@blamejs/pki 0.7.29 → 0.7.31

package/CHANGELOG.md

@@ -4,6 +4,32 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.7.31 — 2026-09-12
+
+HPKE encrypts to an ML-KEM public key.
+
+### Added
+
+- pki.hpke.suites.KEM.ML_KEM_512, ML_KEM_768 and ML_KEM_1024 (0x0040, 0x0041, 0x0042). The HPKE binding is FIPS 203 encapsulation and decapsulation with the 32-byte ML-KEM shared secret as the HPKE shared secret and the 64-byte seed as the private key. setupS and seal take the recipient's encapsulation key as raw bytes, as { pkm }, or as a node:crypto KeyObject; setupR and open take { skm } holding the seed, with pkm optional, or a KeyObject. The base and psk modes and every KDF and AEAD apply; the auth and auth-psk modes, which the ML-KEM KEMs do not define (draft-ietf-hpke-pq sec. 7.2), are refused with hpke/auth-unsupported at both ends. An encapsulation key that fails the FIPS 203 sec. 7.2 check (length or a coefficient at or above q) is refused at import, and an encapsulated key of the wrong length is refused before decapsulation, each as hpke/bad-key. The recipient side of the draft's A.1, A.2 and A.3 vectors (ML-KEM-512 and -768 with HKDF-SHA256, ML-KEM-1024 with HKDF-SHA384) is a full known answer: the vector's encapsulated key decapsulated under its seed, all ten decryptions and all five exports. The sender side is proven by round trip: node:crypto takes no encapsulation randomness, so a fixed ephemeral (opts.eph) is refused on an ML-KEM suite with hpke/bad-input rather than ignored.
+- pki.hpke.suites.KDF.HKDF_SHA384 (0x0002), for any KEM. The draft-ietf-hpke-pq A.3 vector proves it in the key schedule. DHKEM(P-384) stays unoffered: no known-answer vector pairs it with an HKDF key schedule.
+
+### Changed
+
+- A serialized HPKE private key, { skm, pkm } on setupR, open, opts.eph and opts.senderKey, passes one door for every suite. skm must be a Buffer of exactly the suite's private-key length, an EC scalar additionally in [1, n-1]; the public key is derived from it; and pkm, now optional, must equal that derivation when given. Before this a DHKEM recipient given { skm } alone escaped as a raw TypeError, and a pkm of the wrong length or of another key was fed into the KEM context unchecked, producing a context that could open nothing. A node:crypto KeyObject is checked against the suite's curve or ML-KEM parameter set, and a public KeyObject where a private one is due is refused rather than tried; each refusal is hpke/bad-key naming what was checked.
+- opts.senderKey on setupS and opts.senderPublicKey on setupR are refused with hpke/bad-input in the base and psk modes, where they were previously left unused: a caller who supplied one without mode auth or auth-psk was not authenticating the exchange. A value of undefined or null is still absent. opts.eph is { skm, pkm } or absent (undefined or null); another value, such as 0 or an empty string, is refused with hpke/bad-input instead of being read as absent.
+- pki.hpke.setupS and setupR read each option once, at entry, into a snapshot. mode was read at the default and again at the use, so an option supplied through an accessor could answer auth to the first read and base to the second and get an unauthenticated setup; senderKey was read at its presence check and again at import.
+- The HKDF expand step wipes every block it computed when a later block's HMAC fails, as it already did on the succeeding path. A private KeyObject handed where a public key is due (the recipient key on setupS and seal, senderPublicKey on setupR) now has its public half taken before export, so no JWK carrying the private scalar is produced.
+- The fuzz target for the HPKE recipient path decapsulates under an ML-KEM-768 seed as well as an X25519 key, and selects HKDF-SHA384 among the KDFs.
+
+## v0.7.30 — 2026-09-12
+
+The Sigstore bundle verifier decides with operations bound when the module loads.
+
+### Changed
+
+- pki.sigstore.verifyBundle, parseBundle and pae read Buffer.prototype.equals, Buffer.prototype.toString, Buffer.prototype.subarray and Buffer.prototype.indexOf, Buffer.from and Buffer.concat, String.prototype.split, slice, indexOf, charAt and charCodeAt, Array.prototype.map, forEach, filter and slice, Object.assign, Object.create and Object.freeze, String, Number, BigInt, Date, Date.parse, Number.isNaN and JSON.stringify as bound at module load. Replacing Buffer.prototype.equals, String.prototype.split or indexOf, Array.prototype.filter or forEach, or Date.parse after load changes nothing this module decides: a valid bundle still verifies and a Rekor entry whose signature is not the bundle's is still refused. A replacement of Buffer.prototype.toString or subarray, Array.prototype.map, BigInt, Buffer.from or Buffer.concat still reaches the certificate parser and the chain builder's neighbors, which read those live; that residual is theirs and is stated here rather than implied covered.
+- SECURITY.md names the key import and export verbs and the Sigstore bundle verifier among the surfaces that take what they decide with at load.
+
 ## v0.7.29 — 2026-09-12
 
 Every decision pki.key makes is taken with operations bound when the module loads.

package/README.md

@@ -247,7 +247,7 @@ comment blocks, is at [pkijs.com](https://pkijs.com).
 | `pki.merkle` | Merkle-tree proof verification (RFC 6962 / RFC 9162). `leafHash`, `nodeHash`, and `emptyRootHash` build the domain-separated (0x00 leaf, 0x01 node) SHA-256 tree hashes. `verifyInclusion` folds an audit proof back to a root, and `verifyConsistency` reconstructs both the old and new root, which is the append-only guarantee; each is constant-time-compared to a trusted checkpoint root. Fail-closed on bad geometry, sync hashing, transport-free — `leafHash`, `nodeHash`, `emptyRootHash`, `verifyInclusion`, `verifyConsistency` |
 | `pki.trust` | Mozilla and CCADB trust-store ingestion. `parseCertdata` reads the NSS `certdata.txt` object stream and `parseCcadbCsv` the CCADB CSV export, both into one constraint-carrying anchor shape: the per-purpose trust bits, where only `CKT_NSS_TRUSTED_DELEGATOR` grants, and the per-purpose distrust-after dates the bare root list omits. Certificate and trust objects pair by byte-exact issuer and serial rather than adjacency and are cross-checked against the parsed DER, so metadata cannot attach to the wrong root. `anchor()` hands an entry to `pki.path.validate({ trustAnchors, checkPurpose })`, and `anchor(entry, { nameConstraints })` attaches the namespace a root program trusts a root for when that is narrower than the root certificate states, a `{ permitted, excluded }` pair of `{ tag, base }` subtrees that `validate` seeds as the RFC 5280 §6.1.1(h)(i) initial value, intersecting with each certificate's own constraints. Offline, fail-closed, bounded — `parseCertdata`, `parseCcadbCsv`, `anchor` |
 | `pki.shbs` | Stateful hash-based signature verification: HSS/LMS (RFC 8554), carried in X.509 by RFC 9802 and in CMS by RFC 9708, profiled by NIST SP 800-208 for CNSA 2.0 firmware signing. `verify` checks an HSS signature, where every level must pass, and `verifyLms` a single-tree LMS, over the raw public-key and signature blobs the parsers already surface. Pure public-input SHA-256 and SHAKE256 hashing, a data-driven typecode registry, and bounds-before-slice reads; a malformed blob throws a typed `ShbsError` while a well-formed but wrong signature returns `false`. Verification only by design, since stateful signing needs atomic one-time-key state that belongs in an HSM. `pki.path.validate` verifies an HSS-signed certificate on its own, so a chain reaching one needs no separate call: the signature covers the whole tbsCertificate rather than a digest of it (RFC 9802 §7.1), and a CertificateList naming the algorithm takes the same route. It is proven against the self-signed certificate RFC 9802 Appendix A publishes — `verify`, `verifyLms` |
-| `pki.hpke` | Hybrid Public Key Encryption (RFC 9180), the encrypt-to-a-public-key primitive behind TLS ECH, MLS, and OHTTP. `setupS` and `setupR` establish a sender or recipient context (KEM encapsulation plus the HKDF key schedule); the context's `seal` and `open` AEAD-encrypt with a sequence-counter nonce, and `export` derives further secrets; the module-level `seal` and `open` are single-shot wrappers. DHKEM (P-256, P-521, X25519, X448) by HKDF-SHA256/SHA512 by AES-GCM / ChaCha20Poly1305 / export-only, across all four modes, proven against the RFC 9180 Appendix A vectors. DHKEM(P-384) and HKDF-SHA384 are RFC-registered but Appendix A ships no vector for them, so they fail closed until an authoritative KAT exists. Pure composition over `node:crypto`; ML-KEM and X-Wing are a registry data-row extension pending stable drafts — `suites`, `setupS`, `setupR`, `seal`, `open` |
+| `pki.hpke` | Hybrid Public Key Encryption (RFC 9180), the encrypt-to-a-public-key primitive behind TLS ECH, MLS, and OHTTP. `setupS` and `setupR` establish a sender or recipient context (KEM encapsulation plus the HKDF key schedule); the context's `seal` and `open` AEAD-encrypt with a sequence-counter nonce, and `export` derives further secrets; the module-level `seal` and `open` are single-shot wrappers. DHKEM (P-256, P-521, X25519, X448) in all four modes, proven against the RFC 9180 Appendix A vectors, and the post-quantum ML-KEM-512/768/1024 KEMs (IANA 0x0040 to 0x0042) in the base and psk modes, proven against the draft-ietf-hpke-pq Appendix A vectors; HKDF-SHA256/SHA384/SHA512 by AES-GCM / ChaCha20Poly1305 / export-only. DHKEM(P-384) has no vector under an HKDF key schedule and fails closed. Pure composition over `node:crypto`; the PQ/T hybrid KEMs are a registry data-row extension once the CFRG combiner draft stabilizes — `suites`, `setupS`, `setupR`, `seal`, `open` |
 | `pki.kem` | Composite ML-KEM key establishment (draft-ietf-lamps-pq-composite-kem), a post-quantum ML-KEM hybridized with a traditional RSA-OAEP, ECDH, X25519, or X448 so the established secret holds if either component is later broken. `encapsulate` turns a recipient's composite `SubjectPublicKeyInfo` into a 256-bit shared secret and a ciphertext; `decapsulate` recovers the same secret from the ciphertext and the composite PKCS#8 private key. Each component KEM runs independently and the two secrets are mixed through a SHA3-256 combiner that binds the traditional ciphertext, the traditional public key, and a per-algorithm label. The twelve algorithms pair ML-KEM-768 and ML-KEM-1024 with RSA-OAEP 2048/3072/4096, ECDH over P-256/P-384/P-521 and brainpoolP256r1/P384r1, X25519, and X448, each verified against the draft Appendix G known-answer vectors; a malformed key or ciphertext, an unsupported algorithm, or a component decapsulation failure throws a typed `KemError` — `encapsulate`, `decapsulate` |
 | `pki.sigstore` | Offline verifier for a Sigstore bundle, the artifact `npm publish --provenance` produces and the registry serves. `verifyBundle` composes five fail-closed legs against caller-pinned trust (Fulcio CA roots and Rekor log keys, never trusted from the bundle): the DSSE signature over its PAE preimage under the Fulcio leaf key, the ephemeral Fulcio certificate chain validated as of the Rekor log time, the RFC 9162 inclusion proof folded to a Rekor-signed tree root, the log entry bound to this exact signature, and the in-toto SLSA subject digest the caller confirms against the published artifact. It reuses the X.509 parser, the RFC 5280 path validator, and the Merkle verifier; the net-new codecs are the DSSE PAE byte-builder and a fail-closed JSON reader. `verified: true` says the artifact was signed and logged, not that a party you trust signed it — Fulcio issues to anyone who completes an OIDC flow, so who signed is decided only by `opts.identity`, and `identityChecked` reports which of its fields were compared. An identity policy naming no field, or a field name that is not one of the three, is refused rather than satisfied — either would accept every signer while reading as a policy in force. A sixth leg is opt-in: pinning the certificate-transparency logs in `opts.ctLogs` checks the receipt Fulcio embeds in the certificate it issues (RFC 6962 §3.2), verified over the certificate as it stood before the receipt was added and under the key of the log that issued it, so the verdict says the signing certificate was public when it was issued rather than handed out quietly. At least one receipt must verify against a pinned log, the verdict reports `sctChecked` and `validScts`, and an empty log set is refused rather than read as a policy that checks nothing. Both content arms are read: a DSSE-wrapped in-toto attestation, and a message signature over an artifact's own bytes, which `cosign sign-blob` produces. For that arm `opts.artifact` supplies the bytes, and they are held to the hash the Rekor `hashedrekord` entry records before the signature is checked over them; the `messageDigest` the bundle carries is covered by no signature, so it is compared against the computed digest and never used in its place. `contentType` names the arm and the verdict has one shape for both — `pae`, `parseBundle`, `verifyBundle` |
 | `pki.inspect` | Human-readable inspection, the pure-JS equivalent of `openssl x509/crl/req/cms -text`. `certificate(pem \| der \| parsed)` renders an OpenSSL-style report: version, serial, signature algorithm, issuer and subject distinguished names, validity, public-key details (curve or modulus size plus the raw point or modulus), every decoded extension with its critical flag, and the signature. `crl`, `csr`, and `cms` render the other formats the same way — a CRL like `openssl crl -text`, a CSR like `openssl req -text`, and a CMS message like `openssl cms -cmsout -print`, with a stable summary for a non-SignedData ContentInfo — and `any(input)` detects the format and routes to the right report. Built over the strict parsers and the two-way OID registry with one set of field renderers, it names extension and algorithm OIDs an OpenSSL build shows only as raw bytes. No OpenSSL dependency, and the format is stable and OpenSSL-familiar rather than pinned to one OpenSSL version. A certificate policy's user notice renders as text, both its explicit text and a notice reference with the notice numbers that identify it, rather than hex, and a malformed part falls back to a hex dump rather than throwing — `certificate`, `crl`, `csr`, `cms`, `any` |

