@blamejs/pki 0.8.58 → 0.8.59

package/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.8.59 — 2026-10-07
+
+Render an object identifier, match a header name and read a media type through operations a replacement cannot answer.
+
+### Changed
+
+- The check that holds these modules to captured operations now counts a method reached through an index, not only one reached through a call. It is the same receiver one bracket over, and the earlier form could not see it: two live copies in the RFC 5280 policy-mapping walk, where the copy becomes a node's expected policy set, were found by other means.
+
+### Fixed
+
+- An object identifier is rendered to its dotted form through operations bound when the module loaded, and its arcs are collected by defining each index rather than by appending to the array. Three different replacements each decided that string, which is the value `pki.oid` resolves, which selects a signature algorithm and which names an extension: a replaced integer conversion made the content octets of `1.2.3` render as `1.3.4`, and an accessor inherited at the first index of every array took each arc as it was collected and made the same octets render as `0.1.3`. Appending stores at an index, and a store consults the prototype chain for a setter, so a list this build assembles is now built by defining its indexes.
+- A media type is read on the delimiter character and folded through a captured conversion, in `pki.acme`, `pki.cmp` and `pki.ct`. The token decides which parser a response body is handed to, and it was produced by splitting, trimming and folding through live operations. Splitting is now a character scan, which this toolkit requires in its libraries because a separator's own split hook is part of that operation.
+- `pki.est` reads a content-type parameter through captured operations, and collects the segments it searches by defining each index. That is where the RFC 7030 multipart boundary comes from, so the value decides where a multi-part response is divided: measured, a header declaring `boundary=wire` yielded `forged`, both through a replaced append and through an accessor inherited at an array index. The name comparison that selects a parameter, the slicing that extracts it and the quote stripping around it were each live, as were the name and value of every header on a part, which is where a part's own content type comes from: measured, a part declaring `application/pkcs8` was read as `application/pkcs7-mime` carrying `smime-type=certs-only`. Its two case-insensitive header lookups are folded through the capture on both sides of the comparison.
+- `pki.acme` parses a Link header through captured operations: the header is divided into links, each link into parameters, and the target cut out of its angle brackets, all through operations bound when the module loaded. The relation decides whether a header names a resource the client will follow and the target is the URL it would fetch, and both were produced by methods read off the live prototype: measured, a header stating one alternate chain resolved to a different URL.
+- `pki.cmc.build` selects which request arm a message carries through a selection that reads each candidate once and builds its own result, rather than through a method that is both read off the prototype and specified to construct its result through a replaceable protocol.
+- The algorithm, extension and criticality tables that `pki.path.validate`, `pki.cms`, `pki.crl`, `pki.key`, `pki.webcrypto`, `pki.x509` and the signature-scheme registry build when they load are built through captured walks, so a replacement installed before a module loads cannot decide which rows exist.
+
 ## v0.8.58 — 2026-10-07
 
 Connect under the trust anchors, the address and the identity check the request named, not the ones a second read answers with.

package/lib/acme.js

@@ -88,6 +88,7 @@ var _sortI = intrinsic.sort;
 var _objectKeys = intrinsic.keys;
 var _lower = intrinsic.toLowerCase;
 var _StringI = intrinsic.String;
+var _acmeTrim = intrinsic.uncurry(String.prototype.trim);
 var _stringify = intrinsic.stringify;
 var _push = intrinsic.push;
 var _pop = intrinsic.pop;
@@ -98,6 +99,7 @@ var _split = intrinsic.uncurry(String.prototype.split);
 var _parseIntI = intrinsic.parseInt;
 var _numToString = intrinsic.numberToString;
 var _strSlice = intrinsic.uncurry(String.prototype.slice);
+var _charAtA = intrinsic.uncurry(String.prototype.charAt);
 var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 var _charAt = intrinsic.uncurry(String.prototype.charAt);
 var pkgVersion = require("../package.json").version;
@@ -1707,61 +1709,71 @@ function _hasCtlOctet(s) {
 }
 
