@blamejs/pki 0.5.32 → 0.5.34

package/lib/guard-bytes.js

@@ -27,6 +27,8 @@ var _bufferFrom = intrinsic.bufferFrom;
 // question this guard asked on the caller's behalf. See guard-intrinsic for the whole set.
 var _isView = intrinsic.isView;
 var _isBuffer = intrinsic.isBuffer;
+var _asyncIterator = intrinsic.asyncIterator;
+var _NO_ARGS = intrinsic.freeze([]);
 var _create = intrinsic.create;
 var _getPrototypeOf = intrinsic.getPrototypeOf;
 var _getOwnPropertyDescriptor = intrinsic.getOwnPropertyDescriptor;
@@ -80,6 +82,35 @@ function isByteSource(x) {
   return _isBuffer(x) || _isView(x) || _isArrayBuffer(x);
 }
 
+// asyncStreamOf(x) -> a LAZY single-use async iterable of x's byte chunks, or null when x is not a
+// byte stream.
+//
+// A door offering both a byte source and a streamed content (an async iterable of byte chunks) asks
+// this ONE module which it has, instead of re-inlining the `for await` protocol test and drifting on
+// what counts. It reads x's Symbol.asyncIterator EXACTLY ONCE, captures that method, and returns a
+// thin iterable that CALLS it only when the consumer drives the stream. Deferring the call matters
+// twice: the underlying iterator is acquired once, in the digest engine, so reading the protocol
+// property a second time downstream cannot fire a one-shot or stateful accessor and refuse a stream a
+// direct `for await` accepts; AND a caller whose iterator factory opens a file or socket has that
+// resource opened only on a path that will actually consume it, never on a pre-hash rejection (a
+// missing detached option, an empty signer list, a message needing no streamed digest) that would
+// otherwise acquire and leak it. A byte source is bytes, never a stream, EVEN when a caller attached a
+// Symbol.asyncIterator to it: the byte-source classification wins and is checked FIRST, so a Buffer /
+// typed array / DataView goes down the byte path every time and its own accessors are never invoked
+// here. A callable carrying the method is a valid async iterable that `for await` consumes, so it too
+// yields a stream.
+// @enforced-by behavioral -- a lazy stream wrapper has no rename-proof code shape; the RED vectors (a
+// stream produced where a byte source is not, a one-shot-accessor stream still consumed, and the
+// factory NOT invoked until the stream is driven) are the guard.
+function asyncStreamOf(x) {
+  if (isByteSource(x) || x == null || (typeof x !== "object" && typeof x !== "function")) return null;
+  var acquire = x[_asyncIterator];
+  if (typeof acquire !== "function") return null;
+  var stream = {};
+  stream[_asyncIterator] = function () { return _apply(acquire, x, _NO_ARGS); };
+  return stream;
+}
+
 // Is this value a byte store, asked of the internal slot rather than the prototype?
 //
 // `v instanceof ArrayBuffer` answers what a value inherits from, which is a different question
@@ -1057,6 +1088,6 @@ function fixedCall(ErrorClass, code, args, body) {
 // call, so a writable export would let a caller replace the check rather than pass it.
 module.exports = intrinsic.freeze({
   view: view, source: source, snapshot: snapshot, snapshotSource: snapshotSource,
-  isByteSource: isByteSource, lengthOf: lengthOf, outputView: outputView,
+  isByteSource: isByteSource, asyncStreamOf: asyncStreamOf, lengthOf: lengthOf, outputView: outputView,
   snapshotDeep: snapshotDeep, fixArguments: fixArguments, fixedCall: fixedCall,
 });

package/lib/guard-intrinsic.js

@@ -59,6 +59,10 @@ var _bufferCompare = Buffer.compare;
 // response is about this issuer, a responder ID says this key signed it. Dispatched live, one
 // answering true makes a response about a DIFFERENT certificate match the one being asked about.
 var _bufferEquals = uncurry(Buffer.prototype.equals);
+// Buffer#toString, uncurried at load. Used to build dedup keys (a hex string) from bytes the toolkit
+// owns; dispatched live, a replaced toString could make two distinct values key alike or one value key
+// differently on two reads, so a dedup over untrusted-adjacent bytes would merge or split wrongly.
+var _bufferToString = uncurry(Buffer.prototype.toString);
 
 // The rest of what a guard reads from the runtime while it is deciding something. These are
 // grouped here rather than captured file by file so the set is enumerable in one place and a guard
@@ -94,6 +98,13 @@ var _mathMax = Math.max;
 var _parseInt = parseInt;
 var _promiseResolve = Promise.resolve;
 var _promiseReject = Promise.reject;
+// The well-known async-iteration symbol, captured at load. `for await` uses this symbol at the
+// language level regardless of the global `Symbol` object, so a classifier that reads
+// `Symbol.asyncIterator` live would disagree with the loop the moment a co-resident replaced the
+// writable `Symbol` global: a real async iterable would be looked up under the wrong key, judged not
+// iterable, and refused where the engine would have consumed it. Reading the captured symbol keeps
+// the door's answer and the loop's behavior the same.
+var _asyncIterator = Symbol.asyncIterator;
 