package/lib/guard-intrinsic.js

@@ -28,6 +28,7 @@ var _keyEquals = uncurry(_nodeCrypto.KeyObject.prototype.equals);
 var _isView = ArrayBuffer.isView;
 var _isInteger = Number.isInteger;
 var _isSafeInteger = Number.isSafeInteger;
+var _numberIsFinite = Number.isFinite;
 var _fromCharCode = String.fromCharCode;
 var _objectCreate = Object.create;
 var _getPrototypeOf = Object.getPrototypeOf;
@@ -85,6 +86,8 @@ var _Number = Number;
 var _Boolean = Boolean;
 var _BigInt = BigInt;
 var _Date = Date;
+var _dateParse = Date.parse;
+var _numberIsNaN = Number.isNaN;
 var _isFinite = globalThis.isFinite;
 var _ArrayBuffer = ArrayBuffer;
 var _Uint8Array = Uint8Array;
@@ -155,6 +158,7 @@ module.exports = Object.freeze({
   isView: _isView,
   isInteger: _isInteger,
   isSafeInteger: _isSafeInteger,
+  numberIsFinite: _numberIsFinite,
   fromCharCode: _fromCharCode,
   create: _objectCreate,
   getPrototypeOf: _getPrototypeOf,
@@ -202,6 +206,8 @@ module.exports = Object.freeze({
   Boolean: _Boolean,
   BigInt: _BigInt,
   Date: _Date,
+  dateParse: _dateParse,
+  numberIsNaN: _numberIsNaN,
   isFinite: _isFinite,
   ArrayBuffer: _ArrayBuffer,
   Uint8Array: _Uint8Array,

package/lib/hpke.js

@@ -8,16 +8,18 @@
  * @fullname   HPKE (Hybrid Public Key Encryption, RFC 9180)
  * @intro Hybrid Public Key Encryption (RFC 9180): the standard construction
  *   behind TLS Encrypted Client Hello, MLS, and OHTTP that turns a recipient KEM
- *   public key into an encapsulated key plus an AEAD-encrypting context. This is
- *   the RFC 9180 base construction: the DHKEM suites P-256, P-521, X25519, and
- *   X448, HKDF-SHA256 / HKDF-SHA512, the three AEADs plus export-only, and all
- *   four modes (base / psk / auth / auth-psk), each proven against the RFC 9180
- *   Appendix A known-answer vectors. DHKEM(P-384) and HKDF-SHA384 are RFC-registered
- *   but Appendix A ships no test vector for them, so they are omitted (a request
- *   fails closed) until an authoritative KAT is available. Pure composition over
- *   node:crypto: no ASN.1, no schema engine. Post-quantum KEMs (ML-KEM, X-Wing)
- *   are a data-row extension the registry is shaped to admit once their
- *   specifications stabilize.
+ *   public key into an encapsulated key plus an AEAD-encrypting context. Two KEM
+ *   families run the RFC 9180 key schedule: the DHKEM suites P-256, P-521, X25519,
+ *   and X448 in all four modes (base / psk / auth / auth-psk), proven against the
+ *   RFC 9180 Appendix A known-answer vectors, and the post-quantum ML-KEM-512 /
+ *   -768 / -1024 KEMs (IANA code points 0x0040 to 0x0042, draft-ietf-hpke-pq) in
+ *   the base and psk modes, proven against that draft's Appendix A vectors. The
+ *   KDFs are HKDF-SHA256 / HKDF-SHA384 / HKDF-SHA512; the AEADs are AES-128-GCM,
+ *   AES-256-GCM, ChaCha20Poly1305, and export-only. DHKEM(P-384) is RFC-registered
+ *   but no known-answer vector pairs it with an HKDF key schedule, so a request
+ *   for it fails closed. The PQ/T hybrid KEMs and the SHAKE-based KDFs of the HPKE
+ *   revision are a data-row extension once their specifications stabilize. Pure
+ *   composition over node:crypto: no ASN.1, no schema engine.
  *   The RFC 9180 sec. 7 registry code points live in pki.hpke.suites
  *   (KEM / KDF / AEAD / MODE), passed to the setup functions to select a suite.
  * @spec RFC 9180
@@ -28,7 +30,11 @@ var nodeCrypto = require("crypto");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
+var oid = require("./oid");
 var _hasOwn = intrinsic.hasOwn;
+var _isBuffer = intrinsic.isBuffer, _bufferFrom = intrinsic.bufferFrom, _bufferAlloc = intrinsic.bufferAlloc;
+var _bufferConcat = intrinsic.bufferConcat, _bufferEquals = intrinsic.bufferEquals, _compare = intrinsic.compare;
+var _subarray = intrinsic.subarray;
 
 var HpkeError = frameworkError.HpkeError;
 function _err(code, message, cause) { return new HpkeError(code, message, cause); }
@@ -49,6 +55,7 @@ function L(s) { return Buffer.from(s, "ascii"); }
 
 var KDFS = intrinsic.assign(intrinsic.create(null), {
   0x0001: { hash: "sha256", Nh: 32 },
+  0x0002: { hash: "sha384", Nh: 48 },
   0x0003: { hash: "sha512", Nh: 64 },
 });
 var AEADS = intrinsic.assign(intrinsic.create(null), {
@@ -57,11 +64,18 @@ var AEADS = intrinsic.assign(intrinsic.create(null), {
   0x0003: { cipher: "chacha20-poly1305", Nk: 32, Nn: 12, Nt: 16 },
   0xFFFF: { exportOnly: true, Nn: 12 },
 });
+function _mlKemRow(name, oidName, node) {
+  var p = oid.kemParams(oidName);
+  return { kind: "mlkem", name: name, node: node, Nsecret: p.ss, Npub: p.ek, Nenc: p.ct, Nsk: 64 };
+}
 var KEMS = intrinsic.assign(intrinsic.create(null), {
-  0x0010: { kind: "ec", curve: "P-256", nodeCurve: "prime256v1", kdf: 0x0001, Nsecret: 32, Npub: 65 },
-  0x0012: { kind: "ec", curve: "P-521", nodeCurve: "secp521r1", kdf: 0x0003, Nsecret: 64, Npub: 133 },
-  0x0020: { kind: "okp", curve: "X25519", oid: "2b656e", kdf: 0x0001, Nsecret: 32, Npub: 32 },
-  0x0021: { kind: "okp", curve: "X448", oid: "2b656f", kdf: 0x0003, Nsecret: 64, Npub: 56 },
+  0x0010: { kind: "ec", name: "P-256", curve: "P-256", nodeCurve: "prime256v1", kdf: 0x0001, Nsecret: 32, Npub: 65, Nsk: 32 },
+  0x0012: { kind: "ec", name: "P-521", curve: "P-521", nodeCurve: "secp521r1", kdf: 0x0003, Nsecret: 64, Npub: 133, Nsk: 66 },
+  0x0020: { kind: "okp", name: "X25519", curve: "X25519", kdf: 0x0001, Nsecret: 32, Npub: 32, Nsk: 32 },
+  0x0021: { kind: "okp", name: "X448", curve: "X448", kdf: 0x0003, Nsecret: 64, Npub: 56, Nsk: 56 },
+  0x0040: _mlKemRow("ML-KEM-512", "id-ml-kem-512", "ml-kem-512"),
+  0x0041: _mlKemRow("ML-KEM-768", "id-ml-kem-768", "ml-kem-768"),
+  0x0042: _mlKemRow("ML-KEM-1024", "id-ml-kem-1024", "ml-kem-1024"),
 });
 
