@blamejs/pki 0.8.59 → 0.8.61

package/lib/tuf.js

@@ -57,7 +57,9 @@ var _hasOwn = intrinsic.hasOwn;
 var _bufferFrom = intrinsic.bufferFrom;
 var _bufferConcat = intrinsic.bufferConcat;
 var _bufToString = intrinsic.bufToString;
-var _push = intrinsic.push;
+/** @internal `append`, not a captured `push`: a store at an index walks the prototype chain for a
+ *  setter, so an accessor there takes the element being appended. `append` defines it. */
+var _push = intrinsic.append;
 var _strSlice = intrinsic.uncurry(String.prototype.slice);
 var _codePointAt = intrinsic.uncurry(String.prototype.codePointAt);
 var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
@@ -796,12 +798,13 @@ function _declarationOf(key) {
 function _checkedPublicKey(key, d) {
   if (d.nodeType === "ed25519") return null;
   var imported = _publicFromPem(key.keyval.public, "a " + key.keytype + " public key");
-  if (imported.asymmetricKeyType !== d.nodeType) {
+  var importedType = guard.crypto.keyType(imported);
+  if (importedType !== d.nodeType) {
     throw _err("tuf/bad-key", "the key declared as " + key.keytype + " holds a " +
-      guard.text.showValue(imported.asymmetricKeyType) + " public key, so the signature would be checked " +
+      guard.text.showValue(importedType) + " public key, so the signature would be checked " +
       "under an algorithm the metadata does not name");
   }
-  var details = imported.asymmetricKeyDetails || {};
+  var details = guard.crypto.keyDetails(imported) || {};
   if (d.curve !== null && details.namedCurve !== d.curve) {
     throw _err("tuf/bad-key", "the scheme " + key.scheme + " names the " + d.curve +
       " curve; the key is on " + guard.text.showValue(details.namedCurve));

package/lib/validator-cose.js

@@ -7,7 +7,7 @@ var cbor = require("./cbor-det");
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
 var edwardsPoint = require("./edwards-point");
-var nodeCrypto = require("crypto");
+var guard = require("./guard-all.js");
 
 var EC2_CRV_LEN = Object.assign(Object.create(null), { 1: 32, 2: 48, 3: 66 });
 var EC2_CRV_OID = Object.assign(Object.create(null), { 1: "prime256v1", 2: "secp384r1", 3: "secp521r1" });
@@ -114,7 +114,7 @@ function assertKeyMaterial(key, E, code, unsupportedCode) {
   if (!prof) throw new E(unsupportedCode || code, "unsupported credential key algorithm " + key.alg);
   if (prof.kty !== key.kty) throw bad("credential key algorithm " + key.alg + " is inconsistent with key type " + key.kty);
   if (prof.crv != null && prof.crv !== key.crv) throw bad("credential key algorithm " + key.alg + " requires a different curve");
-  try { nodeCrypto.createPublicKey({ key: toSpki(key, E, code), format: "der", type: "spki" }); }
+  try { guard.crypto.publicKey({ key: toSpki(key, E, code), format: "der", type: "spki" }); }
   catch (e) { throw bad("the credential public key point is not valid for its curve", e); }
   if (Number(key.kty) === 1 && !edwardsPoint.validate(key.x, key.crv)) throw bad("the OKP credential public key is not a valid, full-order Edwards point");
   return key;

package/lib/validator-keydesc.js

@@ -4,6 +4,9 @@
 // @internal
 
 var asn1 = require("./asn1-der");
+/** @internal The append this module's list is built with: `push` stores at the index and a store
+ *  consults a setter inherited there, which takes the element being appended. */
+var _push = require("./guard-list").append;
 
 function _alGet(seqNode, tag) {
   if (!seqNode || !seqNode.children) return null;
@@ -23,7 +26,7 @@ function _purposeUnion(a, b, E, code) {
   var out = [];
   [a, b].forEach(function (list) {
     var p = _alGet(list, 1);
-    if (p && p.children) p.children.forEach(function (c) { var v = _alInt(c, E, code); if (out.indexOf(v) === -1) out.push(v); });
+    if (p && p.children) p.children.forEach(function (c) { var v = _alInt(c, E, code); if (out.indexOf(v) === -1) _push(out,v); });
   });
   return out;
 }

package/lib/validator-tls.js

@@ -5,6 +5,11 @@
 
 var C = require("./constants");
 var ByteReader = require("./byte-reader");
+/** @internal The append every list here is built with. `push` STORES at the index and a store walks
+ *  the prototype chain for a setter, so an accessor inherited at an array index takes the element
+ *  being appended. Taken from `guard-list` rather than `guard-intrinsic`, since this module needs the
+ *  one primitive and not the captures. */
+var _push = require("./guard-list").append;
 
 var MAX_VECTOR_24 = 0xffffff;
 var MAX_VECTOR_16 = 0xffff;
@@ -36,7 +41,7 @@ function _extensionRecords(view, E, codes) {
         type + " (RFC 8446 sec. 4.2)");
     }
     seen[type] = true;
-    out.push({ type: type, data: Buffer.from(data) });
+    _push(out,{ type: type, data: Buffer.from(data) });
   }
   return out;
 }
@@ -68,7 +73,7 @@ function certificateMessage(view, E, codes, certificateType) {
     };
     if (certificateType === "RawPublicKey") entry.spki = Buffer.from(data);
     else entry.certData = Buffer.from(data);
-    entries.push(entry);
+    _push(entries,entry);
   }
   return { certificateRequestContext: Buffer.from(context), entries: entries };
 }

