@blamejs/pki 0.8.59 → 0.8.61

package/lib/mime.js

@@ -18,6 +18,10 @@
 
 var C = require("./constants.js");
 var guard = require("./guard-all.js");
+/** @internal The append every list here is built with: `push` stores at the index and a store
+ *  consults a setter inherited there, and these lists become the headers and parts of a message
+ *  body a signature is computed over. */
+var _push = guard.list.append;
 
 var CRLF = Buffer.from("\r\n");
 
@@ -60,7 +64,7 @@ function _unfoldHeaders(headerText) {
     var ln = lines[i];
     if (ln === "") continue;
     if ((ln[0] === " " || ln[0] === "\t") && out.length) out[out.length - 1] += " " + _stripLeadingHtab(ln);
-    else out.push(ln);
+    else _push(out,ln);
   }
   return out;
 }
@@ -103,10 +107,10 @@ function _splitSemicolons(s) {
     else if (ch === '"' && depth === 0) { inQ = !inQ; cur += ch; }
     else if (ch === "(" && !inQ) { depth++; cur += ch; }
     else if (ch === ")" && !inQ && depth > 0) { depth--; cur += ch; }
-    else if (ch === ";" && !inQ && depth === 0) { out.push(cur); cur = ""; }
+    else if (ch === ";" && !inQ && depth === 0) { _push(out,cur); cur = ""; }
     else cur += ch;
   }
-  out.push(cur);
+  _push(out,cur);
   return out;
 }
 
@@ -124,7 +128,7 @@ function parse(input, E, code) {
     if (colon < 0) throw new E(code, "a MIME header line has no colon: " + JSON.stringify(rawHeaders[i].slice(0, 40)));
     var nm = rawHeaders[i].slice(0, colon).trim();
     var body = rawHeaders[i].slice(colon + 1);
-    headers.push({ name: nm, lname: nm.toLowerCase(), value: body.trim(), rawValue: body.charAt(0) === " " ? body.slice(1) : body });
+    _push(headers,{ name: nm, lname: nm.toLowerCase(), value: body.trim(), rawValue: body.charAt(0) === " " ? body.slice(1) : body });
   }
   function header(name) { var l = name.toLowerCase(); for (var j = 0; j < headers.length; j++) if (headers[j].lname === l) return headers[j].value; return null; }
   var ctv = header("content-type");
@@ -160,7 +164,7 @@ function splitMultipart(bodyBytes, boundary, E, code) {
     var partEnd = next;
     if (partEnd >= 2 && body[partEnd - 2] === 0x0d && body[partEnd - 1] === 0x0a) partEnd -= 2;
     else if (partEnd >= 1 && body[partEnd - 1] === 0x0a) partEnd -= 1;
-    parts.push(body.subarray(pos, partEnd));
+    _push(parts,body.subarray(pos, partEnd));
     var afterDelim = next + delim.length;
     if (body[afterDelim] === 0x2d && body[afterDelim + 1] === 0x2d) break;
     pos = _afterLine(body, afterDelim, E, code);

package/lib/ocsp.js

@@ -23,7 +23,6 @@
  * @card Build, sign, and verify RFC 6960 OCSP requests + responses (a responder + a relying party).
  */
 
