@blamejs/pki 0.8.60 → 0.9.0

package/lib/webcrypto.js

@@ -261,10 +261,10 @@ SubtleCrypto.prototype.digest = async function digest(algorithm, data) {
   var name = _normalizeAlg(algorithm, "digest").name;
   var xof = XOF_NODE[_toUpperCase(_String(name))];
   var h = xof
-    ? nodeCrypto.createHash(xof.node, { outputLength: xof.length })
-    : nodeCrypto.createHash(_hashNode(name, "digest"));
-  h.update(_toBuf(data, "digest"));
-  return _toArrayBuffer(h.digest());
+    ? guard.crypto.hash(xof.node, xof.length)
+    : guard.crypto.hash(_hashNode(name, "digest"));
+  _hashUpdate(h, _toBuf(data, "digest"));
+  return _toArrayBuffer(_hashDigest(h));
 };
 
 SubtleCrypto.prototype.digestStream = async function digestStream(algorithms, source) {
@@ -276,8 +276,8 @@ SubtleCrypto.prototype.digestStream = async function digestStream(algorithms, so
     var name = _normalizeAlg(algorithms[_h], "digestStream").name;
     var xof = XOF_NODE[_toUpperCase(_String(name))];
     hashes[_h] = xof
-      ? nodeCrypto.createHash(xof.node, { outputLength: xof.length })
-      : nodeCrypto.createHash(_hashNode(name, "digestStream"));
+      ? guard.crypto.hash(xof.node, xof.length)
+      : guard.crypto.hash(_hashNode(name, "digestStream"));
   }
   var acquire = source == null ? undefined : source[_asyncIterator];
   if (typeof acquire !== "function") {
@@ -307,8 +307,8 @@ SubtleCrypto.prototype.digestStream = async function digestStream(algorithms, so
 
 SubtleCrypto.prototype.encryptStream = async function encryptStream(spec, source) {
   var cipher = spec.authTagLength
-    ? nodeCrypto.createCipheriv(spec.algNode, spec.key, spec.iv, { authTagLength: spec.authTagLength })
-    : nodeCrypto.createCipheriv(spec.algNode, spec.key, spec.iv);
+    ? guard.crypto.cipher(spec.algNode, spec.key, spec.iv, { authTagLength: spec.authTagLength })
+    : guard.crypto.cipher(spec.algNode, spec.key, spec.iv);
   if (spec.aad && spec.aad.length) _cipherSetAAD(cipher, spec.aad);
   var acquire = source == null ? undefined : source[_asyncIterator];
   if (typeof acquire !== "function") {
@@ -344,7 +344,7 @@ SubtleCrypto.prototype.encryptStream = async function encryptStream(spec, source
 };
 
 SubtleCrypto.prototype.decryptStream = function decryptStream(spec, ct) {
-  var decipher = nodeCrypto.createDecipheriv(spec.algNode, spec.key, spec.iv);
+  var decipher = guard.crypto.decipher(spec.algNode, spec.key, spec.iv);
   return _decipherDrive(decipher, _bufferFrom(_toBuf(ct, "decryptStream ciphertext")), _STREAM_CHUNK);
 };
 async function* _decipherDrive(decipher, ct, chunkSize) {
@@ -368,12 +368,12 @@ SubtleCrypto.prototype.generateKey = async function generateKey(algorithm, extra
   if (name === "AES-GCM" || name === "AES-CBC" || name === "AES-CTR" || name === "AES-KW") {
     var bits = alg.length;
     if (bits !== 128 && bits !== 192 && bits !== 256) throw new WebCryptoError("webcrypto/syntax", name + ": length must be 128/192/256");
-    var secret = guard.crypto.secretKey(nodeCrypto.randomBytes(bits / 8));
+    var secret = guard.crypto.secretKey(guard.crypto.randomBytes(bits / 8));
     return new CryptoKey("secret", extractable, { name: name, length: bits }, usages, secret);
   }
   if (name === "HMAC") {
     var lenBits = _hmacLengthBits(alg, "generateKey HMAC");
-    var hkey = guard.crypto.secretKey(nodeCrypto.randomBytes(lenBits / 8));
+    var hkey = guard.crypto.secretKey(guard.crypto.randomBytes(lenBits / 8));
     return new CryptoKey("secret", extractable, { name: name, hash: { name: (typeof alg.hash === "string" ? alg.hash : alg.hash.name) }, length: lenBits }, usages, hkey);
   }
 
