@blamejs/pki 0.8.59 → 0.8.61

package/lib/guard-list.js

@@ -8,6 +8,7 @@ var _defineProperty = require("./guard-intrinsic").defineProperty;
 var _isArray = require("./guard-intrinsic").isArray;
 var _arrSort = require("./guard-intrinsic").sort;
 var _isSafeInteger = require("./guard-intrinsic").isSafeInteger;
+var _hasOwn = require("./guard-intrinsic").hasOwn;
 
 var MAX_ARRAY_LENGTH = 4294967295;
 
@@ -76,6 +77,67 @@ function allMatch(list, predicate) {
   return true;
 }
 
+/** @internal The first element a predicate selects, or null. Written as `list.filter(p)[0]`, the
+ * selection is a fresh array that is empty when nothing matched, and reading index 0 of an empty
+ * array answers from the array prototype: an accessor there becomes the selected element in a
+ * selection that selected nothing, which reads at every call site as "found one". `filter` also
+ * builds its result through the receiver's `Symbol.species`, so the array indexed is not necessarily
+ * one this toolkit made. This walks the own indexes and returns null when nothing matched, so a
+ * caller's `if (!found)` test answers for the list rather than for the prototype.
+ *
+ * @enforced-by behavioral -- `filter(...)[0]` has no rename-proof shape of its own beyond the method
+ * name, which the captured-operation budget already counts; the RED vectors are the empty-selection
+ * ones each consumer carries (a signedAttrs with no message-digest attribute, a certificate with no
+ * subject key identifier).
+ */
+function firstMatch(list, predicate) {
+  if (!list) return null;
+  for (var i = 0, n = _count(list, "firstMatch"); i < n; i++) {
+    if (!_hasOwn(list, i)) continue;
+    /** @internal One read of the element, tested and returned. Read again after the predicate, an
+     * own accessor at the index answers the test with one value and the caller with another, and a
+     * getter that deletes its own slot leaves the second read falling through to the prototype. */
+    var element = list[i];
+    if (predicate(element, i)) return element;
+  }
+  return null;
+}
+
+/** @internal Remove the element at `index`, shifting the ones after it down by defining each slot
+ * and then truncating through the array's own `length`. `splice` is the ordinary way to write this
+ * and it is not usable here: it returns the removed elements, so it builds that result through
+ * `ArraySpeciesCreate`, which reads the receiver's `constructor` and then its `Symbol.species`. A
+ * getter installed on `Array.prototype.constructor` receives the real array as its `this`, which
+ * hands caller code a reference to the list being edited and to every record in it, in the middle of
+ * the edit. Nothing is returned here, so nothing is constructed.
+ *
+ * @enforced-by behavioral -- `splice(i, 1)` has no rename-proof shape beyond the method name, which
+ * the captured-operation budget counts; the RED vector is the policy-node removal driven with a
+ * `constructor` getter installed.
+ */
+function removeAt(list, index) {
+  if (!_isArray(list)) throw new TypeError("guard.list.removeAt: the receiver must be an array");
+  var n = _count(list, "removeAt");
+  if (!_isSafeInteger(index) || index < 0 || index >= n) {
+    throw new RangeError("guard.list.removeAt: the index must be a position the array holds");
+  }
+  /** @internal A hole stays a hole, and is never read through. `splice` leaves an absent element
+   * absent, so a shift that defined every slot would turn one into an own `undefined`; and reading
+   * `list[i + 1]` at a hole answers from the prototype, which is the value this family exists to
+   * keep out. Each source slot is tested for own-ness once and read once. */
+  for (var i = index; i < n - 1; i++) {
+    if (_hasOwn(list, i + 1)) {
+      _defineProperty(list, i, { value: list[i + 1], writable: true, enumerable: true, configurable: true });
+    } else if (_hasOwn(list, i)) {
+      delete list[i];
+    }
+  }
+  /** @internal `length` is an array's own writable property, so assigning it consults no prototype
+   * and the assignment deletes the tail slot the shift left behind. */
+  list.length = n - 1;
+  return list;
+}
+
 // @enforced-by caller-array-copied-live
 function snapshot(list) {
   if (!_isArray(list)) throw new TypeError("guard.list.snapshot: the receiver must be an array");
@@ -132,6 +194,8 @@ module.exports = _freeze({
   containsAll: containsAll,
   anyMatches: anyMatches,
   allMatch: allMatch,
+  firstMatch: firstMatch,
+  removeAt: removeAt,
   snapshot: snapshot,
   copyMap: copyMap,
 });

package/lib/guard-name.js

@@ -177,7 +177,7 @@ function _reduceDpn(d, E, code, label) {
   for (var i = 0; i < len; i++) {
     var n = ownValue(names, i);
     if (!_isBuffer(n)) throw refuse("every fullName GeneralName must be its encoded bytes");
-    taken[i] = n;
+    _append(taken, n);
   }
   return { kind: kind, names: taken };
 }

