@blamejs/pki 0.5.17 → 0.5.19

package/lib/webcrypto.js

@@ -42,6 +42,52 @@ var guard = require("./guard-all");
 var constants = require("./constants");
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
+// What this engine reads from the runtime while it is deciding something, taken at load. The
+// decisions here are the ones the whole toolkit signs and verifies behind: whether a value IS a
+// CryptoKey, which algorithm a key names, how many octets a modulus has. A caller who receives
+// control afterwards -- through an accessor on a key-like object, or while a verb is suspended on
+// an await -- can replace any of them, and every check around them still runs and still passes.
+// See guard-intrinsic for the whole captured set.
+var intrinsic = require("./guard-intrinsic");
+var _isArray = intrinsic.isArray;
+var _hasOwn = intrinsic.hasOwn;
+var _stringify = intrinsic.stringify;
+var _bufferFrom = intrinsic.bufferFrom;
+var _bufToString = intrinsic.uncurry(Buffer.prototype.toString);
+var _bufferConcat = intrinsic.bufferConcat;
+var _bufferAlloc = intrinsic.bufferAlloc;
+var _isBuffer = intrinsic.isBuffer;
+var _keys = intrinsic.keys;
+var _map = intrinsic.map;
+var _forEach = intrinsic.forEach;
+var _indexOf = intrinsic.indexOf;
+var _isInteger = intrinsic.isInteger;
+var _join = intrinsic.join;
+var _filter = intrinsic.filter;
+var _arraySlice = intrinsic.arraySlice;
+var _defineProperty = intrinsic.defineProperty;
+var _max = intrinsic.max;
+var _parseInt = intrinsic.parseInt;
+var _isFinite = intrinsic.isFinite;
+var _String = intrinsic.String;
+var _Number = intrinsic.Number;
+var _BigInt = intrinsic.BigInt;
+var _Uint8Array = intrinsic.Uint8Array;
+var _assign = intrinsic.assign;
+var _create = intrinsic.create;
+var _isView = intrinsic.isView;
+var _toUpperCase = intrinsic.toUpperCase;
+var _toLowerCase = intrinsic.toLowerCase;
+var _stringIndexOf = intrinsic.stringIndexOf;
+var _subarray = intrinsic.subarray;
+var _arrayBufferSlice = intrinsic.arrayBufferSlice;
+var _numberToString = intrinsic.numberToString;
+var _bigIntToString = intrinsic.bigIntToString;
+var _push = intrinsic.push;
+var _concat = intrinsic.concat;
+// Promise.resolve is a constructor method, so it keeps its receiver: `_resolve(Promise, x)`.
+var _resolve = intrinsic.uncurry(intrinsic.promiseResolve);
+var _types = intrinsic.types;
 
 // Single-owner error class -- co-located with its module (framework-error
 // stays the cross-module home; this is webcrypto-private). withCause: a
@@ -58,7 +104,7 @@ function _toBuf(data, who) {
 }
 
 function _toArrayBuffer(buf) {
-  return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);
+  return _arrayBufferSlice(buf.buffer, buf.byteOffset, buf.byteOffset + buf.byteLength);
 }
 
 function _wcErr(code, msg) { return new WebCryptoError(code, msg); }
@@ -68,7 +114,7 @@ function _wcErr(code, msg) { return new WebCryptoError(code, msg); }
 // bogus 6-byte key). Node's own canonical JWK export (_rawPublic) round-trips
 // cleanly, so the strictness is benign there and fail-closed on untrusted import.
 function _b64urlToBuf(s, who) { return guard.encoding.base64url(s, null, _wcErr, "webcrypto/data", who || "base64url value"); }
-function _bufToB64url(buf) { return Buffer.from(buf).toString("base64url"); }
+function _bufToB64url(buf) { return _bufToString(_bufferFrom(buf), "base64url"); }
 
 function _normalizeAlg(algorithm, who) {
   var alg = (typeof algorithm === "string") ? { name: algorithm } : algorithm;
@@ -76,8 +122,8 @@ function _normalizeAlg(algorithm, who) {
     throw new WebCryptoError("webcrypto/syntax", (who || "operation") + ": algorithm must be a string or an object with a name");
   }
   var out = {};
-  for (var k in alg) { if (Object.prototype.hasOwnProperty.call(alg, k)) out[k] = alg[k]; }
-  out.name = alg.name.toUpperCase();
+  for (var k in alg) { if (_hasOwn(alg, k)) out[k] = alg[k]; }
+  out.name = _toUpperCase(alg.name);
   return out;
 }
 
@@ -119,8 +165,11 @@ var XOF_NODE = {
 
 function _hashNode(h, who) {
   var name = (typeof h === "string") ? h : (h && h.name);
-  var node = HASH_NODE[String(name).toUpperCase()];
-  if (!node) throw new WebCryptoError("webcrypto/not-supported", (who || "operation") + ": unsupported hash " + JSON.stringify(name));
+  // The case fold is what picks the registry row, so it runs through the captured method: dispatched
+  // live, a replaced `toUpperCase` answering "SHA-1" makes a caller who asked for SHA-256 receive a
+  // SHA-1 digest, and nothing between here and the hash says the algorithm changed.
+  var node = HASH_NODE[_toUpperCase(_String(name))];
+  if (!node) throw new WebCryptoError("webcrypto/not-supported", (who || "operation") + ": unsupported hash " + _stringify(name));
   return node;
 }
 
@@ -138,10 +187,10 @@ var HMAC_BLOCK_BITS = {
 
 function _hmacLengthBits(alg, who) {
   var name = (typeof alg.hash === "string") ? alg.hash : (alg.hash && alg.hash.name);
-  var blockBits = HMAC_BLOCK_BITS[String(name).toUpperCase()];
-  if (!blockBits) throw new WebCryptoError("webcrypto/not-supported", who + ": unsupported hash " + JSON.stringify(name));
+  var blockBits = HMAC_BLOCK_BITS[_toUpperCase(_String(name))];
+  if (!blockBits) throw new WebCryptoError("webcrypto/not-supported", who + ": unsupported hash " + _stringify(name));
   if (alg.length == null) return blockBits;
-  if (typeof alg.length !== "number" || !isFinite(alg.length) || alg.length <= 0 || alg.length % 8 !== 0) {
+  if (typeof alg.length !== "number" || !_isFinite(alg.length) || alg.length <= 0 || alg.length % 8 !== 0) {
     throw new WebCryptoError("webcrypto/syntax", who + ": HMAC length must be a positive multiple of 8 bits");
   }
   return alg.length;
@@ -161,7 +210,7 @@ var ML_KEM_NODE = { "ML-KEM-512": "ml-kem-512", "ML-KEM-768": "ml-kem-768", "ML-
 var SLH_DSA_NODE = {};
 ["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
  "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
-].forEach(function (s) { SLH_DSA_NODE["SLH-DSA-" + s.toUpperCase()] = "slh-dsa-" + s; });
+].forEach(function (s) { SLH_DSA_NODE["SLH-DSA-" + _toUpperCase(s)] = "slh-dsa-" + s; });
 
