@blamejs/pki 0.8.3 → 0.8.5

package/lib/schema-pkcs8.js

@@ -193,8 +193,15 @@ function matches(root) {
 }
 
 
-function walkPrivateKeyInfo(node) { return schema.walk(PRIVATE_KEY_INFO, node, NS).result; }
-function walkEncryptedPrivateKeyInfo(node) { return schema.walk(ENCRYPTED_PRIVATE_KEY_INFO, node, NS).result; }
+/** @internal `ctx` is the walk context of the parse that reached this key, when another format
+ *  carries it. Only its caps and budget cross over: the key is still read in this namespace, so a
+ *  fault in it keeps the PKCS#8 error class and code. */
+function walkPrivateKeyInfo(node, ctx) {
+  return schema.walk(PRIVATE_KEY_INFO, node, schema.withResources(NS, ctx)).result;
+}
+function walkEncryptedPrivateKeyInfo(node, ctx) {
+  return schema.walk(ENCRYPTED_PRIVATE_KEY_INFO, node, schema.withResources(NS, ctx)).result;
+}
 
 module.exports = {
   parse: parse,

package/lib/schema-pkix.js

@@ -222,17 +222,16 @@ function _isPemArmor(buf) {
 /** @internal The codec's resource refusals, as distinct from its malformed-input refusals. A
  *  caller who tightened a cap has to be able to tell "your bytes are wrong" from "your cap is
  *  too small", and only the second is answered by raising the cap. */
-var RESOURCE_REFUSALS = intrinsic.assign(intrinsic.create(null), {
-  "asn1/too-large": 1, "asn1/too-deep": 1, "asn1/too-many-items": 1,
-});
+var _isResourceRefusal = schema.isResourceRefusal;
 
 function decodeRoot(der, opts, caps, budget) {
+  // allow:bare-decode the root decode a door performs, which is where the caller's caps enter.
   try { return asn1.decode(der, _decodeOptions(opts, caps)); }
   catch (e) {
     /** @internal `rawDecodeErrors` keeps the codec's own code for a malformed body, which some
      *  callers pin. A resource refusal is still translated, that code being new. */
-    if (opts.rawDecodeErrors && !(e && RESOURCE_REFUSALS[e.code])) throw e;
-    if (e && RESOURCE_REFUSALS[e.code]) {
+    if (opts.rawDecodeErrors && !_isResourceRefusal(e)) throw e;
+    if (_isResourceRefusal(e)) {
       if (budget) {
         try {
           budget.trip(opts.what || "the input");
@@ -338,12 +337,18 @@ var _emptyOptions = intrinsic.freeze(intrinsic.create(null));
 function runParseWith(input, opts, callerOpts, build) {
   var caps = parseCaps(callerOpts, opts);
   var budget = guard.limits.budget({ maxBytes: caps.maxBytes });
-  var ns = _nsWithBudget(opts.ns, budget);
+  var ns = _nsWithBudget(opts.ns, budget, caps);
   var result;
   try {
     result = build(decodeRoot(coerceToDer(input, opts), opts, caps, budget), ns, caps, budget);
   } catch (e) {
     if (guard.limits.isBudgetExceeded(e)) throw _budgetRefusal(opts, e);
+    /** @internal A refusal that is already this door's own resource verdict has been translated
+     *  once and carries the codec's refusal as its cause; wrapping it again would put a copy of
+     *  the verdict where a caller looks for the cap that was exceeded. */
+    if (budget.exhausted() && !(e && e.code === opts.prefix + "/too-large")) {
+      throw _budgetRefusal(opts, e);
+    }
     throw e;
   }
   if (budget.exhausted()) throw _budgetRefusal(opts, null);
@@ -357,17 +362,31 @@ function runParse(input, opts, callerOpts) {
 }
 
 /** @internal The re-read at the door is what makes the latch worth having: a catch anywhere
- *  under the walk may absorb the exception, and this still refuses. */
+ *  under the walk may absorb the exception or rewrap it as a domain error, and this still
+ *  refuses. The rewrapped error is carried as the cause. */
 function _budgetRefusal(opts, cause) {
   return new opts.ErrorClass(opts.prefix + "/too-large",
     (opts.what || "the input") + " exceeds the decode budget for this parse", cause || undefined);
 }
 
