@blamejs/pki 0.6.20 → 0.6.21

package/CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.6.21 — 2026-09-01
+
+WebCrypto and the signing and format builders refuse an algorithm, curve, digest, or profile name that collides with an inherited Object.prototype property name.
+
+### Fixed
+
+- pki.webcrypto (generateKey, sign, verify, encrypt, decrypt, deriveBits, deriveKey, wrapKey, unwrapKey, importKey, encapsulateBits, decapsulateBits) refuses an algorithm name or namedCurve that collides with an inherited Object.prototype property name, returning webcrypto/not-supported instead of a bare Node error. The digest, PBMAC1 PRF, CMP body, PKCS#12 MAC hash, PBES2 PRF, and lint-profile lookups behind pki.tsp.sign, pki.cmp.build, pki.pkcs12.build, pki.key.encrypt, pki.lint.certificate, and the RSA-PSS and C509 builders are hardened the same way, each returning the verb's typed error for such a name.
+
 ## v0.6.20 — 2026-09-01
 
 A vulnerable build-time dependency is refreshed; it is not part of the published package.

package/lib/cmp-build.js

@@ -75,18 +75,18 @@ var KNOWN_HEADER_KEYS = {
   sender: 1, recipient: 1, pvno: 1, messageTime: 1, senderKID: 1, recipKID: 1,
   transactionID: 1, senderNonce: 1, recipNonce: 1, freeText: 1, generalInfo: 1,
 };
-var KNOWN_BODY_KEYS = {
+var KNOWN_BODY_KEYS = intrinsic.assign(intrinsic.create(null), {
   ir: 1, cr: 1, kur: 1, krr: 1, ccr: 1, p10cr: 1, certConf: 1, pollReq: 1, genm: 1, rr: 1,
   ip: 1, cp: 1, kup: 1, ccp: 1, krp: 1, rp: 1, genp: 1, error: 1, pollRep: 1, pkiconf: 1,
   nested: 1,
-};
-var BODY_TAG = {
+});
+var BODY_TAG = intrinsic.assign(intrinsic.create(null), {
   ir: 0, cr: 2, p10cr: 4, kur: 7, krr: 9, ccr: 13, rr: 11, genm: 21, certConf: 24, pollReq: 25,
   ip: 1, cp: 3, kup: 8, krp: 10, rp: 12, ccp: 14, pkiconf: 19, genp: 22, error: 23, pollRep: 26,
   nested: 20,
-};
-var CRMF_BODY = { ir: 1, cr: 1, kur: 1, krr: 1, ccr: 1 };
-var CERT_REP_ARM = { ip: 1, cp: 1, kup: 1, ccp: 1 };
+});
+var CRMF_BODY = intrinsic.assign(intrinsic.create(null), { ir: 1, cr: 1, kur: 1, krr: 1, ccr: 1 });
+var CERT_REP_ARM = intrinsic.assign(intrinsic.create(null), { ip: 1, cp: 1, kup: 1, ccp: 1 });
 var KNOWN_OPTS_KEYS = { key: 1, cert: 1, mac: 1, extraCerts: 1, pem: 1, pss: 1, digestAlgorithm: 1 };
 var KNOWN_OPTS_SIG_KEYS = { key: 1, cert: 1, extraCerts: 1, pem: 1, pss: 1, digestAlgorithm: 1 };
 var KNOWN_OPTS_MAC_KEYS = { mac: 1, extraCerts: 1, pem: 1 };
@@ -100,17 +100,17 @@ var PBMAC1_DEFAULT_KEYLEN = 32;
 var PBMAC1_MIN_KEYLEN = 20;
 var PBMAC1_MAX_KEYLEN = 1024;
 var PBMAC1_MIN_ITER = 1000;
-var PBMAC1_PRF = { "SHA-256": "hmacWithSHA256", "SHA-384": "hmacWithSHA384", "SHA-512": "hmacWithSHA512" };
-var PBMAC1_MAC_OID = { "SHA-256": "hmacWithSHA256", "SHA-384": "hmacWithSHA384", "SHA-512": "hmacWithSHA512" };
+var PBMAC1_PRF = intrinsic.assign(intrinsic.create(null), { "SHA-256": "hmacWithSHA256", "SHA-384": "hmacWithSHA384", "SHA-512": "hmacWithSHA512" });
+var PBMAC1_MAC_OID = intrinsic.assign(intrinsic.create(null), { "SHA-256": "hmacWithSHA256", "SHA-384": "hmacWithSHA384", "SHA-512": "hmacWithSHA512" });
 var PBMAC1_PRF_HLEN = { "SHA-256": 32, "SHA-384": 48, "SHA-512": 64 };
 var FAIL_INFO_NAMES = ["badAlg", "badMessageCheck", "badRequest", "badTime", "badCertId", "badDataFormat",
   "wrongAuthority", "incorrectData", "missingTimeStamp", "badPOP", "certRevoked", "certConfirmed",
   "wrongIntegrity", "badRecipientNonce", "timeNotAvailable", "unacceptedPolicy", "unacceptedExtension",
   "addInfoNotAvailable", "badSenderNonce", "badCertTemplate", "signerNotTrusted", "transactionIdInUse",
   "unsupportedVersion", "notAuthorized", "systemUnavail", "systemFailure", "duplicateCertReq"];
-var FAIL_INFO_INDEX = {};
+var FAIL_INFO_INDEX = intrinsic.create(null);
 FAIL_INFO_NAMES.forEach(function (n, i) { FAIL_INFO_INDEX[n] = i; });
-var CERT_CONF_HASH_ALGS = { sha1: 1, sha256: 1, sha384: 1, sha512: 1, "sha3-256": 1, "sha3-512": 1 };
+var CERT_CONF_HASH_ALGS = intrinsic.assign(intrinsic.create(null), { sha1: 1, sha256: 1, sha384: 1, sha512: 1, "sha3-256": 1, "sha3-512": 1 });
 