 // The array operations, uncurried at load. These run on arrays the TOOLKIT owns -- an `ownKeys`
 // result, a local accumulator -- so the receiver is never a caller's object; what is caller-
@@ -274,6 +285,7 @@ module.exports = Object.freeze({
   bufferFrom: _bufferFrom,
   bufferAlloc: _bufferAlloc,
   bufferConcat: _bufferConcat,
+  bufToString: _bufferToString,
   isBuffer: _bufferIsBuffer,
   byteLength: _bufferByteLength,
   compare: _bufferCompare,
@@ -309,6 +321,7 @@ module.exports = Object.freeze({
   bigIntToString: _bigIntToString,
   promiseResolve: _promiseResolve,
   promiseReject: _promiseReject,
+  asyncIterator: _asyncIterator,
   forEach: _arrForEach,
   map: _arrMap,
   filter: _arrFilter,

package/lib/pki-build.js

@@ -70,7 +70,8 @@ function _isSubDelim(c) {
 function _isUserinfoByte(c) { return _isUnreserved(c) || _isSubDelim(c) || c === 58; }
 // A path/query/fragment byte: unreserved / sub-delim / a non-bracket gen-delim (":" "/" "?" "#" "@").
 // "%" is handled separately (it must open a "%HEXHEX" triplet); the IP-literal brackets "[" "]" are
-// excluded, so an IPv6-literal host is refused by the shorthand and uses the object form.
+// excluded here because they are authority syntax -- a bracketed IPv6 host is validated in
+// _validUriAuthority (RFC 3986 sec. 3.2.2), never in the path.
 function _isUriByte(c) {
   return _isUnreserved(c) || _isSubDelim(c) || c === 58 || c === 47 || c === 63 || c === 35 || c === 64;
 }
@@ -122,8 +123,8 @@ function _componentBytesOk(s, from, to, byteOk) {
 // or an FQDN of strict-LDH labels (the email-domain grammar: no underscore, no hyphen at a label edge) with
 // at least one dot -- a single-label host such as "localhost" is not fully qualified and uses the object
 // form, matching the email domain. An IPv4-SHAPED host that is not a valid address is refused as ambiguous
-// (the same rule the top-level classifier uses), and an IPv6-literal host -- needing the excluded "[" "]"
-// -- uses the object form.
+// (the same rule the top-level classifier uses). An IPv6-literal host is written in "[" "]" and validated
+// by _validUriIp6Host from _validUriAuthority, never reaching this unbracketed-host check.
 function _validUriHost(s, from, to) {
   if (to <= from) return false;                                                        // empty host
   var host = _sliceStr(s, from, to), len = host.length;
@@ -135,10 +136,21 @@ function _validUriHost(s, from, to) {
   return _labelsValid(host, 0, len, _isHostLabelRange, true);                           // strict-LDH FQDN, root "." allowed
 }
 