 var MODE_BASE = 0x00, MODE_PSK = 0x01, MODE_AUTH = 0x02, MODE_AUTH_PSK = 0x03;
@@ -78,19 +92,24 @@ function _extract(hash, Nh, salt, ikm) {
 }
 function _expand(hash, Nh, prk, info, len) {
   if (len > 255 * Nh) throw _err("hpke/export-length", "requested length " + len + " exceeds 255*Nh");
-  var out = [], t = Buffer.alloc(0), n = Math.ceil(len / Nh);
-  for (var i = 1; i <= n; i++) {
-    var fed = concat([t, info, Buffer.from([i])]);
-    t = nodeCrypto.createHmac(hash, prk).update(fed).digest();
+  var out = [], t = Buffer.alloc(0), n = Math.ceil(len / Nh), fed = null, joined = null;
+  try {
+    for (var i = 1; i <= n; i++) {
+      fed = concat([t, info, Buffer.from([i])]);
+      t = nodeCrypto.createHmac(hash, prk).update(fed).digest();
+      guard.secret.zeroize(fed, HpkeError, "hpke/bad-input", "an expand feedback input");
+      fed = null;
+      out.push(t);
+    }
+    joined = concat(out);
+    var exact = Buffer.alloc(len);
+    joined.copy(exact, 0, 0, len);
+    return exact;
+  } finally {
     guard.secret.zeroize(fed, HpkeError, "hpke/bad-input", "an expand feedback input");
-    out.push(t);
+    guard.secret.zeroize(joined, HpkeError, "hpke/bad-input", "the KDF accumulator");
+    for (var oi = 0; oi < out.length; oi++) guard.secret.zeroize(out[oi], HpkeError, "hpke/bad-input", "a KDF block");
   }
-  var joined = concat(out);
-  var exact = Buffer.alloc(len);
-  joined.copy(exact, 0, 0, len);
-  guard.secret.zeroize(joined, HpkeError, "hpke/bad-input", "the KDF accumulator");
-  for (var oi = 0; oi < out.length; oi++) guard.secret.zeroize(out[oi], HpkeError, "hpke/bad-input", "a KDF block");
-  return exact;
 }
 function _labeledExtract(kdf, suiteId, salt, label, ikm) {
   var labeled = concat([HPKE_V1, suiteId, L(label), ikm]);
@@ -104,10 +123,27 @@ function _labeledExpand(kdf, suiteId, prk, label, info, len) {
 
 var OKP_SPKI = intrinsic.assign(intrinsic.create(null), { X25519: "302a300506032b656e032100", X448: "3042300506032b656f033900" });
 var OKP_PKCS8 = intrinsic.assign(intrinsic.create(null), { X25519: "302e020100300506032b656e04220420", X448: "3046020100300506032b656f043a0438" });
+var EC_SEC1 = intrinsic.assign(intrinsic.create(null), {
+  "P-256": { head: "30310201010420", tail: "a00a06082a8648ce3d030107",
+    order: "ffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551" },
+  "P-521": { head: "30500201010442", tail: "a00706052b81040023",
+    order: "01ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e91386409" },
+});
+var ML_KEM_SPKI = intrinsic.assign(intrinsic.create(null), {
+  "ML-KEM-512": "30820332300b06096086480165030404010382032100",
+  "ML-KEM-768": "308204b2300b0609608648016503040402038204a100",
+  "ML-KEM-1024": "30820632300b06096086480165030404030382062100",
+});
+var ML_KEM_PKCS8 = intrinsic.assign(intrinsic.create(null), {
+  "ML-KEM-512": "3054020100300b060960864801650304040104428040",
+  "ML-KEM-768": "3054020100300b060960864801650304040204428040",
+  "ML-KEM-1024": "3054020100300b060960864801650304040304428040",
+});
+function _hex(h) { return _bufferFrom(h, "hex"); }
 
 function _importPublic(kem, raw) {
-  if (!Buffer.isBuffer(raw) || raw.length !== kem.Npub) {
-    throw _err("hpke/bad-key", kem.curve + " public key must be " + kem.Npub + " bytes");
+  if (!_isBuffer(raw) || raw.length !== kem.Npub) {
+    throw _err("hpke/bad-key", kem.name + " public key must be " + kem.Npub + " bytes");
   }
   try {
     if (kem.kind === "ec") {
@@ -116,31 +152,62 @@ function _importPublic(kem, raw) {
       var jwk = { kty: "EC", crv: kem.curve, x: raw.subarray(1, 1 + half).toString("base64url"), y: raw.subarray(1 + half).toString("base64url") };
       return nodeCrypto.createPublicKey({ key: jwk, format: "jwk" });
     }
-    return nodeCrypto.createPublicKey({ key: Buffer.from(OKP_SPKI[kem.curve] + raw.toString("hex"), "hex"), format: "der", type: "spki" });
+    var prefix = kem.kind === "mlkem" ? ML_KEM_SPKI[kem.name] : OKP_SPKI[kem.curve];
+    return nodeCrypto.createPublicKey({ key: _bufferConcat([_hex(prefix), raw]), format: "der", type: "spki" });
   } catch (e) {
     if (e instanceof HpkeError) throw e;
-    throw _err("hpke/bad-key", "invalid " + kem.curve + " public key", e);
+    throw _err("hpke/bad-key", "invalid " + kem.name + " public key" +
+      (kem.kind === "mlkem" ? " (FIPS 203 sec. 7.2 encapsulation key check)" : ""), e);
   }
 }
 function _exportPublic(kem, keyObject) {
-  var jwk = keyObject.export({ format: "jwk" });
+  var pub = keyObject.type === "public" ? keyObject : nodeCrypto.createPublicKey(keyObject);
+  if (kem.kind === "mlkem") {
+    var der = pub.export({ format: "der", type: "spki" }), prefix = _hex(ML_KEM_SPKI[kem.name]);
+    if (der.length !== prefix.length + kem.Npub || !_bufferEquals(_subarray(der, 0, prefix.length), prefix)) {
+      throw _err("hpke/bad-key", "the KeyObject is not an " + kem.name + " key");
+    }
+    return _subarray(der, prefix.length);
+  }
+  var jwk = pub.export({ format: "jwk" });
+  if (jwk.crv !== kem.curve) throw _err("hpke/bad-key", "the KeyObject is not a " + kem.name + " key");
   if (kem.kind === "ec") return concat([Buffer.from([0x04]), _b64u(jwk.x), _b64u(jwk.y)]);
   return _b64u(jwk.x);
 }
 function _b64u(s) { return guard.encoding.base64url(s, null, _err, "hpke/bad-key", "JWK coordinate"); }
 
-function _importPrivate(kem, rawSk, rawPk) {
+function _scalarInRange(d, order) {
+  return _compare(d, _bufferAlloc(d.length)) > 0 && _compare(d, order) < 0;
+}
+function _importPrivate(kem, rawSk) {
+  if (!_isBuffer(rawSk) || rawSk.length !== kem.Nsk) {
+    throw _err("hpke/bad-key", kem.name + " private key must be " +
+      (kem.kind === "mlkem" ? "the 64-byte seed" : "the " + kem.Nsk + "-byte scalar") + " as a Buffer");
+  }
+  var der;
+  if (kem.kind === "ec") {
+    var sec1 = EC_SEC1[kem.curve];
+    if (!_scalarInRange(rawSk, _hex(sec1.order))) throw _err("hpke/bad-key", kem.name + " private scalar is outside [1, n-1]");
+    der = _bufferConcat([_hex(sec1.head), rawSk, _hex(sec1.tail)]);
+  } else {
+    der = _bufferConcat([_hex(kem.kind === "mlkem" ? ML_KEM_PKCS8[kem.name] : OKP_PKCS8[kem.curve]), rawSk]);
+  }
   try {
-    if (kem.kind === "ec") {
-      var jwk = { kty: "EC", crv: kem.curve, d: rawSk.toString("base64url") };
-      if (rawPk) { jwk.x = rawPk.subarray(1, 1 + (rawPk.length - 1) / 2).toString("base64url"); jwk.y = rawPk.subarray(1 + (rawPk.length - 1) / 2).toString("base64url"); }
-      return nodeCrypto.createPrivateKey({ key: jwk, format: "jwk" });
-    }
-    return nodeCrypto.createPrivateKey({ key: Buffer.from(OKP_PKCS8[kem.curve] + rawSk.toString("hex"), "hex"), format: "der", type: "pkcs8" });
+    return nodeCrypto.createPrivateKey({ key: der, format: "der", type: kem.kind === "ec" ? "sec1" : "pkcs8" });
   } catch (e) {
-    throw _err("hpke/bad-key", "invalid " + kem.curve + " private key", e);
+    throw _err("hpke/bad-key", "invalid " + kem.name + " private key", e);
+  } finally {
+    guard.secret.zeroize(der, HpkeError, "hpke/bad-input", "the private key envelope");
   }
 }
+function _boundPublic(kem, privateKey, pkm) {
+  var derived = _exportPublic(kem, nodeCrypto.createPublicKey(privateKey));
+  if (pkm === undefined) return derived;
+  if (!_isBuffer(pkm) || !_bufferEquals(derived, pkm)) {
+    throw _err("hpke/bad-key", "pkm is not the " + kem.name + " public key derived from skm");
+  }
+  return derived;
+}
 function _dh(privateKey, publicKey) {
   try {
     return nodeCrypto.diffieHellman({ privateKey: privateKey, publicKey: publicKey });
@@ -164,12 +231,33 @@ function _extractAndExpand(kem, dh, kemContext) {
 function _kemId(kem) { for (var k in KEMS) if (KEMS[k] === kem) return Number(k); return 0; }
 
