@blamejs/pki 0.5.19 → 0.5.21

package/CHANGELOG.md

@@ -4,6 +4,50 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.5.21 — 2026-08-21
+
+The check that holds the crypto engine to load-time captures could be satisfied around, so nine modules had taken the safe primitive at one site and were never held to it anywhere else.
+
+### Added
+
+- `guard.intrinsic.bufferEquals`, the captured byte-identity comparison the bindings above are decided with.
+
+### Changed
+
+- Taking the captures has one spelling again. The guard orchestrator no longer re-exports them, so a module reaches them by importing the module that holds them, and the check reads that off the loaded module graph rather than off the text. This is the enforcement change: a module that adopts one safe primitive is held to the rule everywhere, and no way of writing the import, or of writing something that resembles one, changes the answer.
+- The seven modules the widened check surfaced carry a declared count of remaining reads rather than an exemption. A new live read pushes a module past its figure and fails, and converting reads without lowering the figure fails too, so the number keeps naming the real count. A module reaching zero leaves the list and is held to zero.
+
+### Fixed
+
+- An OCSP response is bound to the certificate it answers for with captured byte comparisons. The CertID says the response concerns this issuer and the responder ID says this key signed it, and both were decided by a `Buffer.prototype.equals` read at call time: replaced after load it reports every hash equal, and a `good` signed by a different CA answers for the certificate under check.
+- The signer's key is matched to its certificate under a captured case fold. WebCrypto algorithm names compare case-insensitively, so the check folds both sides; dispatched live, a replaced fold reported two different algorithm names equal and a key whose algorithm does not match the certificate passed the gate that exists to catch exactly that.
+- `pki.sign` decides the RSASSA-PSS parameters, the digest tables and its key-shape tests on captured operations, so a caller who replaces one after this package loads cannot change which algorithm a signature runs under.
+- A signing key is classified by asking the value what it is rather than by `instanceof` against a global. The old test read the `Uint8Array` binding at call time, and it answered wrongly in both directions on its own terms: a real typed array from another realm was not one, and an object built on the prototype was.
+
+## v0.5.20 — 2026-08-20
+
+Five verdicts that turned on list membership now decide it by comparison, so replacing an array method after the module loads cannot change what a certificate, a responder or a signed message is found to be.
+
+### Added
+
+- `guard-list`, an internal choke point for membership decided by comparison. Four verbs cover the rule shapes a verdict needs: is this value present, are all of these present, does any member satisfy a test, do all of them. An absent list is honestly empty rather than a throw, because these run on verdict paths where a throw would read as a different verdict. It is not on the public namespace; the surface is the verdicts above.
+
+### Changed
+
+- Certification-path building asks its loop-detection and fetch-dedupe sets through captured methods. These bound the work a hostile chain can cause, and a replaced `Set.prototype.has` answering false let a cycle be walked and a URL be fetched repeatedly until a size cap stopped it.
+
+### Fixed
+
+- `pki.path.validate` holds its `requiredEku` gate against a replaced `Array.prototype.indexOf`. The purpose test IS the decision about what the certificate may be used for, and dispatched live it reported `serverAuth` present on a leaf whose extended key usage carried only `emailProtection`, returning a valid chain for a certificate the caller had asked it to refuse. Certificate-policy membership and the `anyPolicy` scans in the policy tree are decided the same way.
+- `pki.cms.verify` keeps `trusted: false` for a message no supplied anchor covers. The message-level verdict combined the per-signer answers with `every`, and a replaced one reported the whole set trusted without consulting a single signer.
+- An OCSP response is still refused when its delegate lacks id-kp-OCSPSigning. Responder authorization is the decision about who may answer for an issuer, and reading the purpose list through the prototype let a delegate the CA never authorized speak for the whole issuer.
+- A TPM attestation certificate still needs the tcg-kp-AIKCertificate purpose. That test is what makes a leaf an attestation key, so reading it live let an ordinary certificate be accepted as one.
+- A timestamp token carrying an unrecognized critical extension is still refused (RFC 3161 sec. 2.4.2). The scan for a critical extension IS the gate, and a replaced `Array.prototype.some` answering false made the extension invisible and the unusable token acceptable.
+- `pki.cms.verify` keeps `valid: false` for a message whose signature does not verify. The soundness verdict combined the per-signer answers the same way the trust verdict did, so a corrupted signature reported `valid: true`.
+- `pki.path.validate` asks its processed-extension tables for their OWN entries. Freezing a table prevents a write to it and does not prevent an inherited lookup, so a name planted on `Object.prototype` answered for every OID the table did not carry and an unrecognized critical extension counted as processed. On a CA certificate only one of the two tables is consulted, so the chain was accepted rather than refused (RFC 5280 sec. 6.1.4).
+- A trust anchor's `purposes` map is read for its own entries too. The map is the operator's restriction, and an inherited `true` granted the purpose on every anchor whose map did not name it. `distrustAfter` is read the same way.
+- The ML-DSA digest-strength rule (RFC 9882 sec. 3.3) is one question both the signer and the CMS verifier ask, and it answers from the policy table's own entries. A digest name planted on `Object.prototype` answered for every name a parameter set's row omits, so a below-strength digest passed the strength check: `sha256` was accepted for ML-DSA-87 on both paths. The check also had two copies, which is why it now lives in the module that owns the table.
+
 ## v0.5.19 — 2026-08-20
 
 The crypto engine and the JWS signer decide with operations captured at load, so code that runs after the module does cannot change what a permission check concludes.

package/lib/cms-decrypt.js

@@ -23,6 +23,7 @@ var schemaCms = require("./schema-cms");
 var webcrypto = require("./webcrypto");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
 var pbes2 = require("./pbes2");
 var b = asn1.build;
 var subtle = webcrypto.webcrypto.subtle;
@@ -415,8 +416,8 @@ async function _kemriCek(ri, km) {
 // why, by name. An unresolvable OID is left to _openContent too, as the unsupported algorithm it is.
 function _assertContentCipherMode(eci, ct) {
   var oidStr = eci.contentEncryptionAlgorithm.oid;
-  var isAead = guard.intrinsic.hasOwn(AEAD_ALGS, oidStr);
-  if (!isAead && !guard.intrinsic.hasOwn(CONTENT_MODE, oidStr)) return;
+  var isAead = intrinsic.hasOwn(AEAD_ALGS, oidStr);
+  if (!isAead && !intrinsic.hasOwn(CONTENT_MODE, oidStr)) return;
   if (ct === "authEnvelopedData") {
     if (isAead) return;
     throw _err("cms/unsupported-algorithm", "contentEncryptionAlgorithm " + oidStr + " is not an authenticated encryption algorithm, which authEnvelopedData requires (RFC 5083 sec. 2)");
@@ -428,14 +429,14 @@ function _assertContentCipherMode(eci, ct) {
 // ---- stage 3: open the content (uniform failure) ---------------------------
 async function _openContent(parsed, eci, cek, ct) {
   var alg = eci.contentEncryptionAlgorithm;
-  var keyBits = guard.intrinsic.hasOwn(CONTENT_KEYBITS, alg.oid) ? CONTENT_KEYBITS[alg.oid] : 0;
+  var keyBits = intrinsic.hasOwn(CONTENT_KEYBITS, alg.oid) ? CONTENT_KEYBITS[alg.oid] : 0;
   if (!keyBits) {
     // AES-CCM parses completely here -- registered OIDs, the sec. 3.1 nonce bound, the seven legal
     // ICV lengths -- and is then declined, because AES-GCM is the only AEAD this toolkit implements
     // for content encryption. Saying only "unsupported <oid>" is what an operator also sees for an
     // OID nothing in the toolkit recognizes, and the two call for different things: one is a
     // capability gap to route around, the other is a malformed or exotic message.
-    if (guard.intrinsic.hasOwn(AEAD_ALGS, alg.oid) && AEAD_ALGS[alg.oid] === "ccm") {
+    if (intrinsic.hasOwn(AEAD_ALGS, alg.oid) && AEAD_ALGS[alg.oid] === "ccm") {
       throw _err("cms/unsupported-algorithm", "contentEncryptionAlgorithm " + alg.oid + " is AES-CCM. RFC 5084 sec. 3.1 permits it for this content type; this toolkit implements AES-GCM only for content encryption");
     }
     throw _err("cms/unsupported-algorithm", "unsupported contentEncryptionAlgorithm " + alg.oid);

package/lib/cms-encrypt.js

@@ -23,6 +23,7 @@ var schemaCms = require("./schema-cms");
 var webcrypto = require("./webcrypto");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
 var pbes2 = require("./pbes2");
 var b = asn1.build;
 var subtle = webcrypto.webcrypto.subtle;
@@ -565,7 +566,7 @@ function _assertAuthAttrs(pairs, forbidden) {
     }
     var t;
     try { t = asn1.read.oid(node.children[0]); } catch (e) { throw _err("cms/bad-input", "an authenticated attribute type is not an OBJECT IDENTIFIER", e); }
-    if (guard.intrinsic.hasOwn(seenTypes, t)) throw _err("cms/bad-input", "authenticated attributes must not repeat an attribute type (RFC 5652): " + t);
+    if (intrinsic.hasOwn(seenTypes, t)) throw _err("cms/bad-input", "authenticated attributes must not repeat an attribute type (RFC 5652): " + t);
     seenTypes[t] = 1;
     if (forbidden && t === forbidden.oid) throw _err("cms/bad-input", forbidden.why);
   });

package/lib/cms-sign.js

@@ -22,6 +22,7 @@ var frameworkError = require("./framework-error");
 var webcrypto = require("./webcrypto");
 var signScheme = require("./sign-scheme");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
 var pkiBuild = require("./pki-build");   // the shared post-sign self-check, among other producing helpers
 var cms = require("./schema-cms");
 