-var nodeCrypto = require("crypto");
 var asn1 = require("./asn1-der");
 var pkiBuild = require("./pki-build");
 var _ocspIntrinsic = require("./guard-intrinsic");
@@ -51,6 +50,9 @@ var ocspRequestVerify = require("./ocsp-request-verify");
 var webcrypto = require("./webcrypto");
 var subtle = webcrypto.webcrypto.subtle;
 var guard = require("./guard-all");
+/** @internal The append every list here is built with: `push` stores at the index and a store
+ *  consults a setter inherited there, and these lists become a signed request or response. */
+var _push = guard.list.append;
 var constants = require("./constants");
 var frameworkError = require("./framework-error");
 var E = _err;
@@ -230,7 +232,7 @@ function _buildRequest(query, opts) {
         var singles = pkiBuild.reqDenseArray(q.singleRequestExtensions, "singleRequestExtensions", _err, "ocsp/bad-input");
         if (singles.length) {
           if (lightweight) throw _err("ocsp/bad-input", "the lightweight profile permits no singleRequestExtensions (RFC 5019 sec. 2.1.1)");
-          reqChildren.push(b.explicit(0, b.sequence(singles)));
+          _push(reqChildren,b.explicit(0, b.sequence(singles)));
         }
       }
       return b.sequence(reqChildren);
@@ -238,15 +240,15 @@ function _buildRequest(query, opts) {
   }));
   return _ocspIntrinsic.chain(builtRequests, function (requests) {
     var tbsChildren = [];
-    if (requestorNameDer !== null) tbsChildren.push(b.explicit(1, b.contextConstructed(4, requestorNameDer)));
-    tbsChildren.push(b.sequence(requests));
+    if (requestorNameDer !== null) _push(tbsChildren,b.explicit(1, b.contextConstructed(4, requestorNameDer)));
+    _push(tbsChildren,b.sequence(requests));
     var reqExts = [];
     if (opts.nonce) {
-      var nonceBytes = opts.nonce === true ? nodeCrypto.randomBytes(32) : opts.nonce;
+      var nonceBytes = opts.nonce === true ? guard.crypto.randomBytes(32) : opts.nonce;
       _assertNonce(nonceBytes, REQUESTER_NONCE_FLOOR);
-      reqExts.push(_nonceExt(nonceBytes));
+      _push(reqExts,_nonceExt(nonceBytes));
     }
-    if (reqExts.length) tbsChildren.push(b.explicit(2, b.sequence(reqExts)));
+    if (reqExts.length) _push(tbsChildren,b.explicit(2, b.sequence(reqExts)));
     var tbsRequest = b.sequence(tbsChildren);
     if (signerCert === null) return _emitReq(b.sequence([tbsRequest]), opts);
     var scheme = signScheme.resolveSignScheme(signerCert, { combinedRsaSig: true }, true, _signE);
@@ -389,9 +391,9 @@ function _signResponse(responseData, responder, respCert, respCertDer, responder
       }
       var rdChildren = [ridNode, b.generalizedTime(_asEncodableDate(responseData.producedAt, "producedAt") || new Date()), b.sequence(srNodes)];
       var respExts = [];
-      if (opts.nonce != null) { _assertNonce(opts.nonce, RESPONDER_NONCE_FLOOR); respExts.push(_nonceExt(opts.nonce)); }
-      if (opts.extendedRevoke || anyNonIssued) respExts.push(b.sequence([b.oid(OID_EXTENDED_REVOKE), b.octetString(b.nullValue())]));
-      if (respExts.length) rdChildren.push(b.explicit(1, b.sequence(respExts)));
+      if (opts.nonce != null) { _assertNonce(opts.nonce, RESPONDER_NONCE_FLOOR); _push(respExts,_nonceExt(opts.nonce)); }
+      if (opts.extendedRevoke || anyNonIssued) _push(respExts,b.sequence([b.oid(OID_EXTENDED_REVOKE), b.octetString(b.nullValue())]));
+      if (respExts.length) _push(rdChildren,b.explicit(1, b.sequence(respExts)));
       var responseDataDer = b.sequence(rdChildren);
       var scheme = signScheme.resolveSignScheme(respCert, { combinedRsaSig: true }, true, _signE);
       return _ocspIntrinsic.chain(signScheme.signOverTbs(scheme, responderKey, responseDataDer, _signE), function (sig) {
@@ -401,7 +403,7 @@ function _signResponse(responseData, responder, respCert, respCertDer, responder
         var selfChecked = _promiseResolve(_Promise, _b.assertSignatureVerifies(responseDataDer, sig, respCert.subjectPublicKeyInfo.bytes, scheme));
         return _ocspIntrinsic.chain(selfChecked, function () {
           var basicChildren = [responseDataDer, scheme.sigAlgId, b.bitString(sig, 0)];
-          if (opts.embedCert !== false) basicChildren.push(b.explicit(0, b.sequence([b.raw(respCertDer)])));
+          if (opts.embedCert !== false) _push(basicChildren,b.explicit(0, b.sequence([b.raw(respCertDer)])));
           var responseBytes = b.sequence([b.oid(OID_OCSP_BASIC), b.octetString(b.sequence(basicChildren))]);
           var der = b.sequence([b.enumerated(0n), b.explicit(0, responseBytes)]);
           return opts.pem ? ocspSchema.pemEncode(der, "OCSP RESPONSE") : der;
@@ -426,7 +428,7 @@ function _asEncodableDate(d, which) {
 function _snapshotSignerKey(key, owned) {
   if (Buffer.isBuffer(key) || key instanceof Uint8Array) {   // allow:byte-source-narrow -- responder private key on the key-ownership contract (Buffer / Uint8Array / PEM / CryptoKey); widening keys is a separate root decision
     var copy = guard.bytes.snapshot(key, OcspError, "ocsp/bad-input", "the responder key");
-    owned.push(copy);
+    _push(owned,copy);
     return copy;
   }
   if (key && typeof key === "object" && (key.mldsa != null || key.trad != null)) {
@@ -482,10 +484,10 @@ function _buildSingleResponse(r, opts) {
     var statusNode = _certStatusNode(r.status, opts);
     var nonIssued = _isNonIssuedStatus(r.status);
     var srChildren = [certID, statusNode, b.generalizedTime(thisUpdate)];
