@blamejs/pki 0.8.55 → 0.8.57

package/lib/webcrypto.js

@@ -320,7 +320,7 @@ SubtleCrypto.prototype.encryptStream = async function encryptStream(spec, source
       if (step && step.done) break;
       var buf = _toBuf(step == null ? undefined : step.value, "encryptStream chunk");
       var piece = _cipherUpdate(cipher, buf);
-      if (piece && piece.length) out[out.length] = piece;
+      if (piece && piece.length) guard.list.append(out, piece);
     }
   } catch (e) {
     try {
@@ -329,7 +329,11 @@ SubtleCrypto.prototype.encryptStream = async function encryptStream(spec, source
     } catch (_r) { }
     throw e;
   }
-  out[out.length] = _cipherFinal(cipher);
+  /** @internal Each block is appended as an OWN property. An index assignment writes through Set,
+   * which walks the prototype for a numeric setter, so an accessor installed there takes the block
+   * and the index reads back as its getter's value: the final block carries the padding and, for an
+   * AEAD, is what the tag is computed over. */
+  guard.list.append(out, _cipherFinal(cipher));
   return { ciphertext: _bufferConcat(out), tag: spec.authTagLength ? _cipherGetAuthTag(cipher) : null };
 };
 
@@ -696,7 +700,10 @@ function _x963Kdf(hashNode, z, sharedInfo, lenBytes) {
   var blocks = [], counter = 1, got = 0;
   while (got < lenBytes) {
     if (counter > 0xffffffff) throw new WebCryptoError("webcrypto/operation", "X963KDF: requested output exceeds the counter range");
-    var ctr = _bufferAlloc(4); ctr.writeUInt32BE(counter, 0);
+    /** @internal The counter block is written with the capture. Each block of the derived key is the
+     * hash of the shared secret with this counter in it, so a replaced write makes two blocks derive
+     * from the same input and the key material repeats. */
+    var ctr = _bufferAlloc(4); intrinsic.writeUInt32BE(ctr, counter, 0);
     var h = nodeCrypto.createHash(hashNode).update(z).update(ctr).update(sharedInfo).digest();
     _push(blocks, h); got += h.length; counter += 1;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.55",
+  "version": "0.8.57",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:f7650379-6444-462e-bd4b-7cfbdc879bc7",
+  "serialNumber": "urn:uuid:114b9f0f-7681-4cab-8c6a-fcdbf8fd64af",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-06T04:32:24.064Z",
+    "timestamp": "2026-10-07T02:26:14.514Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.55",
+      "bom-ref": "@blamejs/pki@0.8.57",
       "type": "application",
       "name": "pki",
-      "version": "0.8.55",
+      "version": "0.8.57",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.55",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.57",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.55",
+      "ref": "@blamejs/pki@0.8.57",
       "dependsOn": []
     }
   ]