@blamejs/pki 0.5.18 → 0.5.20

package/CHANGELOG.md

@@ -4,6 +4,49 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.5.20 — 2026-08-20
+
+Five verdicts that turned on list membership now decide it by comparison, so replacing an array method after the module loads cannot change what a certificate, a responder or a signed message is found to be.
+
+### Added
+
+- `guard-list`, an internal choke point for membership decided by comparison. Four verbs cover the rule shapes a verdict needs: is this value present, are all of these present, does any member satisfy a test, do all of them. An absent list is honestly empty rather than a throw, because these run on verdict paths where a throw would read as a different verdict. It is not on the public namespace; the surface is the verdicts above.
+
+### Changed
+
+- Certification-path building asks its loop-detection and fetch-dedupe sets through captured methods. These bound the work a hostile chain can cause, and a replaced `Set.prototype.has` answering false let a cycle be walked and a URL be fetched repeatedly until a size cap stopped it.
+
+### Fixed
+
+- `pki.path.validate` holds its `requiredEku` gate against a replaced `Array.prototype.indexOf`. The purpose test IS the decision about what the certificate may be used for, and dispatched live it reported `serverAuth` present on a leaf whose extended key usage carried only `emailProtection`, returning a valid chain for a certificate the caller had asked it to refuse. Certificate-policy membership and the `anyPolicy` scans in the policy tree are decided the same way.
+- `pki.cms.verify` keeps `trusted: false` for a message no supplied anchor covers. The message-level verdict combined the per-signer answers with `every`, and a replaced one reported the whole set trusted without consulting a single signer.
+- An OCSP response is still refused when its delegate lacks id-kp-OCSPSigning. Responder authorization is the decision about who may answer for an issuer, and reading the purpose list through the prototype let a delegate the CA never authorized speak for the whole issuer.
+- A TPM attestation certificate still needs the tcg-kp-AIKCertificate purpose. That test is what makes a leaf an attestation key, so reading it live let an ordinary certificate be accepted as one.
+- A timestamp token carrying an unrecognized critical extension is still refused (RFC 3161 sec. 2.4.2). The scan for a critical extension IS the gate, and a replaced `Array.prototype.some` answering false made the extension invisible and the unusable token acceptable.
+- `pki.cms.verify` keeps `valid: false` for a message whose signature does not verify. The soundness verdict combined the per-signer answers the same way the trust verdict did, so a corrupted signature reported `valid: true`.
+- `pki.path.validate` asks its processed-extension tables for their OWN entries. Freezing a table prevents a write to it and does not prevent an inherited lookup, so a name planted on `Object.prototype` answered for every OID the table did not carry and an unrecognized critical extension counted as processed. On a CA certificate only one of the two tables is consulted, so the chain was accepted rather than refused (RFC 5280 sec. 6.1.4).
+- A trust anchor's `purposes` map is read for its own entries too. The map is the operator's restriction, and an inherited `true` granted the purpose on every anchor whose map did not name it. `distrustAfter` is read the same way.
+- The ML-DSA digest-strength rule (RFC 9882 sec. 3.3) is one question both the signer and the CMS verifier ask, and it answers from the policy table's own entries. A digest name planted on `Object.prototype` answered for every name a parameter set's row omits, so a below-strength digest passed the strength check: `sha256` was accepted for ML-DSA-87 on both paths. The check also had two copies, which is why it now lives in the module that owns the table.
+
+## v0.5.19 — 2026-08-20
+
+The crypto engine and the JWS signer decide with operations captured at load, so code that runs after the module does cannot change what a permission check concludes.
+
+### Changed
+
+- `pki.webcrypto` and `pki.jose` are held to the live-read rule the guard family already follows: the check over `lib/` that refuses reading an operation from the runtime at call time covers every module that takes the captures, and these two now do. Operator-visible behavior is unchanged except where a refusal that could be bypassed now holds.
+
+### Fixed
+
+- The WebCrypto key-usage check holds against a replaced `Array.prototype.indexOf`. The membership test IS the permission decision, so it runs through the captured method: dispatched live, a key permitted only for `verify` passed the engine's gate for `sign` and failed later, in the platform's own crypto, with an untyped fault instead of `webcrypto/invalid-access`.
+- A CryptoKey's usage list is a copy this engine took with a captured `slice`, so a replaced one cannot leave the caller holding the array the key is checked against for the rest of its life. The same applies to the partition that decides which usages each half of a generated pair is minted with.
+- `pki.key.import`, `pki.key.generate` and `subtle.generateKey` refuse a non-array `usages` by name. It reached the key constructor, where `Array.prototype.slice` on a number yields an empty list, so the call minted a key permitted for nothing rather than naming the argument that was wrong. The asymmetric branch of `generateKey` partitions the usages before either half is constructed and `filter` treats a non-list the same way, so it is checked at that verb's own door and the whole pair is refused.
+- The AES-GCM ciphertext and authentication tag are split with a captured `subarray`, so a replaced one cannot hand the tag check a different range of the same buffer.
+- A JWK thumbprint (RFC 7638 sec. 3.3) is built with a captured serializer. The canonical JSON is the thumbprint's preimage, so a replaced `JSON.stringify` changes the identity every consumer compares keys by.
+- The JOSE header checks -- own-name reads, the `crit` list walk, the embedded-JWK shape test -- and the protected-header serialization all run on captured operations, so a caller who reaches the header through an accessor cannot decide which of them apply.
+- A digest runs under the algorithm the caller named. The hash name is case-folded to pick its registry row, and dispatched live a replaced `String.prototype.toUpperCase` answering `SHA-1` gave a caller who asked for SHA-256 a 20-byte digest. The same fold picks the HMAC block size and decides whether a key's algorithm matches the operation's.
+- `getRandomValues` settles the kinds WebCrypto refuses from the value's internal slot rather than by `instanceof` against a replaceable global, so a real `Float32Array` cannot pass a check written to reject it by swapping the constructor the comparison names.
+
 ## v0.5.18 — 2026-08-20
 