@@ -117,7 +118,7 @@ function _buildSid(cert, useSki) {
 function _buildSignedAttrs(pairs) {
   var seenTypes = {};
   var attrs = pairs.map(function (p) {
-    if (guard.intrinsic.hasOwn(seenTypes, p.type)) throw _err("cms/bad-input", "signedAttrs must not repeat an attribute type (RFC 5652 sec. 5.3): " + p.type);
+    if (intrinsic.hasOwn(seenTypes, p.type)) throw _err("cms/bad-input", "signedAttrs must not repeat an attribute type (RFC 5652 sec. 5.3): " + p.type);
     seenTypes[p.type] = 1;
     return b.sequence([b.oid(p.type), b.set(p.values)]);
   });
@@ -155,8 +156,8 @@ function _buildUnsignedAttrs(list) {
   var pairs = _resolveAttrPairs(list, "an unsigned attribute value");
   var seen = {};
   pairs.forEach(function (p) {
-    if (guard.intrinsic.hasOwn(UNSIGNED_FORBIDDEN, p.type)) throw _err("cms/bad-input", "the " + UNSIGNED_FORBIDDEN[p.type] + " attribute must not appear as an unsigned attribute (RFC 5652 sec. 11)");
-    if (guard.intrinsic.hasOwn(seen, p.type)) throw _err("cms/bad-input", "unsignedAttrs must not repeat an attribute type (RFC 5652 sec. 5.3): " + p.type);
+    if (intrinsic.hasOwn(UNSIGNED_FORBIDDEN, p.type)) throw _err("cms/bad-input", "the " + UNSIGNED_FORBIDDEN[p.type] + " attribute must not appear as an unsigned attribute (RFC 5652 sec. 11)");
+    if (intrinsic.hasOwn(seen, p.type)) throw _err("cms/bad-input", "unsignedAttrs must not repeat an attribute type (RFC 5652 sec. 5.3): " + p.type);
     seen[p.type] = 1;
   });
   var setOf = b.set(pairs.map(function (p) { return b.sequence([b.oid(p.type), b.set(p.values)]); }));

package/lib/cms-verify.js

@@ -39,11 +39,14 @@ var cmsEncrypt = require("./cms-encrypt");
 var cmsDecrypt = require("./cms-decrypt");
 var cmsCompress = require("./cms-compress");
 var signScheme = require("./sign-scheme");
-var MLDSA_SUITABLE_DIGEST = signScheme.MLDSA_SUITABLE_DIGEST;   // shared sign/verify digest-strength policy (RFC 9882 sec. 3.3)
+// The digest-strength question is asked of sign-scheme, which owns the policy table, so the signer
+// and this verifier cannot drift (RFC 9882 sec. 3.3).
+var _mldsaDigestSuitable = signScheme.mldsaDigestSuitable;
 var SLHDSA_BY_OID = signScheme.SLHDSA_BY_OID;                   // shared SLH-DSA set -> { wc, digest } (RFC 9814 sec. 4 pinned digest)
 var validator = require("./validator-all");
 var compositeSig = require("./composite-sig");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
 var frameworkError = require("./framework-error");
 var pkix = require("./schema-pkix");
 
@@ -71,7 +74,7 @@ var DIGEST_HASH = {
 // foreign fault and loses this module's own unsupported-algorithm verdict.
 var SIG_HASH = { sha1: "SHA-1", sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" };
 // Is `name` a message-digest algorithm this verifier supports?
-function _supportedDigest(name) { return !!DIGEST_HASH[name]; }
+function _supportedDigest(name) { return intrinsic.hasOwn(DIGEST_HASH, name) && !!DIGEST_HASH[name]; }
 // The digest of `content` under the named algorithm, resolved to a Buffer.
 function _computeDigest(name, content) {
   return subtle.digest(DIGEST_HASH[name], content).then(function (d) { return Buffer.from(d); });
@@ -366,7 +369,7 @@ function _verifyOne(si, content, eContentType, parsedCerts, csTarget) {
   // meet the parameter set's security strength -- a below-strength digest is the weaker link and is
   // rejected fail-closed (the RFC's "verifiers MAY reject", taken by the strict-verifier posture).
   // With signed attributes absent the digestAlgorithm has no meaning (sec. 3.3) and is not checked.
-  if (scheme.kind === "mldsa" && si.signedAttrsBytes && !MLDSA_SUITABLE_DIGEST[scheme.name][si.digestAlgorithm.name]) return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the " + si.digestAlgorithm.name + " message digest is below the security strength of " + scheme.name + " (RFC 9882 sec. 3.3)" });
+  if (scheme.kind === "mldsa" && si.signedAttrsBytes && !_mldsaDigestSuitable(scheme.name, si.digestAlgorithm.name)) return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the " + si.digestAlgorithm.name + " message digest is below the security strength of " + scheme.name + " (RFC 9882 sec. 3.3)" });
   // RFC 9814 sec. 4: an SLH-DSA SignerInfo's message-digest algorithm is the one paired with the
   // parameter set (the sec. 4 list, always at least twice the tree-hash size); the signer emits it
   // and this strict verifier requires it, so a digest that does not match the set's paired hash fails
@@ -768,7 +771,9 @@ function _verify(input, opts) {
     // message a second time to learn it, and a check that needs a second parse is a check most
     // callers will not write.
     var res = {
-      valid: signers.length > 0 && signers.every(function (s) { return s.ok === true; }),
+      // Signature soundness is decided by comparison for the same reason the trust verdict below
+      // is: `every` replaced after load reports the whole set sound without reading one signer.
+      valid: signers.length > 0 && guard.list.allMatch(signers, function (s) { return s.ok === true; }),
       eContentType: parsed.encapContentInfo.eContentType,
       signers: signers,
     };
@@ -873,6 +878,12 @@ function _keyUsagePermitsSigning(parsedCerts, der) {
   return true;                                // absent: unconstrained (sec. 4.2.1.3)
 }
 
+// Every signer trusted? The answer IS the message-level trust verdict, so it is decided by
+// comparison instead of by an `every`. See guard-list.
+function _allTrusted(signers) {
+  return guard.list.allMatch(signers, function (s) { return s.trusted === true; });
+}
+
 // `cfg` is verify's SNAPSHOT, never the caller's options object -- the parameter is named for that
 // so a future caller cannot hand it the live one without noticing.
 function _applyTrust(res, parsedCerts, cfg) {
@@ -963,7 +974,10 @@ function _applyTrust(res, parsedCerts, cfg) {
         });
     });
   }, Promise.resolve()).then(function () {
-    res.trusted = res.valid && res.signers.length > 0 && res.signers.every(function (s) { return s.trusted === true; });
+    // The trust verdict is decided by comparison, not by a prototype method: `every` replaced after
+    // load answers true without consulting a single signer, and a message no anchor covers reports
+    // trusted:true.
+    res.trusted = res.valid && res.signers.length > 0 && _allTrusted(res.signers);
   });
 }
 // Parse a candidate cert DER and index its SKI; a cert that will not parse is skipped (it

package/lib/guard-all.js

@@ -55,6 +55,7 @@ var bytes  = require("./guard-bytes");
 var text   = require("./guard-text");
 var limits = require("./guard-limits");
 var crypto = require("./guard-crypto");
+var list = require("./guard-list");
 var range  = require("./guard-range");
 var time   = require("./guard-time");
 var name   = require("./guard-name");
@@ -67,13 +68,18 @@ var compress = require("./guard-compress");
 var secret = require("./guard-secret");
 var parsed = require("./guard-parsed");
 var async_ = require("./guard-async");
-var intrinsic = require("./guard-intrinsic");
+// guard-intrinsic is deliberately NOT re-exported here. Re-exporting it gave taking the captures a
+// second spelling, and the check that holds a module to the discipline could then be satisfied
+// around: a module reached them as `guard.intrinsic.<x>` and never entered scope, so its remaining
+// live reads were never named. With one spelling, a module's own require IS the fact, and the check
+// reads it off the loaded module graph rather than guessing at the text.
 
 module.exports = {
   bytes:  bytes,
   text:   text,
   limits: limits,
   crypto: crypto,
+  list: list,
   range:  range,
   time:   time,
   name:   name,
@@ -86,5 +92,4 @@ module.exports = {
   secret: secret,
   parsed: parsed,
   async:  async_,
-  intrinsic: intrinsic,
 };

package/lib/guard-intrinsic.js

@@ -55,6 +55,10 @@ var _bufferConcat = Buffer.concat;
 var _bufferIsBuffer = Buffer.isBuffer;
 var _bufferByteLength = Buffer.byteLength;
 var _bufferCompare = Buffer.compare;
+// `Buffer.prototype.equals` is the byte-identity test a binding decides on: an OCSP CertID says the
+// response is about this issuer, a responder ID says this key signed it. Dispatched live, one
+// answering true makes a response about a DIFFERENT certificate match the one being asked about.
+var _bufferEquals = uncurry(Buffer.prototype.equals);
 
