@blamejs/pki 0.8.31 → 0.8.49

package/lib/x509-sign.js

@@ -22,7 +22,12 @@ var x509 = require("./schema-x509");
 var signScheme = require("./sign-scheme");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
-var _isArray = intrinsic.isArray, _bufferEquals = intrinsic.bufferEquals;
+var _isArray = intrinsic.isArray, _bufferEquals = intrinsic.bufferEquals, _isBuffer = intrinsic.isBuffer;
+var _arrSlice = intrinsic.arraySlice, _promiseResolve = intrinsic.uncurry(intrinsic.promiseResolve);
+/** @internal The RECEIVER for the captured `Promise.resolve`, captured too. `resolve` builds through
+ *  its receiver, so handing it the live `globalThis.Promise` put the capture back under a constructor a
+ *  replacement could take over and decide what the awaited value became. */
+var _Promise = intrinsic.Promise;
 var _dnCharCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 var _dnKeys = intrinsic.keys;
 var _dnHasOwn = intrinsic.hasOwn;
@@ -31,6 +36,7 @@ var schema = require("./schema-engine");
 var pkix = require("./schema-pkix");
 var pkiBuild = require("./pki-build");
 var ct = require("./ct");
+var relatedCert = require("./related-cert");
 var lint = require("./lint");
 
 var CertificateError = frameworkError.CertificateError;
@@ -46,8 +52,11 @@ function O(n) { return oid.byName(n); }
 var KNOWN_SPEC_KEYS = intrinsic.assign(intrinsic.create(null), {
   subject: 1, subjectPublicKey: 1, notBefore: 1, notAfter: 1, serialNumber: 1, extensions: 1,
 });
-var KNOWN_ISSUER_CERT_KEYS = intrinsic.assign(intrinsic.create(null), { key: 1, cert: 1 });
-var KNOWN_ISSUER_EXPLICIT_KEYS = intrinsic.assign(intrinsic.create(null), { key: 1, name: 1, publicKey: 1 });
+/** @internal `altKey` and `altPublicKey` are the issuer's ALTERNATIVE signing key and its public half,
+ *  for an ITU-T X.509 (2019) clause 9.8 certificate. They appear in both issuer forms because the
+ *  alternative key is the issuer's own and is unrelated to how the native issuer was named. */
+var KNOWN_ISSUER_CERT_KEYS = intrinsic.assign(intrinsic.create(null), { key: 1, cert: 1, altKey: 1, altPublicKey: 1 });
+var KNOWN_ISSUER_EXPLICIT_KEYS = intrinsic.assign(intrinsic.create(null), { key: 1, name: 1, publicKey: 1, altKey: 1, altPublicKey: 1 });
 var KNOWN_SIGN_OPTS = intrinsic.assign(intrinsic.create(null), { digestAlgorithm: 1, pem: 1, pss: 1, profile: 1 });
 
 /** @internal The signature the build-time gate lints against, standing in for one that does not exist
@@ -66,6 +75,11 @@ var KNOWN_EXT_KEYS = intrinsic.assign(intrinsic.create(null), {
   msCertificateTemplate: 1, msEnrollCertType: 1, msCaVersion: 1, msPreviousCertHash: 1,
   msApplicationPolicies: 1,
   subjectInfoAccess: 1, subjectDirectoryAttributes: 1, ocspNoCheck: 1,
+  relatedCertificate: 1,
+  /** @internal The clause 9.8 alternative set. `altSignatureAlgorithm` and `altSignatureValue` are
+   *  accepted as names so a caller that supplies either is told they are resolved and computed here,
+   *  rather than being told the name is unknown. */
+  subjectAltPublicKeyInfo: 1, altSignatureAlgorithm: 1, altSignatureValue: 1,
 });
 
 var _b = pkiBuild.makeBuilder({ ErrorClass: CertificateError, prefix: "x509", O: O, NS: NS, NAME_SCHEMA: NAME_SCHEMA, SPKI_SCHEMA: SPKI_SCHEMA, EXT_DECODERS: EXT_DECODERS });
@@ -73,6 +87,7 @@ var _encodeName = _b.encodeName, _isEmptyName = _b.isEmptyName, _reqDer = _b.req
   _assertValidSpki = _b.assertValidSpki, _assertValidExtension = _b.assertValidExtension,
   _assertCertCriticality = _b.assertCertCriticality,
   _certLikeFromSpki = _b.certLikeFromSpki, _assertCertVerifies = _b.assertSignatureVerifies,
+  _altPublicKeyValueOf = _b.altPublicKeyValueOf,
   _ext = _b.ext, _extBasicConstraints = _b.extBasicConstraints, _validateBcSpec = _b.validateBcSpec,
   _extKeyUsage = _b.extKeyUsage, _extExtKeyUsage = _b.extExtKeyUsage, _extSki = _b.extSki,
   _extNameConstraints = _b.extNameConstraints, _extAia = _b.extAuthorityInfoAccess,