 function _ephemeral(kem, eph) {
-  if (eph) return { skE: _importPrivate(kem, eph.skm, eph.pkm), enc: _buf(eph.pkm) };
+  if (eph != null) {
+    if (typeof eph !== "object") throw _err("hpke/bad-input", "eph must be { skm, pkm } (a fixed ephemeral key pair), got " + guard.text.showValue(eph));
+    var skE = _importPrivate(kem, eph.skm);
+    return { skE: skE, enc: _boundPublic(kem, skE, eph.pkm) };
+  }
   var kp = _generate(kem);
   return { skE: kp.privateKey, enc: _exportPublic(kem, kp.publicKey) };
 }
 function _wipeDh(dh) { guard.secret.zeroize(dh, HpkeError, "hpke/bad-input", "the KEM shared secret"); }
+function _mlKemEncap(kem, pkR, eph) {
+  if (eph != null) {
+    throw _err("hpke/bad-input", "eph (a fixed ephemeral key pair) applies to a DHKEM suite; " + kem.name + " encapsulation takes its randomness from the runtime");
+  }
+  var r;
+  try { r = nodeCrypto.encapsulate(pkR); }
+  catch (e) { throw _err("hpke/bad-key", kem.name + " encapsulation failed", e); }
+  return { sharedSecret: r.sharedKey, enc: r.ciphertext };
+}
+function _mlKemDecap(kem, enc, skR) {
+  if (enc.length !== kem.Nenc) {
+    throw _err("hpke/bad-key", kem.name + " encapsulated key must be " + kem.Nenc + " bytes (FIPS 203 sec. 7.3 ciphertext check)");
+  }
+  try { return nodeCrypto.decapsulate(skR, enc); }
+  catch (e) { throw _err("hpke/bad-key", kem.name + " decapsulation failed", e); }
+}
 function _encap(kem, pkR, pkRm, eph) {
+  if (kem.kind === "mlkem") return _mlKemEncap(kem, pkR, eph);
   var e = _ephemeral(kem, eph);
   var dh = null;
   try {
@@ -178,6 +266,7 @@ function _encap(kem, pkR, pkRm, eph) {
   } finally { _wipeDh(dh); }
 }
 function _decap(kem, enc, skR, pkRm) {
+  if (kem.kind === "mlkem") return _mlKemDecap(kem, enc, skR);
   var pkE = _importPublic(kem, enc);
   var dh = null;
   try {
@@ -307,14 +396,32 @@ function _recipPublic(suite, pk) {
   }
 }
 function _recipPrivate(suite, sk) {
-  if (sk && sk.skm) return { key: _importPrivate(suite.kem, sk.skm, sk.pkm), pkm: sk.pkm };
-  if (Buffer.isBuffer(sk)) throw _err("hpke/bad-key", "a serialized private key must be provided as { skm, pkm } (raw scalar + public point), not a bare buffer");
+  var kem = suite.kem;
+  if (sk && sk.skm != null) {
+    var key = _importPrivate(kem, sk.skm);
+    return { key: key, pkm: _boundPublic(kem, key, sk.pkm) };
+  }
+  if (_isBuffer(sk)) {
+    throw _err("hpke/bad-key", "a serialized " + kem.name + " private key must be provided as { skm" +
+      (kem.kind === "mlkem" ? " } holding the 64-byte seed" : ", pkm } (the raw scalar, and optionally its public key)") + ", not a bare buffer");
+  }
   try {
-    var pkm = _exportPublic(suite.kem, nodeCrypto.createPublicKey(sk));
+    if (sk.type !== "private") throw _err("hpke/bad-key", "the private key must be a private KeyObject or { skm, pkm }, got a " + guard.text.showValue(sk.type) + " KeyObject");
+    var pkm = _exportPublic(kem, nodeCrypto.createPublicKey(sk));
     return { key: sk, pkm: pkm };
   } catch (e) {
     if (e instanceof HpkeError) throw e;
-    throw _err("hpke/bad-key", "invalid recipient private key (expected a node KeyObject or { skm, pkm })", e);
+    throw _err("hpke/bad-key", "invalid private key (expected a node KeyObject or { skm, pkm })", e);
+  }
+}
+function _requireAuthCapable(kem) {
+  if (kem.kind === "mlkem") {
+    throw _err("hpke/auth-unsupported", kem.name + " defines no AuthEncap / AuthDecap (draft-ietf-hpke-pq sec. 7.2); use the psk mode or a signature");
+  }
+}
+function _refuseUnusedAuthKey(value, name, mode) {
+  if (value != null) {
+    throw _err("hpke/bad-input", name + " applies to the auth and auth-psk modes; mode " + mode + " would leave it unused, so the exchange it was meant to authenticate would not be");
   }
 }
 
@@ -332,7 +439,7 @@ var _SETUP_S_KEYS = _withCommon({
 var _SETUP_R_KEYS = _withCommon({
   senderPublicKey: 1,
 });
-function _mode(opts, keys, who) {
+function _options(opts, keys, who) {
   guard.identifier.assertKnownKeys(opts, keys, _err, "hpke/bad-input", function (k) {
     var other = (keys === _SETUP_S_KEYS ? _SETUP_R_KEYS : _SETUP_S_KEYS);
     return "unknown HPKE " + who + " option " + JSON.stringify(k) +
@@ -340,17 +447,21 @@ function _mode(opts, keys, who) {
         ? " -- that option belongs to the other end of the exchange, where it would authenticate or seed; here it would do nothing"
         : "") + " -- accepted: " + Object.keys(keys).sort().join(", ");
   });
-  var mode = (opts.mode == null) ? MODE_BASE : opts.mode;
-  if (mode !== MODE_BASE && mode !== MODE_PSK && mode !== MODE_AUTH && mode !== MODE_AUTH_PSK) {
-    throw _err("hpke/unknown-mode", "unsupported HPKE mode " + guard.text.showValue(mode) + " (RFC 9180 sec. 5.1 defines base / psk / auth / auth-psk)");
+  var o = guard.identifier.snapshotOptions(opts, keys);
+  if (o.mode == null) o.mode = MODE_BASE;
+  if (o.mode !== MODE_BASE && o.mode !== MODE_PSK && o.mode !== MODE_AUTH && o.mode !== MODE_AUTH_PSK) {
+    throw _err("hpke/unknown-mode", "unsupported HPKE mode " + guard.text.showValue(o.mode) + " (RFC 9180 sec. 5.1 defines base / psk / auth / auth-psk)");
   }
-  return mode;
+  return o;
 }
 
 // @module @intro; a data registry, not a callable primitive).
 var suites = intrinsic.assign(intrinsic.create(null), {
-  KEM: intrinsic.assign(intrinsic.create(null), { DHKEM_P256_HKDF_SHA256: 0x0010, DHKEM_P521_HKDF_SHA512: 0x0012, DHKEM_X25519_HKDF_SHA256: 0x0020, DHKEM_X448_HKDF_SHA512: 0x0021 }),
-  KDF: intrinsic.assign(intrinsic.create(null), { HKDF_SHA256: 0x0001, HKDF_SHA512: 0x0003 }),
+  KEM: intrinsic.assign(intrinsic.create(null), {
+    DHKEM_P256_HKDF_SHA256: 0x0010, DHKEM_P521_HKDF_SHA512: 0x0012, DHKEM_X25519_HKDF_SHA256: 0x0020, DHKEM_X448_HKDF_SHA512: 0x0021,
+    ML_KEM_512: 0x0040, ML_KEM_768: 0x0041, ML_KEM_1024: 0x0042,
+  }),
+  KDF: intrinsic.assign(intrinsic.create(null), { HKDF_SHA256: 0x0001, HKDF_SHA384: 0x0002, HKDF_SHA512: 0x0003 }),
   AEAD: intrinsic.assign(intrinsic.create(null), { AES_128_GCM: 0x0001, AES_256_GCM: 0x0002, CHACHA20_POLY1305: 0x0003, EXPORT_ONLY: 0xFFFF }),
   MODE: intrinsic.assign(intrinsic.create(null), { BASE: MODE_BASE, PSK: MODE_PSK, AUTH: MODE_AUTH, AUTH_PSK: MODE_AUTH_PSK }),
 });
@@ -369,9 +480,13 @@ var suites = intrinsic.assign(intrinsic.create(null), {
  * (send it to the recipient) and a `context` whose `.seal(aad, pt)` /
  * `.export(ctx, L)` encrypt and derive further secrets. `suiteIds` is
  * `{ kem, kdf, aead }` from `pki.hpke.suites`; `recipientPublicKey` is a node
- * KeyObject or the serialized public key bytes. `opts.mode` selects base / psk /
- * auth / auth-psk (default base); `opts.info`, `opts.psk`/`opts.pskId`, and
- * `opts.senderKey` (auth modes) supply the corresponding inputs.
+ * KeyObject or the serialized public key bytes (the uncompressed point, the raw
+ * Montgomery coordinate, or the ML-KEM encapsulation key). `opts.mode` selects
+ * base / psk / auth / auth-psk (default base); `opts.info`, `opts.psk`/`opts.pskId`,
+ * and `opts.senderKey` (auth modes) supply the corresponding inputs; an option that
+ * belongs to another mode, such as `senderKey` in base mode, is refused with
+ * `hpke/bad-input` rather than left unused. The auth modes exist for the DHKEM
+ * suites only: an ML-KEM suite throws `hpke/auth-unsupported`.
  *
  * @example
  *   var s = pki.hpke.suites, ids = { kem: s.KEM.DHKEM_X25519_HKDF_SHA256, kdf: s.KDF.HKDF_SHA256, aead: s.AEAD.AES_128_GCM };
@@ -380,17 +495,18 @@ var suites = intrinsic.assign(intrinsic.create(null), {
  *   var ct = sender.context.seal(Buffer.from("aad"), Buffer.from("secret"));
  */
 function _setupS(ids, pkR, opts) {
-  opts = opts || {};
   var suite = _suite(ids);
-  var mode = _mode(opts, _SETUP_S_KEYS, "sender setup");
+  opts = _options(opts || {}, _SETUP_S_KEYS, "sender setup");
+  var mode = opts.mode;
   var r = _recipPublic(suite, pkR);
   var kem = suite.kem, k;
   if (mode === MODE_AUTH || mode === MODE_AUTH_PSK) {
-    if (kem.kind !== "ec" && kem.kind !== "okp") throw _err("hpke/auth-unsupported", "the KEM does not support authenticated modes");
+    _requireAuthCapable(kem);
     if (opts.senderKey == null) throw _err("hpke/auth-key-required", "an authenticated mode requires opts.senderKey (the sender's KEM private key, RFC 9180 sec. 5.1.3)");
     var s = _recipPrivate(suite, opts.senderKey);
     k = _authEncap(kem, r.key, r.pkm, s.key, s.pkm, opts.eph);
   } else {
+    _refuseUnusedAuthKey(opts.senderKey, "senderKey", mode);
     k = _encap(kem, r.key, r.pkm, opts.eph);
   }
   var ctx = _keySchedule(suite, mode, k.sharedSecret, _buf(opts.info), _buf(opts.psk), _buf(opts.pskId), "S");
@@ -405,12 +521,14 @@ function _setupS(ids, pkR, opts) {
  * @related pki.hpke.setupS, pki.hpke.open
  *
  * Establish the recipient HPKE context from the sender's encapsulated key `enc`
- * and the recipient KEM private key (a node KeyObject, or `{ skm, pkm }` holding
- * the raw private scalar plus its public point),
- * recovering the same shared secret and key schedule. The returned `context`
- * `.open(aad, ct)` decrypts and `.export(ctx, L)` derives secrets. `opts` mirrors
- * `setupS` (mode / info / psk / pskId), with `opts.senderPublicKey` for the auth
- * modes. A ciphertext whose tag does not verify throws `hpke/open-failed`.
+ * and the recipient KEM private key, recovering the same shared secret and key
+ * schedule. The private key is a node KeyObject, or `{ skm, pkm }` where `skm` is
+ * the raw private scalar of a DHKEM suite or the 64-byte seed of an ML-KEM suite;
+ * `pkm` is optional, and when given it must be the public key derived from `skm`
+ * or the call throws `hpke/bad-key`. The returned `context` `.open(aad, ct)`
+ * decrypts and `.export(ctx, L)` derives secrets. `opts` mirrors `setupS` (mode /
+ * info / psk / pskId), with `opts.senderPublicKey` for the auth modes (DHKEM
+ * suites only). A ciphertext whose tag does not verify throws `hpke/open-failed`.
  *
  * @example
  *   var s = pki.hpke.suites, ids = { kem: s.KEM.DHKEM_X25519_HKDF_SHA256, kdf: s.KDF.HKDF_SHA256, aead: s.AEAD.AES_128_GCM };
@@ -421,16 +539,18 @@ function _setupS(ids, pkR, opts) {
  *   var pt = recipient.open(Buffer.alloc(0), sender.context.seal(Buffer.alloc(0), Buffer.from("hi")));
  */
 function _setupR(ids, enc, skR, opts) {
-  opts = opts || {};
   var suite = _suite(ids);
-  var mode = _mode(opts, _SETUP_R_KEYS, "recipient setup");
+  opts = _options(opts || {}, _SETUP_R_KEYS, "recipient setup");
+  var mode = opts.mode;
   var r = _recipPrivate(suite, skR);
   var kem = suite.kem, ss;
   if (mode === MODE_AUTH || mode === MODE_AUTH_PSK) {
+    _requireAuthCapable(kem);
     if (opts.senderPublicKey == null) throw _err("hpke/auth-key-required", "an authenticated mode requires opts.senderPublicKey (the sender's KEM public key, RFC 9180 sec. 5.1.3)");
     var pkS = _recipPublic(suite, opts.senderPublicKey);
     ss = _authDecap(kem, _buf(enc), r.key, r.pkm, pkS.key, pkS.pkm);
   } else {
+    _refuseUnusedAuthKey(opts.senderPublicKey, "senderPublicKey", mode);
     ss = _decap(kem, _buf(enc), r.key, r.pkm);
   }
   try { return _keySchedule(suite, mode, ss, _buf(opts.info), _buf(opts.psk), _buf(opts.pskId), "R"); }
@@ -451,9 +571,9 @@ function _setupR(ids, enc, skR, opts) {
  * `setupS` options object (mode / info / psk / senderKey).
  *
  * @example
- *   var s = pki.hpke.suites, ids = { kem: s.KEM.DHKEM_X25519_HKDF_SHA256, kdf: s.KDF.HKDF_SHA256, aead: s.AEAD.AES_256_GCM };
- *   var pkR = Buffer.from("8c7781768956b9dd38997c5a83ab5b9315270a9f73d87d676573c5bca74e3e48", "hex");
- *   var out = pki.hpke.seal(ids, pkR, {}, Buffer.from("aad"), Buffer.from("msg"));
+ *   // requires: mlKemPkR -- the recipient's ML-KEM-768 encapsulation key (1184 bytes)
+ *   var s = pki.hpke.suites, ids = { kem: s.KEM.ML_KEM_768, kdf: s.KDF.HKDF_SHA256, aead: s.AEAD.AES_256_GCM };
+ *   var out = pki.hpke.seal(ids, mlKemPkR, {}, Buffer.from("aad"), Buffer.from("msg"));
  */
 function seal(ids, pkR, opts, aad, pt) {
   var s = null;
@@ -481,11 +601,11 @@ function seal(ids, pkR, opts, aad, pt) {
  * verify throws `hpke/open-failed` and returns no plaintext.
  *
  * @example
- *   var s = pki.hpke.suites, ids = { kem: s.KEM.DHKEM_X25519_HKDF_SHA256, kdf: s.KDF.HKDF_SHA256, aead: s.AEAD.AES_256_GCM };
- *   var pkR = Buffer.from("8c7781768956b9dd38997c5a83ab5b9315270a9f73d87d676573c5bca74e3e48", "hex");
- *   var skR = Buffer.from("009f2181fba5f8908632c10ea1137c40a849728fde016c4602458b943a5dc048", "hex");
- *   var o = pki.hpke.seal(ids, pkR, {}, Buffer.alloc(0), Buffer.from("m"));
- *   var pt = pki.hpke.open(ids, o.enc, { skm: skR, pkm: pkR }, {}, Buffer.alloc(0), o.ct);
+ *   // requires: mlKemPkR -- the recipient's ML-KEM-768 encapsulation key (1184 bytes)
+ *   // requires: mlKemSkR -- { skm } holding the recipient's 64-byte ML-KEM-768 seed
+ *   var s = pki.hpke.suites, ids = { kem: s.KEM.ML_KEM_768, kdf: s.KDF.HKDF_SHA256, aead: s.AEAD.AES_256_GCM };
+ *   var o = pki.hpke.seal(ids, mlKemPkR, {}, Buffer.alloc(0), Buffer.from("m"));
+ *   var pt = pki.hpke.open(ids, o.enc, mlKemSkR, {}, Buffer.alloc(0), o.ct);
  */
 function open(ids, enc, skR, opts, aad, ct) {
   var ctx = _setupR(ids, enc, skR, opts);