 Every producing verb refuses an authoring field it does not read, so a misspelling is a refusal at the call instead of a signed artifact that quietly omits what was asked for.

package/lib/cms-verify.js

@@ -39,7 +39,9 @@ var cmsEncrypt = require("./cms-encrypt");
 var cmsDecrypt = require("./cms-decrypt");
 var cmsCompress = require("./cms-compress");
 var signScheme = require("./sign-scheme");
-var MLDSA_SUITABLE_DIGEST = signScheme.MLDSA_SUITABLE_DIGEST;   // shared sign/verify digest-strength policy (RFC 9882 sec. 3.3)
+// The digest-strength question is asked of sign-scheme, which owns the policy table, so the signer
+// and this verifier cannot drift (RFC 9882 sec. 3.3).
+var _mldsaDigestSuitable = signScheme.mldsaDigestSuitable;
 var SLHDSA_BY_OID = signScheme.SLHDSA_BY_OID;                   // shared SLH-DSA set -> { wc, digest } (RFC 9814 sec. 4 pinned digest)
 var validator = require("./validator-all");
 var compositeSig = require("./composite-sig");
@@ -71,7 +73,7 @@ var DIGEST_HASH = {
 // foreign fault and loses this module's own unsupported-algorithm verdict.
 var SIG_HASH = { sha1: "SHA-1", sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" };
 // Is `name` a message-digest algorithm this verifier supports?
-function _supportedDigest(name) { return !!DIGEST_HASH[name]; }
+function _supportedDigest(name) { return guard.intrinsic.hasOwn(DIGEST_HASH, name) && !!DIGEST_HASH[name]; }
 // The digest of `content` under the named algorithm, resolved to a Buffer.
 function _computeDigest(name, content) {
   return subtle.digest(DIGEST_HASH[name], content).then(function (d) { return Buffer.from(d); });
@@ -366,7 +368,7 @@ function _verifyOne(si, content, eContentType, parsedCerts, csTarget) {
   // meet the parameter set's security strength -- a below-strength digest is the weaker link and is
   // rejected fail-closed (the RFC's "verifiers MAY reject", taken by the strict-verifier posture).
   // With signed attributes absent the digestAlgorithm has no meaning (sec. 3.3) and is not checked.
-  if (scheme.kind === "mldsa" && si.signedAttrsBytes && !MLDSA_SUITABLE_DIGEST[scheme.name][si.digestAlgorithm.name]) return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the " + si.digestAlgorithm.name + " message digest is below the security strength of " + scheme.name + " (RFC 9882 sec. 3.3)" });
+  if (scheme.kind === "mldsa" && si.signedAttrsBytes && !_mldsaDigestSuitable(scheme.name, si.digestAlgorithm.name)) return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the " + si.digestAlgorithm.name + " message digest is below the security strength of " + scheme.name + " (RFC 9882 sec. 3.3)" });
   // RFC 9814 sec. 4: an SLH-DSA SignerInfo's message-digest algorithm is the one paired with the
   // parameter set (the sec. 4 list, always at least twice the tree-hash size); the signer emits it
   // and this strict verifier requires it, so a digest that does not match the set's paired hash fails
@@ -768,7 +770,9 @@ function _verify(input, opts) {
     // message a second time to learn it, and a check that needs a second parse is a check most
     // callers will not write.
     var res = {
-      valid: signers.length > 0 && signers.every(function (s) { return s.ok === true; }),
+      // Signature soundness is decided by comparison for the same reason the trust verdict below
+      // is: `every` replaced after load reports the whole set sound without reading one signer.
+      valid: signers.length > 0 && guard.list.allMatch(signers, function (s) { return s.ok === true; }),
       eContentType: parsed.encapContentInfo.eContentType,
       signers: signers,
     };
@@ -873,6 +877,12 @@ function _keyUsagePermitsSigning(parsedCerts, der) {
   return true;                                // absent: unconstrained (sec. 4.2.1.3)
 }
 