package/lib/webauthn-mds.js

@@ -26,12 +26,6 @@ var _charAt = intrinsic.uncurry(String.prototype.charAt);
 var _strToLowerCase = intrinsic.toLowerCase;
 var _strSlice = intrinsic.uncurry(String.prototype.slice);
 var _strSplit = intrinsic.uncurry(String.prototype.split);
-/** @internal The hash constructor and the methods of the object it returns. What a digest here
- *  produces is a metadata lookup key and the identity two certificates are told apart by, so a
- *  replaced constructor, update or digest decides which entry governs an attestation. */
-var _createHash = _nodeCrypto.createHash;
-var _hashUpdate = intrinsic.uncurry(_nodeCrypto.createHash("sha256").update);
-var _hashDigest = intrinsic.uncurry(_nodeCrypto.createHash("sha256").digest);
 var jose = require("./jose");
 var rfc3339 = require("./rfc3339");
 var constants = require("./constants");
@@ -702,7 +696,9 @@ function certKeyIdentifier(cert) {
   if (!pk || !intrinsic.isBuffer(pk.bytes)) {
     throw _err("webauthn/bad-input", "certKeyIdentifier expects a parsed certificate carrying a subject public key");
   }
-  return _hashDigest(_hashUpdate(_createHash("sha1"), pk.bytes), "hex");
+  /** @internal A metadata lookup key, and the identity two certificates are told apart by, so
+   *  whatever computes it decides which entry governs an attestation. */
+  return guard.crypto.digest("sha1", pk.bytes, { output: "hex" });
 }
 
 function metadataForKeyIdentifier(metadata, keyId) {

package/lib/webauthn.js

@@ -54,7 +54,6 @@ var _promiseResolve = intrinsic.uncurry(intrinsic.promiseResolve);
 var _promiseReject = intrinsic.uncurry(intrinsic.promiseReject);
 var jose = require("./jose");
 var mds = require("./webauthn-mds");
-var nodeCrypto = require("crypto");
 
 var WebauthnError = frameworkError.WebauthnError;
 function _err(code, message, cause) { return new WebauthnError(code, message, cause); }
@@ -76,16 +75,10 @@ var _subtleVerify = intrinsic.uncurry(subtle.verify);
  * while the bytes handed in were never the credential's. */
 var _subtleImportKey = intrinsic.uncurry(subtle.importKey);
 
-/** @internal The hash constructor is captured, and so are the methods of the object it returns. Every
- * attestation comparison in this module rests on a digest, so a replaced `createHash`, or a replaced
- * `update` or `digest` on the object it hands back, chooses what the comparison sees. */
-var _createHash = nodeCrypto.createHash;
-function _sha(name, buf) {
-  var h = _createHash(name);
-  return _hashDigest(_hashUpdate(h, buf));
-}
-var _hashUpdate = intrinsic.uncurry(nodeCrypto.createHash("sha256").update);
-var _hashDigest = intrinsic.uncurry(nodeCrypto.createHash("sha256").digest);
+/** @internal Every attestation comparison in this module rests on a digest, so whatever computes one
+ * chooses what the comparison sees. The guard owns the hash construction and the methods of the
+ * object it returns. */
+function _sha(name, buf) { return guard.crypto.digest(name, buf); }
 /** @internal The comparison goes through the captured operation. This is what decides that an
  *  attestation statement's key is the credential's key, so a replacement answering zero makes a
  *  different key match. */

package/lib/webcrypto.js

@@ -89,7 +89,9 @@ var _subarray = intrinsic.subarray;
 var _arrayBufferSlice = intrinsic.arrayBufferSlice;
 var _numberToString = intrinsic.numberToString;
 var _bigIntToString = intrinsic.bigIntToString;
-var _push = intrinsic.push;
+/** @internal `append`, not a captured `push`: a store at an index walks the prototype chain for a
+ *  setter, so an accessor there takes the element being appended. `append` defines it. */
+var _push = intrinsic.append;
 var _concat = intrinsic.concat;
 var _resolve = intrinsic.uncurry(intrinsic.promiseResolve);
 /** @internal The promise constructor, captured at load. `promiseResolve` builds its promise from the
@@ -222,7 +224,11 @@ function CryptoKey(type, extractable, algorithm, usages, handle) {
   if (usages != null && !_isArray(usages)) {
     throw new WebCryptoError("webcrypto/syntax", "usages must be an array of key-usage strings");
   }
-  this.usages = usages ? _arraySlice(usages) : [];
+  /** @internal `copyList`, not the captured `slice`. `Array.prototype.slice` builds its result
+   *  through `ArraySpeciesCreate`, which reads the receiver's `constructor` and then its
+   *  `Symbol.species`, so the copy of a caller's usage list ran a lookup the caller could answer.
+   *  `copyList` defines each index on a plain array. */
+  this.usages = usages ? intrinsic.copyList(usages) : [];
   _defineProperty(this, "_handle", { value: handle, enumerable: false });
 }
 