 function _splitLinkValues(s) {
+  /** @internal The header is cut through the captured operations, the same as the parameters below:
+   *  each piece becomes a link whose relation decides whether this client follows it. */
   var out = [], start = 0, inAngle = false, inQuote = false;
   for (var i = 0; i < s.length; i++) {
-    var ch = s.charAt(i);
+    var ch = _charAtA(s, i);
     if (inQuote) { if (ch === "\\") { i++; continue; } if (ch === "\"") inQuote = false; continue; }
     if (ch === "\"") { inQuote = true; continue; }
     if (ch === "<") inAngle = true;
     else if (ch === ">") inAngle = false;
-    else if (ch === "," && !inAngle) { out.push(s.slice(start, i)); start = i + 1; }
+    else if (ch === "," && !inAngle) { intrinsic.append(out, _strSlice(s, start, i)); start = i + 1; }
   }
   if (inQuote || inAngle) throw E("acme/bad-link", "the Link header has an unterminated quote or angle bracket (RFC 8288)");
-  out.push(s.slice(start));
+  intrinsic.append(out, _strSlice(s, start));
   return out;
 }
 function _splitLinkParams(rest) {
   var parts = [], start = 0, inQuote = false;
   for (var i = 0; i < rest.length; i++) {
-    var ch = rest.charAt(i);
+    var ch = _charAtA(rest, i);
     if (inQuote) { if (ch === "\\") { i++; continue; } if (ch === "\"") inQuote = false; continue; }
     if (ch === "\"") inQuote = true;
-    else if (ch === ";") { parts.push(rest.slice(start, i)); start = i + 1; }
+    else if (ch === ";") { intrinsic.append(parts, _strSlice(rest, start, i)); start = i + 1; }
   }
-  parts.push(rest.slice(start));
+  intrinsic.append(parts, _strSlice(rest, start));
   var out = [];
   for (var j = 0; j < parts.length; j++) {
     var p = _trimOWS(parts[j]);
     if (p === "") { if (j === 0) continue; throw E("acme/bad-link", "an empty Link parameter (a ';' with no parameter) is malformed (RFC 8288): " + JSON.stringify(rest)); }
-    var eq = p.indexOf("=");
-    var name = (eq === -1 ? p : _trimOWS(p.slice(0, eq))).toLowerCase();
+    /** @internal The parameter name and value are cut and folded through the captured operations.
+     *  A Link parameter is what names the relation this client follows, and read off the prototype a
+     *  replacement chose it: measured, a header stating `rel=next` parsed as `alternate`. */
+    var eq = intrinsic.stringIndexOf(p, "=");
+    var name = _lower(eq === -1 ? p : _trimOWS(_strSlice(p, 0, eq)));
     if (!pkix.allCharsIn(name, _LINK_TOKEN_TABLE)) throw E("acme/bad-link", "a Link parameter name must be a token (RFC 8288 / RFC 7230): " + JSON.stringify(p));
-    if (eq === -1) { out.push({ name: name, value: "", hasValue: false }); continue; }
-    var v = _trimOWS(p.slice(eq + 1));
-    if (v.length >= 2 && v.charAt(0) === "\"" && v.charAt(v.length - 1) === "\"") {
-      var inner = v.slice(1, -1);
+    if (eq === -1) { intrinsic.append(out, { name: name, value: "", hasValue: false }); continue; }
+    var v = _trimOWS(_strSlice(p, eq + 1));
+    if (v.length >= 2 && _charAtA(v, 0) === "\"" && _charAtA(v, v.length - 1) === "\"") {
+      var inner = _strSlice(v, 1, -1);
       if (!_isValidQuotedInterior(inner)) throw E("acme/bad-link", "a quoted Link parameter value is malformed (an unescaped quote or dangling backslash, RFC 7230): " + JSON.stringify(p));
       v = _unescapeQuotedPair(inner);
     } else if (!pkix.allCharsIn(v, _LINK_TOKEN_TABLE)) {
       throw E("acme/bad-link", "an unquoted Link parameter value must be a non-empty token (RFC 8288 / RFC 7230): " + JSON.stringify(p));
     }
-    out.push({ name: name, value: v, hasValue: true });
+    intrinsic.append(out, { name: name, value: v, hasValue: true });
   }
   return out;
 }
 function _relHas(rel, relName) {
-  var toks = String(rel).split(" ");
-  for (var i = 0; i < toks.length; i++) { if (toks[i].toLowerCase() === relName) return true; }
+  /** @internal The relation names are scanned on the delimiter CHARACTER, which hard rule 11 requires
+   *  in lib/, and each token is folded through the captured conversion: the match decides whether a
+   *  Link header names the resource this client then follows. */
+  var toks = intrinsic.splitChar(_StringI(rel), 32);
+  for (var i = 0; i < toks.length; i++) { if (_lower(toks[i]) === relName) return true; }
   return false;
 }
 function _parseLinkValue(raw) {
   var s = _trimOWS(raw);
   if (s === "") return null;
-  var gt = s.indexOf(">");
-  if (s.charAt(0) !== "<" || gt === -1) throw E("acme/bad-link", "a Link value must be <URI-Reference> with parameters (RFC 8288): " + JSON.stringify(raw));
+  var gt = intrinsic.stringIndexOf(s, ">");
+  if (_charAtA(s, 0) !== "<" || gt === -1) throw E("acme/bad-link", "a Link value must be <URI-Reference> with parameters (RFC 8288): " + JSON.stringify(raw));
   var rest = _stripLeadingOWS(s, gt + 1);
-  if (rest !== "" && rest.charAt(0) !== ";") throw E("acme/bad-link", "a Link value's parameters must be introduced by ';' (RFC 8288): " + JSON.stringify(raw));
-  var uri = s.slice(1, gt);
+  if (rest !== "" && _charAtA(rest, 0) !== ";") throw E("acme/bad-link", "a Link value's parameters must be introduced by ';' (RFC 8288): " + JSON.stringify(raw));
+  /** @internal The target this client may follow is cut through the captured operation: read off the
+   *  prototype, a replacement decided the URL a Link header resolves to. */
+  var uri = _strSlice(s, 1, gt);
   if (_linkUriInvalid(uri)) throw E("acme/bad-link", "a Link URI-Reference contains a character, percent-escape, or encoded dot-segment not permitted by RFC 3986: " + JSON.stringify(raw));
   var params = _splitLinkParams(rest), rel = "", relSeen = false, anchor = null, anchorSeen = false;
   for (var i = 0; i < params.length; i++) {
@@ -1780,14 +1792,16 @@ function _parseLinkRelation(headers, base, relName, opts) {
   var raw = null;
   var hNames = guard.identifier.optionNames(headers);
   for (var hi = 0; hi < hNames.length; hi++) {
-    if (hNames[hi].toLowerCase() === "link") { raw = headers[hNames[hi]]; break; }
+    if (_lower(hNames[hi]) === "link") { raw = headers[hNames[hi]]; break; }
   }
   if (raw == null) return [];
   var baseUrl = new _URL(base), baseOrigin = _urlOrigin(baseUrl), baseHref = _urlHref(baseUrl);
   var baseKey = _dedupKey(baseHref);
-  var fields = Array.isArray(raw) ? raw : [raw], out = [], seen = Object.create(null), distinctCount = 0, totalBytes = 0;
+  var fields = intrinsic.isArray(raw) ? raw : [raw], out = [], seen = intrinsic.create(null), distinctCount = 0, totalBytes = 0;
   for (var fi = 0; fi < fields.length; fi++) {
-    var field = String(fields[fi]);
+    /** @internal The header field is converted through the capture: read through the live global, a
+     *  replacement supplied the whole Link header and with it the target this client resolves. */
+    var field = _StringI(fields[fi]);
     totalBytes += field.length + 1;
     if (totalBytes > LINK_HEADER_MAX_BYTES) throw E("acme/bad-link", "the Link header(s) exceed the " + LINK_HEADER_MAX_BYTES + "-byte aggregate cap (RFC 8288, CWE-770)");
     if (_hasCtlOctet(field)) throw E("acme/bad-link", "a Link header must not contain control octets (RFC 9110 field-value)");
@@ -2202,7 +2216,8 @@ function client(directoryUrl, opts) {
   function _pollAuthorization(url, budget) { return _poll("authorization", url, budget); }
 
