@blamejs/pki 0.8.60 → 0.9.0

package/CHANGELOG.md

@@ -4,6 +4,54 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## v0.9.0 — 2026-10-08
+
+Import any namespace by name from an ESM caller, and give every record the toolkit builds for an omitted argument no prototype.
+
+### Added
+
+- Every namespace is an ESM named import. `import { x509, cms, path, schema, lint, webcrypto } from "@blamejs/pki"` resolves, as does any of the other 41; `import pki from "@blamejs/pki"` is unchanged and gives the same object `require` does. The package remains CommonJS, runs on Node LTS as shipped, and adds no build step and no transpilation: every value in the export object is a bare identifier bound above it, which is the shape Node's export reader can follow. A `.d.ts` generated from the source comment blocks is still to come.
+
+### Changed
+
+- A record the toolkit defaults for an omitted argument no longer inherits from `Object.prototype`. A caller passing its own object is unaffected: only the record built when the argument is absent changed, and a field read off it that the caller did not supply now reads as absent.
+
+### Fixed
+
+- A revocation deadline is measured against the toolkit's own clock. `pki.path.fetchingChecker` builds its deadline with no options record, so the record it defaulted carried `Object.prototype` and the clock came from an inherited `now`: one reporting a time far ahead made the deadline expired before the first fetch, and the fetch that would have retrieved a CRL or an OCSP response was never made. The same record supplies the bound a decoded size is held to, where an inherited `max` of zero refuses every value.
+- `pki.inspect.asn1`, `pki.inspect.certificate` and the other report verbs are held to the caps their caller passed. With the options argument omitted the record they defaulted carried `Object.prototype`, so an inherited `maxBytes` became the cap the render was held to and a report that renders normally came back refused.
+- A signer signs with the identity its caller named. `pki.x509.sign`, `pki.crl.sign` and `pki.attrcert.sign` default an omitted issuer or extension record, so an inherited `cert`, `key`, `name`, `publicKey`, `basicConstraints` or `keyUsage` was read as if supplied. Reaching the read required getting past the spec's unknown-field door and its copy depth cap, both of which refused it, so the effect was a refused signing call rather than a signature under another identity. The record has no prototype now, which is where the answer belongs.
+- A client believes what a server actually sent. `pki.acme`, `pki.cmp`, `pki.ct`, `pki.est`, `pki.scep` and the revocation fetcher each default an omitted response record, where an inherited `status`, `body` or `headers` stands in for what arrived. The content type a CMP transfer and a CT fetch check, and the declared content length the HTTP transport enforces its response cap against, were each read through a header record defaulted the same way.
+- The records every other verb defaults are the same shape and are converted with them: the options records of `pki.asn1.decode`, `pki.cbor.decode`, the schema engine and the shared PKIX sub-schemas, the signer and countersigner records in `pki.cms.sign`, the MAC and bag encryption records in `pki.pkcs12.build`, the message-imprint records in `pki.tsp.sign`, the header records in `pki.est`, the request and defaults records in the HTTP transport, the setup records in `pki.hpke`, the client option records in `pki.ct`, the certificate-transparency policy `pki.path.validate` passes on, the fallback key in `pki.jose`, the algorithm records the WebAuthn verifiers read a name off, and the algorithm record a signature scheme reads off a key.
+
+### Documentation
+
+- `THREAT-MODEL.md` states the boundary the toolkit's use of captured operations rests on. The operations a check decides through are copied from the runtime while the modules load, which is what makes a later replacement unable to change a verdict, and that also means code running before the first `require` of the package can replace an operation before the copy is taken. Load the package before running untrusted code in the same realm.
+
+## v0.8.61 — 2026-10-07
+
+Take every cryptographic operation, and every question about which key a key is, through an operation captured when the toolkit loads, so a replacement installed afterwards cannot decide a secret, a tag, a key type or a verdict.
+
+### Added
+
+- The internal crypto guard gained the operations the library needed to stop reading `node:crypto` at call time: randomness, the password-based and extract-and-expand derivations, the RSA transforms, the elliptic-curve point derivation and conversion, the AEAD transform methods, the hash handle for a caller that cannot hold its whole input, and the four key-identity accessors. The digest primitive takes input and output encodings. None of this is on the public surface.
+
+### Changed
+
+- `pki.webcrypto.subtle.exportKey` and `pki.key.export` read a key's type at most twice per call, once to admit the key and once for every decision that follows. Nothing in the public surface changed shape, and no error code was added or removed.
+
+### Fixed
+
+- An imported key is bound to the algorithm the caller named it under. `pki.webcrypto.subtle.importKey` settles that by asking the key which algorithm family it belongs to, and that answer came from an accessor on a node prototype, read at the moment of the check. An accessor answering `rsa` for an Ed25519 key therefore made the import accept it as RSA-PSS, and every later operation ran under an algorithm the key does not belong to. The accessor is captured when the engine loads. The same read also decided a curve, a modulus length and whether a key pair corresponds, across `pki.key`, `pki.tuf`, `pki.tlog`, `pki.sigstore`, `pki.cmc`, `pki.crmf`, `pki.ct` and the signature-scheme check that matches a signer to a certificate.
+- A plain object carrying an `asymmetricKeyType` field is no longer accepted as a key. The sites that asked whether a caller had handed them a key object tested for that one field, which any object can carry, so a forged object passed the test and was then used as a key. The question is asked of the object's prototype now, and the answer settles both whether it is a key and which kind.