+// Every signer trusted? The answer IS the message-level trust verdict, so it is decided by
+// comparison instead of by an `every`. See guard-list.
+function _allTrusted(signers) {
+  return guard.list.allMatch(signers, function (s) { return s.trusted === true; });
+}
+
 // `cfg` is verify's SNAPSHOT, never the caller's options object -- the parameter is named for that
 // so a future caller cannot hand it the live one without noticing.
 function _applyTrust(res, parsedCerts, cfg) {
@@ -963,7 +973,10 @@ function _applyTrust(res, parsedCerts, cfg) {
         });
     });
   }, Promise.resolve()).then(function () {
-    res.trusted = res.valid && res.signers.length > 0 && res.signers.every(function (s) { return s.trusted === true; });
+    // The trust verdict is decided by comparison, not by a prototype method: `every` replaced after
+    // load answers true without consulting a single signer, and a message no anchor covers reports
+    // trusted:true.
+    res.trusted = res.valid && res.signers.length > 0 && _allTrusted(res.signers);
   });
 }
 // Parse a candidate cert DER and index its SKI; a cert that will not parse is skipped (it

package/lib/guard-all.js

@@ -55,6 +55,7 @@ var bytes  = require("./guard-bytes");
 var text   = require("./guard-text");
 var limits = require("./guard-limits");
 var crypto = require("./guard-crypto");
+var list = require("./guard-list");
 var range  = require("./guard-range");
 var time   = require("./guard-time");
 var name   = require("./guard-name");
@@ -74,6 +75,7 @@ module.exports = {
   text:   text,
   limits: limits,
   crypto: crypto,
+  list: list,
   range:  range,
   time:   time,
   name:   name,

package/lib/guard-intrinsic.js

@@ -84,6 +84,10 @@ var _jsonStringify = JSON.stringify;
 var _mathFloor = Math.floor;
 var _mathCeil = Math.ceil;
 var _mathMin = Math.min;
+var _mathMax = Math.max;
+// A numeric parse a bound is then compared against: one answering a larger value widens the bound
+// the comparison was written to enforce.
+var _parseInt = parseInt;
 var _promiseResolve = Promise.resolve;
 var _promiseReject = Promise.reject;
 
@@ -102,6 +106,19 @@ var _arrSort = uncurry(Array.prototype.sort);
 var _arrConcat = uncurry(Array.prototype.concat);
 var _arrSlice = uncurry(Array.prototype.slice);
 var _arrJoin = uncurry(Array.prototype.join);
+var _arrPush = uncurry(Array.prototype.push);
+
+// The string and byte-view operations a decision is then made on. A `toUpperCase` or `toLowerCase`
+// replaced after load changes which registry row an algorithm name resolves to; a `subarray`
+// returning a different window hands the next step bytes from somewhere else in the same buffer;
+// and a radix conversion is how a key's own numbers are read back before they are compared.
+var _strToUpperCase = uncurry(String.prototype.toUpperCase);
+var _strToLowerCase = uncurry(String.prototype.toLowerCase);
+var _strIndexOf = uncurry(String.prototype.indexOf);
+var _taSubarray = uncurry(Uint8Array.prototype.subarray);
+var _abSlice = uncurry(ArrayBuffer.prototype.slice);
+var _numToString = uncurry(Number.prototype.toString);
+var _bigIntToString = uncurry(BigInt.prototype.toString);
 
 // The collection operations, uncurried. A guard's cycle-safe chain walk is a `Set` it owns, and
 // `has` is what stops it: one answering `true` ends the walk at the first prototype, so a scan that
@@ -270,6 +287,16 @@ module.exports = {
   floor: _mathFloor,
   ceil: _mathCeil,
   min: _mathMin,
+  max: _mathMax,
+  parseInt: _parseInt,
+  push: _arrPush,
+  toUpperCase: _strToUpperCase,
+  toLowerCase: _strToLowerCase,
+  stringIndexOf: _strIndexOf,
+  subarray: _taSubarray,
+  arrayBufferSlice: _abSlice,
+  numberToString: _numToString,
+  bigIntToString: _bigIntToString,
   promiseResolve: _promiseResolve,
   promiseReject: _promiseReject,
   forEach: _arrForEach,

