@blamejs/pki 0.5.22 → 0.5.24

package/lib/trust.js

@@ -40,6 +40,10 @@ var constants = require("./constants");
 var errors = require("./framework-error");
 var asn1 = require("./asn1-der");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
+// Own-key membership through an operation taken at load. Written out, the question reads two
+// replaceable properties to answer one thing, and here it decides which trust bits an anchor carries.
+var _hasOwn = intrinsic.hasOwn;
 var x509 = require("./schema-x509");
 
 var TrustError = errors.TrustError;
@@ -604,7 +608,7 @@ function _trustBits(cell) {
     var t = tok.trim();
     if (t === "") return;
     var l = t.toLowerCase();
-    if (!Object.prototype.hasOwnProperty.call(_TRUST_BIT_TOKENS, l)) {
+    if (!_hasOwn(_TRUST_BIT_TOKENS, l)) {
       throw E("trust/bad-csv", "unrecognized Trust Bits token " + JSON.stringify(t));
     }
     var p = _TRUST_BIT_TOKENS[l];

package/lib/webauthn-mds.js

@@ -22,6 +22,10 @@
 var frameworkError = require("./framework-error");
 var x509 = require("./schema-x509");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
+// Own-key membership through an operation taken at load. Written out, the question reads two
+// replaceable properties to answer one thing, and here it decides which status rows an entry carries.
+var _hasOwn = intrinsic.hasOwn;
 var jose = require("./jose");
 var rfc3339 = require("./rfc3339");
 var constants = require("./constants");
@@ -348,7 +352,7 @@ function _verifyMetadataBlob(blob, opts) {
   // reader that skips the list accepts a token on terms it never met. Nothing here processes an
   // extension parameter, so any name is unprocessed, including a standard name, which sec. 4.1.11
   // forbids listing at all.
-  if (Object.prototype.hasOwnProperty.call(header, "crit")) {
+  if (_hasOwn(header, "crit")) {
     var crit = header.crit;
     if (!Array.isArray(crit) || crit.length === 0) {
       throw _err("webauthn/bad-metadata-blob", "the metadata BLOB header crit must be a non-empty array (RFC 7515 sec. 4.1.11)");

package/lib/webauthn.js

@@ -34,6 +34,10 @@ var constants = require("./constants");
 var validator = require("./validator-all");
 var edwardsPoint = require("./edwards-point");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
+// Own-key membership through an operation taken at load: written out it reads two replaceable
+// properties to answer one question, and either answering true admits a name the table never had.
+var _hasOwn = intrinsic.hasOwn;
 var jose = require("./jose");
 var mds = require("./webauthn-mds");
 var nodeCrypto = require("crypto");
@@ -2220,7 +2224,7 @@ function _snapshotAssertion(input) {
   if (!_isPlainObject(input)) throw _err("webauthn/bad-input", "pki.webauthn.verifyAssertion takes an options object");
   guard.identifier.assertKnownKeys(input, _ASSERT_OPTS, _err, "webauthn/bad-input", "verifyAssertion input has an unknown key ");
   var out = {}, k;
-  for (k in input) { if (Object.prototype.hasOwnProperty.call(input, k)) out[k] = input[k]; }
+  for (k in input) { if (_hasOwn(input, k)) out[k] = input[k]; }
   // The SAME set of byte forms the arguments accept. A snapshot list narrower than the accept list
   // leaves whatever falls in the gap aliased across the yield -- which is the one input a widened
   // accept list newly admits, so the two must be written from one predicate.
@@ -2237,7 +2241,7 @@ function _snapshotAssertion(input) {
   } else if (_isPlainObject(out.credentialPublicKey)) {
     var key = {}, kk;
     for (kk in out.credentialPublicKey) {
-      if (!Object.prototype.hasOwnProperty.call(out.credentialPublicKey, kk)) continue;
+      if (!_hasOwn(out.credentialPublicKey, kk)) continue;
       // The read itself can fault: a stored key is a caller-supplied object, so a field may be an
       // accessor, and one that THROWS would escape as a raw error from the very copy whose job is
       // to make the descriptor stop being the caller's. The copy is the boundary, so the fault is

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.5.22",
+  "version": "0.5.24",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3735feb6-6447-4894-953a-28811d47f2c0",
+  "serialNumber": "urn:uuid:1d864685-81db-45d8-92b0-ef5b74906999",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-21T03:44:09.554Z",
+    "timestamp": "2026-08-21T11:03:39.559Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.5.22",
+      "bom-ref": "@blamejs/pki@0.5.24",
       "type": "application",
       "name": "pki",
-      "version": "0.5.22",
+      "version": "0.5.24",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.5.22",
+      "purl": "pkg:npm/%40blamejs/pki@0.5.24",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.5.22",
+      "ref": "@blamejs/pki@0.5.24",
       "dependsOn": []
     }
   ]