@blamejs/pki 0.8.59 → 0.8.61

package/lib/schema-engine.js

@@ -98,7 +98,7 @@ function isResourceRefusal(e) {
 function withResources(ns, source) {
   if (!source || (source.caps == null && source.budget == null)) return ns;
   var out = Object.create(null);
-  var keys = Object.keys(ns);
+  var keys = intrinsic.keys(ns);
   for (var i = 0; i < keys.length; i++) out[keys[i]] = ns[keys[i]];
   out.caps = source.caps;
   out.budget = source.budget;
@@ -146,11 +146,11 @@ function integerLeaf()    { return { kind: "leaf", read: asn1.read.integer, writ
 function boolean()        { return { kind: "leaf", read: asn1.read.boolean, write: function (v) { return asn1.build.boolean(v); } }; }
 function octetString()    { return { kind: "leaf", read: asn1.read.octetString, write: function (v) { return asn1.build.octetString(v); } }; }
 function bitString()      { return { kind: "leaf", read: function (n) { var b = asn1.read.bitString(n); return { unusedBits: b.unusedBits, bytes: b.bytes }; }, write: function (v) { return asn1.build.bitString(v.bytes, v.unusedBits); } }; }
-function implicitBitString(tag) { return { kind: "leaf", read: function (n) { var b = asn1.read.bitStringImplicit(n, tag); return { unusedBits: b.unusedBits, bytes: b.bytes }; }, write: function (v) { return asn1.build.contextPrimitive(tag, Buffer.concat([Buffer.from([v.unusedBits]), v.bytes])); } }; }
+function implicitBitString(tag) { return { kind: "leaf", read: function (n) { var b = asn1.read.bitStringImplicit(n, tag); return { unusedBits: b.unusedBits, bytes: b.bytes }; }, write: function (v) { return asn1.build.contextPrimitive(tag, intrinsic.bufferConcat([intrinsic.bufferFrom([v.unusedBits]), v.bytes])); } }; }
 function implicitOctetString(tag) { return { kind: "leaf", read: function (n) { return asn1.read.octetStringImplicit(n, tag); }, write: function (v) { return asn1.build.contextPrimitive(tag, v); } }; }
-function implicitNull(tag) { return { kind: "leaf", read: function (n) { return asn1.read.nullImplicit(n, tag); }, write: function () { return asn1.build.contextPrimitive(tag, Buffer.alloc(0)); } }; }
+function implicitNull(tag) { return { kind: "leaf", read: function (n) { return asn1.read.nullImplicit(n, tag); }, write: function () { return asn1.build.contextPrimitive(tag, intrinsic.bufferAlloc(0)); } }; }
 function implicitInteger(tag) { return { kind: "leaf", read: function (n) { return asn1.read.integerImplicit(n, tag); }, write: function (v) { return asn1.build.contextPrimitive(tag, _implicitIntContent(v)); } }; }
-function implicitBoolean(tag) { return { kind: "leaf", read: function (n) { return asn1.read.booleanImplicit(n, tag); }, write: function (v) { return asn1.build.contextPrimitive(tag, Buffer.from([v ? 0xff : 0x00])); } }; }
+function implicitBoolean(tag) { return { kind: "leaf", read: function (n) { return asn1.read.booleanImplicit(n, tag); }, write: function (v) { return asn1.build.contextPrimitive(tag, intrinsic.bufferFrom([v ? 0xff : 0x00])); } }; }
 function any()            { return { kind: "any" }; }
 function decode(fn, write) { return { kind: "decode", fn: fn, write: write }; }
 
@@ -328,7 +328,14 @@ function _walkRepeat(schema, node, ctx) {
       if (seen.has(key)) _fail(ctx, schema.dupCode || schema.code, "duplicate element " + key);
       seen.add(key);
     }
-    items.push(item);
+    /** @internal The element is APPENDED by defining its index. `push` stores, and a store walks the
+     *  prototype chain for a setter, so an accessor at an array index received each element as the
+     *  repeat was walked and left the list a hole that reads back whatever its getter answers.
+     *  `m.items` is what every build() reads its elements out of, and a DN is a SEQUENCE OF RDN:
+     *  measured, a certificate whose subject is `C=US, ST=California, O=blamejs pki, OU=Test,
+     *  CN=pkijs.com` parsed with the accessor's value in place of its first RDN, and the parse threw
+     *  a bare TypeError rather than a typed refusal. */
+    intrinsic.append(items, item);
   }
   var match = { kind: "repeat", node: node, items: items };
   if (schema.build) match.result = schema.build(match, ctx);
@@ -336,7 +343,7 @@ function _walkRepeat(schema, node, ctx) {
 }
 
 function _equalsDefault(value, def) {
-  if (Buffer.isBuffer(value) && Buffer.isBuffer(def)) return value.equals(def);
+  if (intrinsic.isBuffer(value) && intrinsic.isBuffer(def)) return intrinsic.bufferEquals(value, def);
   return value === def;
 }
 