package/lib/sigstore.js

@@ -33,6 +33,7 @@ var frameworkError = require("./framework-error");
 var constants = require("./constants");
 var asn1 = require("./asn1-der");
 var guard = require("./guard-all");
+var intrinsic = require("./guard-intrinsic");
 var x509 = require("./schema-x509");
 var pkix = require("./schema-pkix");
 var pathValidate = require("./path-validate");
@@ -41,6 +42,59 @@ var oid = require("./oid");
 var ct = require("./ct");
 var edwardsPoint = require("./edwards-point");
 
+/** @internal The operations this module decides with, taken at load. The bundle copy every later
+ * check runs on settles what is verified, so which function answers "what does this object own" and
+ * "what does it hold" is fixed before any caller code runs; one replaced after this module loads
+ * would otherwise be asked at the moment of the call. An emptied key list alone turns a bundle into
+ * one carrying no content arm. */
+var _ownNames = intrinsic.getOwnPropertyNames;
+var _ownDescriptor = intrinsic.getOwnPropertyDescriptor;
+var _isArray = intrinsic.isArray;
+var _create = intrinsic.create;
+var _assign = intrinsic.assign;
+var _freeze = intrinsic.freeze;
+var _stringOf = intrinsic.String;
+var _numberOf = intrinsic.Number;
+var _bigIntOf = intrinsic.BigInt;
+var _Date = intrinsic.Date;
+var _dateParse = intrinsic.dateParse;
+var _isNaN = intrinsic.numberIsNaN;
+/** @internal Whether an object OWNS a name. The oneof rules are written on this question, so a
+ * replacement answering no for one arm hides it and a bundle setting two is read as setting one. */
+var _hasOwn = intrinsic.hasOwn;
+var _isFiniteNumber = intrinsic.numberIsFinite;
+var _isSafeInt = intrinsic.isSafeInteger;
+var _isBuffer = intrinsic.isBuffer;
+var _bufferFrom = intrinsic.bufferFrom;
+var _bufferConcat = intrinsic.bufferConcat;
+var _bufToString = intrinsic.bufToString;
+var _bufferEquals = intrinsic.bufferEquals;
+var _subarray = intrinsic.subarray;
+var _bufIndexOf = intrinsic.uncurry(Buffer.prototype.indexOf);
+/** @internal The canonical form a Rekor signed entry timestamp is verified over. A replacement
+ * writing different bytes decides what that signature is checked against. */
+var _jsonStringify = intrinsic.stringify;
+/** @internal Every field the copy holds is DEFINED as its own, never assigned. An assignment consults
+ * the target's prototype for a setter, and something that installs one sees each field the copy
+ * writes and can hand back a different one, so a malformed value arrives valid and the checks read
+ * what the caller never sent. Defining reaches no prototype. */
+var _defineProp = intrinsic.defineProperty;
+var _isFiniteNum = intrinsic.isFinite;
+/** @internal Uncurried, so the copy reads a character's code through the operation taken at load
+ * rather than through whatever the string it is walking offers under that name. What a character
+ * costs decides whether a bundle passes the size limit. */
+var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
+var _charAt = intrinsic.uncurry(String.prototype.charAt);
+var _strSlice = intrinsic.uncurry(String.prototype.slice);
+var _strIndexOf = intrinsic.stringIndexOf;
+var _split = intrinsic.uncurry(String.prototype.split);
+var _join = intrinsic.join;
+var _map = intrinsic.map;
+var _forEach = intrinsic.forEach;
+var _filter = intrinsic.filter;
+var _arraySlice = intrinsic.arraySlice;
+var _fromCharCode = intrinsic.fromCharCode;
+
 var C = constants;
 var SigstoreError = frameworkError.SigstoreError;
 function _err(code, message, cause) { return new SigstoreError(code, message, cause); }
@@ -62,7 +116,7 @@ function _armPresent(obj, name) {
  * records. A member this table does not carry is refused rather than mapped by guessing at its name,
  * so a member added to the enum later cannot be read as one of these.
  * HASH_ALGORITHM_UNSPECIFIED is absent for the reason it exists: it names no algorithm. */
-var _HASH_BY_ENUM = Object.freeze(Object.assign(Object.create(null), {
+var _HASH_BY_ENUM = _freeze(_assign(_create(null), {
   SHA2_256: { node: "sha256", bytes: 32 },
   SHA2_384: { node: "sha384", bytes: 48 },
   SHA2_512: { node: "sha512", bytes: 64 },
@@ -74,7 +128,7 @@ var _HASH_BY_ENUM = Object.freeze(Object.assign(Object.create(null), {
  * a parser "accept[s] both enum names and integer values", so a bundle naming its digest algorithm as
  * 1 is one a conforming producer may write and this reads it as the name it stands for. Zero is
  * absent for the reason the name it belongs to is: HASH_ALGORITHM_UNSPECIFIED names no algorithm. */
-var _HASH_BY_NUMBER = Object.freeze(Object.assign(Object.create(null), {
+var _HASH_BY_NUMBER = _freeze(_assign(_create(null), {
   1: _HASH_BY_ENUM.SHA2_256,
   2: _HASH_BY_ENUM.SHA2_384,
   3: _HASH_BY_ENUM.SHA2_512,
@@ -96,7 +150,7 @@ function _hashOf(algorithm) {
 /** @internal The same three algorithms keyed the way a hashedrekord names them. The entry is the
  * authenticated statement of what was signed, so its algorithm is the one the artifact is digested
  * under; the schema enumerates exactly these three. */
-var _HASH_BY_REKOR = Object.freeze(Object.assign(Object.create(null), {
+var _HASH_BY_REKOR = _freeze(_assign(_create(null), {
   sha256: { node: "sha256", bytes: 32 },
   sha384: { node: "sha384", bytes: 48 },
   sha512: { node: "sha512", bytes: 64 },
@@ -109,64 +163,35 @@ var JSON_MAX = C.LIMITS.JSON_MAX_BYTES;
  * applied alone would admit it one way and refuse it the other. */
 var BUNDLE_MAX_DEPTH = 64;
 