   function _readCertChain(res) {
-    var ctToken = String(res.headers["content-type"] || "").split(";")[0].trim().toLowerCase();
+    var ctParts = intrinsic.splitChar(_StringI(res.headers["content-type"] || ""), 59);
+    var ctToken = _lower(_acmeTrim(ctParts.length ? ctParts[0] : ""));
     if (ctToken !== "application/pem-certificate-chain") throw E("acme/bad-certificate-chain", "the certificate download returned an unexpected media type " + JSON.stringify(ctToken) + " (expected application/pem-certificate-chain, RFC 8555 sec. 7.4.2)");
     var chain = _splitPemChain(_bodyText(res));
     return { certificate: chain[0], chain: chain.slice(1), certificates: chain };

package/lib/asn1-der.js

@@ -566,8 +566,16 @@ function decodeOidContent(buf) {
           "OBJECT IDENTIFIER carries more than " + constants.LIMITS.OID_MAX_SUBIDENTIFIERS + " sub-identifiers");
       }
       var value = 0n;
-      for (var k = arcStart; k <= i; k++) value = value * 128n + BigInt(buf[k] & 0x7f);
-      arcs.push(value);
+      /** @internal The arc is accumulated through the captured conversion. Read off the global, a
+       *  replacement decides the sub-identifier, and therefore the dotted string every algorithm and
+       *  extension decision in this toolkit is made on: measured, the same two bytes rendered as
+       *  `1.2.3` and as `1.2.4`. */
+      for (var k = arcStart; k <= i; k++) value = value * 128n + intrinsic.BigInt(buf[k] & 0x7f);
+      /** @internal `append`, not a captured `push`: appending with `push` STORES at the index, and a
+       *  store walks the prototype chain for a setter, so an accessor installed at
+       *  `Array.prototype[0]` took the arc and answered with another. `append` defines the index on
+       *  the array itself. */
+      intrinsic.append(arcs, value);
       arcStart = i + 1;
     }
   }
@@ -577,9 +585,12 @@ function decodeOidContent(buf) {
   if (first < 40n) { a1 = 0n; a2 = first; }
   else if (first < 80n) { a1 = 1n; a2 = first - 40n; }
   else { a1 = 2n; a2 = first - 80n; }
-  var out = [a1.toString(), a2.toString()];
-  for (var j = 1; j < arcs.length; j++) out.push(arcs[j].toString());
-  return out.join(".");
+  /** @internal Each arc is rendered through the captured conversion. Read off the prototype, the
+   *  value that becomes the dotted identifier is whatever a replacement returns, and the identifier
+   *  is what every algorithm and extension decision in this toolkit is made on. */
+  var out = [intrinsic.bigIntToString(a1, 10), intrinsic.bigIntToString(a2, 10)];
+  for (var j = 1; j < arcs.length; j++) intrinsic.append(out, intrinsic.bigIntToString(arcs[j], 10));
+  return intrinsic.join(out, ".");
 }
 
 function _decodeText(buf, encoding) {

package/lib/cmc-build.js

@@ -173,7 +173,10 @@ function fixedRequestId(req, index) {
     return "unknown field " + JSON.stringify(k) + " on request " + index +
       " -- a request names one of tcr / crm / orm, and optionally bodyPartID";
   });
-  var arms = ["tcr", "crm", "orm"].filter(function (k) { return req[k] != null; });
+  /** @internal `selectList`, not the live `filter`: the selection decides which request arm this
+   *  message carries, and `Array.prototype.filter` is both read off the prototype and specified to
+   *  build its result through the species constructor. */
+  var arms = intrinsic.selectList(["tcr", "crm", "orm"], function (k) { return req[k] != null; });
   if (arms.length !== 1) {
     throw E("cmc/bad-input",
       "each request names exactly one of tcr / crm / orm, got " + (arms.length ? arms.join(" + ") : "none") +

package/lib/cmp-build.js

@@ -29,6 +29,7 @@ var cmp = require("./schema-cmp");
 var crmf = require("./crmf-sign");
 var schemaCrmf = require("./schema-crmf");
 var intrinsic = require("./guard-intrinsic");
+var _strTrim = intrinsic.uncurry(String.prototype.trim);
 /** @internal The promise a signature self-check is awaited through, built from the constructor captured
  *  at load. `Promise.resolve` builds from its RECEIVER, so reading the global binding at the call hands
  *  the construction to whatever that binding holds, and one settling without awaiting its argument runs
@@ -1012,7 +1013,15 @@ function _tlsForTransfer(opts) {
   return guard.identifier.pickSettings(opts.tls, TLS_SETTINGS);
 }
 
-function _ctypeToken(headers) { return String((headers || {})["content-type"] || "").split(";")[0].trim().toLowerCase(); }
+/** @internal The media type is read through the captured operations, and on the delimiter CHARACTER
+ *  rather than through `split`, which hard rule 11 bans in lib/ because the separator's own
+ *  `Symbol.split` is part of that operation. The token decides which parser a response body is
+ *  handed to. */
+function _ctypeToken(headers) {
+  var raw = intrinsic.String((headers || {})["content-type"] || "");
+  var parts = intrinsic.splitChar(raw, 59);
+  return intrinsic.toLowerCase(_strTrim(parts.length ? parts[0] : ""));
+}
 function _isPkixcmp(headers) { var t = _ctypeToken(headers); return t === PKIXCMP || t === PKIXCMP_POLL; }
 