@@ -439,7 +446,7 @@ function _encFail(message) { throw new Error("schema.encode: " + message); }
 function encode(schema, value, ctx) {
   switch (schema.kind) {
     case "leaf":     return schema.write(value);
-    case "any":      return Buffer.isBuffer(value) ? value : value.bytes;
+    case "any":      return intrinsic.isBuffer(value) ? value : value.bytes;
     case "decode":
       if (typeof schema.write !== "function") _encFail("this decode leaf has no paired encoder (decode(fn, write))");
       return schema.write(value, ctx);
@@ -453,7 +460,7 @@ function encode(schema, value, ctx) {
 }
 
 function _wrapConstructed(schema, parts) {
-  if (schema.implicitTag != null) return asn1.build.contextConstructed(schema.implicitTag, Buffer.concat(parts));
+  if (schema.implicitTag != null) return asn1.build.contextConstructed(schema.implicitTag, intrinsic.bufferConcat(parts));
   var mode = schema.assert || "sequence";
   if (mode === "set") return asn1.build.set(parts);
   if (mode === "sequence" || mode === "constructed") return asn1.build.sequence(parts);
@@ -469,13 +476,17 @@ function _encodeSeq(schema, value, ctx) {
   for (var f = 0; f < schema.fields.length; f++) {
     var fld = schema.fields[f];
     if (fld.fkind === "required") {
-      parts.push(encode(fld.schema, value[fld.name], ctx));
+      /** @internal Each field is APPENDED by defining its index, for the reason the repeat walk is:
+       *  `push` stores, a store consults a setter inherited at the index, and these parts are
+       *  concatenated in order into the structure this encoder emits. Measured, an accessor at
+       *  index 0 put its own TLV where the first field belongs. */
+      intrinsic.append(parts, encode(fld.schema, value[fld.name], ctx));
     } else if (fld.fkind === "optional") {
       if (_present(value[fld.name])) {
         var enc = encode(fld.schema, value[fld.name], ctx);
         var isDefault = fld.hasDefault && fld.def !== undefined &&
-          enc.equals(encode(fld.schema, fld.def, ctx));
-        if (!isDefault) parts.push(fld.explicit ? asn1.build.explicit(fld.tag, enc) : enc);
+          intrinsic.bufferEquals(enc, encode(fld.schema, fld.def, ctx));
+        if (!isDefault) intrinsic.append(parts, fld.explicit ? asn1.build.explicit(fld.tag, enc) : enc);
       }
     } else if (fld.fkind === "trailing") {
       var members = guardList.sortedCopy(fld.members, function (a, b) { return a.tag - b.tag; });
@@ -483,7 +494,7 @@ function _encodeSeq(schema, value, ctx) {
         var mm = members[i];
         if (_present(value[mm.name])) {
           var menc = encode(mm.schema, value[mm.name], ctx);
-          parts.push(mm.explicit ? asn1.build.explicit(mm.tag, menc) : menc);
+          intrinsic.append(parts, mm.explicit ? asn1.build.explicit(mm.tag, menc) : menc);
         }
       }
     } else {
@@ -494,17 +505,21 @@ function _encodeSeq(schema, value, ctx) {
 }
 
 function _encodeRepeat(schema, items, ctx) {
-  if (!Array.isArray(items)) _encFail("a repeat value must be an array");
+  if (!intrinsic.isArray(items)) _encFail("a repeat value must be an array");
   if (schema.min != null && items.length < schema.min) {
     _encFail("this repeat requires at least " + schema.min + " element(s) but got " + items.length);
   }
   if (schema.max != null && items.length > schema.max) {
     _encFail("this repeat caps at " + schema.max + " element(s) but got " + items.length);
   }
-  var parts = items.map(function (it) { return encode(schema.item, it, ctx); });
+  /** @internal The elements are mapped through the captured operation, which builds its result by
+   *  defining each index on a plain array. `Array.prototype.map` is replaceable and reads the
+   *  receiver's `Symbol.species` to construct what it returns, so a caller's array could both
+   *  choose the encoded elements and hand this encoder a result object of its own class. */
+  var parts = intrinsic.mapList(items, function (it) { return encode(schema.item, it, ctx); });
   if (schema.unique) {
     var seen = new Set();
-    parts.forEach(function (tlv) {
+    intrinsic.forEach(parts, function (tlv) {
       // allow:bare-decode a round trip through the codec on a TLV this encoder just produced.
       var item = { node: asn1.decode(tlv) };
       item.value = walk(schema.item, item.node, ctx);
@@ -517,7 +532,7 @@ function _encodeRepeat(schema, items, ctx) {
    *  is the engine's own SET OF emission, so whatever decides "before" decides the bytes every schema
    *  built on it emits. */
   if (schema.derSetOrder) parts = guardList.sortedCopy(parts, intrinsic.compare);
-  if (schema.implicitTag != null) return asn1.build.contextConstructed(schema.implicitTag, Buffer.concat(parts));
+  if (schema.implicitTag != null) return asn1.build.contextConstructed(schema.implicitTag, intrinsic.bufferConcat(parts));
   return schema.assert === "set" ? asn1.build.set(parts) : asn1.build.sequence(parts);
 }
 