-function _nsWithBudget(ns, budget) {
-  var out = intrinsic.create(null);
-  _forEach(intrinsic.keys(ns), function (k) { out[k] = ns[k]; });
-  out.budget = budget;
-  return out;
+function _nsWithBudget(ns, budget, caps) {
+  return schema.withResources(ns, { budget: budget, caps: caps });
+}
+
+/** @internal The walk context a hand-rolled door builds for the structures it reads out of its
+ *  own input, so the caller's caps reach them the way `runParseWith` makes them reach a factory
+ *  parser's. The door re-reads `budget.exhausted()` before it returns a result. */
+function nestedContext(ns, caps) {
+  var budget = guard.limits.budget({ maxBytes: caps.maxBytes });
+  return { ns: _nsWithBudget(ns, budget, caps), budget: budget };
+}
+
+/** @internal The decode a format performs on a value it has already read out of its input: an
+ *  embedded OCTET STRING payload, an encapsulated protocol body. The engine owns it, because
+ *  `schema.embeddedDer` performs the same decode from inside a walk and the two must apply the
+ *  caller's caps and trip the parse budget the same way. This is the name format modules call. */
+function decodeNested(bytes, ctx, label, opts) {
+  return schema.decodeNested(bytes, ctx, label, opts);
 }
 
 var DN_SHORT = constants.NAMES.DN_SHORT;
@@ -489,6 +508,7 @@ function attrValueToString(ns) {
         throw ns.E(ns.prefix + "/bad-atv", "a #hex attribute value must be a non-empty even run of hex digits (RFC 4514 sec. 2.4)");
       }
       var raw = guard.encoding.hex(hex, null, ns.E, ns.prefix + "/bad-atv", "a #hex attribute value");
+      // allow:bare-decode the encoder side, checking bytes a caller wrote by hand, outside any parse.
       try { asn1.decode(raw); }
       catch (e) { throw ns.E(ns.prefix + "/bad-atv", "a #hex attribute value must encode exactly one DER TLV", e); }
       return raw;
@@ -826,7 +846,7 @@ function decodeIssuingDistributionPointValue(ns, bytes, code) {
     indirect: false, onlyAttr: false, fields: null };
   var m;
   try {
-    m = schema.walk(issuingDistributionPoint(code), asn1.decode(bytes), ns);
+    m = schema.walk(issuingDistributionPoint(code), schema.decodeNested(bytes, ns, "an IssuingDistributionPoint value"), ns);
     if (m.fields.distributionPoint.present) {
       var wrap = m.fields.distributionPoint.node;
       if (!wrap.children || wrap.children.length !== 1) {
@@ -928,15 +948,20 @@ function userNoticeTexts(qualifier) {
   return i === kids.length ? out : [];
 }
 
+/** @internal The readers an extension or attribute value is decoded through. `ctx` is the walk
+ *  context of the parse that reached the value, when one did: the bytes here are an OCTET STRING
+ *  payload the root decode stopped at, so this decode restarts depth and item counting and needs
+ *  the caller's caps handed to it. A caller outside a parse passes none and takes the built-in
+ *  ceilings, which is what `ns` carries. */
 function _decodeHelpers(ns) {
-  function decodeTop(buf, code, what) {
+  function decodeTop(buf, code, what, ctx) {
     var n;
-    try { n = asn1.decode(buf); }
+    try { n = schema.decodeNested(buf, ctx || ns, what); }
     catch (e) { throw ns.E(code, "malformed " + what + " value: " + ((e && e.message) || _String(e)), e); }
     return n;
   }
-  function seqChildren(buf, code, what) {
-    var n = decodeTop(buf, code, what);
+  function seqChildren(buf, code, what, ctx) {
+    var n = decodeTop(buf, code, what, ctx);
     if (n.tagClass !== "universal" || n.tagNumber !== _T.SEQUENCE || !n.children) {
       throw ns.E(code, what + " must be a SEQUENCE (RFC 5280 sec. 4.2.1)");
     }
@@ -1576,6 +1601,8 @@ module.exports = {
   isCborResourceRefusal: isCborResourceRefusal,
   cborParseOpts: cborParseOpts,
   parseOpts: parseOpts,
+  decodeNested: decodeNested,
+  nestedContext: nestedContext,
   makeNS: makeNS,
   versionReader: versionReader,
   DN_SHORT: DN_SHORT,