-    if (nextUpdate !== null) srChildren.push(b.explicit(0, b.generalizedTime(nextUpdate)));
+    if (nextUpdate !== null) _push(srChildren,b.explicit(0, b.generalizedTime(nextUpdate)));
     if (r.singleExtensions != null) {
       var singleDer = _singleExtensionsDer(r.singleExtensions, nonIssued);
-      if (singleDer.length) srChildren.push(b.explicit(1, b.sequence(singleDer)));
+      if (singleDer.length) _push(srChildren,b.explicit(1, b.sequence(singleDer)));
     }
     return { node: b.sequence(srChildren), nonIssued: nonIssued };
   });
@@ -558,7 +560,7 @@ function _singleExtensionsDer(spec, nonIssued) {
   var out = [];
   if (spec.archiveCutoff != null) {
     guard.time.assertEncodable(spec.archiveCutoff, _err, "ocsp/bad-input", "singleExtensions archiveCutoff");
-    out.push(b.sequence([b.oid(oid.byName("ocspArchiveCutoff")), b.octetString(b.generalizedTime(spec.archiveCutoff))]));
+    _push(out,b.sequence([b.oid(oid.byName("ocspArchiveCutoff")), b.octetString(b.generalizedTime(spec.archiveCutoff))]));
   }
   if (spec.crlReferences != null) {
     if (nonIssued) throw _err("ocsp/bad-input", NON_ISSUED_FORBIDDEN);
@@ -575,18 +577,18 @@ function _singleExtensionsDer(spec, nonIssued) {
       for (var j = 0; j < c.crlUrl.length; j++) {
         if (c.crlUrl.charCodeAt(j) > 0x7f) throw _err("ocsp/bad-input", "crlReferences crlUrl must be 7-bit ASCII (an IA5String, RFC 6960 sec. 4.4.2)");
       }
-      fields.push(b.explicit(0, b.ia5(c.crlUrl)));
+      _push(fields,b.explicit(0, b.ia5(c.crlUrl)));
     }
     if (c.crlNum != null) {
       var num = guard.range.authoredInteger(c.crlNum, _err, "ocsp/bad-input", "crlReferences crlNum");
       if (num < 0n) throw _err("ocsp/bad-input", "crlReferences crlNum must be non-negative (it is a cRLNumber, RFC 5280 sec. 5.2.3)");
-      fields.push(b.explicit(1, b.integer(num)));
+      _push(fields,b.explicit(1, b.integer(num)));
     }
     if (c.crlTime != null) {
       guard.time.assertEncodable(c.crlTime, _err, "ocsp/bad-input", "crlReferences crlTime");
-      fields.push(b.explicit(2, b.generalizedTime(c.crlTime)));
+      _push(fields,b.explicit(2, b.generalizedTime(c.crlTime)));
     }
-    out.push(b.sequence([b.oid(oid.byName("ocspCrl")), b.octetString(b.sequence(fields))]));
+    _push(out,b.sequence([b.oid(oid.byName("ocspCrl")), b.octetString(b.sequence(fields))]));
   }
   return out;
 }
@@ -600,7 +602,7 @@ function _certStatusNode(status, opts) {
     if (status.revocationReason != null) {
       var code = typeof status.revocationReason === "number" ? status.revocationReason : REASON_CODE[guard.text.keyOf(status.revocationReason)];
       if (code == null) throw _err("ocsp/bad-input", "unknown revocationReason " + guard.text.showValue(status.revocationReason));
-      ri.push(b.explicit(0, b.enumerated(BigInt(code))));
+      _push(ri,b.explicit(0, b.enumerated(BigInt(code))));
     }
     return b.contextConstructed(1, Buffer.concat(ri));
   }
@@ -744,14 +746,14 @@ function _reqVerdict(parsed, extra) {
 async function _findRequestSigners(candidates, strict, parsed, sig, sigBits) {
   var parsedList = [];
   for (var i = 0; i < candidates.length; i++) {
-    try { parsedList.push({ der: candidates[i], cert: x509.parse(candidates[i]) }); }
+    try { _push(parsedList,{ der: candidates[i], cert: x509.parse(candidates[i]) }); }
     catch (e) { if (strict) throw _err("ocsp/bad-signer-cert", "an opts.certs entry does not parse as an X.509 certificate", e); }
   }
   var parseable = parsedList.map(function (p) { return p.der; });
   var matches = [];
   for (var j = 0; j < parsedList.length; j++) {
     if (await ocspRequestVerify.verifyRequestSignature(sig.signatureAlgorithm, sigBits, parsedList[j].cert.subjectPublicKeyInfo.bytes, parsed.tbsRequestBytes)) {
-      matches.push({ der: parsedList[j].der, subject: parsedList[j].cert.subject });
+      _push(matches,{ der: parsedList[j].der, subject: parsedList[j].cert.subject });
     }
   }
   return { matches: matches, parseable: parseable };
@@ -770,7 +772,7 @@ function _requestorNamed(parsed, matches) {
   if (!rn.value.rdns.length) return { named: [], reason: "the signed OCSP request's requestorName is an empty distinguished name, which names nobody (RFC 6960 sec. 4.1.2)" };
   var named = [];
   for (var i = 0; i < matches.length; i++) {
-    if (guard.name.dnEqual(matches[i].subject.rdns, rn.value.rdns, _err, "ocsp/bad-input", "the requestorName")) named.push(matches[i]);
+    if (guard.name.dnEqual(matches[i].subject.rdns, rn.value.rdns, _err, "ocsp/bad-input", "the requestorName")) _push(named,matches[i]);
   }
   if (named.length) return { named: named, reason: null };
   return { named: [], reason: "the requestorName " + guard.text.showValue(rn.value.dn) + " is not the subject of a certificate that signed the request (RFC 6960 sec. 4.1.2)" };
@@ -866,7 +868,7 @@ async function verifyRequest(request, opts) {
   var suppliedCerts = [];
   if (opts.certs != null) {
     var list = pkiBuild.reqDenseArray(opts.certs, "opts.certs", _err, "ocsp/bad-input");
-    for (var i = 0; i < list.length; i++) suppliedCerts.push(_normCertDer(list[i], "an opts.certs entry"));
+    for (var i = 0; i < list.length; i++) _push(suppliedCerts,_normCertDer(list[i], "an opts.certs entry"));
   }
   if (!suppliedCerts.length) {
     return _reqVerdict(parsed, { signed: true, signatureValid: false,