 /** @internal The sentinel is added at the one exit rather than at each `return`, so a branch added

package/lib/cms-decrypt.js

@@ -631,9 +631,13 @@ var HASH_W3C = intrinsic.create(null); HASH_W3C[O("sha1")] = "SHA-1"; HASH_W3C[O
 function _hashW3c(o) { if (!HASH_W3C[o]) throw _err("cms/unsupported-algorithm", "unsupported OAEP hash " + o); return HASH_W3C[o]; }
 
 var X963_HASH = intrinsic.create(null);
-[["dhSinglePass-stdDH-sha1kdf-scheme", "SHA-1"], ["dhSinglePass-stdDH-sha224kdf-scheme", "SHA-224"], ["dhSinglePass-stdDH-sha256kdf-scheme", "SHA-256"], ["dhSinglePass-stdDH-sha384kdf-scheme", "SHA-384"], ["dhSinglePass-stdDH-sha512kdf-scheme", "SHA-512"],
+var _X963_ROWS = [["dhSinglePass-stdDH-sha1kdf-scheme", "SHA-1"], ["dhSinglePass-stdDH-sha224kdf-scheme", "SHA-224"], ["dhSinglePass-stdDH-sha256kdf-scheme", "SHA-256"], ["dhSinglePass-stdDH-sha384kdf-scheme", "SHA-384"], ["dhSinglePass-stdDH-sha512kdf-scheme", "SHA-512"],
  ["dhSinglePass-cofactorDH-sha1kdf-scheme", "SHA-1"], ["dhSinglePass-cofactorDH-sha224kdf-scheme", "SHA-224"], ["dhSinglePass-cofactorDH-sha256kdf-scheme", "SHA-256"], ["dhSinglePass-cofactorDH-sha384kdf-scheme", "SHA-384"], ["dhSinglePass-cofactorDH-sha512kdf-scheme", "SHA-512"]
-].forEach(function (r) { X963_HASH[O(r[0])] = r[1]; });
+];
+/** @internal The registry is built through the captured walk. The method is read off the live
+ *  prototype at the moment it runs even where the receiver is a literal, and these rows decide which
+ *  hash a key-agreement recipient's KDF uses. */
+intrinsic.forEach(_X963_ROWS, function (r) { X963_HASH[O(r[0])] = r[1]; });
 function _x963Hash(scheme) { if (!X963_HASH[scheme]) throw _err("cms/unsupported-algorithm", "unsupported kari key-agreement scheme " + scheme); return X963_HASH[scheme]; }
 function _kariWrap(kea) {
   var params = asn1.decode(kea.parameters);

package/lib/cms-verify.js

@@ -126,9 +126,9 @@ var SIG_SCHEME = intrinsic.assign(intrinsic.create(null), {
   ecdsaWithSHA384: { kind: "ec", hash: "SHA-384", params: "absent" },
   ecdsaWithSHA512: { kind: "ec", hash: "SHA-512", params: "absent" },
 });
-["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
- "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
-].forEach(function (s) { SIG_SCHEME["id-slh-dsa-" + s] = { kind: "slhdsa", name: "SLH-DSA-" + s.toUpperCase(), params: "absent", sameKeyOid: true, digest: SLHDSA_BY_OID[oid.byName("id-slh-dsa-" + s)].digest }; });
+intrinsic.forEach(["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
+  "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
+], function (s) { SIG_SCHEME["id-slh-dsa-" + s] = { kind: "slhdsa", name: "SLH-DSA-" + intrinsic.toUpperCase(s), params: "absent", sameKeyOid: true, digest: SLHDSA_BY_OID[oid.byName("id-slh-dsa-" + s)].digest }; });
 function _isDerNull(p) { return guard.der.isNull(p); }
 function _algParamsOk(shape, p) { return shape === "null" ? _isDerNull(p) : (p === null || p === undefined); }
 var EC_CURVE = intrinsic.create(null);

package/lib/crl-sign.js

@@ -108,8 +108,8 @@ var KNOWN_REVOKED_KEYS = intrinsic.assign(intrinsic.create(null), {
 });
 
 var REQUIRED_CRITICALITY = intrinsic.create(null);
-[["cRLNumber", false], ["authorityKeyIdentifier", false], ["freshestCRL", false], ["authorityInfoAccess", false],
-  ["issuingDistributionPoint", true], ["deltaCRLIndicator", true]].forEach(function (r) { REQUIRED_CRITICALITY[O(r[0])] = r[1]; });
+intrinsic.forEach([["cRLNumber", false], ["authorityKeyIdentifier", false], ["freshestCRL", false], ["authorityInfoAccess", false],
+  ["issuingDistributionPoint", true], ["deltaCRLIndicator", true]], function (r) { REQUIRED_CRITICALITY[O(r[0])] = r[1]; });
 
 var REQUIRED_ENTRY_CRITICALITY = intrinsic.create(null);
 (function () {
@@ -199,7 +199,7 @@ var _PRE_ENCODED_IDP_SCHEMA = pkix.issuingDistributionPoint("crl/bad-idp");
 function _validatePreEncodedIdp(inner) {
   if (!inner.children || !inner.children.length) throw _err("crl/bad-idp", "pre-encoded issuingDistributionPoint MUST NOT be empty (RFC 5280 sec. 5.2.5)");
   var f = schema.walk(_PRE_ENCODED_IDP_SCHEMA, inner, NS).fields;
-  ["onlyContainsUserCerts", "onlyContainsCACerts", "onlyContainsAttributeCerts"].forEach(function (name) {
+  intrinsic.forEach(["onlyContainsUserCerts", "onlyContainsCACerts", "onlyContainsAttributeCerts"], function (name) {
     if (f[name].present && f[name].value !== true) throw _err("crl/bad-idp", "pre-encoded issuingDistributionPoint " + name + " encodes its DEFAULT FALSE, which DER omits (X.690 sec. 11.5)");
   });
   if (f.indirectCRL.present) throw _err("crl/bad-idp", _INDIRECT_IDP_DEFERRED);

package/lib/ct.js

@@ -63,6 +63,7 @@ var _bufToString = intrinsic.bufToString;
 var _bufferCompare = intrinsic.compare;
 var _subarray = intrinsic.subarray;
 var _toLowerCase = intrinsic.toLowerCase;
+var _ctTrim = intrinsic.uncurry(String.prototype.trim);
 var _bufCopy = intrinsic.uncurry(Buffer.prototype.copy);
 var _writeU64BE = intrinsic.uncurry(Buffer.prototype.writeBigUInt64BE);
 var _searchSet = intrinsic.uncurry(URLSearchParams.prototype.set);
@@ -1230,7 +1231,15 @@ function _assertTransport(opts) {
     "(request) => Promise<{ status, headers, body }>");
 }
 
