@blamejs/pki 0.5.20 → 0.5.21

package/CHANGELOG.md

@@ -4,6 +4,26 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.5.21 — 2026-08-21
+
+The check that holds the crypto engine to load-time captures could be satisfied around, so nine modules had taken the safe primitive at one site and were never held to it anywhere else.
+
+### Added
+
+- `guard.intrinsic.bufferEquals`, the captured byte-identity comparison the bindings above are decided with.
+
+### Changed
+
+- Taking the captures has one spelling again. The guard orchestrator no longer re-exports them, so a module reaches them by importing the module that holds them, and the check reads that off the loaded module graph rather than off the text. This is the enforcement change: a module that adopts one safe primitive is held to the rule everywhere, and no way of writing the import, or of writing something that resembles one, changes the answer.
+- The seven modules the widened check surfaced carry a declared count of remaining reads rather than an exemption. A new live read pushes a module past its figure and fails, and converting reads without lowering the figure fails too, so the number keeps naming the real count. A module reaching zero leaves the list and is held to zero.
+
+### Fixed
+
+- An OCSP response is bound to the certificate it answers for with captured byte comparisons. The CertID says the response concerns this issuer and the responder ID says this key signed it, and both were decided by a `Buffer.prototype.equals` read at call time: replaced after load it reports every hash equal, and a `good` signed by a different CA answers for the certificate under check.
+- The signer's key is matched to its certificate under a captured case fold. WebCrypto algorithm names compare case-insensitively, so the check folds both sides; dispatched live, a replaced fold reported two different algorithm names equal and a key whose algorithm does not match the certificate passed the gate that exists to catch exactly that.
+- `pki.sign` decides the RSASSA-PSS parameters, the digest tables and its key-shape tests on captured operations, so a caller who replaces one after this package loads cannot change which algorithm a signature runs under.
+- A signing key is classified by asking the value what it is rather than by `instanceof` against a global. The old test read the `Uint8Array` binding at call time, and it answered wrongly in both directions on its own terms: a real typed array from another realm was not one, and an object built on the prototype was.
+
 ## v0.5.20 — 2026-08-20
 
 Five verdicts that turned on list membership now decide it by comparison, so replacing an array method after the module loads cannot change what a certificate, a responder or a signed message is found to be.

package/lib/cms-decrypt.js

@@ -23,6 +23,7 @@ var schemaCms = require("./schema-cms");
 var webcrypto = require("./webcrypto");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
 var pbes2 = require("./pbes2");
 var b = asn1.build;
 var subtle = webcrypto.webcrypto.subtle;
@@ -415,8 +416,8 @@ async function _kemriCek(ri, km) {
 // why, by name. An unresolvable OID is left to _openContent too, as the unsupported algorithm it is.
 function _assertContentCipherMode(eci, ct) {
   var oidStr = eci.contentEncryptionAlgorithm.oid;
-  var isAead = guard.intrinsic.hasOwn(AEAD_ALGS, oidStr);
-  if (!isAead && !guard.intrinsic.hasOwn(CONTENT_MODE, oidStr)) return;
+  var isAead = intrinsic.hasOwn(AEAD_ALGS, oidStr);
+  if (!isAead && !intrinsic.hasOwn(CONTENT_MODE, oidStr)) return;
   if (ct === "authEnvelopedData") {
     if (isAead) return;
     throw _err("cms/unsupported-algorithm", "contentEncryptionAlgorithm " + oidStr + " is not an authenticated encryption algorithm, which authEnvelopedData requires (RFC 5083 sec. 2)");
@@ -428,14 +429,14 @@ function _assertContentCipherMode(eci, ct) {
 // ---- stage 3: open the content (uniform failure) ---------------------------
 async function _openContent(parsed, eci, cek, ct) {
   var alg = eci.contentEncryptionAlgorithm;
-  var keyBits = guard.intrinsic.hasOwn(CONTENT_KEYBITS, alg.oid) ? CONTENT_KEYBITS[alg.oid] : 0;
+  var keyBits = intrinsic.hasOwn(CONTENT_KEYBITS, alg.oid) ? CONTENT_KEYBITS[alg.oid] : 0;
   if (!keyBits) {
     // AES-CCM parses completely here -- registered OIDs, the sec. 3.1 nonce bound, the seven legal
     // ICV lengths -- and is then declined, because AES-GCM is the only AEAD this toolkit implements
     // for content encryption. Saying only "unsupported <oid>" is what an operator also sees for an
     // OID nothing in the toolkit recognizes, and the two call for different things: one is a
     // capability gap to route around, the other is a malformed or exotic message.
-    if (guard.intrinsic.hasOwn(AEAD_ALGS, alg.oid) && AEAD_ALGS[alg.oid] === "ccm") {
+    if (intrinsic.hasOwn(AEAD_ALGS, alg.oid) && AEAD_ALGS[alg.oid] === "ccm") {
       throw _err("cms/unsupported-algorithm", "contentEncryptionAlgorithm " + alg.oid + " is AES-CCM. RFC 5084 sec. 3.1 permits it for this content type; this toolkit implements AES-GCM only for content encryption");
     }
     throw _err("cms/unsupported-algorithm", "unsupported contentEncryptionAlgorithm " + alg.oid);