-/** @internal The operations the bundle copy decides with, taken at load. That copy is what every
- * later check runs on, so which function answers "what does this object own" and "what does it hold"
- * settles what is verified; one replaced after this module loads would otherwise be asked at the
- * moment of the call. An emptied key list alone turns a bundle into one carrying no content arm. */
-var _ownNames = Object.getOwnPropertyNames;
-var _ownDescriptor = Object.getOwnPropertyDescriptor;
-var _isArray = Array.isArray;
-var _create = Object.create;
-var _stringOf = String;
-/** @internal Whether an object OWNS a name. The oneof rules are written on this question, so a
- * replacement answering no for one arm hides it and a bundle setting two is read as setting one. */
-var _hasOwn = Function.prototype.call.bind(Object.prototype.hasOwnProperty);
-var _isFiniteNumber = Number.isFinite;
-var _isSafeInt = Number.isSafeInteger;
-var _isBuffer = Buffer.isBuffer;
-var _bufferFrom = Buffer.from;
-/** @internal The canonical form a Rekor signed entry timestamp is verified over. A replacement
- * writing different bytes decides what that signature is checked against. */
-var _jsonStringify = JSON.stringify;
-/** @internal Every field the copy holds is DEFINED as its own, never assigned. An assignment consults
- * the target's prototype for a setter, and something that installs one sees each field the copy
- * writes and can hand back a different one, so a malformed value arrives valid and the checks read
- * what the caller never sent. Defining reaches no prototype. */
-var _defineProp = Object.defineProperty;
-var _isFiniteNum = isFinite;
-/** @internal Uncurried, so the copy reads a character's code through the operation taken at load
- * rather than through whatever the string it is walking offers under that name. What a character
- * costs decides whether a bundle passes the size limit. */
-var _charCodeAt = Function.prototype.call.bind(String.prototype.charCodeAt);
-var SP = Buffer.from(" ", "ascii");
-var DSSEV1 = Buffer.from("DSSEv1", "ascii");
-var _EM_DASH = String.fromCharCode(0x2014);
+var SP = _bufferFrom(" ", "ascii");
+var DSSEV1 = _bufferFrom("DSSEv1", "ascii");
+var _EM_DASH = _fromCharCode(0x2014);
 
 function _parseNoteSig(line) {
   var prefix = _EM_DASH + " ";
-  if (line.slice(0, prefix.length) !== prefix) return null;
+  if (_strSlice(line, 0, prefix.length) !== prefix) return null;
   var p = prefix.length, n = line.length;
   var t1s = p;
-  while (p < n && !pkix.isJsWhitespace(line.charCodeAt(p))) p += 1;
+  while (p < n && !pkix.isJsWhitespace(_charCodeAt(line, p))) p += 1;
   if (p === t1s) return null;
-  var keyId = line.slice(t1s, p);
-  if (line.charAt(p) !== " ") return null;
+  var keyId = _strSlice(line, t1s, p);
+  if (_charAt(line, p) !== " ") return null;
   p += 1;
   var t2s = p;
-  while (p < n && !pkix.isJsWhitespace(line.charCodeAt(p))) p += 1;
+  while (p < n && !pkix.isJsWhitespace(_charCodeAt(line, p))) p += 1;
   if (p === t2s) return null;
-  var sig = line.slice(t2s, p);
+  var sig = _strSlice(line, t2s, p);
   if (p !== n) return null;
   return { keyId: keyId, sig: sig };
 }
 
 function _stripTrailingEquals(s) {
   var i = s.length;
-  while (i > 0 && s.charAt(i - 1) === "=") i -= 1;
-  return s.slice(0, i);
+  while (i > 0 && _charAt(s, i - 1) === "=") i -= 1;
+  return _strSlice(s, 0, i);
 }
 
-var _BUNDLE_MEDIA_TYPES = Object.assign(Object.create(null), {
+var _BUNDLE_MEDIA_TYPES = _assign(_create(null), {
   "application/vnd.dev.sigstore.bundle.v0.1+json": 1,
   "application/vnd.dev.sigstore.bundle.v0.2+json": 1,
   "application/vnd.dev.sigstore.bundle.v0.3+json": 1,
@@ -206,22 +231,22 @@ function _jsonParse(input, code, label) {
  */
 function pae(payloadType, payloadBytes) {
   if (typeof payloadType !== "string") throw new TypeError("pae: payloadType must be a string");
-  var type = Buffer.from(payloadType, "utf8");
+  var type = _bufferFrom(payloadType, "utf8");
   var body = _isBuffer(payloadBytes) ? payloadBytes : _bufferFrom(payloadBytes || []);
-  return Buffer.concat([
+  return _bufferConcat([
     DSSEV1, SP,
-    Buffer.from(String(type.length), "ascii"), SP, type, SP,
-    Buffer.from(String(body.length), "ascii"), SP, body,
+    _bufferFrom(_stringOf(type.length), "ascii"), SP, type, SP,
+    _bufferFrom(_stringOf(body.length), "ascii"), SP, body,
   ]);
 }
 
 
 function _b64(s, label) {
   if (typeof s !== "string") throw _err("sigstore/bad-bundle", label + " must be a base64 string");
-  var urlSafe = s.indexOf("-") !== -1 || s.indexOf("_") !== -1;
+  var urlSafe = _strIndexOf(s, "-") !== -1 || _strIndexOf(s, "_") !== -1;
   var enc = urlSafe ? "base64url" : "base64";
-  var buf = Buffer.from(s, enc);
-  if (_stripTrailingEquals(buf.toString(enc)) !== _stripTrailingEquals(s)) {
+  var buf = _bufferFrom(s, enc);
+  if (_stripTrailingEquals(_bufToString(buf, enc)) !== _stripTrailingEquals(s)) {
     throw _err("sigstore/bad-bundle", label + " is not canonical base64");
   }
   return buf;
@@ -358,7 +383,7 @@ function _chargeString(budget, s) {
 function _numOf(v) {
   var t = typeof v;
   if (t === "number") return v;
-  if (t === "string" || t === "boolean") return Number(v);
+  if (t === "string" || t === "boolean") return _numberOf(v);
   return NaN;
 }
 
@@ -583,7 +608,7 @@ function _leafCertDer(vm) {
 }
 function _chainDers(vm) {
   if (vm.x509CertificateChain && _isArray(vm.x509CertificateChain.certificates)) {
-    return vm.x509CertificateChain.certificates.map(function (c, i) { return _certBytes(c, "x509CertificateChain[" + i + "]"); });
+    return _map(vm.x509CertificateChain.certificates, function (c, i) { return _certBytes(c, "x509CertificateChain[" + i + "]"); });
   }
   return [_leafCertDer(vm)];
 }
@@ -619,8 +644,8 @@ function _sha256(buf) { return nodeCrypto.createHash("sha256").update(buf).diges
 function _toMs(x) {
   if (x == null) return null;
   if (typeof x === "number") return _isFiniteNumber(x) ? x : null;
-  if (guard.time.isDate(x)) { var d = guard.time.instantOf(x); return isNaN(d) ? null : d; }
-  if (typeof x === "string") { var t = Date.parse(x); return isNaN(t) ? null : t; }
+  if (guard.time.isDate(x)) { var d = guard.time.instantOf(x); return _isNaN(d) ? null : d; }
+  if (typeof x === "string") { var t = _dateParse(x); return _isNaN(t) ? null : t; }
   return null;
 }
 function _inWindow(timeMs, vf) {
@@ -632,29 +657,29 @@ function _inWindow(timeMs, vf) {
 function _rekorKey(rekorKeys, keyIdBuf, hint, timeMs) {
   for (var i = 0; i < rekorKeys.length; i++) {
     var k = rekorKeys[i];
-    var match = (keyIdBuf && k.keyId && k.keyId.equals(keyIdBuf)) ||
-      (hint && k.keyId && k.keyId.length >= 4 && k.keyId.subarray(0, 4).equals(hint));
+    var match = (keyIdBuf && k.keyId && _bufferEquals(k.keyId, keyIdBuf)) ||
+      (hint && k.keyId && k.keyId.length >= 4 && _bufferEquals(_subarray(k.keyId, 0, 4), hint));
     if (match && _inWindow(timeMs, k.validFor)) return k;
   }
   return null;
 }
 
 function _verifyCheckpoint(envelope, ip, rekorKeys, timeMs) {
-  var buf = Buffer.from(envelope, "utf8");
-  var sep = buf.indexOf("\n\n");
+  var buf = _bufferFrom(envelope, "utf8");
+  var sep = _bufIndexOf(buf, "\n\n");
   if (sep < 0) throw _err("sigstore/bad-checkpoint", "the checkpoint has no note/signature separator");
-  var body = buf.subarray(0, sep + 1);
-  var lines = body.toString("utf8").split("\n");
-  if (_b64(lines[2], "checkpoint root").toString("hex") !== _b64(ip.rootHash, "inclusionProof.rootHash").toString("hex")) {
+  var body = _subarray(buf, 0, sep + 1);
+  var lines = _split(_bufToString(body, "utf8"), "\n");
+  if (_bufToString(_b64(lines[2], "checkpoint root"), "hex") !== _bufToString(_b64(ip.rootHash, "inclusionProof.rootHash"), "hex")) {
     throw _err("sigstore/inclusion-proof-mismatch", "the checkpoint root does not match the inclusion-proof root");
   }
-  var sigBlock = buf.subarray(sep + 2).toString("utf8").split("\n");
+  var sigBlock = _split(_bufToString(_subarray(buf, sep + 2), "utf8"), "\n");
   for (var i = 0; i < sigBlock.length; i++) {
     var note = _parseNoteSig(sigBlock[i]);
     if (!note) continue;
     var blob = _b64(note.sig, "checkpoint signature");
     if (blob.length < 5) continue;
-    var hint = blob.subarray(0, 4), derSig = blob.subarray(4);
+    var hint = _subarray(blob, 0, 4), derSig = _subarray(blob, 4);
     var k = _rekorKey(rekorKeys, null, hint, timeMs);
     if (!k) continue;
     if (_rawVerify(_pubFromSpki(k.spki, "Rekor log"), body, derSig)) return true;
@@ -671,11 +696,11 @@ function _verifySet(te, rekorKeys, timeMs, canonBody) {
   var canonical = _jsonStringify({
     body: canonBody,
     integratedTime: _numOf(te.integratedTime),
-    logID: keyId.toString("hex"),
+    logID: _bufToString(keyId, "hex"),
     logIndex: _numOf(te.logIndex),
   });
   var sig = _b64(promise.signedEntryTimestamp, "signedEntryTimestamp");
-  return _rawVerify(_pubFromSpki(k.spki, "Rekor log"), Buffer.from(canonical, "utf8"), sig);
+  return _rawVerify(_pubFromSpki(k.spki, "Rekor log"), _bufferFrom(canonical, "utf8"), sig);
 }
 
