@blamejs/core 0.18.3 → 0.18.5

package/CHANGELOG.md

@@ -8,6 +8,10 @@ upgrading across more than a few patches at a time.
 
 ## v0.18.x
 
+- v0.18.5 (2026-08-01) — **Error- and edge-path tests for the agent orchestrator, mTLS request gate, and i18n primitives.** Error, edge, and adversarial branches of b.agent.orchestrator (registry hydrate/register validation, consumer spawn and start lifecycle, cluster election cache and leader probes, drain and quiesce budgets, tenant-scope authorization, per-row reseal), the b.middleware.requireMtls request gate (no-peer-cert and fingerprint-failure refusals, allow/deny-list gates, revocation-source and onAuthenticated error paths, audit outcomes), and b.i18n's translation-tree and file-load edges are now under test. Behaviour is unchanged -- these pin guarantees the primitives already met. **Changed:** *Error- and edge-path tests for the agent orchestrator, mTLS request gate, and i18n primitives* — b.agent.orchestrator (registry hydrate/register non-object refusals, consumer spawn missing-agent/missing-queue refusals and the shard-topic naming, consumer start double-start refusal and the direct / dotted-nested / unknown consume-handler method resolution, cluster onTransition election-cache clear, elect argument validation and the election cache-hit path, currentLeader/isLeader/fencingToken error handling, drain timeout and the quiesce poll budget, tenant-scope actor-missing / no-tenant authorization, and reseal store-validation with per-cell AAD-sealed filtering), the b.middleware.requireMtls gate (no-opts default, allow/deny-list normalization and gate outcomes, the connection fallback and null-peer-cert / no-raw / fingerprint-failed refusals, deny-match refusal, the revocationSource and onAuthenticated error paths including a non-Error rejection, and audit allowed/refused outcomes), and b.i18n's translation-tree validation and file-load edge branches now have explicit tests for their error and boundary paths. Behaviour is unchanged -- the additions pin guarantees the primitives already met.
+
+- v0.18.4 (2026-08-01) — **`b.session.updateData({ merge: true })` now merges an inner object one level deep instead of discarding the existing nested keys, alongside error- and edge-path tests for the queue, encrypted-field, session, and CalDAV/CardDAV primitives.** b.session.updateData(token, data, { merge: true }) documents a one-level-deep merge, but an inner object value shallow-replaced the whole nested object -- so updating one nested key silently dropped the operator's other nested keys. It now merges an inner plain object into the existing one (its keys survive); an array or non-object value still replaces. Separately, error, edge, and adversarial branches of b.queue (init and backend resolution, consume success/retry/dead-letter, enqueueFlow validation and dependency ordering, dead-letter list/retry/size, shutdown drain, bootFromEnv), b.cryptoField (seal/unseal envelope-floor enforcement, derived-hash modes, per-row-key unseal rate cooldown, data residency, read-time hash upgrade, erase-row vacuum cascade, hash lookup), b.session (fingerprint-drift scoring and fail-closed binding, anonymous mint, rotate carry-forward and re-key, updateData merge guards, validFrom scheduling), and b.mail.dav (CalDAV/CardDAV request and response branches) are now under test. **Changed:** *Error- and edge-path tests for the queue, encrypted-field, session, and CalDAV/CardDAV primitives* — b.queue (init idempotency and the missing-backends / unknown-backend refusals, consume success/retry/dead-letter-write/rate-limit-wait/lease-extend/progress paths, enqueueFlow validation and cycle/dependency ordering, dead-letter list/retry/size with the SQS-unsupported refusals, shutdown pre-init no-op and in-flight drain, bootFromEnv config resolution), b.cryptoField (seal-envelope-floor enforcement, derived-hash keyed/legacy modes and truncation, per-row-key unseal rate cooldown and its audit, data residency, read-time derived-hash upgrade, the erase-row vacuum cascade, and hash lookup), b.session (fingerprint-drift scoring with clamp and fail-closed admission, strict-binding missing/unreadable refusal, anonymous mint and the anonymous-plus-userId refusal, rotate data-replace / carry-forward / bound re-key, updateData token and merge guards, and validFrom read-back with check admit/revoke), and b.mail.dav's request and response branches now have explicit tests for their error and boundary paths. Behaviour is unchanged for these -- the additions pin guarantees the primitives already met. · *Vendored @blamejs/pki refreshed to 0.3.28* — The bundled PKI toolkit (lib/vendor/blamejs-pki.cjs, the mTLS CA engine's certificate/CMS backend) is refreshed from 0.3.27 to 0.3.28 so the vendored copy matches the latest published release. It adds no runtime dependency and no public framework API; the upstream release adds HTTP Digest authentication (RFC 7616) to the EST client transport. **Fixed:** *b.session.updateData({ merge: true }) merges an inner object one level deep instead of discarding existing nested keys* — updateData(token, data, { merge: true }) is documented to merge one level deep -- inner objects merge, arrays replace. It merged only the top-level keys: an inner object value was assigned wholesale (next[k] = data[k]), so updateData(token, { prefs: { theme: "dark" } }, { merge: true }) against a stored { prefs: { locale: "en" } } dropped prefs.locale, leaving only { prefs: { theme: "dark" } }. An inner PLAIN-object value now merges into the existing plain object (its keys survive, then the incoming keys apply); an array, a non-plain object (a Date, Buffer, or class instance -- stored as its own JSON form rather than mangled into the retained old object or byte-index keys), or a non-object value replaces, and merging beyond one level replaces. Operators who relied on the previous top-level-only behaviour, or who intend to replace a whole nested object, can pass the full nested value they want stored. **Detectors:** *session.updateData({ merge: true }) must merge an inner object one level deep* — A source check asserts the merge path merges an inner value only when BOTH are PLAIN objects (a prototype-based _isPlainObject) as Object.assign({}, existing[k], data[k]), never a bare next[k] = data[k] shallow replace, so the nested-key data-loss regression -- and a Date/Buffer being merged instead of replaced -- cannot return unnoticed.
+
 - v0.18.3 (2026-07-30) — **`b.mtlsCa` gains non-breaking CA algorithm-migration primitives -- rotate the CA, keep the superseded root trusted during re-enrollment, self-test that the runtime verifies the algorithm over TLS, and revoke by CA generation -- and `b.db.collection`'s `$like` operator now honours SQL `%` / `_` wildcards instead of matching them as literal characters.** b.mtlsCa can now migrate a certificate authority to a new signature algorithm without an outage. status() reports the stored CA's algorithm and key type; rotate({ generation, algorithm }) generates and atomically commits a new CA and returns the superseded certificate, without the algorithm-mismatch initCA() raises once a CA already exists; await commit({ retainPrevious: true }) (the public commit is the locked primitive — it resolves to a promise, takes the rotation lock so a direct caller cannot race a concurrent rotate/init, and refreshes the handle's algorithm pin to the committed CA like rotate() so a pinned handle that migrates algorithms via commit() stays usable) together with await loadTrustBundle() and dropRetained() keep the old root trusted through a re-enrollment grace window; canVerifyInTls() runs a loopback mutual-TLS self-test proving node:tls verifies the CA's algorithm on the running Node; and revokeGeneration(n) revokes every certificate the issuance ledger recorded under a CA generation below n. Separately, b.db.collection's $like operator emitted an escaped LIKE, so the caller's % and _ were matched as literal characters and $like collapsed to an exact match; it now emits a caller-controlled-wildcard LIKE, so find({ name: { $like: "Al%" } }) matches as SQL LIKE documents. The release also brings error and adversarial branches of the scheduler, session device-binding, body parser, notifier, and document collection under test. **Added:** *b.mtlsCa non-breaking CA algorithm-migration primitives* — A CA handle can now carry an operator through a signature-algorithm migration (for example a classical-to-post-quantum move) with no trust outage. status() reports the stored CA's algorithm and keyType (null before initCA(), and null for an EC CA whose curve is not the framework's P-384 OR whose signature digest is not SHA-384, so a custom P-256/P-521 or SHA-256/SHA-512-signed CA is not mislabeled ECDSA-P384-SHA384). An unpinned rotate({ generation }) preserves the stored CA's algorithm (it does not silently adopt the engine's post-quantum default), so advancing a generation on a classical ECDSA CA keeps issuing classical chains; changing algorithm stays explicit via rotate({ algorithm }). rotate({ generation, algorithm }) generates a new CA at a strictly higher integer generation and atomically commits it -- returning { caCertPem, previousCaCertPem, generation, algorithm } -- so an operator does not hit the algorithm-mismatch initCA() raises when a CA is already present, and the handle keeps issuing under the new algorithm afterward. A rotation also invalidates a persisted CRL (it was signed by the superseded CA), so regenerate it under the new CA with generateCrl(). The commit path gained retainPrevious (defaulted on for rotate): the outgoing certificate is snapshotted to ca.prev.crt, and await loadTrustBundle() returns [current, ...retained] so both roots are trusted while clients re-enroll (it resolves to a promise, taking the rotation lock so its snapshot is serialized