package/lib/guard-secret.js

@@ -5,6 +5,7 @@
 
 var bytes = require("./guard-bytes");
 var intrinsic = require("./guard-intrinsic");
+var cryptoGuard = require("./guard-crypto");
 
 var _fill = intrinsic.uncurry(Uint8Array.prototype.fill);
 var _concat = intrinsic.bufferConcat;
@@ -30,8 +31,8 @@ function zeroizeAll(list, ErrorClass, code, label) {
 function cipherFinish(transform, input, ErrorClass, code, label) {
   var head = null, tail = null;
   try {
-    head = transform.update(input);
-    tail = transform.final();
+    head = cryptoGuard.transformUpdate(transform, input);
+    tail = cryptoGuard.transformFinal(transform);
     return _concat([head, tail]);
   } finally {
     zeroize(head, ErrorClass, code, label);

package/lib/hpke.js

@@ -47,7 +47,10 @@ var oid = require("./oid");
 var _hasOwn = intrinsic.hasOwn;
 var _isBuffer = intrinsic.isBuffer, _bufferFrom = intrinsic.bufferFrom, _bufferAlloc = intrinsic.bufferAlloc;
 var _bufferConcat = intrinsic.bufferConcat, _bufferEquals = intrinsic.bufferEquals, _compare = intrinsic.compare;
-var _push = intrinsic.push;
+/** @internal `append`, not a captured `push`: a store at an index walks the prototype chain for a
+ *  setter, so an accessor there takes the element being appended. The lists here become the byte
+ *  strings a KEM's key schedule is computed over. `append` defines the index. */
+var _push = intrinsic.append;
 var _subarray = intrinsic.subarray;
 
 var HpkeError = frameworkError.HpkeError;
@@ -76,7 +79,10 @@ function _pushPrefixed(parts, b, what) {
     throw _err("hpke/input-length", what + " is " + b.length + " bytes; a single-stage KDF accepts at " +
       "most " + MAX_PREFIXED + " (draft-ietf-hpke-hpke-05 sec. 7.2.1)");
   }
-  _push(parts, i2osp(b.length, 2), b);
+  /** @internal Two appends, because `append` takes one value where `push` took many: the length
+   *  prefix and the value it measures are both part of the byte string a KDF reads. */
+  _push(parts, i2osp(b.length, 2));
+  _push(parts, b);
   return parts;
 }
 /** @internal Through the capture, which is the whole point of this helper existing: every
@@ -244,10 +250,10 @@ function _importPublic(kem, raw) {
       if (raw[0] !== 0x04) throw _err("hpke/bad-key", "EC public key must be an uncompressed 0x04 point (RFC 9180 sec. 7.1.4)");
       var half = (raw.length - 1) / 2;
       var jwk = { kty: "EC", crv: kem.curve, x: raw.subarray(1, 1 + half).toString("base64url"), y: raw.subarray(1 + half).toString("base64url") };
-      return nodeCrypto.createPublicKey({ key: jwk, format: "jwk" });
+      return guard.crypto.publicKey({ key: jwk, format: "jwk" });
     }
     var prefix = kem.kind === "mlkem" ? ML_KEM_SPKI[kem.name] : OKP_SPKI[kem.curve];
-    return nodeCrypto.createPublicKey({ key: _bufferConcat([_hex(prefix), raw]), format: "der", type: "spki" });
+    return guard.crypto.publicKey({ key: _bufferConcat([_hex(prefix), raw]), format: "der", type: "spki" });
   } catch (e) {
     if (e instanceof HpkeError) throw e;
     throw _err("hpke/bad-key", "invalid " + kem.name + " public key" +
