@blamejs/pki 0.2.6 → 0.2.8

package/CHANGELOG.md

@@ -4,7 +4,29 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## v0.2.6 — 2026-07-13
+## v0.2.8 — 2026-07-13
+
+pki.webcrypto rejects an AES key of invalid length at import instead of deferring the failure to first use.
+
+### Fixed
+
+- pki.webcrypto.subtle.importKey now rejects a raw or JWK AES key whose length is not 128, 192, or 256 bits as a webcrypto/data DataError at import, rather than returning a CryptoKey that only fails at first use. Covers AES-GCM, AES-CBC, AES-CTR, and AES-KW; HMAC, HKDF, and PBKDF2 keys are unaffected.
+- The README capability table and the documentation site render the certificate-inspection entry correctly: an inline code span containing pipe characters no longer breaks the surrounding table into misaligned columns.
+
+## v0.2.7 — 2026-07-13
+
+pki.webcrypto rejects an imported key whose type disagrees with its algorithm, and reports every cipher fault as a typed error.
+
+### Changed
+
+- The pkijs.com documentation site is regenerated with content-hashed CSS/JS under a strict Content-Security-Policy, an in-memory search endpoint, a browsable reference of every error class and code, symbol autocomplete, and concept guides. Documentation only -- the published package is unchanged.
+
+### Fixed
+
+- pki.webcrypto.subtle.importKey now validates that an imported asymmetric key's actual type matches the requested algorithm (an RSA key imported under an Ed25519, ECDSA, or RSA-PSS name is rejected as webcrypto/data), closing an algorithm-confusion path where a mislabeled CryptoKey could later be used under the wrong signature scheme. The EC import path already derived and checked the curve; this extends the same key-is-authority rule to RSA and the Edwards/Montgomery curves.
+- pki.webcrypto AES cipher faults now fail closed with a typed webcrypto/operation error instead of a raw Node exception: a decrypt of a tampered AES-GCM ciphertext (failed authentication tag), bad AES-CBC padding, a non-8-byte-multiple AES-KW wrap/unwrap length, and a malformed cipher parameter all surface as a WebCryptoError, so a caller catching pki.errors.PkiError sees a typed verdict rather than a bare Node error crossing the API boundary.
+
+## v0.2.6 — 2026-07-12
 
 WebAuthn attestation verification covers Ed448 and the RFC 9864 fully-specified COSE algorithms, and hardens credential-key conformance.
 

