@blamejs/pki 0.8.60 → 0.9.0

package/lib/hpke.js

@@ -250,10 +250,10 @@ function _importPublic(kem, raw) {
       if (raw[0] !== 0x04) throw _err("hpke/bad-key", "EC public key must be an uncompressed 0x04 point (RFC 9180 sec. 7.1.4)");
       var half = (raw.length - 1) / 2;
       var jwk = { kty: "EC", crv: kem.curve, x: raw.subarray(1, 1 + half).toString("base64url"), y: raw.subarray(1 + half).toString("base64url") };
-      return nodeCrypto.createPublicKey({ key: jwk, format: "jwk" });
+      return guard.crypto.publicKey({ key: jwk, format: "jwk" });
     }
     var prefix = kem.kind === "mlkem" ? ML_KEM_SPKI[kem.name] : OKP_SPKI[kem.curve];
-    return nodeCrypto.createPublicKey({ key: _bufferConcat([_hex(prefix), raw]), format: "der", type: "spki" });
+    return guard.crypto.publicKey({ key: _bufferConcat([_hex(prefix), raw]), format: "der", type: "spki" });
   } catch (e) {
     if (e instanceof HpkeError) throw e;
     throw _err("hpke/bad-key", "invalid " + kem.name + " public key" +
@@ -261,15 +261,15 @@ function _importPublic(kem, raw) {
   }
 }
 function _exportPublic(kem, keyObject) {
-  var pub = keyObject.type === "public" ? keyObject : nodeCrypto.createPublicKey(keyObject);
+  var pub = keyObject.type === "public" ? keyObject : guard.crypto.publicKey(keyObject);
   if (kem.kind === "mlkem") {
-    var der = pub.export({ format: "der", type: "spki" }), prefix = _hex(ML_KEM_SPKI[kem.name]);
+    var der = guard.crypto.exportKey(pub, { format: "der", type: "spki" }), prefix = _hex(ML_KEM_SPKI[kem.name]);
     if (der.length !== prefix.length + kem.Npub || !_bufferEquals(_subarray(der, 0, prefix.length), prefix)) {
       throw _err("hpke/bad-key", "the KeyObject is not an " + kem.name + " key");
     }
     return _subarray(der, prefix.length);
   }
-  var jwk = pub.export({ format: "jwk" });
+  var jwk = guard.crypto.exportKey(pub, { format: "jwk" });
   if (jwk.crv !== kem.curve) throw _err("hpke/bad-key", "the KeyObject is not a " + kem.name + " key");
   if (kem.kind === "ec") return concat([Buffer.from([0x04]), _b64u(jwk.x), _b64u(jwk.y)]);
   return _b64u(jwk.x);
@@ -293,7 +293,7 @@ function _importPrivate(kem, rawSk) {
     der = _bufferConcat([_hex(kem.kind === "mlkem" ? ML_KEM_PKCS8[kem.name] : OKP_PKCS8[kem.curve]), rawSk]);
   }
   try {
-    return nodeCrypto.createPrivateKey({ key: der, format: "der", type: kem.kind === "ec" ? "sec1" : "pkcs8" });
+    return guard.crypto.privateKey({ key: der, format: "der", type: kem.kind === "ec" ? "sec1" : "pkcs8" });
   } catch (e) {
     throw _err("hpke/bad-key", "invalid " + kem.name + " private key", e);
   } finally {
@@ -301,7 +301,7 @@ function _importPrivate(kem, rawSk) {
   }
 }
 function _boundPublic(kem, privateKey, pkm) {
-  var derived = _exportPublic(kem, nodeCrypto.createPublicKey(privateKey));
+  var derived = _exportPublic(kem, guard.crypto.publicKey(privateKey));
   if (pkm === undefined) return derived;
   if (!_isBuffer(pkm) || !_bufferEquals(derived, pkm)) {
     throw _err("hpke/bad-key", "pkm is not the " + kem.name + " public key derived from skm");
@@ -310,7 +310,7 @@ function _boundPublic(kem, privateKey, pkm) {
 }
 function _dh(privateKey, publicKey) {
   try {
-    return nodeCrypto.diffieHellman({ privateKey: privateKey, publicKey: publicKey });
+    return guard.crypto.diffieHellman({ privateKey: privateKey, publicKey: publicKey });
   } catch (e) {
     throw _err("hpke/bad-key", "KEM Diffie-Hellman failed: invalid or low-order public key", e);
   }
@@ -319,8 +319,8 @@ function _dh(privateKey, publicKey) {
  *  drawn and expanded by generateKeyPair, and an ML-KEM encapsulation takes its randomness from the
  *  runtime rather than from an ephemeral key pair. */
 function _generate(kem) {
-  if (kem.kind === "ec") return nodeCrypto.generateKeyPairSync("ec", { namedCurve: kem.nodeCurve });
-  return nodeCrypto.generateKeyPairSync(kem.curve.toLowerCase());
+  if (kem.kind === "ec") return guard.crypto.generateKeyPair("ec", { namedCurve: kem.nodeCurve });
+  return guard.crypto.generateKeyPair(intrinsic.toLowerCase(kem.curve));
 }
 