 // The algorithm names each keyed operation recognizes. Membership is checked
 // before the algorithm/key name binding so an unrecognized algorithm reports
@@ -169,7 +218,7 @@ var SLH_DSA_NODE = {};
 // InvalidAccessError, matching the W3C error ordering.
 var SIGN_VERIFY_NAMES = {};
 ["RSASSA-PKCS1-V1_5", "RSA-PSS", "ECDSA", "ED25519", "ED448", "HMAC"]
-  .concat(Object.keys(ML_DSA_NODE), Object.keys(SLH_DSA_NODE))
+  .concat(_keys(ML_DSA_NODE), _keys(SLH_DSA_NODE))
   .forEach(function (n) { SIGN_VERIFY_NAMES[n] = true; });
 var ENCRYPT_DECRYPT_NAMES = { "RSA-OAEP": true, "AES-GCM": true, "AES-CBC": true, "AES-CTR": true };
 var DERIVE_NAMES = { "ECDH": true, "X25519": true, "X448": true, "HKDF": true, "PBKDF2": true, "X963KDF": true };
@@ -206,8 +255,16 @@ function CryptoKey(type, extractable, algorithm, usages, handle) {
   this.type = type;
   this.extractable = !!extractable;
   this.algorithm = algorithm;
-  this.usages = usages ? usages.slice() : [];
-  Object.defineProperty(this, "_handle", { value: handle, enumerable: false });
+  // The copy is what the key will be asked about for the rest of its life, so the method that makes
+  // it is the captured one: a replaced `slice` hands back a list the caller still controls. The
+  // list-ness is checked rather than left to the copy to discover -- `Array.prototype.slice` on a
+  // number yields an empty list, so a non-list would have minted a key permitted for NOTHING
+  // instead of naming the bad argument.
+  if (usages != null && !_isArray(usages)) {
+    throw new WebCryptoError("webcrypto/syntax", "usages must be an array of key-usage strings");
+  }
+  this.usages = usages ? _arraySlice(usages) : [];
+  _defineProperty(this, "_handle", { value: handle, enumerable: false });
 }
 
 // This engine reads key material through its own CryptoKey handle, which a key minted by another
@@ -225,8 +282,11 @@ function _requireOwnKey(key, who) {
 
 function _requireUsage(key, usage) {
   _requireOwnKey(key, usage);
-  if (key.usages.indexOf(usage) === -1) {
-    throw new WebCryptoError("webcrypto/invalid-access", "key is not permitted for '" + usage + "' (usages: " + key.usages.join(",") + ")");
+  // The membership test IS the permission check, so it runs through the captured method: dispatched
+  // live, an `Array.prototype.indexOf` replaced after load reports every usage present and a key
+  // minted to verify signs instead, with this refusal never raised.
+  if (_indexOf(key.usages, usage) === -1) {
+    throw new WebCryptoError("webcrypto/invalid-access", "key is not permitted for '" + usage + "' (usages: " + _join(key.usages, ",") + ")");
   }
 }
 
@@ -239,8 +299,8 @@ function _requireUsage(key, usage) {
 // be satisfied by a key of algorithm Y (algorithm confusion).
 function _requireAlgMatch(alg, key, who) {
   var keyName = key && key.algorithm && key.algorithm.name;
-  if (String(keyName).toUpperCase() !== alg.name) {
-    throw new WebCryptoError("webcrypto/invalid-access", who + ": algorithm " + JSON.stringify(alg.name) + " does not match the key's algorithm " + JSON.stringify(keyName));
+  if (_toUpperCase(_String(keyName)) !== alg.name) {
+    throw new WebCryptoError("webcrypto/invalid-access", who + ": algorithm " + _stringify(alg.name) + " does not match the key's algorithm " + _stringify(keyName));
   }
 }
 
@@ -250,7 +310,7 @@ function SubtleCrypto() {}
 
 SubtleCrypto.prototype.digest = async function digest(algorithm, data) {
   var name = _normalizeAlg(algorithm, "digest").name;
-  var xof = XOF_NODE[String(name).toUpperCase()];
+  var xof = XOF_NODE[_toUpperCase(_String(name))];
   // An XOF is always constructed with its output length stated. Omitting it
   // makes node emit a deprecation warning and fall back to a 32-byte squeeze,
   // which for SHAKE256 would silently produce half the required digest.
@@ -263,6 +323,14 @@ SubtleCrypto.prototype.digest = async function digest(algorithm, data) {
 
 SubtleCrypto.prototype.generateKey = async function generateKey(algorithm, extractable, keyUsages) {
   var alg = _normalizeAlg(algorithm, "generateKey");
+  // Before the partition below, not only in the CryptoKey constructor: the asymmetric branch splits
+  // the usages first, and `Array.prototype.filter` treats a non-list as array-like and yields `[]`,
+  // so both halves reached the constructor already valid and the call minted an unusable PAIR
+  // instead of naming the argument. The symmetric branches hand `usages` straight to the
+  // constructor, which is why its own door caught those and not these.
+  if (keyUsages != null && !_isArray(keyUsages)) {
+    throw new WebCryptoError("webcrypto/syntax", "generateKey: keyUsages must be an array of key-usage strings");
+  }
   var usages = keyUsages || [];
   var name = alg.name;
 
