rfc822Name' | 'dNSName' | 'uniformResourceIdentifier'", "optional": false, "summary": "Discriminant, which also says which of the three text forms this is." }, { "name": "value", "type": "string", "optional": false, "summary": "The IA5String text, exactly as encoded: never lowercased, never punycode-decoded, never trimmed." } ] }, { "name": "TimeStampAccuracy", "kind": "type", "module": "src/types/tsp-types.ts", "signature": "export interface TimeStampAccuracy", "summary": "`Accuracy` (RFC 3161 §2.4.2): how far the stated time may be from the real one.", "throws": null, "params": null, "returns": null, "members": [ { "name": "seconds", "type": "number", "optional": false, "summary": "Whole seconds; `0` when absent." }, { "name": "millis", "type": "number", "optional": false, "summary": "Milliseconds, 1 to 999; `0` when absent." }, { "name": "micros", "type": "number", "optional": false, "summary": "Microseconds, 1 to 999; `0` when absent." } ] }, { "name": "TimeStampFailure", "kind": "type", "module": "src/types/tsp-types.ts", "signature": "export type TimeStampFailure = | 'badAlg' | 'badRequest' | 'badDataFormat' | 'timeNotAvailable' | 'unacceptedPolicy' | 'unacceptedExtension' | 'addInfoNotAvailable' | 'systemFailure'", "summary": "The `PKIFailureInfo` bits RFC 3161 §2.4.2 names, in bit order.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "TimeStampHashAlgorithm", "kind": "type", "module": "src/cms/tsp-request.ts", "signature": "export type TimeStampHashAlgorithm = 'SHA-256' | 'SHA-384' | 'SHA-512'", "summary": "The digests a new request may stamp.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "TimeStampResponse", "kind": "type", "module": "src/types/tsp-types.ts", "signature": "export interface TimeStampResponse", "summary": "A parsed `TimeStampResp` (RFC 3161 §2.4.2).", "throws": null, "params": null, "returns": null, "members": [ { "name": "der", "type": "Uint8Array", "optional": false, "summary": "The whole response, as a zero-copy view of the input." }, { "name": "status", "type": "TimeStampStatus", "optional": false, "summary": "Whether the TSA granted the request." }, { "name": "statusStrings", "type": "readonly string[]", "optional": false, "summary": "`statusString`, the TSA's free text, in encoded order; empty when absent." }, { "name": "failInfo", "type": "readonly TimeStampFailure[]", "optional": false, "summary": "`failInfo`, the reasons a request was declined; empty when absent." }, { "name": "tokenDer", "type": "Uint8Array | undefined", "optional": false, "summary": "The token as DER — the bytes to embed as `id-aa-signatureTimeStampToken`; `undefined` unless granted." }, { "name": "token", "type": "TimeStampToken | undefined", "optional": false, "summary": "The token, parsed; `undefined` unless granted." }, { "name": "diagnostics", "type": "readonly PkiDiagnostic[]", "optional": false, "summary": "Profile concerns found while reading, in encoded order." } ] }, { "name": "TimeStampStatus", "kind": "type", "module": "src/types/tsp-types.ts", "signature": "export type TimeStampStatus = 'granted' | 'grantedWithMods' | 'rejection' | 'waiting' | 'revocationWarning' | 'revocationNotification'", "summary": "`PKIStatus` (RFC 3161 §2.4.2).", "throws": null, "params": null, "returns": null, "members": null }, { "name": "TimeStampToken", "kind": "type", "module": "src/types/tsp-types.ts", "signature": "export interface TimeStampToken", "summary": "A timestamp token: a SignedData over a TSTInfo (RFC 3161 §2.4.2).", "throws": null, "params": null, "returns": null, "members": [ { "name": "signedData", "type": "SignedData", "optional": false, "summary": "The CMS envelope — who signed, with what, and what certificates came with it." }, { "name": "tstInfo", "type": "TstInfo", "optional": false, "summary": "What was stamped, and when." } ] }, { "name": "TimeType", "kind": "type", "module": "src/types/asn1-types.ts", "signature": "export type TimeType = 'UTCTime' | 'GeneralizedTime'", "summary": "The two time types of X.680.", "throws": null, "params": null, "returns": null, "members": null }, { "name": "TstInfo", "kind": "type", "module": "src/types/tsp-types.ts", "signature": "export interface TstInfo", "summary": "`TSTInfo` (RFC 3161 §2.4.2): what the authority asserts.", "throws": null, "params": null, "returns": null, "members": [ { "name": "version", "type": "1", "optional": false, "summary": "Always `1`; any other version is refused." }, { "name": "policy", "type": "string", "optional": false, "summary": "The TSA policy under which the token was issued." }, { "name": "messageImprint", "type": "MessageImprint", "optional": false, "summary": "The hash that was stamped." }, { "name": "serialNumber", "type": "SerialNumber", "optional": false, "summary": "Unique per token issued by this TSA." }, { "name": "genTime", "type": "PkiTime", "optional": false, "summary": "The time the TSA asserts, in epoch milliseconds, with the fraction the TSA encoded." }, { "name": "accuracy", "type": "TimeStampAccuracy | undefined", "optional": false, "summary": "How far `genTime` may be from the real time; `undefined` when the TSA declared none." }, { "name": "ordering", "type": "boolean", "optional": false, "summary": "Whether tokens from this TSA may be ordered by `genTime` alone, whatever their accuracy." }, { "name": "nonce", "type": "bigint | undefined", "optional": false, "summary": "The request's nonce, echoed; `undefined` when the request carried none." }, { "name": "tsa", "type": "GeneralName | undefined", "optional": false, "summary": "The TSA's name as it chose to state it; `undefined` when absent." }, { "name": "extensions", "type": "readonly Extension[]", "optional": false, "summary": "`extensions`, decoded; empty when there are none." }, { "name": "der", "type": "Uint8Array", "optional": false, "summary": "The whole `TSTInfo`, exactly as encoded — the `eContent` the token's signer signed." } ] }, { "name": "UnknownExtension", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface UnknownExtension extends ExtensionBase", "summary": "An extension pkinative does not decode.", "throws": null, "params": null, "returns": null, "members": [ { "name": "oid", "type": "string", "optional": false, "summary": "The extnID, in dotted notation, e.g. `2.5.29.19` (basicConstraints)." }, { "name": "critical", "type": "boolean", "optional": false, "summary": "Whether the issuer marked the extension critical: a relying party that does not understand a critical extension must reject the certificate." }, { "name": "valueDer", "type": "Uint8Array", "optional": false, "summary": "The content of extnValue: the DER encoding of the extension value." }, { "name": "kind", "type": "'unknown'", "optional": false, "summary": "Discriminant." } ] }, { "name": "UnknownPolicyQualifier", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface UnknownPolicyQualifier", "summary": "A qualifier pkinative does not decode.", "throws": null, "params": null, "returns": null, "members": [ { "name": "kind", "type": "'unknown'", "optional": false, "summary": "Discriminant: switch on it to narrow a `PolicyQualifier` to this alternative." }, { "name": "oid", "type": "string", "optional": false, "summary": "The qualifier OID, which says how to read `qualifier`." }, { "name": "qualifier", "type": "Asn1Node", "optional": false, "summary": "The undecoded qualifier value." } ] }, { "name": "UnknownPublicKeyInfo", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface UnknownPublicKeyInfo extends PublicKeyInfoBase", "summary": "A key of an algorithm pkinative does not decode.", "throws": null, "params": null, "returns": null, "members": [ { "name": "algorithm", "type": "AlgorithmIdentifier", "optional": false, "summary": "The algorithm the key belongs to, with its parameters; `kind` is pkinative's reading of it." }, { "name": "publicKey", "type": "BitString", "optional": false, "summary": "The subjectPublicKey BIT STRING." }, { "name": "der", "type": "Uint8Array", "optional": false, "summary": "The exact encoding of the SubjectPublicKeyInfo." }, { "name": "kind", "type": "'unknown'", "optional": false, "summary": "Discriminant: read `algorithm.oid` and `publicKey` to go further." } ] }, { "name": "UserNoticeQualifier", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface UserNoticeQualifier", "summary": "A user notice qualifier.", "throws": null, "params": null, "returns": null, "members": [ { "name": "kind", "type": "'userNotice'", "optional": false, "summary": "Discriminant: switch on it to narrow a `PolicyQualifier` to this alternative." }, { "name": "oid", "type": "string", "optional": false, "summary": "The qualifier OID, `1.3.6.1.5.5.7.2.2`." }, { "name": "noticeRef", "type": "NoticeReference | undefined", "optional": false, "summary": "A notice named indirectly, by organization and number; `undefined` when absent." }, { "name": "explicitText", "type": "Asn1String | undefined", "optional": false, "summary": "The notice spelled out; `undefined` when absent." } ] }, { "name": "ValidateCertificatePathInput", "kind": "type", "module": "src/types/path-types.ts", "signature": "export interface ValidateCertificatePathInput", "summary": "What to validate, and everything needed to judge it.", "throws": null, "params": null, "returns": null, "members": [ { "name": "path", "type": "readonly Certificate[]", "optional": false, "summary": "The chain, **leaf first**, as parsed certificates." }, { "name": "trustAnchors", "type": "readonly Certificate[]", "optional": false, "summary": "The certificates the caller trusts a priori." }, { "name": "at", "type": "number", "optional": false, "summary": "The instant to validate at, in epoch milliseconds." }, { "name": "signatures", "type": "readonly SignatureResult[] | undefined", "optional": true, "summary": "Signature verdicts computed beforehand — by `verifyCertificateSignature`, or by whatever the caller trusts." }, { "name": "initialPolicySet", "type": "readonly string[] | undefined", "optional": true, "summary": "`user-initial-policy-set` (RFC 5280 §6.1.1 (c)): the policy OIDs the caller is willing to accept." }, { "name": "requireExplicitPolicy", "type": "boolean | undefined", "optional": true, "summary": "`initial-explicit-policy` (§6.1.1 (e))." }, { "name": "inhibitPolicyMapping", "type": "boolean | undefined", "optional": true, "summary": "`initial-policy-mapping-inhibit` (§6.1.1 (f))." }, { "name": "inhibitAnyPolicy", "type": "boolean | undefined", "optional": true, "summary": "`initial-any-policy-inhibit` (§6.1.1 (g))." }, { "name": "limits", "type": "Partial | undefined", "optional": true, "summary": "Overrides for any subset of `DEFAULT_PKI_LIMITS`." } ] }, { "name": "ValidateCertificatePathReport", "kind": "type", "module": "src/types/path-types.ts", "signature": "export interface ValidateCertificatePathReport", "summary": "The verdict, and every reason behind it.", "throws": null, "params": null, "returns": null, "members": [ { "name": "valid", "type": "boolean", "optional": false, "summary": "True only when `reasons` is empty; the two are one answer, not two." }, { "name": "reasons", "type": "readonly PkiReason[]", "optional": false, "summary": "Every reason the answer is no, not just the first." }, { "name": "path", "type": "readonly Certificate[]", "optional": false, "summary": "The path actually walked, leaf first, ending at the trust anchor when one was reached." } ] }, { "name": "Validity", "kind": "type", "module": "src/types/x509-types.ts", "signature": "export interface Validity", "summary": "The