 
 function _reqOctets(v, what) {

package/lib/lint.js

@@ -44,7 +44,7 @@ var EXT_DECODERS = pkix.certExtensionDecoders(NS).byOid;
 
 
 
-var SEVERITY = { fatal: 5, error: 4, warn: 3, notice: 2, pass: 1 };
+var SEVERITY = Object.assign(Object.create(null), { fatal: 5, error: 4, warn: 3, notice: 2, pass: 1 });
 var VALID_SEVERITY = Object.keys(SEVERITY);
 
 function _worst(findings) {
@@ -191,7 +191,7 @@ function _rsaModulusBits(spki) {
     return mod.toString(2).length;
   } catch (_e) { return null; }
 }
-var RSA_KEY_ALGS = { rsaEncryption: 1, rsassaPss: 1, rsaesOaep: 1 };
+var RSA_KEY_ALGS = Object.assign(Object.create(null), { rsaEncryption: 1, rsassaPss: 1, rsaesOaep: 1 });
 var APPROVED_EC_CURVES = ["prime256v1", "secp384r1", "secp521r1"];
 function _ecCurveName(spki) {
   try {
@@ -476,7 +476,7 @@ var CABF_TLS_RULES = [
   },
 ];
 
-var ML_KEM_EK_LEN = {};
+var ML_KEM_EK_LEN = Object.create(null);
 ["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"].forEach(function (n) { ML_KEM_EK_LEN[n] = oid.kemParams(n).ek; });
 function _isMlKem(cert) {
   var spki = cert.subjectPublicKeyInfo;
@@ -510,11 +510,11 @@ var RFC9935_RULES = [
   },
 ];
 
-var PROFILES = {
+var PROFILES = Object.assign(Object.create(null), {
   "rfc5280": RFC5280_RULES,
   "rfc9935": RFC9935_RULES,
   "cabf-tls": CABF_TLS_RULES,
-};
+});
 var ALL_RULES = RFC5280_RULES.concat(RFC9935_RULES).concat(CABF_TLS_RULES);
 
 function _selectRules(profile) {

package/lib/pbes2.js

@@ -13,7 +13,7 @@ var C = require("./constants");
 var b = asn1.build;
 function O(n) { return oid.byName(n); }
 
-var PRF_NODE_BY_NAME = { hmacWithSHA1: "sha1", hmacWithSHA256: "sha256", hmacWithSHA384: "sha384", hmacWithSHA512: "sha512" };
+var PRF_NODE_BY_NAME = Object.assign(Object.create(null), { hmacWithSHA1: "sha1", hmacWithSHA256: "sha256", hmacWithSHA384: "sha384", hmacWithSHA512: "sha512" });
 var PRF_NODE_BY_OID = {}; Object.keys(PRF_NODE_BY_NAME).forEach(function (n) { PRF_NODE_BY_OID[O(n)] = PRF_NODE_BY_NAME[n]; });
 
 var CONTENT_KEYBITS = {}, CONTENT_MODE = {};

package/lib/pkcs12-build.js

@@ -51,18 +51,18 @@ var MAX_PBMAC1_KEYLEN = 1024;
 var CLASSIC_MAC_MAX_ITERATIONS = 1000000;
 var KDF_MAX_ROUNDS = CLASSIC_MAC_MAX_ITERATIONS;
 
