@blamejs/pki 0.8.57 → 0.8.59

package/lib/key.js

@@ -48,6 +48,10 @@ var _floor = intrinsic.floor;
 var _isFinite = intrinsic.isFinite;
 var _String = intrinsic.String;
 var _toUpperCase = intrinsic.toUpperCase;
+/** @internal The walk over an array LITERAL is captured too. The receiver is the literal rather than
+ *  a caller's value, but the method is still read off the live prototype at the moment it runs, and a
+ *  replacement decides which rows of a registry this module builds. */
+var _forEach = intrinsic.forEach;
 var _strIndexOf = intrinsic.stringIndexOf;
 
 var b = asn1.build;
@@ -60,13 +64,13 @@ function _err(code, msg, cause) { return new KeyError(code, msg, cause); }
 var CIPHER_NAME = _assign(_create(null), { "aes-128-cbc": "aes128-CBC", "aes-192-cbc": "aes192-CBC", "aes-256-cbc": "aes256-CBC" });
 
 var INFER_ALG = _create(null);
-["Ed25519", "Ed448", "X25519", "X448"].forEach(function (n) { INFER_ALG[O(n)] = { name: n }; });
-[["id-ml-dsa-44", "ML-DSA-44"], ["id-ml-dsa-65", "ML-DSA-65"], ["id-ml-dsa-87", "ML-DSA-87"],
- ["id-ml-kem-512", "ML-KEM-512"], ["id-ml-kem-768", "ML-KEM-768"], ["id-ml-kem-1024", "ML-KEM-1024"]
-].forEach(function (r) { INFER_ALG[O(r[0])] = { name: r[1] }; });
-["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
- "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
-].forEach(function (s) { INFER_ALG[O("id-slh-dsa-" + s)] = { name: _toUpperCase("SLH-DSA-" + s) }; });
+_forEach(["Ed25519", "Ed448", "X25519", "X448"], function (n) { INFER_ALG[O(n)] = { name: n }; });
+_forEach([["id-ml-dsa-44", "ML-DSA-44"], ["id-ml-dsa-65", "ML-DSA-65"], ["id-ml-dsa-87", "ML-DSA-87"],
+  ["id-ml-kem-512", "ML-KEM-512"], ["id-ml-kem-768", "ML-KEM-768"], ["id-ml-kem-1024", "ML-KEM-1024"]
+], function (r) { INFER_ALG[O(r[0])] = { name: r[1] }; });
+_forEach(["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
+  "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
+], function (s) { INFER_ALG[O("id-slh-dsa-" + s)] = { name: _toUpperCase("SLH-DSA-" + s) }; });
 
 function _isCryptoKey(x) { return webcrypto.isCryptoKeyLike(x); }
 function _algName(a) { return typeof a === "string" ? a : (a && a.name); }

package/lib/path-validate.js

@@ -179,9 +179,9 @@ _sig("Ed448", { name: "Ed448" }, { name: "Ed448" }, "absent", false, true);
 _sig("id-ml-dsa-44", { name: "ML-DSA-44" }, { name: "ML-DSA-44" }, "absent", false, true);
 _sig("id-ml-dsa-65", { name: "ML-DSA-65" }, { name: "ML-DSA-65" }, "absent", false, true);
 _sig("id-ml-dsa-87", { name: "ML-DSA-87" }, { name: "ML-DSA-87" }, "absent", false, true);
-["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
- "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
-].forEach(function (set) {
+intrinsic.forEach(["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
+  "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
+], function (set) {
   var wc = "SLH-DSA-" + set.toUpperCase();
   _sig("id-slh-dsa-" + set, { name: wc }, { name: wc }, "absent", false, true);
 });
@@ -304,7 +304,7 @@ function compositeKeyUsageCheck(cert) {
 }
 
 var STATEFUL_HBS_OIDS = intrinsic.create(null);
-["id-alg-hss-lms-hashsig", "id-alg-xmss-hashsig", "id-alg-xmssmt-hashsig"].forEach(function (n) { STATEFUL_HBS_OIDS[oid.byName(n)] = true; });
+intrinsic.forEach(["id-alg-hss-lms-hashsig", "id-alg-xmss-hashsig", "id-alg-xmssmt-hashsig"], function (n) { STATEFUL_HBS_OIDS[oid.byName(n)] = true; });
 