+- A shared secret is derived through the agreement the toolkit captured, not one replaced afterwards. `crypto.diffieHellman` returns the traditional half of a hybrid secret outright, so a replacement supplies that half: driving `pki.hpke.decap` with one returning a fixed buffer derived a secret from the value the replacement chose. The post-quantum half, through `encapsulate` and `decapsulate`, had the same shape, as did the key generation that decides the ephemeral key an encapsulation is made under. `pki.hpke`, `pki.kem`, `pki.key`, `pki.cms` and `pki.webcrypto` all take these through operations captured at load.
+- A content-encryption key, a MAC key, an IV, a nonce and a salt are drawn through the randomness the toolkit captured. Twenty-seven sites read it off the module handle when they needed it, so a replacement returning a value it already knows handed it every message those protect, and nothing downstream can tell a chosen key from a random one.
+- An AEAD message is authenticated against the tag it carries. The tag is set and read through methods on the cipher object, which were reached through that object: a replacement decides which tag a ciphertext is checked against, so the verdict stops being a function of the message. The additional authenticated data, the padding mode, and the bytes a transform produces are reached the same way and are now taken through operations captured at load. The streaming paths in `pki.webcrypto` already did this; the one-shot encrypt and decrypt did not.
+- A key-transport ciphertext is produced, and the secret inside one recovered, through the RSA transforms captured at load. A password-derived key-encryption key, an HKDF expansion, and the elliptic-curve point a scalar generates are the same shape: each returns a value rather than a claim about one, so a replacement returning a fixed value makes every password open the message or puts a point of its own choosing where a public key was expected.
+- `pki.key.export` emits a PEM label that agrees with the bytes in the block. It asked the key its type once to choose the label and again to choose the encoding, and on a `CryptoKey` from node's own WebCrypto that is an accessor, so an accessor answering differently across those reads picked the two separately and a public key came back inside a `PRIVATE KEY` block. The type is read once and every decision in an export comes from that one answer.
+- A digest is computed through the hash operation the toolkit captured, across every path that takes one: the certificate and CRL digests, the CMS message digests and countersignature imprints, the transparency-log identifiers, the PKCS#12 key derivation, the hash-based signature trees, the WebAuthn attestation comparisons and the HTTP Digest credential. `pki.scep`'s check that a named digest is available goes through the same operation, so the name it accepts is the name it would use.
+- The RFC 7616 HTTP Digest credential is computed over the octets of the latin1 encoding the specification names, through one operation rather than a copy of the hash construction kept in the module. Three modules held their own copy of what the digest primitive already does; all three route through it now, and the input and output encodings are named at the call rather than defaulted.
+
 ## v0.8.60 — 2026-10-07
 
 Build every list a parse or an encode reads from by defining its indexes, so an accessor inherited from the array prototype cannot take an element as it is added.

package/README.md

@@ -71,6 +71,13 @@ no transpilation.
 var pki = require("@blamejs/pki");
 ```
 
+An ESM caller can import the whole namespace object or any namespace by name:
+
+```js
+import pki from "@blamejs/pki";
+import { x509, cms, path, schema } from "@blamejs/pki";
+```
+
 ## Quickstart
 
 ### Parse an X.509 certificate

package/index.js

@@ -73,8 +73,53 @@ var inspect    = require("./lib/inspect");
 var lint       = require("./lib/lint");
 var webauthn   = require("./lib/webauthn");
 
+/* Every value in the export object below is a bare identifier, and the ten `var`s here are what make
+ * that true. Node detects a CommonJS module's named exports with `cjs-module-lexer`, which follows
+ * `name: ident` and a shorthand and stops at anything else: a member expression, a nested object
+ * literal, a call. `version: constants.version` was the first entry, so it stopped the lexer before
+ * any namespace was seen and `import { x509 } from "@blamejs/pki"` failed for all 47 of them, with
+ * only `default`, `module.exports` and `version` reaching an ESM caller. Hoisting is the whole fix;
+ * it needs no build step and changes nothing a `require` caller sees. A new namespace added below
+ * must be a bare identifier, which a vector in `esm-named-exports.test.js` holds it to. */
+var _version = constants.version;
+var _identityNs = { match: identity.match };
+var _cmsNs = {
+  verify: cms.verify, sign: cms.sign, countersign: cms.countersign, encrypt: cms.encrypt,
+  authenticate: cms.authenticate, decrypt: cms.decrypt, compress: cms.compress, decompress: cms.decompress,
+  digest: cms.digest, verifyDigest: cms.verifyDigest,
+  certsOnly: cms.certsOnly, parseCertsOnly: cms.parseCertsOnly, isCertsOnly: cms.isCertsOnly,
+  timestampImprint: cms.timestampImprint, attachTimestamp: cms.attachTimestamp,
+};
+var _cmpNs = {
+  build: cmp.build, transfer: cmp.transfer, wellKnownUrl: cmp.wellKnownUrl, verify: cmp.verify,
+  openKeyPackage: cmp.openKeyPackage, session: cmp.session,
+};
+var _keyNs = {
+  encrypt: key.encrypt, decrypt: key.decrypt, export: key.export, import: key.import,
+  generate: key.generate, publicFromPrivate: key.publicFromPrivate,
+};
+var _kemNs = { encapsulate: compositeKem.encapsulate, decapsulate: compositeKem.decapsulate };
+var _scepNs = {
+  build: scep.build, parse: scep.parse, getCACaps: scep.getCACaps, getCACert: scep.getCACert,
+  getNextCACert: scep.getNextCACert, enroll: scep.enroll, renew: scep.renew, getCert: scep.getCert,
+  getCrl: scep.getCrl, parseCapabilities: scep.parseCapabilities,
+};
+var _transportNs = { https: transport.https, peerChain: transport.peerChain };
+var _lintNs = {
+  certificate: lint.certificate,
+  csr:         lint.csr,
+  crl:         lint.crl,
+  ocsp:        lint.ocsp,
+  cms:         lint.cms,
+  tsp:         lint.tsp,
+  attrcert:    lint.attrcert,
+  rules:       lint.rules,
+  profiles:    lint.profiles,
+};
+var _webcryptoNs = _webcryptoNamespace();
+
 module.exports = {
-  version:   constants.version,
+  version:   _version,
   // `C` is the terse call-site alias; `constants` the discoverable name.
