@blamejs/pki 0.5.18 → 0.5.19

package/CHANGELOG.md

@@ -4,6 +4,25 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.5.19 — 2026-08-20
+
+The crypto engine and the JWS signer decide with operations captured at load, so code that runs after the module does cannot change what a permission check concludes.
+
+### Changed
+
+- `pki.webcrypto` and `pki.jose` are held to the live-read rule the guard family already follows: the check over `lib/` that refuses reading an operation from the runtime at call time covers every module that takes the captures, and these two now do. Operator-visible behavior is unchanged except where a refusal that could be bypassed now holds.
+
+### Fixed
+
+- The WebCrypto key-usage check holds against a replaced `Array.prototype.indexOf`. The membership test IS the permission decision, so it runs through the captured method: dispatched live, a key permitted only for `verify` passed the engine's gate for `sign` and failed later, in the platform's own crypto, with an untyped fault instead of `webcrypto/invalid-access`.
+- A CryptoKey's usage list is a copy this engine took with a captured `slice`, so a replaced one cannot leave the caller holding the array the key is checked against for the rest of its life. The same applies to the partition that decides which usages each half of a generated pair is minted with.
+- `pki.key.import`, `pki.key.generate` and `subtle.generateKey` refuse a non-array `usages` by name. It reached the key constructor, where `Array.prototype.slice` on a number yields an empty list, so the call minted a key permitted for nothing rather than naming the argument that was wrong. The asymmetric branch of `generateKey` partitions the usages before either half is constructed and `filter` treats a non-list the same way, so it is checked at that verb's own door and the whole pair is refused.
+- The AES-GCM ciphertext and authentication tag are split with a captured `subarray`, so a replaced one cannot hand the tag check a different range of the same buffer.
+- A JWK thumbprint (RFC 7638 sec. 3.3) is built with a captured serializer. The canonical JSON is the thumbprint's preimage, so a replaced `JSON.stringify` changes the identity every consumer compares keys by.
+- The JOSE header checks -- own-name reads, the `crit` list walk, the embedded-JWK shape test -- and the protected-header serialization all run on captured operations, so a caller who reaches the header through an accessor cannot decide which of them apply.
+- A digest runs under the algorithm the caller named. The hash name is case-folded to pick its registry row, and dispatched live a replaced `String.prototype.toUpperCase` answering `SHA-1` gave a caller who asked for SHA-256 a 20-byte digest. The same fold picks the HMAC block size and decides whether a key's algorithm matches the operation's.
+- `getRandomValues` settles the kinds WebCrypto refuses from the value's internal slot rather than by `instanceof` against a replaceable global, so a real `Float32Array` cannot pass a check written to reject it by swapping the constructor the comparison names.
+
 ## v0.5.18 — 2026-08-20
 
 Every producing verb refuses an authoring field it does not read, so a misspelling is a refusal at the call instead of a signed artifact that quietly omits what was asked for.

package/lib/guard-intrinsic.js

@@ -84,6 +84,10 @@ var _jsonStringify = JSON.stringify;
 var _mathFloor = Math.floor;
 var _mathCeil = Math.ceil;
 var _mathMin = Math.min;
+var _mathMax = Math.max;
+// A numeric parse a bound is then compared against: one answering a larger value widens the bound
+// the comparison was written to enforce.
+var _parseInt = parseInt;
 var _promiseResolve = Promise.resolve;
 var _promiseReject = Promise.reject;
 
@@ -102,6 +106,19 @@ var _arrSort = uncurry(Array.prototype.sort);
 var _arrConcat = uncurry(Array.prototype.concat);
 var _arrSlice = uncurry(Array.prototype.slice);
 var _arrJoin = uncurry(Array.prototype.join);
+var _arrPush = uncurry(Array.prototype.push);
+
+// The string and byte-view operations a decision is then made on. A `toUpperCase` or `toLowerCase`
+// replaced after load changes which registry row an algorithm name resolves to; a `subarray`
+// returning a different window hands the next step bytes from somewhere else in the same buffer;
+// and a radix conversion is how a key's own numbers are read back before they are compared.
+var _strToUpperCase = uncurry(String.prototype.toUpperCase);
+var _strToLowerCase = uncurry(String.prototype.toLowerCase);
+var _strIndexOf = uncurry(String.prototype.indexOf);
+var _taSubarray = uncurry(Uint8Array.prototype.subarray);
+var _abSlice = uncurry(ArrayBuffer.prototype.slice);
+var _numToString = uncurry(Number.prototype.toString);
+var _bigIntToString = uncurry(BigInt.prototype.toString);
 
 // The collection operations, uncurried. A guard's cycle-safe chain walk is a `Set` it owns, and
 // `has` is what stops it: one answering `true` ends the walk at the first prototype, so a scan that
@@ -270,6 +287,16 @@ module.exports = {
   floor: _mathFloor,
   ceil: _mathCeil,
   min: _mathMin,
+  max: _mathMax,
+  parseInt: _parseInt,
+  push: _arrPush,
+  toUpperCase: _strToUpperCase,
+  toLowerCase: _strToLowerCase,
+  stringIndexOf: _strIndexOf,
+  subarray: _taSubarray,
+  arrayBufferSlice: _abSlice,
+  numberToString: _numToString,
+  bigIntToString: _bigIntToString,
   promiseResolve: _promiseResolve,
   promiseReject: _promiseReject,
   forEach: _arrForEach,

package/lib/jose.js

@@ -42,6 +42,24 @@ var webcrypto = wcEngine.webcrypto;
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
 var edwardsPoint = require("./edwards-point");
+// What this module reads from the runtime while it is deciding something, taken at load. A JWS is
+// signed and verified against a header the caller owns, and the reads below are the ones that decide
+// what that header IS: whether a value is a list, whether a name is the caller's own, which
+// conversion turns a claim into the string compared against a profile. A caller who receives control
+// afterwards -- through an accessor on the header, or a `toJSON` while it is being serialized -- can
+// replace any of them, and every check around them still runs and still passes. See guard-intrinsic.
+var intrinsic = require("./guard-intrinsic");
+var _isArray = intrinsic.isArray;
+var _hasOwn = intrinsic.hasOwn;
+var _keys = intrinsic.keys;
+var _isBuffer = intrinsic.isBuffer;
+var _bufferFrom = intrinsic.bufferFrom;
+var _stringify = intrinsic.stringify;
+var _ObjectProto = intrinsic.ObjectProto;
+var _push = intrinsic.uncurry(Array.prototype.push);
+var _join = intrinsic.join;
+var _map = intrinsic.map;
+var _bufToString = intrinsic.uncurry(Buffer.prototype.toString);
 
 var JoseError = frameworkError.JoseError;
 function E(code, message, cause) { return new JoseError(code, message, cause); }
@@ -65,11 +83,11 @@ var LIMITS = constants.LIMITS;
  *   pki.jose.base64url.encode(Buffer.from([1, 2, 3]));   // -> "AQID"
  */
 function b64uEncode(bytes) {
-  if (!Buffer.isBuffer(bytes)) throw E("jose/bad-input", "base64url.encode requires a Buffer");
+  if (!_isBuffer(bytes)) throw E("jose/bad-input", "base64url.encode requires a Buffer");
   // Re-view through the byte guard: a detached-backed Buffer reads as zero-length,
   // so a bare .toString would silently encode "" -- fail closed instead.
   bytes = guard.bytes.view(bytes, JoseError, "jose/bad-input", "base64url.encode input");
-  return bytes.toString("base64url");
+  return _bufToString(bytes, "base64url");
 }
 