@@ -135,12 +150,26 @@ function _akiFields(val, ctx) {
   return [keyId, issuerName == null ? null : issuerName, serial == null ? null : serial];
 }
 
+/** @internal The extensions this verb owns the value of, so a caller never supplies them pre-encoded. */
+var RESERVED_ALT_EXTS = intrinsic.assign(intrinsic.create(null), (function () {
+  var o = intrinsic.create(null);
+  o[O("altSignatureValue")] = 1;
+  o[O("altSignatureAlgorithm")] = 1;
+  o[O("subjectAltPublicKeyInfo")] = 1;
+  return o;
+})());
+
 function _buildExtensions(extSpec, ctx) {
   if (extSpec == null) extSpec = {};
   if (_isArray(extSpec)) {
     var seenExt = intrinsic.create(null), arrCa = false, arrKeyCertSign = false, arrPathLen = false, arrNameConstraints = false;
     var oidBc = O("basicConstraints"), oidKu = O("keyUsage"), oidNc = O("nameConstraints"), oidPm = O("policyMappings");
-    var arr = extSpec.map(function (e, i) {
+    /** @internal The walk goes through `guard.list.copyMap`, never the caller's own `map`. Reached off
+     *  the array a caller supplied, `map` is that caller's to replace: one returning extension DER the
+     *  callback below never saw bypassed every per-element rule at once, the duplicate check, the
+     *  criticality rule, the value decoders and the alternative-signature refusal among them, and the
+     *  verb then emitted and natively signed a certificate carrying extensions nothing had validated. */
+    var arr = guard.list.copyMap(extSpec, function (e, i) {
       var der = _reqDer(e, "extension");
       _assertValidExtension(der, i, EXT_DECODERS);
       var n = asn1.decode(der);
@@ -164,6 +193,22 @@ function _buildExtensions(extSpec, ctx) {
         else if (extnId === oidKu) { arrKeyCertSign = decoded.keyCertSign === true; }
         else if (extnId === oidPm) { _assertNoAnyPolicyMapping(decoded); }
       }
+      /** @internal The three alternative-signature extensions are refused HERE as well as in the object
+       *  form below, and AFTER the decode above so a malformed value is still reported as one. The
+       *  object form's guards were the only ones, so the pre-encoded array reached none of them: a
+       *  caller could supply `altSignatureValue` and `altSignatureAlgorithm` outright, and the verb then
+       *  emitted and natively signed a certificate carrying an alternative signature it never computed
+       *  or self-checked, which `pki.altSig.verify` refuses for the migrated client the extension exists
+       *  for. `subjectAltPublicKeyInfo` is refused in this form rather than honored: clause 7.2.2 has
+       *  all three travel together, the alternative signing side reads the subject key off the OBJECT
+       *  form only, and a certificate carrying the subject's alternative key with no alternative
+       *  signature has an alternative half nothing can verify. */
+      if (_dnHasOwn(RESERVED_ALT_EXTS, extnId)) {
+        throw _err("x509/bad-input", (oid.name(extnId) || extnId) + " is not supplied as a pre-encoded " +
+          "extension: this verb computes the alternative signature and resolves its algorithm from " +
+          "issuer.altKey, and clause 7.2.2 emits all three together. Pass issuer.altKey with the " +
+          "object form of spec.extensions instead (ITU-T X.509 (2019) clause 7.2.2).");
+      }
       return b.raw(der);
     });
     if (arrKeyCertSign && !arrCa) throw _err("x509/bad-input", "keyUsage keyCertSign requires basicConstraints cA=TRUE (RFC 5280 sec. 4.2.1.3)");
@@ -273,9 +318,122 @@ function _buildExtensions(extSpec, ctx) {
     if (extSpec.ocspNoCheck !== true) throw _err("x509/bad-input", "ocspNoCheck is a flag, so it is true or omitted");
     guard.list.append(out, _ext(O("ocspNoCheck"), false, asn1.build.nullValue()));
   }
+  /** @internal RFC 9763 sec. 4.1 names a second certificate of the same subject by the digest of the
+   *  whole certificate, and the section says the extension SHOULD NOT be marked critical, so it is