with rotation and dropRetained()); dropRetained(), or rotate({ retainPrevious: false }), ends that window. There is one retained window at a time: a second retained rotation while a root is still retained is refused (mtls-ca/retained-root-exists) rather than silently overwriting the retained root and rejecting clients still enrolled under it -- end the window first, and a plain commit() that omits retainPrevious while a window is open is likewise refused (mtls-ca/retention-intent-required) rather than replacing the active CA while leaving the old root, which would drop trust for the just-superseded generation. A rotation also aborts if it cannot capture the existing key for its rollback journal, and loadTrustBundle() still returns a retained root a crashed rotation left only in that journal. canVerifyInTls(algorithm?) performs a loopback mutual-TLS handshake with a freshly issued leaf and resolves true only if node:tls actually authenticates the client against a CA on the running runtime -- pass the prospective algorithm to pre-flight a migration (canVerifyInTls("ML-DSA-87") probes the target chain, not the current CA) before rotating to an algorithm the deployed Node cannot verify; with no argument it probes the stored CA -- and requires an explicit algorithm when the stored CA's algorithm cannot be derived (a custom-engine CA this runtime does not classify, with no create-time pin), rather than probing an undeterminable one that the engine could resolve to a different algorithm. revokeGeneration(n) walks an issuance ledger (recorded automatically as certificates are issued, or supplied via the new issuanceStore option) and revokes every certificate issued under a CA generation below n -- with an undeterminable generation (a custom engine whose CA certificate this runtime cannot parse, such as an opaque post-quantum cert) recorded as null and skipped by that sweep, still revocable by serial or fingerprint, rather than misfiled as generation 0 (which would sweep current leaves and self-revoke future issuances); issuance fails closed if the ledger cannot be written, so no untracked credential escapes revocation, and importIssuance(entries) backfills leaf identities the ledger does not have (certificates from a pre-upgrade dataDir or issued out of band) so revokeGeneration can sweep them too. Rotation is crash-atomic: because the CA key, certificate, and retained root are separate files that cannot be swapped in a single rename, a rotation that is interrupted between them (a crash or power loss) is reconciled the next time the CA is opened -- the prior key AND the prior retained root are journaled durably before either is overwritten, so an interrupted rotation rolls back to the still-usable previous CA (and the trust bundle its retained root still serves) instead of stranding it as an unrecoverable new-key/old-certificate pair or dropping trust for clients enrolled under the formerly-retained generation. A rollback journal that is unreadable or is not a valid manifest fails the open closed (mtls-ca/rollback-journal-corrupt) so an unresolved rotation marker is never overwritten, rather than being silently discarded and losing the prior key. Establishing the requested retention is part of the commit: a rotation that cannot write the retained root (for example an unwritable ca.prev.crt directory) aborts and rolls back rather than publishing a new CA that silently omits the outgoing root, and a rotate({ retainPrevious: false }) that cannot remove the old root aborts rather than leaving a root the operator asked to hard-cut still trusted. The engine interface adds canVerifyInTls(algorithm) for pluggable engines. · *b.middleware.requireMtls enforces a live revocation source* — requireMtls({ revocationSource: caHandle }) consults a b.mtlsCa handle (or any { isRevoked(fingerprintHex) } object) on every request, refusing a peer whose fingerprint the CA reports revoked. This enforces revoke() and revokeGeneration() at the gate without mirroring the registry into denyList, and it is CA-generation-independent (fingerprint-keyed) -- so a revoked superseded-generation cert is refused even though a CRL signed by the new CA could not cover the old cohort. The lookup fails closed: a source that throws refuses the request. **Changed:** *b.mtlsCa revoke() and revokeGeneration() return a promise* — The revocation registry's read-modify-write now runs under a cross-process file lock so concurrent revocations against the same data directory cannot lose each other's entry. b.mtlsCa revoke() -- previously synchronous -- and revokeGeneration() therefore return a promise resolving to their result; input validation still throws synchronously. Callers must await them: await ca.revoke(serial) / const { revoked } = await ca.revokeGeneration(n). isRevoked() stays synchronous and now reads an in-memory index kept fresh against the store, so a revocationSource-wired require-mtls gate does O(1) per-request lookups. An issuance whose signing straddles a rotate()+revokeGeneration() for its own generation -- or a rotate({ retainPrevious: false }) / dropRetained() that removes the root it was signed under -- is now refused (mtls-ca/issuance-superseded) rather than returned as a credential the sweep missed or a leaf that chains to a root no longer trusted; a clustered revocation store (shared across hosts with per-host dataDirs) can share that supersede watermark by additionally exposing { readGenerationWatermark(), bumpGenerationWatermark(n) }. A clustered revocation store now also requires a shared issuanceStore -- constructing one with the default per-host issuance ledger is refused, since revokeGeneration() would otherwise miss certificates issued on another host and leave them accepted by the shared revocation gate. loadTrustBundle() reads a stable snapshot of the current certificate (re-reading and retrying if a retained rotation publishes mid-read), so it never returns a bundle that omits the newly active root, and it deduplicates an identical retained root. · *Error- and edge-path tests for the scheduler, session device-binding, body parser, notifier, and document collection* — The scheduler's register / schedule validation, start / stop / status lifecycle, and task fire-and-failure recording; b.session device-binding storage and its store-error path; the body parser across its supported content types; the notifier's transport surface; and b.db.collection's query operators now have explicit tests for their error and boundary branches. Behaviour is unchanged -- these pin guarantees the primitives already met. · *Vendored @blamejs/pki refreshed to 0.3.27* — The bundled PKI toolkit (lib/vendor/blamejs-pki.cjs, the mTLS CA engine's certificate/CMS backend) is refreshed from 0.3.25 to 0.3.27. It adds no runtime dependency and no public framework API; the upstream releases add CMP certificate-enrollment protocol support (pki.cmp.verify checks a PKIMessage's signature/PBMAC1 protection; pki.cmp.session drives a full RFC 9810 ir/cr/kur/p10cr enrollment exchange) and fixes across the X.509 / CMS / PKCS#12 surface (subjectAltName IP-address string GeneralNames, RSASSA-PKCS1-v1_5 WebCrypto algorithm-name casing, public-key-integrity PKCS#12, CMS countersignature verification, cross-origin SNI/pin retention in the EST/ACME clients). **Fixed:** *b.db.collection $like honours SQL % / _ wildcards instead of matching them literally* — find({ field: { $like: "Al%" } }) routed the pattern through the query builder's escaping LIKE comparator, which escapes % and _ so a bound value cannot smuggle wildcards. For $like -- whose contract is a SQL LIKE pattern -- that neutralised the caller's wildcards and collapsed the operator to an exact match ($like: "Al%" matched only the literal string "Al%", never "Alice"). $like now emits a caller-controlled-wildcard LIKE, so %, _, prefix, suffix, infix, and single-character patterns all resolve as SQL LIKE defines. Exact patterns with no wildcard are unchanged. Callers that relied on the previous literal-match behaviour should pass the field value directly ({ field: value }) or escape their own wildcards. · *b.mtlsCa fails closed on a schema-corrupt issuance ledger instead of silently emptying it* — A present issuance ledger that was valid JSON but carried no `issued` array (an accidental `{}`, or a truncated / externally-rewritten file) was treated as an empty ledger. The next issuance then rewrote the file with only its own entry, permanently dropping every prior certificate from the sole index revokeGeneration() consults -- so those certificates would survive a later generation revocation. A present ledger with a missing or non-array `issued` now fails closed (mtls-ca/issuance-corrupt), exactly as malformed JSON already did; the operator restores or removes the file. An absent ledger still reads as empty. **Detectors:** *b.db.collection $like must use the verbatim caller-wildcard LIKE* — A source check asserts the collection's $like operator routes through the caller-controlled-wildcard LIKE and never the value-escaping LIKE comparator, so the wildcard-escaping regression cannot return unnoticed. · *b.mtlsCa issuance fingerprint must hash the certificate DER* — A source check asserts the issued-certificate fingerprint is computed as the DER hash the require-mtls gate pins, not the PEM-text hash -- a mismatch would silently make revoke() / revokeGeneration() by fingerprint unenforceable at the gate. · *b.mtlsCa CA rotation must journal the prior key before overwriting it* — A source check asserts the commit path persists a durable rollback copy of the prior CA key before the rename that overwrites it, and that both the read and the rotate paths reconcile a leftover journal on open -- so an interrupted rotation can never regress to leaving the new key beside the old certificate with the prior key lost.
 