validity period (RFC 5280 §4.1.2.5).", "throws": null, "params": null, "returns": null, "members": [ { "name": "notBefore", "type": "PkiTime", "optional": false, "summary": "The first instant the certificate is valid, inclusive." }, { "name": "notAfter", "type": "PkiTime", "optional": false, "summary": "The last instant the certificate is valid, inclusive; RFC 5280 §4.1.2.5 gives 99991231235959Z the meaning \"no well-defined expiry\"." } ] }, { "name": "VerifyCertificateChainInput", "kind": "type", "module": "src/verify/verify-chain.ts", "signature": "export interface VerifyCertificateChainInput", "summary": "What to accept, and everything needed to decide it.", "throws": null, "params": null, "returns": null, "members": [ { "name": "leaf", "type": "Certificate", "optional": false, "summary": "The certificate presented — the end entity." }, { "name": "candidates", "type": "readonly Certificate[] | undefined", "optional": true, "summary": "Every other certificate that may appear in the path, in any order." }, { "name": "trustAnchors", "type": "readonly Certificate[]", "optional": false, "summary": "The certificates you trust a priori." }, { "name": "at", "type": "number | undefined", "optional": true, "summary": "The instant to decide at, epoch milliseconds." }, { "name": "serverName", "type": "ServerIdentity | undefined", "optional": true, "summary": "The host or address you connected to (RFC 6125)." }, { "name": "purposes", "type": "readonly string[] | undefined", "optional": true, "summary": "KeyPurposeId OIDs the chain must permit — `KEY_PURPOSES.serverAuth` for a TLS server." }, { "name": "crls", "type": "readonly Uint8Array[] | undefined", "optional": true, "summary": "CRLs, as the DER you downloaded." }, { "name": "ocspResponses", "type": "readonly Uint8Array[] | undefined", "optional": true, "summary": "OCSP responses, as the DER a responder returned or a TLS server stapled." }, { "name": "ocspNonce", "type": "Uint8Array | undefined", "optional": true, "summary": "The nonce you put in the request, so a replayed answer can be caught." }, { "name": "requireOcspNonce", "type": "boolean | undefined", "optional": true, "summary": "Treat a missing nonce echo as a mismatch." }, { "name": "requireRevocation", "type": "boolean | undefined", "optional": true, "summary": "Report `PKI_REASON_REVOCATION_UNKNOWN` when no usable list covered the end-entity certificate." }, { "name": "allowSha1", "type": "boolean | undefined", "optional": true, "summary": "Treat SHA-1 signatures as evidence." }, { "name": "initialPolicySet", "type": "readonly string[] | undefined", "optional": true, "summary": "`user-initial-policy-set` (RFC 5280 §6.1.1 (c))." }, { "name": "requireExplicitPolicy", "type": "boolean | undefined", "optional": true, "summary": "`initial-explicit-policy` (§6.1.1 (e))." }, { "name": "inhibitPolicyMapping", "type": "boolean | undefined", "optional": true, "summary": "`initial-policy-mapping-inhibit` (§6.1.1 (f))." }, { "name": "inhibitAnyPolicy", "type": "boolean | undefined", "optional": true, "summary": "`initial-any-policy-inhibit` (§6.1.1 (g))." }, { "name": "limits", "type": "Partial | undefined", "optional": true, "summary": "Overrides for any subset of `DEFAULT_PKI_LIMITS`." }, { "name": "onDiagnostic", "type": "PkiDiagnosticHandler | undefined", "optional": true, "summary": "Receive every diagnostic this verification raises or reads: what the CRLs, the OCSP responses and the responders' certificates say about themselves that their RFCs ask them not to, and what only this call can decide — an OCSP `responderID` that does not name the signer, answers about certificates no…" } ] }, { "name": "VerifyCertificateChainReport", "kind": "type", "module": "src/verify/verify-chain.ts", "signature": "export interface VerifyCertificateChainReport extends BuildCertificatePathReport", "summary": "The verdict, every reason behind it, and the path that was judged.", "throws": null, "params": null, "returns": null, "members": [ { "name": "valid", "type": "boolean", "optional": false, "summary": "True only when `reasons` is empty; the two are one answer, not two." }, { "name": "reasons", "type": "readonly PkiReason[]", "optional": false, "summary": "Every reason the answer is no, not just the first." }, { "name": "path", "type": "readonly Certificate[]", "optional": false, "summary": "The path actually walked, leaf first, ending at the trust anchor when one was reached." }, { "name": "explored", "type": "number", "optional": false, "summary": "How many candidate paths were explored before this answer." }, { "name": "signatureVerifications", "type": "number", "optional": false, "summary": "How many signature verifications were performed." } ] }, { "name": "VerifyCertificateSignatureOptions", "kind": "type", "module": "src/crypto/x509-verify.ts", "signature": "export interface VerifyCertificateSignatureOptions", "summary": "Options of verifyCertificateSignature.", "throws": null, "params": null, "returns": null, "members": [ { "name": "requireAlgorithmMatch", "type": "boolean | undefined", "optional": true, "summary": "Check that the outer `signatureAlgorithm` equals the inner `tbsCertificate.signature`, as RFC 5280 §4.1.1.2 requires." }, { "name": "allowSha1", "type": "boolean | undefined", "optional": true, "summary": "Treat a SHA-1 signature as evidence." } ] }, { "name": "VerifyCertificationRequestOptions", "kind": "type", "module": "src/verify/verify-csr.ts", "signature": "export interface VerifyCertificationRequestOptions extends ParseCertificateOptions", "summary": "Options of verifyCertificationRequest: how to read the request, and whether SHA-1 counts.", "throws": null, "params": null, "returns": null, "members": [ { "name": "encodingRules", "type": "EncodingRules | undefined", "optional": true, "summary": "`'der'` (default) or `'ber'`." }, { "name": "limits", "type": "Partial | undefined", "optional": true, "summary": "Overrides for any subset of `DEFAULT_PKI_LIMITS`." }, { "name": "strict", "type": "boolean | undefined", "optional": true, "summary": "Escalate every diagnostic to a thrown `PkiError` with code `PKI_STRICT_DIAGNOSTIC`." }, { "name": "onDiagnostic", "type": "PkiDiagnosticHandler | undefined", "optional": true, "summary": "Receive every diagnostic instead of the default once-per-code `console.warn`." }, { "name": "decodeExtensions", "type": "boolean | undefined", "optional": true, "summary": "Decode every recognised extension (default `true`)." }, { "name": "allowSha1", "type": "boolean | undefined", "optional": true, "summary": "Treat a SHA-1 signature as evidence." } ] }, { "name": "VerifyCertificationRequestReport", "kind": "type", "module": "src/verify/verify-csr.ts", "signature": "export interface VerifyCertificationRequestReport", "summary": "The verdict on a certification request, and the request it was about.", "throws": null, "params": null, "returns": null, "members": [ { "name": "valid", "type": "boolean", "optional": false, "summary": "Whether the request's signature verifies under the key the request carries." }, { "name": "reasons", "type": "readonly PkiReason[]", "optional": false, "summary": "Every reason it does not; empty when `valid`." }, { "name": "request", "type": "CertificationRequest | undefined", "optional": false, "summary": "The request, parsed; `undefined` when the bytes could not be read as one." }, { "name": "signatureVerifications", "type": "number", "optional": false, "summary": "How many signature verifications this cost: one, or none when the question could not be put." } ] }, { "name": "VerifySignedDataInput", "kind": "type", "module": "src/verify/verify-signed-data.ts", "signature": "export interface VerifySignedDataInput", "summary": "What to verify a signed message against.", "throws": null, "params": null, "returns": null, "members": [ { "name": "signedData", "type": "Uint8Array", "optional": false, "summary": "The DER `ContentInfo`: a `.p7s` or `.p7m` file, or a PDF signature's `/Contents`." }, { "name": "content", "type": "Uint8Array | undefined", "optional": true, "summary": "The content, when it is detached — as it is for a PDF signature and most S/MIME." }, { "name": "contentDigest", "type": "Uint8Array | undefined", "optional": true, "summary": "The detached content's digest, instead of the content — the PDF case, where the caller hashes the `/ByteRange` and never holds it whole." }, { "name": "certificates", "type": "readonly Certificate[] | undefined", "optional": true, "summary": "Certificates to look for the signers and their issuers among, beyond those the message carries." }, { "name": "trustAnchors", "type": "readonly Certificate[]", "optional": false, "summary": "The anchors every signer must chain to." }, { "name": "purposes", "type": "readonly string[] | undefined", "optional": true, "summary": "KeyPurposeId OIDs each signer's chain must permit — `KEY_PURPOSES.emailProtection` for S/MIME, for instance." }, { "name": "crls", "type": "readonly Uint8Array[] | undefined", "optional": true, "summary": "CRLs, as DER, added to those the message carries." }, { "name": "ocspResponses", "type": "readonly Uint8Array[] | undefined", "optional": true, "summary": "OCSP responses, as DER, added to those the message carries." }, { "name": "requireRevocation", "type": "boolean | undefined", "optional": true, "summary": "Report `PKI_REASON_REVOCATION_UNKNOWN` when nothing covered a signer's certificate." }, { "name": "at", "type": "number | undefined", "optional": true, "summary": "The instant to judge the chains at." }, { "name": "atTimeStamp", "type": "boolean | undefined", "optional": true, "summary": "Judge each signer's chain at the time its own verified RFC 3161 timestamp proves the signature existed by — `genTime` plus the declared accuracy — instead of `at`." }, { "name": "allowSha1", "type": "boolean | undefined", "optional": true, "summary": "Treat SHA-1 signatures as evidence." }, { "name": "requireSigningCertificate", "type": "boolean | undefined", "optional": true, "summary": "Require every signer to name its certificate in a signing-certificate attribute, as CAdES and PAdES do." }, { "name": "requireAlgorithmProtection", "type": "boolean | undefined", "optional": true, "summary": "Require every signer to protect its algorithms with `CMSAlgorithmProtection` (RFC 6211)." }, { "name": "allowTrailingData", "type": "boolean | undefined", "optional": true, "summary": "Ignore bytes after the ContentInfo — the zero padding of a PDF `/Contents`." }, { "name": "encodingRules", "type": "EncodingRules | undefined", "optional": true, "summary": "`'ber'` for a message from a PKCS #7 producer that streams with indefinite lengths." }, { "name": "limits", "type": "Partial | undefined", "optional": true, "summary": "Overrides for any subset of `DEFAULT_PKI_LIMITS`." } ] }, { "name": "VerifySignedDataReport", "kind": "type", "module": "src/verify/verify-signed-data.ts", "signature": "export interface VerifySignedDataReport", "summary": "The verdict on a signed message.", "throws": null, "params": null, "returns": null, "members": [ { "name": "valid", "type": "boolean", "optional": false, "summary": "Whether the message has at least one signer and every signer is valid." }, { "name": "signedData", "type": "SignedData | undefined", "optional": false, "summary": "The message, parsed; `undefined` when it could not be read." }, { "name": "signers", "type": "readonly SignerReport[]", "optional": false, "summary": "One verdict per signer, in encoded