@blamejs/pki 0.5.20 → 0.5.22

package/CHANGELOG.md

@@ -4,6 +4,40 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.5.22 — 2026-08-21
+
+The list tests that decide whether a caller's argument is refused, and which form an extension spec is in, now answer from operations taken at load rather than read when they run.
+
+### Changed
+
+- The DER codec, the PKIX builders and the certificate signer are held to the live-read rule, with the reads each still carries declared as a count that can only fall. Certification-path validation's declared count falls in this release as its list doors convert.
+
+### Fixed
+
+- The DER builder refuses a non-list of children under a captured test. Every structure this toolkit encodes passes through that door, and it was the busiest live read in the library by two orders of magnitude.
+- `pki.x509.sign` picks which form the caller's extension spec is in with a captured test. That choice decides which fields are read and therefore what is signed into the certificate: answering wrongly sends an object down the list arm, and the extensions it carries are never seen. The same test decides whether the spec asserts keyCertSign, which is what makes the issued certificate a CA.
+- The name, key-usage and GeneralNames builders refuse a non-list argument under a captured test, as do certification-path validation's own list doors.
+
+## v0.5.21 — 2026-08-20
+
+The check that holds the crypto engine to load-time captures could be satisfied around, so nine modules had taken the safe primitive at one site and were never held to it anywhere else.
+
+### Added
+
+- `guard.intrinsic.bufferEquals`, the captured byte-identity comparison the bindings above are decided with.
+
+### Changed
+
+- Taking the captures has one spelling again. The guard orchestrator no longer re-exports them, so a module reaches them by importing the module that holds them, and the check reads that off the loaded module graph rather than off the text. This is the enforcement change: a module that adopts one safe primitive is held to the rule everywhere, and no way of writing the import, or of writing something that resembles one, changes the answer.
+- The seven modules the widened check surfaced carry a declared count of remaining reads rather than an exemption. A new live read pushes a module past its figure and fails, and converting reads without lowering the figure fails too, so the number keeps naming the real count. A module reaching zero leaves the list and is held to zero.
+
+### Fixed
+
+- An OCSP response is bound to the certificate it answers for with captured byte comparisons. The CertID says the response concerns this issuer and the responder ID says this key signed it, and both were decided by a `Buffer.prototype.equals` read at call time: replaced after load it reports every hash equal, and a `good` signed by a different CA answers for the certificate under check.
+- The signer's key is matched to its certificate under a captured case fold. WebCrypto algorithm names compare case-insensitively, so the check folds both sides; dispatched live, a replaced fold reported two different algorithm names equal and a key whose algorithm does not match the certificate passed the gate that exists to catch exactly that.
+- `pki.sign` decides the RSASSA-PSS parameters, the digest tables and its key-shape tests on captured operations, so a caller who replaces one after this package loads cannot change which algorithm a signature runs under.
+- A signing key is classified by asking the value what it is rather than by `instanceof` against a global. The old test read the `Uint8Array` binding at call time, and it answered wrongly in both directions on its own terms: a real typed array from another realm was not one, and an object built on the prototype was.
+
 ## v0.5.20 — 2026-08-20
 
 Five verdicts that turned on list membership now decide it by comparison, so replacing an array method after the module loads cannot change what a certificate, a responder or a signed message is found to be.

package/lib/asn1-der.js

@@ -34,6 +34,10 @@
 var constants = require("./constants");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
+// The list test at each builder door decides whether a caller's argument is refused. Read at the
+// moment it runs, a replacement answering true admits a non-list and the door it guards is gone.
+var _isArray = intrinsic.isArray;
 
 var Asn1Error = frameworkError.Asn1Error;
 var OidError = frameworkError.OidError;
@@ -966,7 +970,7 @@ var build = {
   // encoder composes, so the minimal-encoding rule lives once (the CHECK side is
   // schema.assertMinimalNamedBits). No bits asserted -> the empty BIT STRING.
   namedBitString: function (positions) {
-    if (!Array.isArray(positions)) throw new Asn1Error("asn1/bad-bit-string", "namedBitString requires an array of bit positions");
+    if (!_isArray(positions)) throw new Asn1Error("asn1/bad-bit-string", "namedBitString requires an array of bit positions");
     var hi = -1, i, p;
     for (i = 0; i < positions.length; i++) {
       p = positions[i];
@@ -1059,7 +1063,7 @@ function _intContent(v, who) {
 }
 
 function _asBufferArray(arr, who) {
-  if (!Array.isArray(arr)) throw new Asn1Error("asn1/bad-children", who + ": expected an array of TLV buffers");
+  if (!_isArray(arr)) throw new Asn1Error("asn1/bad-children", who + ": expected an array of TLV buffers");
   return arr.map(function (b) { return _asBuffer(b, who); });
 }
 

package/lib/cms-decrypt.js

@@ -23,6 +23,7 @@ var schemaCms = require("./schema-cms");
 var webcrypto = require("./webcrypto");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
 var pbes2 = require("./pbes2");
 var b = asn1.build;
 var subtle = webcrypto.webcrypto.subtle;
@@ -415,8 +416,8 @@ async function _kemriCek(ri, km) {
 // why, by name. An unresolvable OID is left to _openContent too, as the unsupported algorithm it is.
 function _assertContentCipherMode(eci, ct) {
   var oidStr = eci.contentEncryptionAlgorithm.oid;
-  var isAead = guard.intrinsic.hasOwn(AEAD_ALGS, oidStr);
-  if (!isAead && !guard.intrinsic.hasOwn(CONTENT_MODE, oidStr)) return;
+  var isAead = intrinsic.hasOwn(AEAD_ALGS, oidStr);
+  if (!isAead && !intrinsic.hasOwn(CONTENT_MODE, oidStr)) return;
   if (ct === "authEnvelopedData") {
     if (isAead) return;
     throw _err("cms/unsupported-algorithm", "contentEncryptionAlgorithm " + oidStr + " is not an authenticated encryption algorithm, which authEnvelopedData requires (RFC 5083 sec. 2)");
@@ -428,14 +429,14 @@ function _assertContentCipherMode(eci, ct) {
 // ---- stage 3: open the content (uniform failure) ---------------------------
 async function _openContent(parsed, eci, cek, ct) {
   var alg = eci.contentEncryptionAlgorithm;
-  var keyBits = guard.intrinsic.hasOwn(CONTENT_KEYBITS, alg.oid) ? CONTENT_KEYBITS[alg.oid] : 0;
+  var keyBits = intrinsic.hasOwn(CONTENT_KEYBITS, alg.oid) ? CONTENT_KEYBITS[alg.oid] : 0;
   if (!keyBits) {
     // AES-CCM parses completely here -- registered OIDs, the sec. 3.1 nonce bound, the seven legal
     // ICV lengths -- and is then declined, because AES-GCM is the only AEAD this toolkit implements
     // for content encryption. Saying only "unsupported <oid>" is what an operator also sees for an
     // OID nothing in the toolkit recognizes, and the two call for different things: one is a
     // capability gap to route around, the other is a malformed or exotic message.
-    if (guard.intrinsic.hasOwn(AEAD_ALGS, alg.oid) && AEAD_ALGS[alg.oid] === "ccm") {
+    if (intrinsic.hasOwn(AEAD_ALGS, alg.oid) && AEAD_ALGS[alg.oid] === "ccm") {
       throw _err("cms/unsupported-algorithm", "contentEncryptionAlgorithm " + alg.oid + " is AES-CCM. RFC 5084 sec. 3.1 permits it for this content type; this toolkit implements AES-GCM only for content encryption");
     }
     throw _err("cms/unsupported-algorithm", "unsupported contentEncryptionAlgorithm " + alg.oid);