   C:         constants,
   constants: constants,
@@ -97,7 +142,7 @@ module.exports = {
   // `identity` is RFC 9525 service identity -- pki.identity.match says whether a certificate
   // presents a name the client was trying to reach. A separate answer from path validation,
   // which pki.path.validate gives; sec. 1.2 has an application need both.
-  identity:  { match: identity.match },
+  identity:  _identityNs,
   // `ct` is RFC 6962 Certificate Transparency -- pki.ct.parseSctList decodes the
   // SCT-list extension a certificate / OCSP response carries; the signature is
   // surfaced raw for external verification (pki.ct.reconstructSignedData).
@@ -113,11 +158,7 @@ module.exports = {
   // Curated, the way pki.cmp is: cms-verify also exports `setEngine`, the seam path-validate injects
   // its path builder through. That is plumbing between two internal modules, not an operator verb,
   // and exporting the module wholesale would put it on the public surface.
-  cms:       { verify: cms.verify, sign: cms.sign, countersign: cms.countersign, encrypt: cms.encrypt,
-    authenticate: cms.authenticate, decrypt: cms.decrypt, compress: cms.compress, decompress: cms.decompress,
-    digest: cms.digest, verifyDigest: cms.verifyDigest,
-    certsOnly: cms.certsOnly, parseCertsOnly: cms.parseCertsOnly, isCertsOnly: cms.isCertsOnly,
-    timestampImprint: cms.timestampImprint, attachTimestamp: cms.attachTimestamp },
+  cms:       _cmsNs,
   smime:     smime,
   // `cmc` interprets an RFC 5272 Full PKI Response into one terminal verdict;
   // `pki.schema.cmc` is the decoder underneath it.
@@ -147,8 +188,7 @@ module.exports = {
   // and pki.cmp.verify checks the protection on an incoming one. pki.cmp.openKeyPackage opens a
   // centrally generated private key a CA delivered. Parsing lives at pki.schema.cmp.parse.
   // setEngine is the @internal path-validate seam -- kept off the public surface.
-  cmp:       { build: cmp.build, transfer: cmp.transfer, wellKnownUrl: cmp.wellKnownUrl, verify: cmp.verify,
-    openKeyPackage: cmp.openKeyPackage, session: cmp.session },
+  cmp:       _cmpNs,
   // `crl` is the RFC 5280 sec. 5 CRL producing side -- pki.crl.sign builds and signs a CertificateList
   // over any registry algorithm, pki.crl.verify checks a CRL signature through the one path-validation
   // signature engine, and pki.crl.isRevoked looks a serial up. Parsing lives at pki.schema.crl.parse.
@@ -158,8 +198,7 @@ module.exports = {
   // pki.key.generate / publicFromPrivate over every WebCrypto algorithm. Parsing lives at pki.schema.pkcs8.
   // Curated: correspondsTo is the @internal check pki.cmp.session holds a delivered key and its
   // certificate to each other with, and stays off the public surface.
-  key:       { encrypt: key.encrypt, decrypt: key.decrypt, export: key.export, import: key.import,
-    generate: key.generate, publicFromPrivate: key.publicFromPrivate },
+  key:       _keyNs,
   // `pkcs12` is the RFC 7292 / RFC 9579 PKCS#12 (.p12/.pfx) producing side -- pki.pkcs12.build assembles a
   // password-integrity store (key/cert/crl/secret bags in an AuthenticatedSafe, shrouded keys + cert safes
   // under PBES2, a classic HMAC or PBMAC1 MAC), and pki.pkcs12.verifyMac checks a store's MAC. Parsing lives
@@ -193,7 +232,7 @@ module.exports = {
   // `kem` is composite ML-KEM key establishment (draft-ietf-lamps-pq-composite-kem):
   // pki.kem.encapsulate / decapsulate over a post-quantum ML-KEM hybridized with a
   // traditional RSA-OAEP / ECDH / X25519 / X448, mixed through the SHA3-256 combiner.
-  kem:       { encapsulate: compositeKem.encapsulate, decapsulate: compositeKem.decapsulate },
+  kem:       _kemNs,
   // `sigstore` verifies a Sigstore bundle (the npm --provenance artifact): a
   // keyless Fulcio signature over a DSSE-wrapped in-toto SLSA attestation with a
   // Rekor inclusion proof -- offline, zero-dep, against caller-pinned trust.
@@ -204,14 +243,14 @@ module.exports = {
   // splitter, certs-only + serverkeygen validators over CMS, the enroll-attribute
   // builders, the HTTP response classifier). est opens no socket; fail-closed.
   est:       est,
-  scep:      { build: scep.build, parse: scep.parse, getCACaps: scep.getCACaps, getCACert: scep.getCACert, getNextCACert: scep.getNextCACert, enroll: scep.enroll, renew: scep.renew, getCert: scep.getCert, getCrl: scep.getCrl, parseCapabilities: scep.parseCapabilities },
+  scep:      _scepNs,
   // `transport` is the shared fail-closed node:https transport the enrollment clients
   // drive -- pki.transport.https(defaults) returns a transport(request) -> {status,
   // headers, body}. The toolkit's sole socket choke point: explicit trust anchors,
   // rejectUnauthorized always on, a TLS floor, a streaming response cap, and a timeout.