package/lib/schema-tsp.js

@@ -204,7 +204,7 @@ var TIME_STAMP_RESP = schema.seq([
   schema.optional("timeStampToken", schema.any(), { whenUniversal: [TAGS.SEQUENCE] }),
 ], {
   assert: "sequence", arity: { min: 1 }, code: "tsp/bad-response", what: "TimeStampResp",
-  build: function (m) {
+  build: function (m, ctx) {
     var status = m.fields.status.value.result;
     var present = m.fields.timeStampToken.present;
     var granted = status.status === 0 || status.status === 1;
@@ -215,7 +215,9 @@ var TIME_STAMP_RESP = schema.seq([
       status: status.status,
       statusString: status.statusString,
       failInfo: status.failInfo,
-      timeStampToken: present ? parseToken(m.fields.timeStampToken.value.bytes) : null,
+      /** @internal The token is a second parse of bytes carried inside this one, so it takes the
+       *  caps this door was given rather than the built-in ceilings. */
+      timeStampToken: present ? parseToken(m.fields.timeStampToken.value.bytes, ctx ? ctx.caps : undefined) : null,
     };
   },
 });
@@ -424,12 +426,23 @@ function parseToken(input, callerOpts) {
   if (!hasSigningCert) {
     throw new TspError("tsp/missing-signing-certificate", "a TimeStampToken signerInfo must carry a SigningCertificate or SigningCertificateV2 signed attribute (RFC 3161 sec. 2.4.2, RFC 5816)");
   }
+  /** @internal The TSTInfo is decoded out of the eContent the CMS layer handed back, so it is a
+   *  second decode and takes the caller's caps the way the carrier did. The latch is re-read
+   *  below, because the catch here answers in this domain and would otherwise report a cap that
+   *  was too small as a malformed TSTInfo. */
+  var nested = pkix.nestedContext(NS, caps);
   var tstInfo;
-  try { tstInfo = schema.embeddedDer(TST_INFO, encap.eContent, NS, { code: "tsp/bad-der", what: "the encapsulated TSTInfo" }); }
+  try { tstInfo = schema.embeddedDer(TST_INFO, encap.eContent, nested.ns, { code: "tsp/bad-der", what: "the encapsulated TSTInfo" }); }
   catch (e) {
+    if (nested.budget.exhausted()) {
+      throw new TspError("tsp/too-large", "the timeStampToken exceeds the decode budget for this parse", e);
+    }
     if (e instanceof TspError) throw e;
     throw new TspError("tsp/bad-der", "the encapsulated TSTInfo did not decode: " + ((e && e.message) || String(e)), e);
   }
+  if (nested.budget.exhausted()) {
+    throw new TspError("tsp/too-large", "the timeStampToken exceeds the decode budget for this parse");
+  }
   return { tstInfo: tstInfo.result, eContent: encap.eContent, signerInfo: signed.signerInfos[0], certificates: signed.certificates };
 }
 

package/lib/sign-scheme.js

@@ -6,6 +6,8 @@
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
 var pkcs8 = require("./schema-pkcs8");
+var pkix = require("./schema-pkix");
+var frameworkError = require("./framework-error");
 var webcrypto = require("./webcrypto");
 var subtle = webcrypto.webcrypto.subtle;
 var validator = require("./validator-all");
@@ -23,6 +25,7 @@ var _toUpperCase = intrinsic.toUpperCase;
 var _isBuffer = intrinsic.isBuffer;
 var _bufferFrom = intrinsic.bufferFrom;
 var _isU8 = intrinsic.types.isUint8Array;
+var _resolve = intrinsic.uncurry(intrinsic.promiseResolve);
 
 var HASH = intrinsic.assign(intrinsic.create(null), { sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" });
 var NODE_DIGEST = intrinsic.assign(intrinsic.create(null), { sha256: "sha256", sha384: "sha384", sha512: "sha512", shake128: "shake128", shake256: "shake256" });
@@ -98,7 +101,17 @@ function pssSpkiPinnedHash(cert, E) {
   return HASH[d];
 }
 