@@ -255,15 +261,15 @@ function _importPublic(kem, raw) {
   }
 }
 function _exportPublic(kem, keyObject) {
-  var pub = keyObject.type === "public" ? keyObject : nodeCrypto.createPublicKey(keyObject);
+  var pub = keyObject.type === "public" ? keyObject : guard.crypto.publicKey(keyObject);
   if (kem.kind === "mlkem") {
-    var der = pub.export({ format: "der", type: "spki" }), prefix = _hex(ML_KEM_SPKI[kem.name]);
+    var der = guard.crypto.exportKey(pub, { format: "der", type: "spki" }), prefix = _hex(ML_KEM_SPKI[kem.name]);
     if (der.length !== prefix.length + kem.Npub || !_bufferEquals(_subarray(der, 0, prefix.length), prefix)) {
       throw _err("hpke/bad-key", "the KeyObject is not an " + kem.name + " key");
     }
     return _subarray(der, prefix.length);
   }
-  var jwk = pub.export({ format: "jwk" });
+  var jwk = guard.crypto.exportKey(pub, { format: "jwk" });
   if (jwk.crv !== kem.curve) throw _err("hpke/bad-key", "the KeyObject is not a " + kem.name + " key");
   if (kem.kind === "ec") return concat([Buffer.from([0x04]), _b64u(jwk.x), _b64u(jwk.y)]);
   return _b64u(jwk.x);
@@ -287,7 +293,7 @@ function _importPrivate(kem, rawSk) {
     der = _bufferConcat([_hex(kem.kind === "mlkem" ? ML_KEM_PKCS8[kem.name] : OKP_PKCS8[kem.curve]), rawSk]);
   }
   try {
-    return nodeCrypto.createPrivateKey({ key: der, format: "der", type: kem.kind === "ec" ? "sec1" : "pkcs8" });
+    return guard.crypto.privateKey({ key: der, format: "der", type: kem.kind === "ec" ? "sec1" : "pkcs8" });
   } catch (e) {
     throw _err("hpke/bad-key", "invalid " + kem.name + " private key", e);
   } finally {
@@ -295,7 +301,7 @@ function _importPrivate(kem, rawSk) {
   }
 }
 function _boundPublic(kem, privateKey, pkm) {
-  var derived = _exportPublic(kem, nodeCrypto.createPublicKey(privateKey));
+  var derived = _exportPublic(kem, guard.crypto.publicKey(privateKey));
   if (pkm === undefined) return derived;
   if (!_isBuffer(pkm) || !_bufferEquals(derived, pkm)) {
     throw _err("hpke/bad-key", "pkm is not the " + kem.name + " public key derived from skm");
@@ -304,7 +310,7 @@ function _boundPublic(kem, privateKey, pkm) {
 }
 function _dh(privateKey, publicKey) {
   try {
-    return nodeCrypto.diffieHellman({ privateKey: privateKey, publicKey: publicKey });
+    return guard.crypto.diffieHellman({ privateKey: privateKey, publicKey: publicKey });
   } catch (e) {
     throw _err("hpke/bad-key", "KEM Diffie-Hellman failed: invalid or low-order public key", e);
   }
@@ -313,8 +319,8 @@ function _dh(privateKey, publicKey) {
  *  drawn and expanded by generateKeyPair, and an ML-KEM encapsulation takes its randomness from the
  *  runtime rather than from an ephemeral key pair. */
 function _generate(kem) {
-  if (kem.kind === "ec") return nodeCrypto.generateKeyPairSync("ec", { namedCurve: kem.nodeCurve });
-  return nodeCrypto.generateKeyPairSync(kem.curve.toLowerCase());
+  if (kem.kind === "ec") return guard.crypto.generateKeyPair("ec", { namedCurve: kem.nodeCurve });
+  return guard.crypto.generateKeyPair(intrinsic.toLowerCase(kem.curve));
 }
 