 /**
@@ -182,19 +200,19 @@ var PROFILES = {
 // { alg, algRow, header }; throws a typed jose/* fault on any violation.
 function _checkHeader(header, profileName) {
   var profile = PROFILES[profileName];
-  if (!profile) throw E("jose/bad-input", "unknown JWS profile " + JSON.stringify(profileName));
-  if (!header || typeof header !== "object" || Array.isArray(header)) throw E("jose/bad-header", "the protected header must be a JSON object");
+  if (!profile) throw E("jose/bad-input", "unknown JWS profile " + _stringify(profileName));
+  if (!header || typeof header !== "object" || _isArray(header)) throw E("jose/bad-header", "the protected header must be a JSON object");
   // Every field is read as an OWN property. JSON.stringify (used by sign) omits
   // inherited members, so an alg/nonce/url living on the prototype (a polluted or
   // Object.create(...) header) would pass here yet serialize to a header MISSING
   // them -- so require own-ness, matching what the serialized JWS will actually carry.
-  var own = function (k) { return Object.prototype.hasOwnProperty.call(header, k); };
+  var own = function (k) { return _hasOwn(header, k); };
   // b64 (RFC 7797) MUST NOT be present at all -- the unencoded-payload downgrade.
   if (own("b64")) throw E("jose/bad-jws", "the RFC 7797 b64 header parameter is forbidden");
   var alg = header.alg;
   if (!own("alg") || typeof alg !== "string") throw E("jose/bad-header", "the protected header must carry a string alg");
   var algRow = profile.algs[alg];
-  if (!algRow) throw E("jose/bad-alg", "unsupported or forbidden algorithm " + JSON.stringify(alg) + " for this JWS profile");
+  if (!algRow) throw E("jose/bad-alg", "unsupported or forbidden algorithm " + _stringify(alg) + " for this JWS profile");
   if (profile.requireUrl && (!own("url") || typeof header.url !== "string" || header.url.length === 0)) throw E("jose/bad-header", "the protected header must carry a non-empty string url");
   // nonce discipline.
   var hasNonce = own("nonce");
@@ -219,20 +237,20 @@ function _checkHeader(header, profileName) {
   } else if (profile.keyId === "jwk") {
     if (!hasJwk || hasKid) throw E("jose/bad-header", "this JWS must carry an embedded jwk, not kid");
   }
-  if (hasJwk && (!header.jwk || typeof header.jwk !== "object" || Array.isArray(header.jwk))) throw E("jose/bad-header", "jwk must be a JSON object");
+  if (hasJwk && (!header.jwk || typeof header.jwk !== "object" || _isArray(header.jwk))) throw E("jose/bad-header", "jwk must be a JSON object");
   // crit: protected-only, non-empty, no standard names, no duplicates, all understood.
-  if (Object.prototype.hasOwnProperty.call(header, "crit")) {
+  if (_hasOwn(header, "crit")) {
     var crit = header.crit;
-    if (!Array.isArray(crit) || crit.length === 0) throw E("jose/bad-crit", "crit must be a non-empty array");
+    if (!_isArray(crit) || crit.length === 0) throw E("jose/bad-crit", "crit must be a non-empty array");
     var seen = {};
     for (var c = 0; c < crit.length; c++) {
       var name = crit[c];
       if (typeof name !== "string") throw E("jose/bad-crit", "crit entries must be strings");
-      if (Object.prototype.hasOwnProperty.call(seen, name)) throw E("jose/bad-crit", "duplicate crit entry " + JSON.stringify(name));
+      if (_hasOwn(seen, name)) throw E("jose/bad-crit", "duplicate crit entry " + _stringify(name));
       seen[name] = 1;
-      if (UNDERSTOOD_HEADER[name]) throw E("jose/bad-crit", "crit must not name a standard header parameter " + JSON.stringify(name));
+      if (UNDERSTOOD_HEADER[name]) throw E("jose/bad-crit", "crit must not name a standard header parameter " + _stringify(name));
       // Anything else is an extension parameter this implementation does not process.
-      throw E("jose/bad-crit", "unprocessed critical header parameter " + JSON.stringify(name));
+      throw E("jose/bad-crit", "unprocessed critical header parameter " + _stringify(name));
     }
   }
   return { alg: alg, algRow: algRow, header: header };
@@ -267,9 +285,9 @@ function _cryptoAlg(algRow, jwk, key) {
 // The key type the JWK MUST have for this alg (fail closed on confusion).
 function _assertKeyType(algRow, jwk) {
   if (!jwk || typeof jwk !== "object" || typeof jwk.kty !== "string") throw E("jose/bad-key", "a JWK object with a kty is required");
-  if (jwk.kty !== algRow.kty) throw E("jose/bad-alg", "the key type " + JSON.stringify(jwk.kty) + " does not match the algorithm");
+  if (jwk.kty !== algRow.kty) throw E("jose/bad-alg", "the key type " + _stringify(jwk.kty) + " does not match the algorithm");
   if (algRow.kty === "EC" && jwk.crv !== algRow.crv) throw E("jose/bad-alg", "the EC curve does not match the algorithm");
-  if (algRow.kty === "OKP" && jwk.crv !== "Ed25519" && jwk.crv !== "Ed448") throw E("jose/bad-alg", "unsupported OKP curve " + JSON.stringify(jwk.crv));
+  if (algRow.kty === "OKP" && jwk.crv !== "Ed25519" && jwk.crv !== "Ed448") throw E("jose/bad-alg", "unsupported OKP curve " + _stringify(jwk.crv));
   // node/OpenSSL import a low-order (e.g. identity) OKP point without complaint and it verifies a
   // forged signature; reject a non-full-order Edwards point through the shared gate, the same check
   // every EdDSA verify path in the toolkit applies.
@@ -278,7 +296,7 @@ function _assertKeyType(algRow, jwk) {
   }
   // An AKP (ML-DSA) JWK carries its parameter set in `alg` (RFC 9964); it MUST match
   // the algorithm's set, or an ML-DSA-44 key could embed an ML-DSA-65 public JWK.
-  if (algRow.kty === "AKP" && jwk.alg !== algRow.subtle) throw E("jose/bad-alg", "the AKP parameter set " + JSON.stringify(jwk.alg) + " does not match the algorithm " + algRow.subtle);
+  if (algRow.kty === "AKP" && jwk.alg !== algRow.subtle) throw E("jose/bad-alg", "the AKP parameter set " + _stringify(jwk.alg) + " does not match the algorithm " + algRow.subtle);
 }
 
 // The exact signature byte length this alg + key must produce.
@@ -317,10 +335,10 @@ var PRIVATE_JWK_MEMBERS = ["d", "p", "q", "dp", "dq", "qi", "k", "priv"];
  *   pki.jose.assertPublicJwk({ kty: "EC", crv: "P-256", x: "...", y: "..." });
  */
 function assertPublicJwk(jwk) {
-  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) throw E("jose/bad-key", "a JWK object is required");
+  if (!jwk || typeof jwk !== "object" || _isArray(jwk)) throw E("jose/bad-key", "a JWK object is required");
   for (var i = 0; i < PRIVATE_JWK_MEMBERS.length; i++) {
-    if (Object.prototype.hasOwnProperty.call(jwk, PRIVATE_JWK_MEMBERS[i])) {
-      throw E("jose/private-key-material", "a published JWK must be public-only; it carries the private member " + JSON.stringify(PRIVATE_JWK_MEMBERS[i]));
+    if (_hasOwn(jwk, PRIVATE_JWK_MEMBERS[i])) {
+      throw E("jose/private-key-material", "a published JWK must be public-only; it carries the private member " + _stringify(PRIVATE_JWK_MEMBERS[i]));
     }
   }
   return jwk;
@@ -374,9 +392,9 @@ var _VERIFY_KEYS = { key: 1, profile: 1 };
 async function verify(jws, opts) {
   opts = opts || {};
   guard.identifier.assertKnownKeys(opts, _VERIFY_KEYS, E, "jose/bad-input", "unknown pki.jose.verify option ");
-  if (!jws || typeof jws !== "object" || Array.isArray(jws)) throw E("jose/bad-jws", "a flattened JWS object is required");
-  if (Object.prototype.hasOwnProperty.call(jws, "signatures")) throw E("jose/bad-jws", "the multi-signature signatures member is forbidden");
-  if (Object.prototype.hasOwnProperty.call(jws, "header")) throw E("jose/bad-jws", "the unprotected header member is forbidden");
+  if (!jws || typeof jws !== "object" || _isArray(jws)) throw E("jose/bad-jws", "a flattened JWS object is required");
+  if (_hasOwn(jws, "signatures")) throw E("jose/bad-jws", "the multi-signature signatures member is forbidden");
+  if (_hasOwn(jws, "header")) throw E("jose/bad-jws", "the unprotected header member is forbidden");
   if (typeof jws.protected !== "string" || typeof jws.signature !== "string") throw E("jose/bad-jws", "protected and signature must be base64url strings");
   if (typeof jws.payload !== "string") throw E("jose/bad-jws", "payload must be a base64url string (never detached)");
   var header = parseJson(b64uDecode(jws.protected));
@@ -393,7 +411,7 @@ async function verify(jws, opts) {
   // matters most -- a `key` that came back null from a lookup would verify against whatever the
   // message carried, and the verdict would report the embedded key as though none was named.
   // `undefined` alone means "not supplied", so spreading an options object stays safe.
-  if (opts.key !== undefined && (typeof opts.key !== "object" || opts.key === null || Array.isArray(opts.key))) {
+  if (opts.key !== undefined && (typeof opts.key !== "object" || opts.key === null || _isArray(opts.key))) {
     throw E("jose/bad-key", "opts.key was supplied but is not a JWK object, so the key this message must be signed under cannot be established");
   }
   var jwk = header.jwk || opts.key;
@@ -419,7 +437,7 @@ async function verify(jws, opts) {
   var want = _expectedSigBytes(checked.algRow, jwk);
   if (want != null && sig.length !== want) throw E("jose/bad-signature", "the signature length " + sig.length + " is not the " + want + " bytes " + checked.alg + " requires");
   // Signing input from the RECEIVED base64url strings verbatim (never a re-serialize).
-  var signingInput = Buffer.from(jws.protected + "." + jws.payload, "ascii");
+  var signingInput = _bufferFrom(jws.protected + "." + jws.payload, "ascii");
   var key;
   try { key = await webcrypto.subtle.importKey("jwk", jwk, _importParams(checked.algRow, jwk), false, ["verify"]); }
   catch (e) { throw E("jose/bad-key", "the JWK could not be imported for verification", e); }
@@ -483,23 +501,23 @@ async function sign(opts) {
   // those questions separately -- assertPublicJwk sees a public JWK while the bytes that ship carry
   // the private one, and the door sees a jwk-mode header while the signer sees a kid-mode one.
   var headerJson;
-  try { headerJson = JSON.stringify(opts.protected); }
+  try { headerJson = _stringify(opts.protected); }
   catch (e) { throw E("jose/bad-header", "the protected header must be JSON-serializable", e); }
   // Read back through the same bounded reader a received JWS goes through, so a header this side
   // produces is held to the caps and the duplicate-member rule the other side enforces.
-  var headerBytes = headerJson === undefined ? null : Buffer.from(headerJson, "utf8");
+  var headerBytes = headerJson === undefined ? null : _bufferFrom(headerJson, "utf8");
   var header = headerBytes === null ? opts.protected : parseJson(headerBytes);
   // Which of the two key sources is in force is known only once the header has been read, so the
   // narrower table runs here. It re-walks the bag, which also catches a name that code added.
   var embedsJwk = !!(header && typeof header === "object" && header.jwk);
   if (embedsJwk) {
     guard.identifier.assertKnownKeys(opts, _SIGN_KEYS_EMBEDDED_JWK, E, "jose/bad-input", function (k) {
-      return "unknown pki.jose.sign option " + JSON.stringify(k) +
+      return "unknown pki.jose.sign option " + _stringify(k) +
         (k === "jwk" ? "; the protected header already embeds the public JWK" : "");
     });
   }
   var payload = opts.payload;
-  if (!Buffer.isBuffer(payload)) throw E("jose/bad-input", "payload must be a Buffer (empty Buffer for POST-as-GET)");
+  if (!_isBuffer(payload)) throw E("jose/bad-input", "payload must be a Buffer (empty Buffer for POST-as-GET)");
   // Re-view before the length===0 fast-path: a DETACHED payload reads as zero-length
   // and would be silently signed as an empty POST-as-GET body -- fail closed instead.
   payload = guard.bytes.view(payload, JoseError, "jose/bad-input", "payload");
@@ -523,14 +541,14 @@ async function sign(opts) {
   if (header.jwk) { _assertKeyType(checked.algRow, header.jwk); assertPublicJwk(header.jwk); }
   var protectedB64 = b64uEncode(headerBytes);   // the exact bytes every check above read
   var payloadB64 = payload.length === 0 ? "" : b64uEncode(payload);
-  var signingInput = Buffer.from(protectedB64 + "." + payloadB64, "ascii");
+  var signingInput = _bufferFrom(protectedB64 + "." + payloadB64, "ascii");
   var jwk = header.jwk || opts.jwk || {};
   // opts.key is documented as a CryptoKey, so one created outside this engine signs here too: it
   // carries none of the material this engine signs with, and is re-imported through it rather than
   // reaching subtle.sign as a key it cannot read. A key whose material this process cannot reach at
   // all -- non-extractable, or held behind another implementation's interface -- is refused there.
   var signKey = await wcEngine.adoptKey(opts.key, null, ["sign"], E, "jose/bad-input");
-  var sigBuf = Buffer.from(await webcrypto.subtle.sign(_cryptoAlg(checked.algRow, jwk, signKey), signKey, signingInput));
+  var sigBuf = _bufferFrom(await webcrypto.subtle.sign(_cryptoAlg(checked.algRow, jwk, signKey), signKey, signingInput));
   // Pin the produced signature length the same way verify does. A key whose curve /
   // hash / modulus does not match the header alg (a P-384 key under ES256, an
   // HS512 key under HS256) still signs, but emits the wrong length -- caught here
@@ -590,15 +608,17 @@ var THUMBPRINT_MEMBERS = {
 async function thumbprint(jwk) {
   if (!jwk || typeof jwk !== "object" || typeof jwk.kty !== "string") throw E("jose/bad-key", "a JWK object with a kty is required");
   var members = THUMBPRINT_MEMBERS[jwk.kty];
-  if (!members) throw E("jose/bad-key", "unsupported JWK key type " + JSON.stringify(jwk.kty));
+  if (!members) throw E("jose/bad-key", "unsupported JWK key type " + _stringify(jwk.kty));
   var parts = [];
   for (var i = 0; i < members.length; i++) {
     var m = members[i];
-    if (typeof jwk[m] !== "string") throw E("jose/bad-key", "the JWK is missing the required member " + JSON.stringify(m));
-    parts.push(JSON.stringify(m) + ":" + JSON.stringify(jwk[m]));
+    if (typeof jwk[m] !== "string") throw E("jose/bad-key", "the JWK is missing the required member " + _stringify(m));
+    // The canonical form IS the thumbprint preimage (RFC 7638 sec. 3.3), so the serializer that
+    // builds it is the captured one: a replacement changes the identity every consumer compares.
+    _push(parts, _stringify(m) + ":" + _stringify(jwk[m]));
   }
-  var canonical = "{" + parts.join(",") + "}";
-  var digest = Buffer.from(await webcrypto.subtle.digest("SHA-256", Buffer.from(canonical, "utf8")));
+  var canonical = "{" + _join(parts, ",") + "}";
+  var digest = _bufferFrom(await webcrypto.subtle.digest("SHA-256", _bufferFrom(canonical, "utf8")));
   return b64uEncode(digest);
 }
 