@@ -586,11 +601,14 @@ function isUniversal(node, tagNumber) {
 function isContext(node, tagNumber) {
   return !!node && node.tagClass === "context" && node.tagNumber === tagNumber;
 }
+/** @internal Both read the OWN elements of the tag list. `indexOf` is specified in terms of
+ *  HasProperty, so a list with a hole at an index answers from the array prototype, and the list
+ *  here is an allow-list deciding whether a node's tag is one a schema accepts. */
 function isUniversalOneOf(node, tagNumbers) {
-  return !!node && node.tagClass === "universal" && tagNumbers.indexOf(node.tagNumber) !== -1;
+  return !!node && node.tagClass === "universal" && intrinsic.ownIndexOf(tagNumbers, node.tagNumber) !== -1;
 }
 function isContextOneOf(node, tagNumbers) {
-  return !!node && node.tagClass === "context" && tagNumbers.indexOf(node.tagNumber) !== -1;
+  return !!node && node.tagClass === "context" && intrinsic.ownIndexOf(tagNumbers, node.tagNumber) !== -1;
 }
 function isContextInRange(node, min, max) {
   return !!node && node.tagClass === "context" && node.tagNumber >= min && node.tagNumber <= max;

package/lib/schema-pkcs1.js

@@ -264,11 +264,15 @@ function encode(key) {
   var infos = key.otherPrimeInfos;
   if (intrinsic.isArray(infos) && infos.length > 0) {
     var rows = [];
+    /** @internal Both appends define the index. A store at an index a list has no own property at
+     *  walks the prototype chain for a setter, so an accessor there took the element and the list
+     *  read back whatever its getter answers; `kids` holds nine own slots here, so index nine is
+     *  such a store. These are the bytes a private key encodes to. */
     for (var i = 0; i < infos.length; i++) {
-      rows[i] = asn1.build.sequence([asn1.build.integer(infos[i].prime),
-        asn1.build.integer(infos[i].exponent), asn1.build.integer(infos[i].coefficient)]);
+      intrinsic.append(rows, asn1.build.sequence([asn1.build.integer(infos[i].prime),
+        asn1.build.integer(infos[i].exponent), asn1.build.integer(infos[i].coefficient)]));
     }
-    kids[9] = asn1.build.sequence(rows);
+    intrinsic.append(kids, asn1.build.sequence(rows));
   }
   return asn1.build.sequence(kids);
 }

package/lib/schema-pkcs12.js

@@ -47,6 +47,9 @@ var cms = require("./schema-cms.js");
 var pkcs8 = require("./schema-pkcs8.js");
 var frameworkError = require("./framework-error.js");
 var guard = require("./guard-all.js");
+/** @internal The append this module's lists are built with: `push` stores at the index and a store
+ *  consults a setter inherited there, which takes the element being appended. */
+var _push = guard.list.append;
 
 var Pkcs12Error = frameworkError.Pkcs12Error;
 var PemError = frameworkError.PemError;
@@ -181,7 +184,7 @@ var SAFE_BAG = schema.seq([
       var items = m.fields.bagAttributes.value.items;
       for (var i = 0; i < items.length; i++) {
         var a = items[i].value.result;
-        attributes.push(a);
+        _push(attributes, a);
         if (a.type === OID_FRIENDLY_NAME) {
           if (seen[a.type] || a.values.length !== 1) throw ctx.E("pkcs12/bad-friendly-name", "friendlyName carries exactly one BMPString value (PKCS#9 SINGLE VALUE)");
           friendlyName = _bmpValue(a.values[0], ctx);
@@ -319,7 +322,7 @@ function walkSafeContents(der, ctx) {
   var walked = schema.walk(SAFE_CONTENTS, pkix.decodeNested(der, ns, "a SafeContents", { ber: true }), ns);
   var state = { budget: { remaining: C.LIMITS.PKCS12_MAX_REDECODES }, bagDepth: 0 };
   var bags = [];
-  for (var i = 0; i < walked.items.length; i++) bags.push(_buildBag(walked.items[i].value.result, state, ns));
+  for (var i = 0; i < walked.items.length; i++) _push(bags, _buildBag(walked.items[i].value.result, state, ns));
   return bags;
 }
 