@@ -255,10 +261,10 @@ SubtleCrypto.prototype.digest = async function digest(algorithm, data) {
   var name = _normalizeAlg(algorithm, "digest").name;
   var xof = XOF_NODE[_toUpperCase(_String(name))];
   var h = xof
-    ? nodeCrypto.createHash(xof.node, { outputLength: xof.length })
-    : nodeCrypto.createHash(_hashNode(name, "digest"));
-  h.update(_toBuf(data, "digest"));
-  return _toArrayBuffer(h.digest());
+    ? guard.crypto.hash(xof.node, xof.length)
+    : guard.crypto.hash(_hashNode(name, "digest"));
+  _hashUpdate(h, _toBuf(data, "digest"));
+  return _toArrayBuffer(_hashDigest(h));
 };
 
 SubtleCrypto.prototype.digestStream = async function digestStream(algorithms, source) {
@@ -270,8 +276,8 @@ SubtleCrypto.prototype.digestStream = async function digestStream(algorithms, so
     var name = _normalizeAlg(algorithms[_h], "digestStream").name;
     var xof = XOF_NODE[_toUpperCase(_String(name))];
     hashes[_h] = xof
-      ? nodeCrypto.createHash(xof.node, { outputLength: xof.length })
-      : nodeCrypto.createHash(_hashNode(name, "digestStream"));
+      ? guard.crypto.hash(xof.node, xof.length)
+      : guard.crypto.hash(_hashNode(name, "digestStream"));
   }
   var acquire = source == null ? undefined : source[_asyncIterator];
   if (typeof acquire !== "function") {
@@ -301,8 +307,8 @@ SubtleCrypto.prototype.digestStream = async function digestStream(algorithms, so
 
 SubtleCrypto.prototype.encryptStream = async function encryptStream(spec, source) {
   var cipher = spec.authTagLength
-    ? nodeCrypto.createCipheriv(spec.algNode, spec.key, spec.iv, { authTagLength: spec.authTagLength })
-    : nodeCrypto.createCipheriv(spec.algNode, spec.key, spec.iv);
+    ? guard.crypto.cipher(spec.algNode, spec.key, spec.iv, { authTagLength: spec.authTagLength })
+    : guard.crypto.cipher(spec.algNode, spec.key, spec.iv);
   if (spec.aad && spec.aad.length) _cipherSetAAD(cipher, spec.aad);
   var acquire = source == null ? undefined : source[_asyncIterator];
   if (typeof acquire !== "function") {
@@ -338,7 +344,7 @@ SubtleCrypto.prototype.encryptStream = async function encryptStream(spec, source
 };
 
 SubtleCrypto.prototype.decryptStream = function decryptStream(spec, ct) {
-  var decipher = nodeCrypto.createDecipheriv(spec.algNode, spec.key, spec.iv);
+  var decipher = guard.crypto.decipher(spec.algNode, spec.key, spec.iv);
   return _decipherDrive(decipher, _bufferFrom(_toBuf(ct, "decryptStream ciphertext")), _STREAM_CHUNK);
 };
 async function* _decipherDrive(decipher, ct, chunkSize) {
@@ -362,12 +368,12 @@ SubtleCrypto.prototype.generateKey = async function generateKey(algorithm, extra
   if (name === "AES-GCM" || name === "AES-CBC" || name === "AES-CTR" || name === "AES-KW") {
     var bits = alg.length;
     if (bits !== 128 && bits !== 192 && bits !== 256) throw new WebCryptoError("webcrypto/syntax", name + ": length must be 128/192/256");
-    var secret = guard.crypto.secretKey(nodeCrypto.randomBytes(bits / 8));
+    var secret = guard.crypto.secretKey(guard.crypto.randomBytes(bits / 8));
     return new CryptoKey("secret", extractable, { name: name, length: bits }, usages, secret);
   }
   if (name === "HMAC") {
     var lenBits = _hmacLengthBits(alg, "generateKey HMAC");
-    var hkey = guard.crypto.secretKey(nodeCrypto.randomBytes(lenBits / 8));
+    var hkey = guard.crypto.secretKey(guard.crypto.randomBytes(lenBits / 8));
     return new CryptoKey("secret", extractable, { name: name, hash: { name: (typeof alg.hash === "string" ? alg.hash : alg.hash.name) }, length: lenBits }, usages, hkey);
   }
 
