@blamejs/pki 0.6.40 → 0.6.41

package/lib/webauthn.js

@@ -59,7 +59,7 @@ function _ucmp(a, b) {
   return Buffer.compare(strip(a), strip(b)) === 0;
 }
 function _isInteger(node) { return !!node && !node.constructed && node.tagClass === "universal" && node.tagNumber === asn1.TAGS.INTEGER; }
-var COSE_ALG_HASH = { "-7": "sha256", "-9": "sha256", "-257": "sha256", "-37": "sha256", "-35": "sha384", "-51": "sha384", "-258": "sha384", "-38": "sha384", "-36": "sha512", "-52": "sha512", "-259": "sha512", "-39": "sha512", "-65535": "sha1" };
+var COSE_ALG_HASH = intrinsic.assign(intrinsic.create(null), { "-7": "sha256", "-9": "sha256", "-257": "sha256", "-37": "sha256", "-35": "sha384", "-51": "sha384", "-258": "sha384", "-38": "sha384", "-36": "sha512", "-52": "sha512", "-259": "sha512", "-39": "sha512", "-65535": "sha1" });
 function _coseAlgHash(alg, E) {
   var h = COSE_ALG_HASH[String(alg)];
   if (!h) throw E("webauthn/unsupported-algorithm", "no hash mapping for COSE algorithm " + alg);
@@ -154,7 +154,7 @@ function parseCoseKey(bytes) {
 }
 
 
-var COSE_ALG = {
+var COSE_ALG = intrinsic.assign(intrinsic.create(null), {
   "-7":   { imp: { name: "ECDSA", namedCurve: "P-256" }, verify: { name: "ECDSA", hash: "SHA-256" }, ecdsa: 32 },
   "-35":  { imp: { name: "ECDSA", namedCurve: "P-384" }, verify: { name: "ECDSA", hash: "SHA-384" }, ecdsa: 48 },
   "-36":  { imp: { name: "ECDSA", namedCurve: "P-521" }, verify: { name: "ECDSA", hash: "SHA-512" }, ecdsa: 66 },
@@ -171,7 +171,7 @@ var COSE_ALG = {
   "-38":  { imp: { name: "RSA-PSS", hash: "SHA-384" }, verify: { name: "RSA-PSS", saltLength: 48 }, ecdsa: 0 },
   "-39":  { imp: { name: "RSA-PSS", hash: "SHA-512" }, verify: { name: "RSA-PSS", saltLength: 64 }, ecdsa: 0 },
   "-65535": { imp: { name: "RSASSA-PKCS1-v1_5", hash: "SHA-1" }, verify: { name: "RSASSA-PKCS1-v1_5" }, ecdsa: 0 },
-};
+});
 
 function _derEcdsaToRaw(der, curve) { return validator.sig.ecdsaDerToP1363(der, curve, WebauthnError, "webauthn/bad-signature"); }
 
@@ -186,7 +186,7 @@ function _verifySig(alg, sig, spkiBytes, message, E) {
     .then(function (key) { return subtle.verify(ver, key, s, message); })
     .catch(function (e) { throw _err("webauthn/verify-error", "the attestation signature could not be evaluated", e); });
 }
-var ED_OID_NAME = {};
+var ED_OID_NAME = intrinsic.create(null);
 ED_OID_NAME[oid.byName("Ed25519")] = "Ed25519";
 ED_OID_NAME[oid.byName("Ed448")] = "Ed448";
 function _edName(spkiBytes, E) {
@@ -325,7 +325,7 @@ function _attRead(map, key, reader, what) {
 function _algOf(attStmt) { return Number(_attRead(attStmt, "alg", cbor.read.int, "an integer")); }
 function _sigOf(attStmt) { return _attRead(attStmt, "sig", cbor.read.byteString, "a byte string"); }
 function _requireAttShape(attStmt, allowed, required) {
-  var have = {};
+  var have = intrinsic.create(null);
   cbor.read.map(attStmt).forEach(function (kv) {
     if (kv[0].majorType !== 3) throw _err("webauthn/bad-att-stmt", "the attestation statement has a non-text-string field key");
     have[cbor.read.textString(kv[0])] = true;
@@ -333,7 +333,7 @@ function _requireAttShape(attStmt, allowed, required) {
   Object.keys(have).forEach(function (k) { if (allowed.indexOf(k) === -1) throw _err("webauthn/bad-att-stmt", "the attestation statement carries an unexpected field '" + k + "'"); });
   required.forEach(function (k) { if (!have[k]) throw _err("webauthn/bad-att-stmt", "the attestation statement is missing the '" + k + "' field"); });
 }
-var ATT_STMT_MAJOR = { compound: 4 };
+var ATT_STMT_MAJOR = intrinsic.assign(intrinsic.create(null), { compound: 4 });
 