-function _fetchCtypeToken(headers) { return String((headers || {})["content-type"] || "").split(";")[0].trim().toLowerCase(); }
+/** @internal The media type is read through the captured operations, and on the delimiter CHARACTER
+ *  rather than through `split`, which hard rule 11 bans in lib/ because the separator's own
+ *  `Symbol.split` is part of that operation. The token decides which parser a log's response body is
+ *  handed to. */
+function _fetchCtypeToken(headers) {
+  var raw = intrinsic.String((headers || {})["content-type"] || "");
+  var parts = intrinsic.splitChar(raw, 59);
+  return _toLowerCase(_ctTrim(parts.length ? parts[0] : ""));
+}
 
 function _parseHttpsUrl(u, label) {
   var parsed;

package/lib/est.js

@@ -76,6 +76,9 @@ var intrinsic = require("./guard-intrinsic");
 var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 var _strSlice = intrinsic.uncurry(String.prototype.slice);
 var _toLowerCase = intrinsic.uncurry(String.prototype.toLowerCase);
+var _estTrim = intrinsic.uncurry(String.prototype.trim);
+var _estCharAt = intrinsic.uncurry(String.prototype.charAt);
+var _estIndexOf = intrinsic.stringIndexOf;
 /** @internal Each verb gates its body on a resolved promise and returns its refusals as rejected ones,
  *  and both build from the RECEIVER, so reading the global binding at the call decides whether the body
  *  runs and whether a refusal stays a refusal. Taken at load. */
@@ -250,7 +253,7 @@ function _isMultipartMixedPrefix(ct) {
 }
 
 function _multipartBoundary(contentType) {
-  var ct = String(contentType || "");
+  var ct = _stringOf(contentType || "");
   if (!_isMultipartMixedPrefix(ct)) return null;
   var bp = _ctParam(ct, "boundary");
   if (bp.duplicated) {
@@ -356,12 +359,16 @@ function splitMultipartMixed(body, contentType) {
     var lines = _splitCrlf(_unfoldHeaders(rawHeaders));
     for (var li = 0; li < lines.length; li++) {
       var line = lines[li];
-      var col = line.indexOf(":");
-      if (col > 0) headers[line.slice(0, col).trim().toLowerCase()] = line.slice(col + 1).trim();
+      /** @internal A part's header name and value are cut, trimmed and folded through the captured
+       *  operations. One of those headers is the part's own content type, which selects the reader
+       *  its body goes to: measured, a part stating `application/pkcs8` was read as
+       *  `application/pkcs7-mime` with a `smime-type` of `certs-only`. */
+      var col = _estIndexOf(line, ":");
+      if (col > 0) headers[_toLowerCase(_estTrim(_strSlice(line, 0, col)))] = _estTrim(_strSlice(line, col + 1));
     }
     var partCt = headers["content-type"] || "";
     if (_ciStartsWith(partCt, "MULTIPART/")) throw E("est/bad-multipart", "a nested multipart part is not permitted");
-    parts.push({ headers: headers, contentType: partCt, body: partBody });
+    intrinsic.append(parts, { headers: headers, contentType: partCt, body: partBody });
   }
   return parts;
 }
@@ -457,29 +464,37 @@ function _recipientMatches(recipientInfos, opts) {
   return false;
 }
 
+/** @internal The segments are collected through the captured append. Read off the prototype, a
+ *  replacement decides which segments a parameter is then looked for in, and one of those parameters
+ *  is the multipart boundary a response body is divided on: measured, a `boundary=wire` header
+ *  yielded `forged`. */
 function _splitContentTypeParams(s) {
   var segs = [], cur = "", inQuote = false;
   for (var i = 0; i < s.length; i++) {
-    var ch = s[i];
+    var ch = _estCharAt(s, i);
     if (ch === '"') { inQuote = !inQuote; cur += ch; }
-    else if (ch === ";" && !inQuote) { segs.push(cur); cur = ""; }
+    else if (ch === ";" && !inQuote) { intrinsic.append(segs, cur); cur = ""; }
     else cur += ch;
   }
-  segs.push(cur);
+  intrinsic.append(segs, cur);
   return segs;
 }
 
 function _ctParam(contentType, name) {
-  var segs = _splitContentTypeParams(String(contentType || ""));
+  var segs = _splitContentTypeParams(_stringOf(contentType || ""));
   var value = null, count = 0;
+  /** @internal Each parameter is read through the captured operations. The name decides which
+   *  parameter this is, and the value it returns is the one a caller acts on: for the RFC 7030
+   *  multipart boundary, it is where a response body is split. */
   for (var i = 1; i < segs.length; i++) {
-    var eq = segs[i].indexOf("=");
+    var seg = segs[i];
+    var eq = _estIndexOf(seg, "=");
     if (eq === -1) continue;
-    if (segs[i].slice(0, eq).trim().toLowerCase() !== name) continue;
+    if (_toLowerCase(_estTrim(_strSlice(seg, 0, eq))) !== name) continue;
     count++;
     if (count > 1) continue;
-    var val = segs[i].slice(eq + 1).trim();
-    if (val.length >= 2 && val.charAt(0) === '"' && val.charAt(val.length - 1) === '"') val = val.slice(1, -1);
+    var val = _estTrim(_strSlice(seg, eq + 1));
+    if (val.length >= 2 && _estCharAt(val, 0) === '"' && _estCharAt(val, val.length - 1) === '"') val = _strSlice(val, 1, -1);
     value = val;
   }
   return { value: value, duplicated: count > 1 };
@@ -501,12 +516,15 @@ function _mediaType(seg) {
   return _toLowerCase(_strSlice(seg, a, b));
 }
 