@@ -334,12 +337,12 @@ function _dispatchSafes(asMatch, state, ctx) {
         budget: state.budget, budgetCode: "pkcs12/too-deep",
       });
       for (var j = 0; j < contents.items.length; j++) {
-        safeBags.push(_buildBag(contents.items[j].value.result, state, ctx));
+        _push(safeBags, _buildBag(contents.items[j].value.result, state, ctx));
       }
     } else if (el.contentType === OID_ENCRYPTED_DATA) {
-      encryptedSafes.push({ type: "encryptedData", content: _privacySafe(cms.walkEncryptedData(el.innerNode, ctx), ctx) });
+      _push(encryptedSafes, { type: "encryptedData", content: _privacySafe(cms.walkEncryptedData(el.innerNode, ctx), ctx) });
     } else if (el.contentType === OID_ENVELOPED_DATA) {
-      encryptedSafes.push({ type: "envelopedData", content: _privacySafe(cms.walkEnvelopedData(el.innerNode, ctx), ctx), envelopedDataDer: el.innerNode.bytes });
+      _push(encryptedSafes, { type: "envelopedData", content: _privacySafe(cms.walkEnvelopedData(el.innerNode, ctx), ctx), envelopedDataDer: el.innerNode.bytes });
     } else {
       throw ctx.E("pkcs12/bad-safe-contentinfo-type", "an AuthenticatedSafe element must be id-data, id-encryptedData, or id-envelopedData (RFC 7292 sec. 4.1), got " +
         (ctx.oid.name(el.contentType) || el.contentType));
@@ -391,7 +394,7 @@ function _buildBag(rec, state, ctx) {
     bag.nested = [];
     var nestedMatch = schema.walk(SAFE_CONTENTS, rec.valueNode, ctx);
     for (var i = 0; i < nestedMatch.items.length; i++) {
-      bag.nested.push(_buildBag(nestedMatch.items[i].value.result, nestedState, ctx));
+      _push(bag.nested, _buildBag(nestedMatch.items[i].value.result, nestedState, ctx));
     }
     return bag;
   }

package/lib/schema-pkix.js

@@ -11,8 +11,17 @@ var intrinsic = require("./guard-intrinsic");
 var frameworkError = require("./framework-error");
 var _hasOwn = intrinsic.hasOwn;
 var _forEach = intrinsic.forEach;
-var _map = intrinsic.map;
-var _push = intrinsic.push;
+/** @internal `mapList`, not the captured `map`. `Array.prototype.map` is specified to build its
+ *  result through `ArraySpeciesCreate`, which reads the receiver's `constructor` and then that
+ *  constructor's `Symbol.species`, so a getter installed on `Array.prototype.constructor` runs
+ *  caller code with the list being mapped as its `this` on every call. Capturing the method closes
+ *  which function runs, not the protocol it consults. Measured on a certificate parse: the
+ *  extension-list build was reached that way. `mapList` defines each index on a plain array. */
+var _map = intrinsic.mapList;
+/** @internal `append`, not a captured `push`: a store at an index walks the prototype chain for a
+ *  setter, so an accessor there takes the element being appended. The lists built here are the parsed
+ *  members every format module reads its fields from. `append` defines the index. */
+var _push = intrinsic.append;
 var _join = intrinsic.join;
 var _stringify = intrinsic.stringify;
 var _String = intrinsic.String;
@@ -51,7 +60,14 @@ function _hasNonWhitespace(s) {
   for (var i = 0; i < s.length; i++) { if (!_isJsWhitespace(_charCodeAt(s, i))) return true; }
   return false;
 }
-function _charTable(chars) { var t = []; for (var i = 0; i < chars.length; i++) t[_charCodeAt(chars, i)] = true; return t; }
+/** @internal The table has NO PROTOTYPE, because it is deliberately sparse: it holds an entry for
+ *  each character it allows and nothing at the codes it does not, and `_allCharsIn` below reads it at
+ *  the code of each character it is asked about. Built as an array literal, every code outside the
+ *  allowed set was a hole, so a value installed at that index on `Array.prototype` answered the
+ *  check: measured, `Array.prototype[47] = true` made `pki.acme.keyAuthorization` accept a challenge
+ *  token containing `/`, which the base64url set does not allow, instead of refusing it with
+ *  `acme/bad-token`. The same helper in lib/guard-name.js has always been written this way. */
+function _charTable(chars) { var t = _create(null); for (var i = 0; i < chars.length; i++) t[_charCodeAt(chars, i)] = true; return t; }
 function _allCharsIn(s, table) {
   if (s.length === 0) return false;
   for (var i = 0; i < s.length; i++) { if (!table[_charCodeAt(s, i)]) return false; }

package/lib/schema-sec1.js

@@ -210,7 +210,10 @@ function encode(key) {
     asn1.build.octetString(key.privateKey),
     asn1.build.explicit(0, asn1.build.oid(curveOid))];
   if (key.publicKey !== undefined && key.publicKey !== null) {
-    kids[3] = asn1.build.explicit(1, asn1.build.bitString(key.publicKey, 0));
+    /** @internal Appended by defining the index. `kids` holds three own slots above, so assigning at
+     *  index three is a store, and a store walks the prototype chain for a setter: an accessor there
+     *  would take the public key out of the structure this encodes. */
+    intrinsic.append(kids, asn1.build.explicit(1, asn1.build.bitString(key.publicKey, 0)));
   }
   return asn1.build.sequence(kids);
 }

package/lib/schema-tsp.js

@@ -43,6 +43,9 @@ var smime = require("./schema-smime");
 var cms = require("./schema-cms");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
+/** @internal The append this module's lists are built with: `push` stores at the index and a store
+ *  consults a setter inherited there, which takes the element being appended. */
+var _push = guard.list.append;
 