package/README.md

@@ -227,7 +227,7 @@ is callable today; nothing below is a stub.
 | `pki.shbs` | Stateful hash-based signature **verification** — HSS/LMS (RFC 8554), carried in X.509 by RFC 9802 and CMS by RFC 9708, profiled by NIST SP 800-208 (CNSA 2.0 firmware signing). `verify` checks an HSS signature (every level must pass) and `verifyLms` a single-tree LMS, over the raw public-key / signature blobs the parsers already surface. Pure public-input SHA-256 / SHAKE256 hashing, a data-driven typecode registry, bounds-before-slice reads; a malformed blob throws a typed `ShbsError`, a well-formed-but-wrong signature returns `false`. **Verify only by design** — stateful signing needs atomic one-time-key state that belongs in an HSM — `verify`, `verifyLms` |
 | `pki.hpke` | Hybrid Public Key Encryption (RFC 9180) — the encrypt-to-a-public-key primitive behind TLS ECH, MLS, and OHTTP. `setupS`/`setupR` establish a sender/recipient context (KEM encapsulation + HKDF key schedule); the context's `seal`/`open` AEAD-encrypt with a sequence-counter nonce and `export` derives further secrets; `seal`/`open` are single-shot wrappers. DHKEM (P-256, P-521, X25519, X448) × HKDF-SHA256/SHA512 × AES-GCM/ChaCha20Poly1305/export-only × all four modes, proven against the RFC 9180 Appendix A vectors. DHKEM(P-384) and HKDF-SHA384 are RFC-registered but Appendix A ships no vector for them, so they fail closed until an authoritative KAT exists. Pure composition over `node:crypto`; ML-KEM / X-Wing are a registry data-row extension pending stable drafts — `suites`, `setupS`, `setupR`, `seal`, `open` |
 | `pki.sigstore` | Offline verifier for a Sigstore bundle — the exact artifact `npm publish --provenance` produces and the registry serves. `verifyBundle` composes five fail-closed legs against caller-pinned trust (Fulcio CA roots + Rekor log keys, never trusted from the bundle): the DSSE signature over its PAE preimage under the Fulcio leaf key; the ephemeral Fulcio certificate chain, validated as of the Rekor log time; the RFC 9162 inclusion proof folded to a Rekor-signed tree root; the log entry bound to this exact signature; and the in-toto SLSA subject digest the caller confirms against the published artifact. Zero runtime deps — reuses the X.509 parser, RFC 5280 path validator, and Merkle verifier; the net-new codecs are the DSSE PAE byte-builder and a fail-closed JSON reader. `pae`, `parseBundle`, `verifyBundle` |
-| `pki.inspect` | Human-readable certificate inspection — the pure-JS equivalent of `openssl x509 -text`. `certificate(pem | der | parsed)` renders a familiar OpenSSL-style report: version, serial, signature algorithm, issuer/subject distinguished names, validity, public-key details (curve or modulus size + the raw point/modulus), every decoded extension with its critical flag, and the signature. Built over the strict parser and the two-way OID registry, so it names extension and algorithm OIDs an OpenSSL build shows only as raw bytes. No OpenSSL dependency; the format is stable and OpenSSL-familiar rather than pinned to one OpenSSL version; a malformed extension falls back to a hex dump rather than throwing — `certificate` |
+| `pki.inspect` | Human-readable certificate inspection — the pure-JS equivalent of `openssl x509 -text`. `certificate(pem \| der \| parsed)` renders a familiar OpenSSL-style report: version, serial, signature algorithm, issuer/subject distinguished names, validity, public-key details (curve or modulus size + the raw point/modulus), every decoded extension with its critical flag, and the signature. Built over the strict parser and the two-way OID registry, so it names extension and algorithm OIDs an OpenSSL build shows only as raw bytes. No OpenSSL dependency; the format is stable and OpenSSL-familiar rather than pinned to one OpenSSL version; a malformed extension falls back to a hex dump rather than throwing — `certificate` |
 | `pki.webauthn` | WebAuthn / passkey attestation verification — offline trust evaluation of a W3C WebAuthn (Level 3) attestation. `parseAttestationObject(bytes)` decodes the CBOR attestation object + authenticatorData + COSE credential key over the strict `pki.cbor` codec; `verify(attestationObject, clientDataHash, opts)` checks the attestation-statement signature and each format's structural bindings for **packed / tpm / android-key / apple / fido-u2f / none** — the x5c leaf key, the apple nonce, the tpm `certInfo` Name/`extraData` over the `pubArea`, the android `KeyDescription`, the fido-u2f `verificationData` — binding the credential public key to each attestation (via the signed authenticatorData for packed/fido-u2f, or a cert/`pubArea`-key equality check for android-key/apple/tpm) and enforcing each leaf's certificate requirements. The credential-key check covers the full WebAuthn COSE algorithm set — ES256/384/512, RS256/384/512, PS256, EdDSA (Ed25519), and the RFC 9864 fully-specified identifiers **ESP256/384/512, Ed25519, and Ed448** — validating the public-key point on its curve, rejecting the compressed EC point form, and enforcing a minimally-encoded DER ECDSA signature. A verifier, not a ceremony client; fail-closed with typed `webauthn/*` errors. Chaining the returned trust path to a pinned root (and aaguid→root via FIDO MDS) is the caller's step through `pki.path.validate` — `parseAttestationObject`, `verify` |
 | `pki.C` / `pki.constants` | Version-stable constants — functional scale helpers (`C.TIME.*`, `C.BYTES.*`), codec `LIMITS`, `version` |
 | `pki.errors` | The `PkiError` taxonomy — `defineClass` plus `ConstantsError` / `Asn1Error` / `OidError` / `PemError` / `CertificateError` / `CrlError` / `CsrError` / `Pkcs8Error` / `CmsError` / `OcspError` / `TspError` / `AttrCertError` / `CrmfError` / `Pkcs12Error` / `CmpError` / `PathError` / `CtError` / `JoseError` / `AcmeError` / `WebauthnError`, each carrying a stable `code` in `domain/reason` form |