@@ -630,7 +650,7 @@ async function thumbprint(jwk) {
  *   pss.map(function (r) { return r.alg; });   // -> ["PS256", "PS384", "PS512"]
  */
 function sigAlgs() {
-  return Object.keys(SIG_ALGS).map(function (alg) {
+  return _map(_keys(SIG_ALGS), function (alg) {
     var row = SIG_ALGS[alg];
     var out = { alg: alg, kty: row.kty };
     if (row.crv) out.crv = row.crv;

package/lib/key.js

@@ -305,6 +305,10 @@ async function import_(input, opts) {
   }
   var algorithm = opts.algorithm != null ? opts.algorithm : _inferAlgorithm(detected);
   var isPublic = detected.format === "spki";
+  // Checked at this verb's own door rather than left for the engine to discover: a non-list reached
+  // the CryptoKey copy, where `Array.prototype.slice` on a number yields an empty list, so the key
+  // was minted permitted for NOTHING instead of the call naming the argument that was wrong.
+  if (opts.usages != null && !Array.isArray(opts.usages)) throw _err("key/bad-input", "opts.usages must be an array of key-usage strings");
   var usages = opts.usages || _importUsages(_algName(algorithm), isPublic);
   var extractable = opts.extractable != null ? opts.extractable : false;
   try {
@@ -344,6 +348,8 @@ async function generate(algorithm, opts) {
   guard.identifier.assertKnownKeys(opts, _GENERATE_OPTS, _err, "key/bad-input",
     "pki.key.generate has an unknown option (the WebCrypto spelling is `extractable`): ");
   var extractable = opts.extractable != null ? opts.extractable : true;
+  // The same door as import: a non-list is named here rather than becoming an empty usage set.
+  if (opts.usages != null && !Array.isArray(opts.usages)) throw _err("key/bad-input", "opts.usages must be an array of key-usage strings");
   var usages = opts.usages || _generateUsages(_algName(algorithm));
   var pair;
   try { pair = await subtle.generateKey(algorithm, extractable, usages); }

package/lib/webcrypto.js

@@ -42,6 +42,52 @@ var guard = require("./guard-all");
 var constants = require("./constants");
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
+// What this engine reads from the runtime while it is deciding something, taken at load. The
+// decisions here are the ones the whole toolkit signs and verifies behind: whether a value IS a
+// CryptoKey, which algorithm a key names, how many octets a modulus has. A caller who receives
+// control afterwards -- through an accessor on a key-like object, or while a verb is suspended on
+// an await -- can replace any of them, and every check around them still runs and still passes.
+// See guard-intrinsic for the whole captured set.
+var intrinsic = require("./guard-intrinsic");
+var _isArray = intrinsic.isArray;
+var _hasOwn = intrinsic.hasOwn;
+var _stringify = intrinsic.stringify;
+var _bufferFrom = intrinsic.bufferFrom;
+var _bufToString = intrinsic.uncurry(Buffer.prototype.toString);
+var _bufferConcat = intrinsic.bufferConcat;
+var _bufferAlloc = intrinsic.bufferAlloc;
+var _isBuffer = intrinsic.isBuffer;
+var _keys = intrinsic.keys;
+var _map = intrinsic.map;
+var _forEach = intrinsic.forEach;
+var _indexOf = intrinsic.indexOf;
+var _isInteger = intrinsic.isInteger;
+var _join = intrinsic.join;
+var _filter = intrinsic.filter;
+var _arraySlice = intrinsic.arraySlice;
+var _defineProperty = intrinsic.defineProperty;
+var _max = intrinsic.max;
+var _parseInt = intrinsic.parseInt;
+var _isFinite = intrinsic.isFinite;
+var _String = intrinsic.String;
+var _Number = intrinsic.Number;
+var _BigInt = intrinsic.BigInt;
+var _Uint8Array = intrinsic.Uint8Array;
+var _assign = intrinsic.assign;
+var _create = intrinsic.create;
+var _isView = intrinsic.isView;
+var _toUpperCase = intrinsic.toUpperCase;
+var _toLowerCase = intrinsic.toLowerCase;
+var _stringIndexOf = intrinsic.stringIndexOf;
+var _subarray = intrinsic.subarray;
+var _arrayBufferSlice = intrinsic.arrayBufferSlice;
+var _numberToString = intrinsic.numberToString;
+var _bigIntToString = intrinsic.bigIntToString;
+var _push = intrinsic.push;
+var _concat = intrinsic.concat;
+// Promise.resolve is a constructor method, so it keeps its receiver: `_resolve(Promise, x)`.
+var _resolve = intrinsic.uncurry(intrinsic.promiseResolve);
+var _types = intrinsic.types;
 
 // Single-owner error class -- co-located with its module (framework-error
 // stays the cross-module home; this is webcrypto-private). withCause: a
@@ -58,7 +104,7 @@ function _toBuf(data, who) {
 }
 
 function _toArrayBuffer(buf) {
-  return buf.buffer.slice(buf.byteOffset, buf.byteOffset + buf.byteLength);
+  return _arrayBufferSlice(buf.buffer, buf.byteOffset, buf.byteOffset + buf.byteLength);
 }
 
 function _wcErr(code, msg) { return new WebCryptoError(code, msg); }
@@ -68,7 +114,7 @@ function _wcErr(code, msg) { return new WebCryptoError(code, msg); }
 // bogus 6-byte key). Node's own canonical JWK export (_rawPublic) round-trips
 // cleanly, so the strictness is benign there and fail-closed on untrusted import.
 function _b64urlToBuf(s, who) { return guard.encoding.base64url(s, null, _wcErr, "webcrypto/data", who || "base64url value"); }
-function _bufToB64url(buf) { return Buffer.from(buf).toString("base64url"); }
+function _bufToB64url(buf) { return _bufToString(_bufferFrom(buf), "base64url"); }
 
 function _normalizeAlg(algorithm, who) {
   var alg = (typeof algorithm === "string") ? { name: algorithm } : algorithm;
@@ -76,8 +122,8 @@ function _normalizeAlg(algorithm, who) {
     throw new WebCryptoError("webcrypto/syntax", (who || "operation") + ": algorithm must be a string or an object with a name");
   }
   var out = {};
-  for (var k in alg) { if (Object.prototype.hasOwnProperty.call(alg, k)) out[k] = alg[k]; }
-  out.name = alg.name.toUpperCase();
+  for (var k in alg) { if (_hasOwn(alg, k)) out[k] = alg[k]; }
+  out.name = _toUpperCase(alg.name);
   return out;
 }
 