@@ -391,7 +391,7 @@ function _generateKeyPair(alg) {
   var name = alg.name, kp, algorithm;
   if (name === "RSASSA-PKCS1-V1_5" || name === "RSA-PSS" || name === "RSA-OAEP") {
     var rsaHash = _hashObj(alg.hash, "generateKey " + name);
-    kp = nodeCrypto.generateKeyPairSync("rsa", {
+    kp = guard.crypto.generateKeyPair("rsa", {
       modulusLength: alg.modulusLength || 2048,
       publicExponent: alg.publicExponent ? _bufToBigIntNum(alg.publicExponent) : 65537,
     });
@@ -399,19 +399,19 @@ function _generateKeyPair(alg) {
   } else if (name === "ECDSA" || name === "ECDH") {
     var curve = alg.namedCurve;
     if (!CURVE_NODE[curve]) throw new WebCryptoError("webcrypto/not-supported", name + ": unsupported curve " + _stringify(curve));
-    kp = nodeCrypto.generateKeyPairSync("ec", { namedCurve: CURVE_NODE[curve] });
+    kp = guard.crypto.generateKeyPair("ec", { namedCurve: CURVE_NODE[curve] });
     algorithm = { name: name, namedCurve: curve };
   } else if (name === "ED25519" || name === "ED448" || name === "X25519" || name === "X448") {
-    kp = nodeCrypto.generateKeyPairSync(_toLowerCase(name));
+    kp = guard.crypto.generateKeyPair(_toLowerCase(name));
     algorithm = { name: _stdName(name) };
   } else if (ML_DSA_NODE[name]) {
-    kp = nodeCrypto.generateKeyPairSync(ML_DSA_NODE[name]);
+    kp = guard.crypto.generateKeyPair(ML_DSA_NODE[name]);
     algorithm = { name: name };
   } else if (ML_KEM_NODE[name]) {
-    kp = nodeCrypto.generateKeyPairSync(ML_KEM_NODE[name]);
+    kp = guard.crypto.generateKeyPair(ML_KEM_NODE[name]);
     algorithm = { name: name };
   } else if (SLH_DSA_NODE[name]) {
-    kp = nodeCrypto.generateKeyPairSync(SLH_DSA_NODE[name]);
+    kp = guard.crypto.generateKeyPair(SLH_DSA_NODE[name]);
     algorithm = { name: name };
   } else {
     throw new WebCryptoError("webcrypto/not-supported", "generateKey: unsupported algorithm " + _stringify(name));
@@ -515,7 +515,7 @@ SubtleCrypto.prototype.encrypt = async function encrypt(algorithm, key, data) {
   if (!ENCRYPT_DECRYPT_NAMES[name]) throw new WebCryptoError("webcrypto/not-supported", "encrypt: unsupported algorithm " + _stringify(name));
   _requireAlgMatch(alg, key, "encrypt");
   if (name === "RSA-OAEP") {
-    return _toArrayBuffer(nodeCrypto.publicEncrypt({
+    return _toArrayBuffer(guard.crypto.publicEncrypt({
       key: key._handle, padding: guard.crypto.padding.RSA_PKCS1_OAEP,
       oaepHash: _hashNode(key.algorithm.hash, "encrypt"),
       oaepLabel: alg.label ? _toBuf(alg.label, "encrypt label") : undefined,
@@ -526,10 +526,10 @@ SubtleCrypto.prototype.encrypt = async function encrypt(algorithm, key, data) {
     var aad = alg.additionalData ? _toBuf(alg.additionalData, "AES-GCM aad") : null;
     return _toArrayBuffer(_runCipher(function () {
       return _withSecretBytes(key, function (kb) {
-        var cipher = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-gcm", kb, iv, { authTagLength: (alg.tagLength || 128) / 8 });
-        if (aad) cipher.setAAD(aad);
+        var cipher = guard.crypto.cipher("aes-" + key.algorithm.length + "-gcm", kb, iv, { authTagLength: (alg.tagLength || 128) / 8 });
+        if (aad) guard.crypto.transformSetAAD(cipher, aad);
         var ct = guard.secret.cipherFinish(cipher, buf, WebCryptoError, "webcrypto/operation", "an AES-GCM encrypt intermediate");
-        return _bufferConcat([ct, cipher.getAuthTag()]);
+        return _bufferConcat([ct, guard.crypto.cipherAuthTag(cipher)]);
       });
     }, "encrypt"));
   }
@@ -537,7 +537,7 @@ SubtleCrypto.prototype.encrypt = async function encrypt(algorithm, key, data) {
     var cbcIv = _toBuf(alg.iv, "AES-CBC iv");
     return _toArrayBuffer(_runCipher(function () {
       return _withSecretBytes(key, function (kb) {
-        var c2 = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-cbc", kb, cbcIv);
+        var c2 = guard.crypto.cipher("aes-" + key.algorithm.length + "-cbc", kb, cbcIv);
         return guard.secret.cipherFinish(c2, buf, WebCryptoError, "webcrypto/operation", "an AES-CBC encrypt intermediate");
       });
     }, "encrypt"));
@@ -547,7 +547,7 @@ SubtleCrypto.prototype.encrypt = async function encrypt(algorithm, key, data) {
     var ctrCounter = _toBuf(alg.counter, "AES-CTR counter");
     return _toArrayBuffer(_runCipher(function () {
       return _withSecretBytes(key, function (kb) {
-        var c3 = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-ctr", kb, ctrCounter);
+        var c3 = guard.crypto.cipher("aes-" + key.algorithm.length + "-ctr", kb, ctrCounter);