package/lib/path-validate.js

@@ -57,7 +57,6 @@ var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
 var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 var _pop = intrinsic.pop;
-var _splice = intrinsic.splice;
 var _strSlice = intrinsic.uncurry(String.prototype.slice);
 var _strIndexOf = intrinsic.uncurry(String.prototype.indexOf);
 /** @internal The case fold a name constraint is compared under. Read off the live prototype, it is
@@ -761,9 +760,17 @@ function absorbNameConstraints(state, decoded) {
  * `state.policyIndex[depth]` maps a policy identifier to the one node at that depth, so the "is there
  * already a node here for this policy" question every step asks is a lookup rather than a walk.
  */
+/** @internal The predicate for "the first element this list holds", so a selection reads one slot
+ * once rather than testing it and then reading it. */
+function _anyElement() { return true; }
 function graphRoot() {
   return { depth: 0, validPolicy: OID.anyPolicy, qualifierSet: [], expectedPolicySet: [OID.anyPolicy], children: [], parents: [] };
 }
+/** @internal `policyIndex` has NO PROTOTYPE, because it is keyed by depth and holds nothing at a
+ * depth no node has been placed at yet. Held in an array, every such depth was a hole: reading one
+ * answered from the array prototype, so a value installed at an index was taken for the layer at
+ * that depth and the lookups below read their nodes, and the expected policy sets those nodes carry,
+ * out of it. Creating the layer was a store at the same index, which runs an inherited setter. */
 function policyLayer(state, depth) {
   var layer = state.policyIndex[depth];
   if (layer === undefined) { layer = intrinsic.create(null); state.policyIndex[depth] = layer; }
@@ -805,13 +812,20 @@ function removePolicyNode(state, node) {
   /** @internal The unlinking walks come from the captures. Removing a node is how a policy stops
    * being valid for the chain, so a walk that skips an edge leaves the node reachable and the policy
    * still counted after the step that disqualified it. */
+  /** @internal The removal goes through `guard.list.removeAt`, not `splice`. `splice` RETURNS what it
+   * removed, so it builds that result through `ArraySpeciesCreate`, which reads the receiver's
+   * `constructor` and then its `Symbol.species`: a getter installed on `Array.prototype.constructor`
+   * is handed the real `children` array as its `this`, which gives caller code a reference to the
+   * policy-node records mid-edit and a window to change a surviving node's expected-policy set
+   * before the walk reads it. Capturing `splice` closes which function runs, not the protocol it
+   * consults. `removeAt` returns nothing and constructs nothing. */
   intrinsic.forEach(node.parents, function (p) {
-    var idx = intrinsic.indexOf(p.children, node);
-    if (idx !== -1) _splice(p.children, idx, 1);
+    var idx = intrinsic.ownIndexOf(p.children, node);
+    if (idx !== -1) guard.list.removeAt(p.children, idx);
   });
   intrinsic.forEach(node.children, function (c) {
-    var idx = intrinsic.indexOf(c.parents, node);
-    if (idx !== -1) _splice(c.parents, idx, 1);
+    var idx = intrinsic.ownIndexOf(c.parents, node);
+    if (idx !== -1) guard.list.removeAt(c.parents, idx);
   });
   node.parents = [];
   var layer = state.policyIndex[node.depth];
@@ -1007,7 +1021,7 @@ function _initialState(certs, params, seeds, anchor, n, ta, policySwitches) {
   var anchorPathLen = ta.pathLenConstraint;
   return {
     validPolicyGraph: graphRoot(),
-    policyIndex: [],
+    policyIndex: intrinsic.create(null),
     policyNodeCount: 1,
     maxPolicyNodes: params.maxPolicyNodes !== undefined ? params.maxPolicyNodes : constants.LIMITS.PATH_MAX_POLICY_NODES,
     minRsaModulusBits: params.minRsaModulusBits !== undefined ? params.minRsaModulusBits : constants.LIMITS.RSA_MIN_MODULUS_BITS,
@@ -1250,7 +1264,12 @@ function applyPolicyMappings(state, mappings, i) {
       if (anyHere === null) return;
       var anyPrev = nodeAt(state, i - 1, OID.anyPolicy);
       if (anyPrev === null) return;
-      addPolicyNode(state, i, idp, anyHere.qualifierSet[0] || null, intrinsic.copyList(mappedFrom[idp]), [anyPrev]);
+      /** @internal The qualifier is the first element the list HOLDS, in one read. `qualifierSet[0]`
+       * on an empty list answers from the array prototype, so a value installed there would become
+       * the qualifier of a node this step generates; an own-slot test followed by a read is two
+       * reads of one slot, which an accessor answers twice. */
+      var anyQual = guard.list.firstMatch(anyHere.qualifierSet, _anyElement);
+      addPolicyNode(state, i, idp, anyQual, intrinsic.copyList(mappedFrom[idp]), [anyPrev]);
     });
     return;
   }
@@ -1575,7 +1594,10 @@ async function _validate(path, opts, run, scope) {
     var preNc = _precaptureAnchorNameConstraints(anchorEntries, "validate");
     var tuples = [];
     for (var ti = 0; ti < anchorEntries.length; ti++) {
-      tuples[ti] = toAnchor(anchorEntries[ti], "validate");
+      /** @internal Appended by defining the index. A store at an index this list has no own property
+       * at consults a setter inherited from the array prototype, and these are the trust anchors each
+       * attempt below is run against. */
+      guard.list.append(tuples, toAnchor(anchorEntries[ti], "validate"));
       if (preNc[ti] !== undefined) intrinsic.defineProperty(tuples[ti], "nameConstraints", { value: preNc[ti], enumerable: true, configurable: true, writable: true });
     }
     /** @internal Each anchor is a separate attempt and the later ones run after an await, so the
@@ -2953,19 +2975,27 @@ function _copyAtv(atv) {
   return out;
 }
 
+/** @internal Each count is read ONCE and each element is read once. `isArray` is satisfied by a
+ * Proxy over an array, so a `length` trap answers afresh on every read: the length the result was
+ * sized to and the length the walk ran to could differ, and an element read three times for a type
+ * test, a copy and a fallback could be three different values, which is a copy of something the test
+ * never saw. This is the door a caller's own distinguished name comes through. */
 function _copyRdnsDeep(rdns) {
   if (!intrinsic.isArray(rdns)) return rdns;
   var out = [];
-  out.length = rdns.length;
-  for (var i = 0; i < rdns.length; i++) {
+  var n = guard.list.count(rdns, "name rdns");
+  out.length = n;
+  for (var i = 0; i < n; i++) {
     if (!intrinsic.hasOwn(rdns, i)) continue;
     var rdn = rdns[i], val;
     if (intrinsic.isArray(rdn)) {
       var rdnOut = [];
-      rdnOut.length = rdn.length;
-      for (var j = 0; j < rdn.length; j++) {
+      var m = guard.list.count(rdn, "a name rdn");
+      rdnOut.length = m;
+      for (var j = 0; j < m; j++) {
         if (!intrinsic.hasOwn(rdn, j)) continue;
-        var atv = (rdn[j] !== null && typeof rdn[j] === "object") ? _copyAtv(rdn[j]) : rdn[j];
+        var raw = rdn[j];
+        var atv = (raw !== null && typeof raw === "object") ? _copyAtv(raw) : raw;
         intrinsic.defineProperty(rdnOut, j, { value: atv, enumerable: true, configurable: true, writable: true });
       }
       val = rdnOut;