@@ -119,8 +165,11 @@ var XOF_NODE = {
 
 function _hashNode(h, who) {
   var name = (typeof h === "string") ? h : (h && h.name);
-  var node = HASH_NODE[String(name).toUpperCase()];
-  if (!node) throw new WebCryptoError("webcrypto/not-supported", (who || "operation") + ": unsupported hash " + JSON.stringify(name));
+  // The case fold is what picks the registry row, so it runs through the captured method: dispatched
+  // live, a replaced `toUpperCase` answering "SHA-1" makes a caller who asked for SHA-256 receive a
+  // SHA-1 digest, and nothing between here and the hash says the algorithm changed.
+  var node = HASH_NODE[_toUpperCase(_String(name))];
+  if (!node) throw new WebCryptoError("webcrypto/not-supported", (who || "operation") + ": unsupported hash " + _stringify(name));
   return node;
 }
 
@@ -138,10 +187,10 @@ var HMAC_BLOCK_BITS = {
 
 function _hmacLengthBits(alg, who) {
   var name = (typeof alg.hash === "string") ? alg.hash : (alg.hash && alg.hash.name);
-  var blockBits = HMAC_BLOCK_BITS[String(name).toUpperCase()];
-  if (!blockBits) throw new WebCryptoError("webcrypto/not-supported", who + ": unsupported hash " + JSON.stringify(name));
+  var blockBits = HMAC_BLOCK_BITS[_toUpperCase(_String(name))];
+  if (!blockBits) throw new WebCryptoError("webcrypto/not-supported", who + ": unsupported hash " + _stringify(name));
   if (alg.length == null) return blockBits;
-  if (typeof alg.length !== "number" || !isFinite(alg.length) || alg.length <= 0 || alg.length % 8 !== 0) {
+  if (typeof alg.length !== "number" || !_isFinite(alg.length) || alg.length <= 0 || alg.length % 8 !== 0) {
     throw new WebCryptoError("webcrypto/syntax", who + ": HMAC length must be a positive multiple of 8 bits");
   }
   return alg.length;
@@ -161,7 +210,7 @@ var ML_KEM_NODE = { "ML-KEM-512": "ml-kem-512", "ML-KEM-768": "ml-kem-768", "ML-
 var SLH_DSA_NODE = {};
 ["sha2-128s", "sha2-128f", "sha2-192s", "sha2-192f", "sha2-256s", "sha2-256f",
  "shake-128s", "shake-128f", "shake-192s", "shake-192f", "shake-256s", "shake-256f"
-].forEach(function (s) { SLH_DSA_NODE["SLH-DSA-" + s.toUpperCase()] = "slh-dsa-" + s; });
+].forEach(function (s) { SLH_DSA_NODE["SLH-DSA-" + _toUpperCase(s)] = "slh-dsa-" + s; });
 
 // The algorithm names each keyed operation recognizes. Membership is checked
 // before the algorithm/key name binding so an unrecognized algorithm reports
@@ -169,7 +218,7 @@ var SLH_DSA_NODE = {};
 // InvalidAccessError, matching the W3C error ordering.
 var SIGN_VERIFY_NAMES = {};
 ["RSASSA-PKCS1-V1_5", "RSA-PSS", "ECDSA", "ED25519", "ED448", "HMAC"]
-  .concat(Object.keys(ML_DSA_NODE), Object.keys(SLH_DSA_NODE))
+  .concat(_keys(ML_DSA_NODE), _keys(SLH_DSA_NODE))
   .forEach(function (n) { SIGN_VERIFY_NAMES[n] = true; });
 var ENCRYPT_DECRYPT_NAMES = { "RSA-OAEP": true, "AES-GCM": true, "AES-CBC": true, "AES-CTR": true };
 var DERIVE_NAMES = { "ECDH": true, "X25519": true, "X448": true, "HKDF": true, "PBKDF2": true, "X963KDF": true };
@@ -206,8 +255,16 @@ function CryptoKey(type, extractable, algorithm, usages, handle) {
   this.type = type;
   this.extractable = !!extractable;
   this.algorithm = algorithm;
-  this.usages = usages ? usages.slice() : [];
-  Object.defineProperty(this, "_handle", { value: handle, enumerable: false });
+  // The copy is what the key will be asked about for the rest of its life, so the method that makes
+  // it is the captured one: a replaced `slice` hands back a list the caller still controls. The
+  // list-ness is checked rather than left to the copy to discover -- `Array.prototype.slice` on a
+  // number yields an empty list, so a non-list would have minted a key permitted for NOTHING
+  // instead of naming the bad argument.
+  if (usages != null && !_isArray(usages)) {
+    throw new WebCryptoError("webcrypto/syntax", "usages must be an array of key-usage strings");
+  }
+  this.usages = usages ? _arraySlice(usages) : [];
+  _defineProperty(this, "_handle", { value: handle, enumerable: false });
 }
 
 // This engine reads key material through its own CryptoKey handle, which a key minted by another
@@ -225,8 +282,11 @@ function _requireOwnKey(key, who) {
 
 function _requireUsage(key, usage) {
   _requireOwnKey(key, usage);
-  if (key.usages.indexOf(usage) === -1) {
-    throw new WebCryptoError("webcrypto/invalid-access", "key is not permitted for '" + usage + "' (usages: " + key.usages.join(",") + ")");
+  // The membership test IS the permission check, so it runs through the captured method: dispatched
+  // live, an `Array.prototype.indexOf` replaced after load reports every usage present and a key
+  // minted to verify signs instead, with this refusal never raised.
+  if (_indexOf(key.usages, usage) === -1) {
+    throw new WebCryptoError("webcrypto/invalid-access", "key is not permitted for '" + usage + "' (usages: " + _join(key.usages, ",") + ")");
   }
 }
 
@@ -239,8 +299,8 @@ function _requireUsage(key, usage) {
 // be satisfied by a key of algorithm Y (algorithm confusion).
 function _requireAlgMatch(alg, key, who) {
   var keyName = key && key.algorithm && key.algorithm.name;
-  if (String(keyName).toUpperCase() !== alg.name) {
-    throw new WebCryptoError("webcrypto/invalid-access", who + ": algorithm " + JSON.stringify(alg.name) + " does not match the key's algorithm " + JSON.stringify(keyName));
+  if (_toUpperCase(_String(keyName)) !== alg.name) {
+    throw new WebCryptoError("webcrypto/invalid-access", who + ": algorithm " + _stringify(alg.name) + " does not match the key's algorithm " + _stringify(keyName));
   }
 }
 
@@ -250,7 +310,7 @@ function SubtleCrypto() {}
 
 SubtleCrypto.prototype.digest = async function digest(algorithm, data) {
   var name = _normalizeAlg(algorithm, "digest").name;
-  var xof = XOF_NODE[String(name).toUpperCase()];
+  var xof = XOF_NODE[_toUpperCase(_String(name))];
   // An XOF is always constructed with its output length stated. Omitting it
   // makes node emit a deprecation warning and fall back to a 32-byte squeeze,
   // which for SHAKE256 would silently produce half the required digest.
@@ -263,6 +323,14 @@ SubtleCrypto.prototype.digest = async function digest(algorithm, data) {
 
 SubtleCrypto.prototype.generateKey = async function generateKey(algorithm, extractable, keyUsages) {
   var alg = _normalizeAlg(algorithm, "generateKey");
+  // Before the partition below, not only in the CryptoKey constructor: the asymmetric branch splits
+  // the usages first, and `Array.prototype.filter` treats a non-list as array-like and yields `[]`,
+  // so both halves reached the constructor already valid and the call minted an unusable PAIR
+  // instead of naming the argument. The symmetric branches hand `usages` straight to the
+  // constructor, which is why its own door caught those and not these.
+  if (keyUsages != null && !_isArray(keyUsages)) {
+    throw new WebCryptoError("webcrypto/syntax", "generateKey: keyUsages must be an array of key-usage strings");
+  }
   var usages = keyUsages || [];
   var name = alg.name;
 