 
@@ -385,8 +385,8 @@ function _hybridExpand(kem, seed) {
     var skT = _importPrivate(_groupRow(kem), _randomScalar(kem, _subarray(full, kem.pq.Nsk)));
     return {
       skPQ: skPQ, skT: skT,
-      ekPQ: _exportPublic(kem.pq, nodeCrypto.createPublicKey(skPQ)),
-      ekT: _exportPublic(_groupRow(kem), nodeCrypto.createPublicKey(skT)),
+      ekPQ: _exportPublic(kem.pq, guard.crypto.publicKey(skPQ)),
+      ekT: _exportPublic(_groupRow(kem), guard.crypto.publicKey(skT)),
     };
   } finally {
     guard.secret.zeroize(full, HpkeError, "hpke/bad-input", "the hybrid seed expansion");
@@ -491,7 +491,7 @@ function _refuseEph(kem, eph) {
 function _mlKemEncap(kem, pkR, eph) {
   _refuseEph(kem, eph);
   var r;
-  try { r = nodeCrypto.encapsulate(pkR); }
+  try { r = guard.crypto.encapsulate(pkR); }
   catch (e) { throw _err("hpke/bad-key", kem.name + " encapsulation failed", e); }
   return { sharedSecret: r.sharedKey, enc: r.ciphertext };
 }
@@ -499,7 +499,7 @@ function _mlKemDecap(kem, enc, skR) {
   if (enc.length !== kem.Nenc) {
     throw _err("hpke/bad-key", kem.name + " encapsulated key must be " + kem.Nenc + " bytes (FIPS 203 sec. 7.3 ciphertext check)");
   }
-  try { return nodeCrypto.decapsulate(skR, enc); }
+  try { return guard.crypto.decapsulate(skR, enc); }
   catch (e) { throw _err("hpke/bad-key", kem.name + " decapsulation failed", e); }
 }
 function _encap(kem, pkR, pkRm, eph) {
@@ -648,10 +648,10 @@ Context.prototype.seal = function (aad, pt) {
    *  which is what RFC 9180 sec. 5.2 uses. */
   var aadBytes = _buf(aad);
   var nonce = this._nonce();
-  var c = nodeCrypto.createCipheriv(aead.cipher, this._key, nonce, { authTagLength: aead.Nt });
-  if (aadBytes.length) c.setAAD(aadBytes);
+  var c = guard.crypto.cipher(aead.cipher, this._key, nonce, { authTagLength: aead.Nt });
+  if (aadBytes.length) guard.crypto.transformSetAAD(c, aadBytes);
   var body = guard.secret.cipherFinish(c, _buf(pt), HpkeError, "hpke/bad-input", "a seal intermediate");
-  var ct = concat([body, c.getAuthTag()]);
+  var ct = concat([body, guard.crypto.cipherAuthTag(c)]);
   this._inc();
   return ct;
 };
@@ -665,9 +665,9 @@ Context.prototype.open = function (aad, ct) {
    *  so the AAD was dropped on this side too and the pair round-tripped with nothing bound. */
   var aadBytes = _buf(aad);
   var nonce = this._nonce();
-  var d = nodeCrypto.createDecipheriv(aead.cipher, this._key, nonce, { authTagLength: aead.Nt });
-  if (aadBytes.length) d.setAAD(aadBytes);
-  d.setAuthTag(ct.subarray(ct.length - aead.Nt));
+  var d = guard.crypto.decipher(aead.cipher, this._key, nonce, { authTagLength: aead.Nt });