package/lib/cms-encrypt.js

@@ -23,6 +23,7 @@ var schemaCms = require("./schema-cms");
 var webcrypto = require("./webcrypto");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
 var pbes2 = require("./pbes2");
 var b = asn1.build;
 var subtle = webcrypto.webcrypto.subtle;
@@ -565,7 +566,7 @@ function _assertAuthAttrs(pairs, forbidden) {
     }
     var t;
     try { t = asn1.read.oid(node.children[0]); } catch (e) { throw _err("cms/bad-input", "an authenticated attribute type is not an OBJECT IDENTIFIER", e); }
-    if (guard.intrinsic.hasOwn(seenTypes, t)) throw _err("cms/bad-input", "authenticated attributes must not repeat an attribute type (RFC 5652): " + t);
+    if (intrinsic.hasOwn(seenTypes, t)) throw _err("cms/bad-input", "authenticated attributes must not repeat an attribute type (RFC 5652): " + t);
     seenTypes[t] = 1;
     if (forbidden && t === forbidden.oid) throw _err("cms/bad-input", forbidden.why);
   });

package/lib/cms-sign.js

@@ -22,6 +22,7 @@ var frameworkError = require("./framework-error");
 var webcrypto = require("./webcrypto");
 var signScheme = require("./sign-scheme");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
 var pkiBuild = require("./pki-build");   // the shared post-sign self-check, among other producing helpers
 var cms = require("./schema-cms");
 
@@ -117,7 +118,7 @@ function _buildSid(cert, useSki) {
 function _buildSignedAttrs(pairs) {
   var seenTypes = {};
   var attrs = pairs.map(function (p) {
-    if (guard.intrinsic.hasOwn(seenTypes, p.type)) throw _err("cms/bad-input", "signedAttrs must not repeat an attribute type (RFC 5652 sec. 5.3): " + p.type);
+    if (intrinsic.hasOwn(seenTypes, p.type)) throw _err("cms/bad-input", "signedAttrs must not repeat an attribute type (RFC 5652 sec. 5.3): " + p.type);
     seenTypes[p.type] = 1;
     return b.sequence([b.oid(p.type), b.set(p.values)]);
   });
@@ -155,8 +156,8 @@ function _buildUnsignedAttrs(list) {
   var pairs = _resolveAttrPairs(list, "an unsigned attribute value");
   var seen = {};
   pairs.forEach(function (p) {
-    if (guard.intrinsic.hasOwn(UNSIGNED_FORBIDDEN, p.type)) throw _err("cms/bad-input", "the " + UNSIGNED_FORBIDDEN[p.type] + " attribute must not appear as an unsigned attribute (RFC 5652 sec. 11)");
-    if (guard.intrinsic.hasOwn(seen, p.type)) throw _err("cms/bad-input", "unsignedAttrs must not repeat an attribute type (RFC 5652 sec. 5.3): " + p.type);
+    if (intrinsic.hasOwn(UNSIGNED_FORBIDDEN, p.type)) throw _err("cms/bad-input", "the " + UNSIGNED_FORBIDDEN[p.type] + " attribute must not appear as an unsigned attribute (RFC 5652 sec. 11)");
+    if (intrinsic.hasOwn(seen, p.type)) throw _err("cms/bad-input", "unsignedAttrs must not repeat an attribute type (RFC 5652 sec. 5.3): " + p.type);
     seen[p.type] = 1;
   });
   var setOf = b.set(pairs.map(function (p) { return b.sequence([b.oid(p.type), b.set(p.values)]); }));

package/lib/cms-verify.js

@@ -46,6 +46,7 @@ var SLHDSA_BY_OID = signScheme.SLHDSA_BY_OID;                   // shared SLH-DS
 var validator = require("./validator-all");
 var compositeSig = require("./composite-sig");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
 var frameworkError = require("./framework-error");
 var pkix = require("./schema-pkix");
 
@@ -73,7 +74,7 @@ var DIGEST_HASH = {
 // foreign fault and loses this module's own unsupported-algorithm verdict.
 var SIG_HASH = { sha1: "SHA-1", sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" };
 // Is `name` a message-digest algorithm this verifier supports?
-function _supportedDigest(name) { return guard.intrinsic.hasOwn(DIGEST_HASH, name) && !!DIGEST_HASH[name]; }
+function _supportedDigest(name) { return intrinsic.hasOwn(DIGEST_HASH, name) && !!DIGEST_HASH[name]; }
 // The digest of `content` under the named algorithm, resolved to a Buffer.
 function _computeDigest(name, content) {
   return subtle.digest(DIGEST_HASH[name], content).then(function (d) { return Buffer.from(d); });

package/lib/guard-all.js

@@ -68,7 +68,11 @@ var compress = require("./guard-compress");
 var secret = require("./guard-secret");
 var parsed = require("./guard-parsed");
 var async_ = require("./guard-async");
-var intrinsic = require("./guard-intrinsic");
+// guard-intrinsic is deliberately NOT re-exported here. Re-exporting it gave taking the captures a
+// second spelling, and the check that holds a module to the discipline could then be satisfied
+// around: a module reached them as `guard.intrinsic.<x>` and never entered scope, so its remaining
+// live reads were never named. With one spelling, a module's own require IS the fact, and the check
+// reads it off the loaded module graph rather than guessing at the text.
 
 module.exports = {
   bytes:  bytes,
@@ -88,5 +92,4 @@ module.exports = {
   secret: secret,
   parsed: parsed,
   async:  async_,
-  intrinsic: intrinsic,
 };

package/lib/guard-intrinsic.js

@@ -55,6 +55,10 @@ var _bufferConcat = Buffer.concat;
 var _bufferIsBuffer = Buffer.isBuffer;
 var _bufferByteLength = Buffer.byteLength;
 var _bufferCompare = Buffer.compare;
+// `Buffer.prototype.equals` is the byte-identity test a binding decides on: an OCSP CertID says the
+// response is about this issuer, a responder ID says this key signed it. Dispatched live, one
+// answering true makes a response about a DIFFERENT certificate match the one being asked about.
+var _bufferEquals = uncurry(Buffer.prototype.equals);
 
 // The rest of what a guard reads from the runtime while it is deciding something. These are
 // grouped here rather than captured file by file so the set is enumerable in one place and a guard
@@ -268,6 +272,7 @@ module.exports = {
   isBuffer: _bufferIsBuffer,
   byteLength: _bufferByteLength,
   compare: _bufferCompare,
+  bufferEquals: _bufferEquals,
   isView: _isView,
   isInteger: _isInteger,
   isSafeInteger: _isSafeInteger,

package/lib/ocsp-verify.js

@@ -29,6 +29,7 @@
 
 var asn1 = require("./asn1-der");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
 var oid = require("./oid");
 var x509 = require("./schema-x509");
 var compositeSig = require("./composite-sig");
@@ -48,11 +49,16 @@ var OID_OCSP_SIGNING = oid.byName("ocspSigning");
 // Does this extended-key-usage list assert the given purpose? The answer IS an authorization
 // decision, so it goes through the membership guard rather than a prototype method. See guard-list.
 var _asserts = guard.list.contains;
+// Captured at load. Each of these answers a binding question -- does this response concern the
+// certificate being asked about, did this key sign it -- so a replacement made after this module
+// loaded would decide the answer while every check around it still runs.
+var _bufferFrom = intrinsic.bufferFrom;
+var _bytesEqual = intrinsic.bufferEquals;
 var OID_OCSP_NOCHECK = oid.byName("ocspNoCheck");
 var OID_EKU = oid.byName("extKeyUsage");
 var OID_KEY_USAGE = oid.byName("keyUsage");
 
-function ocspDigest(alg, buf) { return subtle.digest(alg, buf).then(function (h) { return Buffer.from(h); }); }
+function ocspDigest(alg, buf) { return subtle.digest(alg, buf).then(function (h) { return _bufferFrom(h); }); }
 