@@ -282,8 +350,10 @@ SubtleCrypto.prototype.generateKey = async function generateKey(algorithm, extra
   // Asymmetric key pairs.
   var pair = _generateKeyPair(alg);
   var pubAlg = pair.algorithm;
-  var privUsages = usages.filter(function (u) { return u === "sign" || u === "deriveKey" || u === "deriveBits" || u === "decrypt" || u === "unwrapKey" || u === "decapsulateKey" || u === "decapsulateBits"; });
-  var pubUsages = usages.filter(function (u) { return u === "verify" || u === "encrypt" || u === "wrapKey" || u === "encapsulateKey" || u === "encapsulateBits"; });
+  // Which usages each half of the pair is minted with -- the permission set every later operation
+  // is checked against -- so the partition runs through the captured method.
+  var privUsages = _filter(usages, function (u) { return u === "sign" || u === "deriveKey" || u === "deriveBits" || u === "decrypt" || u === "unwrapKey" || u === "decapsulateKey" || u === "decapsulateBits"; });
+  var pubUsages = _filter(usages, function (u) { return u === "verify" || u === "encrypt" || u === "wrapKey" || u === "encapsulateKey" || u === "encapsulateBits"; });
   return {
     privateKey: new CryptoKey("private", extractable, pubAlg, privUsages, pair.privateKey),
     publicKey:  new CryptoKey("public", true, pubAlg, pubUsages, pair.publicKey),
@@ -304,11 +374,11 @@ function _generateKeyPair(alg) {
     algorithm = { name: _stdName(name), modulusLength: alg.modulusLength || 2048, publicExponent: alg.publicExponent, hash: rsaHash };
   } else if (name === "ECDSA" || name === "ECDH") {
     var curve = alg.namedCurve;
-    if (!CURVE_NODE[curve]) throw new WebCryptoError("webcrypto/not-supported", name + ": unsupported curve " + JSON.stringify(curve));
+    if (!CURVE_NODE[curve]) throw new WebCryptoError("webcrypto/not-supported", name + ": unsupported curve " + _stringify(curve));
     kp = nodeCrypto.generateKeyPairSync("ec", { namedCurve: CURVE_NODE[curve] });
     algorithm = { name: name, namedCurve: curve };
   } else if (name === "ED25519" || name === "ED448" || name === "X25519" || name === "X448") {
-    kp = nodeCrypto.generateKeyPairSync(name.toLowerCase());
+    kp = nodeCrypto.generateKeyPairSync(_toLowerCase(name));
     algorithm = { name: _stdName(name) };
   } else if (ML_DSA_NODE[name]) {
     kp = nodeCrypto.generateKeyPairSync(ML_DSA_NODE[name]);
@@ -320,7 +390,7 @@ function _generateKeyPair(alg) {
     kp = nodeCrypto.generateKeyPairSync(SLH_DSA_NODE[name]);
     algorithm = { name: name };
   } else {
-    throw new WebCryptoError("webcrypto/not-supported", "generateKey: unsupported algorithm " + JSON.stringify(name));
+    throw new WebCryptoError("webcrypto/not-supported", "generateKey: unsupported algorithm " + _stringify(name));
   }
   return { publicKey: kp.publicKey, privateKey: kp.privateKey, algorithm: algorithm };
 }
@@ -354,11 +424,11 @@ function _bufToBigIntNum(exp) {
   if (b.length === 0) {
     throw new WebCryptoError("webcrypto/syntax", "publicExponent must be a non-empty BigInteger octet string");
   }
-  var v = BigInt("0x" + b.toString("hex"));
+  var v = _BigInt("0x" + _bufToString(b, "hex"));
   if (v > 0xffffffffn) {
-    throw new WebCryptoError("webcrypto/syntax", "publicExponent " + v.toString() + " exceeds the 2^32-1 bound");
+    throw new WebCryptoError("webcrypto/syntax", "publicExponent " + _bigIntToString(v) + " exceeds the 2^32-1 bound");
   }
-  return Number(v);
+  return _Number(v);
 }
 
 SubtleCrypto.prototype.sign = async function sign(algorithm, key, data) {
@@ -366,7 +436,7 @@ SubtleCrypto.prototype.sign = async function sign(algorithm, key, data) {
   _requireUsage(key, "sign");
   var buf = _toBuf(data, "sign");
   var name = alg.name;
-  if (!SIGN_VERIFY_NAMES[name]) throw new WebCryptoError("webcrypto/not-supported", "sign: unsupported algorithm " + JSON.stringify(name));
+  if (!SIGN_VERIFY_NAMES[name]) throw new WebCryptoError("webcrypto/not-supported", "sign: unsupported algorithm " + _stringify(name));
   _requireAlgMatch(alg, key, "sign");
   if (name === "RSASSA-PKCS1-V1_5") {
     return _toArrayBuffer(nodeCrypto.sign(_hashNode(key.algorithm.hash, "sign"), buf, key._handle));
@@ -394,7 +464,7 @@ SubtleCrypto.prototype.sign = async function sign(algorithm, key, data) {
     hm.update(buf);
     return _toArrayBuffer(hm.digest());
   }
-  throw new WebCryptoError("webcrypto/not-supported", "sign: unsupported algorithm " + JSON.stringify(name));
+  throw new WebCryptoError("webcrypto/not-supported", "sign: unsupported algorithm " + _stringify(name));
 };
 
 SubtleCrypto.prototype.verify = async function verify(algorithm, key, signature, data) {
@@ -403,7 +473,7 @@ SubtleCrypto.prototype.verify = async function verify(algorithm, key, signature,
   var sig = _toBuf(signature, "verify");
   var buf = _toBuf(data, "verify");
   var name = alg.name;
-  if (!SIGN_VERIFY_NAMES[name]) throw new WebCryptoError("webcrypto/not-supported", "verify: unsupported algorithm " + JSON.stringify(name));
+  if (!SIGN_VERIFY_NAMES[name]) throw new WebCryptoError("webcrypto/not-supported", "verify: unsupported algorithm " + _stringify(name));
   _requireAlgMatch(alg, key, "verify");
   if (name === "RSASSA-PKCS1-V1_5") {
     return nodeCrypto.verify(_hashNode(key.algorithm.hash, "verify"), buf, key._handle, sig);
@@ -437,7 +507,7 @@ SubtleCrypto.prototype.verify = async function verify(algorithm, key, signature,
     var digest = hm.digest();
     return guard.crypto.constantTimeEqual(digest, sig);
   }
-  throw new WebCryptoError("webcrypto/not-supported", "verify: unsupported algorithm " + JSON.stringify(name));
+  throw new WebCryptoError("webcrypto/not-supported", "verify: unsupported algorithm " + _stringify(name));
 };
 
 // Run a node:crypto AES cipher sequence, converting any raw node fault -- a bad IV length,
@@ -455,7 +525,7 @@ SubtleCrypto.prototype.encrypt = async function encrypt(algorithm, key, data) {
   _requireUsage(key, "encrypt");
   var buf = _toBuf(data, "encrypt");
   var name = alg.name;
-  if (!ENCRYPT_DECRYPT_NAMES[name]) throw new WebCryptoError("webcrypto/not-supported", "encrypt: unsupported algorithm " + JSON.stringify(name));
+  if (!ENCRYPT_DECRYPT_NAMES[name]) throw new WebCryptoError("webcrypto/not-supported", "encrypt: unsupported algorithm " + _stringify(name));
   _requireAlgMatch(alg, key, "encrypt");
   if (name === "RSA-OAEP") {
     return _toArrayBuffer(nodeCrypto.publicEncrypt({
@@ -472,7 +542,7 @@ SubtleCrypto.prototype.encrypt = async function encrypt(algorithm, key, data) {
         var cipher = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-gcm", kb, iv, { authTagLength: (alg.tagLength || 128) / 8 });
         if (aad) cipher.setAAD(aad);
         var ct = guard.secret.cipherFinish(cipher, buf, WebCryptoError, "webcrypto/operation", "an AES-GCM encrypt intermediate");
-        return Buffer.concat([ct, cipher.getAuthTag()]);
+        return _bufferConcat([ct, cipher.getAuthTag()]);
       });
     }, "encrypt"));
   }
@@ -495,7 +565,7 @@ SubtleCrypto.prototype.encrypt = async function encrypt(algorithm, key, data) {
       });
     }, "encrypt"));
   }
-  throw new WebCryptoError("webcrypto/not-supported", "encrypt: unsupported algorithm " + JSON.stringify(name));
+  throw new WebCryptoError("webcrypto/not-supported", "encrypt: unsupported algorithm " + _stringify(name));
 };
 
 SubtleCrypto.prototype.decrypt = async function decrypt(algorithm, key, data) {
@@ -503,7 +573,7 @@ SubtleCrypto.prototype.decrypt = async function decrypt(algorithm, key, data) {
   _requireUsage(key, "decrypt");
   var buf = _toBuf(data, "decrypt");
   var name = alg.name;
-  if (!ENCRYPT_DECRYPT_NAMES[name]) throw new WebCryptoError("webcrypto/not-supported", "decrypt: unsupported algorithm " + JSON.stringify(name));
+  if (!ENCRYPT_DECRYPT_NAMES[name]) throw new WebCryptoError("webcrypto/not-supported", "decrypt: unsupported algorithm " + _stringify(name));
   _requireAlgMatch(alg, key, "decrypt");
   if (name === "RSA-OAEP") {
     // For a CMS key-transport recipient this plaintext IS the recovered content-encryption key, and
@@ -521,8 +591,10 @@ SubtleCrypto.prototype.decrypt = async function decrypt(algorithm, key, data) {
     var tagLen = (alg.tagLength || 128) / 8;
     var iv = _toBuf(alg.iv, "AES-GCM iv");
     if (buf.length < tagLen) throw new WebCryptoError("webcrypto/operation", "decrypt: AES-GCM ciphertext is shorter than its authentication tag");
-    var ct = buf.subarray(0, buf.length - tagLen);
-    var tag = buf.subarray(buf.length - tagLen);
+    // The split between ciphertext and tag decides which bytes are authenticated, so the window it
+    // is taken with is the captured one: a replaced `subarray` hands the tag check other bytes.
+    var ct = _subarray(buf, 0, buf.length - tagLen);
+    var tag = _subarray(buf, buf.length - tagLen);
     var gcmAad = alg.additionalData ? _toBuf(alg.additionalData, "AES-GCM aad") : null;
     return _toArrayBuffer(_runCipher(function () {
       return _withSecretBytes(key, function (kb) {
@@ -554,7 +626,7 @@ SubtleCrypto.prototype.decrypt = async function decrypt(algorithm, key, data) {
       });
     }, "decrypt"));
   }
-  throw new WebCryptoError("webcrypto/not-supported", "decrypt: unsupported algorithm " + JSON.stringify(name));
+  throw new WebCryptoError("webcrypto/not-supported", "decrypt: unsupported algorithm " + _stringify(name));
 };
 