package/lib/cms-encrypt.js

@@ -23,6 +23,7 @@ var schemaCms = require("./schema-cms");
 var webcrypto = require("./webcrypto");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
 var pbes2 = require("./pbes2");
 var b = asn1.build;
 var subtle = webcrypto.webcrypto.subtle;
@@ -565,7 +566,7 @@ function _assertAuthAttrs(pairs, forbidden) {
     }
     var t;
     try { t = asn1.read.oid(node.children[0]); } catch (e) { throw _err("cms/bad-input", "an authenticated attribute type is not an OBJECT IDENTIFIER", e); }
-    if (guard.intrinsic.hasOwn(seenTypes, t)) throw _err("cms/bad-input", "authenticated attributes must not repeat an attribute type (RFC 5652): " + t);
+    if (intrinsic.hasOwn(seenTypes, t)) throw _err("cms/bad-input", "authenticated attributes must not repeat an attribute type (RFC 5652): " + t);
     seenTypes[t] = 1;
     if (forbidden && t === forbidden.oid) throw _err("cms/bad-input", forbidden.why);
   });

package/lib/cms-sign.js

@@ -22,6 +22,7 @@ var frameworkError = require("./framework-error");
 var webcrypto = require("./webcrypto");
 var signScheme = require("./sign-scheme");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
 var pkiBuild = require("./pki-build");   // the shared post-sign self-check, among other producing helpers
 var cms = require("./schema-cms");
 
@@ -117,7 +118,7 @@ function _buildSid(cert, useSki) {
 function _buildSignedAttrs(pairs) {
   var seenTypes = {};
   var attrs = pairs.map(function (p) {
-    if (guard.intrinsic.hasOwn(seenTypes, p.type)) throw _err("cms/bad-input", "signedAttrs must not repeat an attribute type (RFC 5652 sec. 5.3): " + p.type);
+    if (intrinsic.hasOwn(seenTypes, p.type)) throw _err("cms/bad-input", "signedAttrs must not repeat an attribute type (RFC 5652 sec. 5.3): " + p.type);
     seenTypes[p.type] = 1;
     return b.sequence([b.oid(p.type), b.set(p.values)]);
   });
@@ -155,8 +156,8 @@ function _buildUnsignedAttrs(list) {
   var pairs = _resolveAttrPairs(list, "an unsigned attribute value");
   var seen = {};
   pairs.forEach(function (p) {
-    if (guard.intrinsic.hasOwn(UNSIGNED_FORBIDDEN, p.type)) throw _err("cms/bad-input", "the " + UNSIGNED_FORBIDDEN[p.type] + " attribute must not appear as an unsigned attribute (RFC 5652 sec. 11)");
-    if (guard.intrinsic.hasOwn(seen, p.type)) throw _err("cms/bad-input", "unsignedAttrs must not repeat an attribute type (RFC 5652 sec. 5.3): " + p.type);
+    if (intrinsic.hasOwn(UNSIGNED_FORBIDDEN, p.type)) throw _err("cms/bad-input", "the " + UNSIGNED_FORBIDDEN[p.type] + " attribute must not appear as an unsigned attribute (RFC 5652 sec. 11)");
+    if (intrinsic.hasOwn(seen, p.type)) throw _err("cms/bad-input", "unsignedAttrs must not repeat an attribute type (RFC 5652 sec. 5.3): " + p.type);
     seen[p.type] = 1;
   });
   var setOf = b.set(pairs.map(function (p) { return b.sequence([b.oid(p.type), b.set(p.values)]); }));

package/lib/cms-verify.js

@@ -46,6 +46,7 @@ var SLHDSA_BY_OID = signScheme.SLHDSA_BY_OID;                   // shared SLH-DS
 var validator = require("./validator-all");
 var compositeSig = require("./composite-sig");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
 var frameworkError = require("./framework-error");
 var pkix = require("./schema-pkix");
 
@@ -73,7 +74,7 @@ var DIGEST_HASH = {
 // foreign fault and loses this module's own unsupported-algorithm verdict.
 var SIG_HASH = { sha1: "SHA-1", sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" };
 // Is `name` a message-digest algorithm this verifier supports?
-function _supportedDigest(name) { return guard.intrinsic.hasOwn(DIGEST_HASH, name) && !!DIGEST_HASH[name]; }
+function _supportedDigest(name) { return intrinsic.hasOwn(DIGEST_HASH, name) && !!DIGEST_HASH[name]; }
 // The digest of `content` under the named algorithm, resolved to a Buffer.
 function _computeDigest(name, content) {
   return subtle.digest(DIGEST_HASH[name], content).then(function (d) { return Buffer.from(d); });

package/lib/guard-all.js

@@ -68,7 +68,11 @@ var compress = require("./guard-compress");
 var secret = require("./guard-secret");
 var parsed = require("./guard-parsed");
 var async_ = require("./guard-async");
-var intrinsic = require("./guard-intrinsic");
+// guard-intrinsic is deliberately NOT re-exported here. Re-exporting it gave taking the captures a
+// second spelling, and the check that holds a module to the discipline could then be satisfied
+// around: a module reached them as `guard.intrinsic.<x>` and never entered scope, so its remaining
+// live reads were never named. With one spelling, a module's own require IS the fact, and the check
+// reads it off the loaded module graph rather than guessing at the text.
 
 module.exports = {
   bytes:  bytes,
@@ -88,5 +92,4 @@ module.exports = {
   secret: secret,
   parsed: parsed,
   async:  async_,
-  intrinsic: intrinsic,
 };

package/lib/guard-intrinsic.js

@@ -55,6 +55,10 @@ var _bufferConcat = Buffer.concat;
 var _bufferIsBuffer = Buffer.isBuffer;
 var _bufferByteLength = Buffer.byteLength;
 var _bufferCompare = Buffer.compare;
+// `Buffer.prototype.equals` is the byte-identity test a binding decides on: an OCSP CertID says the
+// response is about this issuer, a responder ID says this key signed it. Dispatched live, one
+// answering true makes a response about a DIFFERENT certificate match the one being asked about.
+var _bufferEquals = uncurry(Buffer.prototype.equals);
 