+  if (aadBytes.length) guard.crypto.transformSetAAD(d, aadBytes);
+  guard.crypto.decipherSetAuthTag(d, ct.subarray(ct.length - aead.Nt));
   var pt;
   try { pt = guard.secret.cipherFinish(d, ct.subarray(0, ct.length - aead.Nt), HpkeError, "hpke/bad-input", "the recovered plaintext"); }
   catch (e) { throw _err("hpke/open-failed", "AEAD authentication failed (RFC 9180 sec. 5.2)", e); }
@@ -814,7 +814,7 @@ function _recipPrivate(suite, sk) {
   }
   try {
     if (sk.type !== "private") throw _err("hpke/bad-key", "the private key must be a private KeyObject or { skm, pkm }, got a " + guard.text.showValue(sk.type) + " KeyObject");
-    var pkm = _exportPublic(kem, nodeCrypto.createPublicKey(sk));
+    var pkm = _exportPublic(kem, guard.crypto.publicKey(sk));
     return { key: sk, pkm: pkm };
   } catch (e) {
     if (e instanceof HpkeError) throw e;
@@ -923,7 +923,7 @@ function _setupS(ids, pkR, opts) {
    *  the subject being the key rather than the ciphertext. `_suite(ids)` stays above both, by necessity:
    *  which KEM this is decides the width the key is held to. */
   var r = _recipPublic(suite, pkR);
-  opts = _options(opts || {}, _SETUP_S_KEYS, "sender setup");
+  opts = _options(opts || intrinsic.create(null), _SETUP_S_KEYS, "sender setup");
   var mode = opts.mode;
   var kem = suite.kem, k;
   if (mode === MODE_AUTH || mode === MODE_AUTH_PSK) {
@@ -978,7 +978,7 @@ function _setupR(ids, enc, skR, opts) {
    *  size of whatever was supplied: a 64 MiB value handed where a 32-byte encapsulation belongs was
    *  copied in full and only then refused. */
   var sealed = _rawKey(enc, _encWidth(suite.kem));
-  opts = _options(opts || {}, _SETUP_R_KEYS, "recipient setup");
+  opts = _options(opts || intrinsic.create(null), _SETUP_R_KEYS, "recipient setup");
   var mode = opts.mode;
   var r = _recipPrivate(suite, skR);
   var kem = suite.kem, ss;
@@ -1118,11 +1118,11 @@ function deriveKeyPair(kemId, ikm) {
      *  and the decapsulation key returned is that 64-byte value. */
     var dk = _labeledDerive("shake256", _kemSuiteId(_kemId(kem)), input, "DeriveKeyPair", _EMPTY, kem.Nsk);
     var mlSk = _importPrivate(kem, dk);
-    return { publicKey: _exportPublic(kem, nodeCrypto.createPublicKey(mlSk)), privateKey: dk };
+    return { publicKey: _exportPublic(kem, guard.crypto.publicKey(mlSk)), privateKey: dk };
   }
   var raw = _deriveKeyPairDhkem(kem, input);
   var sk = _importPrivate(kem, raw);
-  return { publicKey: _exportPublic(kem, nodeCrypto.createPublicKey(sk)), privateKey: raw };
+  return { publicKey: _exportPublic(kem, guard.crypto.publicKey(sk)), privateKey: raw };
 }
 