@@ -385,7 +391,7 @@ function _generateKeyPair(alg) {
   var name = alg.name, kp, algorithm;
   if (name === "RSASSA-PKCS1-V1_5" || name === "RSA-PSS" || name === "RSA-OAEP") {
     var rsaHash = _hashObj(alg.hash, "generateKey " + name);
-    kp = nodeCrypto.generateKeyPairSync("rsa", {
+    kp = guard.crypto.generateKeyPair("rsa", {
       modulusLength: alg.modulusLength || 2048,
       publicExponent: alg.publicExponent ? _bufToBigIntNum(alg.publicExponent) : 65537,
     });
@@ -393,19 +399,19 @@ function _generateKeyPair(alg) {
   } else if (name === "ECDSA" || name === "ECDH") {
     var curve = alg.namedCurve;
     if (!CURVE_NODE[curve]) throw new WebCryptoError("webcrypto/not-supported", name + ": unsupported curve " + _stringify(curve));
-    kp = nodeCrypto.generateKeyPairSync("ec", { namedCurve: CURVE_NODE[curve] });
+    kp = guard.crypto.generateKeyPair("ec", { namedCurve: CURVE_NODE[curve] });
     algorithm = { name: name, namedCurve: curve };
   } else if (name === "ED25519" || name === "ED448" || name === "X25519" || name === "X448") {
-    kp = nodeCrypto.generateKeyPairSync(_toLowerCase(name));
+    kp = guard.crypto.generateKeyPair(_toLowerCase(name));
     algorithm = { name: _stdName(name) };
   } else if (ML_DSA_NODE[name]) {
-    kp = nodeCrypto.generateKeyPairSync(ML_DSA_NODE[name]);
+    kp = guard.crypto.generateKeyPair(ML_DSA_NODE[name]);
     algorithm = { name: name };
   } else if (ML_KEM_NODE[name]) {
-    kp = nodeCrypto.generateKeyPairSync(ML_KEM_NODE[name]);
+    kp = guard.crypto.generateKeyPair(ML_KEM_NODE[name]);
     algorithm = { name: name };
   } else if (SLH_DSA_NODE[name]) {
-    kp = nodeCrypto.generateKeyPairSync(SLH_DSA_NODE[name]);
+    kp = guard.crypto.generateKeyPair(SLH_DSA_NODE[name]);
     algorithm = { name: name };
   } else {
     throw new WebCryptoError("webcrypto/not-supported", "generateKey: unsupported algorithm " + _stringify(name));
@@ -509,7 +515,7 @@ SubtleCrypto.prototype.encrypt = async function encrypt(algorithm, key, data) {
   if (!ENCRYPT_DECRYPT_NAMES[name]) throw new WebCryptoError("webcrypto/not-supported", "encrypt: unsupported algorithm " + _stringify(name));
   _requireAlgMatch(alg, key, "encrypt");
   if (name === "RSA-OAEP") {
-    return _toArrayBuffer(nodeCrypto.publicEncrypt({
+    return _toArrayBuffer(guard.crypto.publicEncrypt({
       key: key._handle, padding: guard.crypto.padding.RSA_PKCS1_OAEP,
       oaepHash: _hashNode(key.algorithm.hash, "encrypt"),
       oaepLabel: alg.label ? _toBuf(alg.label, "encrypt label") : undefined,
@@ -520,10 +526,10 @@ SubtleCrypto.prototype.encrypt = async function encrypt(algorithm, key, data) {
     var aad = alg.additionalData ? _toBuf(alg.additionalData, "AES-GCM aad") : null;
     return _toArrayBuffer(_runCipher(function () {
       return _withSecretBytes(key, function (kb) {
-        var cipher = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-gcm", kb, iv, { authTagLength: (alg.tagLength || 128) / 8 });
-        if (aad) cipher.setAAD(aad);
+        var cipher = guard.crypto.cipher("aes-" + key.algorithm.length + "-gcm", kb, iv, { authTagLength: (alg.tagLength || 128) / 8 });
+        if (aad) guard.crypto.transformSetAAD(cipher, aad);
         var ct = guard.secret.cipherFinish(cipher, buf, WebCryptoError, "webcrypto/operation", "an AES-GCM encrypt intermediate");
-        return _bufferConcat([ct, cipher.getAuthTag()]);
+        return _bufferConcat([ct, guard.crypto.cipherAuthTag(cipher)]);
       });
     }, "encrypt"));
   }
@@ -531,7 +537,7 @@ SubtleCrypto.prototype.encrypt = async function encrypt(algorithm, key, data) {
     var cbcIv = _toBuf(alg.iv, "AES-CBC iv");
     return _toArrayBuffer(_runCipher(function () {
       return _withSecretBytes(key, function (kb) {
-        var c2 = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-cbc", kb, cbcIv);
+        var c2 = guard.crypto.cipher("aes-" + key.algorithm.length + "-cbc", kb, cbcIv);