 // The rest of what a guard reads from the runtime while it is deciding something. These are
 // grouped here rather than captured file by file so the set is enumerable in one place and a guard
@@ -268,6 +272,7 @@ module.exports = {
   isBuffer: _bufferIsBuffer,
   byteLength: _bufferByteLength,
   compare: _bufferCompare,
+  bufferEquals: _bufferEquals,
   isView: _isView,
   isInteger: _isInteger,
   isSafeInteger: _isSafeInteger,

package/lib/ocsp-verify.js

@@ -29,6 +29,7 @@
 
 var asn1 = require("./asn1-der");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
 var oid = require("./oid");
 var x509 = require("./schema-x509");
 var compositeSig = require("./composite-sig");
@@ -48,11 +49,16 @@ var OID_OCSP_SIGNING = oid.byName("ocspSigning");
 // Does this extended-key-usage list assert the given purpose? The answer IS an authorization
 // decision, so it goes through the membership guard rather than a prototype method. See guard-list.
 var _asserts = guard.list.contains;
+// Captured at load. Each of these answers a binding question -- does this response concern the
+// certificate being asked about, did this key sign it -- so a replacement made after this module
+// loaded would decide the answer while every check around it still runs.
+var _bufferFrom = intrinsic.bufferFrom;
+var _bytesEqual = intrinsic.bufferEquals;
 var OID_OCSP_NOCHECK = oid.byName("ocspNoCheck");
 var OID_EKU = oid.byName("extKeyUsage");
 var OID_KEY_USAGE = oid.byName("keyUsage");
 
-function ocspDigest(alg, buf) { return subtle.digest(alg, buf).then(function (h) { return Buffer.from(h); }); }
+function ocspDigest(alg, buf) { return subtle.digest(alg, buf).then(function (h) { return _bufferFrom(h); }); }
 
 // The subjectPublicKey BIT STRING value (past the unused-bits octet) of an SPKI DER: the exact
 // bytes an OCSP CertID issuerKeyHash / byKey KeyHash hash over (RFC 6960 sec. 4.1.1). Throws on a
@@ -108,12 +114,12 @@ function makeOcspVerify(deps) {
   // 5280 sec. 7.1-equal byte encoding of the validated issuer DN to try.
   async function ocspCertIdMatches(certID, cert, issuerNameCandidates, issuerKeyBits) {
     if (certID.serialNumberHex !== cert.serialNumberHex) return false;
-    var hashName = guard.intrinsic.hasOwn(OCSP_CERTID_HASHES, certID.hashAlgorithm.oid) ? OCSP_CERTID_HASHES[certID.hashAlgorithm.oid] : null;
+    var hashName = intrinsic.hasOwn(OCSP_CERTID_HASHES, certID.hashAlgorithm.oid) ? OCSP_CERTID_HASHES[certID.hashAlgorithm.oid] : null;
     if (!hashName) return false;
     var keyHash = await ocspDigest(hashName, issuerKeyBits);
-    if (!certID.issuerKeyHash.equals(keyHash)) return false;
+    if (!_bytesEqual(certID.issuerKeyHash, keyHash)) return false;
     for (var i = 0; i < issuerNameCandidates.length; i++) {
-      if (certID.issuerNameHash.equals(await ocspDigest(hashName, issuerNameCandidates[i]))) return true;
+      if (_bytesEqual(certID.issuerNameHash, await ocspDigest(hashName, issuerNameCandidates[i]))) return true;
     }
     return false;
   }
@@ -126,7 +132,7 @@ function makeOcspVerify(deps) {
     var matchesIssuer = false;
     try {
       if (rid.byName) matchesIssuer = dnEqual(rid.byName.rdns, cert.issuer.rdns);
-      else if (rid.byKey) matchesIssuer = rid.byKey.equals(await ocspDigest("SHA-1", issuerKeyBits));
+      else if (rid.byKey) matchesIssuer = _bytesEqual(rid.byKey, await ocspDigest("SHA-1", issuerKeyBits));
     } catch (_e) { matchesIssuer = false; }
     if (matchesIssuer) return issuer.workingPublicKey;
 
@@ -137,7 +143,7 @@ function makeOcspVerify(deps) {
       var identifies = false;
       try {
         if (rid.byName) identifies = dnEqual(rid.byName.rdns, rc.subject.rdns);
-        else if (rid.byKey) identifies = rid.byKey.equals(await ocspDigest("SHA-1", ocspKeyValue(rc.subjectPublicKeyInfo.bytes)));
+        else if (rid.byKey) identifies = _bytesEqual(rid.byKey, await ocspDigest("SHA-1", ocspKeyValue(rc.subjectPublicKeyInfo.bytes)));
       } catch (_e) { identifies = false; }
       if (!identifies) continue;
       // The delegate MUST be issued directly by the CA that issued the target.