+   *  emitted non-critical with no option to mark it. */
+  if (extSpec.relatedCertificate != null) guard.list.append(out, _ext(O("relatedCertificate"), false, _relatedCertificate(extSpec.relatedCertificate)));
+  /** @internal ITU-T X.509 (2019) clause 9.8.2. The subject's alternative public key, and the algorithm
+   *  identifier of the issuer's alternative signature beside it: clause 7.2.2 requires all three of the
+   *  alternative extensions together, and the third is filled in by the signing pass below because its
+   *  value is a signature over these two. The NOTEs in clauses 9.8.2 and 9.8.3 recommend non-critical
+   *  and the clauses permit either, so these are emitted non-critical and there is no option to mark
+   *  them: marking them would require every relying party to understand the alternative algorithm. */
+  if (ctx.altSigAlgId != null) {
+    guard.list.append(out, _ext(O("subjectAltPublicKeyInfo"), false, b.raw(ctx.subjectAltSpki)));
+    guard.list.append(out, _ext(O("altSignatureAlgorithm"), false, b.raw(ctx.altSigAlgId)));
+  }
   return out;
 }
 
+var KNOWN_ALT_ISSUER_KEYS = intrinsic.assign(intrinsic.create(null), { altKey: 1, altPublicKey: 1 });
+/** @internal The alternative signing side of clause 9.8, resolved before any signing happens. All three
+ *  extensions travel together (clause 7.2.2), so a subject alternative key without an issuer
+ *  alternative key is refused and so is the reverse: either alone emits a certificate whose alternative
+ *  half cannot be verified. `altSignatureValue` is never a caller's to supply, because its value is a
+ *  signature this verb computes and a supplied one would be emitted unchecked. */
+function _resolveAltSigning(issuer, extSpec, issuerCert, selfSigned) {
+  var subjectAltRaw = (extSpec != null && !_isArray(extSpec)) ? extSpec.subjectAltPublicKeyInfo : null;
+  var hasAltKey = issuer.altKey != null;
+  if (extSpec != null && !_isArray(extSpec) && extSpec.altSignatureValue != null) {
+    throw _err("x509/bad-input", "altSignatureValue is computed by this verb from the alternative signing key, so it is not supplied (ITU-T X.509 (2019) clause 7.2.2)");
+  }
+  if (extSpec != null && !_isArray(extSpec) && extSpec.altSignatureAlgorithm != null) {
+    throw _err("x509/bad-input", "altSignatureAlgorithm is resolved from the alternative signing key, so it is not supplied (ITU-T X.509 (2019) clause 9.8.3)");
+  }
+  /** @internal An `altPublicKey` with no `altKey` is refused rather than passed over. Returning null on
+   *  the pair of absences read `altPublicKey` as absent too, so an issuer that supplied it and omitted
+   *  the private half got an ordinary certificate and no indication that the alternative signature it
+   *  asked for was never made. `pki.crl.sign` refuses the same pair, and a configuration assembled a
+   *  field at a time is exactly where the omission happens. */
+  if (subjectAltRaw == null && !hasAltKey) {
+    if (issuer.altPublicKey != null) {
+      throw _err("x509/bad-input", "issuer.altPublicKey needs issuer.altKey to sign the alternative signature with (ITU-T X.509 (2019) clause 7.2.2)");
+    }
+    return null;
+  }
+  if (subjectAltRaw == null) {
+    throw _err("x509/bad-input", "an issuer altKey needs extensions.subjectAltPublicKeyInfo: clause 7.2.2 requires all three alternative extensions together");
+  }
+  if (!hasAltKey) {
+    throw _err("x509/bad-input", "extensions.subjectAltPublicKeyInfo needs an issuer altKey to sign the alternative signature with (ITU-T X.509 (2019) clause 7.2.2)");
+  }
+  guard.identifier.assertKnownKeys({ altKey: issuer.altKey, altPublicKey: issuer.altPublicKey },
+    KNOWN_ALT_ISSUER_KEYS, _err, "x509/bad-input", "unknown alternative issuer field: ");
+  var subjectAltSpki = _reqDer(subjectAltRaw, "extensions.subjectAltPublicKeyInfo (the subject's alternative SPKI DER)");
+  _assertValidSpki(subjectAltSpki, "extensions.subjectAltPublicKeyInfo");