         return guard.secret.cipherFinish(c2, buf, WebCryptoError, "webcrypto/operation", "an AES-CBC encrypt intermediate");
       });
     }, "encrypt"));
@@ -541,7 +547,7 @@ SubtleCrypto.prototype.encrypt = async function encrypt(algorithm, key, data) {
     var ctrCounter = _toBuf(alg.counter, "AES-CTR counter");
     return _toArrayBuffer(_runCipher(function () {
       return _withSecretBytes(key, function (kb) {
-        var c3 = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-ctr", kb, ctrCounter);
+        var c3 = guard.crypto.cipher("aes-" + key.algorithm.length + "-ctr", kb, ctrCounter);
         return guard.secret.cipherFinish(c3, buf, WebCryptoError, "webcrypto/operation", "an AES-CTR encrypt intermediate");
       });
     }, "encrypt"));
@@ -557,7 +563,7 @@ SubtleCrypto.prototype.decrypt = async function decrypt(algorithm, key, data) {
   if (!ENCRYPT_DECRYPT_NAMES[name]) throw new WebCryptoError("webcrypto/not-supported", "decrypt: unsupported algorithm " + _stringify(name));
   _requireAlgMatch(alg, key, "decrypt");
   if (name === "RSA-OAEP") {
-    var oaepOut = nodeCrypto.privateDecrypt({
+    var oaepOut = guard.crypto.privateDecrypt({
       key: key._handle, padding: guard.crypto.padding.RSA_PKCS1_OAEP,
       oaepHash: _hashNode(key.algorithm.hash, "decrypt"),
       oaepLabel: alg.label ? _toBuf(alg.label, "decrypt label") : undefined,
@@ -574,9 +580,9 @@ SubtleCrypto.prototype.decrypt = async function decrypt(algorithm, key, data) {
     var gcmAad = alg.additionalData ? _toBuf(alg.additionalData, "AES-GCM aad") : null;
     return _toArrayBuffer(_runCipher(function () {
       return _withSecretBytes(key, function (kb) {
-        var d = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-gcm", kb, iv, { authTagLength: tagLen });
-        if (gcmAad) d.setAAD(gcmAad);
-        d.setAuthTag(tag);
+        var d = guard.crypto.decipher("aes-" + key.algorithm.length + "-gcm", kb, iv, { authTagLength: tagLen });
+        if (gcmAad) guard.crypto.transformSetAAD(d, gcmAad);
+        guard.crypto.decipherSetAuthTag(d, tag);
         return guard.secret.cipherFinish(d, ct, WebCryptoError, "webcrypto/operation", "the recovered AES-GCM plaintext");
       });
     }, "decrypt"));
@@ -585,7 +591,7 @@ SubtleCrypto.prototype.decrypt = async function decrypt(algorithm, key, data) {
     var cbcIv2 = _toBuf(alg.iv, "AES-CBC iv");
     return _toArrayBuffer(_runCipher(function () {
       return _withSecretBytes(key, function (kb) {
-        var d2 = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-cbc", kb, cbcIv2);
+        var d2 = guard.crypto.decipher("aes-" + key.algorithm.length + "-cbc", kb, cbcIv2);
         return guard.secret.cipherFinish(d2, buf, WebCryptoError, "webcrypto/operation", "the recovered AES-CBC plaintext");
       });
     }, "decrypt"));
@@ -595,7 +601,7 @@ SubtleCrypto.prototype.decrypt = async function decrypt(algorithm, key, data) {
     var ctrCounter2 = _toBuf(alg.counter, "AES-CTR counter");
     return _toArrayBuffer(_runCipher(function () {
       return _withSecretBytes(key, function (kb) {
-        var d3 = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-ctr", kb, ctrCounter2);
+        var d3 = guard.crypto.decipher("aes-" + key.algorithm.length + "-ctr", kb, ctrCounter2);
         return guard.secret.cipherFinish(d3, buf, WebCryptoError, "webcrypto/operation", "the recovered AES-CTR plaintext");
       });
     }, "decrypt"));
@@ -644,10 +650,10 @@ function _pbkdf2Async(pw, salt, iterations, keylen, digest) {
         if (next) next();
         if (err) reject(err); else resolve(derived);
       }
-      try { nodeCrypto.pbkdf2(pw, salt, iterations, keylen, digest, done); }
+      try { guard.crypto.pbkdf2Async(pw, salt, iterations, keylen, digest, done); }
       catch (e) { done(e); }
     }
-    if (_pbkdf2InFlight < _PBKDF2_MAX_CONCURRENT) start(); else _pbkdf2Waiters.push(start);
+    if (_pbkdf2InFlight < _PBKDF2_MAX_CONCURRENT) start(); else _push(_pbkdf2Waiters,start);
   });
 }
 