 // The rest of what a guard reads from the runtime while it is deciding something. These are
 // grouped here rather than captured file by file so the set is enumerable in one place and a guard
@@ -268,6 +272,7 @@ module.exports = {
   isBuffer: _bufferIsBuffer,
   byteLength: _bufferByteLength,
   compare: _bufferCompare,
+  bufferEquals: _bufferEquals,
   isView: _isView,
   isInteger: _isInteger,
   isSafeInteger: _isSafeInteger,

package/lib/guard-list.js

@@ -0,0 +1,85 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal, so no operator-facing namespace. The documented surface is every verdict whose rule
+// composes this guard: pki.path.validate (requiredEku, the policy tree), pki.cms.verify (the
+// message trust verdict), the OCSP delegated-responder check, the TPM AIK purpose check, and the
+// timestamp unknown-critical-extension gate.
+//
+// guard-list, membership decided by comparison and never by a prototype method.
+//
+// Defends the intrinsic-substitution class (CWE-349 / CWE-693: a control the caller can neutralize).
+// Written `list.indexOf(v) !== -1` or `list.some(fn)`, a membership test asks the runtime, at the
+// moment of the call, which function `indexOf` or `some` is. A caller who receives control after
+// this package loads, through an option accessor or a `toJSON` or while a verb is suspended on an
+// await, can replace it. The answer becomes whatever they chose, while every check around it still
+// runs and still passes.
+//
+// The distinction that matters is what the answer IS. A scan over a local accumulator produces a
+// value. A scan that decides whether a certificate carries a purpose, whether a policy is expected,
+// or whether every signer is trusted IS the rule. Measured on the tree before this guard existed:
+// with `Array.prototype.indexOf` replaced to report every value present, a certificate restricted
+// to emailProtection satisfied a requiredEku of serverAuth, and pki.path.validate went from
+// valid:false to valid:true.
+//
+// Capturing the method at load (guard-intrinsic) is the other half of the same defense, and is what
+// a module already inside that discipline uses. This guard is for the rule sites themselves. A loop
+// over `===` has nothing to replace, so it holds whatever the prototype says, in a module that has
+// been swept and in one that has not.
+
+// contains(list, value) -> boolean. Strict-equality membership, the `indexOf(v) !== -1` rule.
+// A null / undefined list is honestly empty, never a throw: these run on verdict paths.
+// @enforced-by behavioral -- `.indexOf(x) !== -1` has no rename-proof form that separates a
+//   membership RULE from its legitimate siblings: the identical token is a substring search
+//   (`authority.indexOf(":")`, `addr.indexOf("@")`) and a local index lookup, and a shape matching
+//   all of them fired on 37 sites of which most were strings. What makes a site this guard's is
+//   what the answer IS -- a decision about a certificate, a policy or a signer -- and that is a
+//   judgment no regex makes. The RED vectors are the guard: a codeSigning-only certificate still
+//   fails a serverAuth requiredEku, and an unauthorized responder is still refused, each with
+//   Array.prototype.indexOf replaced after load.
+function contains(list, value) {
+  if (!list) return false;
+  for (var i = 0, n = list.length; i < n; i++) if (list[i] === value) return true;
+  return false;
+}
+
+// containsAll(list, values) -> boolean. Every one of `values` present in `list` -- the shape a
+// "these purposes are all required" rule needs. No `values` is vacuously satisfied.
+// @enforced-by behavioral -- the composition of contains() has no rename-proof shape of its own;
+//   the RED vectors (a codeSigning-only certificate still fails a serverAuth requiredEku with
+//   Array.prototype.indexOf replaced) are the guard.
+function containsAll(list, values) {
+  if (!values) return true;
+  for (var i = 0, n = values.length; i < n; i++) if (!contains(list, values[i])) return false;
+  return true;
+}
+
+// anyMatches(list, predicate) -> boolean. The `some(fn)` rule: does any member satisfy it? The
+// predicate is the caller's own function, so what this guard removes is the DISPATCH, not the test.
+// @enforced-by behavioral -- `.some(` has legitimate non-rule siblings (building a list, reporting
+//   a count), so a blanket detector would false-fire; the RED vectors (a critical extension is
+//   still seen, an untrusted signer still reported) are the guard.
+function anyMatches(list, predicate) {
+  if (!list) return false;
+  for (var i = 0, n = list.length; i < n; i++) if (predicate(list[i], i)) return true;
+  return false;
+}
+
+// allMatch(list, predicate) -> boolean. The `every(fn)` rule, same reasoning as anyMatches. An
+// empty list is vacuously true, matching Array.prototype.every -- a caller that needs "non-empty
+// AND all" tests the length itself, as pki.cms.verify does for the trust verdict.
+// @enforced-by behavioral -- see anyMatches; the RED vector (an untrusted signer keeps
+// trusted:false with Array.prototype.every replaced) is the guard.
+function allMatch(list, predicate) {
+  if (!list) return true;
+  for (var i = 0, n = list.length; i < n; i++) if (!predicate(list[i], i)) return false;
+  return true;
+}
+
+module.exports = {
+  contains: contains,
+  containsAll: containsAll,
+  anyMatches: anyMatches,
+  allMatch: allMatch,
+};

package/lib/ocsp-verify.js

@@ -29,6 +29,7 @@
 
 var asn1 = require("./asn1-der");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
 var oid = require("./oid");
 var x509 = require("./schema-x509");
 var compositeSig = require("./composite-sig");
@@ -45,11 +46,19 @@ OCSP_CERTID_HASHES[oid.byName("sha256")] = "SHA-256";
 OCSP_CERTID_HASHES[oid.byName("sha384")] = "SHA-384";
 OCSP_CERTID_HASHES[oid.byName("sha512")] = "SHA-512";
 var OID_OCSP_SIGNING = oid.byName("ocspSigning");
+// Does this extended-key-usage list assert the given purpose? The answer IS an authorization
+// decision, so it goes through the membership guard rather than a prototype method. See guard-list.
+var _asserts = guard.list.contains;
+// Captured at load. Each of these answers a binding question -- does this response concern the
+// certificate being asked about, did this key sign it -- so a replacement made after this module
+// loaded would decide the answer while every check around it still runs.
+var _bufferFrom = intrinsic.bufferFrom;
+var _bytesEqual = intrinsic.bufferEquals;
 var OID_OCSP_NOCHECK = oid.byName("ocspNoCheck");
 var OID_EKU = oid.byName("extKeyUsage");
 var OID_KEY_USAGE = oid.byName("keyUsage");
 
-function ocspDigest(alg, buf) { return subtle.digest(alg, buf).then(function (h) { return Buffer.from(h); }); }
+function ocspDigest(alg, buf) { return subtle.digest(alg, buf).then(function (h) { return _bufferFrom(h); }); }
 
 // The subjectPublicKey BIT STRING value (past the unused-bits octet) of an SPKI DER: the exact
 // bytes an OCSP CertID issuerKeyHash / byKey KeyHash hash over (RFC 6960 sec. 4.1.1). Throws on a
@@ -105,12 +114,12 @@ function makeOcspVerify(deps) {
   // 5280 sec. 7.1-equal byte encoding of the validated issuer DN to try.
   async function ocspCertIdMatches(certID, cert, issuerNameCandidates, issuerKeyBits) {
     if (certID.serialNumberHex !== cert.serialNumberHex) return false;
-    var hashName = OCSP_CERTID_HASHES[certID.hashAlgorithm.oid];
+    var hashName = intrinsic.hasOwn(OCSP_CERTID_HASHES, certID.hashAlgorithm.oid) ? OCSP_CERTID_HASHES[certID.hashAlgorithm.oid] : null;
     if (!hashName) return false;
     var keyHash = await ocspDigest(hashName, issuerKeyBits);
-    if (!certID.issuerKeyHash.equals(keyHash)) return false;
+    if (!_bytesEqual(certID.issuerKeyHash, keyHash)) return false;
     for (var i = 0; i < issuerNameCandidates.length; i++) {
-      if (certID.issuerNameHash.equals(await ocspDigest(hashName, issuerNameCandidates[i]))) return true;
+      if (_bytesEqual(certID.issuerNameHash, await ocspDigest(hashName, issuerNameCandidates[i]))) return true;
     }
     return false;
   }
@@ -123,7 +132,7 @@ function makeOcspVerify(deps) {
     var matchesIssuer = false;
     try {
       if (rid.byName) matchesIssuer = dnEqual(rid.byName.rdns, cert.issuer.rdns);
-      else if (rid.byKey) matchesIssuer = rid.byKey.equals(await ocspDigest("SHA-1", issuerKeyBits));
+      else if (rid.byKey) matchesIssuer = _bytesEqual(rid.byKey, await ocspDigest("SHA-1", issuerKeyBits));
     } catch (_e) { matchesIssuer = false; }
     if (matchesIssuer) return issuer.workingPublicKey;
 