 
@@ -346,7 +352,8 @@ function _derive(xof, input, outLen) {
 function _labeledDerive(xof, suiteId, ikm, label, context, outLen) {
   var lab = _bufferFrom(label, "latin1");
   var parts = _pushPrefixed([ikm, HPKE_V1, suiteId], lab, "a derive label");
-  _push(parts, i2osp(outLen, 2), context);
+  _push(parts, i2osp(outLen, 2));
+  _push(parts, context);
   var labeledIkm = concat(parts);
   try { return _derive(xof, labeledIkm, outLen); }
   finally { guard.secret.zeroize(labeledIkm, HpkeError, "hpke/bad-input", "the labeled derive input"); }
@@ -378,8 +385,8 @@ function _hybridExpand(kem, seed) {
     var skT = _importPrivate(_groupRow(kem), _randomScalar(kem, _subarray(full, kem.pq.Nsk)));
     return {
       skPQ: skPQ, skT: skT,
-      ekPQ: _exportPublic(kem.pq, nodeCrypto.createPublicKey(skPQ)),
-      ekT: _exportPublic(_groupRow(kem), nodeCrypto.createPublicKey(skT)),
+      ekPQ: _exportPublic(kem.pq, guard.crypto.publicKey(skPQ)),
+      ekT: _exportPublic(_groupRow(kem), guard.crypto.publicKey(skT)),
     };
   } finally {
     guard.secret.zeroize(full, HpkeError, "hpke/bad-input", "the hybrid seed expansion");
@@ -484,7 +491,7 @@ function _refuseEph(kem, eph) {
 function _mlKemEncap(kem, pkR, eph) {
   _refuseEph(kem, eph);
   var r;
-  try { r = nodeCrypto.encapsulate(pkR); }
+  try { r = guard.crypto.encapsulate(pkR); }
   catch (e) { throw _err("hpke/bad-key", kem.name + " encapsulation failed", e); }
   return { sharedSecret: r.sharedKey, enc: r.ciphertext };
 }
@@ -492,7 +499,7 @@ function _mlKemDecap(kem, enc, skR) {
   if (enc.length !== kem.Nenc) {
     throw _err("hpke/bad-key", kem.name + " encapsulated key must be " + kem.Nenc + " bytes (FIPS 203 sec. 7.3 ciphertext check)");
   }
-  try { return nodeCrypto.decapsulate(skR, enc); }
+  try { return guard.crypto.decapsulate(skR, enc); }
   catch (e) { throw _err("hpke/bad-key", kem.name + " decapsulation failed", e); }
 }
 function _encap(kem, pkR, pkRm, eph) {
@@ -641,10 +648,10 @@ Context.prototype.seal = function (aad, pt) {
    *  which is what RFC 9180 sec. 5.2 uses. */
   var aadBytes = _buf(aad);
   var nonce = this._nonce();
-  var c = nodeCrypto.createCipheriv(aead.cipher, this._key, nonce, { authTagLength: aead.Nt });
-  if (aadBytes.length) c.setAAD(aadBytes);
+  var c = guard.crypto.cipher(aead.cipher, this._key, nonce, { authTagLength: aead.Nt });
+  if (aadBytes.length) guard.crypto.transformSetAAD(c, aadBytes);
   var body = guard.secret.cipherFinish(c, _buf(pt), HpkeError, "hpke/bad-input", "a seal intermediate");
-  var ct = concat([body, c.getAuthTag()]);
+  var ct = concat([body, guard.crypto.cipherAuthTag(c)]);
   this._inc();
   return ct;
 };
@@ -658,9 +665,9 @@ Context.prototype.open = function (aad, ct) {
    *  so the AAD was dropped on this side too and the pair round-tripped with nothing bound. */
   var aadBytes = _buf(aad);
   var nonce = this._nonce();
-  var d = nodeCrypto.createDecipheriv(aead.cipher, this._key, nonce, { authTagLength: aead.Nt });
-  if (aadBytes.length) d.setAAD(aadBytes);
-  d.setAuthTag(ct.subarray(ct.length - aead.Nt));
+  var d = guard.crypto.decipher(aead.cipher, this._key, nonce, { authTagLength: aead.Nt });
+  if (aadBytes.length) guard.crypto.transformSetAAD(d, aadBytes);
+  guard.crypto.decipherSetAuthTag(d, ct.subarray(ct.length - aead.Nt));
   var pt;
   try { pt = guard.secret.cipherFinish(d, ct.subarray(0, ct.length - aead.Nt), HpkeError, "hpke/bad-input", "the recovered plaintext"); }
   catch (e) { throw _err("hpke/open-failed", "AEAD authentication failed (RFC 9180 sec. 5.2)", e); }
@@ -807,7 +814,7 @@ function _recipPrivate(suite, sk) {
   }
   try {
     if (sk.type !== "private") throw _err("hpke/bad-key", "the private key must be a private KeyObject or { skm, pkm }, got a " + guard.text.showValue(sk.type) + " KeyObject");
-    var pkm = _exportPublic(kem, nodeCrypto.createPublicKey(sk));
+    var pkm = _exportPublic(kem, guard.crypto.publicKey(sk));
     return { key: sk, pkm: pkm };
   } catch (e) {
     if (e instanceof HpkeError) throw e;
@@ -1111,11 +1118,11 @@ function deriveKeyPair(kemId, ikm) {
      *  and the decapsulation key returned is that 64-byte value. */
     var dk = _labeledDerive("shake256", _kemSuiteId(_kemId(kem)), input, "DeriveKeyPair", _EMPTY, kem.Nsk);
     var mlSk = _importPrivate(kem, dk);
-    return { publicKey: _exportPublic(kem, nodeCrypto.createPublicKey(mlSk)), privateKey: dk };
+    return { publicKey: _exportPublic(kem, guard.crypto.publicKey(mlSk)), privateKey: dk };
   }
   var raw = _deriveKeyPairDhkem(kem, input);
   var sk = _importPrivate(kem, raw);
-  return { publicKey: _exportPublic(kem, nodeCrypto.createPublicKey(sk)), privateKey: raw };
+  return { publicKey: _exportPublic(kem, guard.crypto.publicKey(sk)), privateKey: raw };
 }
 