@@ -282,8 +350,10 @@ SubtleCrypto.prototype.generateKey = async function generateKey(algorithm, extra
   // Asymmetric key pairs.
   var pair = _generateKeyPair(alg);
   var pubAlg = pair.algorithm;
-  var privUsages = usages.filter(function (u) { return u === "sign" || u === "deriveKey" || u === "deriveBits" || u === "decrypt" || u === "unwrapKey" || u === "decapsulateKey" || u === "decapsulateBits"; });
-  var pubUsages = usages.filter(function (u) { return u === "verify" || u === "encrypt" || u === "wrapKey" || u === "encapsulateKey" || u === "encapsulateBits"; });
+  // Which usages each half of the pair is minted with -- the permission set every later operation
+  // is checked against -- so the partition runs through the captured method.
+  var privUsages = _filter(usages, function (u) { return u === "sign" || u === "deriveKey" || u === "deriveBits" || u === "decrypt" || u === "unwrapKey" || u === "decapsulateKey" || u === "decapsulateBits"; });
+  var pubUsages = _filter(usages, function (u) { return u === "verify" || u === "encrypt" || u === "wrapKey" || u === "encapsulateKey" || u === "encapsulateBits"; });
   return {
     privateKey: new CryptoKey("private", extractable, pubAlg, privUsages, pair.privateKey),
     publicKey:  new CryptoKey("public", true, pubAlg, pubUsages, pair.publicKey),
@@ -304,11 +374,11 @@ function _generateKeyPair(alg) {
     algorithm = { name: _stdName(name), modulusLength: alg.modulusLength || 2048, publicExponent: alg.publicExponent, hash: rsaHash };
   } else if (name === "ECDSA" || name === "ECDH") {
     var curve = alg.namedCurve;
-    if (!CURVE_NODE[curve]) throw new WebCryptoError("webcrypto/not-supported", name + ": unsupported curve " + JSON.stringify(curve));
+    if (!CURVE_NODE[curve]) throw new WebCryptoError("webcrypto/not-supported", name + ": unsupported curve " + _stringify(curve));
     kp = nodeCrypto.generateKeyPairSync("ec", { namedCurve: CURVE_NODE[curve] });
     algorithm = { name: name, namedCurve: curve };
   } else if (name === "ED25519" || name === "ED448" || name === "X25519" || name === "X448") {
-    kp = nodeCrypto.generateKeyPairSync(name.toLowerCase());
+    kp = nodeCrypto.generateKeyPairSync(_toLowerCase(name));
     algorithm = { name: _stdName(name) };
   } else if (ML_DSA_NODE[name]) {
     kp = nodeCrypto.generateKeyPairSync(ML_DSA_NODE[name]);
@@ -320,7 +390,7 @@ function _generateKeyPair(alg) {
     kp = nodeCrypto.generateKeyPairSync(SLH_DSA_NODE[name]);
     algorithm = { name: name };
   } else {
-    throw new WebCryptoError("webcrypto/not-supported", "generateKey: unsupported algorithm " + JSON.stringify(name));
+    throw new WebCryptoError("webcrypto/not-supported", "generateKey: unsupported algorithm " + _stringify(name));
   }
   return { publicKey: kp.publicKey, privateKey: kp.privateKey, algorithm: algorithm };
 }
@@ -354,11 +424,11 @@ function _bufToBigIntNum(exp) {
   if (b.length === 0) {
     throw new WebCryptoError("webcrypto/syntax", "publicExponent must be a non-empty BigInteger octet string");
   }
-  var v = BigInt("0x" + b.toString("hex"));
+  var v = _BigInt("0x" + _bufToString(b, "hex"));
   if (v > 0xffffffffn) {
-    throw new WebCryptoError("webcrypto/syntax", "publicExponent " + v.toString() + " exceeds the 2^32-1 bound");
+    throw new WebCryptoError("webcrypto/syntax", "publicExponent " + _bigIntToString(v) + " exceeds the 2^32-1 bound");
   }
-  return Number(v);
+  return _Number(v);
 }
 
 SubtleCrypto.prototype.sign = async function sign(algorithm, key, data) {
@@ -366,7 +436,7 @@ SubtleCrypto.prototype.sign = async function sign(algorithm, key, data) {
   _requireUsage(key, "sign");
   var buf = _toBuf(data, "sign");
   var name = alg.name;
-  if (!SIGN_VERIFY_NAMES[name]) throw new WebCryptoError("webcrypto/not-supported", "sign: unsupported algorithm " + JSON.stringify(name));
+  if (!SIGN_VERIFY_NAMES[name]) throw new WebCryptoError("webcrypto/not-supported", "sign: unsupported algorithm " + _stringify(name));
   _requireAlgMatch(alg, key, "sign");
   if (name === "RSASSA-PKCS1-V1_5") {
     return _toArrayBuffer(nodeCrypto.sign(_hashNode(key.algorithm.hash, "sign"), buf, key._handle));
@@ -394,7 +464,7 @@ SubtleCrypto.prototype.sign = async function sign(algorithm, key, data) {
     hm.update(buf);
     return _toArrayBuffer(hm.digest());
   }
-  throw new WebCryptoError("webcrypto/not-supported", "sign: unsupported algorithm " + JSON.stringify(name));
+  throw new WebCryptoError("webcrypto/not-supported", "sign: unsupported algorithm " + _stringify(name));
 };
 
 SubtleCrypto.prototype.verify = async function verify(algorithm, key, signature, data) {
@@ -403,7 +473,7 @@ SubtleCrypto.prototype.verify = async function verify(algorithm, key, signature,
   var sig = _toBuf(signature, "verify");
   var buf = _toBuf(data, "verify");
   var name = alg.name;
-  if (!SIGN_VERIFY_NAMES[name]) throw new WebCryptoError("webcrypto/not-supported", "verify: unsupported algorithm " + JSON.stringify(name));
+  if (!SIGN_VERIFY_NAMES[name]) throw new WebCryptoError("webcrypto/not-supported", "verify: unsupported algorithm " + _stringify(name));
   _requireAlgMatch(alg, key, "verify");
   if (name === "RSASSA-PKCS1-V1_5") {
     return nodeCrypto.verify(_hashNode(key.algorithm.hash, "verify"), buf, key._handle, sig);
@@ -437,7 +507,7 @@ SubtleCrypto.prototype.verify = async function verify(algorithm, key, signature,
     var digest = hm.digest();
     return guard.crypto.constantTimeEqual(digest, sig);
   }
-  throw new WebCryptoError("webcrypto/not-supported", "verify: unsupported algorithm " + JSON.stringify(name));
+  throw new WebCryptoError("webcrypto/not-supported", "verify: unsupported algorithm " + _stringify(name));
 };
 
 // Run a node:crypto AES cipher sequence, converting any raw node fault -- a bad IV length,
@@ -455,7 +525,7 @@ SubtleCrypto.prototype.encrypt = async function encrypt(algorithm, key, data) {
   _requireUsage(key, "encrypt");
   var buf = _toBuf(data, "encrypt");
   var name = alg.name;
-  if (!ENCRYPT_DECRYPT_NAMES[name]) throw new WebCryptoError("webcrypto/not-supported", "encrypt: unsupported algorithm " + JSON.stringify(name));
+  if (!ENCRYPT_DECRYPT_NAMES[name]) throw new WebCryptoError("webcrypto/not-supported", "encrypt: unsupported algorithm " + _stringify(name));
   _requireAlgMatch(alg, key, "encrypt");
   if (name === "RSA-OAEP") {
     return _toArrayBuffer(nodeCrypto.publicEncrypt({
@@ -472,7 +542,7 @@ SubtleCrypto.prototype.encrypt = async function encrypt(algorithm, key, data) {
         var cipher = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-gcm", kb, iv, { authTagLength: (alg.tagLength || 128) / 8 });
         if (aad) cipher.setAAD(aad);
         var ct = guard.secret.cipherFinish(cipher, buf, WebCryptoError, "webcrypto/operation", "an AES-GCM encrypt intermediate");
-        return Buffer.concat([ct, cipher.getAuthTag()]);
+        return _bufferConcat([ct, cipher.getAuthTag()]);
       });
     }, "encrypt"));
   }
@@ -495,7 +565,7 @@ SubtleCrypto.prototype.encrypt = async function encrypt(algorithm, key, data) {
       });
     }, "encrypt"));
   }
-  throw new WebCryptoError("webcrypto/not-supported", "encrypt: unsupported algorithm " + JSON.stringify(name));
+  throw new WebCryptoError("webcrypto/not-supported", "encrypt: unsupported algorithm " + _stringify(name));
 };
 