package/lib/path-validate.js

@@ -1463,7 +1463,7 @@ function crlIssuerNamesIssuer(cRLIssuer, issuerRdns) {
     // dnEqual throws only on a control-byte / malformed cRLIssuer DN; returning false excludes
     // that DP from the correspondence (a malformed indirect-CRL issuer name never corresponds).
     try { if (dnEqual(n.value.rdns, issuerRdns)) return true; }
-    catch (_e) { return false; }   // allow:swallow-unverified fail-closed predicate: error -> no match -> DP excluded (restrictive)
+    catch (_e) { return false; }
   }
   return false;
 }

package/lib/webcrypto.js

@@ -353,6 +353,16 @@ SubtleCrypto.prototype.verify = async function verify(algorithm, key, signature,
   throw new WebCryptoError("webcrypto/not-supported", "verify: unsupported algorithm " + JSON.stringify(name));
 };
 
+// Run a node:crypto AES cipher sequence, converting any raw node fault -- a bad IV length,
+// a failed GCM authentication tag, bad CBC padding -- into a typed OperationError. A
+// decrypt of tampered ciphertext (or a malformed cipher parameter) is a typed webcrypto
+// verdict, never a raw Error crossing the public API (input prep that already throws a
+// typed error runs OUTSIDE this, so a typed fault is never double-wrapped).
+function _runCipher(fn, who) {
+  try { return fn(); }
+  catch (e) { throw new WebCryptoError("webcrypto/operation", who + ": AES cipher operation failed (bad key / iv / tag / padding)", e); }
+}
+
 SubtleCrypto.prototype.encrypt = async function encrypt(algorithm, key, data) {
   var alg = _normalizeAlg(algorithm, "encrypt");
   _requireUsage(key, "encrypt");
@@ -369,19 +379,28 @@ SubtleCrypto.prototype.encrypt = async function encrypt(algorithm, key, data) {
   }
   if (name === "AES-GCM") {
     var iv = _toBuf(alg.iv, "AES-GCM iv");
-    var cipher = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-gcm", _secretBytes(key), iv, { authTagLength: (alg.tagLength || 128) / 8 });
-    if (alg.additionalData) cipher.setAAD(_toBuf(alg.additionalData, "AES-GCM aad"));
-    var ct = Buffer.concat([cipher.update(buf), cipher.final()]);
-    return _toArrayBuffer(Buffer.concat([ct, cipher.getAuthTag()]));
+    var aad = alg.additionalData ? _toBuf(alg.additionalData, "AES-GCM aad") : null;
+    return _toArrayBuffer(_runCipher(function () {
+      var cipher = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-gcm", _secretBytes(key), iv, { authTagLength: (alg.tagLength || 128) / 8 });
+      if (aad) cipher.setAAD(aad);
+      var ct = Buffer.concat([cipher.update(buf), cipher.final()]);
+      return Buffer.concat([ct, cipher.getAuthTag()]);
+    }, "encrypt"));
   }
   if (name === "AES-CBC") {
-    var c2 = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-cbc", _secretBytes(key), _toBuf(alg.iv, "AES-CBC iv"));
-    return _toArrayBuffer(Buffer.concat([c2.update(buf), c2.final()]));
+    var cbcIv = _toBuf(alg.iv, "AES-CBC iv");
+    return _toArrayBuffer(_runCipher(function () {
+      var c2 = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-cbc", _secretBytes(key), cbcIv);
+      return Buffer.concat([c2.update(buf), c2.final()]);
+    }, "encrypt"));
   }
   if (name === "AES-CTR") {
     _requireCtrLength128(alg);
-    var c3 = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-ctr", _secretBytes(key), _toBuf(alg.counter, "AES-CTR counter"));
-    return _toArrayBuffer(Buffer.concat([c3.update(buf), c3.final()]));
+    var ctrCounter = _toBuf(alg.counter, "AES-CTR counter");
+    return _toArrayBuffer(_runCipher(function () {
+      var c3 = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-ctr", _secretBytes(key), ctrCounter);
+      return Buffer.concat([c3.update(buf), c3.final()]);
+    }, "encrypt"));
   }
   throw new WebCryptoError("webcrypto/not-supported", "encrypt: unsupported algorithm " + JSON.stringify(name));
 };
@@ -403,21 +422,31 @@ SubtleCrypto.prototype.decrypt = async function decrypt(algorithm, key, data) {
   if (name === "AES-GCM") {
     var tagLen = (alg.tagLength || 128) / 8;
     var iv = _toBuf(alg.iv, "AES-GCM iv");
+    if (buf.length < tagLen) throw new WebCryptoError("webcrypto/operation", "decrypt: AES-GCM ciphertext is shorter than its authentication tag");
     var ct = buf.subarray(0, buf.length - tagLen);
     var tag = buf.subarray(buf.length - tagLen);
-    var d = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-gcm", _secretBytes(key), iv, { authTagLength: tagLen });
-    if (alg.additionalData) d.setAAD(_toBuf(alg.additionalData, "AES-GCM aad"));
-    d.setAuthTag(tag);
-    return _toArrayBuffer(Buffer.concat([d.update(ct), d.final()]));
+    var gcmAad = alg.additionalData ? _toBuf(alg.additionalData, "AES-GCM aad") : null;
+    return _toArrayBuffer(_runCipher(function () {