 /** @internal DeriveKeyPair for a DHKEM (RFC 9180 sec. 7.1.3). X25519 and X448 expand the extract output
@@ -1251,7 +1258,7 @@ function decap(kemId, enc, recipientPrivateKey) {
  *  Nsk rather than trusted. An ML-KEM or hybrid key never reaches here, its private half being a seed
  *  that generateKeyPair draws. */
 function _exportPrivateRaw(kem, privateKey) {
-  var raw = _b64u(privateKey.export({ format: "jwk" }).d);
+  var raw = _b64u(guard.crypto.exportKey(privateKey, { format: "jwk" }).d);
   if (!_isBuffer(raw) || raw.length !== kem.Nsk) {
     throw _err("hpke/bad-key", "the generated " + kem.name + " private key is not the " +
       kem.Nsk + "-byte scalar this verb returns");

package/lib/http-digest.js

@@ -6,6 +6,7 @@
 var crypto = require("crypto");
 var constants = require("./constants");
 var intrinsic = require("./guard-intrinsic");
+var guard = require("./guard-all");
 var guardIdentifier = require("./guard-identifier");
 var _hasOwn = intrinsic.hasOwn;
 /** @internal The URL parser, taken at load: the origin it reports is what a challenge is bound to.
@@ -46,14 +47,11 @@ var DEFAULT_CODES = intrinsic.assign(intrinsic.create(null), {
   noQop: "digest/no-qop", badChallenge: "digest/bad-challenge",
 });
 
-/** @internal The hash the credential is computed with, taken at load along with the methods of the
- * object it returns. Every Digest response value is this function's output, so a replacement chooses
- * what is sent in place of the password-derived proof. */
-var _createHash = crypto.createHash;
+/** @internal Every Digest response value is this function's output, so whatever computes it chooses
+ * what is sent in place of the password-derived proof. RFC 7616 sec. 3 computes over the octets of
+ * the latin1 encoding, which is why the input encoding is named rather than defaulted. */
 var _randomBytes = crypto.randomBytes;
-var _hashUpdate = intrinsic.uncurry(crypto.createHash("sha256").update);
-var _hashDigest = intrinsic.uncurry(crypto.createHash("sha256").digest);
-function H(hash, s) { return _hashDigest(_hashUpdate(_createHash(hash), s, "latin1"), "hex"); }
+function H(hash, s) { return guard.crypto.digest(hash, s, { input: "latin1", output: "hex" }); }
 function KD(hash, secret, data) { return H(hash, secret + ":" + data); }
 function _qstr(v) {
   var s = intrinsic.String(v), out = "";

package/lib/http-transport.js

@@ -128,7 +128,10 @@ var _toLowerCase = intrinsic.toLowerCase;
 var _fromCharCode = intrinsic.fromCharCode;
 var _isArray = intrinsic.isArray;
 var _arrIndexOf = intrinsic.indexOf;
-var _arrPush = intrinsic.push;
+/** @internal `append`, not a captured `push`: a store at an index walks the prototype chain for a
+ *  setter, so an accessor there takes the element being appended, and this list is the peer chain a
+ *  caller reads. `append` defines the index. */
+var _arrPush = intrinsic.append;
 var _arrForEach = intrinsic.forEach;
 var _isBuffer = intrinsic.isBuffer;
 var _bufferFrom = intrinsic.bufferFrom;
@@ -348,7 +351,10 @@ function _makeGuardedLookup(lookupFn) {
           var entry = address[i];
           var one = { address: entry && entry.address, family: entry && entry.family };
           if (_isBlockedIp(one.address)) return callback(_blockedAddrErr(hostname, one.address));
-          checked[i] = one;
+          /** @internal Appended by defining the index. Stored at, the store walks the prototype chain
+           *  for a setter, so an accessor there took the checked entry and node read the address it
+           *  connects to back from the getter instead: an address this check never saw. */
+          _arrPush(checked, one);
         }
         return callback(null, checked);
       }
@@ -448,7 +454,10 @@ function snapshotProxy(p) {
       var a = p.tls.anchors;
       if (_copyableArray(a)) {
         var copied = [];
-        for (var i = 0; i < a.length; i++) copied[i] = _copyAnchor(a[i]);
+        /** @internal Appended by defining the index, for the reason the address list above is: these
+         *  are the trust anchors the handshake runs under, and a store consults a setter inherited at
+         *  the index. */
+        for (var i = 0; i < a.length; i++) _arrPush(copied, _copyAnchor(a[i]));
         out.tls.anchors = copied;
       } else if (typeof a === "string") out.tls.anchors = a;
       else if (a !== null && typeof a === "object" && !nodeUtil.types.isProxy(a) && _isBuffer(a)) out.tls.anchors = _bufferFrom(a);

package/lib/inspect.js

@@ -1158,7 +1158,11 @@ function _joinAnd(list) {
  *  door can validate to arbitrary depth, so a report must not fault on any shape it is handed. */
 function _list(v) { return Array.isArray(v) ? v : []; }
 /** @internal The same for a member a loop body dereferences. */
-function _obj(v) { return (v !== null && typeof v === "object") ? v : {}; }
+/** @internal The stand-in for a value that is not a record has NO PROTOTYPE. Written as `{}`, it
+ *  inherits `Object.prototype`, so a field read off it answers with whatever a name planted there
+ *  holds and a report prints a value its subject does not carry. */
+var _EMPTY_RECORD = Object.create(null);
+function _obj(v) { return (v !== null && typeof v === "object") ? v : _EMPTY_RECORD; }
 