package/lib/pbes2.js

@@ -3,11 +3,14 @@
 "use strict";
 // @internal
 
-var nodeCrypto = require("crypto");
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
 var webcrypto = require("./webcrypto");
 var guard = require("./guard-all");
+/** @internal The append every list here is built with: `push` stores at the index and a store
+ *  consults a setter inherited there, and these lists become the key-derivation parameters an
+ *  encrypted structure declares. */
+var _push = guard.list.append;
 var C = require("./constants");
 
 var b = asn1.build;
@@ -48,7 +51,7 @@ function prfNodeByOid(oidStr, E, prefix) { if (!PRF_NODE_BY_OID[oidStr]) throw E
 
 function pbkdf2ParamsSeq(salt, iterations, prf) {
   var kids = [b.octetString(salt), b.integer(BigInt(iterations))];
-  if (prf !== "hmacWithSHA1") kids.push(b.sequence([b.oid(O(prf)), b.nullValue()]));
+  if (prf !== "hmacWithSHA1") _push(kids,b.sequence([b.oid(O(prf)), b.nullValue()]));
   return b.sequence(kids);
 }
 
@@ -98,11 +101,11 @@ function parsePbkdf2Params(paramsDer, opts, E, prefix, strictPrf) {
 }
 
 function cbcEncrypt(key, iv, plaintext, keyBits, E, code) {
-  var c = nodeCrypto.createCipheriv("aes-" + keyBits + "-cbc", key, iv);
+  var c = guard.crypto.cipher("aes-" + keyBits + "-cbc", key, iv);
   return guard.secret.cipherFinish(c, plaintext, E, code, "a content-encryption intermediate");
 }
 function cbcDecrypt(key, iv, ct, keyBits, E, code) {
-  var d = nodeCrypto.createDecipheriv("aes-" + keyBits + "-cbc", key, iv);
+  var d = guard.crypto.decipher("aes-" + keyBits + "-cbc", key, iv);
   return guard.secret.cipherFinish(d, ct, E, code, "the partially recovered plaintext");
 }
 
@@ -114,9 +117,9 @@ function pbes2Encrypt(pwBytes, plaintext, opts, E, prefix) {
   var prf = opts.prf || "hmacWithSHA256";
   var prfNode = prfNodeByName(prf, E, prefix);
   var iterations = assertIterations(opts.iterations == null ? 2048 : opts.iterations, E, prefix);
-  var salt = opts.salt != null ? assertSalt(opts.salt, E, prefix) : nodeCrypto.randomBytes(16);
-  var iv = opts.iv != null ? opts.iv : nodeCrypto.randomBytes(16);
-  var key = nodeCrypto.pbkdf2Sync(pwBytes, salt, iterations, keyBits / 8, prfNode);
+  var salt = opts.salt != null ? assertSalt(opts.salt, E, prefix) : guard.crypto.randomBytes(16);
+  var iv = opts.iv != null ? opts.iv : guard.crypto.randomBytes(16);
+  var key = guard.crypto.pbkdf2(pwBytes, salt, iterations, keyBits / 8, prfNode);
   try {
     return { algId: pbes2AlgId(salt, iterations, prf, cipherName, iv), ct: cbcEncrypt(key, iv, plaintext, keyBits, E, prefix + "/bad-input") };
   } finally {
@@ -148,7 +151,7 @@ function pbes2Decrypt(pwBytes, params, ciphertext, opts, E, prefix, budget) {
     budget.rounds -= pb.iterations;
     if (budget.rounds < 0) throw E(prefix + "/iteration-limit", "the aggregate PBKDF2 key-derivation work exceeds the budget (a hostile many-element input)");
   }
-  var dk = nodeCrypto.pbkdf2Sync(pwBytes, pb.salt, pb.iterations, keyBits / 8, pb.prfNode);
+  var dk = guard.crypto.pbkdf2(pwBytes, pb.salt, pb.iterations, keyBits / 8, pb.prfNode);
   try { return cbcDecrypt(dk, iv, ciphertext, keyBits, E, prefix + "/decrypt-failed"); }
   catch (_e) { throw E(prefix + "/decrypt-failed", "decryption failed"); }
   finally { guard.secret.zeroize(dk, E, prefix + "/bad-input", "the password-derived decryption key"); }
@@ -158,7 +161,7 @@ function _hmacAlgId(name) { return b.sequence([b.oid(O(name)), b.nullValue()]);
 
 function pbmac1AlgId(desc) {
   var pbkdf2Params = [b.octetString(desc.salt), b.integer(BigInt(desc.iterationCount)), b.integer(BigInt(desc.keyLength))];
-  if (desc.prfName !== "hmacWithSHA1") pbkdf2Params.push(_hmacAlgId(desc.prfName));
+  if (desc.prfName !== "hmacWithSHA1") _push(pbkdf2Params,_hmacAlgId(desc.prfName));
   var pbkdf2AlgId = b.sequence([b.oid(O("pbkdf2")), b.sequence(pbkdf2Params)]);
   return b.sequence([b.oid(O("pbmac1")), b.sequence([pbkdf2AlgId, _hmacAlgId(desc.macName)])]);
 }

package/lib/pkcs11-uri.js

@@ -57,7 +57,9 @@ var _assign = intrinsic.assign;
 var _hasOwn = intrinsic.hasOwn;
 var _keys = intrinsic.keys;
 var _forEach = intrinsic.forEach;
-var _push = intrinsic.push;
+/** @internal `append`, not a captured `push`: a store at an index walks the prototype chain for a
+ *  setter, so an accessor there takes the element being appended. `append` defines it. */
+var _push = intrinsic.append;
 var _join = intrinsic.join;
 var _String = intrinsic.String;
 var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);

package/lib/pkcs12-build.js

@@ -17,7 +17,6 @@
  * @card Build a password-integrity PKCS#12 store (RFC 7292 / RFC 9579) and verify its MAC.
  */
 