+      var d = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-gcm", _secretBytes(key), iv, { authTagLength: tagLen });
+      if (gcmAad) d.setAAD(gcmAad);
+      d.setAuthTag(tag);
+      return Buffer.concat([d.update(ct), d.final()]);
+    }, "decrypt"));
   }
   if (name === "AES-CBC") {
-    var d2 = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-cbc", _secretBytes(key), _toBuf(alg.iv, "AES-CBC iv"));
-    return _toArrayBuffer(Buffer.concat([d2.update(buf), d2.final()]));
+    var cbcIv2 = _toBuf(alg.iv, "AES-CBC iv");
+    return _toArrayBuffer(_runCipher(function () {
+      var d2 = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-cbc", _secretBytes(key), cbcIv2);
+      return Buffer.concat([d2.update(buf), d2.final()]);
+    }, "decrypt"));
   }
   if (name === "AES-CTR") {
     _requireCtrLength128(alg);
-    var d3 = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-ctr", _secretBytes(key), _toBuf(alg.counter, "AES-CTR counter"));
-    return _toArrayBuffer(Buffer.concat([d3.update(buf), d3.final()]));
+    var ctrCounter2 = _toBuf(alg.counter, "AES-CTR counter");
+    return _toArrayBuffer(_runCipher(function () {
+      var d3 = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-ctr", _secretBytes(key), ctrCounter2);
+      return Buffer.concat([d3.update(buf), d3.final()]);
+    }, "decrypt"));
   }
   throw new WebCryptoError("webcrypto/not-supported", "decrypt: unsupported algorithm " + JSON.stringify(name));
 };
@@ -526,8 +555,16 @@ SubtleCrypto.prototype.wrapKey = async function wrapKey(format, key, wrappingKey
   if (alg.name !== "AES-KW" && !ENCRYPT_DECRYPT_NAMES[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "wrapKey: unsupported algorithm " + JSON.stringify(alg.name));
   _requireAlgMatch(alg, wrappingKey, "wrapKey");
   if (alg.name === "AES-KW") {
-    var c = nodeCrypto.createCipheriv("aes" + wrappingKey.algorithm.length + "-wrap", _secretBytes(wrappingKey), Buffer.from("A6A6A6A6A6A6A6A6", "hex"));
-    return _toArrayBuffer(Buffer.concat([c.update(bytes), c.final()]));
+    // AES-KW wraps 64-bit blocks (RFC 3394): the serialized key MUST be a multiple of 8
+    // bytes and at least 16. A "jwk" serialization (arbitrary-length JSON) or any other
+    // non-conforming length is an OperationError -- a typed verdict, never a raw node fault.
+    if (bytes.length < 16 || bytes.length % 8 !== 0) {
+      throw new WebCryptoError("webcrypto/operation", "wrapKey: AES-KW requires the serialized key be a multiple of 8 bytes (>= 16); got " + bytes.length + " -- format " + JSON.stringify(format) + " is not AES-KW-wrappable");
+    }
+    try {
+      var c = nodeCrypto.createCipheriv("aes" + wrappingKey.algorithm.length + "-wrap", _secretBytes(wrappingKey), Buffer.from("A6A6A6A6A6A6A6A6", "hex"));
+      return _toArrayBuffer(Buffer.concat([c.update(bytes), c.final()]));
+    } catch (e) { throw new WebCryptoError("webcrypto/operation", "wrapKey: AES-KW key wrap failed", e); }
   }
   // Delegate to a content-encryption algorithm (RSA-OAEP / AES-GCM).
   var wrapKeyClone = _cloneWithUsage(wrappingKey, "encrypt");
@@ -546,8 +583,17 @@ SubtleCrypto.prototype.unwrapKey = async function unwrapKey(format, wrappedKey,
   _requireAlgMatch(alg, unwrappingKey, "unwrapKey");
   var bytes;
   if (alg.name === "AES-KW") {
-    var d = nodeCrypto.createDecipheriv("aes" + unwrappingKey.algorithm.length + "-wrap", _secretBytes(unwrappingKey), Buffer.from("A6A6A6A6A6A6A6A6", "hex"));
-    bytes = Buffer.concat([d.update(_toBuf(wrappedKey, "unwrapKey")), d.final()]);
+    var wrapped = _toBuf(wrappedKey, "unwrapKey");
+    // The wrapped input is the plaintext plus one 64-bit integrity block: a multiple of 8,
+    // at least 24. A wrong length, or a failed integrity check inside final(), is an
+    // OperationError -- a typed verdict, never a raw node cipher fault.
+    if (wrapped.length < 24 || wrapped.length % 8 !== 0) {
+      throw new WebCryptoError("webcrypto/operation", "unwrapKey: AES-KW wrapped key must be a multiple of 8 bytes (>= 24); got " + wrapped.length);
+    }
+    try {
+      var d = nodeCrypto.createDecipheriv("aes" + unwrappingKey.algorithm.length + "-wrap", _secretBytes(unwrappingKey), Buffer.from("A6A6A6A6A6A6A6A6", "hex"));
+      bytes = Buffer.concat([d.update(wrapped), d.final()]);
+    } catch (e) { throw new WebCryptoError("webcrypto/operation", "unwrapKey: AES-KW key unwrap failed (integrity or length)", e); }
   } else {
     var unwrapKeyClone = _cloneWithUsage(unwrappingKey, "decrypt");
     bytes = Buffer.from(await this.decrypt(unwrapAlgorithm, unwrapKeyClone, wrappedKey));
@@ -575,6 +621,17 @@ function _cloneWithUsage(key, usage) {
   return k;
 }
 