package/lib/path-validate.js

@@ -48,6 +48,7 @@ var cmpVerify = require("./cmp-verify");
 var cmsVerify = require("./cms-verify");
 var cmpSession = require("./cmp-session");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
 var constants = require("./constants");
 var validator = require("./validator-all");
 var cms = require("./schema-cms");
@@ -1108,8 +1109,8 @@ function unrecognizedCriticalExtension(cert, isTarget) {
   for (var i = 0; i < cert.extensions.length; i++) {
     var ext = cert.extensions[i];
     if (!ext.critical) continue;
-    if (!guard.intrinsic.hasOwn(PROCESSED_EXTENSIONS, ext.oid)) return ext.oid;
-    if (isTarget && guard.intrinsic.hasOwn(TARGET_UNPROCESSED_IF_CRITICAL, ext.oid)) return ext.oid;
+    if (!intrinsic.hasOwn(PROCESSED_EXTENSIONS, ext.oid)) return ext.oid;
+    if (isTarget && intrinsic.hasOwn(TARGET_UNPROCESSED_IF_CRITICAL, ext.oid)) return ext.oid;
   }
   return null;
 }
@@ -1492,7 +1493,7 @@ async function validate(path, opts) {
         anchorPurposeApplied = true;
         // The map is the operator's RESTRICTION, so it is asked for its own entry: an inherited
         // `true` would grant the purpose on every anchor whose map does not name it.
-        if (!guard.intrinsic.hasOwn(ta.purposes, checkPurpose) || ta.purposes[checkPurpose] !== true) {
+        if (!intrinsic.hasOwn(ta.purposes, checkPurpose) || ta.purposes[checkPurpose] !== true) {
           checks.push({ name: "purposeTrust", ok: false, code: "path/purpose-not-trusted" }); failed = true;
         }
       }
@@ -2633,7 +2634,7 @@ function _hasPurposeScopedMetadata(ta) {
 }
 
 function assertAnchorConstraints(ta, checkPurpose) {
-  var d = (checkPurpose && ta && ta.distrustAfter && guard.intrinsic.hasOwn(ta.distrustAfter, checkPurpose))
+  var d = (checkPurpose && ta && ta.distrustAfter && intrinsic.hasOwn(ta.distrustAfter, checkPurpose))
     ? ta.distrustAfter[checkPurpose] : null;
   if (d == null) return null;
   return guard.time.assertValid(d, E, "path/bad-input", "trustAnchor.distrustAfter." + checkPurpose);
@@ -2754,9 +2755,9 @@ function _pushCandidates(frame, scored, stack, counter) {
     // Loop detection and the dedupe sets below are resource bounds, so they are asked through the
     // captured methods: a replaced `Set.prototype.has` answering false never prunes and the build
     // walks a cycle until a cap stops it.
-    if (guard.intrinsic.setHas(frame.keys, candKey)) continue;
+    if (intrinsic.setHas(frame.keys, candKey)) continue;
     var childKeys = new Set(frame.keys);
-    guard.intrinsic.setAdd(childKeys, candKey);
+    intrinsic.setAdd(childKeys, candKey);
     stack.push({ chain: [cand].concat(frame.chain), hop: frame.hop + 1, keys: childKeys });
   }
   return n;
@@ -2847,16 +2848,16 @@ async function _fetchAiaIssuers(current, aia) {
     // IP literals only (already validated above), never a hostname whose resolved address we cannot verify.
     if (net.isIP(u.hostname.replace(/^\[(.*)\]$/, "$1")) === 0 && !aia.transportGuardsAddresses) continue;
     u.hash = "";                                          // the fragment is never sent on the wire -> not part of the request/dedupe identity
-    if (guard.intrinsic.setHas(aia.fetchedUrls, u.href) || guard.intrinsic.setHas(seenThisCert, u.href)) continue;   // dedupe (build-wide OR same-cert) on the normalized URL
+    if (intrinsic.setHas(aia.fetchedUrls, u.href) || intrinsic.setHas(seenThisCert, u.href)) continue;   // dedupe (build-wide OR same-cert) on the normalized URL
     if (seenThisCert.size >= aia.maxPerCert) break;       // per-cert DISTINCT-url cap, checked BEFORE appending so maxAiaPerCert:0 collects nothing (no fetch at all)
-    guard.intrinsic.setAdd(seenThisCert, u.href);
+    intrinsic.setAdd(seenThisCert, u.href);
     uris.push(u.href);
   }
   var out = [];
   for (var k = 0; k < uris.length; k++) {
-    if (guard.intrinsic.setHas(aia.fetchedUrls, uris[k])) continue;   // a same-cert normalization-equal duplicate
+    if (intrinsic.setHas(aia.fetchedUrls, uris[k])) continue;   // a same-cert normalization-equal duplicate
     if (aia.fetches >= aia.maxFetches) break;     // total budget reached -> STOP fetching (a SILENT cap, never a throw that denies a buildable path)
-    guard.intrinsic.setAdd(aia.fetchedUrls, uris[k]);   // mark BEFORE the fetch -> fetched at most once, even on failure
+    intrinsic.setAdd(aia.fetchedUrls, uris[k]);   // mark BEFORE the fetch -> fetched at most once, even on failure
     aia.fetches += 1;
     var certs;
     try { certs = await _aiaFetchOne(uris[k], aia); }
@@ -2984,7 +2985,7 @@ async function build(leaf, opts) {
   // repeating CMS returning the same issuer) is appended AT MOST ONCE -- it otherwise inflates the pool, charging
   // the candidate budget and the ceiling for each copy before the issuer is ever evaluated.
   var poolDerKeys = new Set();
-  for (var pdk = 0; pdk < pool.length; pdk++) guard.intrinsic.setAdd(poolDerKeys, certDerKey(pool[pdk]));
+  for (var pdk = 0; pdk < pool.length; pdk++) intrinsic.setAdd(poolDerKeys, certDerKey(pool[pdk]));
 