@@ -656,7 +662,7 @@ async function _deriveBitsRaw(alg, key, length) {
   if (name === "ECDH" || name === "X25519" || name === "X448") {
     _requireAlgMatch(alg, alg.public, name + " public key");
     _requireOwnKey(alg.public, "deriveBits public key");
-    var secret = nodeCrypto.diffieHellman({ privateKey: key._handle, publicKey: alg.public._handle });
+    var secret = guard.crypto.diffieHellman({ privateKey: key._handle, publicKey: alg.public._handle });
     try {
       if (length == null) return _toArrayBuffer(secret);
       _requireDeriveLength(length, name);
@@ -671,7 +677,7 @@ async function _deriveBitsRaw(alg, key, length) {
   if (name === "HKDF") {
     _requireDeriveLength(length, "HKDF");
     return _withSecretBytes(key, function (ikm) {
-      var derived = nodeCrypto.hkdfSync(_hashNode(alg.hash, "HKDF"), ikm, _toBuf(alg.salt, "HKDF salt"), _toBuf(alg.info || _bufferAlloc(0), "HKDF info"), length / 8);
+      var derived = guard.crypto.hkdf(_hashNode(alg.hash, "HKDF"), ikm, _toBuf(alg.salt, "HKDF salt"), _toBuf(alg.info || _bufferAlloc(0), "HKDF info"), length / 8);
       return _types.isArrayBuffer(derived) ? derived : _toArrayBuffer(_bufferFrom(derived));
     });
   }
@@ -704,7 +710,7 @@ function _x963Kdf(hashNode, z, sharedInfo, lenBytes) {
      * hash of the shared secret with this counter in it, so a replaced write makes two blocks derive
      * from the same input and the key material repeats. */
     var ctr = _bufferAlloc(4); intrinsic.writeUInt32BE(ctr, counter, 0);
-    var h = nodeCrypto.createHash(hashNode).update(z).update(ctr).update(sharedInfo).digest();
+    var h = guard.crypto.digestParts(hashNode, [z, ctr, sharedInfo]);
     _push(blocks, h); got += h.length; counter += 1;
   }
   var joined = _bufferConcat(blocks);
@@ -752,7 +758,7 @@ SubtleCrypto.prototype.encapsulateBits = async function encapsulateBits(algorith
   _requireAlgMatch(alg, encapsulationKey, "encapsulateBits");
   if (encapsulationKey.type !== "public") throw new WebCryptoError("webcrypto/invalid-access", "encapsulateBits requires a public (encapsulation) key, got " + _stringify(encapsulationKey.type));
   var r;
-  try { r = nodeCrypto.encapsulate(encapsulationKey._handle); }
+  try { r = guard.crypto.encapsulate(encapsulationKey._handle); }
   catch (e) { throw new WebCryptoError("webcrypto/operation", "encapsulateBits: ML-KEM encapsulation failed", e); }
   try {
     return { sharedKey: _toArrayBuffer(r.sharedKey), ciphertext: _toArrayBuffer(r.ciphertext) };
@@ -774,7 +780,7 @@ SubtleCrypto.prototype.decapsulateBits = async function decapsulateBits(algorith
       "decapsulateBits: " + alg.name + " expects a " + kemRow.ct + "-octet ciphertext, got " + ct.length + " (FIPS 203 sec. 7.3)");
   }
   var ss;
-  try { ss = nodeCrypto.decapsulate(decapsulationKey._handle, ct); }
+  try { ss = guard.crypto.decapsulate(decapsulationKey._handle, ct); }
   catch (e) { throw new WebCryptoError("webcrypto/operation", "decapsulateBits: ML-KEM decapsulation failed (malformed or wrong-length ciphertext)", e); }
   try {
     return _toArrayBuffer(ss);
@@ -797,7 +803,7 @@ SubtleCrypto.prototype.wrapKey = async function wrapKey(format, key, wrappingKey
     }
     try {
       return _withSecretBytes(wrappingKey, function (wkBytes) {
-        var c = nodeCrypto.createCipheriv("aes" + wrappingKey.algorithm.length + "-wrap", wkBytes, _bufferFrom("A6A6A6A6A6A6A6A6", "hex"));
+        var c = guard.crypto.cipher("aes" + wrappingKey.algorithm.length + "-wrap", wkBytes, _bufferFrom("A6A6A6A6A6A6A6A6", "hex"));
         return _toArrayBuffer(guard.secret.cipherFinish(c, bytes, WebCryptoError, "webcrypto/operation", "an AES-KW wrap intermediate"));
       });
     } catch (e) { throw new WebCryptoError("webcrypto/operation", "wrapKey: AES-KW key wrap failed", e); }
@@ -822,7 +828,7 @@ SubtleCrypto.prototype.unwrapKey = async function unwrapKey(format, wrappedKey,
     }
     try {
       bytes = _withSecretBytes(unwrappingKey, function (kwBytes) {
-        var d = nodeCrypto.createDecipheriv("aes" + unwrappingKey.algorithm.length + "-wrap", kwBytes, _bufferFrom("A6A6A6A6A6A6A6A6", "hex"));
+        var d = guard.crypto.decipher("aes" + unwrappingKey.algorithm.length + "-wrap", kwBytes, _bufferFrom("A6A6A6A6A6A6A6A6", "hex"));
         return guard.secret.cipherFinish(d, wrapped, WebCryptoError, "webcrypto/operation", "the unwrapped key material");
       });
     } catch (e) { throw new WebCryptoError("webcrypto/operation", "unwrapKey: AES-KW key unwrap failed (integrity or length)", e); }
@@ -1015,8 +1021,13 @@ _forEach([ML_DSA_NODE, ML_KEM_NODE, SLH_DSA_NODE], function (m) {
 });
 function _algFromImport(name, alg, keyObject) {
   var wantType = IMPORT_KEY_TYPE[name];
-  if (wantType && keyObject && keyObject.asymmetricKeyType && !wantType[keyObject.asymmetricKeyType]) {
-    throw new WebCryptoError("webcrypto/data", name + ": the imported key is a " + keyObject.asymmetricKeyType +
+  /** @internal The key's own family, read through the accessor captured at load. This is the check
+   *  that binds the algorithm a caller named to the key they supplied, so reading it off the live
+   *  prototype let a replaced accessor answer `"rsa"` for an Ed25519 key and the import accepted it
+   *  as RSA-PSS. */
+  var actualType = guard.crypto.keyTypeOf(keyObject);
+  if (wantType && actualType && !wantType[actualType]) {
+    throw new WebCryptoError("webcrypto/data", name + ": the imported key is a " + actualType +
       " key, which is not compatible with algorithm " + name);
   }
   if (name === "ECDSA" || name === "ECDH") {
@@ -1130,17 +1141,17 @@ Crypto.prototype.getRandomValues = function getRandomValues(typedArray) {
   if (out.length > MAX_RANDOM_BYTES) {
     throw new WebCryptoError("webcrypto/data", "getRandomValues: byteLength exceeds " + MAX_RANDOM_BYTES);
   }
-  nodeCrypto.randomFillSync(out);
+  guard.crypto.randomFill(out);
   return typedArray;
 };
 