 /** @internal RFC 9802 sec. 6 states the rule twice, and the two differ: a certification authority's
  * certificate may assert keyCertSign, an end entity's may not. Both must assert at least one of the values
@@ -404,7 +404,7 @@ function statefulHbsKeyUsageCheck(cert, isCa) {
 }
 
 var ML_KEM_OIDS = intrinsic.create(null);
-["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"].forEach(function (n) { ML_KEM_OIDS[oid.byName(n)] = true; });
+intrinsic.forEach(["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"], function (n) { ML_KEM_OIDS[oid.byName(n)] = true; });
 
 function kemKeyUsageCheck(cert) {
   var ku;

package/lib/pki-build.js

@@ -359,8 +359,8 @@ var ATV_TYPE = intrinsic.assign(intrinsic.create(null), {
  *  pre-encoded value for one of them must be a member. An attribute with no published short
  *  name has a syntax this toolkit does not claim to know, and its value stays opaque. */
 var DIRECTORY_STRING_TAGS = intrinsic.assign(intrinsic.create(null), {});
-[asn1.TAGS.TELETEX_STRING, asn1.TAGS.PRINTABLE_STRING, asn1.TAGS.UNIVERSAL_STRING,
-  asn1.TAGS.UTF8_STRING, asn1.TAGS.BMP_STRING].forEach(function (t) { DIRECTORY_STRING_TAGS[t] = 1; });
+intrinsic.forEach([asn1.TAGS.TELETEX_STRING, asn1.TAGS.PRINTABLE_STRING, asn1.TAGS.UNIVERSAL_STRING,
+  asn1.TAGS.UTF8_STRING, asn1.TAGS.BMP_STRING], function (t) { DIRECTORY_STRING_TAGS[t] = 1; });
 
 var KU_BIT = intrinsic.assign(intrinsic.create(null), {
   digitalSignature: 0, nonRepudiation: 1, contentCommitment: 1, keyEncipherment: 2,
@@ -396,12 +396,12 @@ var SDA_ATTR_KEYS = intrinsic.assign(intrinsic.create(null), { type: 1, values:
  *  statement's set is refused rather than ignored: a misspelled field would otherwise be dropped and
  *  the certificate would carry a statement the caller did not write. */
 var QC_INFO_KEYS = intrinsic.create(null);
-[["qcType", { types: 1 }], ["qcIdentMethod", { methods: 1 }],
+intrinsic.forEach([["qcType", { types: 1 }], ["qcIdentMethod", { methods: 1 }],
   ["qcCClegislation", { countries: 1 }], ["qcQSCDlegislation", { countries: 1 }],
   ["qcRetentionPeriod", { years: 1 }], ["qcLimitValue", { currency: 1, amount: 1, exponent: 1 }],
   ["qcPDS", { locations: 1 }],
   ["qcsPkixQCSyntaxV1", { semanticsIdentifier: 1, nameRegistrationAuthorities: 1 }],
-  ["qcsPkixQCSyntaxV2", { semanticsIdentifier: 1, nameRegistrationAuthorities: 1 }]].forEach(function (r) {
+  ["qcsPkixQCSyntaxV2", { semanticsIdentifier: 1, nameRegistrationAuthorities: 1 }]], function (r) {
   QC_INFO_KEYS[oid.byName(r[0])] = intrinsic.assign(intrinsic.create(null), r[1]);
 });
 var QC_PDS_LOCATION_KEYS = intrinsic.assign(intrinsic.create(null), { url: 1, language: 1 });