order." }, { "name": "reasons", "type": "readonly PkiReason[]", "optional": false, "summary": "Every reason, from every signer and from the message itself." }, { "name": "signatureVerifications", "type": "number", "optional": false, "summary": "How many signature verifications this cost, chains and timestamps included." } ] }, { "name": "VerifySignerInfoSignatureOptions", "kind": "type", "module": "src/crypto/cms-verify.ts", "signature": "export interface VerifySignerInfoSignatureOptions", "summary": "Options of verifySignerInfoSignature.", "throws": null, "params": null, "returns": null, "members": [ { "name": "content", "type": "Uint8Array | undefined", "optional": true, "summary": "The content octets, for a signer **without** signed attributes: such a signer signs the content itself (RFC 5652 §5.4), so nothing else can be checked." }, { "name": "allowSha1", "type": "boolean | undefined", "optional": true, "summary": "Treat a SHA-1 signature as evidence." } ] }, { "name": "VerifyTimeStampTokenInput", "kind": "type", "module": "src/verify/verify-timestamp.ts", "signature": "export interface VerifyTimeStampTokenInput", "summary": "What to verify a timestamp token against.", "throws": null, "params": null, "returns": null, "members": [ { "name": "token", "type": "Uint8Array | undefined", "optional": true, "summary": "The token: a ContentInfo whose content is a SignedData over a TSTInfo." }, { "name": "response", "type": "Uint8Array | undefined", "optional": true, "summary": "The whole `TimeStampResp` the TSA sent back, when you hold that rather than the token inside it." }, { "name": "request", "type": "Uint8Array | undefined", "optional": true, "summary": "The `TimeStampReq` you sent." }, { "name": "data", "type": "Uint8Array | undefined", "optional": true, "summary": "The data that was stamped." }, { "name": "imprint", "type": "Uint8Array | undefined", "optional": true, "summary": "The hash that was stamped, when you hold that rather than the data." }, { "name": "certificates", "type": "readonly Certificate[] | undefined", "optional": true, "summary": "Certificates to look for the TSA's among, beyond those the token carries — needed when the request set certReq to false." }, { "name": "trustAnchors", "type": "readonly Certificate[]", "optional": false, "summary": "The anchors the TSA must chain to." }, { "name": "crls", "type": "readonly Uint8Array[] | undefined", "optional": true, "summary": "CRLs for the TSA's chain, as DER." }, { "name": "ocspResponses", "type": "readonly Uint8Array[] | undefined", "optional": true, "summary": "OCSP responses for the TSA's certificate, as DER." }, { "name": "requireRevocation", "type": "boolean | undefined", "optional": true, "summary": "Report `PKI_REASON_REVOCATION_UNKNOWN` when nothing covered the TSA's certificate." }, { "name": "at", "type": "number | undefined", "optional": true, "summary": "The instant to judge the TSA's chain at." }, { "name": "allowSha1", "type": "boolean | undefined", "optional": true, "summary": "Treat SHA-1 signatures as evidence." }, { "name": "allowNonCriticalTimeStampingEku", "type": "boolean | undefined", "optional": true, "summary": "Accept a TSA whose extKeyUsage names timestamping but is not critical." }, { "name": "limits", "type": "Partial | undefined", "optional": true, "summary": "Overrides for any subset of `DEFAULT_PKI_LIMITS`." }, { "name": "onDiagnostic", "type": "PkiDiagnosticHandler | undefined", "optional": true, "summary": "Receive every diagnostic this verification raises or reads: what the token, the response and the TSA's chain say about themselves that their RFCs ask them not to, and what only this call can decide — whether the token honoured the request's `certReq` (RFC 3161 §2.4.1), which needs `request`." } ] }, { "name": "VerifyTimeStampTokenReport", "kind": "type", "module": "src/verify/verify-timestamp.ts", "signature": "export interface VerifyTimeStampTokenReport", "summary": "The verdict on a timestamp token, and what it established.", "throws": null, "params": null, "returns": null, "members": [ { "name": "valid", "type": "boolean", "optional": false, "summary": "Whether the token is evidence that the expected hash existed at `genTime`." }, { "name": "token", "type": "TimeStampToken | undefined", "optional": false, "summary": "The token, parsed; `undefined` when it could not be read." }, { "name": "genTime", "type": "PkiTime | undefined", "optional": false, "summary": "The time the token asserts — established only when `valid`." }, { "name": "earliest", "type": "number | undefined", "optional": false, "summary": "`genTime` minus the declared accuracy, in whole epoch milliseconds rounded down: the earliest the stamping can have happened." }, { "name": "latest", "type": "number | undefined", "optional": false, "summary": "`genTime` plus the declared accuracy, rounded up: the latest." }, { "name": "tsaCertificate", "type": "Certificate | undefined", "optional": false, "summary": "The TSA's certificate, when its key verified the token and it is the one the token names." }, { "name": "chain", "type": "VerifyCertificateChainReport | undefined", "optional": false, "summary": "The TSA's chain, judged by `verifyCertificateChain`; `undefined` when there was no certificate to judge." }, { "name": "reasons", "type": "readonly PkiReason[]", "optional": false, "summary": "Every reason the token is not evidence of what was asked." }, { "name": "signatureVerifications", "type": "number", "optional": false, "summary": "How many signature verifications this cost, the TSA's chain included." } ] }, { "name": "addTimeStampToken", "kind": "function", "module": "src/build/build-signed-data.ts", "signature": "export function addTimeStampToken(signedDataDer: Uint8Array, signerIndex: number, tokenDer: Uint8Array, options?: PkiBuildOptions): Uint8Array", "summary": "Add an RFC 3161 timestamp to a signer — the step that turns a signature into one whose time is proved (CAdES-T, PAdES B-T).", "throws": [ "PkiError" ], "params": [ { "name": "signedDataDer", "description": "The DER ContentInfo to add the timestamp to; not modified." }, { "name": "signerIndex", "description": "Which signer, counted from 0 in encoded order." }, { "name": "tokenDer", "description": "The TimeStampToken, as `parseTimeStampResponse` hands it back in `tokenDer`." }, { "name": "options", "description": "Limits, as `addUnsignedAttribute` takes them." } ], "returns": "A new DER ContentInfo, every signed octet unchanged.", "members": null }, { "name": "addUnsignedAttribute", "kind": "function", "module": "src/build/build-signed-data.ts", "signature": "export function addUnsignedAttribute(signedDataDer: Uint8Array, signerIndex: number, attributeDer: Uint8Array, options?: PkiBuildOptions): Uint8Array", "summary": "Add one unsigned attribute to one signer of a SignedData.", "throws": [ "PkiCmsError", "PkiEncodingError", "PkiError", "PkiLimitError" ], "params": [ { "name": "signedDataDer", "description": "The DER `ContentInfo` of a SignedData. It is not modified." }, { "name": "signerIndex", "description": "Which `signerInfos` entry, counted from 0 in encoded order." }, { "name": "attributeDer", "description": "One `Attribute` encoding, e.g. from `encodeAttribute`." }, { "name": "options", "description": "`limits`: `maxInputBytes`, `maxSignerInfos` and `maxAttributes` apply." } ], "returns": "A new `ContentInfo`, in DER.", "members": null }, { "name": "buildCertificatePath", "kind": "function", "module": "src/path/path-build.ts", "signature": "export function buildCertificatePath(input: BuildCertificatePathInput): BuildCertificatePathReport", "summary": "Build and validate a certification path.", "throws": [ "PkiError" ], "params": [ { "name": "input", "description": "See {@link BuildCertificatePathInput}." } ], "returns": "The first accepted path with §6's report, or the report of the attempt that got furthest; `explored` counts the candidates tried.", "members": null }, { "name": "canDecrypt", "kind": "function", "module": "src/crypto/webcrypto.ts", "signature": "export function canDecrypt(): boolean", "summary": "Whether this runtime can open a password-protected key or container at all.", "throws": [], "params": [], "returns": "Whether `globalThis.crypto.subtle` offers every operation PBES2 and RFC 9579 need. It does not say which ciphers the host implements — AES-192 is missing from several browsers that answer `true`.", "members": null }, { "name": "canSign", "kind": "function", "module": "src/crypto/webcrypto.ts", "signature": "export function canSign(): boolean", "summary": "Whether this runtime can sign at all.", "throws": [], "params": [], "returns": "Whether `globalThis.crypto.subtle` offers `sign`. It says nothing about which algorithms the host implements, nor about the key.", "members": null }, { "name": "canVerify", "kind": "function", "module": "src/crypto/webcrypto.ts", "signature": "export function canVerify(): boolean", "summary": "Whether this runtime can verify a signature at all.", "throws": [], "params": [], "returns": "Whether `globalThis.crypto.subtle` offers both `importKey` and `verify`. It does not say which algorithms the host implements — Ed448 and Ed25519 are missing on several runtimes that answer `true`.", "members": null }, { "name": "checkExtendedKeyUsage", "kind": "function", "module": "src/path/path-purpose.ts", "signature": "export function checkExtendedKeyUsage( path: readonly Certificate[], purpose: string, options?: CheckExtendedKeyUsageOptions, ): readonly PkiReason[]", "summary": "Check that every certificate in a path permits a purpose.", "throws": [], "params": [ { "name": "path", "description": "The validated path, **leaf first**, as a report returns it." }, { "name": "purpose", "description": "The KeyPurposeId OID needed, e.g. `KEY_PURPOSES.serverAuth`." }, { "name": "options", "description": "See {@link CheckExtendedKeyUsageOptions}." } ], "returns": "One `PKI_REASON_PURPOSE_NOT_PERMITTED` per certificate that forbids the purpose; empty when every certificate permits it.", "members": null }, { "name": "checkOcspStatus", "kind": "function", "module": "src/revocation/ocsp-check.ts", "signature": "export function checkOcspStatus(input: CheckOcspStatusInput): readonly PkiReason[]", "summary": "Decide what an OCSP response establishes about one certificate.", "throws": [], "params": [ { "name": "input", "description": "See {@link CheckOcspStatusInput}." } ], "returns": "Every reason the answer is not a clean `good`; empty when it is.", "members": null }, { "name": "checkRevocation", "kind": "function", "module": "src/revocation/crl-check.ts", "signature": "export function checkRevocation(input: CheckRevocationInput): readonly PkiReason[]", "summary": "Decide a certificate's revocation status against one CRL.", "throws": [ "PkiCertificateError", "PkiLimitError" ], "params": [ { "name": "input", "description": "See {@link CheckRevocationInput}." } ], "returns": "Every reason the answer is not a clean \"not revoked\", in the order they were established; empty when the certificate is not revoked.", "members": null }, { "name": "checkServerName", "kind": "function", "module": "src/path/path-server-name.ts", "signature": "export function checkServerName( certificate: Certificate, reference: ServerIdentity, options?: CheckServerNameOptions, ): readonly PkiReason[]", "summary": "Check that a certificate names the host or address the caller asked about.", "throws": [], "params": [ { "name": "certificate", "description": "The end-entity certificate