 var TspError = frameworkError.TspError;
 var PemError = frameworkError.PemError;
@@ -196,7 +199,7 @@ function _namedBits(bytes) {
     if ((bytes[i >> 3] >> (7 - (i & 7))) & 1) {
       var nm = FAILURE_BITS[i];
       if (!nm) throw NS.E("tsp/bad-failinfo", "unsupported PKIFailureInfo bit " + i + " (RFC 3161 sec. 2.4.2)");
-      out.push(nm);
+      _push(out, nm);
     }
   }
   return out;
@@ -525,8 +528,8 @@ function essDigest(name) {
   var xof = ESS_XOF_BYTES[name];
   /** @internal One read of the name answers both whether the digest can be computed and how to
    *  compute it, so the hash every candidate is put through is the one that read settled. */
-  return function () {
-    return xof ? nodeCrypto.createHash(name, { outputLength: xof }) : nodeCrypto.createHash(name);
+  return function (bytes) {
+    return xof ? guard.crypto.xof(name, bytes, xof) : guard.crypto.digest(name, bytes);
   };
 }
 
@@ -576,7 +579,7 @@ function _essNamedCertificate(token, attr) {
   for (var j = 0; j < certs.length; j++) {
     var element = certs[j];
     if (!element || element.tagClass !== "universal" || !Buffer.isBuffer(element.bytes)) continue;
-    var actual = digest().update(element.bytes).digest();
+    var actual = digest(element.bytes);
     if (actual.length === want.length && guard.bytes.compare(actual, want) === 0) return element.bytes;
   }
   return null;

package/lib/shbs.js

@@ -21,9 +21,12 @@
  * @card Verify HSS/LMS signatures (post-quantum, CNSA 2.0 firmware signing).
  */
 
-var nodeCrypto = require("crypto");
 var frameworkError = require("./framework-error");
 var guard = require("./guard-all");
+/** @internal The append every list here is built with: `push` stores at the index and a store
+ *  consults a setter inherited there, and these lists are the authentication path and the one-time
+ *  values a hash-based signature is formed from. */
+var _push = guard.list.append;
 var constants = require("./constants");
 
 var ShbsError = frameworkError.ShbsError;
@@ -78,11 +81,9 @@ function _lmotsSet(code) {
 }
 
 function _hash(family, n, parts) {
-  var h;
-  if (family === "shake256") h = nodeCrypto.createHash("shake256", { outputLength: n });
-  else h = nodeCrypto.createHash("sha256");
-  for (var i = 0; i < parts.length; i++) h.update(parts[i]);
-  var d = h.digest();
+  var d = family === "shake256"
+    ? guard.crypto.digestParts("shake256", parts, n)
+    : guard.crypto.digestParts("sha256", parts);
   return (family === "shake256" || n === 32) ? d : d.subarray(0, n);
 }
 
@@ -124,7 +125,7 @@ function _lmotsKc(otsSet, I, q, C, y, message) {
     var a = _coef(Qc, i, w);
     var tmp = y[i];
     for (var j = a; j < (1 << w) - 1; j++) tmp = _hash(f, n, [I, qb, u16(i), u8(j), tmp]);
-    z.push(tmp);
+    _push(z,tmp);
   }
   return _hash(f, n, z);
 }
@@ -148,11 +149,11 @@ function _lmsVerify(pubBytes, message, sigBytes) {
   var n = otsSet.n, p = otsSet.p;
   var C = sr.take(n);
   var y = [];
-  for (var yi = 0; yi < p; yi++) y.push(sr.take(n));
+  for (var yi = 0; yi < p; yi++) _push(y,sr.take(n));
   var sigLmsType = sr.u32();
   if (sigLmsType !== lmsSet.code) return false;
   var path = [];
-  for (var pi = 0; pi < h; pi++) path.push(sr.take(m));
+  for (var pi = 0; pi < h; pi++) _push(path,sr.take(m));
   if (!sr.atEnd()) throw _err("shbs/bad-signature", "LMS signature has " + sr.remaining() + " trailing byte(s)");
   if (q >= Math.pow(2, h)) return false;
 

package/lib/sign-scheme.js

@@ -359,14 +359,14 @@ function _keyTypeAccepts(reported, wanted) {
 }
 
 function _assertKeyObjectMatchesScheme(key, scheme, E) {
-  var reported = key.asymmetricKeyType;
+  var reported = guard.crypto.keyType(key);
   var wanted = NODE_KEY_TYPE[scheme.imp.name] || _toLowerCase(_String(scheme.imp.name));
   if (!_keyTypeAccepts(reported, wanted)) {
     throw E("bad-input", "the signer KeyObject algorithm (" + reported +
       ") does not match the certificate's key algorithm (" + scheme.imp.name + ")");
   }
   if (scheme.imp.namedCurve) {
-    var details = key.asymmetricKeyDetails;
+    var details = guard.crypto.keyDetails(key);
     var curve = details && details.namedCurve;
     if (curve !== NODE_CURVE[scheme.imp.namedCurve]) {
       throw E("bad-input", "the signer KeyObject curve (" + curve +

package/lib/sigstore.js

@@ -28,7 +28,6 @@
  * @card Verify an npm --provenance Sigstore bundle offline (DSSE + Fulcio + Rekor + SLSA).
  */
 