 SubtleCrypto.prototype.decrypt = async function decrypt(algorithm, key, data) {
@@ -503,7 +573,7 @@ SubtleCrypto.prototype.decrypt = async function decrypt(algorithm, key, data) {
   _requireUsage(key, "decrypt");
   var buf = _toBuf(data, "decrypt");
   var name = alg.name;
-  if (!ENCRYPT_DECRYPT_NAMES[name]) throw new WebCryptoError("webcrypto/not-supported", "decrypt: unsupported algorithm " + JSON.stringify(name));
+  if (!ENCRYPT_DECRYPT_NAMES[name]) throw new WebCryptoError("webcrypto/not-supported", "decrypt: unsupported algorithm " + _stringify(name));
   _requireAlgMatch(alg, key, "decrypt");
   if (name === "RSA-OAEP") {
     // For a CMS key-transport recipient this plaintext IS the recovered content-encryption key, and
@@ -521,8 +591,10 @@ SubtleCrypto.prototype.decrypt = async function decrypt(algorithm, key, data) {
     var tagLen = (alg.tagLength || 128) / 8;
     var iv = _toBuf(alg.iv, "AES-GCM iv");
     if (buf.length < tagLen) throw new WebCryptoError("webcrypto/operation", "decrypt: AES-GCM ciphertext is shorter than its authentication tag");
-    var ct = buf.subarray(0, buf.length - tagLen);
-    var tag = buf.subarray(buf.length - tagLen);
+    // The split between ciphertext and tag decides which bytes are authenticated, so the window it
+    // is taken with is the captured one: a replaced `subarray` hands the tag check other bytes.
+    var ct = _subarray(buf, 0, buf.length - tagLen);
+    var tag = _subarray(buf, buf.length - tagLen);
     var gcmAad = alg.additionalData ? _toBuf(alg.additionalData, "AES-GCM aad") : null;
     return _toArrayBuffer(_runCipher(function () {
       return _withSecretBytes(key, function (kb) {
@@ -554,7 +626,7 @@ SubtleCrypto.prototype.decrypt = async function decrypt(algorithm, key, data) {
       });
     }, "decrypt"));
   }
-  throw new WebCryptoError("webcrypto/not-supported", "decrypt: unsupported algorithm " + JSON.stringify(name));
+  throw new WebCryptoError("webcrypto/not-supported", "decrypt: unsupported algorithm " + _stringify(name));
 };
 
 // _withSecretBytes(key, fn) -- export a secret key's raw material, hand it to fn, and wipe
@@ -607,7 +679,7 @@ function _requireCtrLength128(alg) {
 // the `length / 8` narrowing in the per-algorithm branches below would
 // otherwise silently truncate a fractional byte count.
 function _requireDeriveLength(length, who) {
-  if (typeof length !== "number" || !isFinite(length) || length <= 0 || length % 8 !== 0) {
+  if (typeof length !== "number" || !_isFinite(length) || length <= 0 || length % 8 !== 0) {
     throw new WebCryptoError("webcrypto/operation", who + ": length must be a positive multiple of 8 bits");
   }
 }
@@ -622,7 +694,7 @@ function _requireDeriveLength(length, who) {
 // Concurrency is CAPPED so many high-iteration jobs cannot monopolize the whole worker pool and starve
 // unrelated DNS / filesystem / crypto work: at least two pool threads are left free (default pool is four),
 // and derivations beyond the cap queue and run as slots free. The cap tracks UV_THREADPOOL_SIZE when raised.
-var _PBKDF2_MAX_CONCURRENT = Math.max(1, (parseInt(process.env.UV_THREADPOOL_SIZE, 10) || 4) - 2);
+var _PBKDF2_MAX_CONCURRENT = _max(1, (_parseInt(process.env.UV_THREADPOOL_SIZE, 10) || 4) - 2);
 var _pbkdf2InFlight = 0;
 var _pbkdf2Waiters = [];
 function _pbkdf2Async(pw, salt, iterations, keylen, digest) {
@@ -663,7 +735,7 @@ async function _deriveBitsRaw(alg, key, length) {
       if (length / 8 > secret.length) {
         throw new WebCryptoError("webcrypto/operation", name + ": requested " + length + " bits but the shared secret has " + (secret.length * 8));
       }
-      return _toArrayBuffer(secret.subarray(0, length / 8));
+      return _toArrayBuffer(_subarray(secret, 0, length / 8));
     } finally {
       guard.secret.zeroize(secret, WebCryptoError, "webcrypto/operation", "the raw key-agreement shared secret");
     }
@@ -674,8 +746,8 @@ async function _deriveBitsRaw(alg, key, length) {
     // itself. A controllable allocation, not one of the runtime-internal copies the best-effort
     // caveat covers, so it is wiped once the derivation has consumed it.
     return _withSecretBytes(key, function (ikm) {
-      var derived = nodeCrypto.hkdfSync(_hashNode(alg.hash, "HKDF"), ikm, _toBuf(alg.salt, "HKDF salt"), _toBuf(alg.info || Buffer.alloc(0), "HKDF info"), length / 8);
-      return derived instanceof ArrayBuffer ? derived : _toArrayBuffer(Buffer.from(derived));
+      var derived = nodeCrypto.hkdfSync(_hashNode(alg.hash, "HKDF"), ikm, _toBuf(alg.salt, "HKDF salt"), _toBuf(alg.info || _bufferAlloc(0), "HKDF info"), length / 8);
+      return derived instanceof ArrayBuffer ? derived : _toArrayBuffer(_bufferFrom(derived));
     });
   }
   if (name === "PBKDF2") {
@@ -700,13 +772,13 @@ async function _deriveBitsRaw(alg, key, length) {
     // The base key here HOLDS the ECDH shared secret Z of an RFC 5753 kari, so this export is
     // exactly as sensitive as the raw agreement secret wiped above.
     return _withSecretBytes(key, function (z) {
-      var derived = _x963Kdf(_hashNode(alg.hash, "X963KDF"), z, _toBuf(alg.info || Buffer.alloc(0), "X963KDF SharedInfo"), length / 8);
+      var derived = _x963Kdf(_hashNode(alg.hash, "X963KDF"), z, _toBuf(alg.info || _bufferAlloc(0), "X963KDF SharedInfo"), length / 8);
       // Same as PBKDF2 above: the copy is what the caller receives, so the derived buffer is cleared.
       try { return _toArrayBuffer(derived); }
       finally { guard.secret.zeroize(derived, WebCryptoError, "webcrypto/operation", "the X9.63 KDF output"); }
     });
   }
-  throw new WebCryptoError("webcrypto/not-supported", "deriveBits: unsupported algorithm " + JSON.stringify(name));
+  throw new WebCryptoError("webcrypto/not-supported", "deriveBits: unsupported algorithm " + _stringify(name));
 }
 