presented." }, { "name": "reference", "description": "The host or address the caller connected to; a `dns` value that spells an address is read as one." }, { "name": "options", "description": "See {@link CheckServerNameOptions}." } ], "returns": "`PKI_REASON_NAME_MISMATCH` when nothing matches; empty when something does.", "members": null }, { "name": "computeFingerprint", "kind": "function", "module": "src/hash/fingerprint.ts", "signature": "export function computeFingerprint(der: Uint8Array, algorithm: FingerprintAlgorithm): Uint8Array", "summary": "Compute a fingerprint synchronously.", "throws": [ "PkiError" ], "params": [ { "name": "der", "description": "The exact encoding to fingerprint, typically `certificate.der`." }, { "name": "algorithm", "description": "`'SHA-1'`, `'SHA-256'`, `'SHA-384'` or `'SHA-512'`." } ], "returns": "The digest octets.", "members": null }, { "name": "computeFingerprintAsync", "kind": "function", "module": "src/hash/fingerprint.ts", "signature": "export async function computeFingerprintAsync(der: Uint8Array, algorithm: FingerprintAlgorithm): Promise", "summary": "Compute a fingerprint through Web Crypto when available, and through the pure-TypeScript hashes otherwise.", "throws": [ "PkiError" ], "params": [ { "name": "der", "description": "The exact encoding to fingerprint." }, { "name": "algorithm", "description": "`'SHA-1'`, `'SHA-256'`, `'SHA-384'` or `'SHA-512'`." } ], "returns": "A promise of the digest octets.", "members": null }, { "name": "computeKeyIdentifier", "kind": "function", "module": "src/hash/key-identifier.ts", "signature": "export function computeKeyIdentifier(publicKeyBits: Uint8Array, algorithm: 'SHA-1' | 'SHA-256' = 'SHA-1'): Uint8Array", "summary": "Compute a key identifier from a public key's BIT STRING content.", "throws": [ "PkiError" ], "params": [ { "name": "publicKeyBits", "description": "The BIT STRING **content** of the public key: no tag, no length, no unused-bits octet. `subjectPublicKeyInfo.publicKey.bytes` on a parsed certificate is exactly this." }, { "name": "algorithm", "description": "The digest. `'SHA-1'` by default, per §4.2.1.2 method 1." } ], "returns": "The identifier: 20 bytes for SHA-1, 32 for SHA-256.", "members": null }, { "name": "createCertificate", "kind": "function", "module": "src/build/build-certificate.ts", "signature": "export async function createCertificate(description: CertificateDescription, signer: Signer, options?: PkiBuildOptions): Promise", "summary": "Build and sign an RFC 5280 certificate.", "throws": [ "PkiCryptoError", "PkiError", "PkiLimitError" ], "params": [ { "name": "description", "description": "What the certificate says." }, { "name": "signer", "description": "The key that signs it, and the algorithm it signs with: a `SigningKey` for Web Crypto, or an `ExternalSigner` for a key held elsewhere." }, { "name": "options", "description": "See {@link PkiBuildOptions}." } ], "returns": "The complete certificate, in DER.", "members": null }, { "name": "createCertificationRequest", "kind": "function", "module": "src/build/build-csr.ts", "signature": "export async function createCertificationRequest( description: CertificationRequestDescription, signer: Signer, options?: PkiBuildOptions, ): Promise", "summary": "Build and sign a PKCS#10 certification request.", "throws": [ "PkiCryptoError", "PkiError", "PkiLimitError" ], "params": [ { "name": "description", "description": "What the request asks for." }, { "name": "signer", "description": "The key that signs it — the private half of `subjectPublicKey` — as a `SigningKey` for Web Crypto, or an `ExternalSigner` for a key held elsewhere." }, { "name": "options", "description": "See {@link PkiBuildOptions}." } ], "returns": "The complete `CertificationRequest`, in DER.", "members": null }, { "name": "createOcspRequest", "kind": "function", "module": "src/revocation/ocsp-request.ts", "signature": "export function createOcspRequest(certificate: Certificate, issuer: Certificate, options?: CreateOcspRequestOptions): Uint8Array", "summary": "Build an OCSP request for one certificate.", "throws": [ "PkiError" ], "params": [ { "name": "certificate", "description": "The certificate being asked about." }, { "name": "issuer", "description": "The certificate that issued it." }, { "name": "options", "description": "See {@link CreateOcspRequestOptions}." } ], "returns": "The encoded `OCSPRequest`, ready to POST.", "members": null }, { "name": "createSignedData", "kind": "function", "module": "src/build/build-signed-data.ts", "signature": "export async function createSignedData(input: CreateSignedDataInput, signer: Signer, options?: PkiBuildOptions): Promise", "summary": "Build and sign an RFC 5652 SignedData, returned as a DER `ContentInfo`.", "throws": [ "PkiCryptoError", "PkiEncodingError", "PkiError", "PkiLimitError" ], "params": [ { "name": "input", "description": "What is signed and what is written around it; see {@link CreateSignedDataInput}." }, { "name": "signer", "description": "The key that signs: a `SigningKey` for Web Crypto, or an `ExternalSigner` for a key held elsewhere." }, { "name": "options", "description": "`limits`: `maxAttributes` bounds each attribute list, `maxCmsCertificatesAndCrls` the certificates and revocation lists." } ], "returns": "The `ContentInfo` (id-signedData), in DER.", "members": null }, { "name": "createTimeStampRequest", "kind": "function", "module": "src/cms/tsp-request.ts", "signature": "export function createTimeStampRequest(hash: Uint8Array, options?: CreateTimeStampRequestOptions): Uint8Array", "summary": "Build an RFC 3161 `TimeStampReq` for a hash.", "throws": [ "PkiEncodingError", "PkiError" ], "params": [ { "name": "hash", "description": "The digest to stamp, computed with `hashAlgorithm`." }, { "name": "options", "description": "See {@link CreateTimeStampRequestOptions}." } ], "returns": "The DER `TimeStampReq`, ready to POST.", "members": null }, { "name": "decodeAsn1", "kind": "function", "module": "src/asn1/asn1-decode.ts", "signature": "export function decodeAsn1(data: Uint8Array, options?: DecodeAsn1Options): Asn1Node", "summary": "Decode one ASN.1 value — strict DER by default, BER with `encodingRules: 'ber'`.", "throws": [ "PkiEncodingError", "PkiError", "PkiLimitError" ], "params": [ { "name": "data", "description": "The encoded value. Nodes are zero-copy views of it." }, { "name": "options", "description": "Encoding rules, limits, diagnostics, and whether bytes may follow the value." } ], "returns": "The root node, with every descendant decoded.", "members": null }, { "name": "decodeAsn1Sequence", "kind": "function", "module": "src/asn1/asn1-decode.ts", "signature": "export function decodeAsn1Sequence(data: Uint8Array, options?: DecodeAsn1Options): readonly Asn1Node[]", "summary": "Decode a concatenation of ASN.1 values placed back to back (an empty input yields no value).", "throws": [ "PkiEncodingError", "PkiError", "PkiLimitError" ], "params": [ { "name": "data", "description": "The concatenated encodings." }, { "name": "options", "description": "Encoding rules, limits and diagnostics." } ], "returns": "Every value, in input order.", "members": null }, { "name": "decodeExtensionValue", "kind": "function", "module": "src/x509/x509-extensions.ts", "signature": "export function decodeExtensionValue(oid: string, valueDer: Uint8Array, options?: DecodeExtensionValueOptions): Extension", "summary": "Decode an extension value on its own — the content of an extnValue — as `parseCertificate` decodes it.", "throws": [ "PkiCertificateError", "PkiEncodingError", "PkiError", "PkiLimitError" ], "params": [ { "name": "oid", "description": "The extension OID, e.g. `2.5.29.17`." }, { "name": "valueDer", "description": "The DER encoding of the extension value." }, { "name": "options", "description": "`critical`, encoding rules, limits, `strict` and `onDiagnostic`." } ], "returns": "The decoded extension, or `kind: 'unknown'` for an OID pkinative does not decode.", "members": null }, { "name": "decodeOid", "kind": "function", "module": "src/asn1/asn1-oid.ts", "signature": "export function decodeOid(content: Uint8Array, options?: PkiParseOptions): string", "summary": "Decode the content octets of an OBJECT IDENTIFIER to dotted decimal.", "throws": [ "PkiEncodingError", "PkiLimitError" ], "params": [ { "name": "content", "description": "The content octets (not the tag and length)." }, { "name": "options", "description": "Limits (`maxOidBytes`)." } ], "returns": "The dotted-decimal OID, e.g. `1.2.840.113549.1.1.11`.", "members": null }, { "name": "decodePem", "kind": "function", "module": "src/pem/pem.ts", "signature": "export function decodePem(text: string, options?: DecodePemOptions): readonly PemBlock[]", "summary": "Decode every PEM block of a text.", "throws": [ "PkiEncodingError", "PkiError", "PkiLimitError" ], "params": [ { "name": "text", "description": "The PEM text (explanatory text around the blocks is ignored)." }, { "name": "options", "description": "Mode (strict by default), a required label, limits and diagnostics." } ], "returns": "The blocks in text order, with their labels, payloads, headers and offsets.", "members": null }, { "name": "decryptPrivateKey", "kind": "function", "module": "src/keys/key-import.ts", "signature": "export async function decryptPrivateKey(der: Uint8Array, options: DecryptPrivateKeyOptions): Promise", "summary": "Decrypt a password-protected PKCS#8 private key — the DER of an `ENCRYPTED PRIVATE KEY` PEM block — into a non-extractable signing key.", "throws": [ "PkiCryptoError", "PkiEncodingError", "PkiError", "PkiKeyError", "PkiLimitError" ], "params": [ { "name": "der", "description": "The DER of a RFC 5958 §3 `EncryptedPrivateKeyInfo`." }, { "name": "options", "description": "The password, the algorithm the key signs with, and the encoding rules, limits and diagnostics of the parse." } ], "returns": "The key and the algorithm it signs with.", "members": null }, { "name": "encodeAlgorithmIdentifier", "kind": "function", "module": "src/build/build-structures.ts", "signature": "export function encodeAlgorithmIdentifier(oid: string, parameters?: Uint8Array): Uint8Array", "summary": "Encode an `AlgorithmIdentifier`, with the parameters its OID requires.", "throws": [ "PkiEncodingError" ], "params": [ { "name": "oid", "description": "The algorithm OID." }, { "name": "parameters", "description": "The encoded parameters. Omitted, the RFC 3279 rule decides: NULL for the PKCS#1 v1.5 family, absent for everything else." } ], "returns": "The `AlgorithmIdentifier` encoding.", "members": null }, { "name": "encodeAsn1Node", "kind": "function", "module": "src/asn1/asn1-encode.ts", "signature": "export function encodeAsn1Node(node: Asn1Node): Uint8Array", "summary": "Re-encode a decoded node tree in DER.", "throws": [ "PkiError" ], "params": [ { "name": "node", "description": "A node returned by decodeAsn1." } ], "returns": "The DER encoding of the tree.", "members": null }, { "name": "encodeAttribute", "kind": "function", "module": "src/build/build-structures.ts", "signature": "export function encodeAttribute(oid: string, values: readonly Uint8Array[]): Uint8Array", "summary": "Encode an `Attribute` — a type OID and a SET OF values.", "throws": [ "PkiEncodingError", "PkiError" ], "params": [ { "name": "oid", "description": "The attribute type OID." }, { "name": "values", "description": "The DER encodings of the values." } ], "returns": "The `Attribute` encoding.", "members": null }, { "name": "encodeAuthorityKeyIdentifier", "kind": "function", "module": "src/build/build-structures.ts", "signature": "export function encodeAuthorityKeyIdentifier(keyIdentifier: Uint8Array): Uint8Array", "summary": "`authorityKeyIdentifier` (RFC 5280 §4.2.1.1) with the issuer's key identifier.", "throws": [ "PkiError" ], "params": [ { "name": "keyIdentifier", "description": "The issuing certificate's subjectKeyIdentifier octets." } ], "returns": "The extension value's DER.", "members": null }, { "name": "encodeBasicConstraints", "kind": "function", "module": "src/build/build-structures.ts", "signature": "export function encodeBasicConstraints(options: { readonly cA: boolean; readonly pathLenConstraint?: number | undefined }): Uint8Array", "summary": "`basicConstraints` (RFC 5280 §4.2.1.9).", "throws": [ "PkiError" ], "params": [ { "name": "options", "description": "`cA`, and `pathLenConstraint` for a CA that limits how many intermediates may follow it." } ], "returns": "The extension value's DER.", "members": null }, { "name": "encodeBitString", "kind": "function", "module": "src/asn1/asn1-encode.ts", "signature": "export function encodeBitString(bytes: Uint8Array, unusedBits = 0): Uint8Array", "summary": "Encode a BIT STRING.", "throws": [ "PkiEncodingError" ], "params": [ { "name": "bytes", "description": "The octets." }, { "name": "unusedBits", "description": "Unused bits in the last octet, 0 to 7; they must be zero." } ], "returns": "The BIT STRING encoding.", "members": null }, { "name": "encodeBoolean", "kind": "function", "module": "src/asn1/asn1-encode.ts", "signature": "export function encodeBoolean(value: boolean): Uint8Array", "summary": "Encode a BOOLEAN (TRUE as 0xFF, as DER requires).", "throws": [], "params": [ { "name": "value", "description": "The boolean." } ], "returns": "The BOOLEAN encoding.", "members": null }, { "name": "encodeDistinguishedName", "kind": "function", "module": "src/build/build-structures.ts", "signature": "export function encodeDistinguishedName(name: NameDescription, options?: PkiBuildOptions): Uint8Array", "summary": "Encode a `Name` (an RDNSequence).", "throws": [ "PkiError", "PkiLimitError" ], "params": [ { "name": "name", "description": "The RDNs, most significant first." }, { "name": "options", "description": "`limits` bounds the attribute count." } ], "returns": "The `Name` encoding.", "members": null }, { "name": "encodeEnumerated", "kind": "function", "module": "src/asn1/asn1-encode.ts", "signature": "export function encodeEnumerated(value: bigint | number): Uint8Array", "summary": "Encode an ENUMERATED (X.690 §8.4), whose content is an INTEGER's.", "throws": [ "PkiEncodingError" ], "params": [ { "name": "value", "description": "The enumeration value." } ], "returns": "The ENUMERATED encoding.", "members": null }, { "name": "encodeExplicit", "kind": "function", "module": "src/asn1/asn1-encode.ts", "signature": "export function encodeExplicit(tagNumber: number, inner: Uint8Array, options?: { readonly tagClass?: TagClass | undefined }): Uint8Array", "summary": "Wrap an already-encoded value in an explicit tag: `[n] EXPLICIT`.", "throws": [ "PkiEncodingError", "PkiError" ], "params": [ { "name": "tagNumber", "description": "The tag number." }, { "name": "inner", "description": "The encoding of the value being tagged." }, { "name": "options", "description": "`tagClass` defaults to `'context'`." } ], "returns": "The tagged encoding.", "members": null }, { "name": "encodeExtendedKeyUsage", "kind": "function", "module": "src/build/build-structures.ts", "signature": "export function encodeExtendedKeyUsage(purposes: readonly string[]): Uint8Array", "summary": "`extendedKeyUsage` (RFC 5280 §4.2.1.12): a SEQUENCE OF key-purpose OIDs.", "throws": [ "PkiEncodingError", "PkiError" ], "params": [ { "name": "purposes", "description": "The purpose OIDs, e.g. `1.3.6.1.5.5.7.3.1` for serverAuth." } ], "returns": "The extension value's DER.", "members": null }, { "name": "encodeExtension", "kind": "function", "module": "src/build/build-structures.ts", "signature": "export function encodeExtension(extension: ExtensionDescription): Uint8Array", "summary": "Encode one `Extension`.", "throws": [ "PkiEncodingError", "PkiError" ], "params": [ { "name": "extension", "description": "The OID, the criticality and the value's DER." } ], "returns": "The `Extension` encoding.", "members": null }, { "name": "encodeExtensions", "kind": "function", "module": "src/build/build-structures.ts", "signature": "export function encodeExtensions(extensions: readonly ExtensionDescription[], options?: PkiBuildOptions): Uint8Array", "summary": "Encode an `Extensions` SEQUENCE.", "throws": [ "PkiError", "PkiLimitError" ], "params": [ { "name": "extensions", "description": "The extensions, in the order they are placed." }, { "name": "options", "description": "`limits` bounds the count." } ], "returns": "The `Extensions` encoding.", "members": null }, { "name": "encodeImplicit", "kind": "function", "module": "src/asn1/asn1-encode.ts", "signature": "export function encodeImplicit(tagNumber: number, encoded: Uint8Array, options?: { readonly tagClass?: TagClass | undefined }): Uint8Array", "summary": "Re-tag an already-encoded value in place: `[n] IMPLICIT`.", "throws": [ "PkiEncodingError", "PkiError" ], "params": [ { "name": "tagNumber", "description": "The replacement tag number." }, { "name": "encoded", "description": "A complete DER encoding whose identifier is replaced." }, { "name": "options", "description": "`tagClass` defaults to `'context'`." } ], "returns": "The re-tagged encoding.", "members": null }, { "name": "encodeInteger", "kind": "function", "module": "src/asn1/asn1-encode.ts", "signature": "export function encodeInteger(value: bigint | number): Uint8Array", "summary": "Encode an INTEGER in minimal two's complement form.", "throws": [ "PkiEncodingError" ], "params": [ { "name": "value", "description": "A bigint, or a safe-integer number." } ], "returns": "The INTEGER encoding.", "members": null }, { "name": "encodeKeyUsage", "kind": "function", "module": "src/build/build-structures.ts", "signature": "export function encodeKeyUsage(usages: Iterable): Uint8Array", "summary": "`keyUsage` (RFC 5280 §4.2.1.3).", "throws": [ "PkiError" ], "params": [ { "name": "usages", "description": "The usage names, in any order — {@link KEY_USAGE_BITS} lists them." } ], "returns": "The extension value's DER, with every trailing zero bit dropped.", "members": null }, { "name": "encodeNameAttribute", "kind": "function", "module": "src/build/build-structures.ts", "signature": "export function encodeNameAttribute(attribute: NameAttribute): Uint8Array", "summary": "Encode one `AttributeTypeAndValue`.", "throws": [ "PkiEncodingError", "PkiError" ], "params": [ { "name": "attribute", "description": "The type OID and its value." } ], "returns": "The `AttributeTypeAndValue` encoding.", "members": null }, { "name": "encodeNamedBits", "kind": "function", "module": "src/asn1/asn1-encode.ts", "signature": "export function encodeNamedBits(bits: Iterable): Uint8Array", "summary": "Encode a named-bit BIT STRING with the DER trailing-zero rule.", "throws": [ "PkiEncodingError" ], "params": [ { "name": "bits", "description": "The set positions, counted from bit 0 as the most significant bit of the first octet." } ], "returns": "The BIT STRING encoding, with no trailing zero bit.", "members": null }, { "name": "encodeNull", "kind": "function", "module": "src/asn1/asn1-encode.ts", "signature": "export function encodeNull(): Uint8Array", "summary": "Encode a NULL.", "throws": [], "params": [], "returns": "The two octets 05 00.", "members": null }, { "name": "encodeObjectIdentifier", "kind": "function", "module": "src/asn1/asn1-encode.ts", "signature": "export function encodeObjectIdentifier(oid: string): Uint8Array", "summary": "Encode an OBJECT IDENTIFIER from dotted decimal.", "throws": [ "PkiEncodingError" ], "params": [ { "name": "oid", "description": "A dotted-decimal OID." } ], "returns": "The OBJECT IDENTIFIER encoding.", "members": null }, { "name": "encodeOcspCertId", "kind": "function", "module": "src/revocation/ocsp-request.ts", "signature": "export function encodeOcspCertId(certificate: Certificate, issuer: Certificate, algorithm: OcspHashAlgorithm = 'SHA-1'): Uint8Array", "summary": "Build a `CertID` for one certificate under one issuer.", "throws": [ "PkiError" ], "params": [ { "name": "certificate", "description": "The certificate being asked about." }, { "name": "issuer", "description": "The certificate that issued it." }, { "name": "algorithm", "description": "The digest; SHA-1 by default." } ], "returns": "The encoded `CertID`.", "members": null }, { "name": "encodeOctetString", "kind": "function", "module": "src/asn1/asn1-encode.ts", "signature": "export function encodeOctetString(bytes: Uint8Array): Uint8Array", "summary": "Encode an OCTET STRING.", "throws": [ "PkiError" ], "params": [ { "name": "bytes", "description": "The octets." } ], "returns": "The OCTET STRING encoding.", "members": null }, { "name": "encodeOid", "kind": "function", "module": "src/asn1/asn1-oid.ts", "signature": "export function encodeOid(oid: string): Uint8Array", "summary": "Encode a dotted-decimal OID as content octets (without tag and length).", "throws": [ "PkiEncodingError", "PkiError" ], "params": [ { "name": "oid", "description": "A dotted-decimal OID, e.g. `2.5.29.17`." } ], "returns": "The minimal base-128 content octets.", "members": null }, { "name": "encodePem", "kind": "function", "module": "src/pem/pem.ts", "signature": "export function encodePem(label: string, bytes: Uint8Array): string", "summary": "Encode bytes as one strict RFC 7468 block: 64-character lines, LF line endings.", "throws": [ "PkiEncodingError", "PkiError" ], "params": [ { "name": "label", "description": "The label, e.g. `CERTIFICATE`." }, { "name": "bytes", "description": "The binary payload." } ], "returns": "The PEM text, ending with a line feed.", "members": null }, { "name": "encodeRelativeOid", "kind": "function", "module": "src/asn1/asn1-encode.ts", "signature": "export function encodeRelativeOid(oid: string): Uint8Array", "summary": "Encode a RELATIVE-OID (X.690 §8.20) from its dotted-decimal arcs: one subidentifier per arc, with none of the first-two-arcs packing of an OBJECT IDENTIFIER, so `8571.3.2` is `0D 04 C2 7B 03 02` (the §8.20.2 example).", "throws": [ "PkiEncodingError", "PkiError" ], "params": [ { "name": "oid", "description": "One or more decimal arcs without leading zeros, separated by dots." } ], "returns": "The RELATIVE-OID encoding.", "members": null }, { "name": "encodeSequence", "kind": "function", "module": "src/asn1/asn1-encode.ts", "signature": "export function encodeSequence(children: readonly Uint8Array[]): Uint8Array", "summary": "Encode a SEQUENCE from its encoded components, in the order given.", "throws": [ "PkiError" ], "params": [ { "name": "children", "description": "The DER encodings of the components." } ], "returns": "The SEQUENCE encoding.", "members": null }, { "name": "encodeSet", "kind": "function", "module": "src/asn1/asn1-encode.ts", "signature": "export function encodeSet(children: readonly Uint8Array[]): Uint8Array", "summary": "Encode a SET whose component order the schema fixes (SET, not SET OF).", "throws": [ "PkiError" ], "params": [ { "name": "children", "description": "The DER encodings of the components, in schema order." } ], "returns": "The SET encoding.", "members": null }, { "name": "encodeSetOf", "kind": "function", "module": "src/asn1/asn1-encode.ts", "signature": "export