-var nodeCrypto = require("crypto");
 var asn1 = require("./asn1-der");
 var rc2 = require("./rc2");
 var oid = require("./oid");
@@ -34,6 +33,9 @@ var pkix = require("./schema-pkix");
 var pkiBuild = require("./pki-build");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
+/** @internal The append every list here is built with: `push` stores at the index and a store
+ *  consults a setter inherited there, and these lists become the bags a PFX carries under its MAC. */
+var _push = intrinsic.append;
 var _toLower = intrinsic.uncurry(String.prototype.toLowerCase);
 var frameworkError = require("./framework-error");
 var C = require("./constants");
@@ -147,7 +149,7 @@ function _p12Kdf(hashName, id, pwBytes, salt, iterations, nBytes) {
     var A = Buffer.concat([D, I]);
     for (var r = 0; r < iterations; r++) {
       var prev = A;
-      A = nodeCrypto.createHash(hashName).update(A).digest();
+      A = guard.crypto.digest(hashName, A);
       guard.secret.zeroize(prev, Pkcs12Error, "pkcs12/bad-input", "a key-derivation intermediate");
     }
     A.copy(out, i * u);
@@ -197,11 +199,11 @@ function _bagAttributes(bag) {
     if (typeof bag.friendlyName !== "string") {
       throw _err("pkcs12/bad-input", "a bag's friendlyName must be a string, since it is the text a key store lists the bag under");
     }
-    attrs.push(b.sequence([b.oid(O("friendlyName")), b.set([b.bmpString(bag.friendlyName)])]));
+    _push(attrs,b.sequence([b.oid(O("friendlyName")), b.set([b.bmpString(bag.friendlyName)])]));
   }
   if (bag.localKeyId != null) {
     if (bag.localKeyId === "ski") throw _err("pkcs12/bad-input", "localKeyId 'ski' auto-derivation is not yet supported -- supply an explicit Buffer");
-    attrs.push(b.sequence([b.oid(O("localKeyId")), b.set([b.octetString(_bytes(bag.localKeyId, "localKeyId"))])]));
+    _push(attrs,b.sequence([b.oid(O("localKeyId")), b.set([b.octetString(_bytes(bag.localKeyId, "localKeyId"))])]));
   }
   return attrs.length ? b.set(attrs) : null;
 }
@@ -214,7 +216,7 @@ function _secretTypeOid(id) {
 function _safeBag(bagName, bagValueDer, bag) {
   var children = [b.oid(O(bagName)), b.explicit(0, bagValueDer)];
   var attrs = _bagAttributes(bag);
-  if (attrs) children.push(attrs);
+  if (attrs) _push(children,attrs);
   return b.sequence(children);
 }
 
@@ -348,7 +350,7 @@ async function _buildMacData(macOpts, sharedPassword, authSafeDer) {
   var password = macOpts.password != null ? macOpts.password : sharedPassword;
   var algorithm = macOpts.algorithm || "hmac";
   var hash = macOpts.hash || "sha256";
-  var salt = macOpts.salt != null ? _bytes(macOpts.salt, "mac salt") : nodeCrypto.randomBytes(MAC_SALT_BYTES);
+  var salt = macOpts.salt != null ? _bytes(macOpts.salt, "mac salt") : guard.crypto.randomBytes(MAC_SALT_BYTES);
   if (salt.length === 0) throw _err("pkcs12/bad-input", "the MAC salt must be non-empty (RFC 9579 sec. 4c)");
   if (salt.length > C.LIMITS.PBKDF2_MAX_SALT) throw _err("pkcs12/bad-input", "the MAC salt exceeds the " + C.LIMITS.PBKDF2_MAX_SALT + "-octet cap");
 