 // The X9.63 single-step KDF counter loop. Bounded by the 2^32 counter range; every input is a
@@ -715,16 +787,16 @@ function _x963Kdf(hashNode, z, sharedInfo, lenBytes) {
   var blocks = [], counter = 1, got = 0;
   while (got < lenBytes) {
     if (counter > 0xffffffff) throw new WebCryptoError("webcrypto/operation", "X963KDF: requested output exceeds the counter range");
-    var ctr = Buffer.alloc(4); ctr.writeUInt32BE(counter, 0);
+    var ctr = _bufferAlloc(4); ctr.writeUInt32BE(counter, 0);
     var h = nodeCrypto.createHash(hashNode).update(z).update(ctr).update(sharedInfo).digest();
-    blocks.push(h); got += h.length; counter += 1;
+    _push(blocks, h); got += h.length; counter += 1;
   }
   // Return an exact-sized buffer the caller wholly owns, not a VIEW over the joined blocks: a
   // caller clearing what it received would otherwise leave the unused tail of the final digest
   // block -- derived from the shared secret -- readable behind it. The accumulator and the
   // per-block digests are cleared here, where they were allocated.
-  var joined = Buffer.concat(blocks);
-  var exact = Buffer.alloc(lenBytes);
+  var joined = _bufferConcat(blocks);
+  var exact = _bufferAlloc(lenBytes);
   joined.copy(exact, 0, 0, lenBytes);
   guard.secret.zeroize(joined, WebCryptoError, "webcrypto/operation", "the KDF accumulator");
   for (var bi = 0; bi < blocks.length; bi++) guard.secret.zeroize(blocks[bi], WebCryptoError, "webcrypto/operation", "a KDF block");
@@ -734,7 +806,7 @@ function _x963Kdf(hashNode, z, sharedInfo, lenBytes) {
 SubtleCrypto.prototype.deriveBits = async function deriveBits(algorithm, key, length) {
   var alg = _normalizeAlg(algorithm, "deriveBits");
   _requireUsage(key, "deriveBits");
-  if (!DERIVE_NAMES[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "deriveBits: unsupported algorithm " + JSON.stringify(alg.name));
+  if (!DERIVE_NAMES[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "deriveBits: unsupported algorithm " + _stringify(alg.name));
   _requireAlgMatch(alg, key, "deriveBits");
   return _deriveBitsRaw(alg, key, length);
 };
@@ -746,11 +818,11 @@ SubtleCrypto.prototype.deriveKey = async function deriveKey(algorithm, baseKey,
   // here and route the raw derivation past deriveBits' own usage gate.
   _requireUsage(baseKey, "deriveKey");
   var alg = _normalizeAlg(algorithm, "deriveKey");
-  if (!DERIVE_NAMES[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "deriveKey: unsupported algorithm " + JSON.stringify(alg.name));
+  if (!DERIVE_NAMES[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "deriveKey: unsupported algorithm " + _stringify(alg.name));
   _requireAlgMatch(alg, baseKey, "deriveKey");
   var dk = _normalizeAlg(derivedKeyType, "deriveKey");
   var bits;
-  if (dk.name.indexOf("AES") === 0) {
+  if (_stringIndexOf(dk.name, "AES") === 0) {
     // W3C get-key-length for AES: the derivedKeyType MUST carry a length of
     // 128/192/256. Without this check the derived key would silently take
     // the size of the raw agreement/KDF output (e.g. a 384-bit "AES" key
@@ -775,7 +847,7 @@ SubtleCrypto.prototype.deriveKey = async function deriveKey(algorithm, baseKey,
   // failing import too (a bad derivedKeyType is caller-controlled).
   var raw = await _deriveBitsRaw(alg, baseKey, bits);
   try { return await this.importKey("raw", raw, dk, extractable, keyUsages); }
-  finally { guard.secret.zeroize(new Uint8Array(raw), WebCryptoError, "webcrypto/operation", "the derived key material"); }
+  finally { guard.secret.zeroize(new _Uint8Array(raw), WebCryptoError, "webcrypto/operation", "the derived key material"); }
 };
 