         return guard.secret.cipherFinish(c3, buf, WebCryptoError, "webcrypto/operation", "an AES-CTR encrypt intermediate");
       });
     }, "encrypt"));
@@ -563,7 +563,7 @@ SubtleCrypto.prototype.decrypt = async function decrypt(algorithm, key, data) {
   if (!ENCRYPT_DECRYPT_NAMES[name]) throw new WebCryptoError("webcrypto/not-supported", "decrypt: unsupported algorithm " + _stringify(name));
   _requireAlgMatch(alg, key, "decrypt");
   if (name === "RSA-OAEP") {
-    var oaepOut = nodeCrypto.privateDecrypt({
+    var oaepOut = guard.crypto.privateDecrypt({
       key: key._handle, padding: guard.crypto.padding.RSA_PKCS1_OAEP,
       oaepHash: _hashNode(key.algorithm.hash, "decrypt"),
       oaepLabel: alg.label ? _toBuf(alg.label, "decrypt label") : undefined,
@@ -580,9 +580,9 @@ SubtleCrypto.prototype.decrypt = async function decrypt(algorithm, key, data) {
     var gcmAad = alg.additionalData ? _toBuf(alg.additionalData, "AES-GCM aad") : null;
     return _toArrayBuffer(_runCipher(function () {
       return _withSecretBytes(key, function (kb) {
-        var d = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-gcm", kb, iv, { authTagLength: tagLen });
-        if (gcmAad) d.setAAD(gcmAad);
-        d.setAuthTag(tag);
+        var d = guard.crypto.decipher("aes-" + key.algorithm.length + "-gcm", kb, iv, { authTagLength: tagLen });
+        if (gcmAad) guard.crypto.transformSetAAD(d, gcmAad);
+        guard.crypto.decipherSetAuthTag(d, tag);
         return guard.secret.cipherFinish(d, ct, WebCryptoError, "webcrypto/operation", "the recovered AES-GCM plaintext");
       });
     }, "decrypt"));
@@ -591,7 +591,7 @@ SubtleCrypto.prototype.decrypt = async function decrypt(algorithm, key, data) {
     var cbcIv2 = _toBuf(alg.iv, "AES-CBC iv");
     return _toArrayBuffer(_runCipher(function () {
       return _withSecretBytes(key, function (kb) {
-        var d2 = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-cbc", kb, cbcIv2);
+        var d2 = guard.crypto.decipher("aes-" + key.algorithm.length + "-cbc", kb, cbcIv2);
         return guard.secret.cipherFinish(d2, buf, WebCryptoError, "webcrypto/operation", "the recovered AES-CBC plaintext");
       });
     }, "decrypt"));
@@ -601,7 +601,7 @@ SubtleCrypto.prototype.decrypt = async function decrypt(algorithm, key, data) {
     var ctrCounter2 = _toBuf(alg.counter, "AES-CTR counter");
     return _toArrayBuffer(_runCipher(function () {
       return _withSecretBytes(key, function (kb) {
-        var d3 = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-ctr", kb, ctrCounter2);
+        var d3 = guard.crypto.decipher("aes-" + key.algorithm.length + "-ctr", kb, ctrCounter2);
         return guard.secret.cipherFinish(d3, buf, WebCryptoError, "webcrypto/operation", "the recovered AES-CTR plaintext");
       });
     }, "decrypt"));
@@ -650,7 +650,7 @@ function _pbkdf2Async(pw, salt, iterations, keylen, digest) {
         if (next) next();
         if (err) reject(err); else resolve(derived);
       }
-      try { nodeCrypto.pbkdf2(pw, salt, iterations, keylen, digest, done); }
+      try { guard.crypto.pbkdf2Async(pw, salt, iterations, keylen, digest, done); }
       catch (e) { done(e); }
     }
     if (_pbkdf2InFlight < _PBKDF2_MAX_CONCURRENT) start(); else _push(_pbkdf2Waiters,start);
@@ -662,7 +662,7 @@ async function _deriveBitsRaw(alg, key, length) {
   if (name === "ECDH" || name === "X25519" || name === "X448") {
     _requireAlgMatch(alg, alg.public, name + " public key");
     _requireOwnKey(alg.public, "deriveBits public key");
-    var secret = nodeCrypto.diffieHellman({ privateKey: key._handle, publicKey: alg.public._handle });
+    var secret = guard.crypto.diffieHellman({ privateKey: key._handle, publicKey: alg.public._handle });
     try {
       if (length == null) return _toArrayBuffer(secret);
       _requireDeriveLength(length, name);
@@ -677,7 +677,7 @@ async function _deriveBitsRaw(alg, key, length) {
   if (name === "HKDF") {
     _requireDeriveLength(length, "HKDF");
     return _withSecretBytes(key, function (ikm) {
-      var derived = nodeCrypto.hkdfSync(_hashNode(alg.hash, "HKDF"), ikm, _toBuf(alg.salt, "HKDF salt"), _toBuf(alg.info || _bufferAlloc(0), "HKDF info"), length / 8);
+      var derived = guard.crypto.hkdf(_hashNode(alg.hash, "HKDF"), ikm, _toBuf(alg.salt, "HKDF salt"), _toBuf(alg.info || _bufferAlloc(0), "HKDF info"), length / 8);
       return _types.isArrayBuffer(derived) ? derived : _toArrayBuffer(_bufferFrom(derived));
     });
   }
@@ -710,7 +710,7 @@ function _x963Kdf(hashNode, z, sharedInfo, lenBytes) {
      * hash of the shared secret with this counter in it, so a replaced write makes two blocks derive