 - v0.18.2 (2026-07-30) — **`b.sql` andWhere() now accepts the 2-argument andWhere(field, value) shorthand it previously rejected; the SQL builder, i18n, and static file server also gain error/adversarial-path tests.** b.sql query builders support two call shapes for their WHERE helpers -- where(field, value) and where(field, op, value), distinguished by argument count. orWhere honoured both, but andWhere re-passed three fixed positional arguments internally, so a two-argument andWhere(field, value) was misread as three: the value became the operator and the call threw sql-builder/bad-operator. andWhere now forwards its arguments like where/orWhere, so andWhere("col", value) appends `AND "col" = ?` as documented. The three- and object-argument forms are unchanged. Alongside the fix, the error, boundary, and adversarial branches of the SQL builder, the i18n primitive, and the static file server are brought under test; no other defects surfaced. **Changed:** *Error-path tests for the SQL builder, i18n, and the static file server* — The b.sql builder's dialect / cast / raw-SQL guards, its emitted-SQL size and encoding guards, and the full set of chained WHERE / HAVING / JOIN delegators now have explicit tests; b.i18n's option-validation and interpolation error contracts are pinned to their exact typed error codes; and b.staticServe's path-traversal, symlink-escape, reserved-name, content-disposition, conditional-request, and HEAD-sanitize branches are asserted through the wired middleware. Behaviour is unchanged -- these assert guarantees the primitives already met (a served-traversal or wrong content-type would be a real defect; none were found) -- so no migration is needed. **Fixed:** *b.sql andWhere() honours the 2-argument andWhere(field, value) shorthand* — A chained builder call such as b.sql.select("t").where("a", 1).andWhere("b", 2) previously threw sql-builder/bad-operator because andWhere forwarded three fixed positional parameters to where(), defeating where()'s argument-count check for the two-argument shorthand (the value was interpreted as the operator). andWhere now forwards its arguments verbatim, matching where() and orWhere(); andWhere("b", 2) emits `AND "b" = ?`. The three-argument andWhere(field, op, value) and object andWhere({ field: value }) forms are unaffected.

package/NOTICE

@@ -60,7 +60,7 @@ Used for:    WebAuthn / passkey registration + authentication response
              server.cjs).
 --------------------------------------------------------------------------------
 Component:   @blamejs/pki
-Version:     0.3.27
+Version:     0.3.28
 Source:      https://github.com/blamejs/pki
 License:     Apache-2.0
 Copyright:   Copyright (c) blamejs contributors

package/lib/session.js

@@ -63,6 +63,16 @@ var safeJson = require("./safe-json");
 var sql = require("./sql");
 var { SessionError } = require("./framework-error");
 
+// A PLAIN object (created by {} or JSON.parse — its prototype is Object.prototype or null), NOT a Date /
+// Buffer / Map / RegExp / class instance. updateData's one-level-deep merge merges two plain objects
+// only; a non-plain value REPLACES so it reaches JSON.stringify as its own form (a Date's ISO string, a
+// Buffer's byte array) instead of being mangled by Object.assign (which copies only enumerable own keys).
+function _isPlainObject(v) {
+  if (v === null || typeof v !== "object" || Array.isArray(v)) return false;
+  var proto = Object.getPrototypeOf(v);
+  return proto === Object.prototype || proto === null;
+}
+
 // vault is initialized at boot before sessions; lazyRequire keeps the
 // load order independent of module-import order. Used to seal/unseal
 // the cookie-side sid so the wire token is ciphertext rather than
@@ -1273,7 +1283,17 @@ async function updateData(token, data, opts) {
     if (data && typeof data === "object") {
       Object.keys(data).forEach(function (k) {
         if (k === "__bj_fingerprint") return;       // reserved — only fingerprint binding writes this
-        next[k] = data[k];
+        var ev = existing[k], nv = data[k];
+        // ONE LEVEL DEEP (per the doc): a PLAIN-object value merges into the existing plain object so its
+        // keys survive; an array, a non-plain object (Date/Buffer/class instance), or a non-object value
+        // REPLACES wholesale. Deeper than one level replaces — Object.assign copies own keys, not
+        // recursively. Both must be PLAIN objects to merge, else a Date (no enumerable keys) would leave
+        // the old object in place and a Buffer would mangle into byte-index keys.
+        if (_isPlainObject(ev) && _isPlainObject(nv)) {
+          next[k] = Object.assign({}, ev, nv);
+        } else {
+          next[k] = nv;
+        }
       });
     }
   } else {

package/lib/vendor/MANIFEST.json

@@ -18,7 +18,7 @@
       "hashes": {
         "server": "sha256:2b30a26f728c5349f4c4b47834f862a4f77393b1224fc12b22abe3ce2cfab78f"
       },
-      "refreshedAt": "2026-08-01T16:08:02.316Z"
+      "refreshedAt": "2026-08-01T21:13:55.453Z"
     },
     "@noble/curves": {
       "version": "2.2.0",
@@ -40,7 +40,7 @@
       "hashes": {
         "server": "sha256:2880c288b1285ef51d356d057bee6f0c8a00de36638cf47b47617e8c1faf10d5"
       },
-      "refreshedAt": "2026-08-01T16:08:02.316Z"
+      "refreshedAt": "2026-08-01T21:13:55.453Z"
     },
     "@noble/post-quantum": {
       "version": "0.6.1",
@@ -71,7 +71,7 @@
       "hashes": {
         "server": "sha256:f9c94094b3c10fe73dac5343289da582454ea6053494fab2bf66099d9103d6c3"
       },
-      "refreshedAt": "2026-08-01T16:08:02.316Z"
+      "refreshedAt": "2026-08-01T21:13:55.453Z"
     },
     "@simplewebauthn/server": {
       "version": "13.3.2",
@@ -94,7 +94,7 @@
       "hashes": {
         "server": "sha256:e83195dc9f189385da9c856ef38843f4466f93ea8f3d7fc2efcb1e1b18da6f20"
       },
-      "refreshedAt": "2026-08-01T16:08:02.316Z"
+      "refreshedAt": "2026-08-01T21:13:55.453Z"
     },
     "SecLists-common-passwords-top-10000": {
       "version": "10k-most-common (master)",
@@ -114,7 +114,7 @@
       },
       "runtime_artifact": "lib/vendor/common-passwords-top-10000.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-01T16:08:02.316Z"
+      "refreshedAt": "2026-08-01T21:13:55.453Z"
     },
     "bimi-trust-anchors": {
       "version": "operator-managed",
@@ -139,7 +139,7 @@
       },
       "runtime_artifact": "lib/vendor/bimi-trust-anchors.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-01T16:08:02.316Z"
+      "refreshedAt": "2026-08-01T21:13:55.453Z"
     },
     "publicsuffix-list": {
       "version": "master",
@@ -159,10 +159,10 @@
       },
       "runtime_artifact": "lib/vendor/public-suffix-list.data.js",
       "integrity_layers": "sha256 + sha3-512 + SLH-DSA-SHAKE-256f signature + in-payload canary (where applicable)",
-      "refreshedAt": "2026-08-01T16:08:02.316Z"
+      "refreshedAt": "2026-08-01T21:13:55.453Z"
     },
     "@blamejs/pki": {
-      "version": "0.3.27",
+      "version": "0.3.28",
       "license": "Apache-2.0",
       "author": "blamejs",
       "source": "https://github.com/blamejs/pki",
@@ -183,11 +183,11 @@
       },
       "bundler": "esbuild --format=cjs --platform=node --external:crypto --external:node:crypto",
       "bundledAt": "2026-08-01T00:00:00Z",
-      "cpe": "cpe:2.3:a:blamejs:pki:0.3.27:*:*:*:*:node.js:*:*",
+      "cpe": "cpe:2.3:a:blamejs:pki:0.3.28:*:*:*:*:node.js:*:*",
       "hashes": {
-        "server": "sha256:28b53546b062fef30e9fe5569036fcf51b6669cbd0a910542a52064eb4814e81"
+        "server": "sha256:5e6824b7a7b0a8f8cf191475c115aeba433b12dba790de6da1afb26ebf43a6ec"
       },
-      "refreshedAt": "2026-08-01T16:08:02.316Z"
+      "refreshedAt": "2026-08-01T21:13:55.453Z"
     }
   }
 }