-var P12_KDF_UV = {
+var P12_KDF_UV = intrinsic.assign(intrinsic.create(null), {
   sha1: { u: 20, v: 64 }, sha224: { u: 28, v: 64 }, sha256: { u: 32, v: 64 },
   sha384: { u: 48, v: 128 }, sha512: { u: 64, v: 128 },
-};
-var PBMAC1_PRF = {
+});
+var PBMAC1_PRF = intrinsic.assign(intrinsic.create(null), {
   sha256: { prfName: "hmacWithSHA256", wc: "SHA-256", keyLen: 32 },
   sha384: { prfName: "hmacWithSHA384", wc: "SHA-384", keyLen: 48 },
   sha512: { prfName: "hmacWithSHA512", wc: "SHA-512", keyLen: 64 },
-};
-var PRF_WC = { hmacWithSHA1: "SHA-1", hmacWithSHA256: "SHA-256", hmacWithSHA384: "SHA-384", hmacWithSHA512: "SHA-512" };
-var CIPHER_NAME = { "aes-128-cbc": "aes128-CBC", "aes-192-cbc": "aes192-CBC", "aes-256-cbc": "aes256-CBC" };
-var DIGEST_NAME = { sha1: "sha1", sha256: "sha256", sha384: "sha384", sha512: "sha512" };
+});
+var PRF_WC = intrinsic.assign(intrinsic.create(null), { hmacWithSHA1: "SHA-1", hmacWithSHA256: "SHA-256", hmacWithSHA384: "SHA-384", hmacWithSHA512: "SHA-512" });
+var CIPHER_NAME = intrinsic.assign(intrinsic.create(null), { "aes-128-cbc": "aes128-CBC", "aes-192-cbc": "aes192-CBC", "aes-256-cbc": "aes256-CBC" });
+var DIGEST_NAME = intrinsic.assign(intrinsic.create(null), { sha1: "sha1", sha256: "sha256", sha384: "sha384", sha512: "sha512" });
 
 
 
@@ -77,14 +77,14 @@ var _BUILD_OPTS_SHORTHAND = { integrity: 1, mac: 1, password: 1, pem: 1, recipie
 var _SAFE_RECIPIENTS_KEYS = { bags: 1, recipients: 1, contentEncryptionAlgorithm: 1 };
 var _SAFE_PASSWORD_KEYS = { bags: 1, encrypt: 1 };
 var _SAFE_PLAINTEXT_KEYS = { bags: 1 };
-var _BAG_KEYS_BY_TYPE = {
+var _BAG_KEYS_BY_TYPE = intrinsic.assign(intrinsic.create(null), {
   key:          { type: 1, friendlyName: 1, localKeyId: 1, key: 1 },
   shroudedKey:  { type: 1, friendlyName: 1, localKeyId: 1, key: 1, encrypt: 1 },
   cert:         { type: 1, friendlyName: 1, localKeyId: 1, cert: 1 },
   crl:          { type: 1, friendlyName: 1, localKeyId: 1, crl: 1 },
   secret:       { type: 1, friendlyName: 1, localKeyId: 1, secretTypeId: 1, secretValue: 1 },
   safeContents: { type: 1, friendlyName: 1, localKeyId: 1, nested: 1 },
-};
+});
 var _ENCRYPT_KEYS = { password: 1, cipher: 1, salt: 1, iterations: 1, prf: 1 };
 var _MAC_KEYS = { algorithm: 1, hash: 1, salt: 1, iterations: 1, keyLength: 1, password: 1 };
 var _MAC_KEYS_HMAC = { algorithm: 1, hash: 1, salt: 1, iterations: 1, password: 1 };

package/lib/schema-c509.js

@@ -47,7 +47,7 @@ var PK_ALG_BY_INT = {
   2: { alg: _name("ecPublicKey"), curve: _name("secp384r1") },
   3: { alg: _name("ecPublicKey"), curve: _name("secp521r1") },
 };
-var EC_FIELD_BYTES = { "prime256v1": 32, "secp384r1": 48, "secp521r1": 66 };
+var EC_FIELD_BYTES = Object.assign(Object.create(null), { "prime256v1": 32, "secp384r1": 48, "secp521r1": 66 });
 