 // The subjectPublicKey BIT STRING value (past the unused-bits octet) of an SPKI DER: the exact
 // bytes an OCSP CertID issuerKeyHash / byKey KeyHash hash over (RFC 6960 sec. 4.1.1). Throws on a
@@ -108,12 +114,12 @@ function makeOcspVerify(deps) {
   // 5280 sec. 7.1-equal byte encoding of the validated issuer DN to try.
   async function ocspCertIdMatches(certID, cert, issuerNameCandidates, issuerKeyBits) {
     if (certID.serialNumberHex !== cert.serialNumberHex) return false;
-    var hashName = guard.intrinsic.hasOwn(OCSP_CERTID_HASHES, certID.hashAlgorithm.oid) ? OCSP_CERTID_HASHES[certID.hashAlgorithm.oid] : null;
+    var hashName = intrinsic.hasOwn(OCSP_CERTID_HASHES, certID.hashAlgorithm.oid) ? OCSP_CERTID_HASHES[certID.hashAlgorithm.oid] : null;
     if (!hashName) return false;
     var keyHash = await ocspDigest(hashName, issuerKeyBits);
-    if (!certID.issuerKeyHash.equals(keyHash)) return false;
+    if (!_bytesEqual(certID.issuerKeyHash, keyHash)) return false;
     for (var i = 0; i < issuerNameCandidates.length; i++) {
-      if (certID.issuerNameHash.equals(await ocspDigest(hashName, issuerNameCandidates[i]))) return true;
+      if (_bytesEqual(certID.issuerNameHash, await ocspDigest(hashName, issuerNameCandidates[i]))) return true;
     }
     return false;
   }
@@ -126,7 +132,7 @@ function makeOcspVerify(deps) {
     var matchesIssuer = false;
     try {
       if (rid.byName) matchesIssuer = dnEqual(rid.byName.rdns, cert.issuer.rdns);
-      else if (rid.byKey) matchesIssuer = rid.byKey.equals(await ocspDigest("SHA-1", issuerKeyBits));
+      else if (rid.byKey) matchesIssuer = _bytesEqual(rid.byKey, await ocspDigest("SHA-1", issuerKeyBits));
     } catch (_e) { matchesIssuer = false; }
     if (matchesIssuer) return issuer.workingPublicKey;
 
@@ -137,7 +143,7 @@ function makeOcspVerify(deps) {
       var identifies = false;
       try {
         if (rid.byName) identifies = dnEqual(rid.byName.rdns, rc.subject.rdns);
-        else if (rid.byKey) identifies = rid.byKey.equals(await ocspDigest("SHA-1", ocspKeyValue(rc.subjectPublicKeyInfo.bytes)));
+        else if (rid.byKey) identifies = _bytesEqual(rid.byKey, await ocspDigest("SHA-1", ocspKeyValue(rc.subjectPublicKeyInfo.bytes)));
       } catch (_e) { identifies = false; }
       if (!identifies) continue;
       // The delegate MUST be issued directly by the CA that issued the target.

package/lib/path-validate.js

@@ -48,6 +48,7 @@ var cmpVerify = require("./cmp-verify");
 var cmsVerify = require("./cms-verify");
 var cmpSession = require("./cmp-session");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
 var constants = require("./constants");
 var validator = require("./validator-all");
 var cms = require("./schema-cms");
@@ -770,7 +771,7 @@ function isSubtreeBaseValid(tag, base) {
     case 1: case 2: case 6: return typeof base === "string";                       // rfc822Name / dNSName / URI
     case 7: return (Buffer.isBuffer(base) || base instanceof Uint8Array) &&
                    (base.length === 8 || base.length === 32);                      // iPAddress: address + mask
-    case 4: return base !== null && typeof base === "object" && !!base.rdns && Array.isArray(base.rdns);   // directoryName
+    case 4: return base !== null && typeof base === "object" && !!base.rdns && intrinsic.isArray(base.rdns);   // directoryName
     default: return base !== undefined;
   }
 }
@@ -781,7 +782,7 @@ function isSubtreeBaseValid(tag, base) {
 // disabling the constraint the caller configured -- so it throws instead.
 function checkedSubtreeSeeds(list, optName) {
   if (list === undefined || list === null) return [];
-  if (!Array.isArray(list)) throw E("path/bad-input", "validate: opts." + optName + " must be an array of { tag, base } subtree entries");
+  if (!intrinsic.isArray(list)) throw E("path/bad-input", "validate: opts." + optName + " must be an array of { tag, base } subtree entries");
   return list.map(function (st) {
     if (!st || typeof st !== "object" || !Number.isInteger(st.tag) || st.tag < 0 || st.tag > 8 || !isSubtreeBaseValid(st.tag, st.base)) {
       throw E("path/bad-input", "validate: opts." + optName + " entries must be { tag: <GeneralName tag number 0..8>, base: <that form's constraint value> }");
@@ -1108,8 +1109,8 @@ function unrecognizedCriticalExtension(cert, isTarget) {
   for (var i = 0; i < cert.extensions.length; i++) {
     var ext = cert.extensions[i];
     if (!ext.critical) continue;
-    if (!guard.intrinsic.hasOwn(PROCESSED_EXTENSIONS, ext.oid)) return ext.oid;
-    if (isTarget && guard.intrinsic.hasOwn(TARGET_UNPROCESSED_IF_CRITICAL, ext.oid)) return ext.oid;
+    if (!intrinsic.hasOwn(PROCESSED_EXTENSIONS, ext.oid)) return ext.oid;
+    if (isTarget && intrinsic.hasOwn(TARGET_UNPROCESSED_IF_CRITICAL, ext.oid)) return ext.oid;
   }
   return null;
 }
@@ -1216,7 +1217,7 @@ async function validate(path, opts) {
   guard.identifier.assertKnownKeys(opts, _VALIDATE_OPTS, E, "path/bad-input",
     "pki.path.validate has an unknown option. The anchor here is `trustAnchor`, singular; " +
     "pki.path.build takes `trustAnchors`. The unknown option was: ");
-  if (!Array.isArray(path)) throw E("path/bad-input", "validate: path must be an array of certificates");
+  if (!intrinsic.isArray(path)) throw E("path/bad-input", "validate: path must be an array of certificates");
   // Bound the per-cert asymmetric-verify work BEFORE parsing an untrusted bundle
   // (the policy-tree cap guards CVE-2023-0464-style blow-up; this guards linear
   // crypto amplification from an oversized path). Entry-point tier: throw.
@@ -1241,7 +1242,7 @@ async function validate(path, opts) {
   // Membership is tested with indexOf, so a raw string here would be consulted
   // as a SUBSTRING match -- validated to an array of strings instead.
   if (opts.userInitialPolicySet !== undefined) {
-    var uipsOk = Array.isArray(opts.userInitialPolicySet) && opts.userInitialPolicySet.length > 0 &&
+    var uipsOk = intrinsic.isArray(opts.userInitialPolicySet) && opts.userInitialPolicySet.length > 0 &&
       guard.list.allMatch(opts.userInitialPolicySet, function (p) { return typeof p === "string" && p.length > 0; });
     if (!uipsOk) throw E("path/bad-input", "validate: opts.userInitialPolicySet must be a non-empty array of policy OID strings");
     // Each entry is compared (indexOf) against canonical decoder output, so a
@@ -1492,7 +1493,7 @@ async function validate(path, opts) {
         anchorPurposeApplied = true;
         // The map is the operator's RESTRICTION, so it is asked for its own entry: an inherited
         // `true` would grant the purpose on every anchor whose map does not name it.
-        if (!guard.intrinsic.hasOwn(ta.purposes, checkPurpose) || ta.purposes[checkPurpose] !== true) {
+        if (!intrinsic.hasOwn(ta.purposes, checkPurpose) || ta.purposes[checkPurpose] !== true) {
           checks.push({ name: "purposeTrust", ok: false, code: "path/purpose-not-trusted" }); failed = true;
         }
       }
@@ -2633,7 +2634,7 @@ function _hasPurposeScopedMetadata(ta) {
 }
 