      * from the same input and the key material repeats. */
     var ctr = _bufferAlloc(4); intrinsic.writeUInt32BE(ctr, counter, 0);
-    var h = nodeCrypto.createHash(hashNode).update(z).update(ctr).update(sharedInfo).digest();
+    var h = guard.crypto.digestParts(hashNode, [z, ctr, sharedInfo]);
     _push(blocks, h); got += h.length; counter += 1;
   }
   var joined = _bufferConcat(blocks);
@@ -758,7 +758,7 @@ SubtleCrypto.prototype.encapsulateBits = async function encapsulateBits(algorith
   _requireAlgMatch(alg, encapsulationKey, "encapsulateBits");
   if (encapsulationKey.type !== "public") throw new WebCryptoError("webcrypto/invalid-access", "encapsulateBits requires a public (encapsulation) key, got " + _stringify(encapsulationKey.type));
   var r;
-  try { r = nodeCrypto.encapsulate(encapsulationKey._handle); }
+  try { r = guard.crypto.encapsulate(encapsulationKey._handle); }
   catch (e) { throw new WebCryptoError("webcrypto/operation", "encapsulateBits: ML-KEM encapsulation failed", e); }
   try {
     return { sharedKey: _toArrayBuffer(r.sharedKey), ciphertext: _toArrayBuffer(r.ciphertext) };
@@ -780,7 +780,7 @@ SubtleCrypto.prototype.decapsulateBits = async function decapsulateBits(algorith
       "decapsulateBits: " + alg.name + " expects a " + kemRow.ct + "-octet ciphertext, got " + ct.length + " (FIPS 203 sec. 7.3)");
   }
   var ss;
-  try { ss = nodeCrypto.decapsulate(decapsulationKey._handle, ct); }
+  try { ss = guard.crypto.decapsulate(decapsulationKey._handle, ct); }
   catch (e) { throw new WebCryptoError("webcrypto/operation", "decapsulateBits: ML-KEM decapsulation failed (malformed or wrong-length ciphertext)", e); }
   try {
     return _toArrayBuffer(ss);
@@ -803,7 +803,7 @@ SubtleCrypto.prototype.wrapKey = async function wrapKey(format, key, wrappingKey
     }
     try {
       return _withSecretBytes(wrappingKey, function (wkBytes) {
-        var c = nodeCrypto.createCipheriv("aes" + wrappingKey.algorithm.length + "-wrap", wkBytes, _bufferFrom("A6A6A6A6A6A6A6A6", "hex"));
+        var c = guard.crypto.cipher("aes" + wrappingKey.algorithm.length + "-wrap", wkBytes, _bufferFrom("A6A6A6A6A6A6A6A6", "hex"));
         return _toArrayBuffer(guard.secret.cipherFinish(c, bytes, WebCryptoError, "webcrypto/operation", "an AES-KW wrap intermediate"));
       });
     } catch (e) { throw new WebCryptoError("webcrypto/operation", "wrapKey: AES-KW key wrap failed", e); }
@@ -828,7 +828,7 @@ SubtleCrypto.prototype.unwrapKey = async function unwrapKey(format, wrappedKey,
     }
     try {
       bytes = _withSecretBytes(unwrappingKey, function (kwBytes) {
-        var d = nodeCrypto.createDecipheriv("aes" + unwrappingKey.algorithm.length + "-wrap", kwBytes, _bufferFrom("A6A6A6A6A6A6A6A6", "hex"));
+        var d = guard.crypto.decipher("aes" + unwrappingKey.algorithm.length + "-wrap", kwBytes, _bufferFrom("A6A6A6A6A6A6A6A6", "hex"));
         return guard.secret.cipherFinish(d, wrapped, WebCryptoError, "webcrypto/operation", "the unwrapped key material");
       });
     } catch (e) { throw new WebCryptoError("webcrypto/operation", "unwrapKey: AES-KW key unwrap failed (integrity or length)", e); }
@@ -1021,8 +1021,13 @@ _forEach([ML_DSA_NODE, ML_KEM_NODE, SLH_DSA_NODE], function (m) {
 });
 function _algFromImport(name, alg, keyObject) {
   var wantType = IMPORT_KEY_TYPE[name];
-  if (wantType && keyObject && keyObject.asymmetricKeyType && !wantType[keyObject.asymmetricKeyType]) {
-    throw new WebCryptoError("webcrypto/data", name + ": the imported key is a " + keyObject.asymmetricKeyType +
+  /** @internal The key's own family, read through the accessor captured at load. This is the check
+   *  that binds the algorithm a caller named to the key they supplied, so reading it off the live
+   *  prototype let a replaced accessor answer `"rsa"` for an Ed25519 key and the import accepted it
+   *  as RSA-PSS. */
+  var actualType = guard.crypto.keyTypeOf(keyObject);
+  if (wantType && actualType && !wantType[actualType]) {
+    throw new WebCryptoError("webcrypto/data", name + ": the imported key is a " + actualType +
       " key, which is not compatible with algorithm " + name);
   }
   if (name === "ECDSA" || name === "ECDH") {
@@ -1136,17 +1141,17 @@ Crypto.prototype.getRandomValues = function getRandomValues(typedArray) {
   if (out.length > MAX_RANDOM_BYTES) {
     throw new WebCryptoError("webcrypto/data", "getRandomValues: byteLength exceeds " + MAX_RANDOM_BYTES);
   }
-  nodeCrypto.randomFillSync(out);
+  guard.crypto.randomFill(out);
   return typedArray;
 };
 