 /** @internal A serial reads the same wherever a report carries one, through the certificate report's own
  *  presentation: small values as decimal with the hex beside them, long ones as wrapped colon-hex. Printed
@@ -1327,7 +1331,11 @@ function _someSignerUnmatched(signed) {
 }
 function _certMatchesSid(cert, sid) {
   if (Buffer.isBuffer(sid.subjectKeyIdentifier)) {
-    var ski = _list(cert.extensions).filter(function (e) { return _obj(e).oid === OID_SUBJECT_KEY_ID; })[0];
+    /** @internal The selection returns the first matching row or null. `filter(...)[0]` indexes a
+     *  result that is EMPTY when the certificate carries no key identifier, and index 0 of an empty
+     *  array answers from the array prototype, which would report a signer match for a certificate
+     *  that carries nothing to match on. */
+    var ski = guard.list.firstMatch(_list(cert.extensions), function (e) { return _obj(e).oid === OID_SUBJECT_KEY_ID; });
     if (!ski) return false;
     // allow:swallow-unverified drop-silent display fallback: an unreadable key id matches nothing
     try { return asn1.read.octetString(asn1.decode(_obj(ski).value)).equals(sid.subjectKeyIdentifier); }

package/lib/jose.js

@@ -54,7 +54,9 @@ var _isBuffer = intrinsic.isBuffer;
 var _bufferFrom = intrinsic.bufferFrom;
 var _stringify = intrinsic.stringify;
 var _ObjectProto = intrinsic.ObjectProto;
-var _push = intrinsic.uncurry(Array.prototype.push);
+/** @internal `append`, not a captured `push`: a store at an index walks the prototype chain for a
+ *  setter, so an accessor there takes the element being appended. `append` defines it. */
+var _push = intrinsic.append;
 var _join = intrinsic.join;
 var _map = intrinsic.map;
 var _bufToString = intrinsic.uncurry(Buffer.prototype.toString);

package/lib/key.js

@@ -183,11 +183,11 @@ async function encrypt(privateKey, password, opts) {
   var prf = opts.prf || "hmacWithSHA256";
   var prfNode = pbes2.prfNodeByName(prf, _err, "key");
   var iterations = pbes2.assertIterations(opts.iterations == null ? 600000 : opts.iterations, _err, "key");
-  var salt = opts.salt != null ? pbes2.assertSalt(guard.bytes.view(opts.salt, KeyError, "key/bad-input", "salt"), _err, "key") : nodeCrypto.randomBytes(16);
-  var iv = nodeCrypto.randomBytes(16);
+  var salt = opts.salt != null ? pbes2.assertSalt(guard.bytes.view(opts.salt, KeyError, "key/bad-input", "salt"), _err, "key") : guard.crypto.randomBytes(16);
+  var iv = guard.crypto.randomBytes(16);
   var pwK = pbes2.passwordBytesOwned(password, _err, "key");
   var dk;
-  try { dk = nodeCrypto.pbkdf2Sync(pwK.bytes, salt, iterations, keyBits / 8, prfNode); }
+  try { dk = guard.crypto.pbkdf2(pwK.bytes, salt, iterations, keyBits / 8, prfNode); }
   finally { if (pwK.owned) guard.secret.zeroize(pwK.bytes, KeyError, "key/bad-input", "the password encoding"); }
   try {
     var ciphertext = pbes2.cbcEncrypt(dk, iv, der, keyBits, KeyError, "key/bad-input");
@@ -290,6 +290,10 @@ function _decryptPbes2(encAlg, ciphertext, password, opts) {
  *   var spkiPem = await pki.key.export(pair.publicKey, { format: "pem" });
  */
 var _EXPORT_OPTS = _assign(_create(null), { format: 1, label: 1 });
+/** @internal The WebCrypto export format each key type calls for, named here so the ONE read of the
+ * key's type below settles the encoding as well as the PEM label. Passing the format explicitly is
+ * what keeps the engine from reading the type a second time. */
+var _EXPORT_WANT_BY_TYPE = _assign(_create(null), { "private": "pkcs8", "public": "spki", "secret": "raw" });
 