   if (!Array.isArray(opts.trustAnchors) || opts.trustAnchors.length === 0) throw E("path/bad-input", "build: opts.trustAnchors must be a non-empty array of anchor tuples or root certificates");
   var anchors = opts.trustAnchors.map(toAnchor);
@@ -3146,8 +3147,8 @@ async function build(leaf, opts) {
         var fetched = await _fetchAiaIssuers(fbCur, aiaCtx);   // append newly-fetched issuer(s) to the SHARED pool
         for (var fj = 0; fj < fetched.length; fj++) {
           var fdk = certDerKey(fetched[fj]);
-          if (guard.intrinsic.setHas(poolDerKeys, fdk)) continue;   // a byte-duplicate (mirror URL / repeating CMS) -> add once, never re-charge the budget/ceiling
-          guard.intrinsic.setAdd(poolDerKeys, fdk);
+          if (intrinsic.setHas(poolDerKeys, fdk)) continue;   // a byte-duplicate (mirror URL / repeating CMS) -> add once, never re-charge the budget/ceiling
+          intrinsic.setAdd(poolDerKeys, fdk);
           if (pool.length < poolCeiling) pool.push(fetched[fj]);
         }
       }

package/lib/pkcs12-build.js

@@ -48,6 +48,7 @@ var cmsDecrypt = require("./cms-decrypt");   // the @internal decryptEnvelopedDa
 var schemaPkcs12 = require("./schema-pkcs12");
 var pkix = require("./schema-pkix");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
 var frameworkError = require("./framework-error");
 var C = require("./constants");
 
@@ -368,7 +369,7 @@ function _buildBag(bag, opts, depth) {
   if (!bag || typeof bag !== "object") throw _err("pkcs12/bad-input", "each bag must be an object with a type");
   // Checked against THIS type's table. An unrecognized type falls through to the switch below,
   // which is the one place that names the permitted set.
-  if (guard.intrinsic.hasOwn(_BAG_KEYS_BY_TYPE, bag.type)) {
+  if (intrinsic.hasOwn(_BAG_KEYS_BY_TYPE, bag.type)) {
     guard.identifier.assertKnownKeys(bag, _BAG_KEYS_BY_TYPE[bag.type], _err, "pkcs12/bad-input", function (k) {
       return "unknown field " + JSON.stringify(k) + " on a " + JSON.stringify(bag.type) +
         " bag; that field is not read for this bag type";
@@ -588,7 +589,7 @@ async function _buildMacData(macOpts, sharedPassword, authSafeDer) {
 function _specForm(spec) {
   var isObject = !!spec && typeof spec === "object" && !Buffer.isBuffer(spec);
   var safeContents = isObject ? spec.safeContents : null;
-  var full = guard.intrinsic.isArray(safeContents);
+  var full = intrinsic.isArray(safeContents);
   return { isObject: isObject, full: full, safeContents: full ? safeContents : null };
 }
 
@@ -599,7 +600,7 @@ function _normalizeSpec(spec, opts, form) {
     // be handed different values.
     var recipientCerts = opts.recipientCerts;
     var enveloped = recipientCerts != null;
-    if (enveloped && (!guard.intrinsic.isArray(recipientCerts) || !recipientCerts.length)) throw _err("pkcs12/bad-input", "opts.recipientCerts must be a non-empty array of recipient certificates");
+    if (enveloped && (!intrinsic.isArray(recipientCerts) || !recipientCerts.length)) throw _err("pkcs12/bad-input", "opts.recipientCerts must be a non-empty array of recipient certificates");
     var certBags = [];
     if (spec.cert != null) certBags.push({ type: "cert", cert: spec.cert, friendlyName: spec.friendlyName, localKeyId: spec.localKeyId });
     if (spec.ca != null && !Array.isArray(spec.ca)) throw _err("pkcs12/bad-input", "spec.ca must be an array of certificates");
@@ -749,7 +750,7 @@ async function _build(spec, opts) {
     // array reached _buildMacData as an empty descriptor and produced the DEFAULT MAC. Excluded by
     // the same test opts.integrity already applies, read through the load-time capture so a
     // replaced Array.isArray cannot reopen it.
-    if (opts.mac != null && opts.mac !== false && (typeof opts.mac !== "object" || guard.intrinsic.isArray(opts.mac))) throw _err("pkcs12/bad-input", "opts.mac must be false or a { algorithm, hash, salt, iterations, keyLength } object");
+    if (opts.mac != null && opts.mac !== false && (typeof opts.mac !== "object" || intrinsic.isArray(opts.mac))) throw _err("pkcs12/bad-input", "opts.mac must be false or a { algorithm, hash, salt, iterations, keyLength } object");
     if (opts.mac != null && opts.mac !== false) {
       // The algorithm selects the derivation, so the table that runs is the one belonging to it.
       // An unrecognized spelling keeps the union; _buildMacData refuses it by name a moment later.

package/lib/sign-scheme.js

@@ -23,10 +23,28 @@ var webcrypto = require("./webcrypto");
 var subtle = webcrypto.webcrypto.subtle;
 var validator = require("./validator-all");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
 var compositeSig = require("./composite-sig");
 var b = asn1.build;
 function O(name) { return oid.byName(name); }
 