 /** @internal DeriveKeyPair for a DHKEM (RFC 9180 sec. 7.1.3). X25519 and X448 expand the extract output
@@ -1258,7 +1258,7 @@ function decap(kemId, enc, recipientPrivateKey) {
  *  Nsk rather than trusted. An ML-KEM or hybrid key never reaches here, its private half being a seed
  *  that generateKeyPair draws. */
 function _exportPrivateRaw(kem, privateKey) {
-  var raw = _b64u(privateKey.export({ format: "jwk" }).d);
+  var raw = _b64u(guard.crypto.exportKey(privateKey, { format: "jwk" }).d);
   if (!_isBuffer(raw) || raw.length !== kem.Nsk) {
     throw _err("hpke/bad-key", "the generated " + kem.name + " private key is not the " +
       kem.Nsk + "-byte scalar this verb returns");

package/lib/http-digest.js

@@ -6,6 +6,7 @@
 var crypto = require("crypto");
 var constants = require("./constants");
 var intrinsic = require("./guard-intrinsic");
+var guard = require("./guard-all");
 var guardIdentifier = require("./guard-identifier");
 var _hasOwn = intrinsic.hasOwn;
 /** @internal The URL parser, taken at load: the origin it reports is what a challenge is bound to.
@@ -46,14 +47,11 @@ var DEFAULT_CODES = intrinsic.assign(intrinsic.create(null), {
   noQop: "digest/no-qop", badChallenge: "digest/bad-challenge",
 });
 
-/** @internal The hash the credential is computed with, taken at load along with the methods of the
- * object it returns. Every Digest response value is this function's output, so a replacement chooses
- * what is sent in place of the password-derived proof. */
-var _createHash = crypto.createHash;
+/** @internal Every Digest response value is this function's output, so whatever computes it chooses
+ * what is sent in place of the password-derived proof. RFC 7616 sec. 3 computes over the octets of
+ * the latin1 encoding, which is why the input encoding is named rather than defaulted. */
 var _randomBytes = crypto.randomBytes;
-var _hashUpdate = intrinsic.uncurry(crypto.createHash("sha256").update);
-var _hashDigest = intrinsic.uncurry(crypto.createHash("sha256").digest);
-function H(hash, s) { return _hashDigest(_hashUpdate(_createHash(hash), s, "latin1"), "hex"); }
+function H(hash, s) { return guard.crypto.digest(hash, s, { input: "latin1", output: "hex" }); }
 function KD(hash, secret, data) { return H(hash, secret + ":" + data); }
 function _qstr(v) {
   var s = intrinsic.String(v), out = "";

package/lib/http-retry-after.js

@@ -3,6 +3,9 @@
 "use strict";
 // @internal
 
+/** @internal The record constructor, captured at load, for the reason the same capture in
+ * `lib/inspect.js` gives: arming this module counts 48 live runtime reads. */
+var _create = Object.create;
 var constants = require("./constants");
 var guard = require("./guard-all");
 
@@ -100,7 +103,7 @@ function httpDateMs(s, refMs) {
 }
 
 function parse(value, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var raStr = String(value).trim();
   var out = { retryAfterSeconds: null, retryAfterDate: null };
   if (_isAllDigits(raStr)) {

package/lib/http-transport.js

@@ -339,7 +339,7 @@ function _blockedAddrErr(hostname, address) {
 }
 function _makeGuardedLookup(lookupFn) {
   return function guardedLookup(hostname, options, callback) {
-    lookupFn(hostname, options || {}, function (err, address, family) {
+    lookupFn(hostname, options || intrinsic.create(null), function (err, address, family) {
       if (err) return callback(err);
       /** @internal Each address is read ONCE, the read is what gets classified, and the SNAPSHOT is
        *  what the socket layer is handed. Forwarding the list the resolver returned let the entry be
@@ -633,7 +633,7 @@ function _proxyErrorClass(e, C) {
  *   res.status;   // 200
  */
 function httpsTransport(defaults) {
-  defaults = defaults || {};
+  defaults = defaults || intrinsic.create(null);
   /** @internal Each of these is read ONCE, into the value both the test and the use see, and the
    *  error factory a refusal is built from is one of them. */
   var rawE = defaults.E;
@@ -789,7 +789,7 @@ function httpsTransport(defaults) {
   }
 