@@ -134,7 +143,7 @@ function makeOcspVerify(deps) {
       var identifies = false;
       try {
         if (rid.byName) identifies = dnEqual(rid.byName.rdns, rc.subject.rdns);
-        else if (rid.byKey) identifies = rid.byKey.equals(await ocspDigest("SHA-1", ocspKeyValue(rc.subjectPublicKeyInfo.bytes)));
+        else if (rid.byKey) identifies = _bytesEqual(rid.byKey, await ocspDigest("SHA-1", ocspKeyValue(rc.subjectPublicKeyInfo.bytes)));
       } catch (_e) { identifies = false; }
       if (!identifies) continue;
       // The delegate MUST be issued directly by the CA that issued the target.
@@ -154,7 +163,11 @@ function makeOcspVerify(deps) {
       var eku;
       try { eku = decodeExt(rc, OID_EKU); }
       catch (_e) { continue; }
-      if (!eku || eku.value.indexOf(OID_OCSP_SIGNING) === -1) continue;
+      // The membership test IS the delegation rule, so it is decided by comparison rather than by a
+      // prototype method: dispatched live, an `Array.prototype.indexOf` replaced after load reports
+      // the purpose present on ANY certificate, and a cert an attacker put in the response's own
+      // certs bag is accepted as the authorized responder.
+      if (!eku || !_asserts(eku.value, OID_OCSP_SIGNING)) continue;
       // A delegate asserting keyUsage MUST permit digitalSignature; an absent keyUsage is
       // unrestricted, an unreadable one is not authoritative.
       var ku;

package/lib/path-validate.js

@@ -48,6 +48,7 @@ var cmpVerify = require("./cmp-verify");
 var cmsVerify = require("./cms-verify");
 var cmpSession = require("./cmp-session");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
 var constants = require("./constants");
 var validator = require("./validator-all");
 var cms = require("./schema-cms");
@@ -67,6 +68,20 @@ function pathCode(e, fallback) {
   return (e && typeof e.code === "string" && e.code.indexOf("path/") === 0) ? e.code : fallback;
 }
 
+// Membership decided by comparison rather than by a prototype method, through the shared guard.
+// Every use below is a RULE: whether a certificate's extended key usages cover the ones the caller
+// required, whether a policy is already expected at a node, whether anyPolicy is in the user's
+// initial set. See guard-list for what a replaced Array.prototype.indexOf did to this validator.
+var contains = guard.list.contains;
+var containsAll = guard.list.containsAll;
+// RFC 5280 6.1.4(a): a policyMappings extension MUST NOT map to or from anyPolicy. The scan for a
+// violating pair is the rule, so it routes through the guard for the same reason.
+function mapsAnyPolicy(mappings) {
+  return guard.list.anyMatches(mappings, function (m) {
+    return !!m && (m.issuerDomainPolicy === OID.anyPolicy || m.subjectDomainPolicy === OID.anyPolicy);
+  });
+}
+
 var NS = pkix.makeNS("path", PathError, oid);
 var EXT_DECODERS = pkix.certExtensionDecoders(NS).byOid;
 
@@ -828,7 +843,7 @@ function processPolicies(state, cert, i, checks) {
       if (p.policyIdentifier === OID.anyPolicy) { anyPolicyPresent = true; anyPolicyQualifiers = p.qualifiersBytes; return; }
       var matched = false;
       leavesAt(state.validPolicyTree, depth).forEach(function (node) {
-        if (node.expectedPolicySet.indexOf(p.policyIdentifier) !== -1) {
+        if (contains(node.expectedPolicySet, p.policyIdentifier)) {
           addChild(state, node, p.policyIdentifier, p.qualifiersBytes, [p.policyIdentifier], checks);
           matched = true;
         }
@@ -849,7 +864,7 @@ function processPolicies(state, cert, i, checks) {
       // certificate's own anyPolicy entry ("set the qualifier_set to AP-Q").
       leavesAt(state.validPolicyTree, depth).forEach(function (node) {
         node.expectedPolicySet.forEach(function (ep) {
-          var already = node.children.some(function (ch) { return ch.validPolicy === ep; });
+          var already = guard.list.anyMatches(node.children, function (ch) { return ch.validPolicy === ep; });
           if (!already) addChild(state, node, ep, anyPolicyQualifiers, [ep], checks);
         });
       });
@@ -929,8 +944,7 @@ function ekuPurposeFails(cert, requiredEku, checks) {
   catch (e) { checks.push({ name: "extendedKeyUsage", ok: false, code: pathCode(e, "path/bad-extension-value") }); return true; }
   if (!eku) return false;   // absent EKU: unrestricted (4.2.1.12 restricts only when present)
   var purposes = eku.value;
-  var ok = purposes.indexOf(OID.anyExtendedKeyUsage) !== -1 ||
-    requiredEku.every(function (p) { return purposes.indexOf(p) !== -1; });
+  var ok = contains(purposes, OID.anyExtendedKeyUsage) || containsAll(purposes, requiredEku);
   checks.push({ name: "extendedKeyUsage", ok: ok, code: ok ? undefined : "path/eku-not-permitted" });
   return !ok;
 }
@@ -950,7 +964,10 @@ function prepareNext(state, cert, i, checks) {
   try { pm = decodeExt(cert, OID.policyMappings); }
   catch (e) { checks.push({ name: "policyMappings", ok: false, code: "path/bad-policy" }); return { fatal: true, error: e }; }
   if (pm) {
-    var badAny = pm.value.some(function (m) { return m.issuerDomainPolicy === OID.anyPolicy || m.subjectDomainPolicy === OID.anyPolicy; });
+    // The scan for a forbidden anyPolicy mapping is the rule itself (RFC 5280 6.1.4(a)), so it is a
+    // loop rather than a `some`: one answering false makes the forbidden mapping invisible and the
+    // certificate is accepted carrying it.
+    var badAny = mapsAnyPolicy(pm.value);
     if (badAny) { checks.push({ name: "policyMappings", ok: false, code: "path/bad-policy" }); return { fatal: true, error: E("path/bad-policy", "policyMappings must not map to or from anyPolicy (RFC 5280 6.1.4(a))") }; }
     if (state.validPolicyTree) applyPolicyMappings(state, pm.value, i);
   }
@@ -1084,12 +1101,16 @@ var TARGET_UNPROCESSED_IF_CRITICAL = {};
 TARGET_UNPROCESSED_IF_CRITICAL[OID.policyMappings] = true;
 Object.freeze(TARGET_UNPROCESSED_IF_CRITICAL);
 