 /** @internal The entry rows this build reads, keyed on the entry's OWN kind and apiVersion together.
@@ -684,7 +709,7 @@ function _verifySet(te, rekorKeys, timeMs, canonBody) {
  * would read one shape's field names out of the other and report a mismatch rather than an
  * unsupported entry. Each row states which content arm it may accompany, because an entry describing
  * a DSSE envelope says nothing about a message signature and the two must agree. */
-var _ENTRY_ROWS = Object.freeze(Object.assign(Object.create(null), {
+var _ENTRY_ROWS = _freeze(_assign(_create(null), {
   "dsse@0.0.1": { content: "dsseEnvelope", bind: _bindDsseEntry },
   "hashedrekord@0.0.1": { content: "messageSignature", bind: _bindHashedRekordEntry },
 }));
@@ -723,18 +748,18 @@ function _bindDsseEntry(body, envelope, leafDer) {
   }
   var envSig = _b64(envelope.signatures[0].sig, "dsseEnvelope.signatures[0].sig");
   var bodySig = _b64(spec.signatures[0].signature, "Rekor entry signature");
-  if (!envSig.equals(bodySig)) throw _err("sigstore/entry-mismatch", "the Rekor entry signature does not match the bundle signature");
+  if (!_bufferEquals(envSig, bodySig)) throw _err("sigstore/entry-mismatch", "the Rekor entry signature does not match the bundle signature");
   var payload = _b64(envelope.payload, "dsseEnvelope.payload");
   if (!spec.payloadHash || typeof spec.payloadHash.value !== "string") throw _err("sigstore/bad-tlog-entry", "the Rekor dsse entry is missing its payloadHash");
-  if (spec.payloadHash.value !== _sha256(payload).toString("hex")) {
+  if (spec.payloadHash.value !== _bufToString(_sha256(payload), "hex")) {
     throw _err("sigstore/entry-mismatch", "the Rekor entry payloadHash does not match the bundle payload");
   }
   var vf = spec.signatures[0].verifier;
   if (typeof vf !== "string") throw _err("sigstore/bad-tlog-entry", "the Rekor dsse entry is missing its verifier certificate");
   var vDer;
-  try { vDer = x509.pemDecode(_b64(vf, "Rekor entry verifier").toString("utf8"), "CERTIFICATE"); }
+  try { vDer = x509.pemDecode(_bufToString(_b64(vf, "Rekor entry verifier"), "utf8"), "CERTIFICATE"); }
   catch (e) { throw _err("sigstore/bad-tlog-entry", "the Rekor entry verifier is not a valid certificate", e); }
-  if (!vDer.equals(leafDer)) throw _err("sigstore/entry-mismatch", "the Rekor entry verifier certificate does not match the bundle leaf certificate");
+  if (!_bufferEquals(vDer, leafDer)) throw _err("sigstore/entry-mismatch", "the Rekor entry verifier certificate does not match the bundle leaf certificate");
 }
 
 /** @internal The entry's verifier, bound to the bundle's leaf. The Rekor field is "the public key
@@ -744,11 +769,11 @@ function _bindDsseEntry(body, envelope, leafDer) {
  * about it, and the certificate's own identity is settled by the chain leg rather than here. Neither
  * form is guessed at from the bytes: the armor names which one the entry wrote. */
 function _bindVerifier(content, leafDer) {
-  var text = _b64(content, "Rekor entry verifier").toString("utf8");
+  var text = _bufToString(_b64(content, "Rekor entry verifier"), "utf8");
   var vDer;
   try { vDer = x509.pemDecode(text, "CERTIFICATE"); } catch (_e) { vDer = null; } // allow:swallow-unverified the other armor is tried next and a value carrying neither is refused below
   if (vDer !== null) {
-    if (!vDer.equals(leafDer)) {
+    if (!_bufferEquals(vDer, leafDer)) {
       throw _err("sigstore/entry-mismatch", "the Rekor entry verifier certificate does not match the bundle leaf certificate");
     }
     return;
@@ -757,7 +782,7 @@ function _bindVerifier(content, leafDer) {
   try { spki = x509.pemDecode(text, "PUBLIC KEY"); }
   catch (e) { throw _err("sigstore/bad-tlog-entry", "the Rekor entry verifier is neither a certificate nor a public key", e); }
   var leafSpki = _parseCert(leafDer, "Fulcio leaf certificate").subjectPublicKeyInfo.bytes;
-  if (!spki.equals(Buffer.from(leafSpki))) {
+  if (!_bufferEquals(spki, _bufferFrom(leafSpki))) {
     throw _err("sigstore/entry-mismatch", "the Rekor entry verifier public key does not match the bundle leaf certificate's key");
   }
 }
@@ -769,7 +794,7 @@ function _bindVerifier(content, leafDer) {
  * matched through a replaceable protocol. */
 function _isLowerHex(s) {
   for (var i = 0; i < s.length; i++) {
-    var c = s.charCodeAt(i);
+    var c = _charCodeAt(s, i);
     if (!((c >= 0x30 && c <= 0x39) || (c >= 0x61 && c <= 0x66))) return false;
   }
   return s.length > 0;
@@ -792,7 +817,7 @@ function _bindHashedRekordEntry(body, ms, leafDer) {
   }
   var bodySig = _b64(spec.signature.content, "Rekor entry signature");
   var armSig = _b64(ms.signature, "messageSignature.signature");
-  if (!armSig.equals(bodySig)) {
+  if (!_bufferEquals(armSig, bodySig)) {
     throw _err("sigstore/entry-mismatch", "the Rekor entry signature does not match the bundle signature");
   }
   var pk = spec.signature.publicKey;
@@ -855,10 +880,10 @@ function _verifyRekorEntry(te, rekorKeys, leafDer, contentType, bind) {
   var included;
   try {
     included = merkle.verifyInclusion({
-      leafIndex: BigInt(ip.logIndex),
-      treeSize: BigInt(ip.treeSize),
+      leafIndex: _bigIntOf(ip.logIndex),
+      treeSize: _bigIntOf(ip.treeSize),
       leafHash: merkle.leafHash(canonBytes),
-      proof: ip.hashes.map(function (h, i) { return _b64(h, "inclusionProof.hashes[" + i + "]"); }),
+      proof: _map(ip.hashes, function (h, i) { return _b64(h, "inclusionProof.hashes[" + i + "]"); }),
       rootHash: _b64(ip.rootHash, "inclusionProof.rootHash"),
     });
   } catch (e) {
@@ -874,7 +899,7 @@ function _verifyRekorEntry(te, rekorKeys, leafDer, contentType, bind) {
   var li = _numOf(te.logIndex);
   return {
     integratedTime: t, logIndex: _isFiniteNumber(li) ? li : null,
-    logId: te.logId && te.logId.keyId ? _b64(te.logId.keyId, "logId.keyId").toString("hex") : null,
+    logId: te.logId && te.logId.keyId ? _bufToString(_b64(te.logId.keyId, "logId.keyId"), "hex") : null,
     artifactHash: artifactHash,
   };
 }
@@ -883,7 +908,7 @@ function _verifyRekorEntry(te, rekorKeys, leafDer, contentType, bind) {
 function _dn(cert, which) { return cert[which] && cert[which].dn; }
 
 function _normRoots(fulcioRoots) {
-  return fulcioRoots.map(function (r, i) {
+  return _map(fulcioRoots, function (r, i) {
     var der = _isBuffer(r) ? r : (r && (r.der || r.rawBytes));
     if (!_isBuffer(der)) throw _err("sigstore/bad-input", "fulcioRoots[" + i + "] must be a DER Buffer or { der, validFor }");
     return { cert: _parseCert(der, "Fulcio CA root [" + i + "]"), validFor: (r && r.validFor) || null };
@@ -895,7 +920,7 @@ function _pathToAnchor(leaf, anchor, intBySubject) {
   /** @internal Issuers are collected leaf-first and the path is assembled once, so no element is
    * ever moved to a new index: an indexed setter has nothing to intercept and cannot replace the
    * leaf the preceding signature checks authenticated. */
-  var above = [], cur = leaf, seen = Object.create(null), guardN = 0;
+  var above = [], cur = leaf, seen = _create(null), guardN = 0;
   function assemble() {
     var path = [];
     for (var k = above.length - 1; k >= 0; k--) guard.list.append(path, above[k]);
@@ -927,7 +952,7 @@ var OID_SCT_LIST = oid.byName("signedCertificateTimestampList");
 function _normCtLogs(ctLogs) {
   if (!_isArray(ctLogs)) throw _err("sigstore/bad-input", "ctLogs must be an array of { keyId, spki, validFor? }");
   if (ctLogs.length === 0) throw _err("sigstore/bad-input", "ctLogs is empty; omit the option to skip the certificate-transparency check rather than supplying no logs");
-  return ctLogs.map(function (l, i) {
+  return _map(ctLogs, function (l, i) {
     if (l === null || typeof l !== "object") throw _err("sigstore/bad-input", "ctLogs[" + i + "] must be { keyId, spki, validFor? }");
     if (!_isBuffer(l.keyId)) throw _err("sigstore/bad-input", "ctLogs[" + i + "].keyId must be the log id as a Buffer");
     if (!_isBuffer(l.spki)) throw _err("sigstore/bad-input", "ctLogs[" + i + "].spki must be the log's SubjectPublicKeyInfo DER");
@@ -984,24 +1009,24 @@ function _sctVerifies(entry, sct, spki) {
 