 var _AAGUID_SIGNED_BY_FMT = Object.assign(Object.create(null), { "fido-u2f": false });
 function _aaguidIsSigned(fmt) { return _AAGUID_SIGNED_BY_FMT[fmt] !== false; }
@@ -353,7 +353,7 @@ function _cloneParsed(v, depth) {
   if (Array.isArray(v)) return v.map(function (x) { return _cloneParsed(x, depth + 1); });
   if (guard.time.isDate(v)) return new Date(guard.time.instantOf(v));
   if (v && typeof v === "object") {
-    var out = {};
+    var out = intrinsic.create(null);
     Object.keys(v).forEach(function (k) { out[k] = _cloneParsed(v[k], depth + 1); });
     return out;
   }
@@ -501,13 +501,13 @@ function _readX5c(attStmt) {
     try { return x509.parse(der); } catch (e) { throw _err("webauthn/bad-att-stmt", "an x5c certificate is not a well-formed X.509 certificate", e); }
   });
 }
-var _exts = { find: _findExt, decode: _decodeExt };
+var _exts = intrinsic.assign(intrinsic.create(null), { find: _findExt, decode: _decodeExt });
 function _requireV3(cert) { validator.attcert.requireV3(cert, WebauthnError, "webauthn/bad-att-cert"); }
 function _checkPackedCert(cert) { validator.attcert.packedCert(cert, _exts, WebauthnError, "webauthn/bad-att-cert"); }
 function _checkAikCert(cert) { validator.attcert.aikCert(cert, _exts, WebauthnError, "webauthn/bad-att-cert"); }
 function _checkAaguidExt(cert, aaguid) { validator.attcert.aaguidExt(cert, aaguid, _exts, WebauthnError, "webauthn/bad-att-cert", "webauthn/aaguid-mismatch"); }
 
-var VERIFIERS = {
+var VERIFIERS = intrinsic.assign(intrinsic.create(null), {
   packed: function (att, clientDataHash) {
     var isX5c = !!cbor.read.mapGet(att.attStmt, "x5c");
     _requireAttShape(att.attStmt, isX5c ? ["alg", "sig", "x5c"] : ["alg", "sig"], isX5c ? ["alg", "sig", "x5c"] : ["alg", "sig"]);
@@ -722,7 +722,7 @@ var VERIFIERS = {
     }
     return Promise.resolve(_result("none", "None", [], att));
   },
-};
+});
 
 function _isPlainObject(v) { return !!v && typeof v === "object" && !Array.isArray(v); }
 
@@ -1473,7 +1473,7 @@ var _ASSERT_OPTS = Object.assign(Object.create(null), {
 function _snapshotAssertion(input) {
   if (!_isPlainObject(input)) throw _err("webauthn/bad-input", "pki.webauthn.verifyAssertion takes an options object");
   guard.identifier.assertKnownKeys(input, _ASSERT_OPTS, _err, "webauthn/bad-input", "verifyAssertion input has an unknown key ");
-  var out = {}, k;
+  var out = intrinsic.create(null), k;
   for (k in input) { if (_hasOwn(input, k)) out[k] = input[k]; }
   ["authenticatorData", "clientDataJSON", "clientDataHash", "signature", "expectedChallenge"].forEach(function (f) {
     if (_isBufferSource(out[f])) out[f] = guard.bytes.snapshotSource(out[f], WebauthnError, "webauthn/bad-input", f);
@@ -1482,7 +1482,7 @@ function _snapshotAssertion(input) {
     out.credentialPublicKey = guard.bytes.snapshotSource(out.credentialPublicKey, WebauthnError,
       "webauthn/bad-input", "credentialPublicKey");
   } else if (_isPlainObject(out.credentialPublicKey)) {
-    var key = {}, kk;
+    var key = intrinsic.create(null), kk;
     for (kk in out.credentialPublicKey) {
       if (!_hasOwn(out.credentialPublicKey, kk)) continue;
       var v;