   var _transportFn = function transport(request) {
-    request = request || {};
+    request = request || intrinsic.create(null);
     var prep;
     try { prep = _prepare(request); }
     catch (e) { return _promiseReject(_Promise, e); }
@@ -848,7 +848,7 @@ function httpsTransport(defaults) {
             /** @internal Captured for consistency with the rest of the file, not because this gates
              * anything: an understated `content-length` only skips this EARLY refusal, and the cap is
              * enforced below on the bytes actually counted as they arrive. */
-            var declared = intrinsic.parseInt((res.headers || {})["content-length"], 10);
+            var declared = intrinsic.parseInt((res.headers || intrinsic.create(null))["content-length"], 10);
             if (intrinsic.numberIsFinite(declared) && declared > prep.maxBytes) { fail(C("response-too-large"), "the declared content-length " + declared + " exceeds the " + prep.maxBytes + "-byte cap (RFC 7030 sec. 6)"); return; }
             var buf = _bufferAllocUnsafe(0);
             var len = 0;
@@ -1039,7 +1039,7 @@ function httpsTransport(defaults) {
    * connecting directly while a proxy is configured would reach an origin the caller asked not to
    * reach directly. */
   _transportFn.peerChain = function peerChain(request) {
-    request = request || {};
+    request = request || intrinsic.create(null);
     var prep;
     try { prep = _prepare({
       url: request.url,
@@ -1149,6 +1149,6 @@ function httpsTransport(defaults) {
  *   pki.schema.x509.parse(channel.peerChain[0]).subject.dn;    // the leaf's subject
  *   channel.peerCertificate;                                   // the one certificate the endpoint sent
  */
-function peerChain(request, defaults) { return httpsTransport(defaults || {}).peerChain(request); }
+function peerChain(request, defaults) { return httpsTransport(defaults || intrinsic.create(null)).peerChain(request); }
 
 module.exports = { https: httpsTransport, peerChain: peerChain, isBlockedIp: _isBlockedIp, _makeGuardedLookup: _makeGuardedLookup, MAX_TIMEOUT: MAX_TIMEOUT, snapshotProxy: snapshotProxy };

package/lib/inspect.js

@@ -23,6 +23,11 @@
  * @card Read a certificate like `openssl x509 -text`, in pure JS.
  */
 
+/** @internal The record constructor, captured at load. A default record written as `{}` has
+ * `Object.prototype`, so every field the caller omitted is read off the prototype chain. This module
+ * does not take the guard-intrinsic captures, and requiring them arms it whole: measured, that counts
+ * 662 live runtime reads here, which is a migration of its own rather than a line in this change. */
+var _create = Object.create;
 var frameworkError = require("./framework-error");
 var constants = require("./constants");
 var asn1 = require("./asn1-der");
@@ -56,7 +61,7 @@ var OID_UNOTICE = oid.byName("unotice");
 
 var HEX = "0123456789abcdef";
 function _hexColon(buf, opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   var hex = [];
   for (var i = 0; i < buf.length; i++) {
     var b = buf[i], s = HEX[(b >> 4) & 0xf] + HEX[b & 0xf];
@@ -346,7 +351,7 @@ var EXT_RENDERERS = Object.assign(Object.create(null), {
     return (decoded || []).map(function (ad) {
       var m = null;
       try { m = oid.name(ad.accessMethod); } catch (_e) { /* allow:swallow-unverified display best-effort: an unregistered accessMethod OID falls back to the raw dotted OID below (inspection is best-effort, never a verdict) */ }
-      var loc = ad.accessLocation || {}, lv;
+      var loc = ad.accessLocation || _create(null), lv;
       if (loc.tag === 6) lv = "URI:" + loc.value;
       else if (loc.tag === 2) lv = "DNS:" + loc.value;
       else if (loc.tag === 1) lv = "email:" + loc.value;
@@ -1368,7 +1373,7 @@ function pkcs12Report(input) {
      *  structure, and the outer MacData fields then describe nothing: read from there, a store with 2048
      *  PBKDF2 iterations reported one iteration, an empty salt, and "pbmac1" as its digest. */
     if (p.mac.pbmac1) {
-      var kdf = p.mac.pbmac1.kdf || {};
+      var kdf = p.mac.pbmac1.kdf || _create(null);
       _optLine(L, "        ", "Digest", p.mac.pbmac1.schemeName || p.mac.pbmac1.schemeOid);
       _optLine(L, "        ", "Key Derivation", kdf.prfName || kdf.prfOid);
       _optLine(L, "        ", "Iterations", kdf.iterationCount);
@@ -2363,7 +2368,7 @@ var KNOWN_DUMP_OPTS = Object.assign(Object.create(null),
  *   // Incomplete: the walk could not read the value at offset 5: content length 3 overruns the 0 bytes that remain.
  */
 function asn1Dump(input, opts) {
-  if (opts === undefined || opts === null) opts = {};
+  if (opts === undefined || opts === null) opts = _create(null);
   if (typeof opts !== "object" || Array.isArray(opts)) {
     throw _err("inspect/bad-input", "pki.inspect.asn1 options must be an object");
   }