+  if (issuer.altPublicKey == null) {
+    throw _err("x509/bad-input", "an issuer altKey needs issuer.altPublicKey, the SPKI of its public half, to resolve the alternative signature algorithm");
+  }
+  var issuerAltSpki = _reqDer(issuer.altPublicKey, "issuer.altPublicKey (the issuer's alternative SPKI DER)");
+  _assertValidSpki(issuerAltSpki, "issuer.altPublicKey");
+  /** @internal Bound to the issuer, the way the native signature already is: its key is read OUT of
+   *  issuer.cert, while this one arrives beside the certificate, so nothing otherwise stops a CA signing
+   *  with a second alternative pair. Clause 9.8.4 has a relying party check an alternative signature with
+   *  the issuer's alternative public key, meaning the one the issuer's own certificate publishes, so a
+   *  signature made with any other key verifies for nobody and the certificate is unusable on the half it
+   *  was issued for. A self-signed certificate publishes its own alternative key in the extension it is
+   *  being given, so that is what it is held to. */
+  if (issuerCert !== null && issuerCert !== undefined) {
+    var published = _altPublicKeyValueOf(issuerCert);
+    if (published === null) {
+      throw _err("x509/bad-input",
+        "issuer.cert publishes no subjectAltPublicKeyInfo, so it names no alternative key for a relying party to check an alternative signature with (ITU-T X.509 (2019) clause 9.8.4)");
+    }
+    if (!_bufferEquals(published, issuerAltSpki)) {
+      throw _err("x509/bad-input",
+        "issuer.altPublicKey is not the alternative key issuer.cert publishes in its subjectAltPublicKeyInfo, so the alternative signature would verify under no key a relying party can find (ITU-T X.509 (2019) clause 9.8.4)");
+    }
+  } else if (selfSigned === true && !_bufferEquals(subjectAltSpki, issuerAltSpki)) {
+    throw _err("x509/bad-input",
+      "a self-signed certificate publishes its own alternative key, so issuer.altPublicKey must be extensions.subjectAltPublicKeyInfo");
+  }
+  var altScheme = signScheme.resolveSignScheme(_certLikeFromSpki(issuerAltSpki), { combinedRsaSig: true }, true, _signE);
+  return { subjectAltSpki: subjectAltSpki, issuerAltSpki: issuerAltSpki, scheme: altScheme, altSigAlgId: altScheme.sigAlgId };
+}
+
+var KNOWN_RELATED_CERTIFICATE_KEYS = intrinsic.assign(intrinsic.create(null), { hashAlgorithm: 1, hashValue: 1, relatedCertificate: 1 });
+/** @internal RelatedCertificate ::= SEQUENCE { hashAlgorithm DigestAlgorithmIdentifier,
+ *  hashValue OCTET STRING } (RFC 9763 sec. 4.1). `relatedCertificate` hands over the certificate and
+ *  the digest is computed here, which is the form that cannot name one algorithm while carrying the
+ *  output of another; `hashAlgorithm` + `hashValue` carries a digest already computed elsewhere. Both
+ *  at once is refused, since the two can disagree and only one of them would be emitted. */
+function _relatedCertificate(spec) {
+  if (spec === null || typeof spec !== "object" || _isBuffer(spec) || _isArray(spec)) {
+    throw _err("x509/bad-input", "relatedCertificate must be an object { relatedCertificate } or { hashAlgorithm, hashValue }");
+  }
+  guard.identifier.assertKnownKeys(spec, KNOWN_RELATED_CERTIFICATE_KEYS, _err, "x509/bad-input", "relatedCertificate has an unknown field: ");
+  var hasCert = spec.relatedCertificate != null, hasValue = spec.hashValue != null;
+  if (hasCert && hasValue) {
+    throw _err("x509/bad-input", "relatedCertificate takes either the related certificate to hash or a hashValue already computed, not both");
+  }
+  var value;
+  if (hasCert) {
+    try { value = relatedCert.certificateHash(spec.relatedCertificate, spec.hashAlgorithm); }
+    catch (e) { throw _err("x509/bad-input", "relatedCertificate: " + ((e && e.message) || intrinsic.String(e)), e); }
+  } else {
+    if (!hasValue) throw _err("x509/bad-input", "relatedCertificate needs either the related certificate to hash or a hashAlgorithm with a hashValue");