-var nodeCrypto = require("crypto");
 var frameworkError = require("./framework-error");
 var constants = require("./constants");
 var asn1 = require("./asn1-der");
@@ -227,8 +226,8 @@ function _assertKeyDetailsParameters(want, leafSpki, declared) {
   if (want.bits !== undefined) {
     var bits;
     try {
-      bits = guard.crypto.publicKey({ key: leafSpki.bytes, format: "der", type: "spki" })
-        .asymmetricKeyDetails.modulusLength;
+      bits = guard.crypto.keyDetails(
+        guard.crypto.publicKey({ key: leafSpki.bytes, format: "der", type: "spki" })).modulusLength;
     } catch (_e) { bits = null; }   // allow:swallow-unverified -- a key that will not import has no modulus size to match, and the mismatch below is the verdict
     if (bits !== want.bits) {
       throw _err("sigstore/entry-mismatch", "the Rekor entry states the signing key is " +
@@ -709,13 +708,14 @@ function _chainDers(vm) {
 }
 
 function _rawVerify(keyObj, data, derSig) {
-  var t = keyObj.asymmetricKeyType;
+  var t = guard.crypto.keyType(keyObj);
   if (t === "ed25519" || t === "ed448") {
     var edSpki = guard.crypto.exportKey(keyObj, { type: "spki", format: "der" });
     edwardsPoint.validateSpki(edSpki, t === "ed25519" ? 6 : 7, SigstoreError, "sigstore/bad-key");
     return guard.crypto.verify(null, data, keyObj, derSig);
   }
-  var crv = keyObj.asymmetricKeyDetails && keyObj.asymmetricKeyDetails.namedCurve;
+  var keyObjDetails = guard.crypto.keyDetails(keyObj);
+  var crv = keyObjDetails && keyObjDetails.namedCurve;
   var hash = crv === "secp384r1" ? "sha384" : (crv === "secp521r1" ? "sha512" : "sha256");
   return guard.crypto.verify(hash, data, { key: keyObj, dsaEncoding: "der" }, derSig);
 }
@@ -723,7 +723,7 @@ function _pubFromSpki(spkiDer, label) {
   var key;
   try { key = guard.crypto.publicKey({ key: spkiDer, format: "der", type: "spki" }); }
   catch (e) { throw _err("sigstore/bad-key", "invalid " + label + " public key", e); }
-  var t = key.asymmetricKeyType;
+  var t = guard.crypto.keyType(key);
   if (t === "ed25519" || t === "ed448") {
     edwardsPoint.validateSpki(spkiDer, t === "ed25519" ? 6 : 7, SigstoreError, "sigstore/bad-key");
   }
@@ -735,7 +735,7 @@ function _parseCert(der, label) {
 }
 
 
-function _sha256(buf) { return nodeCrypto.createHash("sha256").update(buf).digest(); }
+function _sha256(buf) { return guard.crypto.digest("sha256", buf); }
 
 function _toMs(x) {
   if (x == null) return null;
@@ -1109,7 +1109,7 @@ function _bindHashedRekordV002Entry(body, arm, leafDer, contentType, payloadType
   }
   var digest = _b64(data.digest, "hashedRekordV002.data.digest");
   if (contentType === "dsseEnvelope") {
-    var computed = nodeCrypto.createHash(alg.node).update(pae(payloadType, payload)).digest();
+    var computed = guard.crypto.digest(alg.node, pae(payloadType, payload));
     if (!guard.crypto.constantTimeEqual(computed, digest)) {
       throw _err("sigstore/entry-mismatch", "the Rekor entry digest is not the hash of this envelope's " +
         "signing preimage, so the entry records a different signature than the bundle carries");
@@ -1831,7 +1831,7 @@ async function verifyBundle(bundle, opts) {
   var artifactDigests = intrinsic.create(null);
   function _artifactDigest(nodeName) {
     if (!intrinsic.hasOwn(artifactDigests, nodeName)) {
-      artifactDigests[nodeName] = nodeCrypto.createHash(nodeName).update(artifact).digest();
+      artifactDigests[nodeName] = guard.crypto.digest(nodeName, artifact);
     }
     return artifactDigests[nodeName];
   }

package/lib/smime.js

@@ -41,10 +41,13 @@ var schemaX509 = require("./schema-x509.js");
 var pkix = require("./schema-pkix.js");
 var oid = require("./oid.js");
 var guard = require("./guard-all.js");
+/** @internal The append every list here is built with: `push` stores at the index and a store
+ *  consults a setter inherited there, and these lists become the headers and parts a signed or
+ *  encrypted message carries. */
+var _push = guard.list.append;
 var pkiBuild = require("./pki-build.js");
 var C = require("./constants.js");
 var nodeUtil = require("util");
-var nodeCrypto = require("crypto");
 
 var SmimeError = frameworkError.SmimeError;
 