package/lib/jose.js

@@ -325,7 +325,7 @@ function assertPublicJwk(jwk) {
  */
 var _VERIFY_KEYS = intrinsic.assign(intrinsic.create(null), { key: 1, profile: 1 });
 async function verify(jws, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   guard.identifier.assertKnownKeys(opts, _VERIFY_KEYS, E, "jose/bad-input", "unknown pki.jose.verify option ");
   /** @internal opts.key is examined several times: the type gate, the RFC 7638 thumbprint comparison
    *  against the embedded jwk, and the key the signature is verified under. An option reached through
@@ -456,7 +456,7 @@ function _fixedPayload(supplied) {
 }
 
 async function sign(opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   guard.identifier.assertKnownKeys(opts, _SIGN_KEYS, E, "jose/bad-input", "unknown pki.jose.sign option ");
   var fixedPayload = _fixedPayload(opts.payload);
   var headerJson;
@@ -496,7 +496,7 @@ async function sign(opts) {
   var protectedB64 = b64uEncode(headerBytes);
   var payloadB64 = payload.length === 0 ? "" : b64uEncode(payload);
   var signingInput = _bufferFrom(protectedB64 + "." + payloadB64, "ascii");
-  var jwk = header.jwk || opts.jwk || {};
+  var jwk = header.jwk || opts.jwk || intrinsic.create(null);
   /** @internal `suppliedKey` is the reading taken at the top, so the key adopted for signing, the key the
    *  hash-to-algorithm check approved and the key the expected signature width is computed from are all
    *  one key. */

package/lib/key.js

@@ -183,11 +183,11 @@ async function encrypt(privateKey, password, opts) {
   var prf = opts.prf || "hmacWithSHA256";
   var prfNode = pbes2.prfNodeByName(prf, _err, "key");
   var iterations = pbes2.assertIterations(opts.iterations == null ? 600000 : opts.iterations, _err, "key");
-  var salt = opts.salt != null ? pbes2.assertSalt(guard.bytes.view(opts.salt, KeyError, "key/bad-input", "salt"), _err, "key") : nodeCrypto.randomBytes(16);
-  var iv = nodeCrypto.randomBytes(16);
+  var salt = opts.salt != null ? pbes2.assertSalt(guard.bytes.view(opts.salt, KeyError, "key/bad-input", "salt"), _err, "key") : guard.crypto.randomBytes(16);
+  var iv = guard.crypto.randomBytes(16);
   var pwK = pbes2.passwordBytesOwned(password, _err, "key");
   var dk;
-  try { dk = nodeCrypto.pbkdf2Sync(pwK.bytes, salt, iterations, keyBits / 8, prfNode); }
+  try { dk = guard.crypto.pbkdf2(pwK.bytes, salt, iterations, keyBits / 8, prfNode); }
   finally { if (pwK.owned) guard.secret.zeroize(pwK.bytes, KeyError, "key/bad-input", "the password encoding"); }
   try {
     var ciphertext = pbes2.cbcEncrypt(dk, iv, der, keyBits, KeyError, "key/bad-input");
@@ -290,6 +290,10 @@ function _decryptPbes2(encAlg, ciphertext, password, opts) {
  *   var spkiPem = await pki.key.export(pair.publicKey, { format: "pem" });
  */
 var _EXPORT_OPTS = _assign(_create(null), { format: 1, label: 1 });
+/** @internal The WebCrypto export format each key type calls for, named here so the ONE read of the
+ * key's type below settles the encoding as well as the PEM label. Passing the format explicitly is
+ * what keeps the engine from reading the type a second time. */
+var _EXPORT_WANT_BY_TYPE = _assign(_create(null), { "private": "pkcs8", "public": "spki", "secret": "raw" });
 