 // ML-KEM (FIPS 203) key encapsulation over Node's crypto.encapsulate/decapsulate.
@@ -791,9 +863,9 @@ SubtleCrypto.prototype.deriveKey = async function deriveKey(algorithm, baseKey,
 SubtleCrypto.prototype.encapsulateBits = async function encapsulateBits(algorithm, encapsulationKey) {
   var alg = _normalizeAlg(algorithm, "encapsulateBits");
   _requireUsage(encapsulationKey, "encapsulateBits");
-  if (!ML_KEM_NODE[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "encapsulateBits: unsupported algorithm " + JSON.stringify(alg.name));
+  if (!ML_KEM_NODE[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "encapsulateBits: unsupported algorithm " + _stringify(alg.name));
   _requireAlgMatch(alg, encapsulationKey, "encapsulateBits");
-  if (encapsulationKey.type !== "public") throw new WebCryptoError("webcrypto/invalid-access", "encapsulateBits requires a public (encapsulation) key, got " + JSON.stringify(encapsulationKey.type));
+  if (encapsulationKey.type !== "public") throw new WebCryptoError("webcrypto/invalid-access", "encapsulateBits requires a public (encapsulation) key, got " + _stringify(encapsulationKey.type));
   var r;
   try { r = nodeCrypto.encapsulate(encapsulationKey._handle); }
   catch (e) { throw new WebCryptoError("webcrypto/operation", "encapsulateBits: ML-KEM encapsulation failed", e); }
@@ -814,9 +886,9 @@ SubtleCrypto.prototype.encapsulateBits = async function encapsulateBits(algorith
 SubtleCrypto.prototype.decapsulateBits = async function decapsulateBits(algorithm, decapsulationKey, ciphertext) {
   var alg = _normalizeAlg(algorithm, "decapsulateBits");
   _requireUsage(decapsulationKey, "decapsulateBits");
-  if (!ML_KEM_NODE[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "decapsulateBits: unsupported algorithm " + JSON.stringify(alg.name));
+  if (!ML_KEM_NODE[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "decapsulateBits: unsupported algorithm " + _stringify(alg.name));
   _requireAlgMatch(alg, decapsulationKey, "decapsulateBits");
-  if (decapsulationKey.type !== "private") throw new WebCryptoError("webcrypto/invalid-access", "decapsulateBits requires a private (decapsulation) key, got " + JSON.stringify(decapsulationKey.type));
+  if (decapsulationKey.type !== "private") throw new WebCryptoError("webcrypto/invalid-access", "decapsulateBits requires a private (decapsulation) key, got " + _stringify(decapsulationKey.type));
   var ct = _toBuf(ciphertext, "decapsulateBits ciphertext");
   // FIPS 203 sec. 7.3 makes the ciphertext-length check the ONE per-execution input check a
   // decapsulating party owes, so it belongs here, at the engine boundary, rather than only in the
@@ -858,25 +930,25 @@ SubtleCrypto.prototype.wrapKey = async function wrapKey(format, key, wrappingKey
   // exists to protect. It is this function's allocation and is cleared once the wrap has consumed
   // it, on the delegated branch as well as the AES-KW one.
   var exported = await this.exportKey(format, key);
-  var bytes = (format === "jwk") ? Buffer.from(JSON.stringify(exported)) : Buffer.from(exported);
+  var bytes = (format === "jwk") ? _bufferFrom(_stringify(exported)) : _bufferFrom(exported);
   try {
   var alg = _normalizeAlg(wrapAlgorithm, "wrapKey");
   _requireUsage(wrappingKey, "wrapKey");
-  if (alg.name !== "AES-KW" && !ENCRYPT_DECRYPT_NAMES[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "wrapKey: unsupported algorithm " + JSON.stringify(alg.name));
+  if (alg.name !== "AES-KW" && !ENCRYPT_DECRYPT_NAMES[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "wrapKey: unsupported algorithm " + _stringify(alg.name));
   _requireAlgMatch(alg, wrappingKey, "wrapKey");
   if (alg.name === "AES-KW") {
     // AES-KW wraps 64-bit blocks (RFC 3394): the serialized key MUST be a multiple of 8
     // bytes and at least 16. A "jwk" serialization (arbitrary-length JSON) or any other
     // non-conforming length is an OperationError -- a typed verdict, never a raw node fault.
     if (bytes.length < 16 || bytes.length % 8 !== 0) {
-      throw new WebCryptoError("webcrypto/operation", "wrapKey: AES-KW requires the serialized key be a multiple of 8 bytes (>= 16); got " + bytes.length + " -- format " + JSON.stringify(format) + " is not AES-KW-wrappable");
+      throw new WebCryptoError("webcrypto/operation", "wrapKey: AES-KW requires the serialized key be a multiple of 8 bytes (>= 16); got " + bytes.length + " -- format " + _stringify(format) + " is not AES-KW-wrappable");
     }
     // The mirror of unwrapKey below: in a KEM flow this export is the SENDER's copy of the same
     // key-encryption key, so leaving it unwiped would keep a full copy of the KEK alive for the
     // process lifetime and make the wipes the CMS layer performs pointless in the encrypt direction.
     try {
       return _withSecretBytes(wrappingKey, function (wkBytes) {
-        var c = nodeCrypto.createCipheriv("aes" + wrappingKey.algorithm.length + "-wrap", wkBytes, Buffer.from("A6A6A6A6A6A6A6A6", "hex"));
+        var c = nodeCrypto.createCipheriv("aes" + wrappingKey.algorithm.length + "-wrap", wkBytes, _bufferFrom("A6A6A6A6A6A6A6A6", "hex"));
         return _toArrayBuffer(guard.secret.cipherFinish(c, bytes, WebCryptoError, "webcrypto/operation", "an AES-KW wrap intermediate"));
       });
     } catch (e) { throw new WebCryptoError("webcrypto/operation", "wrapKey: AES-KW key wrap failed", e); }
@@ -902,7 +974,7 @@ SubtleCrypto.prototype.unwrapKey = async function unwrapKey(format, wrappedKey,
   // never verify the caller was actually permitted to unwrap (mirrors
   // wrapKey, which checks before both of its paths).
   _requireUsage(unwrappingKey, "unwrapKey");
-  if (alg.name !== "AES-KW" && !ENCRYPT_DECRYPT_NAMES[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "unwrapKey: unsupported algorithm " + JSON.stringify(alg.name));
+  if (alg.name !== "AES-KW" && !ENCRYPT_DECRYPT_NAMES[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "unwrapKey: unsupported algorithm " + _stringify(alg.name));
   _requireAlgMatch(alg, unwrappingKey, "unwrapKey");
   var bytes;
   if (alg.name === "AES-KW") {
@@ -921,13 +993,13 @@ SubtleCrypto.prototype.unwrapKey = async function unwrapKey(format, wrappedKey,
     // would also break the fuzz-harness contract.
     try {
       bytes = _withSecretBytes(unwrappingKey, function (kwBytes) {
-        var d = nodeCrypto.createDecipheriv("aes" + unwrappingKey.algorithm.length + "-wrap", kwBytes, Buffer.from("A6A6A6A6A6A6A6A6", "hex"));
+        var d = nodeCrypto.createDecipheriv("aes" + unwrappingKey.algorithm.length + "-wrap", kwBytes, _bufferFrom("A6A6A6A6A6A6A6A6", "hex"));
         return guard.secret.cipherFinish(d, wrapped, WebCryptoError, "webcrypto/operation", "the unwrapped key material");
       });
     } catch (e) { throw new WebCryptoError("webcrypto/operation", "unwrapKey: AES-KW key unwrap failed (integrity or length)", e); }
   } else {
     var unwrapKeyClone = _cloneWithUsage(unwrappingKey, "decrypt");
-    bytes = Buffer.from(await this.decrypt(unwrapAlgorithm, unwrapKeyClone, wrappedKey));
+    bytes = _bufferFrom(await this.decrypt(unwrapAlgorithm, unwrapKeyClone, wrappedKey));
   }
   var keyData;
   if (format === "jwk") {
@@ -955,7 +1027,7 @@ SubtleCrypto.prototype.unwrapKey = async function unwrapKey(format, wrappedKey,
 };
 
 function _cloneWithUsage(key, usage) {
-  var k = new CryptoKey(key.type, key.extractable, key.algorithm, key.usages.concat([usage]), key._handle);
+  var k = new CryptoKey(key.type, key.extractable, key.algorithm, _concat(key.usages, [usage]), key._handle);
   return k;
 }
 