+/** @internal The SPKI the signature will be verified against travels on the scheme, because the
+ *  signer form declares a public key and the door has to hold it to the one the certificate names.
+ *  Attached here rather than on each return, so a new algorithm branch cannot omit it. */
 function resolveSignScheme(cert, so, noSignedAttrs, E) {
+  var scheme = _resolveSignScheme(cert, so, noSignedAttrs, E);
+  var spki = cert && cert.subjectPublicKeyInfo;
+  scheme.spki = (spki && spki.bytes) || null;
+  return scheme;
+}
+
+function _resolveSignScheme(cert, so, noSignedAttrs, E) {
   so = so || {};
   var alg = cert.subjectPublicKeyInfo.algorithm;
   var keyOid = alg.oid;
@@ -154,15 +167,16 @@ function resolveSignScheme(cert, so, noSignedAttrs, E) {
   throw E("unsupported-algorithm", "unsupported signer key algorithm " + keyOid);
 }
 
-function _assertKeyMatchesScheme(key, imp, E) {
+function _assertKeyMatchesScheme(key, imp, E, what) {
   var ka = key.algorithm || {};
+  var subject = what || "CryptoKey";
   if (_toUpperCase(_String(ka.name)) !== _toUpperCase(_String(imp.name))) {
     var hint = (_toUpperCase(_String(ka.name)) === "RSA-PSS" && _toUpperCase(_String(imp.name)) === "RSASSA-PKCS1-V1_5")
-      ? "; this CryptoKey is bound to RSASSA-PSS -- pass opts.pss to sign with RSASSA-PSS" : "";
-    throw E("bad-input", "the signer CryptoKey algorithm (" + ka.name + ") does not match the certificate's key algorithm (" + imp.name + ")" + hint);
+      ? "; this " + subject + " is bound to RSASSA-PSS -- pass opts.pss to sign with RSASSA-PSS" : "";
+    throw E("bad-input", "the signer " + subject + " algorithm (" + ka.name + ") does not match the certificate's key algorithm (" + imp.name + ")" + hint);
   }
-  if (imp.hash && (!ka.hash || ka.hash.name !== imp.hash)) throw E("bad-input", "the signer CryptoKey hash (" + (ka.hash && ka.hash.name) + ") does not match the signing digest (" + imp.hash + ")");
-  if (imp.namedCurve && ka.namedCurve !== imp.namedCurve) throw E("bad-input", "the signer CryptoKey curve (" + ka.namedCurve + ") does not match the certificate curve (" + imp.namedCurve + ")");
+  if (imp.hash && (!ka.hash || ka.hash.name !== imp.hash)) throw E("bad-input", "the signer " + subject + " hash (" + (ka.hash && ka.hash.name) + ") does not match the signing digest (" + imp.hash + ")");
+  if (imp.namedCurve && ka.namedCurve !== imp.namedCurve) throw E("bad-input", "the signer " + subject + " curve (" + ka.namedCurve + ") does not match the certificate curve (" + imp.namedCurve + ")");
 }
 /** @internal `owned`, when given, collects the copies this makes of the caller's key so the caller can
  * wipe them: a Buffer is viewed and stays the caller's, while a Uint8Array or a PEM string produces a
@@ -218,7 +232,105 @@ function _importKey(key, imp, E) {
   });
 }
 