-Crypto.prototype.randomUUID = function randomUUID() { return nodeCrypto.randomUUID(); };
+Crypto.prototype.randomUUID = function randomUUID() { return guard.crypto.randomUUID(); };
 
 function decompressEcPoint(sec1Compressed, nodeCurve, E, code) {
   var head = sec1Compressed[0];
   if (head !== 0x02 && head !== 0x03) throw E(code, "EC point de-compression expects a compressed SEC1 point (0x02/0x03)");
   try {
-    return nodeCrypto.ECDH.convertKey(sec1Compressed, nodeCurve, undefined, undefined, "uncompressed");
+    return guard.crypto.ecConvertPoint(sec1Compressed, nodeCurve, "uncompressed");
   } catch (e) {
     throw E(code, "EC point is not on curve " + nodeCurve + " (de-compression failed)", e);
   }
@@ -1170,9 +1175,19 @@ function isCryptoKeyLike(x) {
  * key this engine did not make while the others returned it. A JWK is an object rather than
  * bytes, so only the byte formats are wrapped. */
 function exportAnyKey(key, E, code, want) {
-  var format = want || _EXPORT_FORMAT[key && key.type];
+  /** @internal At most ONE read of the key's type, and none at all when the caller named the format
+   *  it wants. It is a getter on node's own CryptoKey, so each read is a call a replacement answers,
+   *  and reading it per decision let one answer "private" where a PEM label was chosen and "public"
+   *  where the bytes were, which put a public key inside a `PRIVATE KEY` block. */
+  var keyType;
+  var readType = false;
+  function typeOnce() {
+    if (!readType) { keyType = key == null ? undefined : key.type; readType = true; }
+    return keyType;
+  }
+  var format = want || _EXPORT_FORMAT[typeOnce()];
   if (!format) throw E(code, "a CryptoKey with a private, public, or secret type is required");
-  if (want === "jwk" && !_EXPORT_FORMAT[key && key.type]) {
+  if (want === "jwk" && !_EXPORT_FORMAT[typeOnce()]) {
     throw E(code, "a CryptoKey with a private, public, or secret type is required");
   }
   var asJwk = format === "jwk";
@@ -1186,7 +1201,7 @@ function exportAnyKey(key, E, code, want) {
     throw E(code, "the CryptoKey comes from a different WebCrypto implementation and is not extractable, so its key material cannot be reached; import it through pki.webcrypto.subtle, or pass the key as DER");
   }
   var handle = key._handle;
-  if (handle instanceof nodeCrypto.KeyObject && handle.type === key.type) {
+  if (guard.crypto.isKeyObject(handle) && guard.crypto.keyKind(handle) === key.type) {
     return _resolve(_Promise).then(function () {
       if (asJwk) return guard.crypto.exportKey(handle, { format: "jwk" });
       return format === "raw" ? guard.crypto.exportKey(handle) : guard.crypto.exportKey(handle, { format: "der", type: format });
@@ -1195,7 +1210,7 @@ function exportAnyKey(key, E, code, want) {
     });
   }
   return _resolve(_Promise)
-    .then(function () { return nodeCrypto.webcrypto.subtle.exportKey(format, key); })
+    .then(function () { return guard.crypto.nodeExportKey(format, key); })
     .then(wrap, function (e) {
       throw E(code, "the CryptoKey comes from a different WebCrypto implementation and could not be exported for re-import; import it through pki.webcrypto.subtle, or pass the key as DER", e);
     });