@@ -1034,7 +1106,7 @@ function _validateMlKemInner(innerBytes, sizes) {
 // per-algorithm structural check lives here, at the one import boundary. Only ML-KEM needs it
 // today: the engine ACCEPTS the OpenSSL-legacy bare-seed layout RFC 9935 sec. 6 forbids.
 var PKCS8_INNER_VALIDATORS = {};
-Object.keys(ML_KEM_INNER).forEach(function (o) { PKCS8_INNER_VALIDATORS[o] = function (inner) { _validateMlKemInner(inner, ML_KEM_INNER[o]); }; });
+_forEach(_keys(ML_KEM_INNER), function (o) { PKCS8_INNER_VALIDATORS[o] = function (inner) { _validateMlKemInner(inner, ML_KEM_INNER[o]); }; });
 
 function _preValidatePkcs8(p8, name) {
   if (!ML_KEM_NODE[name]) return;   // only the ML-KEM CHOICE carries the bare-seed hazard
@@ -1090,7 +1162,7 @@ SubtleCrypto.prototype.importKey = async function importKey(format, keyData, alg
     // A JWK is a JSON object; null / undefined / an array / a primitive (incl. the JSON token
     // `null` from an unwrapKey over non-authenticating ciphertext) fails closed as a typed
     // DataError, never a raw property-access TypeError.
-    if (jwk === null || typeof jwk !== "object" || Array.isArray(jwk)) {
+    if (jwk === null || typeof jwk !== "object" || _isArray(jwk)) {
       throw new WebCryptoError("webcrypto/data", "importKey jwk: keyData must be a JsonWebKey object");
     }
     if (jwk.kty === "oct") {
@@ -1109,12 +1181,12 @@ SubtleCrypto.prototype.importKey = async function importKey(format, keyData, alg
     // unrecognized member to be ignored, so a member of that name on an EC or OKP JWK is an
     // extension this implementation has no meaning for -- reading it as private material there
     // would turn a valid public-key import into a failure.
-    var isPrivate = Object.prototype.hasOwnProperty.call(jwk, "d") ||
-      (jwk.kty === "AKP" && Object.prototype.hasOwnProperty.call(jwk, "priv"));
+    var isPrivate = _hasOwn(jwk, "d") ||
+      (jwk.kty === "AKP" && _hasOwn(jwk, "priv"));
     var ko = _nodeKey(function () { return isPrivate ? nodeCrypto.createPrivateKey({ key: jwk, format: "jwk" }) : nodeCrypto.createPublicKey({ key: jwk, format: "jwk" }); }, "importKey jwk");
     return new CryptoKey(isPrivate ? "private" : "public", isPrivate ? extractable : true, _algFromImport(name, alg, ko), usages, ko);
   }
-  throw new WebCryptoError("webcrypto/not-supported", "importKey: unsupported format " + JSON.stringify(format));
+  throw new WebCryptoError("webcrypto/not-supported", "importKey: unsupported format " + _stringify(format));
 };
 
 function _importRawPublic(name, alg, raw, extractable, usages) {
@@ -1128,11 +1200,11 @@ function _importRawPublic(name, alg, raw, extractable, usages) {
   if (name === "ECDSA" || name === "ECDH") {
     var fb = CURVE_FIELD_BYTES[alg.namedCurve];
     if (!fb || raw[0] !== 0x04 || raw.length !== 1 + 2 * fb) throw new WebCryptoError("webcrypto/data", "importKey raw EC: expected an uncompressed point for " + alg.namedCurve);
-    var ecjwk = { kty: "EC", crv: alg.namedCurve, x: _bufToB64url(raw.subarray(1, 1 + fb)), y: _bufToB64url(raw.subarray(1 + fb)) };
+    var ecjwk = { kty: "EC", crv: alg.namedCurve, x: _bufToB64url(_subarray(raw, 1, 1 + fb)), y: _bufToB64url(_subarray(raw, 1 + fb)) };
     var eck = nodeCrypto.createPublicKey({ key: ecjwk, format: "jwk" });
     return new CryptoKey("public", true, { name: name, namedCurve: alg.namedCurve }, usages, eck);
   }
-  throw new WebCryptoError("webcrypto/not-supported", "importKey raw: unsupported public-key algorithm " + JSON.stringify(name));
+  throw new WebCryptoError("webcrypto/not-supported", "importKey raw: unsupported public-key algorithm " + _stringify(name));
 }
 
 // The node asymmetricKeyType(s) each imported asymmetric algorithm requires. The key TYPE
@@ -1149,7 +1221,7 @@ var IMPORT_KEY_TYPE = {
 // algorithm name maps to exactly its node asymmetricKeyType, so an RSA (or any) key imported
 // under an ML-DSA / ML-KEM / SLH-DSA name is a DataError, not a mislabeled PQC CryptoKey.
 [ML_DSA_NODE, ML_KEM_NODE, SLH_DSA_NODE].forEach(function (m) {
-  Object.keys(m).forEach(function (webName) { var t = {}; t[m[webName]] = 1; IMPORT_KEY_TYPE[webName] = t; });
+  _forEach(_keys(m), function (webName) { var t = {}; t[m[webName]] = 1; IMPORT_KEY_TYPE[webName] = t; });
 });
 function _algFromImport(name, alg, keyObject) {
   var wantType = IMPORT_KEY_TYPE[name];
@@ -1169,8 +1241,8 @@ function _algFromImport(name, alg, keyObject) {
       throw new WebCryptoError("webcrypto/not-supported", name + ": imported key uses an unsupported EC curve");
     }
     if (alg.namedCurve && alg.namedCurve !== actualCurve) {
-      throw new WebCryptoError("webcrypto/data", name + ": importKey namedCurve " + JSON.stringify(alg.namedCurve) +
-        " does not match the imported key's curve " + JSON.stringify(actualCurve));
+      throw new WebCryptoError("webcrypto/data", name + ": importKey namedCurve " + _stringify(alg.namedCurve) +
+        " does not match the imported key's curve " + _stringify(actualCurve));
     }
     return { name: name, namedCurve: actualCurve };
   }
@@ -1243,13 +1315,13 @@ SubtleCrypto.prototype.exportKey = async function exportKey(format, key) {
     }
     return _toArrayBuffer(_rawPublic(key));
   }
-  throw new WebCryptoError("webcrypto/not-supported", "exportKey: unsupported format " + JSON.stringify(format));
+  throw new WebCryptoError("webcrypto/not-supported", "exportKey: unsupported format " + _stringify(format));
 };
 
 function _rawPublic(key) {
   var jwk = key._handle.export({ format: "jwk" });
   if (jwk.kty === "OKP") return _b64urlToBuf(jwk.x);
-  if (jwk.kty === "EC") return Buffer.concat([Buffer.from([0x04]), _b64urlToBuf(jwk.x), _b64urlToBuf(jwk.y)]);
+  if (jwk.kty === "EC") return _bufferConcat([_bufferFrom([0x04]), _b64urlToBuf(jwk.x), _b64urlToBuf(jwk.y)]);
   throw new WebCryptoError("webcrypto/not-supported", "exportKey raw: unsupported key type " + jwk.kty);
 }
 