+// Captured at load. This module decides which algorithm a signature runs under and whether the
+// caller's key matches the certificate it claims, so an operation read at call time is one the
+// caller answers: a replaced case fold reports two different algorithm names equal, and a replaced
+// `Buffer.isBuffer` admits a key that is not bytes.
+var _BigInt = intrinsic.BigInt;
+var _String = intrinsic.String;
+var _filter = intrinsic.filter;
+var _stringify = intrinsic.stringify;
+var _toUpperCase = intrinsic.toUpperCase;
+var _isBuffer = intrinsic.isBuffer;
+var _bufferFrom = intrinsic.bufferFrom;
+// Asks the value's internal slot rather than `instanceof`, which reads the `Uint8Array` global at
+// call time and answers about whichever constructor is bound then. It also settles the two cases
+// `instanceof` gets wrong on their own terms: a real typed array from another realm is one, and an
+// object merely built on the prototype is not.
+var _isU8 = intrinsic.types.isUint8Array;
+
 var HASH = { sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" };
 var NODE_DIGEST = { sha256: "sha256", sha384: "sha384", sha512: "sha512", shake128: "shake128", shake256: "shake256" };
 var PSS_SALT = { "SHA-256": 32, "SHA-384": 48, "SHA-512": 64 };
@@ -61,9 +79,9 @@ var MLDSA_SUITABLE_DIGEST = {
 //   legitimate one; the RED vectors (a below-strength digest still refused with its name planted on
 //   Object.prototype, on both the sign and verify paths) are the guard.
 function mldsaDigestSuitable(mlName, md) {
-  if (!guard.intrinsic.hasOwn(MLDSA_SUITABLE_DIGEST, mlName)) return false;
+  if (!intrinsic.hasOwn(MLDSA_SUITABLE_DIGEST, mlName)) return false;
   var row = MLDSA_SUITABLE_DIGEST[mlName];
-  return !!row && guard.intrinsic.hasOwn(row, md) && !!row[md];
+  return !!row && intrinsic.hasOwn(row, md) && !!row[md];
 }
 