+// A bracketed IPv6-literal URI host (RFC 3986 sec. 3.2.2): the bytes between "[" and "]" must be a valid
+// IPv6 address (16 packed octets), never an IPv4 literal (which uses the unbracketed IPv4address form). The
+// bracket is the ONLY way to write an IPv6 host in a URI, and an IPv6 host is a valid iPAddress per RFC 5280
+// sec. 4.2.1.6, so the shorthand accepts it rather than forcing the object form.
+function _validUriIp6Host(s, from, to) {
+  if (to <= from) return false;                                                        // empty "[ ]"
+  var packed = _packIpLiteral(_sliceStr(s, from, to));
+  return packed !== null && intrinsic.sizeOf(packed) === 16;                            // IPv6 literal only (16 octets)
+}
+
 // The authority in [from,to) is "[ userinfo "@" ] host [ ":" port ]" (RFC 3986 sec. 3.2): at most one "@"
-// (userinfo and reg-name each exclude it), a host validated by _validUriHost (RFC 5280 FQDN or IPv4), and
-// an all-digit -- possibly empty -- port after the host's single ":" (a reg-name has no ":"). The userinfo
-// bytes are validated against the RFC 3986 userinfo class.
+// (userinfo and reg-name each exclude it), a host that is an RFC 5280 FQDN or IPv4 (_validUriHost) or a
+// bracketed IPv6 literal (_validUriIp6Host), and an all-digit -- possibly empty -- port after the host's
+// ":". A bracketed host is taken as ONE unit before the port, so a ":" inside the IPv6 literal is not read
+// as the port separator. The userinfo bytes are validated against the RFC 3986 userinfo class.
 function _validUriAuthority(s, from, to) {
   var i, c, at = -1;
   for (i = from; i < to; i += 1) {
@@ -147,6 +159,17 @@ function _validUriAuthority(s, from, to) {
   }
   var hostStart = at === -1 ? from : at + 1;
   if (at !== -1 && !_componentBytesOk(s, from, at, _isUserinfoByte)) return false;      // userinfo
+  if (hostStart < to && _charCodeAt(s, hostStart) === 91) {                             // "[" -> bracketed IPv6 host
+    var close = -1;
+    for (i = hostStart + 1; i < to; i += 1) { if (_charCodeAt(s, i) === 93) { close = i; break; } }   // "]"
+    if (close === -1) return false;                                                    // unterminated "["
+    if (!_validUriIp6Host(s, hostStart + 1, close)) return false;                       // IPv6 literal in "[ ]"
+    var after = close + 1;
+    if (after === to) return true;                                                     // "[ ipv6 ]" with no port
+    if (_charCodeAt(s, after) !== 58) return false;                                    // only a ":" port may follow "]"
+    for (i = after + 1; i < to; i += 1) { if (!_isDigitCode(_charCodeAt(s, i))) return false; }   // port = *DIGIT
+    return true;
+  }
   var colon = -1;
   for (i = hostStart; i < to; i += 1) { if (_charCodeAt(s, i) === 58) { colon = i; break; } }   // ":" -> port
   var hostEnd = colon === -1 ? to : colon;

package/lib/webcrypto.js

@@ -54,6 +54,14 @@ var _hasOwn = intrinsic.hasOwn;
 var _stringify = intrinsic.stringify;
 var _bufferFrom = intrinsic.bufferFrom;
 var _bufToString = intrinsic.uncurry(Buffer.prototype.toString);
+// The node Hash instance methods, captured at load. digestStream feeds chunks across `await` points,
+// and a co-resident that replaced Hash.prototype.update while the stream was suspended between chunks
+// could drop or alter one -- making digest("ab") equal digest("a") -- and, because both streamed
+// signing and verification trust this digest, forge a valid verdict over bytes the stream never
+// yielded. Calling the captured update/digest keeps the hash bound to the bytes the stream saw. The
+// one-shot digest needs no such capture: its single update and digest run with no suspension between.
+var _hashUpdate = intrinsic.uncurry(nodeCrypto.Hash.prototype.update);
+var _hashDigest = intrinsic.uncurry(nodeCrypto.Hash.prototype.digest);
 var _bufferConcat = intrinsic.bufferConcat;
 var _bufferAlloc = intrinsic.bufferAlloc;
 var _isBuffer = intrinsic.isBuffer;
@@ -76,6 +84,9 @@ var _Uint8Array = intrinsic.Uint8Array;
 var _assign = intrinsic.assign;
 var _create = intrinsic.create;
 var _isView = intrinsic.isView;
+var _asyncIterator = intrinsic.asyncIterator;
+var _apply = intrinsic.apply;
+var _NO_ARGS = intrinsic.freeze([]);
 var _toUpperCase = intrinsic.toUpperCase;
 var _toLowerCase = intrinsic.toLowerCase;
 var _stringIndexOf = intrinsic.stringIndexOf;
@@ -334,6 +345,74 @@ SubtleCrypto.prototype.digest = async function digest(algorithm, data) {
   return _toArrayBuffer(h.digest());
 };
 