function encodeSetOf(children: readonly Uint8Array[]): Uint8Array", "summary": "Encode a SET OF with the canonical DER ordering: the component encodings sorted as octet strings (X.690 §11.6).", "throws": [ "PkiError" ], "params": [ { "name": "children", "description": "The DER encodings of the components, in any order." } ], "returns": "The SET OF encoding.", "members": null }, { "name": "encodeSignatureAlgorithm", "kind": "function", "module": "src/build/build-certificate.ts", "signature": "export function encodeSignatureAlgorithm(signer: Signer): Uint8Array", "summary": "The `AlgorithmIdentifier` a signature algorithm writes into a structure, parameters included — RSASSA-PSS carries its digest and salt length, and a verifier reads them back out of exactly these bytes.", "throws": [ "PkiCryptoError" ], "params": [ { "name": "signer", "description": "A `SigningKey` or an `ExternalSigner`; only its algorithm is read." } ], "returns": "The `AlgorithmIdentifier` encoding.", "members": null }, { "name": "encodeString", "kind": "function", "module": "src/asn1/asn1-encode.ts", "signature": "export function encodeString(type: Asn1StringType, value: string): Uint8Array", "summary": "Encode a character string, refusing any character outside the type.", "throws": [ "PkiEncodingError", "PkiError" ], "params": [ { "name": "type", "description": "The string type." }, { "name": "value", "description": "The text." } ], "returns": "The string encoding.", "members": null }, { "name": "encodeSubjectAltName", "kind": "function", "module": "src/build/build-structures.ts", "signature": "export function encodeSubjectAltName(names: readonly GeneralNameDescription[]): Uint8Array", "summary": "`subjectAltName` (RFC 5280 §4.2.1.6), and `issuerAltName`, which has the same value syntax.", "throws": [ "PkiEncodingError", "PkiError" ], "params": [ { "name": "names", "description": "The names, in the order they are placed." } ], "returns": "The extension value's DER.", "members": null }, { "name": "encodeSubjectKeyIdentifier", "kind": "function", "module": "src/build/build-structures.ts", "signature": "export function encodeSubjectKeyIdentifier(keyIdentifier: Uint8Array): Uint8Array", "summary": "`subjectKeyIdentifier` (RFC 5280 §4.2.1.2): an OCTET STRING, conventionally the SHA-1 of the subject public key's bits.", "throws": [ "PkiError" ], "params": [ { "name": "keyIdentifier", "description": "The identifier octets." } ], "returns": "The extension value's DER.", "members": null }, { "name": "encodeSubjectPublicKeyInfo", "kind": "function", "module": "src/build/build-structures.ts", "signature": "export function encodeSubjectPublicKeyInfo(algorithmOid: string, publicKey: Uint8Array, parameters?: Uint8Array): Uint8Array", "summary": "Encode a `SubjectPublicKeyInfo` from its parts.", "throws": [ "PkiEncodingError", "PkiError" ], "params": [ { "name": "algorithmOid", "description": "The key algorithm OID, e.g. `1.2.840.113549.1.1.1`." }, { "name": "publicKey", "description": "The key bits, as the BIT STRING's octets." }, { "name": "parameters", "description": "The algorithm parameters, following the RFC 3279 rule when omitted." } ], "returns": "The `SubjectPublicKeyInfo` encoding.", "members": null }, { "name": "encodeTime", "kind": "function", "module": "src/asn1/asn1-encode.ts", "signature": "export function encodeTime(epochMilliseconds: number, type: 'UTCTime' | 'GeneralizedTime' | 'rfc5280' = 'rfc5280'): Uint8Array", "summary": "Encode an instant as a UTCTime or a GeneralizedTime in its DER form.", "throws": [ "PkiEncodingError", "PkiError" ], "params": [ { "name": "epochMilliseconds", "description": "The instant, in milliseconds since 1970-01-01T00:00:00Z." }, { "name": "type", "description": "`'rfc5280'` (default) picks UTCTime for 1950–2049 and GeneralizedTime otherwise, with whole seconds; `'UTCTime'` requires 1950–2049 and whole seconds; `'GeneralizedTime'` writes a fraction when needed." } ], "returns": "The time encoding.", "members": null }, { "name": "encodeTlv", "kind": "function", "module": "src/asn1/asn1-encode.ts", "signature": "export function encodeTlv(tagClass: TagClass, tagNumber: number, constructed: boolean, content: Uint8Array): Uint8Array", "summary": "Encode one tag-length-value in DER: the shortest identifier and length forms.", "throws": [ "PkiEncodingError" ], "params": [ { "name": "tagClass", "description": "The class of the tag." }, { "name": "tagNumber", "description": "The tag number, 0 to 2^31 − 1 (0 is refused in the universal class)." }, { "name": "constructed", "description": "Whether the content is a concatenation of encodings." }, { "name": "content", "description": "The content octets." } ], "returns": "The encoding.", "members": null }, { "name": "encodeValidity", "kind": "function", "module": "src/build/build-structures.ts", "signature": "export function encodeValidity(notBefore: number, notAfter: number): Uint8Array", "summary": "Encode a `Validity`.", "throws": [ "PkiEncodingError", "PkiError" ], "params": [ { "name": "notBefore", "description": "Start, in epoch milliseconds." }, { "name": "notAfter", "description": "End, in epoch milliseconds." } ], "returns": "The `Validity` encoding.", "members": null }, { "name": "findRevocation", "kind": "function", "module": "src/revocation/crl-parse.ts", "signature": "export function findRevocation(der: Uint8Array, serial: Uint8Array, options?: FindRevocationOptions): RevokedCertificate | undefined", "summary": "Look one serial number up in the revocation list.", "throws": [ "PkiCertificateError", "PkiLimitError" ], "params": [ { "name": "der", "description": "The same bytes `parseCertificateList` was given." }, { "name": "serial", "description": "The certificate's serial number." }, { "name": "options", "description": "The same options, plus `issuerDer`; the limits apply to the walk." } ], "returns": "The entry, or undefined when the serial is not listed.", "members": null }, { "name": "formatDistinguishedName", "kind": "function", "module": "src/x509/x509-name-format.ts", "signature": "export function formatDistinguishedName(name: DistinguishedName): string", "summary": "Format a distinguished name as an RFC 4514 string, e.g. `CN=example.com,O=Example,C=US`.", "throws": [ "PkiError" ], "params": [ { "name": "name", "description": "A name from a parsed certificate (`certificate.subject`, `certificate.issuer`)." } ], "returns": "The RFC 4514 string; an empty name gives the empty string.", "members": null }, { "name": "formatFingerprint", "kind": "function", "module": "src/hash/fingerprint.ts", "signature": "export function formatFingerprint(digest: Uint8Array, options?: FormatFingerprintOptions): string", "summary": "Render a digest the way certificate tools display it, e.g. `AB:CD:…`.", "throws": [ "PkiError" ], "params": [ { "name": "digest", "description": "The digest octets." }, { "name": "options", "description": "Separator (`':'` by default) and letter case (`'upper'` by default)." } ], "returns": "The formatted fingerprint.", "members": null }, { "name": "getExtension", "kind": "function", "module": "src/x509/x509-extensions.ts", "signature": "export function getExtension(certificate: Certificate, kind: K): Extract | undefined", "summary": "The decoded extension of one kind, e.g. `getExtension(cert, 'subjectAltName')?.names`.", "throws": [ "PkiError" ], "params": [ { "name": "certificate", "description": "A certificate from `parseCertificate`." }, { "name": "kind", "description": "The extension kind; RFC 5280 allows each extension once per certificate." } ], "returns": "The extension, or `undefined` when the certificate does not carry it, was parsed with `decodeExtensions: false`, or `kind` names no decoded extension kind (TypeScript refuses such a kind at compile time).", "members": null }, { "name": "getOidName", "kind": "function", "module": "src/oid/oid-names.ts", "signature": "export function getOidName(oid: string): string | undefined", "summary": "The display name of a registered object identifier.", "throws": [], "params": [ { "name": "oid", "description": "A dotted-decimal OID, e.g. `2.5.29.17`." } ], "returns": "The registered name (`subjectAltName`), or `undefined` for an OID the registry does not list and for any argument that is not a string.", "members": null }, { "name": "importPrivateKey", "kind": "function", "module": "src/keys/key-import.ts", "signature": "export async function importPrivateKey(der: Uint8Array, options?: ImportPrivateKeyOptions): Promise", "summary": "Import an unencrypted PKCS#8 private key — the DER of a `PRIVATE KEY` PEM block — as a non-extractable signing key.", "throws": [ "PkiCryptoError", "PkiEncodingError", "PkiError", "PkiKeyError", "PkiLimitError" ], "params": [ { "name": "der", "description": "The DER of a RFC 5958 `OneAsymmetricKey` (version 0 is RFC 5208 PKCS#8)." }, { "name": "options", "description": "Encoding rules, limits, diagnostics, and the algorithm — required for an RSA key, inferred for an EC, Ed25519 or Ed448 key." } ], "returns": "The key and the algorithm it signs with.", "members": null }, { "name": "isValidOid", "kind": "function", "module": "src/asn1/asn1-oid.ts", "signature": "export function isValidOid(oid: string): boolean", "summary": "Whether a string is a dotted-decimal OID X.660 allows: at least two arcs, the first 0, 1 or 2, the second at most 39 under 0 and 1, no leading zeros.", "throws": [], "params": [ { "name": "oid", "description": "The candidate string." } ], "returns": "True when `encodeOid` accepts it; false for anything else, a non-string included.", "members": null }, { "name": "matchDnsName", "kind": "function", "module": "src/path/path-server-name.ts", "signature": "export function matchDnsName(presented: string, reference: string, options?: MatchDnsNameOptions): boolean", "summary": "RFC 6125 §6.4: a presented `dNSName` against a reference host name.", "throws": [], "params": [ { "name": "presented", "description": "The certificate's name, possibly a wildcard." }, { "name": "reference", "description": "The host the caller asked about." }, { "name": "options", "description": "`allowWildcards: false` refuses every wildcard; on by default." } ], "returns": "Whether they identify the same host.", "members": null }, { "name": "openPkcs12", "kind": "function", "module": "src/verify/verify-pkcs12.ts", "signature": "export async function openPkcs12(der: Uint8Array, options: OpenPkcs12Options): Promise", "summary": "Open a PKCS#12 in one call: its MAC, its SafeContents, its certificates and its keys.", "throws": [ "PkiCryptoError", "PkiError" ], "params": [ { "name": "der", "description": "The PFX, as DER — or BER with `encodingRules: 'ber'`, which Windows writes." }, { "name": "options", "description": "The password, and what to accept." } ], "returns": "What was opened and why anything was not. Never rejects for a problem with the file.", "members": null }, { "name": "openSafeContents", "kind": "function", "module": "src/keys/key-pkcs12.ts", "signature": "export async function openSafeContents(contents: SafeContentsInfo, password: Uint8Array | string, options?: PkiParseOptions): Promise", "summary": "The bags of one SafeContents: those already read when it is plain, or, when it is PBES2-encrypted, the plaintext decrypted through Web Crypto and read with the same bag reader, with paths under `contents.path`.", "throws": [ "PkiCryptoError", "PkiEncodingError", "PkiError", "PkiKeyError", "PkiLimitError" ], "params": [ { "name": "contents", "description": "An