[BUG] Published TypeScript packages have pq-oid ESM/export compatibility issues

[williamclay8]

Package

pq-oid and pq-algorithm-id

Language: TypeScript

Version:

• pq-oid@1.0.2
• pq-algorithm-id@1.0.0
• Related smoke-test install also included pq-key-encoder@1.0.3 and
  pq-key-fingerprint@1.0.0

Description

Hi MultiVM Labs team, thanks for publishing the post-quantum package suite.

I ran a small inert local npm smoke test against the currently published
TypeScript starter packages and found two compatibility issues that may be worth
checking in the package build/publish pipeline.

First, pq-algorithm-id@1.0.0 imports isCanonicalOid from pq-oid, but the
installed pq-oid@1.0.2 artifact I tested did not appear to export that symbol.
The local quickstart failed at the pq-algorithm-id import path with:

SyntaxError: Export named 'isCanonicalOid' not found in module '.../node_modules/pq-oid/dist/index.js'.

The installed pq-algorithm-id/dist/lookup.js starts with:

import { isCanonicalOid } from 'pq-oid';

Second, Node direct ESM import of the published pq-oid@1.0.2 artifact failed
because dist/index.js uses extensionless relative imports while the emitted
files are .js files.

Observed Node error:

Error [ERR_MODULE_NOT_FOUND]: Cannot find module '.../node_modules/pq-oid/dist/encoding' imported from .../node_modules/pq-oid/dist/index.js

The installed pq-oid/dist/index.js contains imports like:

import { decodeOid, encodeOid } from './encoding';

while the installed file is dist/encoding.js.

Current-source note: I checked main before opening this issue, and current
source appears to export isCanonicalOid from packages/pq-oid/ts/src/index.ts
and define it in packages/pq-oid/ts/src/oid.ts. So this may already be fixed
in source and only need a published npm patch/release, or there may be a pinned
version set I should use instead.

I also noticed pq-algorithm-id has a Node dist smoke check for .js relative
specifiers in its own emitted files. It may be useful to apply the same kind of
guard to pq-oid if Node is intended to be supported for the published ESM
package.

Expected Behavior

• pq-algorithm-id@1.0.0 should import only symbols exported by its pinned
  pq-oid@1.0.2 dependency, or the published pq-oid package should export
  the required isCanonicalOid helper.
• Published ESM should import correctly under Node for the package's supported
  runtime range, or package docs/metadata should clarify if Bun is currently
  the intended TypeScript runtime.

Steps to Reproduce

The local smoke test used pinned package versions and --ignore-scripts:

npm install --ignore-scripts \
  pq-oid@1.0.2 \
  pq-algorithm-id@1.0.0 \
  pq-key-encoder@1.0.3 \
  pq-key-fingerprint@1.0.0

Then check the Node import path:

node --input-type=module --eval "import('pq-oid').then(() => console.log('pq-oid ok'))"

The local run failed with ERR_MODULE_NOT_FOUND on an extensionless internal
specifier such as pq-oid/dist/encoding.

Then check the pq-algorithm-id dependency path:

bun --eval "import('pq-algorithm-id').then(() => console.log('pq-algorithm-id ok'))"

The local Bun quickstart failed because the installed pq-oid@1.0.2 artifact
did not expose the named isCanonicalOid export expected by
pq-algorithm-id@1.0.0.

Environment

• OS: macOS
• Runtime version:
  • Node v25.9.0
  • Bun 1.3.14
  • npm 11.12.1
• Package version:
  • pq-oid@1.0.2
  • pq-algorithm-id@1.0.0

Notes:

• This is not a security report and does not involve private key material,
  wallets, live chain writes, or production-readiness claims.
• The smoke test used toy public bytes only for the package surfaces that did
  run.
• Happy to test a release candidate or a suggested pinned workaround.