 var SLHDSA_BY_OID = {};
@@ -79,7 +97,7 @@ function _algId(name, shape) { return shape === "null" ? b.sequence([b.oid(O(nam
 function _pssAlgId(digestName) {
   var hashAlg = b.sequence([b.oid(O(digestName)), b.nullValue()]);
   var mgf = b.sequence([b.oid(O("mgf1")), hashAlg]);
-  var params = b.sequence([b.explicit(0, hashAlg), b.explicit(1, mgf), b.explicit(2, b.integer(BigInt(PSS_SALT[HASH[digestName]])))]);
+  var params = b.sequence([b.explicit(0, hashAlg), b.explicit(1, mgf), b.explicit(2, b.integer(_BigInt(PSS_SALT[HASH[digestName]])))]);
   return b.sequence([b.oid(O("rsassaPss")), params]);
 }
 // The hash an id-RSASSA-PSS SPKI restricts its key to, or null when it restricts none.
@@ -104,7 +122,7 @@ function _pssHashFromSpki(cert, E) {
   if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children) {
     throw E("unsupported-algorithm", "the id-RSASSA-PSS key parameters are not an RSASSA-PSS-params SEQUENCE (RFC 4055 sec. 3.1)");
   }
-  var hashField = node.children.filter(function (c) { return c.tagClass === "context" && c.tagNumber === 0; })[0];
+  var hashField = _filter(node.children, function (c) { return c.tagClass === "context" && c.tagNumber === 0; })[0];
   // DEFAULT sha1Identifier -- an omitted hashAlgorithm names SHA-1, which this toolkit does not
   // sign or verify with, so it is reported as the pin it is and refused by the caller's own table.
   if (!hashField) return "sha1";
@@ -150,15 +168,15 @@ function resolveSignScheme(cert, so, noSignedAttrs, E) {
   var comp = compositeSig.COMPOSITE_ALGS[keyOid];
   if (comp) {
     if (comp.trad.unsupported) throw E("unsupported-algorithm", "composite " + comp.name + ": " + comp.trad.unsupported);
-    if (so.digestAlgorithm && so.digestAlgorithm !== comp.phCms) throw E("bad-input", "composite " + comp.name + " fixes the digestAlgorithm to " + comp.phCms + " (draft-ietf-lamps-cms-composite-sigs sec. 3.4); " + JSON.stringify(so.digestAlgorithm) + " conflicts");
+    if (so.digestAlgorithm && so.digestAlgorithm !== comp.phCms) throw E("bad-input", "composite " + comp.name + " fixes the digestAlgorithm to " + comp.phCms + " (draft-ietf-lamps-cms-composite-sigs sec. 3.4); " + _stringify(so.digestAlgorithm) + " conflicts");
     return { composite: comp, digest: comp.phCms, digestAlgId: _algId(comp.phCms, "absent"), sigAlgId: _algId(comp.name, "absent") };
   }
   if (keyOid === O("rsaEncryption") || keyOid === O("rsassaPss")) {
     var isPssKey = keyOid === O("rsassaPss");
     var pinned = isPssKey ? _pssHashFromSpki(cert, E) : null;
-    if (pinned && so.digestAlgorithm && so.digestAlgorithm !== pinned) throw E("bad-input", "the signer key restricts the RSASSA-PSS digest to " + pinned + ", but digestAlgorithm " + JSON.stringify(so.digestAlgorithm) + " was requested");
+    if (pinned && so.digestAlgorithm && so.digestAlgorithm !== pinned) throw E("bad-input", "the signer key restricts the RSASSA-PSS digest to " + pinned + ", but digestAlgorithm " + _stringify(so.digestAlgorithm) + " was requested");
     var d = so.digestAlgorithm || pinned || "sha256";
-    if (!HASH[d]) throw E("unsupported-algorithm", "unsupported RSA digest algorithm " + JSON.stringify(d));
+    if (!HASH[d]) throw E("unsupported-algorithm", "unsupported RSA digest algorithm " + _stringify(d));
     if (so.pss || isPssKey) return { digest: d, digestAlgId: _algId(d, "absent"), sigAlgId: _pssAlgId(d), imp: { name: "RSA-PSS", hash: HASH[d] }, sign: { name: "RSA-PSS", saltLength: PSS_SALT[HASH[d]] }, ecdsaDer: false };
     var rsaSigAlgId = so.combinedRsaSig ? _algId(RSA_PKCS1_SIG[d], "null") : _algId("rsaEncryption", "null");
     return { digest: d, digestAlgId: _algId(d, "absent"), sigAlgId: rsaSigAlgId, imp: { name: "RSASSA-PKCS1-v1_5", hash: HASH[d] }, sign: { name: "RSASSA-PKCS1-v1_5" }, ecdsaDer: false };
@@ -170,13 +188,13 @@ function resolveSignScheme(cert, so, noSignedAttrs, E) {
     var ec = EC_BY_CURVE_OID[curveOid];
     if (!ec) throw E("unsupported-algorithm", "the signer key is on an unsupported EC curve");
     var de = so.digestAlgorithm || "sha256";
-    if (!HASH[de]) throw E("unsupported-algorithm", "unsupported ECDSA digest algorithm " + JSON.stringify(de));
+    if (!HASH[de]) throw E("unsupported-algorithm", "unsupported ECDSA digest algorithm " + _stringify(de));
     return { digest: de, digestAlgId: _algId(de, "absent"), sigAlgId: _algId(ECDSA_ALG[de], "absent"), imp: { name: "ECDSA", namedCurve: ec.curve }, sign: { name: "ECDSA", hash: HASH[de] }, ecdsaDer: true, coordLen: ec.coordLen };
   }
   if (keyOid === O("Ed25519") || keyOid === O("Ed448")) {
     var name = keyOid === O("Ed25519") ? "Ed25519" : "Ed448";
     var dd = so.digestAlgorithm || (name === "Ed25519" ? "sha512" : "shake256");
-    if (!NODE_DIGEST[dd]) throw E("unsupported-algorithm", "unsupported " + name + " digest algorithm " + JSON.stringify(dd));
+    if (!NODE_DIGEST[dd]) throw E("unsupported-algorithm", "unsupported " + name + " digest algorithm " + _stringify(dd));
     return { digest: dd, digestAlgId: _algId(dd, "absent"), sigAlgId: _algId(name, "absent"), imp: { name: name }, sign: { name: name }, ecdsaDer: false };
   }
   if (MLDSA_BY_OID[keyOid]) {
@@ -186,14 +204,14 @@ function resolveSignScheme(cert, so, noSignedAttrs, E) {
       md = "sha512";
     } else {
       md = so.digestAlgorithm || "sha512";
-      if (!NODE_DIGEST[md]) throw E("unsupported-algorithm", "unsupported ML-DSA message digest " + JSON.stringify(md));
+      if (!NODE_DIGEST[md]) throw E("unsupported-algorithm", "unsupported ML-DSA message digest " + _stringify(md));
       if (!mldsaDigestSuitable(mlName, md)) throw E("unsupported-algorithm", "the " + md + " message digest is below the security strength of " + mlName + " (RFC 9882 sec. 3.3)");
     }
     return { digest: md, digestAlgId: _algId(md, "absent"), sigAlgId: _algId(oid.name(keyOid), "absent"), imp: { name: mlName }, sign: { name: mlName }, ecdsaDer: false };
   }
   if (SLHDSA_BY_OID[keyOid]) {
     var slh = SLHDSA_BY_OID[keyOid];
-    if (so.digestAlgorithm && so.digestAlgorithm !== slh.digest) throw E("bad-input", "SLH-DSA " + slh.wc + " requires the " + slh.digest + " message digest (RFC 9814 sec. 4); digestAlgorithm " + JSON.stringify(so.digestAlgorithm) + " conflicts");
+    if (so.digestAlgorithm && so.digestAlgorithm !== slh.digest) throw E("bad-input", "SLH-DSA " + slh.wc + " requires the " + slh.digest + " message digest (RFC 9814 sec. 4); digestAlgorithm " + _stringify(so.digestAlgorithm) + " conflicts");
     return { digest: slh.digest, digestAlgId: _algId(slh.digest, "absent"), sigAlgId: _algId(oid.name(keyOid), "absent"), imp: { name: slh.wc }, sign: { name: slh.wc }, ecdsaDer: false };
   }
   throw E("unsupported-algorithm", "unsupported signer key algorithm " + keyOid);
@@ -204,7 +222,7 @@ function _assertKeyMatchesScheme(key, imp, E) {
   var ka = key.algorithm || {};
   // WebCrypto algorithm names are ASCII-case-insensitive (RSASSA-PKCS1-v1_5 and RSASSA-PKCS1-V1_5 are one
   // algorithm), so compare case-folded; a genuine mismatch (e.g. RSASSA-PKCS1-v1_5 vs ECDSA) still fails.
-  if (String(ka.name).toUpperCase() !== String(imp.name).toUpperCase()) throw E("bad-input", "the signer CryptoKey algorithm (" + ka.name + ") does not match the certificate's key algorithm (" + imp.name + ")");
+  if (_toUpperCase(_String(ka.name)) !== _toUpperCase(_String(imp.name))) throw E("bad-input", "the signer CryptoKey algorithm (" + ka.name + ") does not match the certificate's key algorithm (" + imp.name + ")");
   if (imp.hash && (!ka.hash || ka.hash.name !== imp.hash)) throw E("bad-input", "the signer CryptoKey hash (" + (ka.hash && ka.hash.name) + ") does not match the signing digest (" + imp.hash + ")");
   if (imp.namedCurve && ka.namedCurve !== imp.namedCurve) throw E("bad-input", "the signer CryptoKey curve (" + ka.namedCurve + ") does not match the certificate curve (" + imp.namedCurve + ")");
 }
@@ -212,19 +230,19 @@ function _normPkcs8(k, label, E) {
   // A caller's own Buffer is borrowed, not copied, the same rule _importKey states below. Every
   // other form is copied, and neither copy is duplicated further, so a private key never gains a
   // plaintext duplicate this module cannot account for.
-  if (Buffer.isBuffer(k)) return guard.bytes.view(k, E, "bad-input", label);
-  if (k instanceof Uint8Array) return guard.bytes.snapshot(k, E, "bad-input", label);
+  if (_isBuffer(k)) return guard.bytes.view(k, E, "bad-input", label);
+  if (_isU8(k)) return guard.bytes.snapshot(k, E, "bad-input", label);
   if (typeof k === "string") { try { return pkcs8.pemDecode(k); } catch (e) { throw E("bad-input", label + " PEM could not be decoded", e); } }
   throw E("bad-input", label + " must be a PKCS#8 DER Buffer, Uint8Array, or PEM string");
 }
 function _normCompositeKeys(key, comp, E) {
-  if (!key || typeof key !== "object" || Buffer.isBuffer(key) || key instanceof Uint8Array || key.mldsa == null || key.trad == null) {
+  if (!key || typeof key !== "object" || _isBuffer(key) || _isU8(key) || key.mldsa == null || key.trad == null) {
     throw E("bad-input", "a composite " + comp.name + " signer key must be { mldsa: <PKCS#8>, trad: <PKCS#8> }");
   }
   return { mldsa: _normPkcs8(key.mldsa, "the composite ML-DSA component key", E), trad: _normPkcs8(key.trad, "the composite traditional component key", E) };
 }
 function _importKey(key, imp, E) {
-  if (key && typeof key === "object" && !Buffer.isBuffer(key) && !(key instanceof Uint8Array) && key.type === "private") {
+  if (key && typeof key === "object" && !_isBuffer(key) && !(_isU8(key)) && key.type === "private") {
     _assertKeyMatchesScheme(key, imp, E);
     // `key` is documented as taking a CryptoKey, so one created outside this engine signs here too --
     // it is re-imported through this engine, because it carries none of the key material this engine
@@ -236,8 +254,8 @@ function _importKey(key, imp, E) {
   // only thing that reads it. A caller's own Buffer is passed through untouched: they hold a live
   // reference and will use it again, so clearing it would destroy their key.
   var der, owned = false;
-  if (Buffer.isBuffer(key)) der = guard.bytes.view(key, E, "bad-input", "the signer private key");
-  else if (key instanceof Uint8Array) { der = guard.bytes.snapshot(key, E, "bad-input", "the signer private key"); owned = true; }
+  if (_isBuffer(key)) der = guard.bytes.view(key, E, "bad-input", "the signer private key");
+  else if (_isU8(key)) { der = guard.bytes.snapshot(key, E, "bad-input", "the signer private key"); owned = true; }
   else if (typeof key === "string") {
     try { der = pkcs8.pemDecode(key); }
     catch (e) { throw E("bad-input", "the signer PEM private key could not be decoded", e); }
@@ -260,11 +278,11 @@ function _importKey(key, imp, E) {
 // path signs both component keys and returns mldsaSig || tradSig (composite-sig.js owns it).
 function signOverTbs(scheme, key, signedBytes, E) {
   if (scheme.composite) {
-    return compositeSig.compositeSign(scheme.composite, _normCompositeKeys(key, scheme.composite, E), signedBytes).then(function (sig) { return Buffer.from(sig); });
+    return compositeSig.compositeSign(scheme.composite, _normCompositeKeys(key, scheme.composite, E), signedBytes).then(function (sig) { return _bufferFrom(sig); });
   }
   return _importKey(key, scheme.imp, E).then(function (priv) {
     return subtle.sign(scheme.sign, priv, signedBytes).then(function (sigRaw) {
-      var sig = Buffer.from(sigRaw);
+      var sig = _bufferFrom(sigRaw);
       if (scheme.ecdsaDer) sig = validator.sig.rawToEcdsaDer(sig, scheme.coordLen);
       return sig;
     });