   // Curated to the public `https` factory; the module's `isBlockedIp` classifier is an
   // internal helper pki.path.build reuses (require the module), not a public surface.
-  transport: { https: transport.https, peerChain: transport.peerChain },
+  transport: _transportNs,
   // `jose` is the RFC 7515 Flattened JWS + RFC 7638 JWK-thumbprint layer: a strict
   // base64url codec, a bounded duplicate-key-rejecting JSON reader, profiled
   // sign/verify (ACME-outer / EAB-inner / keyChange-inner), and an alg registry
@@ -241,17 +280,7 @@ module.exports = {
   // `lint` is named member by member rather than passed through, because the module also exports the
   // build-time gate the authoring verbs call and the two readers its conformance vectors use. Those
   // are internal plumbing, so they stay off the public namespace.
-  lint: {
-    certificate: lint.certificate,
-    csr:         lint.csr,
-    crl:         lint.crl,
-    ocsp:        lint.ocsp,
-    cms:         lint.cms,
-    tsp:         lint.tsp,
-    attrcert:    lint.attrcert,
-    rules:       lint.rules,
-    profiles:    lint.profiles,
-  },
+  lint: _lintNs,
   // `webauthn` verifies a W3C WebAuthn / passkey attestation -- pki.webauthn.verify
   // checks the attestation-statement signature + each format's structural bindings
   // (packed / tpm / android-key / apple / fido-u2f / none) and surfaces the x5c chain
@@ -263,7 +292,7 @@ module.exports = {
   // A ready W3C Crypto instance (globalThis.crypto shape) with the classes for
   // constructing more attached under the same namespace (pki.webcrypto.CryptoKey,
   // .SubtleCrypto, .Crypto, .WebCryptoError). PQC-first, classical-capable, zero-dep.
-  webcrypto: _webcryptoNamespace(),
+  webcrypto: _webcryptoNs,
 };
 
 function _webcryptoNamespace() {

package/lib/acme.js

@@ -1796,7 +1796,7 @@ function _parseLinkValue(raw) {
   return { uri: uri, rel: rel, anchor: anchor, relSeen: relSeen };
 }
 function _parseLinkRelation(headers, base, relName, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var raw = null;
   var hNames = guard.identifier.optionNames(headers);
   for (var hi = 0; hi < hNames.length; hi++) {
@@ -2047,11 +2047,11 @@ function client(directoryUrl, opts) {
 
   function _send(method, url, headers, body) { return _sendFollowing(method, url, headers, body, 0); }
   function _sendFollowing(method, url, headers, body, redirects) {
-    var reqHeaders = Object.assign({ "user-agent": CLIENT_USER_AGENT }, headers || {});
+    var reqHeaders = Object.assign({ "user-agent": CLIENT_USER_AGENT }, headers || intrinsic.create(null));
     return guard.async.deferred(function () {
       return guard.async.invoked(transport, [{ method: method, url: url, headers: reqHeaders, body: body, tls: _tlsFor(url), proxy: budgets.proxy, timeout: budgets.timeout, maxResponseBytes: budgets.maxResponseBytes }], E, "acme/bad-input", "opts.transport");
     }).then(function (res) {
-      res = res || {};
+      res = res || intrinsic.create(null);
       /** @internal The transport is a caller-supplied option, so its response is a caller object: the body
        *  and the status are read ONCE here and every check and the returned value read those locals. Read
        *  per use, the body whose length was capped need not be the body handed back, which is how a
@@ -2145,7 +2145,7 @@ function client(directoryUrl, opts) {
 
   function _newAccount(payloadOpts) {
     return _resource("newAccount").then(function (url) {
-      return _post(url, newAccount, payloadOpts || {}, "jwk", undefined, [200, 201]).then(function (res) {
+      return _post(url, newAccount, payloadOpts || intrinsic.create(null), "jwk", undefined, [200, 201]).then(function (res) {
         var loc = res.headers["location"];
         if (!_isString(loc)) throw E("acme/no-account-url", "newAccount did not return an account URL in a Location header (RFC 8555 sec. 7.3)");
         var account = validate("account", _json(res));
@@ -2156,7 +2156,7 @@ function client(directoryUrl, opts) {
   }
   function _newOrder(payloadOpts) {
     return _resource("newOrder").then(function (url) {
-      return _post(url, newOrder, payloadOpts || {}, "kid", undefined, [201]).then(function (res) {
+      return _post(url, newOrder, payloadOpts || intrinsic.create(null), "kid", undefined, [201]).then(function (res) {
         var loc = res.headers["location"];
         if (!_isString(loc)) throw E("acme/no-order-url", "newOrder did not return an order URL in a Location header (RFC 8555 sec. 7.4)");
         return { order: validate("order", _json(res)), url: _resolveLocation(loc, url) };

package/lib/asn1-der.js

@@ -210,7 +210,7 @@ function _asBuffer(input, who) {
  *   node.tagNumber === pki.asn1.TAGS.SEQUENCE;
  */
 function decode(input, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   var buf = _asBuffer(input, "decode");
   var maxBytes = guard.limits.cap(opts.maxBytes, "maxBytes", constants.LIMITS.DER_MAX_BYTES);
   var maxDepth = guard.limits.depthCap(opts.maxDepth, "maxDepth", constants.LIMITS.DER_MAX_DEPTH);

package/lib/attrcert-sign.js

@@ -448,7 +448,7 @@ function _emitNamedExtension(out, seen, k, val, ctx) {
   _push(out,_b.ext(eOid, meta.critical, valueDer));
 }
 function _buildExtensions(extSpec, ctx) {
-  if (extSpec == null) extSpec = {};
+  if (extSpec == null) extSpec = intrinsic.create(null);
   if (Array.isArray(extSpec)) {
     if (!extSpec.length) return null;
     var seenA = intrinsic.create(null);
@@ -567,7 +567,7 @@ function _sign(spec, issuer, opts) {
   guard.identifier.assertKnownKeys(opts, KNOWN_SIGN_OPTS, _err, "attrcert/bad-input", "unknown pki.attrcert.sign option (accepted: pem, pss, digestAlgorithm): ");
   if (!spec || typeof spec !== "object" || Buffer.isBuffer(spec)) throw _err("attrcert/bad-input", "the attribute-certificate spec must be an object");
   guard.identifier.assertKnownKeys(spec, KNOWN_SPEC_KEYS, _err, "attrcert/bad-input", "unknown spec field ");
-  issuer = issuer || {};
+  issuer = issuer || intrinsic.create(null);
   if (issuer.key == null) throw _err("attrcert/bad-input", "a signing key (issuer.key, the AA's WebCrypto CryptoKey or PKCS#8 private key DER/PEM) is required");
 
   var issuerDnSpec, aaSpki, aaSki = null;

package/lib/cbor-det.js

@@ -36,6 +36,9 @@
  *   leaf readers over its node tree.