 /** @internal A receipt's own instant, in milliseconds. The parser's `timestampMs` is this same value
  * wherever it is representable, and above 2^53 there is no reachable instant either way. */
-function _sctMs(sct) { return Number(sct.timestamp || 0); }
+function _sctMs(sct) { return _numberOf(sct.timestamp || 0); }
 
 function _ctLogFor(logs, logIdBytes, timeMs) {
-  var want = _isBuffer(logIdBytes) ? logIdBytes : Buffer.from(logIdBytes || []);
+  var want = _isBuffer(logIdBytes) ? logIdBytes : _bufferFrom(logIdBytes || []);
   for (var i = 0; i < logs.length; i++) {
-    if (logs[i].keyId.equals(want) && _inWindow(timeMs, logs[i].validFor)) return logs[i];
+    if (_bufferEquals(logs[i].keyId, want) && _inWindow(timeMs, logs[i].validFor)) return logs[i];
   }
   return null;
 }
 
 async function _verifyChain(leaf, chainDers, fulcioRoots, timeMs) {
   var roots = _normRoots(fulcioRoots);
-  var bundleLinks = chainDers.slice(1).map(function (d, i) { return _parseCert(d, "bundle intermediate [" + i + "]"); });
-  var intBySubject = Object.create(null);
+  var bundleLinks = _map(_arraySlice(chainDers, 1), function (d, i) { return _parseCert(d, "bundle intermediate [" + i + "]"); });
+  var intBySubject = _create(null);
   function addInt(c) { guard.list.append(intBySubject[_dn(c, "subject")] = intBySubject[_dn(c, "subject")] || [], c); }
-  roots.forEach(function (r) { addInt(r.cert); });
-  bundleLinks.forEach(addInt);
-  var candidates = roots.filter(function (r) { return _inWindow(timeMs, r.validFor); });
+  _forEach(roots, function (r) { addInt(r.cert); });
+  _forEach(bundleLinks, addInt);
+  var candidates = _filter(roots, function (r) { return _inWindow(timeMs, r.validFor); });
   var lastErr = _err("sigstore/chain-incomplete", "no caller-supplied Fulcio anchor (within its validity window) issues the chain");
   for (var i = 0; i < candidates.length; i++) {
     var anchor = candidates[i].cert;
@@ -1010,7 +1035,7 @@ async function _verifyChain(leaf, chainDers, fulcioRoots, timeMs) {
     var spki = anchor.subjectPublicKeyInfo;
     try {
       var res = await pathValidate.validate(path, {
-        time: new Date(timeMs),
+        time: new _Date(timeMs),
         historicalMode: true,
         trustAnchors: { name: anchor.subject, publicKey: spki.bytes, algorithm: spki.algorithm.oid, parameters: spki.algorithm.parameters },
         requiredEku: ["codeSigning"],
@@ -1030,14 +1055,14 @@ async function _verifyChain(leaf, chainDers, fulcioRoots, timeMs) {
 
 
 var SAN_OID = oid.byName("subjectAltName");
-var FULCIO_PREFIX = oid.byName("otherName").split(".").slice(0, -1).join(".") + ".";
+var FULCIO_PREFIX = _join(_arraySlice(_split(oid.byName("otherName"), "."), 0, -1), ".") + ".";
 function _identity(leaf) {
-  var out = { san: null, extensions: Object.create(null) };
+  var out = { san: null, extensions: _create(null) };
   try {
-    (leaf.extensions || []).forEach(function (ext) {
+    _forEach(leaf.extensions || [], function (ext) {
       if (ext.oid === SAN_OID) { out.san = _sanValue(ext); return; }
-      if (ext.oid.indexOf(FULCIO_PREFIX) === 0) {
-        out.extensions[ext.name || ext.oid] = _fulcioExtValue(ext, Number(ext.oid.slice(FULCIO_PREFIX.length)));
+      if (_strIndexOf(ext.oid, FULCIO_PREFIX) === 0) {
+        out.extensions[ext.name || ext.oid] = _fulcioExtValue(ext, _numberOf(_strSlice(ext.oid, FULCIO_PREFIX.length)));
       }
     });
   } catch (e) {
@@ -1046,7 +1071,7 @@ function _identity(leaf) {
   }
   return out;
 }
-var GN_TYPE = Object.assign(Object.create(null), { 1: "rfc822Name", 2: "dNSName", 6: "uri" });
+var GN_TYPE = _assign(_create(null), { 1: "rfc822Name", 2: "dNSName", 6: "uri" });
 function _sanValue(ext) {
   var seq = asn1.decode(ext.value);
   var names = [];
@@ -1055,7 +1080,7 @@ function _sanValue(ext) {
     if (n.tagClass !== "context") continue;
     var val = null;
     if (!n.constructed && GN_TYPE[n.tagNumber]) {
-      val = { type: GN_TYPE[n.tagNumber], value: asn1.read.octetStringImplicit(n, n.tagNumber).toString("utf8") };
+      val = { type: GN_TYPE[n.tagNumber], value: _bufToString(asn1.read.octetStringImplicit(n, n.tagNumber), "utf8") };
     } else if (n.constructed && n.tagNumber === 0 && (n.children || []).length >= 2) {
       var inner = (n.children[1].children || [])[0] || n.children[1];
       var v;
@@ -1073,13 +1098,13 @@ function _sanValue(ext) {
 }
 function _fulcioExtValue(ext, leafArc) {
   if (!_isBuffer(ext.value)) throw _err("sigstore/bad-certificate", "Fulcio extension " + ext.oid + " has no value");
-  if (leafArc >= 1 && leafArc <= 6) return ext.value.toString("utf8");
+  if (leafArc >= 1 && leafArc <= 6) return _bufToString(ext.value, "utf8");
   return asn1.read.string(asn1.decode(ext.value));
 }
 
 var IDENTITY_FIELDS = ["san", "issuer", "sourceRepositoryURI"];
-var IDENTITY_KEYS = Object.assign(Object.create(null), { san: 1, issuer: 1, sourceRepositoryURI: 1 });
-var _VERIFY_BUNDLE_OPTS = Object.assign(Object.create(null), { fulcioRoots: 1, rekorKeys: 1, ctLogs: 1, identity: 1, predicateType: 1, time: 1, artifact: 1 });
+var IDENTITY_KEYS = _assign(_create(null), { san: 1, issuer: 1, sourceRepositoryURI: 1 });
+var _VERIFY_BUNDLE_OPTS = _assign(_create(null), { fulcioRoots: 1, rekorKeys: 1, ctLogs: 1, identity: 1, predicateType: 1, time: 1, artifact: 1 });
 
 /** @internal The bytes a message signature covers, taken once. There is no shape here in which a
  * caller hands over a precomputed digest: the arm's own field comment forbids using one as a
@@ -1101,21 +1126,21 @@ function _checkIdentity(id, policy) {
   var ran = { san: false, issuer: false, sourceRepositoryURI: false };
   if (policy === undefined || policy === null) return ran;
   if (typeof policy !== "object" || _isArray(policy)) {
-    throw _err("sigstore/bad-input", "opts.identity must be an object naming the identity fields to pin (" + IDENTITY_FIELDS.join(", ") + ")");
+    throw _err("sigstore/bad-input", "opts.identity must be an object naming the identity fields to pin (" + _join(IDENTITY_FIELDS, ", ") + ")");
   }
   guard.identifier.assertKnownKeys(policy, IDENTITY_KEYS, _err, "sigstore/bad-input", "opts.identity has an unknown key ");
-  var asked = IDENTITY_FIELDS.filter(function (f) { return policy[f] !== undefined; });
+  var asked = _filter(IDENTITY_FIELDS, function (f) { return policy[f] !== undefined; });
   if (!asked.length) {
-    throw _err("sigstore/bad-input", "opts.identity constrains nothing -- name at least one of " + IDENTITY_FIELDS.join(", ") + ", or omit it to state that the signer is not being checked");
+    throw _err("sigstore/bad-input", "opts.identity constrains nothing -- name at least one of " + _join(IDENTITY_FIELDS, ", ") + ", or omit it to state that the signer is not being checked");
   }
-  asked.forEach(function (f) {
+  _forEach(asked, function (f) {
     if (typeof policy[f] !== "string" || policy[f] === "") {
       throw _err("sigstore/bad-input", "opts.identity." + f + " must be a non-empty string -- a value that cannot be compared would leave the signer unchecked under a policy that names it");
     }
     ran[f] = true;
   });
   var sanValue = id.san && id.san.value;
-  if (policy.san && sanValue !== policy.san) throw _err("sigstore/identity-mismatch", "the certificate SAN " + JSON.stringify(sanValue) + " does not match the expected identity");
+  if (policy.san && sanValue !== policy.san) throw _err("sigstore/identity-mismatch", "the certificate SAN " + _jsonStringify(sanValue) + " does not match the expected identity");
   if (policy.issuer && policy.issuer !== id.extensions.issuer && policy.issuer !== id.extensions.issuerLegacy) throw _err("sigstore/identity-mismatch", "the certificate OIDC issuer does not match the expected issuer");
   if (policy.sourceRepositoryURI && id.extensions.sourceRepositoryURI !== policy.sourceRepositoryURI) throw _err("sigstore/identity-mismatch", "the certificate source-repository URI does not match");
   return ran;
@@ -1130,7 +1155,7 @@ function _statement(payload, payloadType, expectedPredicate) {
   if (!st || typeof st !== "object" || st._type !== "https://in-toto.io/Statement/v1") throw _err("sigstore/bad-statement", "the payload is not an in-toto Statement v1");
   if (!_isArray(st.subject) || !st.subject.length) throw _err("sigstore/bad-statement", "the in-toto statement has no subject");
   if (expectedPredicate && st.predicateType !== expectedPredicate) {
-    throw _err("sigstore/predicate-mismatch", "the statement predicateType " + JSON.stringify(st.predicateType) + " does not match the expected " + JSON.stringify(expectedPredicate));
+    throw _err("sigstore/predicate-mismatch", "the statement predicateType " + _jsonStringify(st.predicateType) + " does not match the expected " + _jsonStringify(expectedPredicate));
   }
   return st;
 }
@@ -1305,9 +1330,9 @@ async function verifyBundle(bundle, opts) {
       var candidateDigest = null;
       if (isMsg) {
         candidateDigest = nodeCrypto.createHash(candidate.artifactHash.node).update(artifact).digest();
-        if (!guard.crypto.constantTimeEqual(candidateDigest, Buffer.from(candidate.artifactHash.value, "hex"))) {
+        if (!guard.crypto.constantTimeEqual(candidateDigest, _bufferFrom(candidate.artifactHash.value, "hex"))) {
           throw _err("sigstore/artifact-mismatch", "the artifact does not match the one the transparency-log entry records; its " +
-            candidate.artifactHash.algorithm + " digest is " + candidateDigest.toString("hex") + " and the entry names " + candidate.artifactHash.value);
+            candidate.artifactHash.algorithm + " digest is " + _bufToString(candidateDigest, "hex") + " and the entry names " + candidate.artifactHash.value);
         }
       }
       var candidateTime = haveCallerTime ? callerTime : C.TIME.seconds(candidate.integratedTime);
@@ -1337,7 +1362,7 @@ async function verifyBundle(bundle, opts) {
   if (isMsg) {
     digestAlgorithm = rekor.artifactHash.algorithm;
     var computed = artifactComputed;
-    artifactDigest = computed.toString("hex");
+    artifactDigest = _bufToString(computed, "hex");
     if (msParsed.digest !== null) {
       var againstClaim = msParsed.digestAlg.node === rekor.artifactHash.node ? computed
         : nodeCrypto.createHash(msParsed.digestAlg.node).update(artifact).digest();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.7.29",
+  "version": "0.7.31",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:3c9a8588-ff6f-477c-92fd-33c03ea2c98b",
+  "serialNumber": "urn:uuid:12c7bd5e-a715-426d-b609-24c3b76f11be",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-09-12T05:32:15.338Z",
+    "timestamp": "2026-09-12T07:21:39.704Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.7.29",
+      "bom-ref": "@blamejs/pki@0.7.31",
       "type": "application",
       "name": "pki",
-      "version": "0.7.29",
+      "version": "0.7.31",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.7.29",
+      "purl": "pkg:npm/%40blamejs/pki@0.7.31",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.7.29",
+      "ref": "@blamejs/pki@0.7.31",
       "dependsOn": []
     }
   ]