@@ -360,7 +362,7 @@ async function _buildMacData(macOpts, sharedPassword, authSafeDer) {
     var macKey = _p12Kdf(node, 3, macPw.bytes, salt, iter, P12_KDF_UV[node].u);
     if (macPw.owned) guard.secret.zeroize(macPw.bytes, Pkcs12Error, "pkcs12/bad-input", "the password encoding");
     try {
-      var digest = nodeCrypto.createHmac(node, macKey).update(authSafeDer).digest();
+      var digest = guard.crypto.hmac(node, macKey, authSafeDer);
       var digestInfo = b.sequence([b.sequence([b.oid(O(node)), b.nullValue()]), b.octetString(digest)]);
       return b.sequence([digestInfo, b.octetString(salt), b.integer(BigInt(iter))]);
     } finally {
@@ -485,18 +487,18 @@ function _normalizeSpec(spec, opts, form) {
     var enveloped = recipientCerts != null;
     if (enveloped && (!intrinsic.isArray(recipientCerts) || !recipientCerts.length)) throw _err("pkcs12/bad-input", "opts.recipientCerts must be a non-empty array of recipient certificates");
     var certBags = [];
-    if (spec.cert != null) certBags.push({ type: "cert", cert: spec.cert, friendlyName: spec.friendlyName, localKeyId: spec.localKeyId });
+    if (spec.cert != null) _push(certBags,{ type: "cert", cert: spec.cert, friendlyName: spec.friendlyName, localKeyId: spec.localKeyId });
     if (spec.ca != null && !Array.isArray(spec.ca)) throw _err("pkcs12/bad-input", "spec.ca must be an array of certificates");
-    (spec.ca || []).forEach(function (ca) { certBags.push({ type: "cert", cert: ca }); });
+    (spec.ca || []).forEach(function (ca) { _push(certBags,{ type: "cert", cert: ca }); });
     var sc = [];
     if (enveloped) {
       var bags = certBags.slice();
-      if (spec.key != null) bags.push({ type: "key", key: spec.key, friendlyName: spec.friendlyName, localKeyId: spec.localKeyId });
-      sc.push({ recipients: recipientCerts.map(function (c) { return { cert: c }; }), bags: bags });
+      if (spec.key != null) _push(bags,{ type: "key", key: spec.key, friendlyName: spec.friendlyName, localKeyId: spec.localKeyId });
+      _push(sc,{ recipients: recipientCerts.map(function (c) { return { cert: c }; }), bags: bags });
       return sc;
     }
-    if (certBags.length) sc.push({ encrypt: { password: opts.password }, bags: certBags });
-    if (spec.key != null) sc.push({ bags: [{ type: "shroudedKey", key: spec.key, encrypt: { password: opts.password }, friendlyName: spec.friendlyName, localKeyId: spec.localKeyId }] });
+    if (certBags.length) _push(sc,{ encrypt: { password: opts.password }, bags: certBags });
+    if (spec.key != null) _push(sc,{ bags: [{ type: "shroudedKey", key: spec.key, encrypt: { password: opts.password }, friendlyName: spec.friendlyName, localKeyId: spec.localKeyId }] });
     return sc;
   }
   throw _err("pkcs12/bad-input", "spec must be { safeContents: [...] } or { key, cert, ca? }");
@@ -584,7 +586,7 @@ async function _build(spec, opts) {
   if (safeContentsSpecs.length > C.LIMITS.PKCS12_MAX_ELEMENTS) throw _err("pkcs12/bad-input", "the AuthenticatedSafe exceeds the element cap " + C.LIMITS.PKCS12_MAX_ELEMENTS + " (safeContents entries)");
   await _assertKeyPairs(spec, form, safeContentsSpecs);
   var elements = [];
-  for (var i = 0; i < safeContentsSpecs.length; i++) elements.push(await _buildAuthSafeElement(safeContentsSpecs[i], opts));
+  for (var i = 0; i < safeContentsSpecs.length; i++) _push(elements,await _buildAuthSafeElement(safeContentsSpecs[i], opts));
   var authSafeDer = b.sequence(elements);
 
   var pfx;
@@ -619,7 +621,7 @@ async function _build(spec, opts) {
             : "");
       });
     }
-    if (opts.mac !== false) pfxChildren.push(await _buildMacData(opts.mac || {}, opts.password, authSafeDer));
+    if (opts.mac !== false) _push(pfxChildren,await _buildMacData(opts.mac || {}, opts.password, authSafeDer));
     pfx = b.sequence(pfxChildren);
   }
 
@@ -685,7 +687,7 @@ async function _verifyMacOfStore(m, password, opts) {
     var vMacPw = _p12PasswordOwned(password);
     var macKey = _p12Kdf(node, 3, vMacPw.bytes, m.mac.macSalt, m.mac.iterations, P12_KDF_UV[node].u);
     if (vMacPw.owned) guard.secret.zeroize(vMacPw.bytes, Pkcs12Error, "pkcs12/bad-input", "the password encoding");
-    try { computed = nodeCrypto.createHmac(node, macKey).update(m.macedBytes).digest(); }
+    try { computed = guard.crypto.hmac(node, macKey, m.macedBytes); }
     finally { guard.secret.zeroize(macKey, Pkcs12Error, "pkcs12/bad-input", "the password-derived MAC key"); }
   } else {
     var kdf = m.mac.pbmac1.kdf;
@@ -865,7 +867,7 @@ function _decryptLegacyPbe(ea, ct, password, opts, budget) {
   if (p12pw.owned) guard.secret.zeroize(p12pw.bytes, Pkcs12Error, "pkcs12/bad-input", "the password encoding");
   try {
     if (scheme.rc2) return rc2.cbcDecrypt(keyM, scheme.rc2, iv, ct, _err, "pkcs12/decrypt-failed");
-    var d = nodeCrypto.createDecipheriv(scheme.cipher, keyM, iv);
+    var d = guard.crypto.decipher(scheme.cipher, keyM, iv);
     return guard.secret.cipherFinish(d, ct, Pkcs12Error, "pkcs12/bad-input", "the recovered safe contents");
   } catch (_e) { throw _err("pkcs12/decrypt-failed", "decryption failed"); }
   finally { guard.secret.zeroize(keyM, Pkcs12Error, "pkcs12/bad-input", "the password-derived decryption key"); }

package/lib/pki-build.js

@@ -8,6 +8,10 @@ var schema = require("./schema-engine");
 var compositeSig = require("./composite-sig");
 var guard = require("./guard-all");
 var intrinsic = require("./guard-intrinsic");
+/** @internal The append every list here is built with: `push` stores at the index and a store
+ *  consults a setter inherited there, and these lists become the extension and name structures
+ *  every signing verb embeds. */
+var _push = intrinsic.append;
 var _isArray = intrinsic.isArray;
 var _bufferFrom = intrinsic.bufferFrom;
 var _bufferEquals = intrinsic.bufferEquals;
@@ -414,7 +418,7 @@ var DP_KEYS = intrinsic.assign(intrinsic.create(null), { fullName: 1, reasons: 1
  * others, so the loop keeps the leading octet uniform over 1 to 127. */
 function randomSerial() {
   for (;;) {
-    var rnd = nodeCrypto.randomBytes(20);
+    var rnd = guard.crypto.randomBytes(20);
     rnd[0] &= 0x7f;
     if (rnd[0] !== 0) return BigInt("0x" + rnd.toString("hex"));
   }
@@ -632,8 +636,8 @@ function makeBuilder(ctx) {
   }
   function extBasicConstraints(spec) {
     var children = [];
-    if (spec.cA === true) children.push(b.boolean(true));
-    if (spec.pathLen != null) children.push(b.integer(pathLen(spec.pathLen)));
+    if (spec.cA === true) _push(children,b.boolean(true));
+    if (spec.pathLen != null) _push(children,b.integer(pathLen(spec.pathLen)));
     return b.sequence(children);
   }
   function pathLen(v) {
@@ -1238,14 +1242,14 @@ function makeBuilder(ctx) {
   }
   function ext(oidStr, critical, valueDer) {
     var children = [b.oid(oidStr)];
-    if (critical) children.push(b.boolean(true));
-    children.push(b.octetString(valueDer));
+    if (critical) _push(children,b.boolean(true));
+    _push(children,b.octetString(valueDer));
     return b.sequence(children);
   }
 