+// Membership is asked of the table's OWN properties. Freezing the table stops a write to it and
+// stops nothing about the prototype chain: a name planted on Object.prototype answers for every OID
+// the table does not carry, and read live this reported an unrecognized critical extension as
+// processed. On a CA certificate only the first table is consulted, so the chain was accepted.
 function unrecognizedCriticalExtension(cert, isTarget) {
   for (var i = 0; i < cert.extensions.length; i++) {
     var ext = cert.extensions[i];
     if (!ext.critical) continue;
-    if (!PROCESSED_EXTENSIONS[ext.oid]) return ext.oid;
-    if (isTarget && TARGET_UNPROCESSED_IF_CRITICAL[ext.oid]) return ext.oid;
+    if (!intrinsic.hasOwn(PROCESSED_EXTENSIONS, ext.oid)) return ext.oid;
+    if (isTarget && intrinsic.hasOwn(TARGET_UNPROCESSED_IF_CRITICAL, ext.oid)) return ext.oid;
   }
   return null;
 }
@@ -1222,7 +1243,7 @@ async function validate(path, opts) {
   // as a SUBSTRING match -- validated to an array of strings instead.
   if (opts.userInitialPolicySet !== undefined) {
     var uipsOk = Array.isArray(opts.userInitialPolicySet) && opts.userInitialPolicySet.length > 0 &&
-      opts.userInitialPolicySet.every(function (p) { return typeof p === "string" && p.length > 0; });
+      guard.list.allMatch(opts.userInitialPolicySet, function (p) { return typeof p === "string" && p.length > 0; });
     if (!uipsOk) throw E("path/bad-input", "validate: opts.userInitialPolicySet must be a non-empty array of policy OID strings");
     // Each entry is compared (indexOf) against canonical decoder output, so a
     // non-canonical key would silently never match -- fail the typo closed here.
@@ -1427,7 +1448,7 @@ async function validate(path, opts) {
       var lpm;
       try { lpm = decodeExt(cert, OID.policyMappings); }
       catch (_e) { lpm = null; checks.push({ name: "policyMappings", ok: false, code: "path/bad-policy" }); failed = true; }
-      if (lpm && lpm.value.some(function (m) { return m.issuerDomainPolicy === OID.anyPolicy || m.subjectDomainPolicy === OID.anyPolicy; })) {
+      if (lpm && mapsAnyPolicy(lpm.value)) {
         checks.push({ name: "policyMappings", ok: false, code: "path/bad-policy" }); failed = true;
       }
       // 4.2.1.10 / 4.2.1.14: nameConstraints and inhibitAnyPolicy MUST be
@@ -1470,7 +1491,9 @@ async function validate(path, opts) {
       }
       if (checkPurpose && ta.purposes) {
         anchorPurposeApplied = true;
-        if (ta.purposes[checkPurpose] !== true) {
+        // The map is the operator's RESTRICTION, so it is asked for its own entry: an inherited
+        // `true` would grant the purpose on every anchor whose map does not name it.
+        if (!intrinsic.hasOwn(ta.purposes, checkPurpose) || ta.purposes[checkPurpose] !== true) {
           checks.push({ name: "purposeTrust", ok: false, code: "path/purpose-not-trusted" }); failed = true;
         }
       }
@@ -1502,7 +1525,7 @@ async function validate(path, opts) {
   var policyOk = state.explicitPolicy > 0 || ucps.length > 0;
   if (!policyOk) {
     var last = state.results[state.results.length - 1];
-    if (!last.checks.some(function (c) { return c.code === "path/policy-required"; })) {
+    if (!guard.list.anyMatches(last.checks, function (c) { return c.code === "path/policy-required"; })) {
       last.checks.push({ name: "policy", ok: false, code: "path/policy-required" });
     }
     failed = true;
@@ -1539,7 +1562,7 @@ async function validate(path, opts) {
 function userConstrainedPolicies(state, n) {
   if (!state.validPolicyTree) return [];
   var uips = state.userInitialPolicySet;
-  var anyUser = uips.indexOf(OID.anyPolicy) !== -1;
+  var anyUser = contains(uips, OID.anyPolicy);
   var leaves = leavesAt(state.validPolicyTree, n);
   var explicit = {}, hasAnyLeaf = false;
   leaves.forEach(function (node) {
@@ -1547,7 +1570,7 @@ function userConstrainedPolicies(state, n) {
     else explicit[node.validPolicy] = true;
   });
   var set = {};
-  Object.keys(explicit).forEach(function (p) { if (anyUser || uips.indexOf(p) !== -1) set[p] = true; });
+  Object.keys(explicit).forEach(function (p) { if (anyUser || contains(uips, p)) set[p] = true; });
   // 6.1.5(g) step 3: a depth-n anyPolicy node under a restrictive user set
   // expands to each user policy (the intersection of anyPolicy with the user
   // set is the user set itself).
@@ -2193,7 +2216,7 @@ function crlChecker(crls, opts) {
       // nothing can never erase a revocation the checker would otherwise report.
       for (var dj = 0; dj < classified.deltas.length; dj++) {
         var dRec = classified.deltas[dj];
-        if (consumedDeltas.indexOf(dRec) !== -1) continue;
+        if (contains(consumedDeltas, dRec)) continue;
         // A delta that was MERGEABLE with some complete CRL but lost the sec. 5.2.4 @3580 selection
         // does not speak for its scope at all -- the selected delta does, and it was evaluated
         // against the base. Letting a superseded delta contribute its revocation while ignoring its
@@ -2365,7 +2388,7 @@ function ocspChecker(responses) {
       // certificate's own subject encoding -- sec. 7.1-equal but not byte-identical).
       var issuerNameCandidates = [cert.issuer.bytes];
       function addNameCandidate(nm) {
-        if (nm && nm.bytes && !issuerNameCandidates.some(function (e) { return e.equals(nm.bytes); })) issuerNameCandidates.push(nm.bytes);
+        if (nm && nm.bytes && !guard.list.anyMatches(issuerNameCandidates, function (e) { return e.equals(nm.bytes); })) issuerNameCandidates.push(nm.bytes);
       }
       if (issuer.issuerCert) addNameCandidate(issuer.issuerCert.subject);
       addNameCandidate(issuer.workingIssuerName);
@@ -2525,7 +2548,7 @@ function _verifyOcspParsed(parsedResponse, cert, issuerCert, time, opts) {
     if (!sig.ok) return unbound("the target certificate's signature does not verify under the supplied issuer certificate's key");
     var issuerCtx = { workingPublicKey: issuerCert.subjectPublicKeyInfo.bytes, workingIssuerName: issuerCert.subject, issuerCert: issuerCert };
     var issuerNameCandidates = [cert.issuer.bytes];
-    function add(nm) { if (nm && nm.bytes && !issuerNameCandidates.some(function (e) { return e.equals(nm.bytes); })) issuerNameCandidates.push(nm.bytes); }
+    function add(nm) { if (nm && nm.bytes && !guard.list.anyMatches(issuerNameCandidates, function (e) { return e.equals(nm.bytes); })) issuerNameCandidates.push(nm.bytes); }
     add(issuerCert.subject);
     var issuerKeyBits;
     try { issuerKeyBits = ocspVerify.ocspKeyValue(issuerCert.subjectPublicKeyInfo.bytes); }
@@ -2604,14 +2627,15 @@ function coerceCert(input, label) {
 // inert without one. An EMPTY map states no constraint and is not a reason to refuse.
 function _hasPurposeScopedMetadata(ta) {
   if (!ta || typeof ta !== "object") return false;
-  return ["distrustAfter", "purposes"].some(function (k) {
+  return guard.list.anyMatches(["distrustAfter", "purposes"], function (k) {
     var m = ta[k];
     return !!m && typeof m === "object" && Object.keys(m).length > 0;
   });
 }
 
 function assertAnchorConstraints(ta, checkPurpose) {
-  var d = (checkPurpose && ta && ta.distrustAfter) ? ta.distrustAfter[checkPurpose] : null;
+  var d = (checkPurpose && ta && ta.distrustAfter && intrinsic.hasOwn(ta.distrustAfter, checkPurpose))
+    ? ta.distrustAfter[checkPurpose] : null;
   if (d == null) return null;
   return guard.time.assertValid(d, E, "path/bad-input", "trustAnchor.distrustAfter." + checkPurpose);
 }
@@ -2728,9 +2752,12 @@ function _pushCandidates(frame, scored, stack, counter) {
     counter.tick();          // breadth / total-work cap -> throws path/build-limit
     n += 1;
     var cand = scored[ci].cand, candKey = identityKey(cand);
-    if (frame.keys.has(candKey)) continue;   // the (subject, SAN, key) tuple is already on this branch -> a loop, prune
+    // Loop detection and the dedupe sets below are resource bounds, so they are asked through the
+    // captured methods: a replaced `Set.prototype.has` answering false never prunes and the build
+    // walks a cycle until a cap stops it.
+    if (intrinsic.setHas(frame.keys, candKey)) continue;
     var childKeys = new Set(frame.keys);
-    childKeys.add(candKey);
+    intrinsic.setAdd(childKeys, candKey);
     stack.push({ chain: [cand].concat(frame.chain), hop: frame.hop + 1, keys: childKeys });
   }
   return n;
@@ -2821,16 +2848,16 @@ async function _fetchAiaIssuers(current, aia) {
     // IP literals only (already validated above), never a hostname whose resolved address we cannot verify.
     if (net.isIP(u.hostname.replace(/^\[(.*)\]$/, "$1")) === 0 && !aia.transportGuardsAddresses) continue;
     u.hash = "";                                          // the fragment is never sent on the wire -> not part of the request/dedupe identity
-    if (aia.fetchedUrls.has(u.href) || seenThisCert.has(u.href)) continue;   // dedupe (build-wide OR same-cert) on the normalized URL
+    if (intrinsic.setHas(aia.fetchedUrls, u.href) || intrinsic.setHas(seenThisCert, u.href)) continue;   // dedupe (build-wide OR same-cert) on the normalized URL
     if (seenThisCert.size >= aia.maxPerCert) break;       // per-cert DISTINCT-url cap, checked BEFORE appending so maxAiaPerCert:0 collects nothing (no fetch at all)
-    seenThisCert.add(u.href);
+    intrinsic.setAdd(seenThisCert, u.href);
     uris.push(u.href);
   }
   var out = [];
   for (var k = 0; k < uris.length; k++) {
-    if (aia.fetchedUrls.has(uris[k])) continue;   // a same-cert normalization-equal duplicate
+    if (intrinsic.setHas(aia.fetchedUrls, uris[k])) continue;   // a same-cert normalization-equal duplicate
     if (aia.fetches >= aia.maxFetches) break;     // total budget reached -> STOP fetching (a SILENT cap, never a throw that denies a buildable path)
-    aia.fetchedUrls.add(uris[k]);                 // mark BEFORE the fetch -> fetched at most once, even on failure
+    intrinsic.setAdd(aia.fetchedUrls, uris[k]);   // mark BEFORE the fetch -> fetched at most once, even on failure
     aia.fetches += 1;
     var certs;
     try { certs = await _aiaFetchOne(uris[k], aia); }
@@ -2958,7 +2985,7 @@ async function build(leaf, opts) {
   // repeating CMS returning the same issuer) is appended AT MOST ONCE -- it otherwise inflates the pool, charging
   // the candidate budget and the ceiling for each copy before the issuer is ever evaluated.
   var poolDerKeys = new Set();
-  for (var pdk = 0; pdk < pool.length; pdk++) poolDerKeys.add(certDerKey(pool[pdk]));
+  for (var pdk = 0; pdk < pool.length; pdk++) intrinsic.setAdd(poolDerKeys, certDerKey(pool[pdk]));
 
   if (!Array.isArray(opts.trustAnchors) || opts.trustAnchors.length === 0) throw E("path/bad-input", "build: opts.trustAnchors must be a non-empty array of anchor tuples or root certificates");
   var anchors = opts.trustAnchors.map(toAnchor);
@@ -3120,8 +3147,8 @@ async function build(leaf, opts) {
         var fetched = await _fetchAiaIssuers(fbCur, aiaCtx);   // append newly-fetched issuer(s) to the SHARED pool
         for (var fj = 0; fj < fetched.length; fj++) {
           var fdk = certDerKey(fetched[fj]);
-          if (poolDerKeys.has(fdk)) continue;                  // a byte-duplicate (mirror URL / repeating CMS) -> add once, never re-charge the budget/ceiling
-          poolDerKeys.add(fdk);
+          if (intrinsic.setHas(poolDerKeys, fdk)) continue;   // a byte-duplicate (mirror URL / repeating CMS) -> add once, never re-charge the budget/ceiling
+          intrinsic.setAdd(poolDerKeys, fdk);
           if (pool.length < poolCeiling) pool.push(fetched[fj]);
         }
       }

package/lib/pkcs12-build.js

@@ -48,6 +48,7 @@ var cmsDecrypt = require("./cms-decrypt");   // the @internal decryptEnvelopedDa
 var schemaPkcs12 = require("./schema-pkcs12");
 var pkix = require("./schema-pkix");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
 var frameworkError = require("./framework-error");
 var C = require("./constants");
 