+// Digest an async iterable of byte chunks under several algorithms in ONE pass, returning one
+// ArrayBuffer per algorithm in order. Each result is byte-identical to digest(algorithms[i], <the
+// concatenated chunks>): the same createHash + XOF handling, fed incrementally so an arbitrarily
+// large payload is never held whole. The single pass is what lets a multi-signer detached CMS sign
+// hash a single-use stream once for every distinct digest algorithm. Which algorithm each Hash runs
+// is fixed up front through the captured name resolution (_normalizeAlg / _toUpperCase / _hashNode),
+// exactly as the one-shot digest resolves it, so a replaced toUpperCase cannot swap SHA-256 for SHA-1
+// mid-stream. A chunk that is not a BufferSource throws webcrypto/data, before it reaches a hash.
+SubtleCrypto.prototype.digestStream = async function digestStream(algorithms, source) {
+  if (!_isArray(algorithms) || !algorithms.length) {
+    throw new WebCryptoError("webcrypto/syntax", "digestStream: algorithms must be a non-empty array of digest algorithms");
+  }
+  // Follow the async-iteration protocol exactly as `for await` does: read the source's
+  // Symbol.asyncIterator ONCE, call it to obtain the iterator, then capture THAT iterator's `next` with
+  // a single read and drive it manually. Driving `source` by its own `next` would diverge from
+  // `for await` whenever Symbol.asyncIterator returns a distinct iterator, and an inherited `next` (say
+  // from a polluted prototype) would misclassify an ordinary iterable; going through the method avoids
+  // both. Native `for await` caches `next` after one read, so capturing each method once and reusing it
+  // -- rather than re-reading to drive the loop -- also consumes a one-shot or stateful accessor a
+  // direct `for await` accepts.
+  // Build (and thereby validate) the hashes BEFORE acquiring the iterator: an unsupported algorithm
+  // must reject before the iterator factory runs, so a factory that opens a file or socket is never
+  // invoked -- and never leaked outside the cleanup guard -- on a rejection, keeping the lazy-stream
+  // guarantee that a pre-hash rejection acquires no resource.
+  // A plain index loop, not `_map`: Array.prototype.map SKIPS holes, so a sparse list such as
+  // `[, "SHA-256"]` would leave a hole in `hashes` (later read as `undefined` and updated as a raw
+  // TypeError) or, if fully sparse, yield sparse output. Indexing every slot instead makes a hole read
+  // as `undefined`, which `_normalizeAlg` rejects with a typed webcrypto/syntax before any chunk is read.
+  var hashes = [];
+  for (var _h = 0; _h < algorithms.length; _h++) {
+    var name = _normalizeAlg(algorithms[_h], "digestStream").name;
+    var xof = XOF_NODE[_toUpperCase(_String(name))];
+    hashes[_h] = xof
+      ? nodeCrypto.createHash(xof.node, { outputLength: xof.length })
+      : nodeCrypto.createHash(_hashNode(name, "digestStream"));
+  }
+  var acquire = source == null ? undefined : source[_asyncIterator];
+  if (typeof acquire !== "function") {
+    throw new WebCryptoError("webcrypto/syntax", "digestStream: source must be an async iterable of byte chunks");
+  }
+  var iterator = _apply(acquire, source, _NO_ARGS);
+  try {
+    // The `next` retrieval and its validation are INSIDE the guard: the factory above may have opened a
+    // resource, so a non-callable next (or a throwing next accessor) must still reach the cleanup below
+    // that calls the iterator's return(), rather than leak on a malformed iterator protocol.
+    var nextMethod = iterator == null ? undefined : iterator.next;
+    if (typeof nextMethod !== "function") {
+      throw new WebCryptoError("webcrypto/syntax", "digestStream: source must be an async iterable of byte chunks");
+    }
+    for (;;) {
+      var step = await _apply(nextMethod, iterator, _NO_ARGS);
+      if (step && step.done) break;
+      var buf = _toBuf(step == null ? undefined : step.value, "digestStream chunk");
+      for (var i = 0; i < hashes.length; i++) _hashUpdate(hashes[i], buf);
+    }
+  } catch (e) {
+    // Best-effort completion, as `for await` performs on an early exit or throw: let the source release.
+    // The retrieval of `return` is INSIDE the guard too, so a throwing `return` accessor cannot replace
+    // the original error -- the malformed-chunk verdict is what the caller must see, not a cleanup fault.
+    try {
+      var ret = iterator == null ? undefined : iterator.return;
+      if (typeof ret === "function") await _apply(ret, iterator, _NO_ARGS);
+    } catch (_r) { /* cleanup is best-effort */ }
+    throw e;
+  }
+  return _map(hashes, function (h) { return _toArrayBuffer(_hashDigest(h)); });
+};
+
 SubtleCrypto.prototype.generateKey = async function generateKey(algorithm, extractable, keyUsages) {
   var alg = _normalizeAlg(algorithm, "generateKey");
   // Before the partition below, not only in the CryptoKey constructor: the asymmetric branch splits

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.5.32",
+  "version": "0.5.34",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",
@@ -83,6 +83,6 @@
   "devDependencies": {
     "c8": "12.0.0",
     "esbuild": "0.28.2",
-    "eslint": "10.8.1"
+    "eslint": "10.9.1"
   }
 }

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:e0315ce7-f8af-453b-be94-cae61e3f47ea",
+  "serialNumber": "urn:uuid:849173ca-4a17-451d-91be-1f2d75d83f00",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-28T18:08:22.906Z",
+    "timestamp": "2026-08-29T10:04:44.768Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.5.32",
+      "bom-ref": "@blamejs/pki@0.5.34",
       "type": "application",
       "name": "pki",
-      "version": "0.5.32",
+      "version": "0.5.34",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.5.32",
+      "purl": "pkg:npm/%40blamejs/pki@0.5.34",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.5.32",
+      "ref": "@blamejs/pki@0.5.34",
       "dependsOn": []
     }
   ]