package/lib/guard-list.js

@@ -0,0 +1,85 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal, so no operator-facing namespace. The documented surface is every verdict whose rule
+// composes this guard: pki.path.validate (requiredEku, the policy tree), pki.cms.verify (the
+// message trust verdict), the OCSP delegated-responder check, the TPM AIK purpose check, and the
+// timestamp unknown-critical-extension gate.
+//
+// guard-list, membership decided by comparison and never by a prototype method.
+//
+// Defends the intrinsic-substitution class (CWE-349 / CWE-693: a control the caller can neutralize).
+// Written `list.indexOf(v) !== -1` or `list.some(fn)`, a membership test asks the runtime, at the
+// moment of the call, which function `indexOf` or `some` is. A caller who receives control after
+// this package loads, through an option accessor or a `toJSON` or while a verb is suspended on an
+// await, can replace it. The answer becomes whatever they chose, while every check around it still
+// runs and still passes.
+//
+// The distinction that matters is what the answer IS. A scan over a local accumulator produces a
+// value. A scan that decides whether a certificate carries a purpose, whether a policy is expected,
+// or whether every signer is trusted IS the rule. Measured on the tree before this guard existed:
+// with `Array.prototype.indexOf` replaced to report every value present, a certificate restricted
+// to emailProtection satisfied a requiredEku of serverAuth, and pki.path.validate went from
+// valid:false to valid:true.
+//
+// Capturing the method at load (guard-intrinsic) is the other half of the same defense, and is what
+// a module already inside that discipline uses. This guard is for the rule sites themselves. A loop
+// over `===` has nothing to replace, so it holds whatever the prototype says, in a module that has
+// been swept and in one that has not.
+
+// contains(list, value) -> boolean. Strict-equality membership, the `indexOf(v) !== -1` rule.
+// A null / undefined list is honestly empty, never a throw: these run on verdict paths.
+// @enforced-by behavioral -- `.indexOf(x) !== -1` has no rename-proof form that separates a
+//   membership RULE from its legitimate siblings: the identical token is a substring search
+//   (`authority.indexOf(":")`, `addr.indexOf("@")`) and a local index lookup, and a shape matching
+//   all of them fired on 37 sites of which most were strings. What makes a site this guard's is
+//   what the answer IS -- a decision about a certificate, a policy or a signer -- and that is a
+//   judgment no regex makes. The RED vectors are the guard: a codeSigning-only certificate still
+//   fails a serverAuth requiredEku, and an unauthorized responder is still refused, each with
+//   Array.prototype.indexOf replaced after load.
+function contains(list, value) {
+  if (!list) return false;
+  for (var i = 0, n = list.length; i < n; i++) if (list[i] === value) return true;
+  return false;
+}
+
+// containsAll(list, values) -> boolean. Every one of `values` present in `list` -- the shape a
+// "these purposes are all required" rule needs. No `values` is vacuously satisfied.
+// @enforced-by behavioral -- the composition of contains() has no rename-proof shape of its own;
+//   the RED vectors (a codeSigning-only certificate still fails a serverAuth requiredEku with
+//   Array.prototype.indexOf replaced) are the guard.
+function containsAll(list, values) {
+  if (!values) return true;
+  for (var i = 0, n = values.length; i < n; i++) if (!contains(list, values[i])) return false;
+  return true;
+}
+
+// anyMatches(list, predicate) -> boolean. The `some(fn)` rule: does any member satisfy it? The
+// predicate is the caller's own function, so what this guard removes is the DISPATCH, not the test.
+// @enforced-by behavioral -- `.some(` has legitimate non-rule siblings (building a list, reporting
+//   a count), so a blanket detector would false-fire; the RED vectors (a critical extension is
+//   still seen, an untrusted signer still reported) are the guard.
+function anyMatches(list, predicate) {
+  if (!list) return false;
+  for (var i = 0, n = list.length; i < n; i++) if (predicate(list[i], i)) return true;
+  return false;
+}
+
+// allMatch(list, predicate) -> boolean. The `every(fn)` rule, same reasoning as anyMatches. An
+// empty list is vacuously true, matching Array.prototype.every -- a caller that needs "non-empty
+// AND all" tests the length itself, as pki.cms.verify does for the trust verdict.
+// @enforced-by behavioral -- see anyMatches; the RED vector (an untrusted signer keeps
+// trusted:false with Array.prototype.every replaced) is the guard.
+function allMatch(list, predicate) {
+  if (!list) return true;
+  for (var i = 0, n = list.length; i < n; i++) if (!predicate(list[i], i)) return false;
+  return true;
+}
+
+module.exports = {
+  contains: contains,
+  containsAll: containsAll,
+  anyMatches: anyMatches,
+  allMatch: allMatch,
+};

package/lib/jose.js

@@ -42,6 +42,24 @@ var webcrypto = wcEngine.webcrypto;
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
 var edwardsPoint = require("./edwards-point");
+// What this module reads from the runtime while it is deciding something, taken at load. A JWS is
+// signed and verified against a header the caller owns, and the reads below are the ones that decide
+// what that header IS: whether a value is a list, whether a name is the caller's own, which
+// conversion turns a claim into the string compared against a profile. A caller who receives control
+// afterwards -- through an accessor on the header, or a `toJSON` while it is being serialized -- can
+// replace any of them, and every check around them still runs and still passes. See guard-intrinsic.
+var intrinsic = require("./guard-intrinsic");
+var _isArray = intrinsic.isArray;
+var _hasOwn = intrinsic.hasOwn;
+var _keys = intrinsic.keys;
+var _isBuffer = intrinsic.isBuffer;
+var _bufferFrom = intrinsic.bufferFrom;
+var _stringify = intrinsic.stringify;
+var _ObjectProto = intrinsic.ObjectProto;
+var _push = intrinsic.uncurry(Array.prototype.push);
+var _join = intrinsic.join;
+var _map = intrinsic.map;
+var _bufToString = intrinsic.uncurry(Buffer.prototype.toString);
 
 var JoseError = frameworkError.JoseError;
 function E(code, message, cause) { return new JoseError(code, message, cause); }
@@ -65,11 +83,11 @@ var LIMITS = constants.LIMITS;
  *   pki.jose.base64url.encode(Buffer.from([1, 2, 3]));   // -> "AQID"
  */
 function b64uEncode(bytes) {
-  if (!Buffer.isBuffer(bytes)) throw E("jose/bad-input", "base64url.encode requires a Buffer");
+  if (!_isBuffer(bytes)) throw E("jose/bad-input", "base64url.encode requires a Buffer");
   // Re-view through the byte guard: a detached-backed Buffer reads as zero-length,
   // so a bare .toString would silently encode "" -- fail closed instead.
   bytes = guard.bytes.view(bytes, JoseError, "jose/bad-input", "base64url.encode input");
-  return bytes.toString("base64url");
+  return _bufToString(bytes, "base64url");
 }
 