package/lib/x509-sign.js

@@ -166,7 +166,7 @@ var RESERVED_ALT_EXTS = intrinsic.assign(intrinsic.create(null), (function () {
 })());
 
 function _buildExtensions(extSpec, ctx) {
-  if (extSpec == null) extSpec = {};
+  if (extSpec == null) extSpec = intrinsic.create(null);
   if (_isArray(extSpec)) {
     var seenExt = intrinsic.create(null), arrCa = false, arrKeyCertSign = false, arrPathLen = false, arrNameConstraints = false;
     var oidBc = O("basicConstraints"), oidKu = O("keyUsage"), oidNc = O("nameConstraints"), oidPm = O("policyMappings");
@@ -708,9 +708,9 @@ function sign(spec, issuer, opts) {
 }
 
 function _sign(spec, issuer, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("x509/bad-input", "the certificate spec must be an object");
-  issuer = issuer || {};
+  issuer = issuer || intrinsic.create(null);
   guard.identifier.assertKnownKeys(spec, KNOWN_SPEC_KEYS, _err, "x509/bad-input", function (k) {
     return "unknown certificate spec field " + JSON.stringify(k) +
       (k === "issuer" ? "; the issuer is the SECOND argument to pki.x509.sign, not a spec field" : "") +

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.60",
+  "version": "0.9.0",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:a0bc3a87-4c9e-4598-95ba-7457dca63e87",
+  "serialNumber": "urn:uuid:f52bf92f-41f7-4879-bff9-6077f2cf84f5",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-07T18:31:09.061Z",
+    "timestamp": "2026-10-08T01:34:26.318Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.60",
+      "bom-ref": "@blamejs/pki@0.9.0",
       "type": "application",
       "name": "pki",
-      "version": "0.8.60",
+      "version": "0.9.0",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.60",
+      "purl": "pkg:npm/%40blamejs/pki@0.9.0",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.60",
+      "ref": "@blamejs/pki@0.9.0",
       "dependsOn": []
     }
   ]