 function assertAnchorConstraints(ta, checkPurpose) {
-  var d = (checkPurpose && ta && ta.distrustAfter && guard.intrinsic.hasOwn(ta.distrustAfter, checkPurpose))
+  var d = (checkPurpose && ta && ta.distrustAfter && intrinsic.hasOwn(ta.distrustAfter, checkPurpose))
     ? ta.distrustAfter[checkPurpose] : null;
   if (d == null) return null;
   return guard.time.assertValid(d, E, "path/bad-input", "trustAnchor.distrustAfter." + checkPurpose);
@@ -2642,7 +2643,7 @@ function assertAnchorConstraints(ta, checkPurpose) {
 function resolvePurposeOpts(opts) {
   var requiredEku = null;
   if (opts.requiredEku !== undefined) {
-    if (!Array.isArray(opts.requiredEku) || opts.requiredEku.length === 0) {
+    if (!intrinsic.isArray(opts.requiredEku) || opts.requiredEku.length === 0) {
       throw E("path/bad-input", "validate: opts.requiredEku must be a non-empty array of key-purpose OID names or dotted OID strings");
     }
     requiredEku = opts.requiredEku.map(function (p) {
@@ -2678,7 +2679,7 @@ function toAnchor(entry) {
     // (name matching), publicKey bytes and the algorithm OID (the sec. 6.1.4 key
     // hand-off). trustAnchors is a caller option, so a malformed tuple is a config
     // error and fails closed at entry, not a downstream no-path / soft verdict.
-    if (!Array.isArray(entry.name.rdns) || !Buffer.isBuffer(entry.publicKey) || typeof entry.algorithm !== "string") {
+    if (!intrinsic.isArray(entry.name.rdns) || !Buffer.isBuffer(entry.publicKey) || typeof entry.algorithm !== "string") {
       throw E("path/bad-input", "build: a trustAnchor tuple must be { name: { rdns: [...] }, publicKey: Buffer, algorithm: OID string }");
     }
     return entry;
@@ -2754,9 +2755,9 @@ function _pushCandidates(frame, scored, stack, counter) {
     // Loop detection and the dedupe sets below are resource bounds, so they are asked through the
     // captured methods: a replaced `Set.prototype.has` answering false never prunes and the build
     // walks a cycle until a cap stops it.
-    if (guard.intrinsic.setHas(frame.keys, candKey)) continue;
+    if (intrinsic.setHas(frame.keys, candKey)) continue;
     var childKeys = new Set(frame.keys);
-    guard.intrinsic.setAdd(childKeys, candKey);
+    intrinsic.setAdd(childKeys, candKey);
     stack.push({ chain: [cand].concat(frame.chain), hop: frame.hop + 1, keys: childKeys });
   }
   return n;
@@ -2847,16 +2848,16 @@ async function _fetchAiaIssuers(current, aia) {
     // IP literals only (already validated above), never a hostname whose resolved address we cannot verify.
     if (net.isIP(u.hostname.replace(/^\[(.*)\]$/, "$1")) === 0 && !aia.transportGuardsAddresses) continue;
     u.hash = "";                                          // the fragment is never sent on the wire -> not part of the request/dedupe identity
-    if (guard.intrinsic.setHas(aia.fetchedUrls, u.href) || guard.intrinsic.setHas(seenThisCert, u.href)) continue;   // dedupe (build-wide OR same-cert) on the normalized URL
+    if (intrinsic.setHas(aia.fetchedUrls, u.href) || intrinsic.setHas(seenThisCert, u.href)) continue;   // dedupe (build-wide OR same-cert) on the normalized URL
     if (seenThisCert.size >= aia.maxPerCert) break;       // per-cert DISTINCT-url cap, checked BEFORE appending so maxAiaPerCert:0 collects nothing (no fetch at all)
-    guard.intrinsic.setAdd(seenThisCert, u.href);
+    intrinsic.setAdd(seenThisCert, u.href);
     uris.push(u.href);
   }
   var out = [];
   for (var k = 0; k < uris.length; k++) {
-    if (guard.intrinsic.setHas(aia.fetchedUrls, uris[k])) continue;   // a same-cert normalization-equal duplicate
+    if (intrinsic.setHas(aia.fetchedUrls, uris[k])) continue;   // a same-cert normalization-equal duplicate
     if (aia.fetches >= aia.maxFetches) break;     // total budget reached -> STOP fetching (a SILENT cap, never a throw that denies a buildable path)
-    guard.intrinsic.setAdd(aia.fetchedUrls, uris[k]);   // mark BEFORE the fetch -> fetched at most once, even on failure
+    intrinsic.setAdd(aia.fetchedUrls, uris[k]);   // mark BEFORE the fetch -> fetched at most once, even on failure
     aia.fetches += 1;
     var certs;
     try { certs = await _aiaFetchOne(uris[k], aia); }
@@ -2971,7 +2972,7 @@ async function build(leaf, opts) {
 
   var poolInput = opts.candidates !== undefined ? opts.candidates : opts.intermediates;
   if (poolInput === undefined) poolInput = [];
-  if (!Array.isArray(poolInput)) throw E("path/bad-input", "build: opts.candidates must be an array of certificates");
+  if (!intrinsic.isArray(poolInput)) throw E("path/bad-input", "build: opts.candidates must be an array of certificates");
   // A pool larger than the absolute ceiling is rejected at entry (bounds the
   // parse work on an untrusted bundle) -- distinct from the per-search tick
   // budget below, which an operator may set lower to cap the DFS.
@@ -2984,9 +2985,9 @@ async function build(leaf, opts) {
   // repeating CMS returning the same issuer) is appended AT MOST ONCE -- it otherwise inflates the pool, charging
   // the candidate budget and the ceiling for each copy before the issuer is ever evaluated.
   var poolDerKeys = new Set();
-  for (var pdk = 0; pdk < pool.length; pdk++) guard.intrinsic.setAdd(poolDerKeys, certDerKey(pool[pdk]));
+  for (var pdk = 0; pdk < pool.length; pdk++) intrinsic.setAdd(poolDerKeys, certDerKey(pool[pdk]));
 
-  if (!Array.isArray(opts.trustAnchors) || opts.trustAnchors.length === 0) throw E("path/bad-input", "build: opts.trustAnchors must be a non-empty array of anchor tuples or root certificates");
+  if (!intrinsic.isArray(opts.trustAnchors) || opts.trustAnchors.length === 0) throw E("path/bad-input", "build: opts.trustAnchors must be a non-empty array of anchor tuples or root certificates");
   var anchors = opts.trustAnchors.map(toAnchor);
 
   guard.time.assertValid(opts.time, E, "path/bad-input", "build: opts.time (the validity-window check date, forwarded to validate)");
@@ -3146,8 +3147,8 @@ async function build(leaf, opts) {
         var fetched = await _fetchAiaIssuers(fbCur, aiaCtx);   // append newly-fetched issuer(s) to the SHARED pool
         for (var fj = 0; fj < fetched.length; fj++) {
           var fdk = certDerKey(fetched[fj]);
-          if (guard.intrinsic.setHas(poolDerKeys, fdk)) continue;   // a byte-duplicate (mirror URL / repeating CMS) -> add once, never re-charge the budget/ceiling
-          guard.intrinsic.setAdd(poolDerKeys, fdk);
+          if (intrinsic.setHas(poolDerKeys, fdk)) continue;   // a byte-duplicate (mirror URL / repeating CMS) -> add once, never re-charge the budget/ceiling
+          intrinsic.setAdd(poolDerKeys, fdk);
           if (pool.length < poolCeiling) pool.push(fetched[fj]);
         }
       }

package/lib/pkcs12-build.js

@@ -48,6 +48,7 @@ var cmsDecrypt = require("./cms-decrypt");   // the @internal decryptEnvelopedDa
 var schemaPkcs12 = require("./schema-pkcs12");
 var pkix = require("./schema-pkix");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
 var frameworkError = require("./framework-error");
 var C = require("./constants");
 