 /**
@@ -182,19 +200,19 @@ var PROFILES = {
 // { alg, algRow, header }; throws a typed jose/* fault on any violation.
 function _checkHeader(header, profileName) {
   var profile = PROFILES[profileName];
-  if (!profile) throw E("jose/bad-input", "unknown JWS profile " + JSON.stringify(profileName));
-  if (!header || typeof header !== "object" || Array.isArray(header)) throw E("jose/bad-header", "the protected header must be a JSON object");
+  if (!profile) throw E("jose/bad-input", "unknown JWS profile " + _stringify(profileName));
+  if (!header || typeof header !== "object" || _isArray(header)) throw E("jose/bad-header", "the protected header must be a JSON object");
   // Every field is read as an OWN property. JSON.stringify (used by sign) omits
   // inherited members, so an alg/nonce/url living on the prototype (a polluted or
   // Object.create(...) header) would pass here yet serialize to a header MISSING
   // them -- so require own-ness, matching what the serialized JWS will actually carry.
-  var own = function (k) { return Object.prototype.hasOwnProperty.call(header, k); };
+  var own = function (k) { return _hasOwn(header, k); };
   // b64 (RFC 7797) MUST NOT be present at all -- the unencoded-payload downgrade.
   if (own("b64")) throw E("jose/bad-jws", "the RFC 7797 b64 header parameter is forbidden");
   var alg = header.alg;
   if (!own("alg") || typeof alg !== "string") throw E("jose/bad-header", "the protected header must carry a string alg");
   var algRow = profile.algs[alg];
-  if (!algRow) throw E("jose/bad-alg", "unsupported or forbidden algorithm " + JSON.stringify(alg) + " for this JWS profile");
+  if (!algRow) throw E("jose/bad-alg", "unsupported or forbidden algorithm " + _stringify(alg) + " for this JWS profile");
   if (profile.requireUrl && (!own("url") || typeof header.url !== "string" || header.url.length === 0)) throw E("jose/bad-header", "the protected header must carry a non-empty string url");
   // nonce discipline.
   var hasNonce = own("nonce");
@@ -219,20 +237,20 @@ function _checkHeader(header, profileName) {
   } else if (profile.keyId === "jwk") {
     if (!hasJwk || hasKid) throw E("jose/bad-header", "this JWS must carry an embedded jwk, not kid");
   }
-  if (hasJwk && (!header.jwk || typeof header.jwk !== "object" || Array.isArray(header.jwk))) throw E("jose/bad-header", "jwk must be a JSON object");
+  if (hasJwk && (!header.jwk || typeof header.jwk !== "object" || _isArray(header.jwk))) throw E("jose/bad-header", "jwk must be a JSON object");
   // crit: protected-only, non-empty, no standard names, no duplicates, all understood.
-  if (Object.prototype.hasOwnProperty.call(header, "crit")) {
+  if (_hasOwn(header, "crit")) {
     var crit = header.crit;
-    if (!Array.isArray(crit) || crit.length === 0) throw E("jose/bad-crit", "crit must be a non-empty array");
+    if (!_isArray(crit) || crit.length === 0) throw E("jose/bad-crit", "crit must be a non-empty array");
     var seen = {};
     for (var c = 0; c < crit.length; c++) {
       var name = crit[c];
       if (typeof name !== "string") throw E("jose/bad-crit", "crit entries must be strings");
-      if (Object.prototype.hasOwnProperty.call(seen, name)) throw E("jose/bad-crit", "duplicate crit entry " + JSON.stringify(name));
+      if (_hasOwn(seen, name)) throw E("jose/bad-crit", "duplicate crit entry " + _stringify(name));
       seen[name] = 1;
-      if (UNDERSTOOD_HEADER[name]) throw E("jose/bad-crit", "crit must not name a standard header parameter " + JSON.stringify(name));
+      if (UNDERSTOOD_HEADER[name]) throw E("jose/bad-crit", "crit must not name a standard header parameter " + _stringify(name));
       // Anything else is an extension parameter this implementation does not process.
-      throw E("jose/bad-crit", "unprocessed critical header parameter " + JSON.stringify(name));
+      throw E("jose/bad-crit", "unprocessed critical header parameter " + _stringify(name));
     }
   }
   return { alg: alg, algRow: algRow, header: header };
@@ -267,9 +285,9 @@ function _cryptoAlg(algRow, jwk, key) {
 // The key type the JWK MUST have for this alg (fail closed on confusion).
 function _assertKeyType(algRow, jwk) {
   if (!jwk || typeof jwk !== "object" || typeof jwk.kty !== "string") throw E("jose/bad-key", "a JWK object with a kty is required");
-  if (jwk.kty !== algRow.kty) throw E("jose/bad-alg", "the key type " + JSON.stringify(jwk.kty) + " does not match the algorithm");
+  if (jwk.kty !== algRow.kty) throw E("jose/bad-alg", "the key type " + _stringify(jwk.kty) + " does not match the algorithm");
   if (algRow.kty === "EC" && jwk.crv !== algRow.crv) throw E("jose/bad-alg", "the EC curve does not match the algorithm");
-  if (algRow.kty === "OKP" && jwk.crv !== "Ed25519" && jwk.crv !== "Ed448") throw E("jose/bad-alg", "unsupported OKP curve " + JSON.stringify(jwk.crv));
+  if (algRow.kty === "OKP" && jwk.crv !== "Ed25519" && jwk.crv !== "Ed448") throw E("jose/bad-alg", "unsupported OKP curve " + _stringify(jwk.crv));
   // node/OpenSSL import a low-order (e.g. identity) OKP point without complaint and it verifies a
   // forged signature; reject a non-full-order Edwards point through the shared gate, the same check
   // every EdDSA verify path in the toolkit applies.
@@ -278,7 +296,7 @@ function _assertKeyType(algRow, jwk) {
   }
   // An AKP (ML-DSA) JWK carries its parameter set in `alg` (RFC 9964); it MUST match
   // the algorithm's set, or an ML-DSA-44 key could embed an ML-DSA-65 public JWK.
-  if (algRow.kty === "AKP" && jwk.alg !== algRow.subtle) throw E("jose/bad-alg", "the AKP parameter set " + JSON.stringify(jwk.alg) + " does not match the algorithm " + algRow.subtle);
+  if (algRow.kty === "AKP" && jwk.alg !== algRow.subtle) throw E("jose/bad-alg", "the AKP parameter set " + _stringify(jwk.alg) + " does not match the algorithm " + algRow.subtle);
 }
 