entry of `parsePkcs12(…).contents`." }, { "name": "password", "description": "The password, as a string (UTF-8) or as exact octets; unused for a plain SafeContents." }, { "name": "options", "description": "Encoding rules, limits (`maxPkcs12Bags`, `maxKdfIterations`, `maxPkcs12KdfIterations`) and diagnostics for the decrypted SafeContents." } ], "returns": "The bags, in encoded order, nested safeContentsBags flattened.", "members": null }, { "name": "parseCertificate", "kind": "function", "module": "src/x509/x509-certificate.ts", "signature": "export function parseCertificate(der: Uint8Array, options?: ParseCertificateOptions): Certificate", "summary": "Parse a DER-encoded X.509 certificate (RFC 5280 §4.1).", "throws": [ "PkiCertificateError", "PkiEncodingError", "PkiError", "PkiLimitError" ], "params": [ { "name": "der", "description": "The certificate encoding. The result holds zero-copy views of it: do not mutate it while you use the result." }, { "name": "options", "description": "Encoding rules (`'der'` by default), limits, `strict`, `onDiagnostic` and `decodeExtensions` (default `true`)." } ], "returns": "The frozen certificate, with every diagnostic of the parse on `diagnostics`.", "members": null }, { "name": "parseCertificateList", "kind": "function", "module": "src/revocation/crl-parse.ts", "signature": "export function parseCertificateList(der: Uint8Array, options?: PkiParseOptions): CertificateList", "summary": "Parse an RFC 5280 CertificateList.", "throws": [ "PkiCertificateError", "PkiEncodingError", "PkiError", "PkiLimitError" ], "params": [ { "name": "der", "description": "The complete CertificateList." }, { "name": "options", "description": "Encoding rules, limits, diagnostics — the same options every other entry point takes." } ], "returns": "The parsed CRL, with zero-copy views of `der`.", "members": null }, { "name": "parseCertificationRequest", "kind": "function", "module": "src/x509/x509-csr.ts", "signature": "export function parseCertificationRequest(der: Uint8Array, options?: ParseCertificateOptions): CertificationRequest", "summary": "Parse a DER-encoded PKCS#10 certification request (RFC 2986 §4).", "throws": [ "PkiCertificateError", "PkiEncodingError", "PkiError", "PkiLimitError" ], "params": [ { "name": "der", "description": "The request encoding. The result holds zero-copy views of it: do not mutate it while you use the result." }, { "name": "options", "description": "Encoding rules (`'der'` by default), limits, `strict`, `onDiagnostic` and `decodeExtensions` (default `true`)." } ], "returns": "The frozen request, with every diagnostic of the parse on `diagnostics`.", "members": null }, { "name": "parseEncryptedPrivateKeyInfo", "kind": "function", "module": "src/keys/key-pkcs8.ts", "signature": "export function parseEncryptedPrivateKeyInfo(der: Uint8Array, options?: PkiParseOptions): EncryptedPrivateKeyInfo", "summary": "Read an encrypted PKCS#8 private key — the DER of an `ENCRYPTED PRIVATE KEY` PEM block — and say how it is protected, before anyone types a password.", "throws": [ "PkiEncodingError", "PkiError", "PkiKeyError", "PkiLimitError" ], "params": [ { "name": "der", "description": "The DER of a RFC 5958 §3 `EncryptedPrivateKeyInfo`." }, { "name": "options", "description": "Encoding rules, limits and diagnostics." } ], "returns": "The scheme and the ciphertext.", "members": null }, { "name": "parseOcspResponse", "kind": "function", "module": "src/revocation/ocsp-response.ts", "signature": "export function parseOcspResponse(der: Uint8Array, options?: PkiParseOptions): OcspResponse", "summary": "Parse an `OCSPResponse`.", "throws": [ "PkiCertificateError", "PkiEncodingError", "PkiLimitError" ], "params": [ { "name": "der", "description": "The complete OCSPResponse, as returned by a responder." }, { "name": "options", "description": "Encoding rules, limits, diagnostics." } ], "returns": "The parsed response, with zero-copy views of `der`.", "members": null }, { "name": "parsePkcs12", "kind": "function", "module": "src/keys/key-pkcs12.ts", "signature": "export function parsePkcs12(der: Uint8Array, options?: PkiParseOptions): Pkcs12", "summary": "Read a PKCS#12 file (`.p12`, `.pfx`) and describe it, without a password.", "throws": [ "PkiEncodingError", "PkiError", "PkiKeyError", "PkiLimitError" ], "params": [ { "name": "der", "description": "The DER (or, with `encodingRules: 'ber'`, the BER) of an RFC 7292 `PFX`." }, { "name": "options", "description": "Encoding rules, limits (`maxPkcs12Bags`, `maxKdfIterations`, `maxPkcs12KdfIterations`) and diagnostics." } ], "returns": "The container, read but not opened.", "members": null }, { "name": "parsePrivateKeyInfo", "kind": "function", "module": "src/keys/key-pkcs8.ts", "signature": "export function parsePrivateKeyInfo(der: Uint8Array, options?: PkiParseOptions): PrivateKeyInfo", "summary": "Read an unencrypted PKCS#8 private key — the DER of a `PRIVATE KEY` PEM block — and describe it without exposing its secret.", "throws": [ "PkiEncodingError", "PkiError", "PkiKeyError", "PkiLimitError" ], "params": [ { "name": "der", "description": "The DER of a RFC 5958 `OneAsymmetricKey` (version 0 is RFC 5208 PKCS#8)." }, { "name": "options", "description": "Encoding rules, limits and diagnostics." } ], "returns": "The key's description. The `privateKey` octets are not a field.", "members": null }, { "name": "parseSignedData", "kind": "function", "module": "src/cms/cms-signed-data.ts", "signature": "export function parseSignedData(der: Uint8Array, options?: ParseSignedDataOptions): SignedData", "summary": "Parse a CMS `ContentInfo` whose content is a `SignedData`.", "throws": [ "PkiCmsError", "PkiEncodingError", "PkiError", "PkiLimitError" ], "params": [ { "name": "der", "description": "The DER (or, with `encodingRules: 'ber'`, BER) of the ContentInfo." }, { "name": "options", "description": "Encoding rules, limits, diagnostics and `allowTrailingData`." } ], "returns": "The parsed SignedData, with zero-copy views of `der` — except `signedAttributesDer`, which is a copy with its tag replaced, and a segmented BER `eContent`, which is the concatenation of its segments. The caller must not mutate `der` while the result is in use.", "members": null }, { "name": "parseTimeStampResponse", "kind": "function", "module": "src/cms/tsp-response.ts", "signature": "export function parseTimeStampResponse(der: Uint8Array, options?: PkiParseOptions): TimeStampResponse", "summary": "Parse a `TimeStampResp` — what a TSA answers to a `TimeStampReq`.", "throws": [ "PkiCmsError", "PkiEncodingError", "PkiError", "PkiLimitError" ], "params": [ { "name": "der", "description": "The response, as the TSA sent it." }, { "name": "options", "description": "Encoding rules, limits and diagnostics." } ], "returns": "The parsed response, with zero-copy views of `der`.", "members": null }, { "name": "parseTimeStampToken", "kind": "function", "module": "src/cms/tsp-response.ts", "signature": "export function parseTimeStampToken(der: Uint8Array, options?: PkiParseOptions): TimeStampToken", "summary": "Parse a `TimeStampToken` — the token itself, as it is embedded in a signature or a PDF document timestamp.", "throws": [ "PkiCmsError", "PkiEncodingError", "PkiLimitError" ], "params": [ { "name": "der", "description": "The token: a ContentInfo whose content is a SignedData over a TSTInfo." }, { "name": "options", "description": "Encoding rules, limits and diagnostics, as `parseSignedData` takes them. The TSTInfo inside is always read as DER." } ], "returns": "The SignedData envelope and the TSTInfo it carries.", "members": null }, { "name": "parseTstInfo", "kind": "function", "module": "src/cms/tsp-tst-info.ts", "signature": "export function parseTstInfo(der: Uint8Array, options?: PkiParseOptions): TstInfo", "summary": "Parse a DER `TSTInfo` — the `eContent` of a timestamp token.", "throws": [ "PkiCmsError", "PkiEncodingError", "PkiLimitError" ], "params": [ { "name": "der", "description": "The DER of one TSTInfo." }, { "name": "options", "description": "Limits and diagnostics. `encodingRules` is ignored: a TSTInfo is always DER." } ], "returns": "The parsed TSTInfo, with zero-copy views of `der`.", "members": null }, { "name": "readBitString", "kind": "function", "module": "src/asn1/asn1-read.ts", "signature": "export function readBitString(node: Asn1Node, options?: PkiParseOptions): BitString", "summary": "Read a BIT STRING.", "throws": [ "PkiEncodingError" ], "params": [ { "name": "node", "description": "A BIT STRING node (constructed only under BER), or an implicitly tagged one." }, { "name": "options", "description": "Encoding rules (DER requires zero padding bits), limits and diagnostics." } ], "returns": "The octets (a zero-copy view when primitive) and the unused-bits count.", "members": null }, { "name": "readBoolean", "kind": "function", "module": "src/asn1/asn1-read.ts", "signature": "export function readBoolean(node: Asn1Node, options?: PkiParseOptions): boolean", "summary": "Read a BOOLEAN.", "throws": [ "PkiEncodingError" ], "params": [ { "name": "node", "description": "A BOOLEAN node, or an implicitly tagged one." }, { "name": "options", "description": "Encoding rules and diagnostics (DER requires TRUE as 0xFF)." } ], "returns": "The boolean value.", "members": null }, { "name": "readEnumerated", "kind": "function", "module": "src/asn1/asn1-read.ts", "signature": "export function readEnumerated(node: Asn1Node, options?: PkiParseOptions): bigint", "summary": "Read an ENUMERATED (X.690 §8.4): universal tag 10 over the content octets of an INTEGER, so the minimal two's complement form of §8.3.2 is required as for `readInteger`.", "throws": [ "PkiEncodingError", "PkiLimitError" ], "params": [ { "name": "node", "description": "An ENUMERATED node, or an implicitly tagged one." }, { "name": "options", "description": "Limits (`maxIntegerBytes`) and diagnostics." } ], "returns": "The enumeration value as a bigint, as `readInteger` returns it.", "members": null }, { "name": "readInteger", "kind": "function", "module": "src/asn1/asn1-read.ts", "signature": "export function readInteger(node: Asn1Node, options?: PkiParseOptions): bigint", "summary": "Read an INTEGER of any size.", "throws": [ "PkiEncodingError", "PkiLimitError" ], "params": [ { "name": "node", "description": "An INTEGER node, or an implicitly tagged one." }, { "name": "options", "description": "Limits (`maxIntegerBytes`) and diagnostics." } ], "returns": "The value as a bigint.", "members": null }, { "name": "readNull", "kind": "function", "module": "src/asn1/asn1-read.ts", "signature": "export function readNull(node: Asn1Node): null", "summary": "Read a NULL.", "throws": [ "PkiEncodingError" ], "params": [ { "name": "node", "description": "A NULL node, or an implicitly tagged one." } ], "returns": "null.", "members": null }, { "name": "readObjectIdentifier", "kind": "function", "module": "src/asn1/asn1-oid.ts", "signature": "export function readObjectIdentifier(node: Asn1Node, options?: PkiParseOptions): string", "summary": "Read an OBJECT IDENTIFIER node.", "throws": [ "PkiEncodingError" ], "params": [ { "name": "node", "description": "An OBJECT IDENTIFIER node, or an implicitly tagged one." }, { "name": "options", "description": "Limits (`maxOidBytes`)." } ], "returns": "The dotted-decimal OID.", "members": null }, { "name": "readOctetString", "kind": "function", "module": "src/asn1/asn1-read.ts", "signature": "export function readOctetString(node: Asn1Node, options?: PkiParseOptions): Uint8Array", "summary": "Read