 var ATTR_BY_INT = {
   0: _name("emailAddress"),
@@ -87,14 +87,14 @@ var EXT_BY_INT = {
   36: _name("ocspNoCheck"),
   38: _name("tlsFeature"),
 };
-var EXT_COMPACT = {
+var EXT_COMPACT = Object.assign(Object.create(null), {
   subjectKeyIdentifier: 1, keyUsage: 1, basicConstraints: 1, authorityKeyIdentifier: 1,
   extKeyUsage: 1, inhibitAnyPolicy: 1, ocspNoCheck: 1, tlsFeature: 1,
   subjectAltName: 1, issuerAltName: 1, nameConstraints: 1, cRLDistributionPoints: 1,
   freshestCRL: 1, authorityInfoAccess: 1, subjectInfoAccess: 1, certificatePolicies: 1,
   policyMappings: 1, policyConstraints: 1, subjectDirectoryAttributes: 1,
   ipAddrBlocks: 1, autonomousSysIds: 1, ipAddrBlocksV2: 1, autonomousSysIdsV2: 1,
-};
+});
 var EKU_BY_INT = {
   0: _name("anyExtendedKeyUsage"), 1: _name("serverAuth"), 2: _name("clientAuth"),
   3: _name("codeSigning"), 4: _name("emailProtection"), 8: _name("timeStamping"), 9: _name("ocspSigning"),
@@ -1561,11 +1561,11 @@ function matches(node) {
 }
 
 
-var SIG_ALG_TO_INT = { ecdsaWithSHA256: 0, ecdsaWithSHA384: 1, ecdsaWithSHA512: 2 };
-var PK_ALG_TO_INT = { rsaEncryption: 0, "ecPublicKey|prime256v1": 1, "ecPublicKey|secp384r1": 2, "ecPublicKey|secp521r1": 3 };
-var ATTR_TO_INT = {};
+var SIG_ALG_TO_INT = Object.assign(Object.create(null), { ecdsaWithSHA256: 0, ecdsaWithSHA384: 1, ecdsaWithSHA512: 2 });
+var PK_ALG_TO_INT = Object.assign(Object.create(null), { rsaEncryption: 0, "ecPublicKey|prime256v1": 1, "ecPublicKey|secp384r1": 2, "ecPublicKey|secp521r1": 3 });
+var ATTR_TO_INT = Object.create(null);
 Object.keys(ATTR_BY_INT).forEach(function (k) { ATTR_TO_INT[ATTR_BY_INT[k]] = Number(k); });
-var EXT_TO_INT = {};
+var EXT_TO_INT = Object.create(null);
 Object.keys(EXT_BY_INT).forEach(function (k) { if (EXT_COMPACT[EXT_BY_INT[k]]) EXT_TO_INT[EXT_BY_INT[k]] = Number(k); });
 
 function _minBytes(n) {
@@ -1754,9 +1754,9 @@ function _keyUsageBitsFromDer(extnValue) {
   return _namedBitsFromContent(bs.bytes, bs.unusedBits);
 }
 var _NO_EXPIRY = Date.UTC(9999, 11, 31, 23, 59, 59);
-var NODE_TO_WEBCRYPTO = { "prime256v1": "P-256", "secp384r1": "P-384", "secp521r1": "P-521" };
-var WEBCRYPTO_FIELD_BYTES = { "P-256": 32, "P-384": 48, "P-521": 66 };
-var SIG_ALG_TO_CURVE = { "ecdsaWithSHA256": "P-256", "ecdsaWithSHA384": "P-384", "ecdsaWithSHA512": "P-521" };
+var NODE_TO_WEBCRYPTO = Object.assign(Object.create(null), { "prime256v1": "P-256", "secp384r1": "P-384", "secp521r1": "P-521" });
+var WEBCRYPTO_FIELD_BYTES = Object.assign(Object.create(null), { "P-256": 32, "P-384": 48, "P-521": 66 });
+var SIG_ALG_TO_CURVE = Object.assign(Object.create(null), { "ecdsaWithSHA256": "P-256", "ecdsaWithSHA384": "P-384", "ecdsaWithSHA512": "P-521" });
 function _magBytes(intNode) {
   var c = intNode.content, i = 0;
   while (i < c.length - 1 && c[i] === 0x00) i++;

package/lib/sign-scheme.js

@@ -24,8 +24,8 @@ var _isBuffer = intrinsic.isBuffer;
 var _bufferFrom = intrinsic.bufferFrom;
 var _isU8 = intrinsic.types.isUint8Array;
 