 // The exact signature byte length this alg + key must produce.
@@ -317,10 +335,10 @@ var PRIVATE_JWK_MEMBERS = ["d", "p", "q", "dp", "dq", "qi", "k", "priv"];
  *   pki.jose.assertPublicJwk({ kty: "EC", crv: "P-256", x: "...", y: "..." });
  */
 function assertPublicJwk(jwk) {
-  if (!jwk || typeof jwk !== "object" || Array.isArray(jwk)) throw E("jose/bad-key", "a JWK object is required");
+  if (!jwk || typeof jwk !== "object" || _isArray(jwk)) throw E("jose/bad-key", "a JWK object is required");
   for (var i = 0; i < PRIVATE_JWK_MEMBERS.length; i++) {
-    if (Object.prototype.hasOwnProperty.call(jwk, PRIVATE_JWK_MEMBERS[i])) {
-      throw E("jose/private-key-material", "a published JWK must be public-only; it carries the private member " + JSON.stringify(PRIVATE_JWK_MEMBERS[i]));
+    if (_hasOwn(jwk, PRIVATE_JWK_MEMBERS[i])) {
+      throw E("jose/private-key-material", "a published JWK must be public-only; it carries the private member " + _stringify(PRIVATE_JWK_MEMBERS[i]));
     }
   }
   return jwk;
@@ -374,9 +392,9 @@ var _VERIFY_KEYS = { key: 1, profile: 1 };
 async function verify(jws, opts) {
   opts = opts || {};
   guard.identifier.assertKnownKeys(opts, _VERIFY_KEYS, E, "jose/bad-input", "unknown pki.jose.verify option ");
-  if (!jws || typeof jws !== "object" || Array.isArray(jws)) throw E("jose/bad-jws", "a flattened JWS object is required");
-  if (Object.prototype.hasOwnProperty.call(jws, "signatures")) throw E("jose/bad-jws", "the multi-signature signatures member is forbidden");
-  if (Object.prototype.hasOwnProperty.call(jws, "header")) throw E("jose/bad-jws", "the unprotected header member is forbidden");
+  if (!jws || typeof jws !== "object" || _isArray(jws)) throw E("jose/bad-jws", "a flattened JWS object is required");
+  if (_hasOwn(jws, "signatures")) throw E("jose/bad-jws", "the multi-signature signatures member is forbidden");
+  if (_hasOwn(jws, "header")) throw E("jose/bad-jws", "the unprotected header member is forbidden");
   if (typeof jws.protected !== "string" || typeof jws.signature !== "string") throw E("jose/bad-jws", "protected and signature must be base64url strings");
   if (typeof jws.payload !== "string") throw E("jose/bad-jws", "payload must be a base64url string (never detached)");
   var header = parseJson(b64uDecode(jws.protected));
@@ -393,7 +411,7 @@ async function verify(jws, opts) {
   // matters most -- a `key` that came back null from a lookup would verify against whatever the
   // message carried, and the verdict would report the embedded key as though none was named.
   // `undefined` alone means "not supplied", so spreading an options object stays safe.
-  if (opts.key !== undefined && (typeof opts.key !== "object" || opts.key === null || Array.isArray(opts.key))) {
+  if (opts.key !== undefined && (typeof opts.key !== "object" || opts.key === null || _isArray(opts.key))) {
     throw E("jose/bad-key", "opts.key was supplied but is not a JWK object, so the key this message must be signed under cannot be established");
   }
   var jwk = header.jwk || opts.key;
@@ -419,7 +437,7 @@ async function verify(jws, opts) {
   var want = _expectedSigBytes(checked.algRow, jwk);
   if (want != null && sig.length !== want) throw E("jose/bad-signature", "the signature length " + sig.length + " is not the " + want + " bytes " + checked.alg + " requires");
   // Signing input from the RECEIVED base64url strings verbatim (never a re-serialize).
-  var signingInput = Buffer.from(jws.protected + "." + jws.payload, "ascii");
+  var signingInput = _bufferFrom(jws.protected + "." + jws.payload, "ascii");
   var key;
   try { key = await webcrypto.subtle.importKey("jwk", jwk, _importParams(checked.algRow, jwk), false, ["verify"]); }
   catch (e) { throw E("jose/bad-key", "the JWK could not be imported for verification", e); }
@@ -483,23 +501,23 @@ async function sign(opts) {
   // those questions separately -- assertPublicJwk sees a public JWK while the bytes that ship carry
   // the private one, and the door sees a jwk-mode header while the signer sees a kid-mode one.
   var headerJson;
-  try { headerJson = JSON.stringify(opts.protected); }
+  try { headerJson = _stringify(opts.protected); }
   catch (e) { throw E("jose/bad-header", "the protected header must be JSON-serializable", e); }
   // Read back through the same bounded reader a received JWS goes through, so a header this side