 // _withSecretBytes(key, fn) -- export a secret key's raw material, hand it to fn, and wipe
@@ -607,7 +679,7 @@ function _requireCtrLength128(alg) {
 // the `length / 8` narrowing in the per-algorithm branches below would
 // otherwise silently truncate a fractional byte count.
 function _requireDeriveLength(length, who) {
-  if (typeof length !== "number" || !isFinite(length) || length <= 0 || length % 8 !== 0) {
+  if (typeof length !== "number" || !_isFinite(length) || length <= 0 || length % 8 !== 0) {
     throw new WebCryptoError("webcrypto/operation", who + ": length must be a positive multiple of 8 bits");
   }
 }
@@ -622,7 +694,7 @@ function _requireDeriveLength(length, who) {
 // Concurrency is CAPPED so many high-iteration jobs cannot monopolize the whole worker pool and starve
 // unrelated DNS / filesystem / crypto work: at least two pool threads are left free (default pool is four),
 // and derivations beyond the cap queue and run as slots free. The cap tracks UV_THREADPOOL_SIZE when raised.
-var _PBKDF2_MAX_CONCURRENT = Math.max(1, (parseInt(process.env.UV_THREADPOOL_SIZE, 10) || 4) - 2);
+var _PBKDF2_MAX_CONCURRENT = _max(1, (_parseInt(process.env.UV_THREADPOOL_SIZE, 10) || 4) - 2);
 var _pbkdf2InFlight = 0;
 var _pbkdf2Waiters = [];
 function _pbkdf2Async(pw, salt, iterations, keylen, digest) {
@@ -663,7 +735,7 @@ async function _deriveBitsRaw(alg, key, length) {
       if (length / 8 > secret.length) {
         throw new WebCryptoError("webcrypto/operation", name + ": requested " + length + " bits but the shared secret has " + (secret.length * 8));
       }
-      return _toArrayBuffer(secret.subarray(0, length / 8));
+      return _toArrayBuffer(_subarray(secret, 0, length / 8));
     } finally {
       guard.secret.zeroize(secret, WebCryptoError, "webcrypto/operation", "the raw key-agreement shared secret");
     }
@@ -674,8 +746,8 @@ async function _deriveBitsRaw(alg, key, length) {
     // itself. A controllable allocation, not one of the runtime-internal copies the best-effort
     // caveat covers, so it is wiped once the derivation has consumed it.
     return _withSecretBytes(key, function (ikm) {
-      var derived = nodeCrypto.hkdfSync(_hashNode(alg.hash, "HKDF"), ikm, _toBuf(alg.salt, "HKDF salt"), _toBuf(alg.info || Buffer.alloc(0), "HKDF info"), length / 8);
-      return derived instanceof ArrayBuffer ? derived : _toArrayBuffer(Buffer.from(derived));
+      var derived = nodeCrypto.hkdfSync(_hashNode(alg.hash, "HKDF"), ikm, _toBuf(alg.salt, "HKDF salt"), _toBuf(alg.info || _bufferAlloc(0), "HKDF info"), length / 8);
+      return derived instanceof ArrayBuffer ? derived : _toArrayBuffer(_bufferFrom(derived));
     });
   }
   if (name === "PBKDF2") {
@@ -700,13 +772,13 @@ async function _deriveBitsRaw(alg, key, length) {
     // The base key here HOLDS the ECDH shared secret Z of an RFC 5753 kari, so this export is
     // exactly as sensitive as the raw agreement secret wiped above.
     return _withSecretBytes(key, function (z) {
-      var derived = _x963Kdf(_hashNode(alg.hash, "X963KDF"), z, _toBuf(alg.info || Buffer.alloc(0), "X963KDF SharedInfo"), length / 8);
+      var derived = _x963Kdf(_hashNode(alg.hash, "X963KDF"), z, _toBuf(alg.info || _bufferAlloc(0), "X963KDF SharedInfo"), length / 8);
       // Same as PBKDF2 above: the copy is what the caller receives, so the derived buffer is cleared.
       try { return _toArrayBuffer(derived); }
       finally { guard.secret.zeroize(derived, WebCryptoError, "webcrypto/operation", "the X9.63 KDF output"); }
     });
   }
-  throw new WebCryptoError("webcrypto/not-supported", "deriveBits: unsupported algorithm " + JSON.stringify(name));
+  throw new WebCryptoError("webcrypto/not-supported", "deriveBits: unsupported algorithm " + _stringify(name));
 }
 
 // The X9.63 single-step KDF counter loop. Bounded by the 2^32 counter range; every input is a
@@ -715,16 +787,16 @@ function _x963Kdf(hashNode, z, sharedInfo, lenBytes) {
   var blocks = [], counter = 1, got = 0;
   while (got < lenBytes) {
     if (counter > 0xffffffff) throw new WebCryptoError("webcrypto/operation", "X963KDF: requested output exceeds the counter range");
-    var ctr = Buffer.alloc(4); ctr.writeUInt32BE(counter, 0);
+    var ctr = _bufferAlloc(4); ctr.writeUInt32BE(counter, 0);
     var h = nodeCrypto.createHash(hashNode).update(z).update(ctr).update(sharedInfo).digest();
-    blocks.push(h); got += h.length; counter += 1;
+    _push(blocks, h); got += h.length; counter += 1;
   }
   // Return an exact-sized buffer the caller wholly owns, not a VIEW over the joined blocks: a
   // caller clearing what it received would otherwise leave the unused tail of the final digest
   // block -- derived from the shared secret -- readable behind it. The accumulator and the
   // per-block digests are cleared here, where they were allocated.
-  var joined = Buffer.concat(blocks);
-  var exact = Buffer.alloc(lenBytes);
+  var joined = _bufferConcat(blocks);
+  var exact = _bufferAlloc(lenBytes);
   joined.copy(exact, 0, 0, lenBytes);
   guard.secret.zeroize(joined, WebCryptoError, "webcrypto/operation", "the KDF accumulator");
   for (var bi = 0; bi < blocks.length; bi++) guard.secret.zeroize(blocks[bi], WebCryptoError, "webcrypto/operation", "a KDF block");
@@ -734,7 +806,7 @@ function _x963Kdf(hashNode, z, sharedInfo, lenBytes) {
 SubtleCrypto.prototype.deriveBits = async function deriveBits(algorithm, key, length) {
   var alg = _normalizeAlg(algorithm, "deriveBits");
   _requireUsage(key, "deriveBits");
-  if (!DERIVE_NAMES[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "deriveBits: unsupported algorithm " + JSON.stringify(alg.name));
+  if (!DERIVE_NAMES[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "deriveBits: unsupported algorithm " + _stringify(alg.name));
   _requireAlgMatch(alg, key, "deriveBits");
   return _deriveBitsRaw(alg, key, length);
 };
@@ -746,11 +818,11 @@ SubtleCrypto.prototype.deriveKey = async function deriveKey(algorithm, baseKey,
   // here and route the raw derivation past deriveBits' own usage gate.
   _requireUsage(baseKey, "deriveKey");
   var alg = _normalizeAlg(algorithm, "deriveKey");
-  if (!DERIVE_NAMES[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "deriveKey: unsupported algorithm " + JSON.stringify(alg.name));
+  if (!DERIVE_NAMES[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "deriveKey: unsupported algorithm " + _stringify(alg.name));
   _requireAlgMatch(alg, baseKey, "deriveKey");
   var dk = _normalizeAlg(derivedKeyType, "deriveKey");
   var bits;
-  if (dk.name.indexOf("AES") === 0) {
+  if (_stringIndexOf(dk.name, "AES") === 0) {
     // W3C get-key-length for AES: the derivedKeyType MUST carry a length of
     // 128/192/256. Without this check the derived key would silently take
     // the size of the raw agreement/KDF output (e.g. a 384-bit "AES" key
@@ -775,7 +847,7 @@ SubtleCrypto.prototype.deriveKey = async function deriveKey(algorithm, baseKey,
   // failing import too (a bad derivedKeyType is caller-controlled).
   var raw = await _deriveBitsRaw(alg, baseKey, bits);
   try { return await this.importKey("raw", raw, dk, extractable, keyUsages); }
-  finally { guard.secret.zeroize(new Uint8Array(raw), WebCryptoError, "webcrypto/operation", "the derived key material"); }
+  finally { guard.secret.zeroize(new _Uint8Array(raw), WebCryptoError, "webcrypto/operation", "the derived key material"); }
 };
 