+/** @internal The media type and the S/MIME type are produced through the captured conversions. The
+ *  media type selects which reader a part's body goes to, and read through the live global `String`
+ *  a replacement chose it: measured, `text/plain` arrived as `application/pkcs8`. */
 function _partMediaType(contentType) {
-  var segs = _splitContentTypeParams(String(contentType || ""));
+  var segs = _splitContentTypeParams(_stringOf(contentType || ""));
   var st = _ctParam(contentType, "smime-type");
   return {
     media: _mediaType(segs[0]),
-    smimeType: st.value === null ? null : st.value.toLowerCase(),
+    smimeType: st.value === null ? null : _toLowerCase(st.value),
     ambiguous: st.duplicated,
   };
 }
@@ -1279,7 +1297,7 @@ function _requestBinding(der) {
   var body = cmcFmt.parse(der);
   var ids = [];
   var paths = [];
-  [body.requests, body.controls, body.cmsSequence, body.otherMsgs].forEach(function (list) {
+  intrinsic.forEach([body.requests, body.controls, body.cmsSequence, body.otherMsgs], function (list) {
     (list || []).forEach(function (el) {
       if (el && el.bodyPartID != null) { ids.push(el.bodyPartID); paths.push([el.bodyPartID]); }
     });
@@ -1325,7 +1343,7 @@ function _collectNestedPaths(list, prefix, out, depth) {
     catch (_e) { /* allow:swallow-unverified the outer request must itself parse for this to run, which already rejects a malformed nested ContentInfo; a payload that survives that and still fails to read back lands on the same no-path refusal the non-pkiData route below takes, which the vectors drive */ return; }
     if (!inner || inner.kind !== "pkiData") return;
     var path = prefix.concat([el.bodyPartID]);
-    [inner.requests, inner.controls, inner.cmsSequence, inner.otherMsgs].forEach(function (l) {
+    intrinsic.forEach([inner.requests, inner.controls, inner.cmsSequence, inner.otherMsgs], function (l) {
       (l || []).forEach(function (e2) { if (e2 && e2.bodyPartID != null) out.push(path.concat([e2.bodyPartID])); });
     });
     _collectNestedPaths(inner.cmsSequence, path, out, depth + 1);
@@ -1405,7 +1423,7 @@ function _fullcmcResult(res, opts, wanted, sent) {
   }
   var smimeType = pt200.smimeType;
   if (smimeType === "certs-only") {
-    var unecho = ["transactionId", "senderNonce", "dataReturn"].filter(function (k) {
+    var unecho = intrinsic.selectList(["transactionId", "senderNonce", "dataReturn"], function (k) {
       return sent[k] != null;
     });
     if (unecho.length) {
@@ -1731,21 +1749,23 @@ function _assertConfidentialCipher(res) {
 
 function _ciHeaderList(headers, name) {
   headers = headers || {};
-  var lname = name.toLowerCase(), keys = guard.identifier.optionNames(headers), parts = [];
+  /** @internal The header NAME a value is selected under is folded through the captured conversion on
+   *  both sides of the comparison: the match decides which header this response is read from. */
+  var lname = _toLowerCase(name), keys = guard.identifier.optionNames(headers), parts = [];
   for (var i = 0; i < keys.length; i++) {
-    if (keys[i].toLowerCase() !== lname) continue;
+    if (_toLowerCase(keys[i]) !== lname) continue;
     var v = headers[keys[i]];
     if (v == null) continue;
-    parts.push(Array.isArray(v) ? v.join(", ") : String(v));
+    intrinsic.append(parts, intrinsic.isArray(v) ? intrinsic.join(v, ", ") : _stringOf(v));
   }
-  return parts.length ? parts.join(", ") : null;
+  return parts.length ? intrinsic.join(parts, ", ") : null;
 }
 
 function _ciHeader(headers, name) {
   headers = headers || {};
-  var lname = name.toLowerCase(), keys = guard.identifier.optionNames(headers), found = null, n = 0;
+  var lname = _toLowerCase(name), keys = guard.identifier.optionNames(headers), found = null, n = 0;
   for (var i = 0; i < keys.length; i++) {
-    if (keys[i].toLowerCase() !== lname) continue;
+    if (_toLowerCase(keys[i]) !== lname) continue;
     n += 1;
     if (n === 1) found = headers[keys[i]];
   }

package/lib/guard-identifier.js

@@ -257,7 +257,7 @@ var _CONCRETE_TYPED_MEMBERS = ["BYTES_PER_ELEMENT"];
 var _BUFFER_PROTO_MEMBERS = ["parent", "offset"];
 
 var _ARRAY_MEMBERS = _ARRAY_PROTO_MEMBERS;
-var _REGEXP_MEMBERS = ["lastIndex"].concat(_REGEXP_PROTO_MEMBERS);
+var _REGEXP_MEMBERS = intrinsic.concatList(["lastIndex"], _REGEXP_PROTO_MEMBERS);
 var _VIEW_MEMBERS = _TYPED_PROTO_MEMBERS.concat(_CONCRETE_TYPED_MEMBERS);
 var _BUFFER_KIND_MEMBERS = _VIEW_MEMBERS.concat(_BUFFER_PROTO_MEMBERS);
 var _DATAVIEW_MEMBERS = _DATAVIEW_PROTO_MEMBERS;

package/lib/key.js

@@ -48,6 +48,10 @@ var _floor = intrinsic.floor;
 var _isFinite = intrinsic.isFinite;
 var _String = intrinsic.String;
 var _toUpperCase = intrinsic.toUpperCase;
+/** @internal The walk over an array LITERAL is captured too. The receiver is the literal rather than
+ *  a caller's value, but the method is still read off the live prototype at the moment it runs, and a
+ *  replacement decides which rows of a registry this module builds. */
+var _forEach = intrinsic.forEach;
 var _strIndexOf = intrinsic.stringIndexOf;
 