@@ -368,7 +369,7 @@ function _buildBag(bag, opts, depth) {
   if (!bag || typeof bag !== "object") throw _err("pkcs12/bad-input", "each bag must be an object with a type");
   // Checked against THIS type's table. An unrecognized type falls through to the switch below,
   // which is the one place that names the permitted set.
-  if (guard.intrinsic.hasOwn(_BAG_KEYS_BY_TYPE, bag.type)) {
+  if (intrinsic.hasOwn(_BAG_KEYS_BY_TYPE, bag.type)) {
     guard.identifier.assertKnownKeys(bag, _BAG_KEYS_BY_TYPE[bag.type], _err, "pkcs12/bad-input", function (k) {
       return "unknown field " + JSON.stringify(k) + " on a " + JSON.stringify(bag.type) +
         " bag; that field is not read for this bag type";
@@ -588,7 +589,7 @@ async function _buildMacData(macOpts, sharedPassword, authSafeDer) {
 function _specForm(spec) {
   var isObject = !!spec && typeof spec === "object" && !Buffer.isBuffer(spec);
   var safeContents = isObject ? spec.safeContents : null;
-  var full = guard.intrinsic.isArray(safeContents);
+  var full = intrinsic.isArray(safeContents);
   return { isObject: isObject, full: full, safeContents: full ? safeContents : null };
 }
 
@@ -599,7 +600,7 @@ function _normalizeSpec(spec, opts, form) {
     // be handed different values.
     var recipientCerts = opts.recipientCerts;
     var enveloped = recipientCerts != null;
-    if (enveloped && (!guard.intrinsic.isArray(recipientCerts) || !recipientCerts.length)) throw _err("pkcs12/bad-input", "opts.recipientCerts must be a non-empty array of recipient certificates");
+    if (enveloped && (!intrinsic.isArray(recipientCerts) || !recipientCerts.length)) throw _err("pkcs12/bad-input", "opts.recipientCerts must be a non-empty array of recipient certificates");
     var certBags = [];
     if (spec.cert != null) certBags.push({ type: "cert", cert: spec.cert, friendlyName: spec.friendlyName, localKeyId: spec.localKeyId });
     if (spec.ca != null && !Array.isArray(spec.ca)) throw _err("pkcs12/bad-input", "spec.ca must be an array of certificates");
@@ -749,7 +750,7 @@ async function _build(spec, opts) {
     // array reached _buildMacData as an empty descriptor and produced the DEFAULT MAC. Excluded by
     // the same test opts.integrity already applies, read through the load-time capture so a
     // replaced Array.isArray cannot reopen it.
-    if (opts.mac != null && opts.mac !== false && (typeof opts.mac !== "object" || guard.intrinsic.isArray(opts.mac))) throw _err("pkcs12/bad-input", "opts.mac must be false or a { algorithm, hash, salt, iterations, keyLength } object");
+    if (opts.mac != null && opts.mac !== false && (typeof opts.mac !== "object" || intrinsic.isArray(opts.mac))) throw _err("pkcs12/bad-input", "opts.mac must be false or a { algorithm, hash, salt, iterations, keyLength } object");
     if (opts.mac != null && opts.mac !== false) {
       // The algorithm selects the derivation, so the table that runs is the one belonging to it.
       // An unrecognized spelling keeps the union; _buildMacData refuses it by name a moment later.

package/lib/pki-build.js

@@ -14,6 +14,10 @@ var asn1 = require("./asn1-der");
 var schema = require("./schema-engine");
 var compositeSig = require("./composite-sig");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
+// Each of these doors refuses a caller argument that is not a list. Read live, a replacement
+// answering true lets a non-list through the check written to stop it.
+var _isArray = intrinsic.isArray;
 var oid = require("./oid");
 var ipUtils = require("./ip-utils");
 var nodeCrypto = require("crypto");
@@ -83,7 +87,7 @@ function makeBuilder(ctx) {
   function encodeName(spec) {
     if (Buffer.isBuffer(spec)) { assertValidNameDer(spec); return spec; }
     if (typeof spec === "string") spec = [{ commonName: spec }];
-    if (!Array.isArray(spec)) throw E("bad-name", "a name must be a string, an array of RDNs, or raw Name DER");
+    if (!_isArray(spec)) throw E("bad-name", "a name must be a string, an array of RDNs, or raw Name DER");
     return b.sequence(spec.map(encodeRdn));
   }
   // Full validation of a raw Name DER: walk it through the exact RDNSequence parser the decoder uses.
@@ -161,7 +165,7 @@ function makeBuilder(ctx) {
 
   // ---- extension-value encoders (the inverse of certExtensionDecoders) ----
   function extKeyUsage(names) {
-    if (!Array.isArray(names) || !names.length) throw E("bad-input", "keyUsage must assert at least one bit (RFC 5280 sec. 4.2.1.3)");
+    if (!_isArray(names) || !names.length) throw E("bad-input", "keyUsage must assert at least one bit (RFC 5280 sec. 4.2.1.3)");
     var positions = names.map(function (n) {
       var pos = KU_BIT[n];
       if (pos == null) throw E("bad-input", "unknown keyUsage bit " + JSON.stringify(n));
@@ -187,7 +191,7 @@ function makeBuilder(ctx) {
     throw E("bad-input", "unknown " + label + " " + JSON.stringify(n) + " (expected a registered name or a dotted-decimal OID)");
   }
   function extExtKeyUsage(names) {
-    if (!Array.isArray(names) || !names.length) throw E("bad-input", "extendedKeyUsage must list at least one KeyPurposeId");
+    if (!_isArray(names) || !names.length) throw E("bad-input", "extendedKeyUsage must list at least one KeyPurposeId");
     return b.sequence(names.map(function (n) { return b.oid(_resolveOid(n, "extendedKeyUsage purpose")); }));
   }
   function validateBcSpec(bc) {
@@ -214,14 +218,14 @@ function makeBuilder(ctx) {
   // RoleSyntax.roleAuthority [0], IetfAttrSyntax.policyAuthority [0]); the [n] node's children ARE the
   // GeneralName members, no inner SEQUENCE wrapper.
   function encodeGeneralNames(entries, implicitTag) {
-    if (!Array.isArray(entries) || !entries.length) throw E("bad-input", "a GeneralNames must carry at least one GeneralName");
+    if (!_isArray(entries) || !entries.length) throw E("bad-input", "a GeneralNames must carry at least one GeneralName");
     var members = entries.map(encodeGeneralName);
     if (implicitTag == null) return b.sequence(members);
     return b.contextConstructed(implicitTag, Buffer.concat(members));
   }
   function extSan(entries) { return encodeGeneralNames(entries); }
   function extCertPolicies(names) {
-    if (!Array.isArray(names) || !names.length) throw E("bad-input", "certificatePolicies must list at least one policy OID");
+    if (!_isArray(names) || !names.length) throw E("bad-input", "certificatePolicies must list at least one policy OID");
     var seen = {};
     return b.sequence(names.map(function (n) {
       var pOid = _resolveOid(n, "certificate policy");
@@ -301,7 +305,7 @@ function makeBuilder(ctx) {
   };
   function requestedExtensions(extSpec, spki) {
     var EXT_DECODERS = ctx.EXT_DECODERS;
-    if (Array.isArray(extSpec)) {
+    if (_isArray(extSpec)) {
       if (!extSpec.length) throw E("bad-input", "the requested extensions list must carry at least one extension");
       var seen = {};
       return b.sequence(extSpec.map(function (e, i) {

package/lib/sign-scheme.js

@@ -23,10 +23,28 @@ var webcrypto = require("./webcrypto");
 var subtle = webcrypto.webcrypto.subtle;
 var validator = require("./validator-all");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
 var compositeSig = require("./composite-sig");
 var b = asn1.build;
 function O(name) { return oid.byName(name); }
 