package/lib/vendor/blamejs-pki.cjs

@@ -1,4 +1,4 @@
-// @blamejs/pki v0.3.27 — vendored (Apache-2.0). Zero-dep pure CJS.
+// @blamejs/pki v0.3.28 — vendored (Apache-2.0). Zero-dep pure CJS.
 // https://github.com/blamejs/pki  Exports: x509, crl, pkcs12, key, webcrypto, schema, csr, cms, ...
 // Backs lib/mtls-engine-default.js (PQC-capable CA + PKCS#12 engine).
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -137,7 +137,7 @@ var require_package = __commonJS({
   "node_modules/@blamejs/pki/package.json"(exports2, module2) {
     module2.exports = {
       name: "@blamejs/pki",
-      version: "0.3.27",
+      version: "0.3.28",
       description: "Pure-JavaScript PKI toolkit that owns its stack \u2014 X.509, ASN.1/DER, CMS, PQC-first.",
       license: "Apache-2.0",
       author: "blamejs contributors",
@@ -314,6 +314,10 @@ var require_constants = __commonJS({
       // document plus multipart/header overhead (16 MiB * 4/3 ~= 21.3 MiB); 24 MiB
       // clears it. An operator may only tighten it DOWNWARD via opts.maxResponseBytes.
       HTTP_MAX_RESPONSE_BYTES: BYTES.mib(24),
+      // A single untrusted WWW-Authenticate challenge header, bounded BEFORE the string
+      // is copied/tokenized so a hostile server cannot drive unbounded work parsing it
+      // (CWE-770). 8 KiB clears any realistic multi-scheme Digest challenge.
+      HTTP_AUTH_HEADER_MAX_BYTES: BYTES.kib(8),
       // Deterministic-CBOR codec ceilings (RFC 8949), the DER neighbours' siblings:
       // a whole-document cap refused before the walk, a nesting cap, and a per-value
       // bignum ceiling the document cap can't provide. Unlike DER_MAX_INTEGER_BYTES,
@@ -5448,6 +5452,7 @@ var require_http_transport = __commonJS({
           try {
             req = nodeHttps.request(prep.options, function(res) {
               var proto = res.socket && res.socket.getProtocol ? res.socket.getProtocol() : null;
+              var cipher = res.socket && res.socket.getCipher ? res.socket.getCipher() : null;
               var peer = res.socket && res.socket.getPeerCertificate ? res.socket.getPeerCertificate() : null;
               var declared = parseInt((res.headers || {})["content-length"], 10);
               if (Number.isFinite(declared) && declared > prep.maxBytes) {
@@ -5484,7 +5489,7 @@ var require_http_transport = __commonJS({
                   status: res.statusCode,
                   headers: lower,
                   body: Buffer.from(buf.subarray(0, len)),
-                  tls: { protocol: proto, peerCertificate: peer && peer.raw ? peer.raw : null }
+                  tls: { protocol: proto, cipher, peerCertificate: peer && peer.raw ? peer.raw : null }
                 });
               });
               res.on("error", function(e) {
@@ -25227,6 +25232,331 @@ var require_sigstore = __commonJS({
   }
 });
 