 var b = asn1.build;
@@ -60,13 +64,13 @@ function _err(code, msg, cause) { return new KeyError(code, msg, cause); }
 var CIPHER_NAME = _assign(_create(null), { "aes-128-cbc": "aes128-CBC", "aes-192-cbc": "aes192-CBC", "aes-256-cbc": "aes256-CBC" });
 
 var INFER_ALG = _create(null);
-["Ed25519", "Ed448", "X25519", "X448"].forEach(function (n) { INFER_ALG[O(n)] = { name: n }; });
-[["id-ml-dsa-44", "ML-DSA-44"], ["id-ml-dsa-65", "ML-DSA-65"], ["id-ml-dsa-87", "ML-DSA-87"],
- ["id-ml-kem-512", "ML-KEM-512"], ["id-ml-kem-768", "ML-KEM-768"], ["id-ml-kem-1024", "ML-KEM-1024"]
-].forEach(function (r) { INFER_ALG[O(r[0])] = { name: r[1] }; });
-["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
- "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
-].forEach(function (s) { INFER_ALG[O("id-slh-dsa-" + s)] = { name: _toUpperCase("SLH-DSA-" + s) }; });
+_forEach(["Ed25519", "Ed448", "X25519", "X448"], function (n) { INFER_ALG[O(n)] = { name: n }; });
+_forEach([["id-ml-dsa-44", "ML-DSA-44"], ["id-ml-dsa-65", "ML-DSA-65"], ["id-ml-dsa-87", "ML-DSA-87"],
+  ["id-ml-kem-512", "ML-KEM-512"], ["id-ml-kem-768", "ML-KEM-768"], ["id-ml-kem-1024", "ML-KEM-1024"]
+], function (r) { INFER_ALG[O(r[0])] = { name: r[1] }; });
+_forEach(["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
+  "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
+], function (s) { INFER_ALG[O("id-slh-dsa-" + s)] = { name: _toUpperCase("SLH-DSA-" + s) }; });
 
 function _isCryptoKey(x) { return webcrypto.isCryptoKeyLike(x); }
 function _algName(a) { return typeof a === "string" ? a : (a && a.name); }

package/lib/path-validate.js

@@ -179,9 +179,9 @@ _sig("Ed448", { name: "Ed448" }, { name: "Ed448" }, "absent", false, true);
 _sig("id-ml-dsa-44", { name: "ML-DSA-44" }, { name: "ML-DSA-44" }, "absent", false, true);
 _sig("id-ml-dsa-65", { name: "ML-DSA-65" }, { name: "ML-DSA-65" }, "absent", false, true);
 _sig("id-ml-dsa-87", { name: "ML-DSA-87" }, { name: "ML-DSA-87" }, "absent", false, true);
-["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
- "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
-].forEach(function (set) {
+intrinsic.forEach(["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
+  "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
+], function (set) {
   var wc = "SLH-DSA-" + set.toUpperCase();
   _sig("id-slh-dsa-" + set, { name: wc }, { name: wc }, "absent", false, true);
 });
@@ -304,7 +304,7 @@ function compositeKeyUsageCheck(cert) {
 }
 
 var STATEFUL_HBS_OIDS = intrinsic.create(null);
-["id-alg-hss-lms-hashsig", "id-alg-xmss-hashsig", "id-alg-xmssmt-hashsig"].forEach(function (n) { STATEFUL_HBS_OIDS[oid.byName(n)] = true; });
+intrinsic.forEach(["id-alg-hss-lms-hashsig", "id-alg-xmss-hashsig", "id-alg-xmssmt-hashsig"], function (n) { STATEFUL_HBS_OIDS[oid.byName(n)] = true; });
 
 /** @internal RFC 9802 sec. 6 states the rule twice, and the two differ: a certification authority's
  * certificate may assert keyCertSign, an end entity's may not. Both must assert at least one of the values
@@ -404,7 +404,7 @@ function statefulHbsKeyUsageCheck(cert, isCa) {
 }
 
 var ML_KEM_OIDS = intrinsic.create(null);
-["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"].forEach(function (n) { ML_KEM_OIDS[oid.byName(n)] = true; });
+intrinsic.forEach(["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"], function (n) { ML_KEM_OIDS[oid.byName(n)] = true; });
 
 function kemKeyUsageCheck(cert) {
   var ku;

package/lib/pki-build.js

@@ -359,8 +359,8 @@ var ATV_TYPE = intrinsic.assign(intrinsic.create(null), {
  *  pre-encoded value for one of them must be a member. An attribute with no published short
  *  name has a syntax this toolkit does not claim to know, and its value stays opaque. */
 var DIRECTORY_STRING_TAGS = intrinsic.assign(intrinsic.create(null), {});
-[asn1.TAGS.TELETEX_STRING, asn1.TAGS.PRINTABLE_STRING, asn1.TAGS.UNIVERSAL_STRING,
-  asn1.TAGS.UTF8_STRING, asn1.TAGS.BMP_STRING].forEach(function (t) { DIRECTORY_STRING_TAGS[t] = 1; });
+intrinsic.forEach([asn1.TAGS.TELETEX_STRING, asn1.TAGS.PRINTABLE_STRING, asn1.TAGS.UNIVERSAL_STRING,
+  asn1.TAGS.UTF8_STRING, asn1.TAGS.BMP_STRING], function (t) { DIRECTORY_STRING_TAGS[t] = 1; });
 