@@ -118,13 +121,13 @@ function _hpHeaderList(headers) {
       if (!h || typeof h !== "object") throw _err("smime/bad-input", "each opts.headers entry must be { name, value }");
       var name = h.name, v = h.value;
       if (typeof name !== "string") throw _err("smime/bad-input", "each opts.headers entry must be { name, value }");
-      out.push({ name: name, value: v == null ? "" : String(v) });
+      _push(out,{ name: name, value: v == null ? "" : String(v) });
     });
   } else if (typeof headers === "object") {
     var hn = guard.identifier.optionNames(headers);
     for (var hi = 0; hi < hn.length; hi++) {
       var hv = headers[hn[hi]];
-      out.push({ name: hn[hi], value: hv == null ? "" : String(hv) });
+      _push(out,{ name: hn[hi], value: hv == null ? "" : String(hv) });
     }
   } else {
     throw _err("smime/bad-input", "opts.headers must be an object or an array of { name, value }");
@@ -155,9 +158,9 @@ function _outerHeaderList(list, mode, hcp) {
   list.forEach(function (h) {
     if (mode === "cipher") {
       var v = _applyHcp(h.name, h.value, policy);
-      if (v !== null) out.push({ name: h.name, value: v });
+      if (v !== null) _push(out,{ name: h.name, value: v });
     } else {
-      out.push({ name: h.name, value: h.value });
+      _push(out,{ name: h.name, value: h.value });
     }
   });
   return out;
@@ -171,9 +174,9 @@ function _protectedInnerEntity(content, opts, mode, hpList, outerList) {
   if (cty != null && mime.hasParam(cty, "hp")) throw _err("smime/bad-input", "opts.contentType must not set the hp parameter -- header protection sets it (hp=" + guard.text.showValue(mode) + ")");
   var ct = (cty || "text/plain; charset=utf-8") + "; hp=\"" + mode + "\"";
   var fields = [{ name: "Content-Type", value: ct }, { name: "Content-Transfer-Encoding", value: _is7bit(raw) ? "7bit" : "8bit" }];
-  hpList.forEach(function (h) { fields.push(h); });
+  hpList.forEach(function (h) { _push(fields,h); });
   if (mode === "cipher") {
-    outerList.forEach(function (h) { fields.push({ name: "HP-Outer", value: h.name + ": " + h.value }); });
+    outerList.forEach(function (h) { _push(fields,{ name: "HP-Outer", value: h.name + ": " + h.value }); });
   }
   return mime.buildEntity(fields, raw, SmimeError, "smime/bad-header");
 }
@@ -227,7 +230,7 @@ function _contentTypeLines(s) {
   var lines = [], lineStart = 0;
   while (lineStart <= s.length) {
     var line = _contentTypeLineAt(s, lineStart);
-    if (line !== null) lines.push(line);
+    if (line !== null) _push(lines,line);
     var nl = s.indexOf("\n", lineStart);
     if (nl === -1) break;
     lineStart = nl + 1;
@@ -274,11 +277,11 @@ function _extractProtected(headerList) {
     if (_isStructural(h.lname)) return;
     if (h.lname === "hp-outer") {
       var ci = h.rawValue.indexOf(":");
-      if (ci >= 0) refouter.push({ name: h.rawValue.slice(0, ci).trim().toLowerCase(), value: h.rawValue.slice(ci + 1).trim() });
+      if (ci >= 0) _push(refouter,{ name: h.rawValue.slice(0, ci).trim().toLowerCase(), value: h.rawValue.slice(ci + 1).trim() });
       return;
     }
     var val = _utf8Header(h.rawValue);
-    entries.push({ name: h.name, value: val, raw: h.rawValue });
+    _push(entries,{ name: h.name, value: val, raw: h.rawValue });
     if (seen[h.lname]) { dup = h.name; if (RFC5322_SINGLETON.has(h.lname)) dupSingleton = h.name; }
     seen[h.lname] = 1;
     protectedHeaders[h.name] = val;
@@ -297,7 +300,7 @@ function _computeConfidential(entries, refouter) {
   entries.forEach(function (e) {
     var m = byName.get(e.name.toLowerCase()), val = e.raw.trim(), n = (m && m.get(val)) || 0;
     if (n > 0) { m.set(val, n - 1); return; }
-    if (!seen[e.name]) { seen[e.name] = 1; confidential.push(e.name); }
+    if (!seen[e.name]) { seen[e.name] = 1; _push(confidential,e.name); }
   });
   return confidential;
 }
@@ -305,7 +308,7 @@ function _computeConfidential(entries, refouter) {
 function _computeFromMismatch(innerFrom, outerEnt) {
   if (innerFrom == null) return null;
   var outerFroms = [];
-  outerEnt.headers.forEach(function (h) { if (h.lname === "from") outerFroms.push(h.value.trim()); });
+  outerEnt.headers.forEach(function (h) { if (h.lname === "from") _push(outerFroms,h.value.trim()); });
   return outerFroms.length !== 1 || outerFroms[0] !== innerFrom.trim();
 }
 