+    if (spec.hashAlgorithm == null) throw _err("x509/bad-input", "relatedCertificate hashValue must be accompanied by the hashAlgorithm that produced it");
+    var bytes = _reqDer(spec.hashValue, "relatedCertificate hashValue");
+    /** @internal Routed through the same reader that holds a parsed value to its algorithm's length,
+     *  so a digest this build emits and a digest it reads back are held to one rule. */
+    try { value = relatedCert.digestValue(spec.hashAlgorithm, bytes); }
+    catch (e) { throw _err("x509/bad-input", "relatedCertificate: " + ((e && e.message) || intrinsic.String(e)), e); }
+  }
+  var algOid = O(value.hashAlgorithm);
+  if (!algOid) throw _err("x509/bad-input", "relatedCertificate hashAlgorithm " + value.hashAlgorithm + " has no registered OID");
+  return asn1.build.sequence([asn1.build.sequence([asn1.build.oid(algOid)]), asn1.build.octetString(value.hashValue)]);
+}
+
 
 /** @internal RFC 6962 sec. 3.1 and sec. 3.2 put these at the two ends of one exchange: the poison
  *  names the precertificate submitted to a log, and the SCT list names the certificate issued once
@@ -589,7 +747,13 @@ function _sign(spec, issuer, opts) {
     _err, "x509/bad-input", "issuer/subject DN");
   var selfSignedCert = selfIssued && _b.samePublicKey(issuerSpki, spki);
   var extSpec = spec.extensions;
-  var exts = _buildExtensions(extSpec, { spki: spki, issuerSpki: issuerSpki, issuerCert: issuerCert, subjectEmpty: subjectEmpty, selfSigned: selfSignedCert });
+  /** @internal `selfSignedCert`, not `selfSigned`: a root is self-signed whether the caller omits the
+   *  issuer or names one whose name and key are the subject's, and the alternative-key binding applies to
+   *  both. `selfSigned` is only the omitted form, and it is what the extension builder already passes
+   *  `selfSignedCert` for the same reason. */
+  var alt = _resolveAltSigning(issuer, extSpec, issuerCert, selfSignedCert);
+  var exts = _buildExtensions(extSpec, { spki: spki, issuerSpki: issuerSpki, issuerCert: issuerCert, subjectEmpty: subjectEmpty, selfSigned: selfSignedCert,
+    altSigAlgId: alt === null ? null : alt.altSigAlgId, subjectAltSpki: alt === null ? null : alt.subjectAltSpki });
   if (subjectEmpty && !_hasCriticalSan(extSpec)) {
     throw _err("x509/bad-input", "an empty subject requires a critical subjectAltName (RFC 5280 sec. 4.1.2.6)");
   }
@@ -602,22 +766,63 @@ function _sign(spec, issuer, opts) {
   }
   var version = exts.length ? 3 : 1;
 
-  var tbsChildren = [];
-  if (version !== 1) tbsChildren.push(b.explicit(0, b.integer(BigInt(version - 1))));
-  tbsChildren.push(serialTlv);
-  tbsChildren.push(scheme.sigAlgId);
-  tbsChildren.push(issuerDer);
-  tbsChildren.push(validityDer);
-  tbsChildren.push(subjectDer);
-  tbsChildren.push(b.raw(spki));
-  if (exts.length) tbsChildren.push(b.explicit(3, b.sequence(exts)));
-  var tbsDer = b.sequence(tbsChildren);
-  lint.assertBuildClean("certificate",
-    b.sequence([tbsDer, scheme.sigAlgId, b.bitString(GATE_PLACEHOLDER_SIG, 0)]),
-    opts.profile, _err, "x509/profile-violation");
+  /** @internal The tbsCertificate over a given extension list, so the two passes an alternative
+   *  signature needs build it the same way rather than twice. `omitSignatureAlg` drops the `signature`
+   *  AlgorithmIdentifier, which turns the TBSCertificate into the PreTBSCertificate the alternative
+   *  signature covers (draft-truskovsky-lamps-pq-hybrid-x509 sec. 4). */
+  function tbsOver(extList, omitSignatureAlg) {
+    var tbsChildren = [];
+    if (version !== 1) tbsChildren.push(b.explicit(0, b.integer(BigInt(version - 1))));
+    tbsChildren.push(serialTlv);
+    if (omitSignatureAlg !== true) tbsChildren.push(scheme.sigAlgId);
+    tbsChildren.push(issuerDer);
+    tbsChildren.push(validityDer);
+    tbsChildren.push(subjectDer);
+    tbsChildren.push(b.raw(spki));