 // ML-KEM (FIPS 203) key encapsulation over Node's crypto.encapsulate/decapsulate.
@@ -791,9 +863,9 @@ SubtleCrypto.prototype.deriveKey = async function deriveKey(algorithm, baseKey,
 SubtleCrypto.prototype.encapsulateBits = async function encapsulateBits(algorithm, encapsulationKey) {
   var alg = _normalizeAlg(algorithm, "encapsulateBits");
   _requireUsage(encapsulationKey, "encapsulateBits");
-  if (!ML_KEM_NODE[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "encapsulateBits: unsupported algorithm " + JSON.stringify(alg.name));
+  if (!ML_KEM_NODE[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "encapsulateBits: unsupported algorithm " + _stringify(alg.name));
   _requireAlgMatch(alg, encapsulationKey, "encapsulateBits");
-  if (encapsulationKey.type !== "public") throw new WebCryptoError("webcrypto/invalid-access", "encapsulateBits requires a public (encapsulation) key, got " + JSON.stringify(encapsulationKey.type));
+  if (encapsulationKey.type !== "public") throw new WebCryptoError("webcrypto/invalid-access", "encapsulateBits requires a public (encapsulation) key, got " + _stringify(encapsulationKey.type));
   var r;
   try { r = nodeCrypto.encapsulate(encapsulationKey._handle); }
   catch (e) { throw new WebCryptoError("webcrypto/operation", "encapsulateBits: ML-KEM encapsulation failed", e); }
@@ -814,9 +886,9 @@ SubtleCrypto.prototype.encapsulateBits = async function encapsulateBits(algorith
 SubtleCrypto.prototype.decapsulateBits = async function decapsulateBits(algorithm, decapsulationKey, ciphertext) {
   var alg = _normalizeAlg(algorithm, "decapsulateBits");
   _requireUsage(decapsulationKey, "decapsulateBits");
-  if (!ML_KEM_NODE[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "decapsulateBits: unsupported algorithm " + JSON.stringify(alg.name));
+  if (!ML_KEM_NODE[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "decapsulateBits: unsupported algorithm " + _stringify(alg.name));
   _requireAlgMatch(alg, decapsulationKey, "decapsulateBits");
-  if (decapsulationKey.type !== "private") throw new WebCryptoError("webcrypto/invalid-access", "decapsulateBits requires a private (decapsulation) key, got " + JSON.stringify(decapsulationKey.type));
+  if (decapsulationKey.type !== "private") throw new WebCryptoError("webcrypto/invalid-access", "decapsulateBits requires a private (decapsulation) key, got " + _stringify(decapsulationKey.type));
   var ct = _toBuf(ciphertext, "decapsulateBits ciphertext");
   // FIPS 203 sec. 7.3 makes the ciphertext-length check the ONE per-execution input check a
   // decapsulating party owes, so it belongs here, at the engine boundary, rather than only in the
@@ -858,25 +930,25 @@ SubtleCrypto.prototype.wrapKey = async function wrapKey(format, key, wrappingKey
   // exists to protect. It is this function's allocation and is cleared once the wrap has consumed
   // it, on the delegated branch as well as the AES-KW one.
   var exported = await this.exportKey(format, key);
-  var bytes = (format === "jwk") ? Buffer.from(JSON.stringify(exported)) : Buffer.from(exported);
+  var bytes = (format === "jwk") ? _bufferFrom(_stringify(exported)) : _bufferFrom(exported);
   try {
   var alg = _normalizeAlg(wrapAlgorithm, "wrapKey");
   _requireUsage(wrappingKey, "wrapKey");
-  if (alg.name !== "AES-KW" && !ENCRYPT_DECRYPT_NAMES[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "wrapKey: unsupported algorithm " + JSON.stringify(alg.name));
+  if (alg.name !== "AES-KW" && !ENCRYPT_DECRYPT_NAMES[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "wrapKey: unsupported algorithm " + _stringify(alg.name));
   _requireAlgMatch(alg, wrappingKey, "wrapKey");
   if (alg.name === "AES-KW") {
     // AES-KW wraps 64-bit blocks (RFC 3394): the serialized key MUST be a multiple of 8
     // bytes and at least 16. A "jwk" serialization (arbitrary-length JSON) or any other
     // non-conforming length is an OperationError -- a typed verdict, never a raw node fault.
     if (bytes.length < 16 || bytes.length % 8 !== 0) {
-      throw new WebCryptoError("webcrypto/operation", "wrapKey: AES-KW requires the serialized key be a multiple of 8 bytes (>= 16); got " + bytes.length + " -- format " + JSON.stringify(format) + " is not AES-KW-wrappable");
+      throw new WebCryptoError("webcrypto/operation", "wrapKey: AES-KW requires the serialized key be a multiple of 8 bytes (>= 16); got " + bytes.length + " -- format " + _stringify(format) + " is not AES-KW-wrappable");
     }
     // The mirror of unwrapKey below: in a KEM flow this export is the SENDER's copy of the same
     // key-encryption key, so leaving it unwiped would keep a full copy of the KEK alive for the
     // process lifetime and make the wipes the CMS layer performs pointless in the encrypt direction.
     try {
       return _withSecretBytes(wrappingKey, function (wkBytes) {
-        var c = nodeCrypto.createCipheriv("aes" + wrappingKey.algorithm.length + "-wrap", wkBytes, Buffer.from("A6A6A6A6A6A6A6A6", "hex"));
+        var c = nodeCrypto.createCipheriv("aes" + wrappingKey.algorithm.length + "-wrap", wkBytes, _bufferFrom("A6A6A6A6A6A6A6A6", "hex"));
         return _toArrayBuffer(guard.secret.cipherFinish(c, bytes, WebCryptoError, "webcrypto/operation", "an AES-KW wrap intermediate"));
       });
     } catch (e) { throw new WebCryptoError("webcrypto/operation", "wrapKey: AES-KW key wrap failed", e); }
@@ -902,7 +974,7 @@ SubtleCrypto.prototype.unwrapKey = async function unwrapKey(format, wrappedKey,
   // never verify the caller was actually permitted to unwrap (mirrors
   // wrapKey, which checks before both of its paths).
   _requireUsage(unwrappingKey, "unwrapKey");
-  if (alg.name !== "AES-KW" && !ENCRYPT_DECRYPT_NAMES[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "unwrapKey: unsupported algorithm " + JSON.stringify(alg.name));
+  if (alg.name !== "AES-KW" && !ENCRYPT_DECRYPT_NAMES[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "unwrapKey: unsupported algorithm " + _stringify(alg.name));
   _requireAlgMatch(alg, unwrappingKey, "unwrapKey");
   var bytes;
   if (alg.name === "AES-KW") {
@@ -921,13 +993,13 @@ SubtleCrypto.prototype.unwrapKey = async function unwrapKey(format, wrappedKey,
     // would also break the fuzz-harness contract.
     try {
       bytes = _withSecretBytes(unwrappingKey, function (kwBytes) {
-        var d = nodeCrypto.createDecipheriv("aes" + unwrappingKey.algorithm.length + "-wrap", kwBytes, Buffer.from("A6A6A6A6A6A6A6A6", "hex"));
+        var d = nodeCrypto.createDecipheriv("aes" + unwrappingKey.algorithm.length + "-wrap", kwBytes, _bufferFrom("A6A6A6A6A6A6A6A6", "hex"));
         return guard.secret.cipherFinish(d, wrapped, WebCryptoError, "webcrypto/operation", "the unwrapped key material");
       });
     } catch (e) { throw new WebCryptoError("webcrypto/operation", "unwrapKey: AES-KW key unwrap failed (integrity or length)", e); }
   } else {
     var unwrapKeyClone = _cloneWithUsage(unwrappingKey, "decrypt");
-    bytes = Buffer.from(await this.decrypt(unwrapAlgorithm, unwrapKeyClone, wrappedKey));
+    bytes = _bufferFrom(await this.decrypt(unwrapAlgorithm, unwrapKeyClone, wrappedKey));
   }
   var keyData;
   if (format === "jwk") {
@@ -955,7 +1027,7 @@ SubtleCrypto.prototype.unwrapKey = async function unwrapKey(format, wrappedKey,
 };
 
 function _cloneWithUsage(key, usage) {
-  var k = new CryptoKey(key.type, key.extractable, key.algorithm, key.usages.concat([usage]), key._handle);
+  var k = new CryptoKey(key.type, key.extractable, key.algorithm, _concat(key.usages, [usage]), key._handle);
   return k;
 }
 
@@ -1034,7 +1106,7 @@ function _validateMlKemInner(innerBytes, sizes) {
 // per-algorithm structural check lives here, at the one import boundary. Only ML-KEM needs it
 // today: the engine ACCEPTS the OpenSSL-legacy bare-seed layout RFC 9935 sec. 6 forbids.
 var PKCS8_INNER_VALIDATORS = {};
-Object.keys(ML_KEM_INNER).forEach(function (o) { PKCS8_INNER_VALIDATORS[o] = function (inner) { _validateMlKemInner(inner, ML_KEM_INNER[o]); }; });
+_forEach(_keys(ML_KEM_INNER), function (o) { PKCS8_INNER_VALIDATORS[o] = function (inner) { _validateMlKemInner(inner, ML_KEM_INNER[o]); }; });
 
 function _preValidatePkcs8(p8, name) {
   if (!ML_KEM_NODE[name]) return;   // only the ML-KEM CHOICE carries the bare-seed hazard
@@ -1090,7 +1162,7 @@ SubtleCrypto.prototype.importKey = async function importKey(format, keyData, alg
     // A JWK is a JSON object; null / undefined / an array / a primitive (incl. the JSON token
     // `null` from an unwrapKey over non-authenticating ciphertext) fails closed as a typed
     // DataError, never a raw property-access TypeError.
-    if (jwk === null || typeof jwk !== "object" || Array.isArray(jwk)) {
+    if (jwk === null || typeof jwk !== "object" || _isArray(jwk)) {
       throw new WebCryptoError("webcrypto/data", "importKey jwk: keyData must be a JsonWebKey object");
     }
     if (jwk.kty === "oct") {
@@ -1109,12 +1181,12 @@ SubtleCrypto.prototype.importKey = async function importKey(format, keyData, alg
     // unrecognized member to be ignored, so a member of that name on an EC or OKP JWK is an
     // extension this implementation has no meaning for -- reading it as private material there
     // would turn a valid public-key import into a failure.
-    var isPrivate = Object.prototype.hasOwnProperty.call(jwk, "d") ||
-      (jwk.kty === "AKP" && Object.prototype.hasOwnProperty.call(jwk, "priv"));
+    var isPrivate = _hasOwn(jwk, "d") ||
+      (jwk.kty === "AKP" && _hasOwn(jwk, "priv"));
     var ko = _nodeKey(function () { return isPrivate ? nodeCrypto.createPrivateKey({ key: jwk, format: "jwk" }) : nodeCrypto.createPublicKey({ key: jwk, format: "jwk" }); }, "importKey jwk");
     return new CryptoKey(isPrivate ? "private" : "public", isPrivate ? extractable : true, _algFromImport(name, alg, ko), usages, ko);
   }
-  throw new WebCryptoError("webcrypto/not-supported", "importKey: unsupported format " + JSON.stringify(format));
+  throw new WebCryptoError("webcrypto/not-supported", "importKey: unsupported format " + _stringify(format));
 };
 
 function _importRawPublic(name, alg, raw, extractable, usages) {
@@ -1128,11 +1200,11 @@ function _importRawPublic(name, alg, raw, extractable, usages) {
   if (name === "ECDSA" || name === "ECDH") {
     var fb = CURVE_FIELD_BYTES[alg.namedCurve];
     if (!fb || raw[0] !== 0x04 || raw.length !== 1 + 2 * fb) throw new WebCryptoError("webcrypto/data", "importKey raw EC: expected an uncompressed point for " + alg.namedCurve);
-    var ecjwk = { kty: "EC", crv: alg.namedCurve, x: _bufToB64url(raw.subarray(1, 1 + fb)), y: _bufToB64url(raw.subarray(1 + fb)) };
+    var ecjwk = { kty: "EC", crv: alg.namedCurve, x: _bufToB64url(_subarray(raw, 1, 1 + fb)), y: _bufToB64url(_subarray(raw, 1 + fb)) };
     var eck = nodeCrypto.createPublicKey({ key: ecjwk, format: "jwk" });
     return new CryptoKey("public", true, { name: name, namedCurve: alg.namedCurve }, usages, eck);
   }
-  throw new WebCryptoError("webcrypto/not-supported", "importKey raw: unsupported public-key algorithm " + JSON.stringify(name));
+  throw new WebCryptoError("webcrypto/not-supported", "importKey raw: unsupported public-key algorithm " + _stringify(name));
 }
 