@@ -1275,7 +1347,10 @@ function Crypto() {
 }
 
 Crypto.prototype.getRandomValues = function getRandomValues(typedArray) {
-  if (!ArrayBuffer.isView(typedArray) || typedArray instanceof Float32Array || typedArray instanceof Float64Array || typedArray instanceof DataView) {
+  // The kinds W3C WebCrypto refuses here are settled from the value's internal slot, not from an
+  // `instanceof` against a replaceable global: replace `Float32Array` after load and the comparison
+  // is against a different constructor, so a real Float32Array passes a check written to reject it.
+  if (!_isView(typedArray) || _types.isFloat32Array(typedArray) || _types.isFloat64Array(typedArray) || _types.isDataView(typedArray)) {
     throw new WebCryptoError("webcrypto/data", "getRandomValues: expected an integer TypedArray");
   }
   // Re-view the (already integer-TypedArray-validated) output buffer through the OUTPUT door --
@@ -1327,14 +1402,14 @@ function decompressEcPoint(sec1Compressed, nodeCurve, E, code) {
 var _crypto = new Crypto();
 // Null-prototype:  is caller-supplied, and an inherited member ("constructor", "toString")
 // would otherwise resolve to a truthy non-format and slip past the check below.
-var _EXPORT_FORMAT = Object.assign(Object.create(null), { "private": "pkcs8", "public": "spki", "secret": "raw" });
+var _EXPORT_FORMAT = _assign(_create(null), { "private": "pkcs8", "public": "spki", "secret": "raw" });
 
 // @internal
 // True for any object shaped like a WebCrypto CryptoKey, whichever implementation minted it.
 function isCryptoKeyLike(x) {
   return !!x && typeof x === "object" && typeof x.type === "string" &&
     typeof x.extractable === "boolean" && !!x.algorithm && typeof x.algorithm === "object" &&
-    typeof x.algorithm.name === "string" && Array.isArray(x.usages);
+    typeof x.algorithm.name === "string" && _isArray(x.usages);
 }
 
 // @internal
@@ -1346,9 +1421,9 @@ function exportAnyKey(key, E, code) {
   var format = _EXPORT_FORMAT[key && key.type];
   if (!format) throw E(code, "a CryptoKey with a private, public, or secret type is required");
   if (key instanceof CryptoKey) {
-    return Promise.resolve()
+    return _resolve(Promise)
       .then(function () { return _crypto.subtle.exportKey(format, key); })
-      .then(function (b) { return Buffer.from(b); });
+      .then(function (b) { return _bufferFrom(b); });
   }
   if (!key.extractable) {
     throw E(code, "the CryptoKey comes from a different WebCrypto implementation and is not extractable, so its key material cannot be reached; import it through pki.webcrypto.subtle, or pass the key as DER");
@@ -1360,18 +1435,18 @@ function exportAnyKey(key, E, code) {
   // key's own extractable promise is this branch's responsibility, not the crypto library's.
   var handle = key._handle;
   if (handle instanceof nodeCrypto.KeyObject && handle.type === key.type) {
-    return Promise.resolve().then(function () {
+    return _resolve(Promise).then(function () {
       return format === "raw" ? handle.export() : handle.export({ format: "der", type: format });
-    }).then(function (b) { return Buffer.from(b); }, function (e) {
+    }).then(function (b) { return _bufferFrom(b); }, function (e) {
       throw E(code, "the CryptoKey comes from a different copy of this WebCrypto engine and its key material could not be read; import it through pki.webcrypto.subtle, or pass the key as DER", e);
     });
   }
   // Otherwise the only remaining implementation whose keys are reachable from this process is the
   // platform's own. A third party's -- a browser's, a userland polyfill's -- keeps its material
   // behind its own SubtleCrypto, which nothing here holds a reference to, so it is refused below.
-  return Promise.resolve()
+  return _resolve(Promise)
     .then(function () { return nodeCrypto.webcrypto.subtle.exportKey(format, key); })
-    .then(function (b) { return Buffer.from(b); }, function (e) {
+    .then(function (b) { return _bufferFrom(b); }, function (e) {
       throw E(code, "the CryptoKey comes from a different WebCrypto implementation and could not be exported for re-import; import it through pki.webcrypto.subtle, or pass the key as DER", e);
     });
 }
@@ -1381,19 +1456,19 @@ function exportAnyKey(key, E, code) {
 // key of its own keeps working -- and a foreign one is re-imported. `importParams` may be null, in
 // which case the key's own `algorithm` is used, which is what the key actually is.
 function adoptKey(key, importParams, usages, E, code) {
-  if (key instanceof CryptoKey) return Promise.resolve(key);
+  if (key instanceof CryptoKey) return _resolve(Promise, key);
   // A key's usages are a capability restriction it carries, and re-importing it is the one moment
   // that restriction could be widened -- the new key is created with the usages the CALLER wants,
   // not the ones the original was created with. Require every one of them up front, so an adopted
   // key can do no more than it could where it came from, and a verify-only key is refused here
   // exactly as this engine's own verify-only key is refused by _requireUsage.
-  if (!Array.isArray(key.usages)) throw E(code, "a CryptoKey carrying its permitted usages is required");
+  if (!_isArray(key.usages)) throw E(code, "a CryptoKey carrying its permitted usages is required");
   for (var i = 0; i < usages.length; i++) {
-    if (key.usages.indexOf(usages[i]) === -1) {
-      throw E(code, "the CryptoKey is not permitted for '" + usages[i] + "' (usages: " + key.usages.join(",") + ")");
+    if (_indexOf(key.usages, usages[i]) === -1) {
+      throw E(code, "the CryptoKey is not permitted for '" + usages[i] + "' (usages: " + _join(key.usages, ",") + ")");
     }
   }
-  return Promise.resolve()
+  return _resolve(Promise)
     .then(function () { return exportAnyKey(key, E, code); })
     .then(function (der) {
       return _crypto.subtle.importKey(_EXPORT_FORMAT[key.type], der, importParams || key.algorithm, false, usages);