  */
 
+/** @internal The record constructor, captured at load, for the reason the same capture in
+ * `lib/inspect.js` gives: arming this module counts 66 live runtime reads. */
+var _create = Object.create;
 var constants = require("./constants");
 var frameworkError = require("./framework-error");
 var asn1 = require("./asn1-der");
@@ -241,7 +244,7 @@ function _decodeItem(buf, start, limit, depth, maxD, rules, state) {
  *   pki.cbor.read.uint(node.children[0]); // 1n
  */
 function decode(input, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var buf = _asBuffer(input, "decode");
   var maxBytes = guard.limits.cap(opts.maxBytes, "maxBytes", constants.LIMITS.CBOR_MAX_BYTES);
   var maxDepth = guard.limits.depthCap(opts.maxDepth, "maxDepth", constants.LIMITS.CBOR_MAX_DEPTH);

package/lib/cmc-build.js

@@ -470,8 +470,8 @@ function identityProofV2(secret, reqSequenceBytes, identity) {
         _ownSecret(Buffer.from(identity, "utf8"), owned),
       ]), owned);
     }
-    key = nodeCrypto.createHash("sha256").update(material).digest();
-    var witness = nodeCrypto.createHmac("sha256", key).update(reqSequenceBytes).digest();
+    key = guard.crypto.digest("sha256", material);
+    var witness = guard.crypto.hmac("sha256", key, reqSequenceBytes);
     return b.sequence([algId(OID_SHA256), algId(OID_HMAC_SHA256), b.octetString(witness)]);
   } finally {
     if (key) guard.secret.zeroize(key, CmcError, "cmc/bad-input", "the Identity Proof MAC key");
@@ -541,7 +541,7 @@ function _provesRequestKey(opening, outgoing) {
     /** @internal Keys of different types are never the same key, and comparing them through the
      * runtime's equality leaves a fault queued in the crypto library that surfaces on the next
      * unrelated key import in the process, so the type decides that case first. */
-    if (requested.asymmetricKeyType !== opening.key.asymmetricKeyType) return false;
+    if (guard.crypto.keyType(requested) !== guard.crypto.keyType(opening.key)) return false;
     return intrinsic.keyEquals(requested, opening.key);
   }
   /** @internal A key the runtime engine cannot read has no KeyObject to compare, and a composite
@@ -607,7 +607,7 @@ async function _recoverProofValue(decoded, recipient, witnessHash) {
       continue;   // allow:swallow-unverified this recipient is not addressed to the supplied key; the witness decides
     }
     var candidate = opened.content;
-    var computed = nodeCrypto.createHash(witnessHash).update(candidate).digest();
+    var computed = guard.crypto.digest(witnessHash, candidate);
     var matches = computed.length === decoded.witness.length &&
       guard.crypto.constantTimeEqual(computed, decoded.witness);
     guard.secret.zeroize(computed, CmcError, "cmc/bad-input", "the computed witness");
@@ -674,7 +674,7 @@ async function answerPopChallenge(popChallenge, ids) {
      * in the challenge at all: neither side re-encodes it. */
     macKey = _bufferFrom(proofValue.length > POP_MAC_KEY_MAX_BYTES
       ? _subarray(proofValue, 0, POP_MAC_KEY_MAX_BYTES) : proofValue);
-    var thePOP = nodeCrypto.createHmac(macHash, macKey).update(decoded.requestBytes).digest();
+    var thePOP = guard.crypto.hmac(macHash, macKey, decoded.requestBytes);
     return { algBytes: decoded.thePOPAlgID.bytes, thePOP: thePOP, ids: ids,
       recipientSpki: await _openingPublicKey(recipient, recovered.recipientType),
       challengedRequest: _requestIdentity(decoded.request) };
@@ -688,13 +688,18 @@ async function answerPopChallenge(popChallenge, ids) {
 
 function popLinkWitnessV2(secret, R) {
   _assertSecret(secret, "a POP Link Witness V2 control");
-  var key = nodeCrypto.createHash("sha256").update(secret, "utf8").digest();
+  /** @internal The secret's octets, held so the finally can wipe them. Handing the string and an
+   *  encoding to a digest instead leaves the copy inside the provider, where nothing clears it. */
+  var material = _bufferFrom(secret, "utf8");
+  var key = null;
   try {
+    key = guard.crypto.digest("sha256", material);
     /** @internal Inside the try, so a MAC that faults on its message still wipes the key above it. */
-    var witness = nodeCrypto.createHmac("sha256", key).update(R).digest();
+    var witness = guard.crypto.hmac("sha256", key, R);
     return b.sequence([algId(OID_SHA256), algId(OID_HMAC_SHA256), b.octetString(witness)]);
   } finally {
-    guard.secret.zeroize(key, CmcError, "cmc/bad-input", "the POP Link MAC key");
+    guard.secret.zeroize(material, CmcError, "cmc/bad-input", "the POP Link secret");
+    if (key !== null) guard.secret.zeroize(key, CmcError, "cmc/bad-input", "the POP Link MAC key");
   }
 }
 
@@ -707,7 +712,7 @@ function build(spec, signer, opts) {
 }
 