-var HASH = { sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" };
-var NODE_DIGEST = { sha256: "sha256", sha384: "sha384", sha512: "sha512", shake128: "shake128", shake256: "shake256" };
+var HASH = intrinsic.assign(intrinsic.create(null), { sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" });
+var NODE_DIGEST = intrinsic.assign(intrinsic.create(null), { sha256: "sha256", sha384: "sha384", sha512: "sha512", shake128: "shake128", shake256: "shake256" });
 var PSS_SALT = { "SHA-256": 32, "SHA-384": 48, "SHA-512": 64 };
 var ECDSA_ALG = { sha256: "ecdsaWithSHA256", sha384: "ecdsaWithSHA384", sha512: "ecdsaWithSHA512" };
 var RSA_PKCS1_SIG = { sha256: "sha256WithRSAEncryption", sha384: "sha384WithRSAEncryption", sha512: "sha512WithRSAEncryption" };

package/lib/tsp-sign.js

@@ -47,7 +47,7 @@ var _b = pkiBuild.makeBuilder({
   NAME_SCHEMA: pkix.name(_NS), SPKI_SCHEMA: pkix.spki(_NS),
 });
 
-var NODE_DIGEST = { sha256: "sha256", sha384: "sha384", sha512: "sha512" };
+var NODE_DIGEST = intrinsic.assign(intrinsic.create(null), { sha256: "sha256", sha384: "sha384", sha512: "sha512" });
 var HASH_LEN = { sha256: 32, sha384: 48, sha512: 64 };
 
 var _REVOCATION_RANK = { "false": 0, "undetermined": 1, "waived": 2, "determined": 3 };
@@ -397,9 +397,9 @@ function response(token, opts) {
 function parseResponse(input) { return schemaTsp.parse(input); }
 
 
-var _VERIFY_DIGEST = { sha256: "sha256", sha384: "sha384", sha512: "sha512", sha1: "sha1" };
-var _VERIFY_DIGEST_LEN = { sha1: 20, sha256: 32, sha384: 48, sha512: 64 };
-var _BIND_DIGEST = { sha256: "sha256", sha384: "sha384", sha512: "sha512" };
+var _VERIFY_DIGEST = intrinsic.assign(intrinsic.create(null), { sha256: "sha256", sha384: "sha384", sha512: "sha512", sha1: "sha1" });
+var _VERIFY_DIGEST_LEN = intrinsic.assign(intrinsic.create(null), { sha1: 20, sha256: 32, sha384: 48, sha512: 64 });
+var _BIND_DIGEST = intrinsic.assign(intrinsic.create(null), { sha256: "sha256", sha384: "sha384", sha512: "sha512" });
 
 function _imprintMatches(mi, data) {
   var name = mi.hashAlgorithm && mi.hashAlgorithm.name;

package/lib/webcrypto.js

@@ -122,7 +122,7 @@ function _normalizeAlg(algorithm, who) {
   return out;
 }
 
-var _STD_ALG_NAME = { "RSASSA-PKCS1-V1_5": "RSASSA-PKCS1-v1_5", "ED25519": "Ed25519", "ED448": "Ed448" };
+var _STD_ALG_NAME = intrinsic.assign(intrinsic.create(null), { "RSASSA-PKCS1-V1_5": "RSASSA-PKCS1-v1_5", "ED25519": "Ed25519", "ED448": "Ed448" });
 function _stdName(name) { return _STD_ALG_NAME[name] || name; }
 
 var HASH_NODE = {
@@ -164,24 +164,24 @@ function _hmacLengthBits(alg, who) {
   return alg.length;
 }
 
-var CURVE_NODE = { "P-256": "prime256v1", "P-384": "secp384r1", "P-521": "secp521r1" };
-var CURVE_FIELD_BYTES = { "P-256": 32, "P-384": 48, "P-521": 66 };
+var CURVE_NODE = intrinsic.assign(intrinsic.create(null), { "P-256": "prime256v1", "P-384": "secp384r1", "P-521": "secp521r1" });
+var CURVE_FIELD_BYTES = intrinsic.assign(intrinsic.create(null), { "P-256": 32, "P-384": 48, "P-521": 66 });
 