an OCTET STRING.", "throws": [ "PkiEncodingError" ], "params": [ { "name": "node", "description": "An OCTET STRING node (constructed only under BER), or an implicitly tagged one." }, { "name": "options", "description": "Encoding rules, limits (`maxBerSegments`) and diagnostics." } ], "returns": "The octets: a zero-copy view when primitive, a joined copy when segmented.", "members": null }, { "name": "readRelativeOid", "kind": "function", "module": "src/asn1/asn1-oid.ts", "signature": "export function readRelativeOid(node: Asn1Node, options?: PkiParseOptions): string", "summary": "Read a RELATIVE-OID node (X.690 §8.20): universal tag 13, the subidentifier encoding of an OBJECT IDENTIFIER without the first-two-arcs packing, so `0D 04 C2 7B 03 02` reads as `8571.3.2` (the §8.20.2 example).", "throws": [ "PkiEncodingError", "PkiLimitError" ], "params": [ { "name": "node", "description": "A RELATIVE-OID node, or an implicitly tagged one." }, { "name": "options", "description": "Limits (`maxOidBytes`)." } ], "returns": "The arcs in dotted decimal, e.g. `8571.3.2`.", "members": null }, { "name": "readSmallInteger", "kind": "function", "module": "src/asn1/asn1-read.ts", "signature": "export function readSmallInteger(node: Asn1Node): number", "summary": "Read an INTEGER that must fit in a JavaScript number.", "throws": [ "PkiEncodingError" ], "params": [ { "name": "node", "description": "An INTEGER node, or an implicitly tagged one." } ], "returns": "The value as a number.", "members": null }, { "name": "readString", "kind": "function", "module": "src/asn1/asn1-read.ts", "signature": "export function readString(node: Asn1Node, options?: ReadStringOptions): Asn1String", "summary": "Read a character string: UTF8String, NumericString, PrintableString, TeletexString (as ISO 8859-1, with a diagnostic), IA5String, VisibleString, UniversalString or BMPString.", "throws": [ "PkiEncodingError", "PkiError" ], "params": [ { "name": "node", "description": "A string node, or an implicitly tagged one together with `stringType`." }, { "name": "options", "description": "Encoding rules, limits, diagnostics, and the type of an implicit tag." } ], "returns": "The type, the decoded text and the original octets.", "members": null }, { "name": "readTime", "kind": "function", "module": "src/asn1/asn1-time.ts", "signature": "export function readTime(node: Asn1Node, options?: ReadTimeOptions): PkiTime", "summary": "Read a UTCTime or a GeneralizedTime.", "throws": [ "PkiEncodingError", "PkiError" ], "params": [ { "name": "node", "description": "A time node, or an implicitly tagged one together with `timeType`. Under DER only the X.690 §11.7–11.8 forms are read. Under BER the seconds may be omitted, the fraction may use a comma or keep trailing zeros, and a `±hhmm` offset may replace `Z`; the rarer ITU-T X.680 GeneralizedTime forms — hours only, a fraction of a minute or of an hour, an offset in whole hours — are refused with `PKI_ASN1_TIME_INVALID` in every mode, and a fraction finer than a millisecond is truncated to one." }, { "name": "node", "description": "A time node, or an implicitly tagged one together with `timeType`." }, { "name": "options", "description": "Encoding rules (DER requires the restricted forms), diagnostics, and the type of an implicit tag." } ], "returns": "The type, the instant in epoch milliseconds and the encoded text. UTCTime years 50–99 are 1950–1999, 00–49 are 2000–2049.", "members": null }, { "name": "shake256", "kind": "function", "module": "src/hash/shake256.ts", "signature": "export function shake256(input: Uint8Array, outputLength: number): Uint8Array", "summary": "SHAKE256 of public data, with the output length the caller names.", "throws": [ "PkiError" ], "params": [ { "name": "input", "description": "The octets to hash." }, { "name": "outputLength", "description": "How many octets to produce — 64 for an Ed448 CMS signer. The caller's number, not a bound on input: the output buffer is this size, and a large value costs the memory and the time of squeezing it (about 136 octets per Keccak permutation)." } ], "returns": "`outputLength` octets of SHAKE256 output.", "members": null }, { "name": "validateCertificatePath", "kind": "function", "module": "src/path/path-validate.ts", "signature": "export function validateCertificatePath(input: ValidateCertificatePathInput): ValidateCertificatePathReport", "summary": "Validate a certification path (RFC 5280 §6).", "throws": [ "PkiError" ], "params": [ { "name": "input", "description": "What to validate, and everything needed to judge it." } ], "returns": "The verdict and every reason behind it.", "members": null }, { "name": "verifyCertificateChain", "kind": "function", "module": "src/verify/verify-chain.ts", "signature": "export async function verifyCertificateChain(input: VerifyCertificateChainInput): Promise", "summary": "Verify a certificate the whole way: chain, name, purpose and revocation.", "throws": [ "PkiError" ], "params": [ { "name": "input", "description": "See {@link VerifyCertificateChainInput}." } ], "returns": "The verdict, every reason behind it, the path judged, how many candidate paths were explored and how many signatures were verified.", "members": null }, { "name": "verifyCertificateSignature", "kind": "function", "module": "src/crypto/x509-verify.ts", "signature": "export async function verifyCertificateSignature( certificate: Certificate, issuer: Certificate, options?: VerifyCertificateSignatureOptions, ): Promise", "summary": "Verify that `issuer`'s public key signed `certificate`.", "throws": [ "PkiCryptoError", "PkiEncodingError", "PkiError" ], "params": [ { "name": "certificate", "description": "The certificate whose signature is in question." }, { "name": "issuer", "description": "The certificate holding the public key that should have signed it. Pass `certificate` itself to test a self-signature." }, { "name": "options", "description": "See {@link VerifyCertificateSignatureOptions}." } ], "returns": "Whether the issuer's key signed this certificate's `tbsCertificate`.", "members": null }, { "name": "verifyCertificationRequest", "kind": "function", "module": "src/verify/verify-csr.ts", "signature": "export async function verifyCertificationRequest( request: CertificationRequest | Uint8Array, options?: VerifyCertificationRequestOptions, ): Promise", "summary": "Verify a PKCS#10 certification request: the proof of possession, checked with the key inside the request.", "throws": [ "PkiError" ], "params": [ { "name": "request", "description": "The request, as the DER bytes or as `parseCertificationRequest` returned it." }, { "name": "options", "description": "See {@link VerifyCertificationRequestOptions}; the reading options apply when `request` is DER." } ], "returns": "The verdict, every reason behind it and the parsed request.", "members": null }, { "name": "verifyCrlSignature", "kind": "function", "module": "src/crypto/x509-verify.ts", "signature": "export async function verifyCrlSignature( crl: CertificateList, issuer: Certificate, options?: VerifyCertificateSignatureOptions, ): Promise", "summary": "Verify that a CA's key signed this revocation list.", "throws": [ "PkiCryptoError", "PkiError" ], "params": [ { "name": "crl", "description": "A parsed `CertificateList`." }, { "name": "issuer", "description": "The certificate whose key is alleged to have signed it." }, { "name": "options", "description": "See {@link VerifyCertificateSignatureOptions}." } ], "returns": "Whether the issuer's key signed `crl.tbsDer`.", "members": null }, { "name": "verifyOcspSignature", "kind": "function", "module": "src/crypto/x509-verify.ts", "signature": "export async function verifyOcspSignature(basicResponse: OcspBasicResponse, responder: Certificate): Promise", "summary": "Verify that a responder's key signed this OCSP response.", "throws": [ "PkiCryptoError", "PkiError" ], "params": [ { "name": "basicResponse", "description": "The `basicResponse` of a successful `OcspResponse`." }, { "name": "responder", "description": "The certificate whose key is alleged to have signed it." } ], "returns": "Whether the responder's key signed `basicResponse.tbsDer`.", "members": null }, { "name": "verifyPkcs12Mac", "kind": "function", "module": "src/keys/key-pkcs12.ts", "signature": "export async function verifyPkcs12Mac(pkcs12: Pkcs12, password: Uint8Array | string): Promise", "summary": "Check a PKCS#12 MAC under RFC 9579 PBMAC1: derive the HMAC key with PBKDF2 from the password, and verify the HMAC over `authenticatedSafe`.", "throws": [ "PkiCryptoError", "PkiError", "PkiKeyError" ], "params": [ { "name": "pkcs12", "description": "A container returned by {@link parsePkcs12}." }, { "name": "password", "description": "The password, as a string (UTF-8) or as exact octets." } ], "returns": "`true` when the MAC matches; `false` for a wrong password or altered content — the two are indistinguishable.", "members": null }, { "name": "verifySelfSignature", "kind": "function", "module": "src/crypto/x509-verify.ts", "signature": "export async function verifySelfSignature(certificate: Certificate, options?: VerifyCertificateSignatureOptions): Promise", "summary": "Verify that a certificate signed itself — the definition of a root, and the check a trust store's contents deserve before they are trusted.", "throws": [ "PkiCryptoError", "PkiError" ], "params": [ { "name": "certificate", "description": "The certificate to test." }, { "name": "options", "description": "See {@link VerifyCertificateSignatureOptions}." } ], "returns": "Whether the certificate's own key signed it, and its subject and issuer names are byte-identical.", "members": null }, { "name": "verifySignedData", "kind": "function", "module": "src/verify/verify-signed-data.ts", "signature": "export async function verifySignedData(input: VerifySignedDataInput): Promise", "summary": "Verify a CMS SignedData — a PDF signature, an S/MIME message, a `.p7s` — the whole way.", "throws": [ "PkiError" ], "params": [ { "name": "input", "description": "See {@link VerifySignedDataInput}." } ], "returns": "The verdict, one verdict per signer, and every reason.", "members": null }, { "name": "verifySignerInfoSignature", "kind": "function", "module": "src/crypto/cms-verify.ts", "signature": "export async function verifySignerInfoSignature( signerInfo: SignerInfo, signer: Certificate, options?: VerifySignerInfoSignatureOptions, ): Promise", "summary": "Verify that `signer`'s public key signed what `signerInfo` covers — its signed attributes when it has them, the content otherwise.", "throws": [ "PkiCryptoError", "PkiEncodingError", "PkiError" ], "params": [ { "name": "signerInfo", "description": "One entry of a parsed `SignedData`'s `signerInfos`." }, { "name": "signer", "description": "The certificate whose key is alleged to have signed." }, { "name": "options", "description": "See {@link VerifySignerInfoSignatureOptions}." } ], "returns": "Whether the signer's key signed `signerInfo.signedAttributesDer`, or `options.content` when the signer has no signed attributes.", "members": null }, { "name": "verifyTimeStampToken", "kind": "function", "module": "src/verify/verify-timestamp.ts", "signature": "export async function verifyTimeStampToken(input: VerifyTimeStampTokenInput): Promise", "summary": "Verify an RFC 3161 timestamp token.", "throws": [ "PkiCmsError", "PkiError" ], "params": [ { "name": "input", "description": "See {@link VerifyTimeStampTokenInput}." } ], "returns": "The verdict and what it established.", "members": null } ] }