 async function _build(spec, signer, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (!spec || typeof spec !== "object" || Array.isArray(spec) || Buffer.isBuffer(spec)) {
     throw E("cmc/bad-input", "the CMC request spec must be an object");
   }
@@ -935,7 +940,7 @@ async function _build(spec, signer, opts) {
     if (typeof rBytes !== "number" || !Number.isInteger(rBytes) || rBytes < 1) {
       throw E("cmc/bad-input", "popLinkRandomBytes must be a positive integer");
     }
-    var R = nodeCrypto.randomBytes(rBytes);
+    var R = guard.crypto.randomBytes(rBytes);
     _push(controls,encodeControl(OID_POP_LINK_RANDOM, [b.octetString(R)], ids));
     _push(controls,encodeControl(O("id-cmc-popLinkWitnessV2"),
       [popLinkWitnessV2(spec.popLink.secret, R)], ids));

package/lib/cmp-build.js

@@ -856,7 +856,7 @@ function build(message, opts) {
 }
 
 async function _build(message, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (!message || typeof message !== "object" || Buffer.isBuffer(message)) throw _err("cmp/bad-input", "the PKIMessage spec must be an object { header, body }");
   guard.identifier.assertKnownKeys(message, KNOWN_MESSAGE_KEYS, _err, "cmp/bad-input", function (k) {
     return "unknown message field " + JSON.stringify(k) + " (a message carries only header + body)";
@@ -1020,7 +1020,7 @@ function _tlsForTransfer(opts) {
  *  `Symbol.split` is part of that operation. The token decides which parser a response body is
  *  handed to. */
 function _ctypeToken(headers) {
-  var raw = intrinsic.String((headers || {})["content-type"] || "");
+  var raw = intrinsic.String((headers || intrinsic.create(null))["content-type"] || "");
   var parts = intrinsic.splitChar(raw, 59);
   return intrinsic.toLowerCase(_strTrim(parts.length ? parts[0] : ""));
 }
@@ -1067,7 +1067,7 @@ function _assertTransport(opts) {
 }
 
 function _transfer(url, message, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   guard.identifier.assertKnownKeys(opts, KNOWN_TRANSFER_OPTS, _err, "cmp/bad-input", "unknown opts field ");
   /** @internal Read once, at the door, and carried from here. Asking again would let an option that
    * answers differently on each read hand back something other than the value that was checked. */
@@ -1095,7 +1095,7 @@ function _transfer(url, message, opts) {
   headers["content-type"] = PKIXCMP;
   var tls = _tlsForTransfer(opts);
   return guard.async.invoked(transport, [{ method: "POST", url: parsedUrl.href, headers: headers, body: der, tls: tls, proxy: proxy, timeout: timeout, maxResponseBytes: maxResponseBytes }], _err, "cmp/bad-input", "opts.transport").then(function (res) {
-    res = res || {};
+    res = res || intrinsic.create(null);
     var h = guard.header.lowerCased(res.headers);
     var body = guard.bytes.isByteSource(res.body)
       ? guard.bytes.source(res.body, CmpError, "cmp/bad-response", "the CMP response body")
@@ -1136,7 +1136,7 @@ function _beforeQueryOrFragment(s) {
 }
 
 function wellKnownUrl(base, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   guard.identifier.assertKnownKeys(opts, KNOWN_WELLKNOWN_OPTS, _err, "cmp/bad-input", function (k) {
     return "unknown wellKnownUrl option " + JSON.stringify(k) + " (expected label / operation)";
   });

package/lib/cmp-session.js

@@ -4,6 +4,9 @@
 // @internal
 // lib/cmp-build.js; this file adds the @primitive pki.cmp.session block and re-exports the cmp message
 
+/** @internal The record constructor, captured at load, for the reason the same capture in
+ * `lib/inspect.js` gives: arming this module counts 174 live runtime reads. */
+var _create = Object.create;
 var cmp = require("./cmp-verify");
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
@@ -430,7 +433,7 @@ function _certConfHash(certDer) {
  *   if (answer.outcome === "answered" && answer.present) { var caCerts = answer.value; }
  */
 function session(opts) {
-  if (opts == null) opts = {};
+  if (opts == null) opts = _create(null);
   guard.identifier.assertPlainRecord(opts, _err, "cmp/bad-input", "opts");
   guard.identifier.optionsObject(opts, _err, "cmp/bad-input", "opts");
   guard.identifier.assertKnownKeys(opts, KNOWN_SESSION_OPTS, _err, "cmp/bad-input", "unknown session opts field ");
@@ -668,7 +671,7 @@ function session(opts) {
   }
 
   function _classify(verdict) {
-    var body = verdict.body || {};
+    var body = verdict.body || _create(null);
     var arm = body.arm;
     if (arm === expectedRespArm && txnKind === "revoke") return _classifyRevRep(body);
     if (arm === expectedRespArm && txnKind === "info") return _classifyGenRep(body);
@@ -734,7 +737,7 @@ function session(opts) {
   }
 
   function _classifyRevRep(body) {
-    var d = body.decoded || {};
+    var d = body.decoded || _create(null);
