@blamejs/pki 0.8.59 → 0.8.60

package/lib/x509-sign.js

@@ -22,6 +22,11 @@ var x509 = require("./schema-x509");
 var signScheme = require("./sign-scheme");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
+/** @internal The append every list here is built with. `push` STORES at the index, and a store walks
+ *  the prototype chain for a setter, so an accessor inherited at an array index receives each element
+ *  as it is appended and the index reads back whatever its getter answers. These lists become the
+ *  bytes that get signed. */
+var _push = intrinsic.append;
 var _isArray = intrinsic.isArray, _bufferEquals = intrinsic.bufferEquals, _isBuffer = intrinsic.isBuffer;
 var _arrSlice = intrinsic.arraySlice, _promiseResolve = intrinsic.uncurry(intrinsic.promiseResolve);
 /** @internal The RECEIVER for the captured `Promise.resolve`, captured too. `resolve` builds through
@@ -243,23 +248,23 @@ function _buildExtensions(extSpec, ctx) {
   if (skiVal === false) {
     if (caTrue) throw _err("x509/bad-input", "a CA certificate MUST carry a subjectKeyIdentifier, so subjectKeyIdentifier: false is refused when basicConstraints cA is TRUE (RFC 5280 sec. 4.2.1.2)");
   } else {
-    out.push(_ext(O("subjectKeyIdentifier"), false, _extSki(_skiKeyId(skiVal, ctx.spki))));
+    _push(out,_ext(O("subjectKeyIdentifier"), false, _extSki(_skiKeyId(skiVal, ctx.spki))));
   }
   var akiVal = extSpec.authorityKeyIdentifier == null ? !ctx.selfSigned : extSpec.authorityKeyIdentifier;
   if (akiVal === false) {
     if (!ctx.selfSigned) throw _err("x509/bad-input", "the authorityKeyIdentifier keyIdentifier MUST be included in every certificate a CA generates other than a self-signed one, so authorityKeyIdentifier: false is refused here (RFC 5280 sec. 4.2.1.1)");
   } else {
     var akiF = _akiFields(akiVal, ctx);
-    out.push(_ext(O("authorityKeyIdentifier"), false, _extAki(akiF[0], akiF[1], akiF[2])));
+    _push(out,_ext(O("authorityKeyIdentifier"), false, _extAki(akiF[0], akiF[1], akiF[2])));
   }
-  if (ku != null) out.push(_ext(O("keyUsage"), extSpec.keyUsageCritical !== false, _extKeyUsage(ku)));
-  if (extSpec.extendedKeyUsage != null) out.push(_ext(O("extKeyUsage"), !!extSpec.extendedKeyUsageCritical, _extExtKeyUsage(extSpec.extendedKeyUsage)));
+  if (ku != null) _push(out,_ext(O("keyUsage"), extSpec.keyUsageCritical !== false, _extKeyUsage(ku)));
+  if (extSpec.extendedKeyUsage != null) _push(out,_ext(O("extKeyUsage"), !!extSpec.extendedKeyUsageCritical, _extExtKeyUsage(extSpec.extendedKeyUsage)));
   if (bc != null) {
     if (bc.cA === true && bc.critical === false) throw _err("x509/bad-input", "a CA certificate's basicConstraints MUST be critical (RFC 5280 sec. 4.2.1.9)");
-    out.push(_ext(O("basicConstraints"), bc.critical !== false, _extBasicConstraints(bc)));
+    _push(out,_ext(O("basicConstraints"), bc.critical !== false, _extBasicConstraints(bc)));
   }
-  if (extSpec.subjectAltName != null) out.push(_ext(O("subjectAltName"), ctx.subjectEmpty, _extSan(extSpec.subjectAltName)));
-  if (extSpec.certificatePolicies != null) out.push(_ext(O("certificatePolicies"), !!extSpec.certificatePoliciesCritical, _extCertPolicies(extSpec.certificatePolicies)));
+  if (extSpec.subjectAltName != null) _push(out,_ext(O("subjectAltName"), ctx.subjectEmpty, _extSan(extSpec.subjectAltName)));
+  if (extSpec.certificatePolicies != null) _push(out,_ext(O("certificatePolicies"), !!extSpec.certificatePoliciesCritical, _extCertPolicies(extSpec.certificatePolicies)));
   /** @internal Sections 4.2.2.1 and 4.2.1.15 fix these non-critical; sec. 4.2.1.13 states a SHOULD
    *  and the toolkit issues the conforming form. */
   if (extSpec.authorityInfoAccess != null) guard.list.append(out, _ext(O("authorityInfoAccess"), false, _extAia(extSpec.authorityInfoAccess)));
@@ -788,14 +793,14 @@ function _sign(spec, issuer, opts) {
    *  signature covers (draft-truskovsky-lamps-pq-hybrid-x509 sec. 4). */
   function tbsOver(extList, omitSignatureAlg) {
     var tbsChildren = [];
-    if (version !== 1) tbsChildren.push(b.explicit(0, b.integer(BigInt(version - 1))));
-    tbsChildren.push(serialTlv);
-    if (omitSignatureAlg !== true) tbsChildren.push(scheme.sigAlgId);
-    tbsChildren.push(issuerDer);
-    tbsChildren.push(validityDer);
-    tbsChildren.push(subjectDer);
-    tbsChildren.push(b.raw(spki));
-    if (extList.length) tbsChildren.push(b.explicit(3, b.sequence(extList)));
+    if (version !== 1) _push(tbsChildren,b.explicit(0, b.integer(BigInt(version - 1))));
+    _push(tbsChildren,serialTlv);
+    if (omitSignatureAlg !== true) _push(tbsChildren,scheme.sigAlgId);
+    _push(tbsChildren,issuerDer);
+    _push(tbsChildren,validityDer);
+    _push(tbsChildren,subjectDer);
+    _push(tbsChildren,b.raw(spki));
+    if (extList.length) _push(tbsChildren,b.explicit(3, b.sequence(extList)));
     return b.sequence(tbsChildren);
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.59",
+  "version": "0.8.60",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:2b5749b0-053a-41de-947c-63a7a8df8028",
+  "serialNumber": "urn:uuid:a0bc3a87-4c9e-4598-95ba-7457dca63e87",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-07T05:12:27.182Z",
+    "timestamp": "2026-10-07T18:31:09.061Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.59",
+      "bom-ref": "@blamejs/pki@0.8.60",
       "type": "application",
       "name": "pki",
-      "version": "0.8.59",
+      "version": "0.8.60",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.59",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.60",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.59",
+      "ref": "@blamejs/pki@0.8.60",
       "dependsOn": []
     }
   ]