 async function export_(key, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "key/bad-input", "pki.key.export options");
@@ -297,9 +301,14 @@ async function export_(key, opts) {
     "pki.key.export has an unknown option. It serializes only. To protect a private key, call " +
     "pki.key.encrypt(key, password) first and export its result. The unknown option was: ");
   if (!_isCryptoKey(key)) throw _err("key/bad-input", "export expects a WebCrypto CryptoKey");
+  /** @internal ONE read of the key's type, which both the PEM label and every encoding decision
+   *  below come from. On node's own CryptoKey it is a getter, so reading it per question let a
+   *  replacement answer "private" where the label was chosen and "public" where the bytes were, and
+   *  a public key came back inside a `PRIVATE KEY` block. */
+  var keyType = key.type;
   var defaultLabel;
-  if (key.type === "private") defaultLabel = "PRIVATE KEY";
-  else if (key.type === "public") defaultLabel = "PUBLIC KEY";
+  if (keyType === "private") defaultLabel = "PRIVATE KEY";
+  else if (keyType === "public") defaultLabel = "PUBLIC KEY";
   else throw _err("key/bad-input", "export supports asymmetric (private / public) CryptoKeys only");
   var fmt = opts.format || "der";
   if (fmt === "jwk") {
@@ -310,11 +319,11 @@ async function export_(key, opts) {
       throw _err("key/bad-input", "exporting the key as a JWK failed", e);
     }
   }
-  var der = await _exportAnyKey(key, _err, "key/bad-input");
+  var der = await _exportAnyKey(key, _err, "key/bad-input", _EXPORT_WANT_BY_TYPE[keyType]);
   if (fmt === "der") return der;
   if (fmt === "pem") return pkix.pemEncode(der, opts.label || defaultLabel, PemError);
-  if (fmt === "pkcs1") return _toPkcs1(der, key);
-  if (fmt === "sec1") return _toSec1(der, key);
+  if (fmt === "pkcs1") return _toPkcs1(der, key, keyType);
+  if (fmt === "sec1") return _toSec1(der, key, keyType);
   throw _err("key/bad-input", "unsupported format " + guard.text.showValue(opts.format) + " (der / pem / pkcs1 / sec1 / jwk)");
 }
 
@@ -923,18 +932,19 @@ var _PAIR_RSA = _assign(_create(null), { rsa: 1, "rsa-pss": 1 });
 var _PAIR_PROBE = _bufferFrom("pki.js key pair correspondence", "utf8");
 
 function _sameKeyFamily(priv, pub) {
-  if (priv.asymmetricKeyType === pub.asymmetricKeyType) return true;
-  return !!(_PAIR_RSA[guard.text.keyOf(priv.asymmetricKeyType)] &&
-    _PAIR_RSA[guard.text.keyOf(pub.asymmetricKeyType)]);
+  var privType = guard.crypto.keyType(priv), pubType = guard.crypto.keyType(pub);
+  if (privType === pubType) return true;
+  return !!(_PAIR_RSA[guard.text.keyOf(privType)] && _PAIR_RSA[guard.text.keyOf(pubType)]);
 }
 