 // The node asymmetricKeyType(s) each imported asymmetric algorithm requires. The key TYPE
@@ -1149,7 +1221,7 @@ var IMPORT_KEY_TYPE = {
 // algorithm name maps to exactly its node asymmetricKeyType, so an RSA (or any) key imported
 // under an ML-DSA / ML-KEM / SLH-DSA name is a DataError, not a mislabeled PQC CryptoKey.
 [ML_DSA_NODE, ML_KEM_NODE, SLH_DSA_NODE].forEach(function (m) {
-  Object.keys(m).forEach(function (webName) { var t = {}; t[m[webName]] = 1; IMPORT_KEY_TYPE[webName] = t; });
+  _forEach(_keys(m), function (webName) { var t = {}; t[m[webName]] = 1; IMPORT_KEY_TYPE[webName] = t; });
 });
 function _algFromImport(name, alg, keyObject) {
   var wantType = IMPORT_KEY_TYPE[name];
@@ -1169,8 +1241,8 @@ function _algFromImport(name, alg, keyObject) {
       throw new WebCryptoError("webcrypto/not-supported", name + ": imported key uses an unsupported EC curve");
     }
     if (alg.namedCurve && alg.namedCurve !== actualCurve) {
-      throw new WebCryptoError("webcrypto/data", name + ": importKey namedCurve " + JSON.stringify(alg.namedCurve) +
-        " does not match the imported key's curve " + JSON.stringify(actualCurve));
+      throw new WebCryptoError("webcrypto/data", name + ": importKey namedCurve " + _stringify(alg.namedCurve) +
+        " does not match the imported key's curve " + _stringify(actualCurve));
     }
     return { name: name, namedCurve: actualCurve };
   }
@@ -1243,13 +1315,13 @@ SubtleCrypto.prototype.exportKey = async function exportKey(format, key) {
     }
     return _toArrayBuffer(_rawPublic(key));
   }
-  throw new WebCryptoError("webcrypto/not-supported", "exportKey: unsupported format " + JSON.stringify(format));
+  throw new WebCryptoError("webcrypto/not-supported", "exportKey: unsupported format " + _stringify(format));
 };
 
 function _rawPublic(key) {
   var jwk = key._handle.export({ format: "jwk" });
   if (jwk.kty === "OKP") return _b64urlToBuf(jwk.x);
-  if (jwk.kty === "EC") return Buffer.concat([Buffer.from([0x04]), _b64urlToBuf(jwk.x), _b64urlToBuf(jwk.y)]);
+  if (jwk.kty === "EC") return _bufferConcat([_bufferFrom([0x04]), _b64urlToBuf(jwk.x), _b64urlToBuf(jwk.y)]);
   throw new WebCryptoError("webcrypto/not-supported", "exportKey raw: unsupported key type " + jwk.kty);
 }
 
@@ -1275,7 +1347,10 @@ function Crypto() {
 }
 
 Crypto.prototype.getRandomValues = function getRandomValues(typedArray) {
-  if (!ArrayBuffer.isView(typedArray) || typedArray instanceof Float32Array || typedArray instanceof Float64Array || typedArray instanceof DataView) {
+  // The kinds W3C WebCrypto refuses here are settled from the value's internal slot, not from an
+  // `instanceof` against a replaceable global: replace `Float32Array` after load and the comparison
+  // is against a different constructor, so a real Float32Array passes a check written to reject it.
+  if (!_isView(typedArray) || _types.isFloat32Array(typedArray) || _types.isFloat64Array(typedArray) || _types.isDataView(typedArray)) {
     throw new WebCryptoError("webcrypto/data", "getRandomValues: expected an integer TypedArray");
   }
   // Re-view the (already integer-TypedArray-validated) output buffer through the OUTPUT door --
@@ -1327,14 +1402,14 @@ function decompressEcPoint(sec1Compressed, nodeCurve, E, code) {
 var _crypto = new Crypto();
 // Null-prototype:  is caller-supplied, and an inherited member ("constructor", "toString")
 // would otherwise resolve to a truthy non-format and slip past the check below.
-var _EXPORT_FORMAT = Object.assign(Object.create(null), { "private": "pkcs8", "public": "spki", "secret": "raw" });
+var _EXPORT_FORMAT = _assign(_create(null), { "private": "pkcs8", "public": "spki", "secret": "raw" });
 
 // @internal
 // True for any object shaped like a WebCrypto CryptoKey, whichever implementation minted it.
 function isCryptoKeyLike(x) {
   return !!x && typeof x === "object" && typeof x.type === "string" &&
     typeof x.extractable === "boolean" && !!x.algorithm && typeof x.algorithm === "object" &&
-    typeof x.algorithm.name === "string" && Array.isArray(x.usages);
+    typeof x.algorithm.name === "string" && _isArray(x.usages);
 }
 
 // @internal
@@ -1346,9 +1421,9 @@ function exportAnyKey(key, E, code) {
   var format = _EXPORT_FORMAT[key && key.type];
   if (!format) throw E(code, "a CryptoKey with a private, public, or secret type is required");
   if (key instanceof CryptoKey) {
-    return Promise.resolve()
+    return _resolve(Promise)
       .then(function () { return _crypto.subtle.exportKey(format, key); })
-      .then(function (b) { return Buffer.from(b); });
+      .then(function (b) { return _bufferFrom(b); });
   }
   if (!key.extractable) {
     throw E(code, "the CryptoKey comes from a different WebCrypto implementation and is not extractable, so its key material cannot be reached; import it through pki.webcrypto.subtle, or pass the key as DER");
@@ -1360,18 +1435,18 @@ function exportAnyKey(key, E, code) {
   // key's own extractable promise is this branch's responsibility, not the crypto library's.
   var handle = key._handle;
   if (handle instanceof nodeCrypto.KeyObject && handle.type === key.type) {
-    return Promise.resolve().then(function () {
+    return _resolve(Promise).then(function () {
       return format === "raw" ? handle.export() : handle.export({ format: "der", type: format });
-    }).then(function (b) { return Buffer.from(b); }, function (e) {
+    }).then(function (b) { return _bufferFrom(b); }, function (e) {
       throw E(code, "the CryptoKey comes from a different copy of this WebCrypto engine and its key material could not be read; import it through pki.webcrypto.subtle, or pass the key as DER", e);
     });
   }
   // Otherwise the only remaining implementation whose keys are reachable from this process is the
   // platform's own. A third party's -- a browser's, a userland polyfill's -- keeps its material
   // behind its own SubtleCrypto, which nothing here holds a reference to, so it is refused below.
-  return Promise.resolve()
+  return _resolve(Promise)
     .then(function () { return nodeCrypto.webcrypto.subtle.exportKey(format, key); })
-    .then(function (b) { return Buffer.from(b); }, function (e) {
+    .then(function (b) { return _bufferFrom(b); }, function (e) {
       throw E(code, "the CryptoKey comes from a different WebCrypto implementation and could not be exported for re-import; import it through pki.webcrypto.subtle, or pass the key as DER", e);
     });
 }
@@ -1381,19 +1456,19 @@ function exportAnyKey(key, E, code) {
 // key of its own keeps working -- and a foreign one is re-imported. `importParams` may be null, in
 // which case the key's own `algorithm` is used, which is what the key actually is.
 function adoptKey(key, importParams, usages, E, code) {
-  if (key instanceof CryptoKey) return Promise.resolve(key);
+  if (key instanceof CryptoKey) return _resolve(Promise, key);
   // A key's usages are a capability restriction it carries, and re-importing it is the one moment
   // that restriction could be widened -- the new key is created with the usages the CALLER wants,
   // not the ones the original was created with. Require every one of them up front, so an adopted
   // key can do no more than it could where it came from, and a verify-only key is refused here
   // exactly as this engine's own verify-only key is refused by _requireUsage.
-  if (!Array.isArray(key.usages)) throw E(code, "a CryptoKey carrying its permitted usages is required");
+  if (!_isArray(key.usages)) throw E(code, "a CryptoKey carrying its permitted usages is required");
   for (var i = 0; i < usages.length; i++) {
-    if (key.usages.indexOf(usages[i]) === -1) {
-      throw E(code, "the CryptoKey is not permitted for '" + usages[i] + "' (usages: " + key.usages.join(",") + ")");
+    if (_indexOf(key.usages, usages[i]) === -1) {
+      throw E(code, "the CryptoKey is not permitted for '" + usages[i] + "' (usages: " + _join(key.usages, ",") + ")");
     }
   }
-  return Promise.resolve()
+  return _resolve(Promise)
     .then(function () { return exportAnyKey(key, E, code); })
     .then(function (der) {
       return _crypto.subtle.importKey(_EXPORT_FORMAT[key.type], der, importParams || key.algorithm, false, usages);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.5.18",
+  "version": "0.5.19",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:123ddb5e-05ea-4e65-9d7d-7a667c46e3a3",
+  "serialNumber": "urn:uuid:d0064cbc-a37c-4d4f-ae67-0b9ba6887de2",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-20T20:31:47.390Z",
+    "timestamp": "2026-08-20T21:35:06.293Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.5.18",
+      "bom-ref": "@blamejs/pki@0.5.19",
       "type": "application",
       "name": "pki",
-      "version": "0.5.18",
+      "version": "0.5.19",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.5.18",
+      "purl": "pkg:npm/%40blamejs/pki@0.5.19",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.5.18",
+      "ref": "@blamejs/pki@0.5.19",
       "dependsOn": []
     }
   ]