   // produces is held to the caps and the duplicate-member rule the other side enforces.
-  var headerBytes = headerJson === undefined ? null : Buffer.from(headerJson, "utf8");
+  var headerBytes = headerJson === undefined ? null : _bufferFrom(headerJson, "utf8");
   var header = headerBytes === null ? opts.protected : parseJson(headerBytes);
   // Which of the two key sources is in force is known only once the header has been read, so the
   // narrower table runs here. It re-walks the bag, which also catches a name that code added.
   var embedsJwk = !!(header && typeof header === "object" && header.jwk);
   if (embedsJwk) {
     guard.identifier.assertKnownKeys(opts, _SIGN_KEYS_EMBEDDED_JWK, E, "jose/bad-input", function (k) {
-      return "unknown pki.jose.sign option " + JSON.stringify(k) +
+      return "unknown pki.jose.sign option " + _stringify(k) +
         (k === "jwk" ? "; the protected header already embeds the public JWK" : "");
     });
   }
   var payload = opts.payload;
-  if (!Buffer.isBuffer(payload)) throw E("jose/bad-input", "payload must be a Buffer (empty Buffer for POST-as-GET)");
+  if (!_isBuffer(payload)) throw E("jose/bad-input", "payload must be a Buffer (empty Buffer for POST-as-GET)");
   // Re-view before the length===0 fast-path: a DETACHED payload reads as zero-length
   // and would be silently signed as an empty POST-as-GET body -- fail closed instead.
   payload = guard.bytes.view(payload, JoseError, "jose/bad-input", "payload");
@@ -523,14 +541,14 @@ async function sign(opts) {
   if (header.jwk) { _assertKeyType(checked.algRow, header.jwk); assertPublicJwk(header.jwk); }
   var protectedB64 = b64uEncode(headerBytes);   // the exact bytes every check above read
   var payloadB64 = payload.length === 0 ? "" : b64uEncode(payload);
-  var signingInput = Buffer.from(protectedB64 + "." + payloadB64, "ascii");
+  var signingInput = _bufferFrom(protectedB64 + "." + payloadB64, "ascii");
   var jwk = header.jwk || opts.jwk || {};
   // opts.key is documented as a CryptoKey, so one created outside this engine signs here too: it
   // carries none of the material this engine signs with, and is re-imported through it rather than
   // reaching subtle.sign as a key it cannot read. A key whose material this process cannot reach at
   // all -- non-extractable, or held behind another implementation's interface -- is refused there.
   var signKey = await wcEngine.adoptKey(opts.key, null, ["sign"], E, "jose/bad-input");
-  var sigBuf = Buffer.from(await webcrypto.subtle.sign(_cryptoAlg(checked.algRow, jwk, signKey), signKey, signingInput));
+  var sigBuf = _bufferFrom(await webcrypto.subtle.sign(_cryptoAlg(checked.algRow, jwk, signKey), signKey, signingInput));
   // Pin the produced signature length the same way verify does. A key whose curve /
   // hash / modulus does not match the header alg (a P-384 key under ES256, an
   // HS512 key under HS256) still signs, but emits the wrong length -- caught here
@@ -590,15 +608,17 @@ var THUMBPRINT_MEMBERS = {
 async function thumbprint(jwk) {
   if (!jwk || typeof jwk !== "object" || typeof jwk.kty !== "string") throw E("jose/bad-key", "a JWK object with a kty is required");
   var members = THUMBPRINT_MEMBERS[jwk.kty];
-  if (!members) throw E("jose/bad-key", "unsupported JWK key type " + JSON.stringify(jwk.kty));
+  if (!members) throw E("jose/bad-key", "unsupported JWK key type " + _stringify(jwk.kty));
   var parts = [];
   for (var i = 0; i < members.length; i++) {
     var m = members[i];
-    if (typeof jwk[m] !== "string") throw E("jose/bad-key", "the JWK is missing the required member " + JSON.stringify(m));
-    parts.push(JSON.stringify(m) + ":" + JSON.stringify(jwk[m]));
+    if (typeof jwk[m] !== "string") throw E("jose/bad-key", "the JWK is missing the required member " + _stringify(m));
+    // The canonical form IS the thumbprint preimage (RFC 7638 sec. 3.3), so the serializer that
+    // builds it is the captured one: a replacement changes the identity every consumer compares.
+    _push(parts, _stringify(m) + ":" + _stringify(jwk[m]));
   }
-  var canonical = "{" + parts.join(",") + "}";
-  var digest = Buffer.from(await webcrypto.subtle.digest("SHA-256", Buffer.from(canonical, "utf8")));
+  var canonical = "{" + _join(parts, ",") + "}";
+  var digest = _bufferFrom(await webcrypto.subtle.digest("SHA-256", _bufferFrom(canonical, "utf8")));
   return b64uEncode(digest);
 }
 