 /** @internal How to exercise a signing pair: the digest, and any padding the encoding requires. An
  * `id-RSASSA-PSS` key may pin the hash and salt length it is usable with, and the engine refuses any
  * other, so a pinned value from either half is what proves the pair. */
 function _pairSignOptions(priv, pub) {
-  var privPss = priv.asymmetricKeyType === "rsa-pss", pubPss = pub.asymmetricKeyType === "rsa-pss";
+  var privType = guard.crypto.keyType(priv);
+  var privPss = privType === "rsa-pss", pubPss = guard.crypto.keyType(pub) === "rsa-pss";
   if (!privPss && !pubPss) {
-    return { digest: _PAIR_DIGEST[guard.text.keyOf(priv.asymmetricKeyType)] || null, options: null };
+    return { digest: _PAIR_DIGEST[guard.text.keyOf(privType)] || null, options: null };
   }
   var privDetails = _pssRestrictionOf(priv, privPss);
   var pubDetails = _pssRestrictionOf(pub, pubPss);
@@ -969,7 +979,7 @@ var _PSS_PINS = ["hashAlgorithm", "mgf1HashAlgorithm", "saltLength"];
  * carried, and refuse a genuine pair. */
 function _pssRestrictionOf(key, isPss) {
   var out = _create(null);
-  var details = isPss ? key.asymmetricKeyDetails : null;
+  var details = isPss ? guard.crypto.keyDetails(key) : null;
   if (details == null) return out;
   for (var i = 0; i < _PSS_PINS.length; i++) {
     var name = _PSS_PINS[i];
@@ -1026,7 +1036,7 @@ async function correspondsTo(privateKey, spkiDer) {
   try { pub = guard.crypto.publicKey({ key: pubAsPkcs3, format: "der", type: "spki" }); }
   catch (e) { throw _err("key/bad-input", "the public key could not be read", e); }
   if (!_sameKeyFamily(priv, pub)) return false;
-  var kind = guard.text.keyOf(priv.asymmetricKeyType);
+  var kind = guard.text.keyOf(guard.crypto.keyType(priv));
   /** @internal Every secret a probe makes, wiped once the verdict is decided, on every way out. */
   var secrets = [];
   try {
@@ -1041,17 +1051,17 @@ async function correspondsTo(privateKey, spkiDer) {
       return _keyEquals(guard.crypto.publicKey(priv), pub) === true;
     }
     if (_PAIR_KEM[kind]) {
-      var sealed = nodeCrypto.encapsulate(pub);
+      var sealed = guard.crypto.encapsulate(pub);
       guard.list.append(secrets, sealed.sharedKey);
-      var opened = nodeCrypto.decapsulate(priv, sealed.ciphertext);
+      var opened = guard.crypto.decapsulate(priv, sealed.ciphertext);
       guard.list.append(secrets, opened);
       return guard.crypto.constantTimeEqual(opened, sealed.sharedKey);
     }
     if (_PAIR_AGREE[kind]) {
-      var ephemeral = nodeCrypto.generateKeyPairSync(priv.asymmetricKeyType);
-      var ours = nodeCrypto.diffieHellman({ privateKey: priv, publicKey: ephemeral.publicKey });
+      var ephemeral = guard.crypto.generateKeyPair(guard.crypto.keyType(priv));
+      var ours = guard.crypto.diffieHellman({ privateKey: priv, publicKey: ephemeral.publicKey });
       guard.list.append(secrets, ours);
-      var theirs = nodeCrypto.diffieHellman({ privateKey: ephemeral.privateKey, publicKey: pub });
+      var theirs = guard.crypto.diffieHellman({ privateKey: ephemeral.privateKey, publicKey: pub });
       guard.list.append(secrets, theirs);
       if (!guard.crypto.constantTimeEqual(ours, theirs)) return false;
       /** @internal The agreement proves the SCALAR, not the encoding it was handed. RFC 7748 masks the
@@ -1194,13 +1204,13 @@ async function _importNamedFormat(input, opts) {
 /** @internal The inverse of the wrap: pull the inner key out of the PKCS#8 or SPKI the engine
  * wrote. The bytes come back as they went in, since the engine carries the inner structure
  * unchanged and this reads it rather than re-encoding it. */
-function _toPkcs1(der, key) {
-  var algOid = _wrappedAlgorithmOid(der, key);
+function _toPkcs1(der, key, keyType) {
+  var algOid = _wrappedAlgorithmOid(der, keyType);
   if (algOid !== O("rsaEncryption")) {
     throw _err("key/bad-input", "PKCS#1 is an RSA encoding (RFC 8017 App. A.1) and this key is " + _algName(key.algorithm));
   }
   var node = asn1.decode(der);
-  if (key.type === "public") {
+  if (keyType === "public") {
     var bits = asn1.read.bitString(node.children[1]);
     if (bits.unusedBits !== 0) throw _err("key/bad-input", "the exported public key does not hold whole octets");
     schemaPkcs1.parsePublic(bits.bytes);
@@ -1210,12 +1220,12 @@ function _toPkcs1(der, key) {
   schemaPkcs1.parse(inner);
   return inner;
 }
-function _toSec1(der, key) {
-  var algOid = _wrappedAlgorithmOid(der, key);
+function _toSec1(der, key, keyType) {
+  var algOid = _wrappedAlgorithmOid(der, keyType);
   if (algOid !== O("ecPublicKey")) {
     throw _err("key/bad-input", "SEC1 is an elliptic-curve private-key encoding (RFC 5915 sec. 3) and this key is " + _algName(key.algorithm));
   }
-  if (key.type !== "private") {
+  if (keyType !== "private") {
     throw _err("key/bad-input", "SEC1 encodes a private key; export the public half as SubjectPublicKeyInfo");
   }
   var node = asn1.decode(der);
@@ -1248,11 +1258,13 @@ function _toSec1(der, key) {
 }
 
 /** @internal The algorithm the wrapper names, read from whichever wrapper the key type produced:
- * a PrivateKeyInfo names it second, a SubjectPublicKeyInfo first. */
-function _wrappedAlgorithmOid(der, key) {
+ * a PrivateKeyInfo names it second, a SubjectPublicKeyInfo first. `keyType` is the one read the
+ * caller took, rather than a fresh one off the key, so every decision in an export comes from the
+ * same answer. */
+function _wrappedAlgorithmOid(der, keyType) {
   var node;
   try { node = asn1.decode(der); } catch (e) { throw _err("key/bad-input", "the exported key is not DER", e); }
-  var algSeq = key.type === "public" ? node.children[0] : node.children[1];
+  var algSeq = keyType === "public" ? node.children[0] : node.children[1];
   if (!algSeq || !algSeq.children || algSeq.children.length === 0) {
     throw _err("key/bad-input", "the exported key names no algorithm");
   }