+// A raw or JWK-oct AES key MUST be 128/192/256 bits: W3C WebCrypto importKey rejects a
+// non-conforming length as a DataError AT IMPORT, never a CryptoKey that only faults at
+// first use (where node would build an "aes-160-gcm" cipher that fails only then). HMAC /
+// HKDF / PBKDF2 keys carry no length restriction, so the check is scoped to the AES names.
+function _assertAesImportLen(name, byteLen) {
+  if ((name === "AES-GCM" || name === "AES-CBC" || name === "AES-CTR" || name === "AES-KW") &&
+      byteLen !== 16 && byteLen !== 24 && byteLen !== 32) {
+    throw new WebCryptoError("webcrypto/data", name + ": an imported AES key must be 128, 192, or 256 bits");
+  }
+}
+
 SubtleCrypto.prototype.importKey = async function importKey(format, keyData, algorithm, extractable, keyUsages) {
   var alg = _normalizeAlg(algorithm, "importKey");
   var usages = keyUsages || [];
@@ -584,6 +641,7 @@ SubtleCrypto.prototype.importKey = async function importKey(format, keyData, alg
     // Symmetric raw material, or a raw public key for EC/OKP.
     if (name === "AES-GCM" || name === "AES-CBC" || name === "AES-CTR" || name === "AES-KW" || name === "HMAC" || name === "HKDF" || name === "PBKDF2") {
       var raw = _toBuf(keyData, "importKey raw");
+      _assertAesImportLen(name, raw.length);
       var secret = nodeCrypto.createSecretKey(raw);
       var symAlg = (name === "HMAC") ? { name: name, hash: _hashObj(alg.hash), length: raw.length * 8 } : { name: name, length: raw.length * 8 };
       return new CryptoKey("secret", extractable, symAlg, usages, secret);
@@ -604,6 +662,7 @@ SubtleCrypto.prototype.importKey = async function importKey(format, keyData, alg
     var jwk = keyData;
     if (jwk.kty === "oct") {
       var kbuf = _b64urlToBuf(jwk.k, "JWK oct key material");
+      _assertAesImportLen(name, kbuf.length);
       var s2 = nodeCrypto.createSecretKey(kbuf);
       var a2 = (name === "HMAC") ? { name: name, hash: _hashObj(alg.hash), length: kbuf.length * 8 } : { name: name, length: kbuf.length * 8 };
       return new CryptoKey("secret", extractable, a2, usages, s2);
@@ -633,7 +692,28 @@ function _importRawPublic(name, alg, raw, extractable, usages) {
   throw new WebCryptoError("webcrypto/not-supported", "importKey raw: unsupported public-key algorithm " + JSON.stringify(name));
 }
 