+/** @internal The signer form, read ONCE. A caller's object is not asked the same question twice:
+ *  an accessor that answers differently on a second read would let the algorithm the door checked
+ *  differ from the one that signs, and the callback the door validated differ from the one it
+ *  calls. `sign` doubles as the discriminator, so the read that classifies is the read that runs. */
+function _snapshotSigner(key) {
+  if (!key || typeof key !== "object" || _isBuffer(key) || _isU8(key)) return null;   // allow:byte-source-narrow -- signer-form discrimination: a raw-key BufferSource is correctly classed as not a signer and normalized by _importKey
+  var sign = key.sign;
+  if (typeof sign !== "function") return null;
+  var algorithm = key.algorithm;
+  if (typeof algorithm === "string") algorithm = { name: algorithm };
+  var flat = null;
+  if (algorithm != null && typeof algorithm === "object") {
+    var hash = algorithm.hash;
+    var hashName = typeof hash === "string" ? hash : (hash == null ? undefined : hash.name);
+    flat = {
+      name: algorithm.name,
+      hash: hashName === undefined ? undefined : { name: hashName },
+      namedCurve: algorithm.namedCurve,
+    };
+  }
+  /** @internal `receiver` is the object this door was handed, so `sign` is called on it and plain
+   *  configuration read off `this` answers. A signing verb snapshots its options, so a client or a
+   *  counter a signer holds on itself is a copy by the time it arrives; a callback keeps those in
+   *  its closure instead, which is where the documented examples put them. */
+  return { sign: sign, receiver: key, algorithm: flat, publicKey: key.publicKey };
+}
+
+/** @internal An SPKI a signer declares, from the shapes a public key arrives in. */
+function _signerSpki(publicKey, E) {
+  if (typeof publicKey === "string") {
+    try { return pkix.pemDecode(publicKey, "PUBLIC KEY", frameworkError.PemError); }
+    catch (e) { throw E("bad-input", "the signer publicKey PEM could not be decoded", e); }
+  }
+  return guard.bytes.snapshotSource(publicKey, E, "bad-input", "the signer publicKey");
+}
+
+/** @internal The signature a signer returned, held to the contract the callback is documented
+ *  against: the bytes `subtle.sign` would return for this scheme. An ECDSA signature is the
+ *  fixed-width r||s of RFC 9053 sec. 2.1, and the DER SEQUENCE a token usually emits is named
+ *  rather than re-derived, because guessing which encoding arrived is how one gets converted twice. */
+function _assertSignerSignature(sig, scheme, E) {
+  if (!scheme.ecdsaDer) return sig;
+  var want = scheme.coordLen * 2;
+  if (sig.length === want) return sig;
+  if (sig.length > 1 && sig[0] === 0x30) {
+    throw E("bad-input", "the signer returned a DER SEQUENCE for an ECDSA signature; sign() returns the " +
+      want + "-byte r||s a WebCrypto signature carries (RFC 9053 sec. 2.1), and this toolkit encodes it");
+  }
+  throw E("bad-input", "the signer returned " + sig.length + " byte(s) for an ECDSA signature on this curve; " +
+    "sign() returns the " + want + "-byte r||s a WebCrypto signature carries (RFC 9053 sec. 2.1)");
+}
+
+function _signExternally(signer, scheme, signedBytes, E) {
+  if (scheme.composite) {
+    throw E("bad-input", "a composite " + scheme.composite.name + " signature is produced from both component private keys, " +
+      "which one sign() callback cannot do; pass { mldsa, trad } PKCS#8 keys");
+  }
+  if (signer.algorithm == null) throw E("bad-input", "a signer must declare the algorithm it signs with: { algorithm, publicKey, sign }");
+  if (signer.publicKey == null) throw E("bad-input", "a signer must declare its publicKey as SPKI DER, so the door can hold it to the key the signature is verified against");
+  _assertKeyMatchesScheme(signer, scheme.imp, E, "signer");
+  /** @internal The digest a scheme signs under is not always part of the key's import parameters:
+   *  an ECDSA key names only its curve, and the digest is chosen per signature. A signer declares
+   *  what it will do, so it is held to that here rather than after a remote signing request. */
+  var wantHash = scheme.sign && scheme.sign.hash;
+  if (wantHash && signer.algorithm.hash && signer.algorithm.hash.name !== wantHash) {
+    throw E("bad-input", "the signer algorithm hash (" + signer.algorithm.hash.name +
+      ") does not match the signing digest (" + wantHash + ")");
+  }
+  var declared = _signerSpki(signer.publicKey, E);
+  if (!scheme.spki) throw E("bad-input", "this signing path does not name the public key a signature is verified against, so a signer's publicKey cannot be held to it");
+  var named = guard.bytes.snapshotSource(scheme.spki, E, "bad-input", "the public key this signature is verified against");
+  if (!guard.crypto.constantTimeEqual(declared, named)) {
+    throw E("bad-input", "the signer publicKey is not the key this signature is verified against");
+  }
+  /** @internal The callback is handed a COPY, in an allocation of its own. It is a caller's
+   *  function over the bytes an artifact is built from, and a callback that rewrote them in place
+   *  would rewrite what is verified and what is emitted together, so the self-check would pass on
+   *  the rewritten artifact. `Buffer.from` is not enough: a small copy comes out of Node's shared
+   *  pool, whose backing ArrayBuffer the callback could reach the original through. */
+  var handed = new intrinsic.Uint8Array(signedBytes.length);
+  handed.set(signedBytes);
+  var produced;
+  try { produced = intrinsic.apply(signer.sign, signer.receiver, [handed]); }
+  catch (e) { throw E("bad-input", "the signer sign() callback failed", e); }
+  return _resolve(Promise, produced).then(function (raw) {
+    var sig = guard.bytes.snapshotSource(raw, E, "bad-input", "the signature the signer returned");
+    return _assertSignerSignature(sig, scheme, E);
+  }, function (e) {
+    throw E("bad-input", "the signer sign() callback failed", e);
+  });
+}
+
 function signOverTbs(scheme, key, signedBytes, E) {
+  var signer = _snapshotSigner(key);
+  if (signer) {
+    return _signExternally(signer, scheme, signedBytes, E).then(function (sig) {
+      return scheme.ecdsaDer ? validator.sig.rawToEcdsaDer(sig, scheme.coordLen) : sig;
+    });
+  }
   if (scheme.composite) {
     return compositeSig.compositeSign(scheme.composite, _normCompositeKeys(key, scheme.composite, E), signedBytes).then(function (sig) { return _bufferFrom(sig); });
   }