package/lib/webcrypto.js

@@ -116,7 +116,7 @@ function _normalizeAlg(algorithm, who) {
   if (!alg || typeof alg.name !== "string") {
     throw new WebCryptoError("webcrypto/syntax", (who || "operation") + ": algorithm must be a string or an object with a name");
   }
-  var out = {};
+  var out = intrinsic.create(null);
   for (var k in alg) { if (_hasOwn(alg, k)) out[k] = alg[k]; }
   out.name = _toUpperCase(alg.name);
   return out;
@@ -125,7 +125,7 @@ function _normalizeAlg(algorithm, who) {
 var _STD_ALG_NAME = intrinsic.assign(intrinsic.create(null), { "RSASSA-PKCS1-V1_5": "RSASSA-PKCS1-v1_5", "ED25519": "Ed25519", "ED448": "Ed448" });
 function _stdName(name) { return _STD_ALG_NAME[name] || name; }
 
-var HASH_NODE = {
+var HASH_NODE = intrinsic.assign(intrinsic.create(null), {
   "SHA-1":   "sha1",
   "SHA-224": "sha224",
   "SHA-256": "sha256",
@@ -134,12 +134,12 @@ var HASH_NODE = {
   "SHA3-256": "sha3-256",
   "SHA3-384": "sha3-384",
   "SHA3-512": "sha3-512",
-};
+});
 
-var XOF_NODE = {
+var XOF_NODE = intrinsic.assign(intrinsic.create(null), {
   "SHAKE128": { node: "shake128", length: 32 },
   "SHAKE256": { node: "shake256", length: 64 },
-};
+});
 
 function _hashNode(h, who) {
   var name = (typeof h === "string") ? h : (h && h.name);
@@ -148,10 +148,10 @@ function _hashNode(h, who) {
   return node;
 }
 
-var HMAC_BLOCK_BITS = {
+var HMAC_BLOCK_BITS = intrinsic.assign(intrinsic.create(null), {
   "SHA-1": 512, "SHA-256": 512, "SHA-384": 1024, "SHA-512": 1024,
   "SHA3-256": 1088, "SHA3-384": 832, "SHA3-512": 576,
-};
+});
 
 function _hmacLengthBits(alg, who) {
   var name = (typeof alg.hash === "string") ? alg.hash : (alg.hash && alg.hash.name);
@@ -859,7 +859,7 @@ function _nodeKey(fn, who) {
   }
 }
 
-var ML_KEM_INNER = {};
+var ML_KEM_INNER = intrinsic.create(null);
 ["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"].forEach(function (n) {
   var row = oid.kemParams(n);
   ML_KEM_INNER[oid.byName(n)] = { ek: row.ek, dk: row.dk };
@@ -891,7 +891,7 @@ function _validateMlKemInner(innerBytes, sizes) {
   throw new WebCryptoError("webcrypto/data", "an ML-KEM private key must be the seed, expandedKey, or both CHOICE (RFC 9935 sec. 6)");
 }
 
-var PKCS8_INNER_VALIDATORS = {};
+var PKCS8_INNER_VALIDATORS = intrinsic.create(null);
 _forEach(_keys(ML_KEM_INNER), function (o) { PKCS8_INNER_VALIDATORS[o] = function (inner) { _validateMlKemInner(inner, ML_KEM_INNER[o]); }; });
 
 function _preValidatePkcs8(p8, name) {
@@ -974,14 +974,22 @@ function _importRawPublic(name, alg, raw, extractable, usages) {
   throw new WebCryptoError("webcrypto/not-supported", "importKey raw: unsupported public-key algorithm " + _stringify(name));
 }
 
+/** @internal Each inner set is asked whether it holds the key's own type, so it answers from its own
+ * entries alone: a type naming an Object.prototype member would otherwise resolve to a truthy
+ * inherited value and pass a key the algorithm does not accept. */
+function _typeSet(names) {
+  var t = intrinsic.create(null);
+  _forEach(names, function (n) { t[n] = 1; });
+  return t;
+}
 var IMPORT_KEY_TYPE = intrinsic.assign(intrinsic.create(null), {
-  "RSASSA-PKCS1-V1_5": { rsa: 1 }, "RSA-PSS": { rsa: 1, "rsa-pss": 1 }, "RSA-OAEP": { rsa: 1 },
-  "ECDSA": { ec: 1 }, "ECDH": { ec: 1 },
-  "ED25519": { ed25519: 1 }, "ED448": { ed448: 1 },
-  "X25519": { x25519: 1 }, "X448": { x448: 1 },
+  "RSASSA-PKCS1-V1_5": _typeSet(["rsa"]), "RSA-PSS": _typeSet(["rsa", "rsa-pss"]), "RSA-OAEP": _typeSet(["rsa"]),
+  "ECDSA": _typeSet(["ec"]), "ECDH": _typeSet(["ec"]),
+  "ED25519": _typeSet(["ed25519"]), "ED448": _typeSet(["ed448"]),
+  "X25519": _typeSet(["x25519"]), "X448": _typeSet(["x448"]),
 });
 [ML_DSA_NODE, ML_KEM_NODE, SLH_DSA_NODE].forEach(function (m) {
-  _forEach(_keys(m), function (webName) { var t = {}; t[m[webName]] = 1; IMPORT_KEY_TYPE[webName] = t; });
+  _forEach(_keys(m), function (webName) { IMPORT_KEY_TYPE[webName] = _typeSet([m[webName]]); });
 });
 function _algFromImport(name, alg, keyObject) {
   var wantType = IMPORT_KEY_TYPE[name];