+// The node asymmetricKeyType(s) each imported asymmetric algorithm requires. The key TYPE
+// is a property of the key material, not the caller's claim: an RSA key imported under
+// {name:"Ed25519"} must be a DataError, not a CryptoKey mislabeled Ed25519 that then signs
+// under the wrong scheme (algorithm confusion). EC is additionally curve-validated below.
+var IMPORT_KEY_TYPE = {
+  "RSASSA-PKCS1-V1_5": { rsa: 1 }, "RSA-PSS": { rsa: 1, "rsa-pss": 1 }, "RSA-OAEP": { rsa: 1 },
+  "ECDSA": { ec: 1 }, "ECDH": { ec: 1 },
+  "ED25519": { ed25519: 1 }, "ED448": { ed448: 1 },
+  "X25519": { x25519: 1 }, "X448": { x448: 1 },
+};
+// The FIPS 203/204/205 PQC families import the same key-is-authority rule: each WebCrypto
+// algorithm name maps to exactly its node asymmetricKeyType, so an RSA (or any) key imported
+// under an ML-DSA / ML-KEM / SLH-DSA name is a DataError, not a mislabeled PQC CryptoKey.
+[ML_DSA_NODE, ML_KEM_NODE, SLH_DSA_NODE].forEach(function (m) {
+  Object.keys(m).forEach(function (webName) { var t = {}; t[m[webName]] = 1; IMPORT_KEY_TYPE[webName] = t; });
+});
 function _algFromImport(name, alg, keyObject) {
+  var wantType = IMPORT_KEY_TYPE[name];
+  if (wantType && keyObject && keyObject.asymmetricKeyType && !wantType[keyObject.asymmetricKeyType]) {
+    throw new WebCryptoError("webcrypto/data", name + ": the imported key is a " + keyObject.asymmetricKeyType +
+      " key, which is not compatible with algorithm " + name);
+  }
   if (name === "ECDSA" || name === "ECDH") {
     // W3C WebCrypto EC import -- the curve is a property of the KEY, not the
     // caller's claim. Derive it from the imported key material; reject an

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.2.6",
+  "version": "0.2.8",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:a602dc26-1f23-43cd-ad30-ef4f457ccc22",
+  "serialNumber": "urn:uuid:fb3ea0b4-6f7b-459d-b24d-19dcdee7f0a8",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-13T05:42:29.445Z",
+    "timestamp": "2026-07-13T08:58:47.895Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.2.6",
+      "bom-ref": "@blamejs/pki@0.2.8",
       "type": "application",
       "name": "pki",
-      "version": "0.2.6",
+      "version": "0.2.8",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.2.6",
+      "purl": "pkg:npm/%40blamejs/pki@0.2.8",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.2.6",
+      "ref": "@blamejs/pki@0.2.8",
       "dependsOn": []
     }
   ]