-Crypto.prototype.randomUUID = function randomUUID() { return nodeCrypto.randomUUID(); };
+Crypto.prototype.randomUUID = function randomUUID() { return guard.crypto.randomUUID(); };
 
 function decompressEcPoint(sec1Compressed, nodeCurve, E, code) {
   var head = sec1Compressed[0];
   if (head !== 0x02 && head !== 0x03) throw E(code, "EC point de-compression expects a compressed SEC1 point (0x02/0x03)");
   try {
-    return nodeCrypto.ECDH.convertKey(sec1Compressed, nodeCurve, undefined, undefined, "uncompressed");
+    return guard.crypto.ecConvertPoint(sec1Compressed, nodeCurve, "uncompressed");
   } catch (e) {
     throw E(code, "EC point is not on curve " + nodeCurve + " (de-compression failed)", e);
   }
@@ -1164,9 +1175,19 @@ function isCryptoKeyLike(x) {
  * key this engine did not make while the others returned it. A JWK is an object rather than
  * bytes, so only the byte formats are wrapped. */
 function exportAnyKey(key, E, code, want) {
-  var format = want || _EXPORT_FORMAT[key && key.type];
+  /** @internal At most ONE read of the key's type, and none at all when the caller named the format
+   *  it wants. It is a getter on node's own CryptoKey, so each read is a call a replacement answers,
+   *  and reading it per decision let one answer "private" where a PEM label was chosen and "public"
+   *  where the bytes were, which put a public key inside a `PRIVATE KEY` block. */
+  var keyType;
+  var readType = false;
+  function typeOnce() {
+    if (!readType) { keyType = key == null ? undefined : key.type; readType = true; }
+    return keyType;
+  }
+  var format = want || _EXPORT_FORMAT[typeOnce()];
   if (!format) throw E(code, "a CryptoKey with a private, public, or secret type is required");
-  if (want === "jwk" && !_EXPORT_FORMAT[key && key.type]) {
+  if (want === "jwk" && !_EXPORT_FORMAT[typeOnce()]) {
     throw E(code, "a CryptoKey with a private, public, or secret type is required");
   }
   var asJwk = format === "jwk";
@@ -1180,7 +1201,7 @@ function exportAnyKey(key, E, code, want) {
     throw E(code, "the CryptoKey comes from a different WebCrypto implementation and is not extractable, so its key material cannot be reached; import it through pki.webcrypto.subtle, or pass the key as DER");
   }
   var handle = key._handle;
-  if (handle instanceof nodeCrypto.KeyObject && handle.type === key.type) {
+  if (guard.crypto.isKeyObject(handle) && guard.crypto.keyKind(handle) === key.type) {
     return _resolve(_Promise).then(function () {
       if (asJwk) return guard.crypto.exportKey(handle, { format: "jwk" });
       return format === "raw" ? guard.crypto.exportKey(handle) : guard.crypto.exportKey(handle, { format: "der", type: format });
@@ -1189,7 +1210,7 @@ function exportAnyKey(key, E, code, want) {
     });
   }
   return _resolve(_Promise)
-    .then(function () { return nodeCrypto.webcrypto.subtle.exportKey(format, key); })
+    .then(function () { return guard.crypto.nodeExportKey(format, key); })
     .then(wrap, function (e) {
       throw E(code, "the CryptoKey comes from a different WebCrypto implementation and could not be exported for re-import; import it through pki.webcrypto.subtle, or pass the key as DER", e);
     });