package/lib/x509-sign.js

@@ -40,18 +40,18 @@ function O(n) { return oid.byName(n); }
 
 var OID_SKI = O("subjectKeyIdentifier");
 
-var KNOWN_SPEC_KEYS = {
+var KNOWN_SPEC_KEYS = intrinsic.assign(intrinsic.create(null), {
   subject: 1, subjectPublicKey: 1, notBefore: 1, notAfter: 1, serialNumber: 1, extensions: 1,
-};
-var KNOWN_ISSUER_CERT_KEYS = { key: 1, cert: 1 };
-var KNOWN_ISSUER_EXPLICIT_KEYS = { key: 1, name: 1, publicKey: 1 };
-var KNOWN_SIGN_OPTS = { digestAlgorithm: 1, pem: 1, pss: 1 };
+});
+var KNOWN_ISSUER_CERT_KEYS = intrinsic.assign(intrinsic.create(null), { key: 1, cert: 1 });
+var KNOWN_ISSUER_EXPLICIT_KEYS = intrinsic.assign(intrinsic.create(null), { key: 1, name: 1, publicKey: 1 });
+var KNOWN_SIGN_OPTS = intrinsic.assign(intrinsic.create(null), { digestAlgorithm: 1, pem: 1, pss: 1 });
 
-var KNOWN_EXT_KEYS = {
+var KNOWN_EXT_KEYS = intrinsic.assign(intrinsic.create(null), {
   subjectKeyIdentifier: 1, authorityKeyIdentifier: 1, keyUsage: 1, keyUsageCritical: 1,
   extendedKeyUsage: 1, extendedKeyUsageCritical: 1, basicConstraints: 1, subjectAltName: 1,
   certificatePolicies: 1, certificatePoliciesCritical: 1,
-};
+});
 
 var _b = pkiBuild.makeBuilder({ ErrorClass: CertificateError, prefix: "x509", O: O, NS: NS, NAME_SCHEMA: NAME_SCHEMA, SPKI_SCHEMA: SPKI_SCHEMA, EXT_DECODERS: EXT_DECODERS });
 var _encodeName = _b.encodeName, _isEmptyName = _b.isEmptyName, _reqDer = _b.reqDer,
@@ -80,7 +80,7 @@ function _akiKeyId(val, ctx) {
 function _buildExtensions(extSpec, ctx) {
   if (extSpec == null) return [];
   if (_isArray(extSpec)) {
-    var seenExt = {}, arrCa = false, arrKeyCertSign = false, arrPathLen = false;
+    var seenExt = intrinsic.create(null), arrCa = false, arrKeyCertSign = false, arrPathLen = false;
     var oidBc = O("basicConstraints"), oidKu = O("keyUsage");
     var arr = extSpec.map(function (e, i) {
       var der = _reqDer(e, "extension");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.6.40",
+  "version": "0.6.41",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:2af62d9e-82a4-4f11-8c8c-7b2c8b1ae891",
+  "serialNumber": "urn:uuid:c14ed2d9-f3d5-4322-88e1-51afbe3a3fbe",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-05T15:01:32.918Z",
+    "timestamp": "2026-09-06T02:19:25.175Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.6.40",
+      "bom-ref": "@blamejs/pki@0.6.41",
       "type": "application",
       "name": "pki",
-      "version": "0.6.40",
+      "version": "0.6.41",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.6.40",
+      "purl": "pkg:npm/%40blamejs/pki@0.6.41",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.6.40",
+      "ref": "@blamejs/pki@0.6.41",
       "dependsOn": []
     }
   ]