     var list = d.status || [];
     if (list.length !== 1) {
       return { state: "unexpected", reason: "an rp answering a revocation must carry exactly one status (RFC 9483 sec. 4.2); got " + list.length };

package/lib/cmp-verify.js

@@ -811,7 +811,7 @@ function _fixTime(v) {
   return new _Date(guard.time.instantOf(v));
 }
 function _fixVerifyOptions(opts, made) {
-  if (opts == null) opts = {};
+  if (opts == null) opts = _create(null);
   opts = guard.identifier.optionsObject(opts, _err, "cmp/bad-input", "pki.cmp.verify options");
   guard.identifier.assertKnownKeys(opts, KNOWN_VERIFY_OPTS, _err, "cmp/bad-input", "unknown opts field ");
   var f = {

package/lib/cms-compress.js

@@ -4,6 +4,9 @@
 // @internal
 // @module pki.cms + the @primitive blocks live in cms-verify.js, which re-exports these (the
 
+/** @internal The record constructor, captured at load, for the reason the same capture in
+ * `lib/inspect.js` gives: arming this module counts 5 live runtime reads. */
+var _create = Object.create;
 var zlib = require("zlib");
 var oid = require("./oid");
 var schemaCms = require("./schema-cms");
@@ -21,7 +24,7 @@ var OID_ZLIB = O("id-alg-zlibCompress");
 var NULL_PARAMS_DER = Buffer.from([0x05, 0x00]);
 
 async function compress(content, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var raw = guard.bytes.source(content, CmsError, "cms/bad-input", "content");
   var level = opts.level;
   if (level !== undefined && (typeof level !== "number" || !isFinite(level) || Math.floor(level) !== level)) throw _err("cms/bad-input", "opts.level must be an integer");
@@ -41,7 +44,7 @@ async function compress(content, opts) {
 }
 
 async function decompress(input, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var cap = C.LIMITS.COMPRESS_MAX_BYTES;
   if (opts.maxOutputBytes !== undefined) {
     var mo = opts.maxOutputBytes;

package/lib/cms-decrypt.js

@@ -4,7 +4,6 @@
 // @internal
 // @primitive pki.cms.decrypt block live in cms-verify.js, which re-exports this function.
 
-var nodeCrypto = require("crypto");
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
 var x509 = require("./schema-x509");
@@ -35,7 +34,7 @@ var CONTENT_KEYBITS = pbes2.CONTENT_KEYBITS;
 var CONTENT_MODE = pbes2.CONTENT_MODE;
 
 async function decrypt(input, keyMaterial, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (keyMaterial == null || typeof keyMaterial !== "object") throw _err("cms/bad-input", "decrypt requires a key-material object");
   /** @internal Read on every route, not only the one that applies it, and read before the message
    * is derived: deriving one runs accessors on a parsed input, which is the caller's own code and
@@ -67,7 +66,7 @@ function _originFields(res, authenticatedBy, originatorInfo) {
 }
 
 async function decryptEnvelopedData(parsed, keyMaterial, opts, contentTypeName) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   if (keyMaterial == null || typeof keyMaterial !== "object") throw _err("cms/bad-input", "decrypt requires a key-material object");
   var ct = contentTypeName || "envelopedData";
   var recips = parsed.recipientInfos || [];
@@ -235,8 +234,8 @@ async function _ktriCek(ri, km) {
       return Buffer.from(await subtle.decrypt({ name: "RSA-OAEP" }, pub, ri.encryptedKey));
     }
     if (kea.oid === O("rsaEncryption")) {
-      var keyObj = nodeCrypto.createPrivateKey({ key: k.der, format: "der", type: "pkcs8" });
-      try { return nodeCrypto.privateDecrypt({ key: keyObj, padding: guard.crypto.padding.RSA_PKCS1 }, ri.encryptedKey); }
+      var keyObj = guard.crypto.privateKey({ key: k.der, format: "der", type: "pkcs8" });
+      try { return guard.crypto.privateDecrypt({ key: keyObj, padding: guard.crypto.padding.RSA_PKCS1 }, ri.encryptedKey); }
       catch (_e) {
         return null;
       }
@@ -339,7 +338,7 @@ async function _pwriCek(ri, km, opts) {
   var iv = asn1.read.octetString(inner.children[1]);
   var pw = pbes2.passwordBytesOwned(km.password, _err, "cms");
   var kek;
-  try { kek = nodeCrypto.pbkdf2Sync(pw.bytes, pb.salt, pb.iterations, innerBits / 8, pb.prfNode); }
+  try { kek = guard.crypto.pbkdf2(pw.bytes, pb.salt, pb.iterations, innerBits / 8, pb.prfNode); }
   finally { if (pw.owned) guard.secret.zeroize(pw.bytes, CmsError, "cms/bad-input", "the password encoding"); }
   try {
     return _pwriUnwrap(kek, ri.encryptedKey, iv, innerBits);
@@ -421,7 +420,7 @@ async function _openContent(parsed, eci, cek, ct, streamMode) {
   }
   if (eci.encryptedContent == null) throw _err("cms/no-encrypted-content", "the message has no encryptedContent (detached; supply it out of band)");
   var substitute = null;
-  if (cek == null || cek.length !== keyBits / 8) { substitute = nodeCrypto.randomBytes(keyBits / 8); cek = substitute; }