 async function export_(key, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "key/bad-input", "pki.key.export options");
@@ -297,9 +301,14 @@ async function export_(key, opts) {
     "pki.key.export has an unknown option. It serializes only. To protect a private key, call " +
     "pki.key.encrypt(key, password) first and export its result. The unknown option was: ");
   if (!_isCryptoKey(key)) throw _err("key/bad-input", "export expects a WebCrypto CryptoKey");
+  /** @internal ONE read of the key's type, which both the PEM label and every encoding decision
+   *  below come from. On node's own CryptoKey it is a getter, so reading it per question let a
+   *  replacement answer "private" where the label was chosen and "public" where the bytes were, and
+   *  a public key came back inside a `PRIVATE KEY` block. */
+  var keyType = key.type;
   var defaultLabel;
-  if (key.type === "private") defaultLabel = "PRIVATE KEY";
-  else if (key.type === "public") defaultLabel = "PUBLIC KEY";
+  if (keyType === "private") defaultLabel = "PRIVATE KEY";
+  else if (keyType === "public") defaultLabel = "PUBLIC KEY";
   else throw _err("key/bad-input", "export supports asymmetric (private / public) CryptoKeys only");
   var fmt = opts.format || "der";
   if (fmt === "jwk") {
@@ -310,11 +319,11 @@ async function export_(key, opts) {
       throw _err("key/bad-input", "exporting the key as a JWK failed", e);
     }
   }
-  var der = await _exportAnyKey(key, _err, "key/bad-input");
+  var der = await _exportAnyKey(key, _err, "key/bad-input", _EXPORT_WANT_BY_TYPE[keyType]);
   if (fmt === "der") return der;
   if (fmt === "pem") return pkix.pemEncode(der, opts.label || defaultLabel, PemError);
-  if (fmt === "pkcs1") return _toPkcs1(der, key);
-  if (fmt === "sec1") return _toSec1(der, key);
+  if (fmt === "pkcs1") return _toPkcs1(der, key, keyType);
+  if (fmt === "sec1") return _toSec1(der, key, keyType);
   throw _err("key/bad-input", "unsupported format " + guard.text.showValue(opts.format) + " (der / pem / pkcs1 / sec1 / jwk)");
 }
 
@@ -923,18 +932,19 @@ var _PAIR_RSA = _assign(_create(null), { rsa: 1, "rsa-pss": 1 });
 var _PAIR_PROBE = _bufferFrom("pki.js key pair correspondence", "utf8");
 
 function _sameKeyFamily(priv, pub) {
-  if (priv.asymmetricKeyType === pub.asymmetricKeyType) return true;
-  return !!(_PAIR_RSA[guard.text.keyOf(priv.asymmetricKeyType)] &&
-    _PAIR_RSA[guard.text.keyOf(pub.asymmetricKeyType)]);
+  var privType = guard.crypto.keyType(priv), pubType = guard.crypto.keyType(pub);
+  if (privType === pubType) return true;
+  return !!(_PAIR_RSA[guard.text.keyOf(privType)] && _PAIR_RSA[guard.text.keyOf(pubType)]);
 }
 