+// Captured at load. This module decides which algorithm a signature runs under and whether the
+// caller's key matches the certificate it claims, so an operation read at call time is one the
+// caller answers: a replaced case fold reports two different algorithm names equal, and a replaced
+// `Buffer.isBuffer` admits a key that is not bytes.
+var _BigInt = intrinsic.BigInt;
+var _String = intrinsic.String;
+var _filter = intrinsic.filter;
+var _stringify = intrinsic.stringify;
+var _toUpperCase = intrinsic.toUpperCase;
+var _isBuffer = intrinsic.isBuffer;
+var _bufferFrom = intrinsic.bufferFrom;
+// Asks the value's internal slot rather than `instanceof`, which reads the `Uint8Array` global at
+// call time and answers about whichever constructor is bound then. It also settles the two cases
+// `instanceof` gets wrong on their own terms: a real typed array from another realm is one, and an
+// object merely built on the prototype is not.
+var _isU8 = intrinsic.types.isUint8Array;
+
 var HASH = { sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" };
 var NODE_DIGEST = { sha256: "sha256", sha384: "sha384", sha512: "sha512", shake128: "shake128", shake256: "shake256" };
 var PSS_SALT = { "SHA-256": 32, "SHA-384": 48, "SHA-512": 64 };
@@ -61,9 +79,9 @@ var MLDSA_SUITABLE_DIGEST = {
 //   legitimate one; the RED vectors (a below-strength digest still refused with its name planted on
 //   Object.prototype, on both the sign and verify paths) are the guard.
 function mldsaDigestSuitable(mlName, md) {
-  if (!guard.intrinsic.hasOwn(MLDSA_SUITABLE_DIGEST, mlName)) return false;
+  if (!intrinsic.hasOwn(MLDSA_SUITABLE_DIGEST, mlName)) return false;
   var row = MLDSA_SUITABLE_DIGEST[mlName];
-  return !!row && guard.intrinsic.hasOwn(row, md) && !!row[md];
+  return !!row && intrinsic.hasOwn(row, md) && !!row[md];
 }
 