+  if (cek == null || cek.length !== keyBits / 8) { substitute = guard.crypto.randomBytes(keyBits / 8); cek = substitute; }
   try {
     if (ct === "authEnvelopedData") {
       var aad = parsed.authAttrsBytes != null ? _explicitSetOf(parsed.authAttrsBytes) : Buffer.alloc(0);
@@ -461,9 +460,9 @@ async function _openContent(parsed, eci, cek, ct, streamMode) {
 }
 function _gcmOpen(cek, nonce, ct, tag, aad, keyBits, icvLen) {
   if (!tag || tag.length !== icvLen) throw _fail();
-  var d = nodeCrypto.createDecipheriv("aes-" + keyBits + "-gcm", cek, nonce, { authTagLength: icvLen });
-  d.setAuthTag(tag);
-  if (aad && aad.length) d.setAAD(aad);
+  var d = guard.crypto.decipher("aes-" + keyBits + "-gcm", cek, nonce, { authTagLength: icvLen });
+  guard.crypto.decipherSetAuthTag(d, tag);
+  if (aad && aad.length) guard.crypto.transformSetAAD(d, aad);
   return guard.secret.cipherFinish(d, ct, CmsError, "cms/decrypt-failed", "the recovered content");
 }
 
@@ -543,7 +542,7 @@ async function _decryptPbes2(parsed, eci, km, opts) {
   if (!keyBits) throw _err("cms/unsupported-algorithm", "unsupported PBES2 content cipher " + encOid);
   var pwE = pbes2.passwordBytesOwned(km.password, _err, "cms");
   var key;
-  try { key = nodeCrypto.pbkdf2Sync(pwE.bytes, pb.salt, pb.iterations, keyBits / 8, pb.prfNode); }
+  try { key = guard.crypto.pbkdf2(pwE.bytes, pb.salt, pb.iterations, keyBits / 8, pb.prfNode); }
   finally { if (pwE.owned) guard.secret.zeroize(pwE.bytes, CmsError, "cms/bad-input", "the password encoding"); }
   try { return _originFields({ content: opts.stream === true ? _cbcStream(key, iv, eci.encryptedContent, keyBits) : pbes2.cbcDecrypt(key, iv, eci.encryptedContent, keyBits, CmsError, "cms/decrypt-failed"), contentType: eci.contentType, contentTypeName: oid.name(eci.contentType) || eci.contentType, recipientType: "password", recipientIndex: -1, contentEncryptionAlgorithm: oid.name(encOid) || encOid, authenticated: false }, null, null); }
   catch (_e) { throw _fail(); }
@@ -588,13 +587,13 @@ function _pwriUnwrap(kek, wrapped, iv, keyBits) {
   var n = wrapped.length;
   var lastDec = null, pass1 = null, body = null;
   try {
-    var ecb = nodeCrypto.createDecipheriv("aes-" + keyBits + "-ecb", kek, Buffer.alloc(0)); ecb.setAutoPadding(false);
+    var ecb = guard.crypto.decipher("aes-" + keyBits + "-ecb", kek, Buffer.alloc(0)); guard.crypto.transformNoPadding(ecb);
     lastDec = guard.secret.cipherFinish(ecb, wrapped.subarray(n - blk), CmsError, "cms/decrypt-failed", "the recovered CBC last block");
     var iv2 = Buffer.alloc(blk);
     for (var i = 0; i < blk; i++) iv2[i] = lastDec[i] ^ wrapped[n - 2 * blk + i];
-    var d1 = nodeCrypto.createDecipheriv(alg, kek, iv2); d1.setAutoPadding(false);
+    var d1 = guard.crypto.decipher(alg, kek, iv2); guard.crypto.transformNoPadding(d1);
     pass1 = guard.secret.cipherFinish(d1, wrapped, CmsError, "cms/decrypt-failed", "the PWRI first-pass plaintext");
-    var d2 = nodeCrypto.createDecipheriv(alg, kek, iv); d2.setAutoPadding(false);
+    var d2 = guard.crypto.decipher(alg, kek, iv); guard.crypto.transformNoPadding(d2);
     body = guard.secret.cipherFinish(d2, pass1, CmsError, "cms/decrypt-failed", "the PWRI plaintext block");
     var count = body[0];
     if (count < 1 || count + 4 > body.length) throw _fail();
@@ -670,8 +669,9 @@ function _ecCurveFromCert(cert) {
 function _ecCurveFromPrivateKey(keyDer) {
   var spki;
   try {
-    spki = nodeCrypto.createPublicKey({ key: keyDer, format: "der", type: "pkcs8" })
-      .export({ format: "der", type: "spki" });
+    spki = guard.crypto.exportKey(
+      guard.crypto.publicKey({ key: keyDer, format: "der", type: "pkcs8" }),
+      { format: "der", type: "spki" });
   } catch (_e) { return null; } // allow:swallow-unverified a key this runtime cannot read names no curve
   var alg = asn1.decode(spki).children[0];
   if (asn1.read.oid(alg.children[0]) !== O("ecPublicKey") || alg.children.length < 2) return null;
@@ -756,7 +756,7 @@ async function _verifyAuthenticatedData(parsed, km, opts, requireProtection) {
       _assertSupported(candidates[ci].ri, km);
       var macKey = await _acquireCek(candidates[ci].ri, km, opts);
       var macSubstitute = null;
-      if (macKey == null || macKey.length < MAC_KEY_MIN_OCTETS) macSubstitute = nodeCrypto.randomBytes(MAC_KEY_MIN_OCTETS);
+      if (macKey == null || macKey.length < MAC_KEY_MIN_OCTETS) macSubstitute = guard.crypto.randomBytes(MAC_KEY_MIN_OCTETS);
       try {
         var key = await subtle.importKey("raw", macSubstitute || macKey, { name: "HMAC", hash: hash }, false, ["verify"]);
         if (!(await _subtleVerify(subtle, { name: "HMAC" }, key, Buffer.from(parsed.mac), preimage))) throw _fail();