package/lib/tsp-sign.js

@@ -25,6 +25,7 @@ var pkiX509 = require("./schema-x509");
 var smime = require("./schema-smime");
 var schemaTsp = require("./schema-tsp");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
 var frameworkError = require("./framework-error");
 
 var pkix = require("./schema-pkix");
@@ -507,7 +508,7 @@ var _BIND_DIGEST = { sha256: "sha256", sha384: "sha384", sha512: "sha512" };
 // tsp/* verdict code; a config-shape error throws (the caller's contract).
 function _imprintMatches(mi, data) {
   var name = mi.hashAlgorithm && mi.hashAlgorithm.name;
-  var nodeAlg = (name && guard.intrinsic.hasOwn(_VERIFY_DIGEST, name)) ? _VERIFY_DIGEST[name] : null;
+  var nodeAlg = (name && intrinsic.hasOwn(_VERIFY_DIGEST, name)) ? _VERIFY_DIGEST[name] : null;
   if (!nodeAlg) return "tsp/unsupported-algorithm";   // cannot recompute -> never assume a match
   var wantLen = _VERIFY_DIGEST_LEN[name];
   // The token's messageImprint MUST be a full-length digest for its algorithm. A short/empty

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.5.20",
+  "version": "0.5.21",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:e979b712-f27c-4c30-ba8e-4e9ab88715fd",
+  "serialNumber": "urn:uuid:353e5368-910e-4a85-a222-14a2add84cee",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-20T23:29:06.438Z",
+    "timestamp": "2026-08-21T02:50:54.975Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.5.20",
+      "bom-ref": "@blamejs/pki@0.5.21",
       "type": "application",
       "name": "pki",
-      "version": "0.5.20",
+      "version": "0.5.21",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.5.20",
+      "purl": "pkg:npm/%40blamejs/pki@0.5.21",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.5.20",
+      "ref": "@blamejs/pki@0.5.21",
       "dependsOn": []
     }
   ]