@@ -368,7 +369,7 @@ function _buildBag(bag, opts, depth) {
   if (!bag || typeof bag !== "object") throw _err("pkcs12/bad-input", "each bag must be an object with a type");
   // Checked against THIS type's table. An unrecognized type falls through to the switch below,
   // which is the one place that names the permitted set.
-  if (guard.intrinsic.hasOwn(_BAG_KEYS_BY_TYPE, bag.type)) {
+  if (intrinsic.hasOwn(_BAG_KEYS_BY_TYPE, bag.type)) {
     guard.identifier.assertKnownKeys(bag, _BAG_KEYS_BY_TYPE[bag.type], _err, "pkcs12/bad-input", function (k) {
       return "unknown field " + JSON.stringify(k) + " on a " + JSON.stringify(bag.type) +
         " bag; that field is not read for this bag type";
@@ -588,7 +589,7 @@ async function _buildMacData(macOpts, sharedPassword, authSafeDer) {
 function _specForm(spec) {
   var isObject = !!spec && typeof spec === "object" && !Buffer.isBuffer(spec);
   var safeContents = isObject ? spec.safeContents : null;
-  var full = guard.intrinsic.isArray(safeContents);
+  var full = intrinsic.isArray(safeContents);
   return { isObject: isObject, full: full, safeContents: full ? safeContents : null };
 }
 
@@ -599,7 +600,7 @@ function _normalizeSpec(spec, opts, form) {
     // be handed different values.
     var recipientCerts = opts.recipientCerts;
     var enveloped = recipientCerts != null;
-    if (enveloped && (!guard.intrinsic.isArray(recipientCerts) || !recipientCerts.length)) throw _err("pkcs12/bad-input", "opts.recipientCerts must be a non-empty array of recipient certificates");
+    if (enveloped && (!intrinsic.isArray(recipientCerts) || !recipientCerts.length)) throw _err("pkcs12/bad-input", "opts.recipientCerts must be a non-empty array of recipient certificates");
     var certBags = [];
     if (spec.cert != null) certBags.push({ type: "cert", cert: spec.cert, friendlyName: spec.friendlyName, localKeyId: spec.localKeyId });
     if (spec.ca != null && !Array.isArray(spec.ca)) throw _err("pkcs12/bad-input", "spec.ca must be an array of certificates");
@@ -749,7 +750,7 @@ async function _build(spec, opts) {
     // array reached _buildMacData as an empty descriptor and produced the DEFAULT MAC. Excluded by
     // the same test opts.integrity already applies, read through the load-time capture so a
     // replaced Array.isArray cannot reopen it.
-    if (opts.mac != null && opts.mac !== false && (typeof opts.mac !== "object" || guard.intrinsic.isArray(opts.mac))) throw _err("pkcs12/bad-input", "opts.mac must be false or a { algorithm, hash, salt, iterations, keyLength } object");
+    if (opts.mac != null && opts.mac !== false && (typeof opts.mac !== "object" || intrinsic.isArray(opts.mac))) throw _err("pkcs12/bad-input", "opts.mac must be false or a { algorithm, hash, salt, iterations, keyLength } object");
     if (opts.mac != null && opts.mac !== false) {
       // The algorithm selects the derivation, so the table that runs is the one belonging to it.
       // An unrecognized spelling keeps the union; _buildMacData refuses it by name a moment later.

package/lib/sign-scheme.js

@@ -23,10 +23,28 @@ var webcrypto = require("./webcrypto");
 var subtle = webcrypto.webcrypto.subtle;
 var validator = require("./validator-all");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
 var compositeSig = require("./composite-sig");
 var b = asn1.build;
 function O(name) { return oid.byName(name); }
 