package/lib/sign-scheme.js

@@ -69,10 +69,10 @@ function mldsaDigestSuitable(mlName, md) {
 }
 
 var SLHDSA_BY_OID = intrinsic.create(null);
-[["sha2-128s", "sha256"], ["sha2-128f", "sha256"], ["sha2-192s", "sha512"], ["sha2-192f", "sha512"],
- ["sha2-256s", "sha512"], ["sha2-256f", "sha512"], ["shake-128s", "shake128"], ["shake-128f", "shake128"],
- ["shake-192s", "shake256"], ["shake-192f", "shake256"], ["shake-256s", "shake256"], ["shake-256f", "shake256"]
-].forEach(function (r) { SLHDSA_BY_OID[O("id-slh-dsa-" + r[0])] = { wc: "SLH-DSA-" + r[0].toUpperCase(), digest: r[1] }; });
+intrinsic.forEach([["sha2-128s", "sha256"], ["sha2-128f", "sha256"], ["sha2-192s", "sha512"], ["sha2-192f", "sha512"],
+  ["sha2-256s", "sha512"], ["sha2-256f", "sha512"], ["shake-128s", "shake128"], ["shake-128f", "shake128"],
+  ["shake-192s", "shake256"], ["shake-192f", "shake256"], ["shake-256s", "shake256"], ["shake-256f", "shake256"]
+], function (r) { SLHDSA_BY_OID[O("id-slh-dsa-" + r[0])] = { wc: "SLH-DSA-" + _toUpperCase(r[0]), digest: r[1] }; });
 
 function _algId(name, shape) { return shape === "null" ? b.sequence([b.oid(O(name)), b.nullValue()]) : b.sequence([b.oid(O(name))]); }
 function _pssAlgId(digestName) {

package/lib/webcrypto.js

@@ -176,9 +176,9 @@ var ML_DSA_NODE = intrinsic.assign(intrinsic.create(null), { "ML-DSA-44": "ml-ds
 var ML_KEM_NODE = intrinsic.assign(intrinsic.create(null), { "ML-KEM-512": "ml-kem-512", "ML-KEM-768": "ml-kem-768", "ML-KEM-1024": "ml-kem-1024" });
 
 var SLH_DSA_NODE = intrinsic.create(null);
-["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
- "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
-].forEach(function (s) { SLH_DSA_NODE["SLH-DSA-" + _toUpperCase(s)] = "slh-dsa-" + s; });
+_forEach(["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
+  "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
+], function (s) { SLH_DSA_NODE["SLH-DSA-" + _toUpperCase(s)] = "slh-dsa-" + s; });
 
 var SIGN_VERIFY_NAMES = intrinsic.create(null);
 ["RSASSA-PKCS1-V1_5", "RSA-PSS", "ECDSA", "ED25519", "ED448", "HMAC"]
@@ -868,7 +868,7 @@ function _nodeKey(fn, who) {
 }
 
 var ML_KEM_INNER = intrinsic.create(null);
-["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"].forEach(function (n) {
+_forEach(["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"], function (n) {
   var row = oid.kemParams(n);
   ML_KEM_INNER[oid.byName(n)] = { ek: row.ek, dk: row.dk };
 });
@@ -1010,7 +1010,7 @@ var IMPORT_KEY_TYPE = intrinsic.assign(intrinsic.create(null), {
   "ED25519": _typeSet(["ed25519"]), "ED448": _typeSet(["ed448"]),
   "X25519": _typeSet(["x25519"]), "X448": _typeSet(["x448"]),
 });
-[ML_DSA_NODE, ML_KEM_NODE, SLH_DSA_NODE].forEach(function (m) {
+_forEach([ML_DSA_NODE, ML_KEM_NODE, SLH_DSA_NODE], function (m) {
   _forEach(_keys(m), function (webName) { IMPORT_KEY_TYPE[webName] = _typeSet([m[webName]]); });
 });
 function _algFromImport(name, alg, keyObject) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.57",
+  "version": "0.8.59",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:114b9f0f-7681-4cab-8c6a-fcdbf8fd64af",
+  "serialNumber": "urn:uuid:2b5749b0-053a-41de-947c-63a7a8df8028",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-07T02:26:14.514Z",
+    "timestamp": "2026-10-07T05:12:27.182Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.57",
+      "bom-ref": "@blamejs/pki@0.8.59",
       "type": "application",
       "name": "pki",
-      "version": "0.8.57",
+      "version": "0.8.59",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.57",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.59",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.57",
+      "ref": "@blamejs/pki@0.8.59",
       "dependsOn": []
     }
   ]