 var SLHDSA_BY_OID = {};
@@ -79,7 +97,7 @@ function _algId(name, shape) { return shape === "null" ? b.sequence([b.oid(O(nam
 function _pssAlgId(digestName) {
   var hashAlg = b.sequence([b.oid(O(digestName)), b.nullValue()]);
   var mgf = b.sequence([b.oid(O("mgf1")), hashAlg]);
-  var params = b.sequence([b.explicit(0, hashAlg), b.explicit(1, mgf), b.explicit(2, b.integer(BigInt(PSS_SALT[HASH[digestName]])))]);
+  var params = b.sequence([b.explicit(0, hashAlg), b.explicit(1, mgf), b.explicit(2, b.integer(_BigInt(PSS_SALT[HASH[digestName]])))]);
   return b.sequence([b.oid(O("rsassaPss")), params]);
 }
 // The hash an id-RSASSA-PSS SPKI restricts its key to, or null when it restricts none.
@@ -104,7 +122,7 @@ function _pssHashFromSpki(cert, E) {
   if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children) {
     throw E("unsupported-algorithm", "the id-RSASSA-PSS key parameters are not an RSASSA-PSS-params SEQUENCE (RFC 4055 sec. 3.1)");
   }
-  var hashField = node.children.filter(function (c) { return c.tagClass === "context" && c.tagNumber === 0; })[0];
+  var hashField = _filter(node.children, function (c) { return c.tagClass === "context" && c.tagNumber === 0; })[0];
   // DEFAULT sha1Identifier -- an omitted hashAlgorithm names SHA-1, which this toolkit does not
   // sign or verify with, so it is reported as the pin it is and refused by the caller's own table.
   if (!hashField) return "sha1";
@@ -150,15 +168,15 @@ function resolveSignScheme(cert, so, noSignedAttrs, E) {
   var comp = compositeSig.COMPOSITE_ALGS[keyOid];
   if (comp) {
     if (comp.trad.unsupported) throw E("unsupported-algorithm", "composite " + comp.name + ": " + comp.trad.unsupported);
-    if (so.digestAlgorithm && so.digestAlgorithm !== comp.phCms) throw E("bad-input", "composite " + comp.name + " fixes the digestAlgorithm to " + comp.phCms + " (draft-ietf-lamps-cms-composite-sigs sec. 3.4); " + JSON.stringify(so.digestAlgorithm) + " conflicts");
+    if (so.digestAlgorithm && so.digestAlgorithm !== comp.phCms) throw E("bad-input", "composite " + comp.name + " fixes the digestAlgorithm to " + comp.phCms + " (draft-ietf-lamps-cms-composite-sigs sec. 3.4); " + _stringify(so.digestAlgorithm) + " conflicts");
     return { composite: comp, digest: comp.phCms, digestAlgId: _algId(comp.phCms, "absent"), sigAlgId: _algId(comp.name, "absent") };
   }
   if (keyOid === O("rsaEncryption") || keyOid === O("rsassaPss")) {
     var isPssKey = keyOid === O("rsassaPss");
     var pinned = isPssKey ? _pssHashFromSpki(cert, E) : null;
-    if (pinned && so.digestAlgorithm && so.digestAlgorithm !== pinned) throw E("bad-input", "the signer key restricts the RSASSA-PSS digest to " + pinned + ", but digestAlgorithm " + JSON.stringify(so.digestAlgorithm) + " was requested");
+    if (pinned && so.digestAlgorithm && so.digestAlgorithm !== pinned) throw E("bad-input", "the signer key restricts the RSASSA-PSS digest to " + pinned + ", but digestAlgorithm " + _stringify(so.digestAlgorithm) + " was requested");
     var d = so.digestAlgorithm || pinned || "sha256";
-    if (!HASH[d]) throw E("unsupported-algorithm", "unsupported RSA digest algorithm " + JSON.stringify(d));
+    if (!HASH[d]) throw E("unsupported-algorithm", "unsupported RSA digest algorithm " + _stringify(d));
     if (so.pss || isPssKey) return { digest: d, digestAlgId: _algId(d, "absent"), sigAlgId: _pssAlgId(d), imp: { name: "RSA-PSS", hash: HASH[d] }, sign: { name: "RSA-PSS", saltLength: PSS_SALT[HASH[d]] }, ecdsaDer: false };
     var rsaSigAlgId = so.combinedRsaSig ? _algId(RSA_PKCS1_SIG[d], "null") : _algId("rsaEncryption", "null");
     return { digest: d, digestAlgId: _algId(d, "absent"), sigAlgId: rsaSigAlgId, imp: { name: "RSASSA-PKCS1-v1_5", hash: HASH[d] }, sign: { name: "RSASSA-PKCS1-v1_5" }, ecdsaDer: false };
@@ -170,13 +188,13 @@ function resolveSignScheme(cert, so, noSignedAttrs, E) {
     var ec = EC_BY_CURVE_OID[curveOid];
     if (!ec) throw E("unsupported-algorithm", "the signer key is on an unsupported EC curve");
     var de = so.digestAlgorithm || "sha256";
-    if (!HASH[de]) throw E("unsupported-algorithm", "unsupported ECDSA digest algorithm " + JSON.stringify(de));
+    if (!HASH[de]) throw E("unsupported-algorithm", "unsupported ECDSA digest algorithm " + _stringify(de));
     return { digest: de, digestAlgId: _algId(de, "absent"), sigAlgId: _algId(ECDSA_ALG[de], "absent"), imp: { name: "ECDSA", namedCurve: ec.curve }, sign: { name: "ECDSA", hash: HASH[de] }, ecdsaDer: true, coordLen: ec.coordLen };
   }
   if (keyOid === O("Ed25519") || keyOid === O("Ed448")) {
     var name = keyOid === O("Ed25519") ? "Ed25519" : "Ed448";
     var dd = so.digestAlgorithm || (name === "Ed25519" ? "sha512" : "shake256");
-    if (!NODE_DIGEST[dd]) throw E("unsupported-algorithm", "unsupported " + name + " digest algorithm " + JSON.stringify(dd));
+    if (!NODE_DIGEST[dd]) throw E("unsupported-algorithm", "unsupported " + name + " digest algorithm " + _stringify(dd));
     return { digest: dd, digestAlgId: _algId(dd, "absent"), sigAlgId: _algId(name, "absent"), imp: { name: name }, sign: { name: name }, ecdsaDer: false };
   }
   if (MLDSA_BY_OID[keyOid]) {
@@ -186,14 +204,14 @@ function resolveSignScheme(cert, so, noSignedAttrs, E) {
       md = "sha512";
     } else {
       md = so.digestAlgorithm || "sha512";
-      if (!NODE_DIGEST[md]) throw E("unsupported-algorithm", "unsupported ML-DSA message digest " + JSON.stringify(md));
+      if (!NODE_DIGEST[md]) throw E("unsupported-algorithm", "unsupported ML-DSA message digest " + _stringify(md));
       if (!mldsaDigestSuitable(mlName, md)) throw E("unsupported-algorithm", "the " + md + " message digest is below the security strength of " + mlName + " (RFC 9882 sec. 3.3)");
     }
     return { digest: md, digestAlgId: _algId(md, "absent"), sigAlgId: _algId(oid.name(keyOid), "absent"), imp: { name: mlName }, sign: { name: mlName }, ecdsaDer: false };
   }
   if (SLHDSA_BY_OID[keyOid]) {
     var slh = SLHDSA_BY_OID[keyOid];
-    if (so.digestAlgorithm && so.digestAlgorithm !== slh.digest) throw E("bad-input", "SLH-DSA " + slh.wc + " requires the " + slh.digest + " message digest (RFC 9814 sec. 4); digestAlgorithm " + JSON.stringify(so.digestAlgorithm) + " conflicts");
+    if (so.digestAlgorithm && so.digestAlgorithm !== slh.digest) throw E("bad-input", "SLH-DSA " + slh.wc + " requires the " + slh.digest + " message digest (RFC 9814 sec. 4); digestAlgorithm " + _stringify(so.digestAlgorithm) + " conflicts");
     return { digest: slh.digest, digestAlgId: _algId(slh.digest, "absent"), sigAlgId: _algId(oid.name(keyOid), "absent"), imp: { name: slh.wc }, sign: { name: slh.wc }, ecdsaDer: false };
   }
   throw E("unsupported-algorithm", "unsupported signer key algorithm " + keyOid);
@@ -204,7 +222,7 @@ function _assertKeyMatchesScheme(key, imp, E) {
   var ka = key.algorithm || {};
   // WebCrypto algorithm names are ASCII-case-insensitive (RSASSA-PKCS1-v1_5 and RSASSA-PKCS1-V1_5 are one
   // algorithm), so compare case-folded; a genuine mismatch (e.g. RSASSA-PKCS1-v1_5 vs ECDSA) still fails.
-  if (String(ka.name).toUpperCase() !== String(imp.name).toUpperCase()) throw E("bad-input", "the signer CryptoKey algorithm (" + ka.name + ") does not match the certificate's key algorithm (" + imp.name + ")");
+  if (_toUpperCase(_String(ka.name)) !== _toUpperCase(_String(imp.name))) throw E("bad-input", "the signer CryptoKey algorithm (" + ka.name + ") does not match the certificate's key algorithm (" + imp.name + ")");
   if (imp.hash && (!ka.hash || ka.hash.name !== imp.hash)) throw E("bad-input", "the signer CryptoKey hash (" + (ka.hash && ka.hash.name) + ") does not match the signing digest (" + imp.hash + ")");
   if (imp.namedCurve && ka.namedCurve !== imp.namedCurve) throw E("bad-input", "the signer CryptoKey curve (" + ka.namedCurve + ") does not match the certificate curve (" + imp.namedCurve + ")");
 }
@@ -212,19 +230,19 @@ function _normPkcs8(k, label, E) {
   // A caller's own Buffer is borrowed, not copied, the same rule _importKey states below. Every
   // other form is copied, and neither copy is duplicated further, so a private key never gains a
   // plaintext duplicate this module cannot account for.
-  if (Buffer.isBuffer(k)) return guard.bytes.view(k, E, "bad-input", label);
-  if (k instanceof Uint8Array) return guard.bytes.snapshot(k, E, "bad-input", label);
+  if (_isBuffer(k)) return guard.bytes.view(k, E, "bad-input", label);
+  if (_isU8(k)) return guard.bytes.snapshot(k, E, "bad-input", label);
   if (typeof k === "string") { try { return pkcs8.pemDecode(k); } catch (e) { throw E("bad-input", label + " PEM could not be decoded", e); } }
   throw E("bad-input", label + " must be a PKCS#8 DER Buffer, Uint8Array, or PEM string");
 }
 function _normCompositeKeys(key, comp, E) {
-  if (!key || typeof key !== "object" || Buffer.isBuffer(key) || key instanceof Uint8Array || key.mldsa == null || key.trad == null) {
+  if (!key || typeof key !== "object" || _isBuffer(key) || _isU8(key) || key.mldsa == null || key.trad == null) {
     throw E("bad-input", "a composite " + comp.name + " signer key must be { mldsa: <PKCS#8>, trad: <PKCS#8> }");
   }
   return { mldsa: _normPkcs8(key.mldsa, "the composite ML-DSA component key", E), trad: _normPkcs8(key.trad, "the composite traditional component key", E) };
 }
 function _importKey(key, imp, E) {
-  if (key && typeof key === "object" && !Buffer.isBuffer(key) && !(key instanceof Uint8Array) && key.type === "private") {
+  if (key && typeof key === "object" && !_isBuffer(key) && !(_isU8(key)) && key.type === "private") {
     _assertKeyMatchesScheme(key, imp, E);
     // `key` is documented as taking a CryptoKey, so one created outside this engine signs here too --
     // it is re-imported through this engine, because it carries none of the key material this engine
@@ -236,8 +254,8 @@ function _importKey(key, imp, E) {
   // only thing that reads it. A caller's own Buffer is passed through untouched: they hold a live
   // reference and will use it again, so clearing it would destroy their key.
   var der, owned = false;
-  if (Buffer.isBuffer(key)) der = guard.bytes.view(key, E, "bad-input", "the signer private key");
-  else if (key instanceof Uint8Array) { der = guard.bytes.snapshot(key, E, "bad-input", "the signer private key"); owned = true; }
+  if (_isBuffer(key)) der = guard.bytes.view(key, E, "bad-input", "the signer private key");
+  else if (_isU8(key)) { der = guard.bytes.snapshot(key, E, "bad-input", "the signer private key"); owned = true; }
   else if (typeof key === "string") {
     try { der = pkcs8.pemDecode(key); }
     catch (e) { throw E("bad-input", "the signer PEM private key could not be decoded", e); }
@@ -260,11 +278,11 @@ function _importKey(key, imp, E) {
 // path signs both component keys and returns mldsaSig || tradSig (composite-sig.js owns it).
 function signOverTbs(scheme, key, signedBytes, E) {
   if (scheme.composite) {
-    return compositeSig.compositeSign(scheme.composite, _normCompositeKeys(key, scheme.composite, E), signedBytes).then(function (sig) { return Buffer.from(sig); });
+    return compositeSig.compositeSign(scheme.composite, _normCompositeKeys(key, scheme.composite, E), signedBytes).then(function (sig) { return _bufferFrom(sig); });
   }
   return _importKey(key, scheme.imp, E).then(function (priv) {
     return subtle.sign(scheme.sign, priv, signedBytes).then(function (sigRaw) {
-      var sig = Buffer.from(sigRaw);
+      var sig = _bufferFrom(sigRaw);
       if (scheme.ecdsaDer) sig = validator.sig.rawToEcdsaDer(sig, scheme.coordLen);
       return sig;
     });