+// node_modules/@blamejs/pki/lib/http-digest.js
+var require_http_digest = __commonJS({
+  "node_modules/@blamejs/pki/lib/http-digest.js"(exports2, module2) {
+    "use strict";
+    var crypto = require("crypto");
+    var constants = require_constants();
+    var ALGS = {
+      "SHA-512-256": { hash: "sha512-256", rank: 3, sess: false },
+      "SHA-512-256-SESS": { hash: "sha512-256", rank: 3, sess: true },
+      "SHA-256": { hash: "sha256", rank: 2, sess: false },
+      "SHA-256-SESS": { hash: "sha256", rank: 2, sess: true },
+      "MD5": { hash: "md5", rank: 1, sess: false },
+      "MD5-SESS": { hash: "md5", rank: 1, sess: true }
+    };
+    var DEFAULT_CODES = {
+      unsupportedAlgorithm: "digest/unsupported-algorithm",
+      weakAlgorithm: "digest/weak-algorithm",
+      noQop: "digest/no-qop",
+      badChallenge: "digest/bad-challenge"
+    };
+    function H(hash, s) {
+      return crypto.createHash(hash).update(s, "latin1").digest("hex");
+    }
+    function KD(hash, secret, data) {
+      return H(hash, secret + ":" + data);
+    }
+    function _qstr(v) {
+      return '"' + String(v).replace(/(["\\])/g, "\\$1") + '"';
+    }
+    function _commaSplitOutsideQuotes(s) {
+      var out = [], buf = "", inQ = false, esc = false;
+      for (var i = 0; i < s.length; i++) {
+        var c = s.charAt(i);
+        if (esc) {
+          buf += c;
+          esc = false;
+          continue;
+        }
+        if (inQ && c === "\\") {
+          buf += c;
+          esc = true;
+          continue;
+        }
+        if (c === '"') {
+          inQ = !inQ;
+          buf += c;
+          continue;
+        }
+        if (c === "," && !inQ) {
+          out.push(buf);
+          buf = "";
+          continue;
+        }
+        buf += c;
+      }
+      out.push(buf);
+      return out;
+    }
+    function _firstEqOutsideQuotes(s) {
+      var inQ = false, esc = false;
+      for (var i = 0; i < s.length; i++) {
+        var c = s.charAt(i);
+        if (esc) {
+          esc = false;
+          continue;
+        }
+        if (inQ && c === "\\") {
+          esc = true;
+          continue;
+        }
+        if (c === '"') {
+          inQ = !inQ;
+          continue;
+        }
+        if (c === "=" && !inQ) return i;
+      }
+      return -1;
+    }
+    function _unq(s) {
+      return s.slice(1, -1).replace(/\\(.)/g, "$1");
+    }
+    function _closedQuote(s) {
+      if (s.length < 2 || s.charAt(0) !== '"') return false;
+      var esc = false;
+      for (var i = 1; i < s.length; i++) {
+        var c = s.charAt(i);
+        if (esc) {
+          esc = false;
+          continue;
+        }
+        if (c === "\\") {
+          esc = true;
+          continue;
+        }
+        if (c === '"') return i === s.length - 1;
+      }
+      return false;
+    }
+    function _hasCtl(s) {
+      for (var i = 0; i < s.length; i++) {
+        var c = s.charCodeAt(i);
+        if (c < 32 && c !== 9 || c === 127) return true;
+      }
+      return false;
+    }
+    function _splitChallenges(s) {
+      var segs = _commaSplitOutsideQuotes(s);
+      var out = [], cur = null;
+      for (var i = 0; i < segs.length; i++) {
+        var seg = segs[i].replace(/^\s+|\s+$/g, "");
+        if (seg === "") continue;
+        var eq = _firstEqOutsideQuotes(seg);
+        var pre = (eq < 0 ? seg : seg.slice(0, eq)).replace(/^\s+|\s+$/g, "");
+        var ws = /^(\S+)\s+(\S[\s\S]*)$/.exec(pre);
+        if (eq < 0) {
+          cur = { scheme: seg, paramText: "" };
+          out.push(cur);
+        } else if (ws) {
+          cur = { scheme: ws[1], paramText: seg.replace(/^\s*\S+\s+/, "") };
+          out.push(cur);
+        } else if (cur) {
+          cur.paramText = cur.paramText ? cur.paramText + "," + seg : seg;
+        }
+      }
+      return out;
+    }
+    function _parseParams(paramText, E, code) {
+      var segs = _commaSplitOutsideQuotes(paramText), map = /* @__PURE__ */ Object.create(null);
+      for (var i = 0; i < segs.length; i++) {
+        var seg = segs[i].replace(/^\s+|\s+$/g, "");
+        if (seg === "") continue;
+        var eq = _firstEqOutsideQuotes(seg);
+        if (eq < 0) throw E(code, "malformed Digest auth-param (no '='): " + JSON.stringify(seg));
+        var key = seg.slice(0, eq).replace(/^\s+|\s+$/g, "").toLowerCase();
+        var rawVal = seg.slice(eq + 1).replace(/^\s+|\s+$/g, "");
+        var quoted = rawVal.charAt(0) === '"';
+        if (quoted && !_closedQuote(rawVal)) throw E(code, "an unterminated or trailing-garbage Digest quoted-string (RFC 7230 sec. 3.2.6)");
+        if (Object.prototype.hasOwnProperty.call(map, key)) throw E(code, "repeated Digest auth-param " + JSON.stringify(key));
+        var value = quoted ? _unq(rawVal) : rawVal;
+        if (_hasCtl(value)) throw E(code, "a Digest auth-param value contains a control character (RFC 7230 sec. 3.2.6)");
+        map[key] = { value, quoted };
+      }
+      return map;
+    }
+    function _validateDigest(paramText, E, code) {
+      var p = _parseParams(paramText, E, code);
+      if (!p.realm || !p.realm.quoted || p.realm.value === "") throw E(code, "a Digest challenge requires a non-empty quoted realm (RFC 7616 sec. 3.3)");
+      if (!p.nonce || !p.nonce.quoted || p.nonce.value === "") throw E(code, "a Digest challenge requires a non-empty quoted nonce (RFC 7616 sec. 3.3)");
+      if (p.algorithm && p.algorithm.quoted) throw E(code, "the Digest algorithm must be a token, not a quoted-string (RFC 7616 sec. 3.3)");
+      var qop = [];
+      if (p.qop) {
+        if (!p.qop.quoted) throw E(code, "the Digest qop must be a quoted list (RFC 7616 sec. 3.3)");
+        qop = p.qop.value.split(",").map(function(x) {
+          return x.replace(/^\s+|\s+$/g, "").toLowerCase();
+        }).filter(Boolean);
+        if (qop.length === 0) throw E(code, "a present Digest qop directive must list at least one value (RFC 7616 sec. 3.3)");
+      }
+      if (p.domain && !p.domain.quoted) throw E(code, "the Digest domain must be a quoted-string (RFC 7616 sec. 3.3)");
+      var domain = p.domain && p.domain.value.replace(/^\s+|\s+$/g, "") !== "" ? p.domain.value.replace(/^\s+|\s+$/g, "").split(/\s+/) : null;
+      if (p.charset && (p.charset.quoted || String(p.charset.value).toUpperCase() !== "UTF-8")) throw E(code, "the Digest charset must be the unquoted token UTF-8 (RFC 7616 sec. 3.3)");
+      if (p.stale) {
+        var sv = String(p.stale.value).toLowerCase();
+        if (p.stale.quoted || sv !== "true" && sv !== "false") throw E(code, "the Digest stale directive must be the unquoted token true or false (RFC 7616 sec. 3.3)");
+      }
+      if (p.userhash) {
+        var uhv = String(p.userhash.value).toLowerCase();
+        if (p.userhash.quoted || uhv !== "true" && uhv !== "false") throw E(code, "the Digest userhash directive must be the unquoted token true or false (RFC 7616 sec. 3.3)");
+      }
+      if (p.opaque && !p.opaque.quoted) throw E(code, "the Digest opaque directive must be a quoted-string (RFC 7616 sec. 3.3)");
+      return {
+        scheme: "Digest",
+        realm: p.realm.value,
+        nonce: p.nonce.value,
+        qop,
+        domain,
+        algorithm: p.algorithm ? p.algorithm.value.toUpperCase() : "MD5",
+        opaque: p.opaque ? p.opaque.value : null,
+        stale: !!(p.stale && String(p.stale.value).toLowerCase() === "true"),
+        userhash: !!(p.userhash && String(p.userhash.value).toLowerCase() === "true"),
+        charset: p.charset ? p.charset.value : null
+      };
+    }
+    function parseChallenge(www, E, code, policy) {
+      var pol = policy || {};
+      var codes = pol.codes || DEFAULT_CODES;
+      var preferStale = !!pol.preferStale;
+      var raw = String(www == null ? "" : www);
+      if (raw.length > constants.LIMITS.HTTP_AUTH_HEADER_MAX_BYTES) throw E(code, "the WWW-Authenticate header exceeds the " + constants.LIMITS.HTTP_AUTH_HEADER_MAX_BYTES + "-byte cap");
+      var challenges = _splitChallenges(raw);
+      var best = null, bestUsable = false, bestApplicable = false, bestStale = false, bestRank = -1, sawDigest = false;
+      for (var i = 0; i < challenges.length; i++) {
+        if (challenges[i].scheme.toLowerCase() !== "digest") continue;
+        sawDigest = true;
+        var parsed;
+        try {
+          parsed = _validateDigest(challenges[i].paramText, E, code);
+        } catch (_e) {
+          continue;
+        }
+        var alg = ALGS[parsed.algorithm];
+        var rank = alg ? alg.rank : 0;
+        var usable = _rejection(parsed, pol, codes) === null;
+        var applicable = pol.requestTarget === void 0 ? true : inProtectionSpace(parsed, pol.requestOrigin, pol.requestTarget);
+        var retryable = preferStale && !!parsed.stale && parsed.nonce !== pol.priorNonce && parsed.realm === pol.priorRealm;
+        if (best === null || usable && !bestUsable || usable === bestUsable && applicable && !bestApplicable || usable === bestUsable && applicable === bestApplicable && retryable && !bestStale || usable === bestUsable && applicable === bestApplicable && retryable === bestStale && rank > bestRank) {
+          best = parsed;
+          bestUsable = usable;
+          bestApplicable = applicable;
+          bestStale = retryable;
+          bestRank = rank;
+        }
+      }
+      if (best) return best;