 var KU_BIT = intrinsic.assign(intrinsic.create(null), {
   digitalSignature: 0, nonRepudiation: 1, contentCommitment: 1, keyEncipherment: 2,
@@ -396,12 +396,12 @@ var SDA_ATTR_KEYS = intrinsic.assign(intrinsic.create(null), { type: 1, values:
  *  statement's set is refused rather than ignored: a misspelled field would otherwise be dropped and
  *  the certificate would carry a statement the caller did not write. */
 var QC_INFO_KEYS = intrinsic.create(null);
-[["qcType", { types: 1 }], ["qcIdentMethod", { methods: 1 }],
+intrinsic.forEach([["qcType", { types: 1 }], ["qcIdentMethod", { methods: 1 }],
   ["qcCClegislation", { countries: 1 }], ["qcQSCDlegislation", { countries: 1 }],
   ["qcRetentionPeriod", { years: 1 }], ["qcLimitValue", { currency: 1, amount: 1, exponent: 1 }],
   ["qcPDS", { locations: 1 }],
   ["qcsPkixQCSyntaxV1", { semanticsIdentifier: 1, nameRegistrationAuthorities: 1 }],
-  ["qcsPkixQCSyntaxV2", { semanticsIdentifier: 1, nameRegistrationAuthorities: 1 }]].forEach(function (r) {
+  ["qcsPkixQCSyntaxV2", { semanticsIdentifier: 1, nameRegistrationAuthorities: 1 }]], function (r) {
   QC_INFO_KEYS[oid.byName(r[0])] = intrinsic.assign(intrinsic.create(null), r[1]);
 });
 var QC_PDS_LOCATION_KEYS = intrinsic.assign(intrinsic.create(null), { url: 1, language: 1 });

package/lib/sign-scheme.js

@@ -69,10 +69,10 @@ function mldsaDigestSuitable(mlName, md) {
 }
 
 var SLHDSA_BY_OID = intrinsic.create(null);
-[["sha2-128s", "sha256"], ["sha2-128f", "sha256"], ["sha2-192s", "sha512"], ["sha2-192f", "sha512"],
- ["sha2-256s", "sha512"], ["sha2-256f", "sha512"], ["shake-128s", "shake128"], ["shake-128f", "shake128"],
- ["shake-192s", "shake256"], ["shake-192f", "shake256"], ["shake-256s", "shake256"], ["shake-256f", "shake256"]
-].forEach(function (r) { SLHDSA_BY_OID[O("id-slh-dsa-" + r[0])] = { wc: "SLH-DSA-" + r[0].toUpperCase(), digest: r[1] }; });
+intrinsic.forEach([["sha2-128s", "sha256"], ["sha2-128f", "sha256"], ["sha2-192s", "sha512"], ["sha2-192f", "sha512"],
+  ["sha2-256s", "sha512"], ["sha2-256f", "sha512"], ["shake-128s", "shake128"], ["shake-128f", "shake128"],
+  ["shake-192s", "shake256"], ["shake-192f", "shake256"], ["shake-256s", "shake256"], ["shake-256f", "shake256"]
+], function (r) { SLHDSA_BY_OID[O("id-slh-dsa-" + r[0])] = { wc: "SLH-DSA-" + _toUpperCase(r[0]), digest: r[1] }; });
 
 function _algId(name, shape) { return shape === "null" ? b.sequence([b.oid(O(name)), b.nullValue()]) : b.sequence([b.oid(O(name))]); }
 function _pssAlgId(digestName) {

package/lib/webcrypto.js

@@ -176,9 +176,9 @@ var ML_DSA_NODE = intrinsic.assign(intrinsic.create(null), { "ML-DSA-44": "ml-ds
 var ML_KEM_NODE = intrinsic.assign(intrinsic.create(null), { "ML-KEM-512": "ml-kem-512", "ML-KEM-768": "ml-kem-768", "ML-KEM-1024": "ml-kem-1024" });
 
 var SLH_DSA_NODE = intrinsic.create(null);
-["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
- "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
-].forEach(function (s) { SLH_DSA_NODE["SLH-DSA-" + _toUpperCase(s)] = "slh-dsa-" + s; });
+_forEach(["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
+  "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
+], function (s) { SLH_DSA_NODE["SLH-DSA-" + _toUpperCase(s)] = "slh-dsa-" + s; });
 
 var SIGN_VERIFY_NAMES = intrinsic.create(null);
 ["RSASSA-PKCS1-V1_5", "RSA-PSS", "ECDSA", "ED25519", "ED448", "HMAC"]
@@ -868,7 +868,7 @@ function _nodeKey(fn, who) {
 }
 
 var ML_KEM_INNER = intrinsic.create(null);
-["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"].forEach(function (n) {
+_forEach(["id-ml-kem-512", "id-ml-kem-768", "id-ml-kem-1024"], function (n) {
   var row = oid.kemParams(n);
   ML_KEM_INNER[oid.byName(n)] = { ek: row.ek, dk: row.dk };
 });
@@ -1010,7 +1010,7 @@ var IMPORT_KEY_TYPE = intrinsic.assign(intrinsic.create(null), {
   "ED25519": _typeSet(["ed25519"]), "ED448": _typeSet(["ed448"]),
   "X25519": _typeSet(["x25519"]), "X448": _typeSet(["x448"]),
 });
-[ML_DSA_NODE, ML_KEM_NODE, SLH_DSA_NODE].forEach(function (m) {
+_forEach([ML_DSA_NODE, ML_KEM_NODE, SLH_DSA_NODE], function (m) {
   _forEach(_keys(m), function (webName) { IMPORT_KEY_TYPE[webName] = _typeSet([m[webName]]); });
 });
 function _algFromImport(name, alg, keyObject) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.58",
+  "version": "0.8.59",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:41653943-4244-48b6-acbe-1493b54bad90",
+  "serialNumber": "urn:uuid:2b5749b0-053a-41de-947c-63a7a8df8028",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-07T04:10:13.613Z",
+    "timestamp": "2026-10-07T05:12:27.182Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.58",
+      "bom-ref": "@blamejs/pki@0.8.59",
       "type": "application",
       "name": "pki",
-      "version": "0.8.58",
+      "version": "0.8.59",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.58",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.59",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.58",
+      "ref": "@blamejs/pki@0.8.59",
       "dependsOn": []
     }
   ]