@@ -630,7 +650,7 @@ async function thumbprint(jwk) {
  *   pss.map(function (r) { return r.alg; });   // -> ["PS256", "PS384", "PS512"]
  */
 function sigAlgs() {
-  return Object.keys(SIG_ALGS).map(function (alg) {
+  return _map(_keys(SIG_ALGS), function (alg) {
     var row = SIG_ALGS[alg];
     var out = { alg: alg, kty: row.kty };
     if (row.crv) out.crv = row.crv;

package/lib/key.js

@@ -305,6 +305,10 @@ async function import_(input, opts) {
   }
   var algorithm = opts.algorithm != null ? opts.algorithm : _inferAlgorithm(detected);
   var isPublic = detected.format === "spki";
+  // Checked at this verb's own door rather than left for the engine to discover: a non-list reached
+  // the CryptoKey copy, where `Array.prototype.slice` on a number yields an empty list, so the key
+  // was minted permitted for NOTHING instead of the call naming the argument that was wrong.
+  if (opts.usages != null && !Array.isArray(opts.usages)) throw _err("key/bad-input", "opts.usages must be an array of key-usage strings");
   var usages = opts.usages || _importUsages(_algName(algorithm), isPublic);
   var extractable = opts.extractable != null ? opts.extractable : false;
   try {
@@ -344,6 +348,8 @@ async function generate(algorithm, opts) {
   guard.identifier.assertKnownKeys(opts, _GENERATE_OPTS, _err, "key/bad-input",
     "pki.key.generate has an unknown option (the WebCrypto spelling is `extractable`): ");
   var extractable = opts.extractable != null ? opts.extractable : true;
+  // The same door as import: a non-list is named here rather than becoming an empty usage set.
+  if (opts.usages != null && !Array.isArray(opts.usages)) throw _err("key/bad-input", "opts.usages must be an array of key-usage strings");
   var usages = opts.usages || _generateUsages(_algName(algorithm));
   var pair;
   try { pair = await subtle.generateKey(algorithm, extractable, usages); }

package/lib/ocsp-verify.js

@@ -45,6 +45,9 @@ OCSP_CERTID_HASHES[oid.byName("sha256")] = "SHA-256";
 OCSP_CERTID_HASHES[oid.byName("sha384")] = "SHA-384";
 OCSP_CERTID_HASHES[oid.byName("sha512")] = "SHA-512";
 var OID_OCSP_SIGNING = oid.byName("ocspSigning");
+// Does this extended-key-usage list assert the given purpose? The answer IS an authorization
+// decision, so it goes through the membership guard rather than a prototype method. See guard-list.
+var _asserts = guard.list.contains;
 var OID_OCSP_NOCHECK = oid.byName("ocspNoCheck");
 var OID_EKU = oid.byName("extKeyUsage");
 var OID_KEY_USAGE = oid.byName("keyUsage");
@@ -105,7 +108,7 @@ function makeOcspVerify(deps) {
   // 5280 sec. 7.1-equal byte encoding of the validated issuer DN to try.
   async function ocspCertIdMatches(certID, cert, issuerNameCandidates, issuerKeyBits) {
     if (certID.serialNumberHex !== cert.serialNumberHex) return false;
-    var hashName = OCSP_CERTID_HASHES[certID.hashAlgorithm.oid];
+    var hashName = guard.intrinsic.hasOwn(OCSP_CERTID_HASHES, certID.hashAlgorithm.oid) ? OCSP_CERTID_HASHES[certID.hashAlgorithm.oid] : null;
     if (!hashName) return false;
     var keyHash = await ocspDigest(hashName, issuerKeyBits);
     if (!certID.issuerKeyHash.equals(keyHash)) return false;
@@ -154,7 +157,11 @@ function makeOcspVerify(deps) {
       var eku;
       try { eku = decodeExt(rc, OID_EKU); }
       catch (_e) { continue; }
-      if (!eku || eku.value.indexOf(OID_OCSP_SIGNING) === -1) continue;
+      // The membership test IS the delegation rule, so it is decided by comparison rather than by a
+      // prototype method: dispatched live, an `Array.prototype.indexOf` replaced after load reports
+      // the purpose present on ANY certificate, and a cert an attacker put in the response's own
+      // certs bag is accepted as the authorized responder.
+      if (!eku || !_asserts(eku.value, OID_OCSP_SIGNING)) continue;
       // A delegate asserting keyUsage MUST permit digitalSignature; an absent keyUsage is
       // unrestricted, an unreadable one is not authoritative.
       var ku;