+// Captured at load. This module decides which algorithm a signature runs under and whether the
+// caller's key matches the certificate it claims, so an operation read at call time is one the
+// caller answers: a replaced case fold reports two different algorithm names equal, and a replaced
+// `Buffer.isBuffer` admits a key that is not bytes.
+var _BigInt = intrinsic.BigInt;
+var _String = intrinsic.String;
+var _filter = intrinsic.filter;
+var _stringify = intrinsic.stringify;
+var _toUpperCase = intrinsic.toUpperCase;
+var _isBuffer = intrinsic.isBuffer;
+var _bufferFrom = intrinsic.bufferFrom;
+// Asks the value's internal slot rather than `instanceof`, which reads the `Uint8Array` global at
+// call time and answers about whichever constructor is bound then. It also settles the two cases
+// `instanceof` gets wrong on their own terms: a real typed array from another realm is one, and an
+// object merely built on the prototype is not.
+var _isU8 = intrinsic.types.isUint8Array;
+
 var HASH = { sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" };
 var NODE_DIGEST = { sha256: "sha256", sha384: "sha384", sha512: "sha512", shake128: "shake128", shake256: "shake256" };
 var PSS_SALT = { "SHA-256": 32, "SHA-384": 48, "SHA-512": 64 };
@@ -52,6 +70,20 @@ var MLDSA_SUITABLE_DIGEST = {
   "ML-DSA-65": { sha384: 1, sha512: 1, shake256: 1 },
   "ML-DSA-87": { sha512: 1, shake256: 1 },
 };
+// mldsaDigestSuitable(mlName, md) -- is `md` listed as meeting `mlName`'s security strength?
+// Both levels are asked for their OWN entries. The gate rejects on a falsy lookup, so a digest name
+// planted on Object.prototype answers for every name the row omits and a below-strength digest
+// passes the RFC 9882 sec. 3.3 check. This is the single home for that question: the signer and the
+// verifier both ask it, and a copy at either would let the two drift.
+// @enforced-by behavioral -- an own-property table read has no rename-proof shape distinct from a
+//   legitimate one; the RED vectors (a below-strength digest still refused with its name planted on
+//   Object.prototype, on both the sign and verify paths) are the guard.
+function mldsaDigestSuitable(mlName, md) {
+  if (!intrinsic.hasOwn(MLDSA_SUITABLE_DIGEST, mlName)) return false;
+  var row = MLDSA_SUITABLE_DIGEST[mlName];
+  return !!row && intrinsic.hasOwn(row, md) && !!row[md];
+}
+
 var SLHDSA_BY_OID = {};
 [["sha2-128s", "sha256"], ["sha2-128f", "sha256"], ["sha2-192s", "sha512"], ["sha2-192f", "sha512"],
  ["sha2-256s", "sha512"], ["sha2-256f", "sha512"], ["shake-128s", "shake128"], ["shake-128f", "shake128"],
@@ -65,7 +97,7 @@ function _algId(name, shape) { return shape === "null" ? b.sequence([b.oid(O(nam
 function _pssAlgId(digestName) {
   var hashAlg = b.sequence([b.oid(O(digestName)), b.nullValue()]);
   var mgf = b.sequence([b.oid(O("mgf1")), hashAlg]);
-  var params = b.sequence([b.explicit(0, hashAlg), b.explicit(1, mgf), b.explicit(2, b.integer(BigInt(PSS_SALT[HASH[digestName]])))]);
+  var params = b.sequence([b.explicit(0, hashAlg), b.explicit(1, mgf), b.explicit(2, b.integer(_BigInt(PSS_SALT[HASH[digestName]])))]);
   return b.sequence([b.oid(O("rsassaPss")), params]);
 }
 // The hash an id-RSASSA-PSS SPKI restricts its key to, or null when it restricts none.
@@ -90,7 +122,7 @@ function _pssHashFromSpki(cert, E) {
   if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children) {
     throw E("unsupported-algorithm", "the id-RSASSA-PSS key parameters are not an RSASSA-PSS-params SEQUENCE (RFC 4055 sec. 3.1)");
   }
-  var hashField = node.children.filter(function (c) { return c.tagClass === "context" && c.tagNumber === 0; })[0];
+  var hashField = _filter(node.children, function (c) { return c.tagClass === "context" && c.tagNumber === 0; })[0];
   // DEFAULT sha1Identifier -- an omitted hashAlgorithm names SHA-1, which this toolkit does not
   // sign or verify with, so it is reported as the pin it is and refused by the caller's own table.
   if (!hashField) return "sha1";
@@ -136,15 +168,15 @@ function resolveSignScheme(cert, so, noSignedAttrs, E) {
   var comp = compositeSig.COMPOSITE_ALGS[keyOid];
   if (comp) {
     if (comp.trad.unsupported) throw E("unsupported-algorithm", "composite " + comp.name + ": " + comp.trad.unsupported);
-    if (so.digestAlgorithm && so.digestAlgorithm !== comp.phCms) throw E("bad-input", "composite " + comp.name + " fixes the digestAlgorithm to " + comp.phCms + " (draft-ietf-lamps-cms-composite-sigs sec. 3.4); " + JSON.stringify(so.digestAlgorithm) + " conflicts");
+    if (so.digestAlgorithm && so.digestAlgorithm !== comp.phCms) throw E("bad-input", "composite " + comp.name + " fixes the digestAlgorithm to " + comp.phCms + " (draft-ietf-lamps-cms-composite-sigs sec. 3.4); " + _stringify(so.digestAlgorithm) + " conflicts");
     return { composite: comp, digest: comp.phCms, digestAlgId: _algId(comp.phCms, "absent"), sigAlgId: _algId(comp.name, "absent") };
   }
   if (keyOid === O("rsaEncryption") || keyOid === O("rsassaPss")) {
     var isPssKey = keyOid === O("rsassaPss");
     var pinned = isPssKey ? _pssHashFromSpki(cert, E) : null;
-    if (pinned && so.digestAlgorithm && so.digestAlgorithm !== pinned) throw E("bad-input", "the signer key restricts the RSASSA-PSS digest to " + pinned + ", but digestAlgorithm " + JSON.stringify(so.digestAlgorithm) + " was requested");
+    if (pinned && so.digestAlgorithm && so.digestAlgorithm !== pinned) throw E("bad-input", "the signer key restricts the RSASSA-PSS digest to " + pinned + ", but digestAlgorithm " + _stringify(so.digestAlgorithm) + " was requested");
     var d = so.digestAlgorithm || pinned || "sha256";
-    if (!HASH[d]) throw E("unsupported-algorithm", "unsupported RSA digest algorithm " + JSON.stringify(d));
+    if (!HASH[d]) throw E("unsupported-algorithm", "unsupported RSA digest algorithm " + _stringify(d));
     if (so.pss || isPssKey) return { digest: d, digestAlgId: _algId(d, "absent"), sigAlgId: _pssAlgId(d), imp: { name: "RSA-PSS", hash: HASH[d] }, sign: { name: "RSA-PSS", saltLength: PSS_SALT[HASH[d]] }, ecdsaDer: false };
     var rsaSigAlgId = so.combinedRsaSig ? _algId(RSA_PKCS1_SIG[d], "null") : _algId("rsaEncryption", "null");
     return { digest: d, digestAlgId: _algId(d, "absent"), sigAlgId: rsaSigAlgId, imp: { name: "RSASSA-PKCS1-v1_5", hash: HASH[d] }, sign: { name: "RSASSA-PKCS1-v1_5" }, ecdsaDer: false };
@@ -156,13 +188,13 @@ function resolveSignScheme(cert, so, noSignedAttrs, E) {
     var ec = EC_BY_CURVE_OID[curveOid];
     if (!ec) throw E("unsupported-algorithm", "the signer key is on an unsupported EC curve");
     var de = so.digestAlgorithm || "sha256";
-    if (!HASH[de]) throw E("unsupported-algorithm", "unsupported ECDSA digest algorithm " + JSON.stringify(de));
+    if (!HASH[de]) throw E("unsupported-algorithm", "unsupported ECDSA digest algorithm " + _stringify(de));
     return { digest: de, digestAlgId: _algId(de, "absent"), sigAlgId: _algId(ECDSA_ALG[de], "absent"), imp: { name: "ECDSA", namedCurve: ec.curve }, sign: { name: "ECDSA", hash: HASH[de] }, ecdsaDer: true, coordLen: ec.coordLen };
   }
   if (keyOid === O("Ed25519") || keyOid === O("Ed448")) {
     var name = keyOid === O("Ed25519") ? "Ed25519" : "Ed448";
     var dd = so.digestAlgorithm || (name === "Ed25519" ? "sha512" : "shake256");
-    if (!NODE_DIGEST[dd]) throw E("unsupported-algorithm", "unsupported " + name + " digest algorithm " + JSON.stringify(dd));
+    if (!NODE_DIGEST[dd]) throw E("unsupported-algorithm", "unsupported " + name + " digest algorithm " + _stringify(dd));
     return { digest: dd, digestAlgId: _algId(dd, "absent"), sigAlgId: _algId(name, "absent"), imp: { name: name }, sign: { name: name }, ecdsaDer: false };
   }
   if (MLDSA_BY_OID[keyOid]) {
@@ -172,14 +204,14 @@ function resolveSignScheme(cert, so, noSignedAttrs, E) {
       md = "sha512";
     } else {
       md = so.digestAlgorithm || "sha512";
-      if (!NODE_DIGEST[md]) throw E("unsupported-algorithm", "unsupported ML-DSA message digest " + JSON.stringify(md));
-      if (!MLDSA_SUITABLE_DIGEST[mlName][md]) throw E("unsupported-algorithm", "the " + md + " message digest is below the security strength of " + mlName + " (RFC 9882 sec. 3.3)");
+      if (!NODE_DIGEST[md]) throw E("unsupported-algorithm", "unsupported ML-DSA message digest " + _stringify(md));
+      if (!mldsaDigestSuitable(mlName, md)) throw E("unsupported-algorithm", "the " + md + " message digest is below the security strength of " + mlName + " (RFC 9882 sec. 3.3)");
     }
     return { digest: md, digestAlgId: _algId(md, "absent"), sigAlgId: _algId(oid.name(keyOid), "absent"), imp: { name: mlName }, sign: { name: mlName }, ecdsaDer: false };
   }
   if (SLHDSA_BY_OID[keyOid]) {
     var slh = SLHDSA_BY_OID[keyOid];
-    if (so.digestAlgorithm && so.digestAlgorithm !== slh.digest) throw E("bad-input", "SLH-DSA " + slh.wc + " requires the " + slh.digest + " message digest (RFC 9814 sec. 4); digestAlgorithm " + JSON.stringify(so.digestAlgorithm) + " conflicts");
+    if (so.digestAlgorithm && so.digestAlgorithm !== slh.digest) throw E("bad-input", "SLH-DSA " + slh.wc + " requires the " + slh.digest + " message digest (RFC 9814 sec. 4); digestAlgorithm " + _stringify(so.digestAlgorithm) + " conflicts");
     return { digest: slh.digest, digestAlgId: _algId(slh.digest, "absent"), sigAlgId: _algId(oid.name(keyOid), "absent"), imp: { name: slh.wc }, sign: { name: slh.wc }, ecdsaDer: false };
   }
   throw E("unsupported-algorithm", "unsupported signer key algorithm " + keyOid);
@@ -190,7 +222,7 @@ function _assertKeyMatchesScheme(key, imp, E) {
   var ka = key.algorithm || {};
   // WebCrypto algorithm names are ASCII-case-insensitive (RSASSA-PKCS1-v1_5 and RSASSA-PKCS1-V1_5 are one
   // algorithm), so compare case-folded; a genuine mismatch (e.g. RSASSA-PKCS1-v1_5 vs ECDSA) still fails.
-  if (String(ka.name).toUpperCase() !== String(imp.name).toUpperCase()) throw E("bad-input", "the signer CryptoKey algorithm (" + ka.name + ") does not match the certificate's key algorithm (" + imp.name + ")");
+  if (_toUpperCase(_String(ka.name)) !== _toUpperCase(_String(imp.name))) throw E("bad-input", "the signer CryptoKey algorithm (" + ka.name + ") does not match the certificate's key algorithm (" + imp.name + ")");
   if (imp.hash && (!ka.hash || ka.hash.name !== imp.hash)) throw E("bad-input", "the signer CryptoKey hash (" + (ka.hash && ka.hash.name) + ") does not match the signing digest (" + imp.hash + ")");
   if (imp.namedCurve && ka.namedCurve !== imp.namedCurve) throw E("bad-input", "the signer CryptoKey curve (" + ka.namedCurve + ") does not match the certificate curve (" + imp.namedCurve + ")");
 }
@@ -198,19 +230,19 @@ function _normPkcs8(k, label, E) {
   // A caller's own Buffer is borrowed, not copied, the same rule _importKey states below. Every
   // other form is copied, and neither copy is duplicated further, so a private key never gains a
   // plaintext duplicate this module cannot account for.
-  if (Buffer.isBuffer(k)) return guard.bytes.view(k, E, "bad-input", label);
-  if (k instanceof Uint8Array) return guard.bytes.snapshot(k, E, "bad-input", label);
+  if (_isBuffer(k)) return guard.bytes.view(k, E, "bad-input", label);
+  if (_isU8(k)) return guard.bytes.snapshot(k, E, "bad-input", label);
   if (typeof k === "string") { try { return pkcs8.pemDecode(k); } catch (e) { throw E("bad-input", label + " PEM could not be decoded", e); } }
   throw E("bad-input", label + " must be a PKCS#8 DER Buffer, Uint8Array, or PEM string");
 }
 function _normCompositeKeys(key, comp, E) {
-  if (!key || typeof key !== "object" || Buffer.isBuffer(key) || key instanceof Uint8Array || key.mldsa == null || key.trad == null) {
+  if (!key || typeof key !== "object" || _isBuffer(key) || _isU8(key) || key.mldsa == null || key.trad == null) {
     throw E("bad-input", "a composite " + comp.name + " signer key must be { mldsa: <PKCS#8>, trad: <PKCS#8> }");
   }
   return { mldsa: _normPkcs8(key.mldsa, "the composite ML-DSA component key", E), trad: _normPkcs8(key.trad, "the composite traditional component key", E) };
 }
 function _importKey(key, imp, E) {
-  if (key && typeof key === "object" && !Buffer.isBuffer(key) && !(key instanceof Uint8Array) && key.type === "private") {
+  if (key && typeof key === "object" && !_isBuffer(key) && !(_isU8(key)) && key.type === "private") {
     _assertKeyMatchesScheme(key, imp, E);
     // `key` is documented as taking a CryptoKey, so one created outside this engine signs here too --
     // it is re-imported through this engine, because it carries none of the key material this engine
@@ -222,8 +254,8 @@ function _importKey(key, imp, E) {
   // only thing that reads it. A caller's own Buffer is passed through untouched: they hold a live
   // reference and will use it again, so clearing it would destroy their key.
   var der, owned = false;
-  if (Buffer.isBuffer(key)) der = guard.bytes.view(key, E, "bad-input", "the signer private key");
-  else if (key instanceof Uint8Array) { der = guard.bytes.snapshot(key, E, "bad-input", "the signer private key"); owned = true; }
+  if (_isBuffer(key)) der = guard.bytes.view(key, E, "bad-input", "the signer private key");
+  else if (_isU8(key)) { der = guard.bytes.snapshot(key, E, "bad-input", "the signer private key"); owned = true; }
   else if (typeof key === "string") {
     try { der = pkcs8.pemDecode(key); }
     catch (e) { throw E("bad-input", "the signer PEM private key could not be decoded", e); }
@@ -246,11 +278,11 @@ function _importKey(key, imp, E) {
 // path signs both component keys and returns mldsaSig || tradSig (composite-sig.js owns it).
 function signOverTbs(scheme, key, signedBytes, E) {
   if (scheme.composite) {
-    return compositeSig.compositeSign(scheme.composite, _normCompositeKeys(key, scheme.composite, E), signedBytes).then(function (sig) { return Buffer.from(sig); });
+    return compositeSig.compositeSign(scheme.composite, _normCompositeKeys(key, scheme.composite, E), signedBytes).then(function (sig) { return _bufferFrom(sig); });
   }
   return _importKey(key, scheme.imp, E).then(function (priv) {
     return subtle.sign(scheme.sign, priv, signedBytes).then(function (sigRaw) {
-      var sig = Buffer.from(sigRaw);
+      var sig = _bufferFrom(sigRaw);
       if (scheme.ecdsaDer) sig = validator.sig.rawToEcdsaDer(sig, scheme.coordLen);
       return sig;
     });
@@ -266,5 +298,6 @@ module.exports = {
   pssSpkiPinnedHash: pssSpkiPinnedHash,
   signOverTbs: signOverTbs,
   MLDSA_SUITABLE_DIGEST: MLDSA_SUITABLE_DIGEST,
+  mldsaDigestSuitable: mldsaDigestSuitable,
   SLHDSA_BY_OID: SLHDSA_BY_OID,
 };