@@ -315,7 +318,7 @@ function _isCryptoLayer(type) {
 
 function _outerRefouter(outerEnt) {
   var r = [];
-  outerEnt.headers.forEach(function (h) { if (!_isStructural(h.lname) && h.lname !== "hp-outer") r.push({ name: h.lname, value: h.rawValue.trim() }); });
+  outerEnt.headers.forEach(function (h) { if (!_isStructural(h.lname) && h.lname !== "hp-outer") _push(r,{ name: h.lname, value: h.rawValue.trim() }); });
   return r;
 }
 
@@ -572,7 +575,7 @@ function _cmsSignOpts(opts, detached) {
 function _micName(name) { return name ? (MICALG[name] || name) : null; }
 function _micalgSet(value) {
   var seen = [];
-  String(value).split(",").forEach(function (m) { var t = m.trim().toLowerCase(); if (t && seen.indexOf(t) < 0) seen.push(t); });
+  String(value).split(",").forEach(function (m) { var t = m.trim().toLowerCase(); if (t && seen.indexOf(t) < 0) _push(seen,t); });
   return seen.sort().join(",");
 }
 function _micalgOf(p7Der) {
@@ -582,12 +585,12 @@ function _micalgOf(p7Der) {
   var out = [];
   (parsed.signerInfos || []).forEach(function (si) {
     var mic = _micName(si.digestAlgorithm && si.digestAlgorithm.name);
-    if (mic && out.indexOf(mic) < 0) out.push(mic);
+    if (mic && out.indexOf(mic) < 0) _push(out,mic);
   });
   return out.length ? out.sort().join(",") : null;
 }
 
-function _boundary() { return "----=_pki_smime_" + nodeCrypto.randomBytes(18).toString("hex"); }
+function _boundary() { return "----=_pki_smime_" + guard.crypto.randomBytes(18).toString("hex"); }
 
 function _wrap64Crlf(s) {
   var out = "";

package/lib/tlog.js

@@ -69,9 +69,10 @@ var _strSlice = intrinsic.uncurry(String.prototype.slice);
 var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 var _arrSlice = intrinsic.arraySlice;
 var _join = intrinsic.join;
-var _push = intrinsic.push;
+/** @internal `append`, not a captured `push`: a store at an index walks the prototype chain for a
+ *  setter, so an accessor there takes the element being appended. `append` defines it. */
+var _push = intrinsic.append;
 var _pop = intrinsic.pop;
-var _unshift = intrinsic.unshift;
 var _bufToString = intrinsic.bufToString;
 var _bufferFrom = intrinsic.bufferFrom;
 var _byteLength = intrinsic.byteLength;
@@ -298,12 +299,13 @@ function _resolveKey(keyName, publicKey) {
     throw _err("tlog/bad-input", "publicKey must be the raw " + ED25519_RAW_BYTES +
       " Ed25519 bytes or a SubjectPublicKeyInfo, got " + bytes.length + " bytes", e);
   }
-  var type = key.asymmetricKeyType;
+  var type = guard.crypto.keyType(key);
   if (type === "ed25519") {
     return _edKey(name, bytes, _subarray(bytes, bytes.length - ED25519_RAW_BYTES));
   }
   if (type === "ec") {
-    var curve = key.asymmetricKeyDetails && key.asymmetricKeyDetails.namedCurve;
+    var keyDetails = guard.crypto.keyDetails(key);
+    var curve = keyDetails && keyDetails.namedCurve;
     if (EC_CURVES[curve] !== 1) {
       throw _err("tlog/bad-input", "a signed note names no key-ID derivation for the elliptic curve " +
         guard.text.showValue(_stringOf(curve)));
@@ -798,20 +800,25 @@ var MAX_INDEX_SEGMENTS = (function () {
   return count;
 })();
 
+/** @internal The segments are counted and then APPENDED most-significant first, by defining each
+ *  index. Prepending STORES at an index, and a store walks the prototype chain for a setter, so an
+ *  accessor inherited at an array index took each segment and left the list reading back its getter's
+ *  value; the `x` prefix was then applied by a read-modify-write through the same hole. These
+ *  segments are the path a tile is requested from, so the list decides which bytes a verification
+ *  reads. */
 function _indexPath(index) {
   var n = guard.range.uint64(index, _err, "tlog/bad-tile", "a tile index");
-  var segments = [];
-  var rest = n;
   var thousand = 1000n;
-  for (;;) {
-    var part = rest % thousand;
-    var text = _stringOf(part);
+  var count = 1;
+  for (var probe = n / thousand; probe > 0n; probe = probe / thousand) count++;
+  var segments = [];
+  for (var k = count - 1; k >= 0; k--) {
+    var scale = 1n;
+    for (var p = 0; p < k; p++) scale = scale * thousand;
+    var text = _stringOf((n / scale) % thousand);
     while (text.length < TILE_SEGMENT_DIGITS) text = "0" + text;
-    _unshift(segments, text);
-    rest = rest / thousand;
-    if (rest === 0n) break;
+    _push(segments, k === 0 ? text : "x" + text);
   }
-  for (var i = 0; i < segments.length - 1; i++) segments[i] = "x" + segments[i];
   return _join(segments, "/");
 }