   function spkiKeyId(spkiDer) {
     var keyBytes = asn1.read.bitString(asn1.decode(spkiDer).children[1]).bytes;
-    return nodeCrypto.createHash("sha1").update(keyBytes).digest();
+    return guard.crypto.digest("sha1", keyBytes);
   }
   function skiKeyId(val, spkiDer) {
     if (guard.bytes.isByteSource(val)) return guard.bytes.snapshotSource(val, ErrorClass, ctx.prefix + "/bad-input", "subjectKeyIdentifier");
@@ -1353,13 +1357,13 @@ function makeBuilder(ctx) {
     var out = [];
     if (extSpec.subjectKeyIdentifier != null) {
       if (extSpec.subjectKeyIdentifier === true && spki == null) throw E("bad-input", "subjectKeyIdentifier auto-derive (true) requires the public key -- supply a Buffer key id, or include the public key");
-      out.push(ext(O("subjectKeyIdentifier"), false, extSki(skiKeyId(extSpec.subjectKeyIdentifier, spki))));
+      _push(out,ext(O("subjectKeyIdentifier"), false, extSki(skiKeyId(extSpec.subjectKeyIdentifier, spki))));
     }
-    if (extSpec.keyUsage != null) out.push(ext(O("keyUsage"), extSpec.keyUsageCritical !== false, extKeyUsage(extSpec.keyUsage)));
-    if (extSpec.extendedKeyUsage != null) out.push(ext(O("extKeyUsage"), !!extSpec.extendedKeyUsageCritical, extExtKeyUsage(extSpec.extendedKeyUsage)));
-    if (extSpec.basicConstraints != null) { validateBcSpec(extSpec.basicConstraints); out.push(ext(O("basicConstraints"), extSpec.basicConstraints.critical !== false, extBasicConstraints(extSpec.basicConstraints))); }
-    if (extSpec.subjectAltName != null) out.push(ext(O("subjectAltName"), false, extSan(extSpec.subjectAltName)));
-    if (extSpec.certificatePolicies != null) out.push(ext(O("certificatePolicies"), !!extSpec.certificatePoliciesCritical, extCertPolicies(extSpec.certificatePolicies)));
+    if (extSpec.keyUsage != null) _push(out,ext(O("keyUsage"), extSpec.keyUsageCritical !== false, extKeyUsage(extSpec.keyUsage)));
+    if (extSpec.extendedKeyUsage != null) _push(out,ext(O("extKeyUsage"), !!extSpec.extendedKeyUsageCritical, extExtKeyUsage(extSpec.extendedKeyUsage)));
+    if (extSpec.basicConstraints != null) { validateBcSpec(extSpec.basicConstraints); _push(out,ext(O("basicConstraints"), extSpec.basicConstraints.critical !== false, extBasicConstraints(extSpec.basicConstraints))); }
+    if (extSpec.subjectAltName != null) _push(out,ext(O("subjectAltName"), false, extSan(extSpec.subjectAltName)));
+    if (extSpec.certificatePolicies != null) _push(out,ext(O("certificatePolicies"), !!extSpec.certificatePoliciesCritical, extCertPolicies(extSpec.certificatePolicies)));
     /** @internal RFC 5280 sec. 4.2.1.10 fixes this extension critical, in a request as in the certificate. */
     if (extSpec.nameConstraints != null) guard.list.append(out, ext(O("nameConstraints"), true, extNameConstraints(extSpec.nameConstraints)));
     if (extSpec.authorityInfoAccess != null) guard.list.append(out, ext(O("authorityInfoAccess"), false, extAuthorityInfoAccess(extSpec.authorityInfoAccess)));
@@ -1513,7 +1517,7 @@ function samePublicKey(spkiA, spkiB) {
   /** @internal Two keys of different types are never the same key, and comparing them through
    *  the runtime's equality leaves a fault queued in the crypto library that surfaces on the
    *  next unrelated key import in the process, so the type decides that case first. */
-  if (ka.asymmetricKeyType !== kb.asymmetricKeyType) return false;
+  if (guard.crypto.keyType(ka) !== guard.crypto.keyType(kb)) return false;
   return _keyEquals(ka, kb) === true;
 }
 

package/lib/possession.js

@@ -78,7 +78,9 @@ var _promiseResolve = intrinsic.uncurry(intrinsic.promiseResolve);
  *  while its signature certificate chained to an untrusted CA, which is the RFC 9883 sec. 4 MUST this
  *  verb exists to apply. */
 var _Promise = intrinsic.Promise;
-var _push = intrinsic.push;
+/** @internal `append`, not a captured `push`: a store at an index walks the prototype chain for a
+ *  setter, so an accessor there takes the element being appended. `append` defines it. */
+var _push = intrinsic.append;
 var _join = intrinsic.join;
 var _every = intrinsic.every;
 var _filter = intrinsic.filter;