+      if (sawDigest) throw E(code, "no valid Digest challenge: every Digest offer was malformed (missing realm / nonce or a bad directive, RFC 7616 sec. 3.3)");
+      return null;
+    }
+    function _octets(s, charset) {
+      var v = s == null ? "" : String(s);
+      return charset && String(charset).toUpperCase() === "UTF-8" ? Buffer.from(v, "utf8").toString("latin1") : v;
+    }
+    function _hasNonAscii(s) {
+      s = String(s == null ? "" : s);
+      for (var i = 0; i < s.length; i++) {
+        if (s.charCodeAt(i) > 127) return true;
+      }
+      return false;
+    }
+    function _pctEncodeUtf8(s) {
+      var bytes = Buffer.from(String(s == null ? "" : s), "utf8");
+      var out = "";
+      for (var i = 0; i < bytes.length; i++) {
+        var b = bytes[i];
+        if (b >= 48 && b <= 57 || b >= 65 && b <= 90 || b >= 97 && b <= 122 || b === 33 || b === 35 || b === 36 || b === 38 || b === 43 || b === 45 || b === 46 || b === 94 || b === 95 || b === 96 || b === 124 || b === 126) {
+          out += String.fromCharCode(b);
+        } else {
+          out += "%" + (b < 16 ? "0" : "") + b.toString(16).toUpperCase();
+        }
+      }
+      return out;
+    }
+    function _rejection(challenge, pol, codes) {
+      var alg = ALGS[challenge.algorithm];
+      if (!alg) return { code: codes.unsupportedAlgorithm, msg: "unsupported Digest algorithm " + challenge.algorithm + " (supported: SHA-512-256, SHA-256, MD5)" };
+      if (alg.hash === "md5" && !pol.allowMD5) return { code: codes.weakAlgorithm, msg: "MD5 Digest refused by default (RFC 7616 sec. 3.4 discourages it); set opts.auth.allowMD5 for legacy interop" };
+      if (challenge.qop.length === 0) {
+        if (!pol.allowLegacyQop) return { code: codes.noQop, msg: "a no-qop (RFC 2069) Digest challenge is refused by default; set opts.auth.allowLegacyQop for legacy interop" };
+      } else if (challenge.qop.indexOf("auth") === -1 && challenge.qop.indexOf("auth-int") === -1) {
+        return { code: codes.badChallenge, msg: "the Digest qop offered no member this client supports (auth / auth-int)" };
+      }
+      return null;
+    }
+    function answer(challenge, params, E) {
+      var pol = params.policy || {};
+      var codes = pol.codes || DEFAULT_CODES;
+      var rej = _rejection(challenge, pol, codes);
+      if (rej) throw E(rej.code, rej.msg);
+      var alg = ALGS[challenge.algorithm];
+      var useQop = challenge.qop.indexOf("auth") !== -1 ? "auth" : challenge.qop.indexOf("auth-int") !== -1 ? "auth-int" : null;
+      var cnonce = String((params.rng || function() {
+        return crypto.randomBytes(18).toString("base64");
+      })());
+      var realm = challenge.realm, nonce = challenge.nonce;
+      var isUtf8 = String(challenge.charset || "").toUpperCase() === "UTF-8";
+      var pUser = params.username == null ? "" : String(params.username);
+      var pPass = params.password == null ? "" : String(params.password);
+      if (isUtf8) {
+        pUser = pUser.normalize("NFC");
+        pPass = pPass.normalize("NFC");
+      }
+      var user = _octets(pUser, challenge.charset);
+      var pass = _octets(pPass, challenge.charset);
+      var HA1 = H(alg.hash, user + ":" + realm + ":" + pass);
+      if (alg.sess) HA1 = H(alg.hash, HA1 + ":" + nonce + ":" + cnonce);
+      var A2 = useQop === "auth-int" ? params.method + ":" + params.uri + ":" + H(alg.hash, params.body == null ? "" : params.body) : params.method + ":" + params.uri;
+      var HA2 = H(alg.hash, A2);
+      var ncNum = typeof params.nc === "number" && params.nc >= 1 ? Math.floor(params.nc) : 1;
+      var nc = ("0000000" + ncNum.toString(16)).slice(-8);
+      var response = useQop ? KD(alg.hash, HA1, nonce + ":" + nc + ":" + cnonce + ":" + useQop + ":" + HA2) : KD(alg.hash, HA1, nonce + ":" + HA2);
+      var parts;
+      if (!challenge.userhash && isUtf8 && _hasNonAscii(pUser)) {
+        parts = ["username*=UTF-8''" + _pctEncodeUtf8(pUser)];
+      } else {
+        var sentUser = challenge.userhash ? H(alg.hash, _octets(pUser, challenge.charset) + ":" + realm) : _octets(pUser, challenge.charset);
+        parts = ["username=" + _qstr(sentUser)];
+      }
+      parts.push("realm=" + _qstr(realm), "nonce=" + _qstr(nonce), "uri=" + _qstr(params.uri), "algorithm=" + challenge.algorithm);
+      if (useQop) {
+        parts.push("qop=" + useQop);
+        parts.push("nc=" + nc);
+      }
+      if (useQop || alg.sess) {
+        parts.push("cnonce=" + _qstr(cnonce));
+      }
+      parts.push("response=" + _qstr(response));
+      if (challenge.opaque != null) parts.push("opaque=" + _qstr(challenge.opaque));
+      if (challenge.userhash) parts.push("userhash=true");
+      return "Digest " + parts.join(", ");
+    }
+    function _domainEntry(d) {
+      d = String(d == null ? "" : d);
+      if (d.charAt(0) === "/") return { origin: null, full: d };
+      try {
+        var u = new URL(d);
+        return { origin: u.origin.toLowerCase(), full: (u.pathname || "/") + (u.search || "") };
+      } catch (_e) {
+        return null;
+      }
+    }
+    function inProtectionSpace(challenge, requestOrigin, requestPathAndSearch) {
+      var domain = challenge && challenge.domain;
+      if (!domain || !domain.length) return true;
+      var origin = String(requestOrigin == null ? "" : requestOrigin).toLowerCase();
+      var full = String(requestPathAndSearch == null ? "" : requestPathAndSearch);
+      for (var i = 0; i < domain.length; i++) {
+        var e = _domainEntry(domain[i]);
+        if (e === null) continue;
+        if (e.origin !== null && e.origin !== origin) continue;
+        if (full.indexOf(e.full) === 0) return true;
+      }
+      return false;
+    }
+    module2.exports = { parseChallenge, answer, inProtectionSpace };
+  }
+});
+
 // node_modules/@blamejs/pki/lib/est.js
 var require_est = __commonJS({
   "node_modules/@blamejs/pki/lib/est.js"(exports2, module2) {
@@ -25237,10 +25567,13 @@ var require_est = __commonJS({
     var cms = require_schema_cms();
     var x509 = require_schema_x509();
     var pkcs8 = require_schema_pkcs8();
+    var key = require_key();
     var csr = require_schema_csr();
+    var csrattrsFmt = require_schema_csrattrs();
     var frameworkError = require_framework_error();
     var guard = require_guard_all();
     var httpTransport = require_http_transport();
+    var httpDigest = require_http_digest();
     var retryAfter = require_http_retry_after();
     var EstError = frameworkError.EstError;
     function E(code, message, cause) {
@@ -25311,7 +25644,7 @@ var require_est = __commonJS({
         var rawHeaders = seg.slice(0, sep);
         var partBody = seg.slice(sep).replace(/^(\r?\n){2}/, "").replace(/\r?\n$/, "");
         var headers = {};
-        rawHeaders.split(/\r?\n/).forEach(function(line) {
+        rawHeaders.replace(/\r?\n(?=[ \t])/g, "").split(/\r?\n/).forEach(function(line) {
           var col = line.indexOf(":");
           if (col > 0) headers[line.slice(0, col).trim().toLowerCase()] = line.slice(col + 1).trim();
         });
@@ -25338,18 +25671,22 @@ var require_est = __commonJS({
       }
       return null;
     }
-    function _recipientKeyIds(recipientInfos) {
+    function _recipientKeyIds(recipientInfos, kind) {
       var ids = [];
       function push(v) {
         if (Buffer.isBuffer(v)) ids.push(v);
       }
       (recipientInfos || []).forEach(function(r) {
-        if (r.rid) push(r.rid.subjectKeyIdentifier);
-        if (r.kemri && r.kemri.rid) push(r.kemri.rid.subjectKeyIdentifier);
-        if (r.kekid) push(r.kekid.keyIdentifier);
-        (r.recipientEncryptedKeys || []).forEach(function(rek) {
-          if (rek.rid) push(rek.rid.subjectKeyIdentifier);
-        });
+        if (kind !== "symmetric") {
+          if (r.rid) push(r.rid.subjectKeyIdentifier);
+          if (r.kemri && r.kemri.rid) push(r.kemri.rid.subjectKeyIdentifier);
+          (r.recipientEncryptedKeys || []).forEach(function(rek) {
+            if (rek.rid) push(rek.rid.subjectKeyIdentifier);
+          });
+        }
+        if (kind !== "asymmetric") {
+          if (r.kekid) push(r.kekid.keyIdentifier);
+        }
       });
       return ids;
     }
@@ -25368,13 +25705,17 @@ var require_est = __commonJS({
       return out;
     }
     function _recipientMatches(recipientInfos, opts) {
-      if (Buffer.isBuffer(opts.expectedRecipientKeyId) && _recipientKeyIds(recipientInfos).some(function(id) {
+      if (Buffer.isBuffer(opts.expectedRecipientKeyId) && _recipientKeyIds(recipientInfos, opts.expectedRecipientKind).some(function(id) {
         return id.equals(opts.expectedRecipientKeyId);
       })) return true;
       var ias = opts.expectedRecipientIssuerSerial;
       if (ias && Buffer.isBuffer(ias.issuer) && ias.serialNumber != null) {
-        var want = typeof ias.serialNumber === "bigint" ? ias.serialNumber : BigInt(ias.serialNumber);
-        if (_recipientIssuerSerials(recipientInfos).some(function(r) {
+        var sn = ias.serialNumber, want;
+        if (typeof sn === "bigint" && sn >= 0n) want = sn;
+        else if (typeof sn === "number" && Number.isSafeInteger(sn) && sn >= 0) want = BigInt(sn);
+        else if (typeof sn === "string" && /^[0-9]+$/.test(sn)) want = BigInt(sn);