package/lib/x509-sign.js

@@ -366,8 +366,13 @@ function _hasCriticalSan(extSpec) {
  * `extensions` object. `issuer` is the signing side: `{ key }` alone issues a self-signed certificate
  * (issuer = subject, signed with the subject's own key); `{ name, publicKey, key }` or `{ cert, key }`
  * issues a CA-signed one. The signing key `key` is a WebCrypto `CryptoKey` (a `pki.key.generate`
- * private key passed directly, without exporting) or a PKCS#8 private key as DER (`Buffer`) or PEM
- * (`string`); a public or secret CryptoKey, or a `node:crypto` KeyObject, is refused. A `subjectAltName`
+ * private key passed directly, without exporting), a PKCS#8 private key as DER (`Buffer`) or PEM
+ * (`string`), or a signer `{ algorithm, publicKey, sign }` for a key this process cannot export,
+ * such as one in a hardware security module, a cloud key management service, a PKCS#11 token or a
+ * PIV slot. `sign(bytes)` returns the bytes WebCrypto would return for that algorithm, which for
+ * ECDSA is the fixed-width `r || s` of RFC 9053 sec. 2.1, and holds its client in its own closure,
+ * since this verb snapshots its options. A public or secret CryptoKey,
+ * or a `node:crypto` KeyObject, is refused. A `subjectAltName`
  * (or any `GeneralName`) entry may be a form object (`{ dNSName: "..." }`) or a bare string classified
  * fail-closed into its form (`"host.example"`, `"a@b.example"`, `"10.0.0.1"`, `"https://host.example/"`).
  * The signature algorithm is resolved from the signing key: RSA (PKCS#1 v1.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.3",
+  "version": "0.8.5",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:9e704e55-ccb2-4ecb-9370-04d6f58aa807",
+  "serialNumber": "urn:uuid:67dbc768-79f1-44d5-921c-53ce9accac3e",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-20T04:03:01.349Z",
+    "timestamp": "2026-09-20T07:17:13.483Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.3",
+      "bom-ref": "@blamejs/pki@0.8.5",
       "type": "application",
       "name": "pki",
-      "version": "0.8.3",
+      "version": "0.8.5",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.3",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.5",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.3",
+      "ref": "@blamejs/pki@0.8.5",
       "dependsOn": []
     }
   ]