+    if (extList.length) tbsChildren.push(b.explicit(3, b.sequence(extList)));
+    return b.sequence(tbsChildren);
+  }
 
+  /** @internal Clause 7.2.2 fixes the order: the alternative signature is generated first, over the
+   *  PreTBSCertificate, which carries neither it nor the `signature` AlgorithmIdentifier, and the native
+   *  signature then covers the tbsCertificate WITH both. Doing it the other way round leaves a native
+   *  signature that does not cover the alternative one, which is the ordering error the two-pass exists
+   *  to make impossible. draft-truskovsky-lamps-pq-hybrid-x509 sec. 4.1 adds the `signature` field in
+   *  step (d), after the alternative signature of step (b), which is why it is absent here. */
+  /** @internal The alternative signature is self-checked against issuer.altPublicKey before it is
+   *  embedded, the same gate the native pass applies to its own signature. Without it an altKey and an
+   *  altPublicKey that are different keys of one algorithm both resolve to the same scheme, so signing
+   *  succeeds and what ships is a certificate whose alternative signature does not verify under the
+   *  alternative key its own issuer names. */
+  var altFirst;
+  if (alt === null) {
+    altFirst = _promiseResolve(_Promise, null);
+  } else {
+    var altPreimage = tbsOver(exts, true);
+    altFirst = signScheme.signOverTbs(alt.scheme, issuer.altKey, altPreimage, _signE)
+      .then(function (altSigBytes) {
+        return _promiseResolve(_Promise,
+          _assertCertVerifies(altPreimage, altSigBytes, alt.issuerAltSpki, alt.scheme)
+        ).then(function () { return altSigBytes; });
+      });
+  }
+
+  return altFirst.then(function (altSigBytes) {
+    var finalExts = exts;
+    if (alt !== null) {
+      finalExts = _arrSlice(exts);
+      guard.list.append(finalExts, _ext(O("altSignatureValue"), false, b.bitString(altSigBytes, 0)));
+    }
+    var tbsDer = tbsOver(finalExts);
+    lint.assertBuildClean("certificate",
+      b.sequence([tbsDer, scheme.sigAlgId, b.bitString(GATE_PLACEHOLDER_SIG, 0)]),
+      opts.profile, _err, "x509/profile-violation");
+    return _signNative(tbsDer);
+  });
+
+  function _signNative(tbsDer) {
   return signScheme.signOverTbs(scheme, issuer.key, tbsDer, _signE).then(function (sig) {
-    return Promise.resolve(_assertCertVerifies(tbsDer, sig, issuerSpki, scheme)).then(function () {
+    return _promiseResolve(_Promise, _assertCertVerifies(tbsDer, sig, issuerSpki, scheme)).then(function () {
       var certDer = b.sequence([tbsDer, scheme.sigAlgId, b.bitString(sig, 0)]);
       return opts.pem ? x509.pemEncode(certDer, "CERTIFICATE") : certDer;
     });
@@ -625,6 +830,7 @@ function _sign(spec, issuer, opts) {
     if (e instanceof CertificateError) throw e;
     throw _err("x509/bad-input", "signing the certificate failed -- the signing key does not match the resolved algorithm or is invalid", e);
   });
+  }
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.31",
+  "version": "0.8.49",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",
@@ -57,6 +57,7 @@
     "index.js",
     "bin/",
     "lib/",
+    "examples/*.js",
     "CHANGELOG.md",
     "LICENSE",
     "MIGRATING.md",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:ea5fc812-c57e-4508-9ef7-3dc7126381e6",
+  "serialNumber": "urn:uuid:850d86e8-9f55-4854-9b3a-89ed4e16dfd5",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-29T06:11:34.254Z",
+    "timestamp": "2026-10-05T08:10:11.062Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.31",
+      "bom-ref": "@blamejs/pki@0.8.49",
       "type": "application",
       "name": "pki",
-      "version": "0.8.31",
+      "version": "0.8.49",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.31",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.49",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.31",
+      "ref": "@blamejs/pki@0.8.49",
       "dependsOn": []
     }
   ]