+        else throw E("est/bad-input", "expectedRecipientIssuerSerial.serialNumber must be a NON-NEGATIVE bigint, a safe non-negative integer, or a decimal digit string (a certificate serial is non-negative, RFC 5280 sec. 4.1.2.2)");
+        if (opts.expectedRecipientKind !== "symmetric" && _recipientIssuerSerials(recipientInfos).some(function(r) {
           return r.issuer.equals(ias.issuer) && r.serialNumber === want;
         })) return true;
       }
@@ -25428,6 +25769,7 @@ var require_est = __commonJS({
       }
       if (!keyPart || !certPart) throw E("est/bad-multipart", "a serverkeygen response needs one key part and one certificate part");
       if (opts.requestedEncryption && !encrypted) throw E("est/expected-encrypted-key", "encryption was requested but the private-key part is cleartext (RFC 7030 sec. 4.4.2)");
+      if (opts.requestedEncryption === false && encrypted) throw E("est/unexpected-encrypted-key", "the server returned an encrypted key but the CSR advertised no DecryptKeyIdentifier / AsymmetricDecryptKeyIdentifier to decrypt it (RFC 7030 sec. 4.4.2)");
       var out = { certificates: parseCertsOnly(transferDecode(certPart.body)).certificates };
       if (encrypted) {
         var parsedKey = cms.parse(transferDecode(keyPart.body));
@@ -25439,7 +25781,9 @@ var require_est = __commonJS({
         }
         out.encryptedKey = parsedKey;
       } else {
-        out.privateKey = pkcs8.parse(transferDecode(keyPart.body));
+        var keyDer = transferDecode(keyPart.body);
+        out.privateKey = pkcs8.parse(keyDer);
+        out.privateKeyDer = keyDer;
       }
       return out;
     }
@@ -25625,13 +25969,38 @@ var require_est = __commonJS({
       }
       return resolved;
     }
-    function _hasBasicChallenge(www) {
+    function _offersScheme(www, scheme) {
       var s = String(www || "").replace(/"(?:[^"\\]|\\.)*"/g, '""');
-      return /(?:^|,)\s*Basic(?=[\s,]|$)/i.test(s);
+      return new RegExp("(?:^|,)\\s*" + scheme + "(?=[\\s,]|$)", "i").test(s);
+    }
+    function _authScheme(opts) {
+      if (opts.auth && opts.auth.scheme != null) {
+        var sc = String(opts.auth.scheme).toLowerCase();
+        if (sc !== "basic" && sc !== "digest") throw E("est/bad-input", 'opts.auth.scheme must be "basic" or "digest"');
+        return sc;
+      }
+      if (opts.username !== void 0 || opts.password !== void 0) return "basic";
+      return null;
+    }
+    function _authUser(opts) {
+      return opts.auth && opts.auth.username !== void 0 ? opts.auth.username : opts.username;
+    }
+    function _authPass(opts) {
+      return opts.auth && opts.auth.password !== void 0 ? opts.auth.password : opts.password;
+    }
+    function _hasCreds(opts) {
+      return _authUser(opts) !== void 0 || _authPass(opts) !== void 0;
+    }
+    var DIGEST_CODES = { unsupportedAlgorithm: "est/digest-unsupported-algorithm", weakAlgorithm: "est/digest-weak-algorithm", noQop: "est/digest-no-qop", badChallenge: "est/digest-bad-challenge" };
+    function _digestPolicy(opts) {
+      return { allowMD5: !!(opts.auth && opts.auth.allowMD5), allowLegacyQop: !!(opts.auth && opts.auth.allowLegacyQop), codes: DIGEST_CODES };
     }
     function _drive(method, url, body, headers, opts, transport, budgets) {
       var redirects = 0;
       var authTried = false;
+      var staleRetries = 0;
+      var authSpaces = 0;
+      var lastDigestNonce = null;
       var initialOrigin = url.origin;
       function _tlsFor(u) {
         var t = budgets.tls;
@@ -25644,10 +26013,22 @@ var require_est = __commonJS({
         return t;
       }
       var authValue = null;
+      var digestChallenge = null;
+      var digestNcByNonce = /* @__PURE__ */ Object.create(null);
+      var digestSent = false;
       function _headersFor(u) {
-        if (!authValue || u.origin !== initialOrigin) return headers;
+        digestSent = false;
+        if (u.origin !== initialOrigin || !authValue && !digestChallenge) return headers;
         var hh = Object.assign({}, headers);
-        hh.authorization = authValue;
+        if (digestChallenge) {
+          if (!httpDigest.inProtectionSpace(digestChallenge, u.origin, u.pathname + u.search)) return headers;
+          var nkey = digestChallenge.nonce;
+          digestNcByNonce[nkey] = (digestNcByNonce[nkey] || 0) + 1;
+          hh.authorization = httpDigest.answer(digestChallenge, { method, uri: u.pathname + u.search, username: _authUser(opts), password: _authPass(opts), body, nc: digestNcByNonce[nkey], policy: _digestPolicy(opts) }, E);
+          digestSent = true;
+        } else {
+          hh.authorization = authValue;
+        }
         return hh;
       }
       function step() {
@@ -25675,12 +26056,39 @@ var require_est = __commonJS({
             return step();
           }
           if (status === 401) {
-            if (authTried) throw E("est/auth-required", "the server rejected the credentialed request (RFC 7030 sec. 3.2.3)");
             if (url.origin !== initialOrigin) throw E("est/auth-required", "refusing to send HTTP credentials to a redirected origin (RFC 7030 sec. 3.6)");
             var www = String(h["www-authenticate"] || "");
-            if (!_hasBasicChallenge(www)) throw E("est/auth-required", "the server requires an unsupported HTTP authentication scheme (only Basic is supported): " + www);
-            if (opts.username === void 0 && opts.password === void 0) throw E("est/auth-required", "the server requires HTTP authentication but no credentials were supplied (RFC 7030 sec. 3.2.3)");
-            authValue = "Basic " + Buffer.from((opts.username || "") + ":" + (opts.password || ""), "utf8").toString("base64");
+            if (www.length > constants.LIMITS.HTTP_AUTH_HEADER_MAX_BYTES) throw E("est/auth-required", "the WWW-Authenticate header exceeds the " + constants.LIMITS.HTTP_AUTH_HEADER_MAX_BYTES + "-byte cap (RFC 7030 sec. 3.2.3)");
+            var scheme = _authScheme(opts);
+            if (scheme === null) throw E("est/auth-required", "the server requires HTTP authentication but no credentials were supplied (RFC 7030 sec. 3.2.3)");
+            if (scheme === "digest") {
+              if (!_offersScheme(www, "Digest")) throw E("est/auth-required", 'opts.auth.scheme is "digest" but the server offered no Digest challenge: ' + www);
+              if (!_hasCreds(opts)) throw E("est/auth-required", "Digest authentication requires opts.auth.username / password (RFC 7030 sec. 3.2.3)");
+              var selPol = _digestPolicy(opts);
+              selPol.preferStale = digestSent;
+              selPol.priorNonce = lastDigestNonce;
+              selPol.priorRealm = digestChallenge && digestChallenge.realm;
+              selPol.requestOrigin = url.origin;
+              selPol.requestTarget = url.pathname + url.search;
+              var ch = httpDigest.parseChallenge(www, E, "est/digest-bad-challenge", selPol);
+              if (!ch) throw E("est/auth-required", "the server offered no usable Digest challenge: " + www);
+              if (digestSent && digestChallenge && ch.realm === digestChallenge.realm) {
+                if (!(ch.stale && ch.nonce !== lastDigestNonce && staleRetries < budgets.maxStaleRetries)) throw E("est/auth-required", "the server rejected the credentialed Digest request (RFC 7030 sec. 3.2.3)");
+                staleRetries += 1;
+              } else {
+                if (authTried && authSpaces >= budgets.maxRedirects) throw E("est/auth-required", "the server demanded Digest authentication for too many distinct protection spaces (RFC 7616 sec. 3.3)");
+                if (authTried) authSpaces += 1;
+                authTried = true;
+                staleRetries = 0;
+              }
+              lastDigestNonce = ch.nonce;
+              digestChallenge = ch;
+              return step();
+            }
+            if (authTried) throw E("est/auth-required", "the server rejected the credentialed request (RFC 7030 sec. 3.2.3)");
+            if (!_offersScheme(www, "Basic")) throw E("est/auth-required", "the server requires an unsupported HTTP authentication scheme (only Basic and Digest are supported): " + www);
+            if (!_hasCreds(opts)) throw E("est/auth-required", "the server requires HTTP authentication but no credentials were supplied (RFC 7030 sec. 3.2.3)");
+            authValue = "Basic " + Buffer.from((_authUser(opts) || "") + ":" + (_authPass(opts) || ""), "utf8").toString("base64");
             authTried = true;
             return step();
           }
@@ -25709,8 +26117,10 @@ var require_est = __commonJS({
         tls: _tlsForRequest(opts),
         timeout: guard.limits.cap(opts.timeout, "timeout", DEFAULT_TIMEOUT, { E, code: "est/bad-input", min: 1, max: MAX_TIMEOUT }),
         maxResponseBytes: guard.limits.cap(opts.maxResponseBytes, "maxResponseBytes", constants.LIMITS.HTTP_MAX_RESPONSE_BYTES, { E, code: "est/bad-input", min: 1, max: constants.LIMITS.HTTP_MAX_RESPONSE_BYTES }),
-        maxRedirects: guard.limits.cap(opts.maxRedirects, "maxRedirects", 5, { E, code: "est/bad-input", min: 0, max: 32 })
+        maxRedirects: guard.limits.cap(opts.maxRedirects, "maxRedirects", 5, { E, code: "est/bad-input", min: 0, max: 32 }),
+        maxStaleRetries: guard.limits.cap(opts.auth && opts.auth.maxStaleRetries, "maxStaleRetries", 1, { E, code: "est/bad-input", min: 0, max: 8 })
       };
+      _authScheme(opts);