package/lib/tsp-sign.js

@@ -25,6 +25,7 @@ var pkiX509 = require("./schema-x509");
 var smime = require("./schema-smime");
 var schemaTsp = require("./schema-tsp");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
 var frameworkError = require("./framework-error");
 
 var pkix = require("./schema-pkix");
@@ -507,7 +508,7 @@ var _BIND_DIGEST = { sha256: "sha256", sha384: "sha384", sha512: "sha512" };
 // tsp/* verdict code; a config-shape error throws (the caller's contract).
 function _imprintMatches(mi, data) {
   var name = mi.hashAlgorithm && mi.hashAlgorithm.name;
-  var nodeAlg = (name && guard.intrinsic.hasOwn(_VERIFY_DIGEST, name)) ? _VERIFY_DIGEST[name] : null;
+  var nodeAlg = (name && intrinsic.hasOwn(_VERIFY_DIGEST, name)) ? _VERIFY_DIGEST[name] : null;
   if (!nodeAlg) return "tsp/unsupported-algorithm";   // cannot recompute -> never assume a match
   var wantLen = _VERIFY_DIGEST_LEN[name];
   // The token's messageImprint MUST be a full-length digest for its algorithm. A short/empty

package/lib/x509-sign.js

@@ -27,6 +27,11 @@ var oid = require("./oid");
 var x509 = require("./schema-x509");
 var signScheme = require("./sign-scheme");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
+// This test picks which FORM the caller's extension spec is in, so it decides which fields are read
+// and therefore what is signed into the certificate. Read live, a replacement answering true sends
+// an object down the list arm and the extensions it carries are never seen.
+var _isArray = intrinsic.isArray;
 var frameworkError = require("./framework-error");
 var schema = require("./schema-engine");
 var pkix = require("./schema-pkix");
@@ -112,7 +117,7 @@ function _akiKeyId(val, ctx) {
 // Extension DER buffers). Enforces the RFC 5280 CA cross-field gates, then emits a deterministic order.
 function _buildExtensions(extSpec, ctx) {
   if (extSpec == null) return [];
-  if (Array.isArray(extSpec)) {
+  if (_isArray(extSpec)) {
     // Validate each pre-encoded extension, reject a duplicate extnID (RFC 5280 sec. 4.2 allows at most one
     // instance of an extension), and decode basicConstraints + keyUsage to apply the same CA
     // cross-field rules the object form enforces (below), so the array escape hatch cannot bypass them.
@@ -161,7 +166,7 @@ function _buildExtensions(extSpec, ctx) {
   if (bc != null) _validateBcSpec(bc);
   var caTrue = !!(bc && bc.cA === true);
   var ku = extSpec.keyUsage;
-  var assertsKeyCertSign = Array.isArray(ku) && ku.indexOf("keyCertSign") >= 0;
+  var assertsKeyCertSign = _isArray(ku) && ku.indexOf("keyCertSign") >= 0;
   // RFC 5280 sec. 4.2.1.3 -- keyCertSign requires basicConstraints cA=TRUE.
   if (assertsKeyCertSign && !caTrue) throw _err("x509/bad-input", "keyUsage keyCertSign requires basicConstraints cA=TRUE (RFC 5280 sec. 4.2.1.3)");
   // RFC 5280 sec. 4.2.1.9 -- pathLenConstraint requires cA=TRUE AND keyCertSign.
@@ -217,7 +222,7 @@ function _assertIssuerIsCa(issuerCert) {
 // pre-encoded array extensions form (used to honor a supplied issuer's pathLenConstraint).
 function _issuedCaInfo(extSpec) {
   if (extSpec == null) return { cA: false, pathLen: null };
-  if (!Array.isArray(extSpec)) {
+  if (!_isArray(extSpec)) {
     var bc = extSpec.basicConstraints;
     return { cA: !!(bc && bc.cA === true), pathLen: bc && bc.pathLen != null ? Number(bc.pathLen) : null };
   }
@@ -234,7 +239,7 @@ function _issuedCaInfo(extSpec) {
 // is decoded to look for an Extension whose extnID is subjectAltName with a TRUE critical flag.
 function _hasCriticalSan(extSpec) {
   if (extSpec == null) return false;
-  if (!Array.isArray(extSpec)) return !!extSpec.subjectAltName;
+  if (!_isArray(extSpec)) return !!extSpec.subjectAltName;
   var sanOid = O("subjectAltName");
   for (var i = 0; i < extSpec.length; i++) {
     var n = asn1.decode(_reqDer(extSpec[i], "extension"));
@@ -362,17 +367,23 @@ function _sign(spec, issuer, opts) {
   if (guard.time.instantOf(spec.notBefore) > guard.time.instantOf(spec.notAfter)) throw _err("x509/bad-input", "notBefore must not be after notAfter (RFC 5280 sec. 4.1.2.5)");
   var validityDer = b.sequence([_timeDer(spec.notBefore, "notBefore"), _timeDer(spec.notAfter, "notAfter")]);
 
-  var exts = _buildExtensions(spec.extensions, { spki: spki, issuerSpki: issuerSpki, issuerCert: issuerCert, subjectEmpty: subjectEmpty });
+  // Read ONCE. Three separate consumers test which form this spec is in -- the encoder, the
+  // empty-subject rule below and the path-length rule under it -- and each answering for its own
+  // read is three chances to answer differently about one certificate. The door deep-copies the
+  // spec, so today they cannot disagree; taking the value once means they still cannot if the
+  // shape of that door ever changes.
+  var extSpec = spec.extensions;
+  var exts = _buildExtensions(extSpec, { spki: spki, issuerSpki: issuerSpki, issuerCert: issuerCert, subjectEmpty: subjectEmpty });
   // RFC 5280 sec. 4.1.2.6 -- an empty subject requires a critical subjectAltName (recognized in both the
   // object form and a pre-encoded array-form extension).
-  if (subjectEmpty && !_hasCriticalSan(spec.extensions)) {
+  if (subjectEmpty && !_hasCriticalSan(extSpec)) {
     throw _err("x509/bad-input", "an empty subject requires a critical subjectAltName (RFC 5280 sec. 4.1.2.6)");
   }
   // Honor a supplied issuer's pathLenConstraint (RFC 5280 sec. 4.2.1.9): a CA certificate issued below
   // it consumes one unit of path length, so pathLen=0 forbids issuing a CA below it, and an issued CA's
   // own pathLenConstraint must leave room within the issuer's remaining depth.
   if (issuerPathLen != null) {
-    var issued = _issuedCaInfo(spec.extensions);
+    var issued = _issuedCaInfo(extSpec);
     // A self-issued CA certificate (subject == issuer, e.g. a CA key rollover) does NOT consume path
     // length (RFC 5280 sec. 6.1 counts only non-self-issued intermediates), so it is permitted even at
     // pathLen 0. Compare canonically (sec. 7.1) via the parsed RDN sequences.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.5.20",
+  "version": "0.5.22",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:e979b712-f27c-4c30-ba8e-4e9ab88715fd",
+  "serialNumber": "urn:uuid:3735feb6-6447-4894-953a-28811d47f2c0",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-20T23:29:06.438Z",
+    "timestamp": "2026-08-21T03:44:09.554Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.5.20",
+      "bom-ref": "@blamejs/pki@0.5.22",
       "type": "application",
       "name": "pki",
-      "version": "0.5.20",
+      "version": "0.5.22",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.5.20",
+      "purl": "pkg:npm/%40blamejs/pki@0.5.22",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.5.20",
+      "ref": "@blamejs/pki@0.5.22",
       "dependsOn": []
     }
   ]