-var ML_DSA_NODE = { "ML-DSA-44": "ml-dsa-44", "ML-DSA-65": "ml-dsa-65", "ML-DSA-87": "ml-dsa-87" };
-var ML_KEM_NODE = { "ML-KEM-512": "ml-kem-512", "ML-KEM-768": "ml-kem-768", "ML-KEM-1024": "ml-kem-1024" };
+var ML_DSA_NODE = intrinsic.assign(intrinsic.create(null), { "ML-DSA-44": "ml-dsa-44", "ML-DSA-65": "ml-dsa-65", "ML-DSA-87": "ml-dsa-87" });
+var ML_KEM_NODE = intrinsic.assign(intrinsic.create(null), { "ML-KEM-512": "ml-kem-512", "ML-KEM-768": "ml-kem-768", "ML-KEM-1024": "ml-kem-1024" });
 
-var SLH_DSA_NODE = {};
+var SLH_DSA_NODE = intrinsic.create(null);
 ["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
  "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
 ].forEach(function (s) { SLH_DSA_NODE["SLH-DSA-" + _toUpperCase(s)] = "slh-dsa-" + s; });
 
-var SIGN_VERIFY_NAMES = {};
+var SIGN_VERIFY_NAMES = intrinsic.create(null);
 ["RSASSA-PKCS1-V1_5", "RSA-PSS", "ECDSA", "ED25519", "ED448", "HMAC"]
   .concat(_keys(ML_DSA_NODE), _keys(SLH_DSA_NODE))
   .forEach(function (n) { SIGN_VERIFY_NAMES[n] = true; });
-var ENCRYPT_DECRYPT_NAMES = { "RSA-OAEP": true, "AES-GCM": true, "AES-CBC": true, "AES-CTR": true };
-var DERIVE_NAMES = { "ECDH": true, "X25519": true, "X448": true, "HKDF": true, "PBKDF2": true, "X963KDF": true };
-var SECRET_KEY_NAMES = { "AES-GCM": true, "AES-CBC": true, "AES-CTR": true, "AES-KW": true, "HMAC": true, "HKDF": true, "PBKDF2": true, "X963KDF": true };
+var ENCRYPT_DECRYPT_NAMES = intrinsic.assign(intrinsic.create(null), { "RSA-OAEP": true, "AES-GCM": true, "AES-CBC": true, "AES-CTR": true });
+var DERIVE_NAMES = intrinsic.assign(intrinsic.create(null), { "ECDH": true, "X25519": true, "X448": true, "HKDF": true, "PBKDF2": true, "X963KDF": true });
+var SECRET_KEY_NAMES = intrinsic.assign(intrinsic.create(null), { "AES-GCM": true, "AES-CBC": true, "AES-CTR": true, "AES-KW": true, "HMAC": true, "HKDF": true, "PBKDF2": true, "X963KDF": true });
 
 
 /**
@@ -974,12 +974,12 @@ function _importRawPublic(name, alg, raw, extractable, usages) {
   throw new WebCryptoError("webcrypto/not-supported", "importKey raw: unsupported public-key algorithm " + _stringify(name));
 }
 
-var IMPORT_KEY_TYPE = {
+var IMPORT_KEY_TYPE = intrinsic.assign(intrinsic.create(null), {
   "RSASSA-PKCS1-V1_5": { rsa: 1 }, "RSA-PSS": { rsa: 1, "rsa-pss": 1 }, "RSA-OAEP": { rsa: 1 },
   "ECDSA": { ec: 1 }, "ECDH": { ec: 1 },
   "ED25519": { ed25519: 1 }, "ED448": { ed448: 1 },
   "X25519": { x25519: 1 }, "X448": { x448: 1 },
-};
+});
 [ML_DSA_NODE, ML_KEM_NODE, SLH_DSA_NODE].forEach(function (m) {
   _forEach(_keys(m), function (webName) { var t = {}; t[m[webName]] = 1; IMPORT_KEY_TYPE[webName] = t; });
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.20",
+  "version": "0.6.21",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:40b50089-a128-40ea-a5a2-b82960272544",
+  "serialNumber": "urn:uuid:ba3e8f6b-69f8-4691-b5ee-3d227fe61113",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-01T19:36:06.284Z",
+    "timestamp": "2026-09-01T20:36:49.754Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.20",
+      "bom-ref": "@blamejs/pki@0.6.21",
       "type": "application",
       "name": "pki",
-      "version": "0.6.20",
+      "version": "0.6.21",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.20",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.21",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.20",
+      "ref": "@blamejs/pki@0.6.21",
       "dependsOn": []
     }
   ]