       return _drive(method, url, body, Object.assign({}, headers), opts, transport, budgets);
     }
     function _certsResult(op, res, opts, csrSpki) {
@@ -25763,10 +26173,119 @@ var require_est = __commonJS({
         return _enroll("simplereenroll", baseUrl, csrInput, opts);
       });
     }
+    function _serverkeygenEncryptionFromCsr(csrDer) {
+      var attrs = csr.parse(csrDer).attributes || [];
+      var keyId = null, kind = null;
+      for (var i = 0; i < attrs.length; i++) {
+        if (attrs[i].type !== OID_DECRYPT_KEY_ID && attrs[i].type !== OID_ASYMM_DECRYPT_KEY_ID) continue;
+        var thisKind = attrs[i].type === OID_ASYMM_DECRYPT_KEY_ID ? "asymmetric" : "symmetric";
+        var vals = attrs[i].values || [];
+        if (vals.length !== 1) throw E("est/bad-input", "a serverkeygen key-identifier attribute must carry exactly one value (RFC 7030 sec. 4.4.1)");
+        var id;
+        try {
+          id = asn1.read.octetString(asn1.decode(vals[0]));
+        } catch (e) {
+          throw E("est/bad-input", "a serverkeygen key-identifier attribute value is not a valid OCTET STRING", e);
+        }
+        if (keyId !== null && !keyId.equals(id)) throw E("est/bad-input", "the CSR advertised two different serverkeygen key identifiers (RFC 7030 sec. 4.4.1)");
+        if (kind !== null && kind !== thisKind) throw E("est/bad-input", "the CSR advertised both a symmetric (DecryptKeyIdentifier) and an asymmetric (AsymmetricDecryptKeyIdentifier) serverkeygen key -- the recipient mechanism is ambiguous (RFC 7030 sec. 4.4.1)");
+        keyId = id;
+        kind = thisKind;
+      }
+      return { requestedEncryption: keyId !== null, expectedRecipientKeyId: keyId, expectedRecipientKind: kind };
+    }
+    function _assertConfidentialCipher(res) {
+      if (!res || !res.tls || !res.tls.cipher) return;
+      var c = res.tls.cipher;
+      var name = (String(c.name || "") + " " + String(c.standardName || "")).toUpperCase();
+      if (/NULL|ANON|EXPORT|\bEXP[-_0-9]|\bA(EC)?DH\b/.test(name)) throw E("est/weak-cipher", "the serverkeygen channel negotiated a NULL / anonymous / EXPORT cipher (" + (c.standardName || c.name) + "), which cannot protect the delivered private key (RFC 7030 sec. 4.4)");
+    }
+    function _ciHeader(headers, name) {
+      headers = headers || {};
+      if (headers[name] !== void 0) return headers[name];
+      var lname = name.toLowerCase(), keys = Object.keys(headers);
+      for (var i = 0; i < keys.length; i++) {
+        if (keys[i].toLowerCase() === lname) return headers[keys[i]];
+      }
+      return null;
+    }
+    async function _serverkeygenResult(res, opts, derived) {
+      var verdict = classifyResponse(res.status, res.headers, res.body, { op: "serverkeygen", now: opts.now });
+      if (verdict.status === "retry") return { retry: true, retryAfterSeconds: verdict.retryAfterSeconds, retryAfterDate: verdict.retryAfterDate };
+      if (verdict.status !== "ok") throw E("est/http-error", "an EST serverkeygen response must be HTTP 200 or 202 (RFC 7030 sec. 4.4.2), got " + res.status);
+      var bodyLen = Buffer.isBuffer(res.body) ? res.body.length : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
+      if (bodyLen === 0) throw E("est/empty-body", "a 200 serverkeygen response carried an empty body (RFC 7030 sec. 4.4.2)");
+      _assertConfidentialCipher(res);
+      var out = parseServerKeygenResponse(res.body, _ciHeader(res.headers, "content-type"), {
+        requestedEncryption: derived.requestedEncryption,
+        expectedRecipientKeyId: derived.expectedRecipientKeyId,
+        expectedRecipientKind: derived.expectedRecipientKind,
+        expectedRecipientIssuerSerial: opts.expectedRecipientIssuerSerial
+      });
+      if (out.privateKeyDer) {
+        var spki;
+        try {
+          spki = await key.publicFromPrivate(out.privateKeyDer);
+        } catch (e) {
+          throw E("est/key-cert-mismatch", "the cleartext server-generated private key's public half could not be derived to bind it to a returned certificate (RFC 7030 sec. 4.4.2)", e);
+        }
+        var bound = findIssuedCert(out.certificates, spki);
+        if (!bound) throw E("est/key-cert-mismatch", "the cleartext server-generated private key matches no returned certificate's public key (RFC 7030 sec. 4.4.2)");
+        if (findIssuedCert(out.certificates.filter(function(c) {
+          return c !== bound;
+        }), spki)) throw E("est/ambiguous-issued-cert", "more than one returned certificate carries the server-generated key; the issued certificate is ambiguous (RFC 7030 sec. 4.4.2)");
+        delete out.privateKeyDer;
+      }
+      return out;
+    }
+    function serverkeygen(baseUrl, csrInput, opts) {
+      opts = opts || {};
+      return Promise.resolve().then(function() {
+        var csrDer = _csrDer(csrInput);
+        var derived = _serverkeygenEncryptionFromCsr(csrDer);
+        if (opts.requestedEncryption !== void 0 && !!opts.requestedEncryption !== derived.requestedEncryption) throw E("est/bad-input", "opts.requestedEncryption (" + !!opts.requestedEncryption + ") contradicts the CSR's advertised key-encryption attribute (" + derived.requestedEncryption + ") (RFC 7030 sec. 4.4.1)");
+        if (opts.expectedRecipientKeyId !== void 0) {
+          if (!Buffer.isBuffer(opts.expectedRecipientKeyId)) throw E("est/bad-input", "opts.expectedRecipientKeyId must be a Buffer");
+          if (derived.expectedRecipientKeyId && !opts.expectedRecipientKeyId.equals(derived.expectedRecipientKeyId)) throw E("est/bad-input", "opts.expectedRecipientKeyId contradicts the key identifier the CSR advertised (RFC 7030 sec. 4.4.1)");
+        }
+        if (opts.expectedRecipientIssuerSerial != null) {
+          var eis = opts.expectedRecipientIssuerSerial;
+          if (typeof eis !== "object" || Buffer.isBuffer(eis) || !Buffer.isBuffer(eis.issuer)) throw E("est/bad-input", "opts.expectedRecipientIssuerSerial must be { issuer: Buffer, serialNumber }");
+          var s = eis.serialNumber;
+          if (!(typeof s === "bigint" && s >= 0n || typeof s === "number" && Number.isSafeInteger(s) && s >= 0 || typeof s === "string" && /^[0-9]+$/.test(s))) throw E("est/bad-input", "opts.expectedRecipientIssuerSerial.serialNumber must be a NON-NEGATIVE bigint, a safe non-negative integer, or a decimal digit string (a certificate serial is non-negative, RFC 5280 sec. 4.1.2.2)");
+        }
+        if ((opts.expectedRecipientKeyId !== void 0 || opts.expectedRecipientIssuerSerial != null) && !derived.requestedEncryption) {
+          throw E("est/bad-input", "a recipient expectation (expectedRecipientKeyId / expectedRecipientIssuerSerial) implies an encrypted key, but the CSR advertised no DecryptKeyIdentifier / AsymmetricDecryptKeyIdentifier attribute (RFC 7030 sec. 4.4.1)");
+        }
+        return _client("serverkeygen", "POST", baseUrl, transferEncode(csrDer), { accept: "multipart/mixed", "content-type": "application/pkcs10" }, opts).then(function(res) {
+          return _serverkeygenResult(res, opts, derived);
+        });
+      });
+    }
+    function _csrattrsResult(res, opts) {
+      var verdict = classifyResponse(res.status, res.headers, res.body, { op: "csrattrs", now: opts.now });
+      if (verdict.status === "none-available") return { available: false, attrs: null };
+      if (verdict.status === "retry") throw E("est/http-error", "a /csrattrs response must be HTTP 200, 204, or 404, not 202 (RFC 7030 sec. 4.5.2)");
+      if (verdict.status !== "ok") throw E("est/http-error", "an EST csrattrs response must be HTTP 200 / 204 / 404 (RFC 7030 sec. 4.5.2), got " + res.status);
+      var bodyLen = Buffer.isBuffer(res.body) ? res.body.length : Buffer.byteLength(String(res.body == null ? "" : res.body), "utf8");
+      if (bodyLen === 0) throw E("est/empty-body", "a 200 csrattrs response carried an empty body (RFC 7030 sec. 4.5.2)");
+      var attrs = csrattrsFmt.parse(transferDecode(res.body));
+      return { available: true, attrs, plan: buildEnrollAttributes(attrs) };
+    }
+    function csrattrs(baseUrl, opts) {
+      opts = opts || {};
+      return Promise.resolve().then(function() {
+        return _client("csrattrs", "GET", baseUrl, null, { accept: "application/csrattrs" }, opts);
+      }).then(function(res) {
+        return _csrattrsResult(res, opts);
+      });
+    }
     module2.exports = {
       cacerts,
       simpleenroll,
       simplereenroll,
+      serverkeygen,
+      csrattrs,
       transferDecode,
       transferEncode,
       splitMultipartMixed,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.18.3",
+  "version": "0.18.5",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:9d3414e8-a5dc-451e-9642-21fd4aa2188c",
+  "serialNumber": "urn:uuid:c76abfd3-3a0a-4021-9a10-644df6ec17a3",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-01T16:37:24.282Z",
+    "timestamp": "2026-08-01T22:29:48.972Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.18.3",
+      "bom-ref": "@blamejs/core@0.18.5",
       "type": "application",
       "name": "blamejs",
-      "version": "0.18.3",
+      "version": "0.18.5",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.18.3",
+      "purl": "pkg:npm/%40blamejs/core@0.18.5",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.18.3",
+      "ref": "@blamejs/core@0.18.5",
       "dependsOn": []
     }
   ]