package/lib/x509-sign.js

@@ -22,6 +22,11 @@ var x509 = require("./schema-x509");
 var signScheme = require("./sign-scheme");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
+/** @internal The append every list here is built with. `push` STORES at the index, and a store walks
+ *  the prototype chain for a setter, so an accessor inherited at an array index receives each element
+ *  as it is appended and the index reads back whatever its getter answers. These lists become the
+ *  bytes that get signed. */
+var _push = intrinsic.append;
 var _isArray = intrinsic.isArray, _bufferEquals = intrinsic.bufferEquals, _isBuffer = intrinsic.isBuffer;
 var _arrSlice = intrinsic.arraySlice, _promiseResolve = intrinsic.uncurry(intrinsic.promiseResolve);
 /** @internal The RECEIVER for the captured `Promise.resolve`, captured too. `resolve` builds through
@@ -243,23 +248,23 @@ function _buildExtensions(extSpec, ctx) {
   if (skiVal === false) {
     if (caTrue) throw _err("x509/bad-input", "a CA certificate MUST carry a subjectKeyIdentifier, so subjectKeyIdentifier: false is refused when basicConstraints cA is TRUE (RFC 5280 sec. 4.2.1.2)");
   } else {
-    out.push(_ext(O("subjectKeyIdentifier"), false, _extSki(_skiKeyId(skiVal, ctx.spki))));
+    _push(out,_ext(O("subjectKeyIdentifier"), false, _extSki(_skiKeyId(skiVal, ctx.spki))));
   }
   var akiVal = extSpec.authorityKeyIdentifier == null ? !ctx.selfSigned : extSpec.authorityKeyIdentifier;
   if (akiVal === false) {
     if (!ctx.selfSigned) throw _err("x509/bad-input", "the authorityKeyIdentifier keyIdentifier MUST be included in every certificate a CA generates other than a self-signed one, so authorityKeyIdentifier: false is refused here (RFC 5280 sec. 4.2.1.1)");
   } else {
     var akiF = _akiFields(akiVal, ctx);
-    out.push(_ext(O("authorityKeyIdentifier"), false, _extAki(akiF[0], akiF[1], akiF[2])));
+    _push(out,_ext(O("authorityKeyIdentifier"), false, _extAki(akiF[0], akiF[1], akiF[2])));
   }
-  if (ku != null) out.push(_ext(O("keyUsage"), extSpec.keyUsageCritical !== false, _extKeyUsage(ku)));
-  if (extSpec.extendedKeyUsage != null) out.push(_ext(O("extKeyUsage"), !!extSpec.extendedKeyUsageCritical, _extExtKeyUsage(extSpec.extendedKeyUsage)));
+  if (ku != null) _push(out,_ext(O("keyUsage"), extSpec.keyUsageCritical !== false, _extKeyUsage(ku)));
+  if (extSpec.extendedKeyUsage != null) _push(out,_ext(O("extKeyUsage"), !!extSpec.extendedKeyUsageCritical, _extExtKeyUsage(extSpec.extendedKeyUsage)));
   if (bc != null) {
     if (bc.cA === true && bc.critical === false) throw _err("x509/bad-input", "a CA certificate's basicConstraints MUST be critical (RFC 5280 sec. 4.2.1.9)");
-    out.push(_ext(O("basicConstraints"), bc.critical !== false, _extBasicConstraints(bc)));
+    _push(out,_ext(O("basicConstraints"), bc.critical !== false, _extBasicConstraints(bc)));
   }
-  if (extSpec.subjectAltName != null) out.push(_ext(O("subjectAltName"), ctx.subjectEmpty, _extSan(extSpec.subjectAltName)));
-  if (extSpec.certificatePolicies != null) out.push(_ext(O("certificatePolicies"), !!extSpec.certificatePoliciesCritical, _extCertPolicies(extSpec.certificatePolicies)));
+  if (extSpec.subjectAltName != null) _push(out,_ext(O("subjectAltName"), ctx.subjectEmpty, _extSan(extSpec.subjectAltName)));
+  if (extSpec.certificatePolicies != null) _push(out,_ext(O("certificatePolicies"), !!extSpec.certificatePoliciesCritical, _extCertPolicies(extSpec.certificatePolicies)));
   /** @internal Sections 4.2.2.1 and 4.2.1.15 fix these non-critical; sec. 4.2.1.13 states a SHOULD
    *  and the toolkit issues the conforming form. */
   if (extSpec.authorityInfoAccess != null) guard.list.append(out, _ext(O("authorityInfoAccess"), false, _extAia(extSpec.authorityInfoAccess)));
@@ -788,14 +793,14 @@ function _sign(spec, issuer, opts) {
    *  signature covers (draft-truskovsky-lamps-pq-hybrid-x509 sec. 4). */
   function tbsOver(extList, omitSignatureAlg) {
     var tbsChildren = [];
-    if (version !== 1) tbsChildren.push(b.explicit(0, b.integer(BigInt(version - 1))));
-    tbsChildren.push(serialTlv);
-    if (omitSignatureAlg !== true) tbsChildren.push(scheme.sigAlgId);
-    tbsChildren.push(issuerDer);
-    tbsChildren.push(validityDer);
-    tbsChildren.push(subjectDer);
-    tbsChildren.push(b.raw(spki));
-    if (extList.length) tbsChildren.push(b.explicit(3, b.sequence(extList)));
+    if (version !== 1) _push(tbsChildren,b.explicit(0, b.integer(BigInt(version - 1))));
+    _push(tbsChildren,serialTlv);
+    if (omitSignatureAlg !== true) _push(tbsChildren,scheme.sigAlgId);
+    _push(tbsChildren,issuerDer);
+    _push(tbsChildren,validityDer);
+    _push(tbsChildren,subjectDer);
+    _push(tbsChildren,b.raw(spki));
+    if (extList.length) _push(tbsChildren,b.explicit(3, b.sequence(extList)));
     return b.sequence(tbsChildren);
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/pki",
-  "version": "0.8.59",
+  "version": "0.8.61",
   "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:2b5749b0-053a-41de-947c-63a7a8df8028",
+  "serialNumber": "urn:uuid:dc638a09-3eb3-4620-b84b-f3edd3453ec6",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-10-07T05:12:27.182Z",
+    "timestamp": "2026-10-07T23:02:52.146Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/pki@0.8.59",
+      "bom-ref": "@blamejs/pki@0.8.61",
       "type": "application",
       "name": "pki",
-      "version": "0.8.59",
+      "version": "0.8.61",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "Pure-JavaScript PKI toolkit that owns its stack — X.509, ASN.1/DER, CMS, PQC-first.",
-      "purl": "pkg:npm/%40blamejs/pki@0.8.59",
+      "purl": "pkg:npm/%40blamejs/pki@0.8.61",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/pki@0.8.59",
+      "ref": "@blamejs/pki@0.8.61",
       "dependsOn": []
     }
   ]