package/lib/tsp-sign.js

@@ -25,6 +25,7 @@ var pkiX509 = require("./schema-x509");
 var smime = require("./schema-smime");
 var schemaTsp = require("./schema-tsp");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
 var frameworkError = require("./framework-error");
 
 var pkix = require("./schema-pkix");
@@ -336,7 +337,7 @@ function request(messageImprint, opts) {
   if (opts.certReq != null && typeof opts.certReq !== "boolean") throw _err("tsp/bad-input", "certReq must be a boolean");
   if (opts.certReq === true) fields.push(b.boolean(true));
   if (opts.extensions != null) {
-    if (!Array.isArray(opts.extensions) || !opts.extensions.every(function (e) { return Buffer.isBuffer(e) || e instanceof Uint8Array; })) throw _err("tsp/bad-input", "extensions must be an array of encoded Extension DER buffers");
+    if (!Array.isArray(opts.extensions) || !guard.list.allMatch(opts.extensions, function (e) { return Buffer.isBuffer(e) || e instanceof Uint8Array; })) throw _err("tsp/bad-input", "extensions must be an array of encoded Extension DER buffers");
     // Each pre-encoded Extension is validated as one, and its extnID must not repeat -- the same
     // gate every other request builder applies. Spliced in unchecked, a caller relaying a blob it
     // did not author put fully chosen bytes inside [0] and this encoder emitted DER its own
@@ -507,7 +508,7 @@ var _BIND_DIGEST = { sha256: "sha256", sha384: "sha384", sha512: "sha512" };
 // tsp/* verdict code; a config-shape error throws (the caller's contract).
 function _imprintMatches(mi, data) {
   var name = mi.hashAlgorithm && mi.hashAlgorithm.name;
-  var nodeAlg = name && _VERIFY_DIGEST[name];
+  var nodeAlg = (name && intrinsic.hasOwn(_VERIFY_DIGEST, name)) ? _VERIFY_DIGEST[name] : null;
   if (!nodeAlg) return "tsp/unsupported-algorithm";   // cannot recompute -> never assume a match
   var wantLen = _VERIFY_DIGEST_LEN[name];
   // The token's messageImprint MUST be a full-length digest for its algorithm. A short/empty
@@ -732,6 +733,12 @@ function _buildTsaChains(leaf, pool) {
 // Every option pki.tsp.verify reads. Adding one here is the only way to make it accepted.
 var _VERIFY_OPTS = { certs: 1, trustAnchor: 1, nonce: 1, reqPolicy: 1, revocationChecker: 1 };
 
+// Does any extension carry the critical flag? The answer IS the unknown-critical-extension gate, so
+// it is decided by comparison instead of by a `some`. See guard-list.
+function _anyCritical(extensions) {
+  return guard.list.anyMatches(extensions, function (e) { return !!e && !!e.critical; });
+}
+
 async function verify(token, data, opts) {
   opts = opts || {};
   if (typeof opts !== "object" || Buffer.isBuffer(opts)) throw _err("tsp/bad-input", "pki.tsp.verify options must be an object");
@@ -742,7 +749,7 @@ async function verify(token, data, opts) {
   // nothing to notice it by. Naming the difference at the boundary is the only place it is cheap.
   guard.identifier.assertKnownKeys(opts, _VERIFY_OPTS, _err, "tsp/bad-input",
     "pki.tsp.verify has an unknown option (note the anchor option here is `trustAnchor`, singular, an anchor tuple -- not the `trustAnchors` certificate list pki.cms.verify takes) ");
-  if (opts.certs != null && (!Array.isArray(opts.certs) || !opts.certs.every(function (c) { return Buffer.isBuffer(c) || c instanceof Uint8Array; }))) {
+  if (opts.certs != null && (!Array.isArray(opts.certs) || !guard.list.allMatch(opts.certs, function (c) { return Buffer.isBuffer(c) || c instanceof Uint8Array; }))) {
     throw _err("tsp/bad-input", "pki.tsp.verify opts.certs must be an array of DER certificate Buffers");   // a bad element is a caller error, never silently dropped
   }
   var tokenDer = _tokenDer(token);   // DER Buffer / PEM -> DER; a non-token input throws tsp/bad-input
@@ -789,7 +796,9 @@ async function verify(token, data, opts) {
   // A TSTInfo carrying a CRITICAL extension the verifier cannot process is unusable: RFC 3161 sec.
   // 2.4.2 defers extension handling to RFC 5280 sec. 4.2, and defines no TSTInfo extension, so any
   // critical one is unrecognized (the unknown-critical-extension gate the cert path also applies).
-  if (tst.extensions && tst.extensions.some(function (e) { return e.critical; })) {
+  // The scan for a critical extension IS the gate, so it is a loop rather than a `some`: one
+  // answering false makes the unrecognized critical extension invisible and the token is accepted.
+  if (tst.extensions && _anyCritical(tst.extensions)) {
     return fail("tsp/unknown-critical-extension");
   }
   // M13 -- the ESSCertID(V2) binding: the verifying cert MUST be the one the signer identified.

package/lib/validator-attcert.js

@@ -29,6 +29,12 @@
 
 var oid = require("./oid");
 var asn1 = require("./asn1-der");
+var guard = require("./guard-all");
+
+// Does this extended-key-usage list assert the given purpose? The answer decides whether a
+// certificate qualifies as the kind the rule names, so it goes through the membership guard
+// instead of a prototype method. See guard-list.
+var _asserts = guard.list.contains;
 
 // requireV3(cert, E, code) -- the leaf attestation certificate MUST be X.509 v3.
 // @enforced-by behavioral -- a version-field check has no rename-proof code shape; the RED
@@ -73,7 +79,10 @@ function aikCert(cert, exts, E, code) {
   assertNotCa(cert, exts, E, code);
   if ((cert.subject.rdns || []).length !== 0) throw new E(code, "the tpm AIK certificate subject MUST be empty (WebAuthn 8.3.1)");
   var eku = exts.decode(cert, "extKeyUsage");
-  if (!eku || !Array.isArray(eku.value) || eku.value.indexOf(oid.byName("tcgKpAikCertificate")) === -1) {
+  // The purpose test IS the rule that makes this an AIK certificate, so it is decided by comparison
+  // rather than by a prototype method: a replaced `indexOf` reports the purpose present on any
+  // certificate and an ordinary leaf is accepted as a TPM attestation key.
+  if (!eku || !Array.isArray(eku.value) || !_asserts(eku.value, oid.byName("tcgKpAikCertificate"))) {
     throw new E(code, "the tpm AIK certificate lacks the tcg-kp-AIKCertificate extended key purpose (WebAuthn 8.3.1)");
   }
   var san = exts.decode(cert, "subjectAltName");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.5.19",
+  "version": "0.5.21",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:d0064cbc-a37c-4d4f-ae67-0b9ba6887de2",
+  "serialNumber": "urn:uuid:353e5368-910e-4a85-a222-14a2add84cee",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-20T21:35:06.293Z",
+    "timestamp": "2026-08-21T02:50:54.975Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.5.19",
+      "bom-ref": "@blamejs/pki@0.5.21",
       "type": "application",
       "name": "pki",
-      "version": "0.5.19",
+      "version": "0.5.21",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.5.19",
+      "purl": "pkg:npm/%40blamejs/pki@0.5.21",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.5.19",
+      "ref": "@blamejs/pki@0.5.21",
       "dependsOn": []
     }
   ]