 /** @internal How to exercise a signing pair: the digest, and any padding the encoding requires. An
  * `id-RSASSA-PSS` key may pin the hash and salt length it is usable with, and the engine refuses any
  * other, so a pinned value from either half is what proves the pair. */
 function _pairSignOptions(priv, pub) {
-  var privPss = priv.asymmetricKeyType === "rsa-pss", pubPss = pub.asymmetricKeyType === "rsa-pss";
+  var privType = guard.crypto.keyType(priv);
+  var privPss = privType === "rsa-pss", pubPss = guard.crypto.keyType(pub) === "rsa-pss";
   if (!privPss && !pubPss) {
-    return { digest: _PAIR_DIGEST[guard.text.keyOf(priv.asymmetricKeyType)] || null, options: null };
+    return { digest: _PAIR_DIGEST[guard.text.keyOf(privType)] || null, options: null };
   }
   var privDetails = _pssRestrictionOf(priv, privPss);
   var pubDetails = _pssRestrictionOf(pub, pubPss);
@@ -969,7 +979,7 @@ var _PSS_PINS = ["hashAlgorithm", "mgf1HashAlgorithm", "saltLength"];
  * carried, and refuse a genuine pair. */
 function _pssRestrictionOf(key, isPss) {
   var out = _create(null);
-  var details = isPss ? key.asymmetricKeyDetails : null;
+  var details = isPss ? guard.crypto.keyDetails(key) : null;
   if (details == null) return out;
   for (var i = 0; i < _PSS_PINS.length; i++) {
     var name = _PSS_PINS[i];
@@ -1026,7 +1036,7 @@ async function correspondsTo(privateKey, spkiDer) {
   try { pub = guard.crypto.publicKey({ key: pubAsPkcs3, format: "der", type: "spki" }); }
   catch (e) { throw _err("key/bad-input", "the public key could not be read", e); }
   if (!_sameKeyFamily(priv, pub)) return false;
-  var kind = guard.text.keyOf(priv.asymmetricKeyType);
+  var kind = guard.text.keyOf(guard.crypto.keyType(priv));
   /** @internal Every secret a probe makes, wiped once the verdict is decided, on every way out. */
   var secrets = [];
   try {
@@ -1041,17 +1051,17 @@ async function correspondsTo(privateKey, spkiDer) {
       return _keyEquals(guard.crypto.publicKey(priv), pub) === true;
     }
     if (_PAIR_KEM[kind]) {
-      var sealed = nodeCrypto.encapsulate(pub);
+      var sealed = guard.crypto.encapsulate(pub);
       guard.list.append(secrets, sealed.sharedKey);
-      var opened = nodeCrypto.decapsulate(priv, sealed.ciphertext);
+      var opened = guard.crypto.decapsulate(priv, sealed.ciphertext);
       guard.list.append(secrets, opened);
       return guard.crypto.constantTimeEqual(opened, sealed.sharedKey);
     }
     if (_PAIR_AGREE[kind]) {
-      var ephemeral = nodeCrypto.generateKeyPairSync(priv.asymmetricKeyType);
-      var ours = nodeCrypto.diffieHellman({ privateKey: priv, publicKey: ephemeral.publicKey });
+      var ephemeral = guard.crypto.generateKeyPair(guard.crypto.keyType(priv));
+      var ours = guard.crypto.diffieHellman({ privateKey: priv, publicKey: ephemeral.publicKey });
       guard.list.append(secrets, ours);
-      var theirs = nodeCrypto.diffieHellman({ privateKey: ephemeral.privateKey, publicKey: pub });
+      var theirs = guard.crypto.diffieHellman({ privateKey: ephemeral.privateKey, publicKey: pub });
       guard.list.append(secrets, theirs);
       if (!guard.crypto.constantTimeEqual(ours, theirs)) return false;
       /** @internal The agreement proves the SCALAR, not the encoding it was handed. RFC 7748 masks the
@@ -1194,13 +1204,13 @@ async function _importNamedFormat(input, opts) {
 /** @internal The inverse of the wrap: pull the inner key out of the PKCS#8 or SPKI the engine
  * wrote. The bytes come back as they went in, since the engine carries the inner structure
  * unchanged and this reads it rather than re-encoding it. */
-function _toPkcs1(der, key) {
-  var algOid = _wrappedAlgorithmOid(der, key);
+function _toPkcs1(der, key, keyType) {
+  var algOid = _wrappedAlgorithmOid(der, keyType);
   if (algOid !== O("rsaEncryption")) {
     throw _err("key/bad-input", "PKCS#1 is an RSA encoding (RFC 8017 App. A.1) and this key is " + _algName(key.algorithm));
   }
   var node = asn1.decode(der);
-  if (key.type === "public") {
+  if (keyType === "public") {
     var bits = asn1.read.bitString(node.children[1]);
     if (bits.unusedBits !== 0) throw _err("key/bad-input", "the exported public key does not hold whole octets");
     schemaPkcs1.parsePublic(bits.bytes);
@@ -1210,12 +1220,12 @@ function _toPkcs1(der, key) {
   schemaPkcs1.parse(inner);
   return inner;
 }
-function _toSec1(der, key) {
-  var algOid = _wrappedAlgorithmOid(der, key);
+function _toSec1(der, key, keyType) {
+  var algOid = _wrappedAlgorithmOid(der, keyType);
   if (algOid !== O("ecPublicKey")) {
     throw _err("key/bad-input", "SEC1 is an elliptic-curve private-key encoding (RFC 5915 sec. 3) and this key is " + _algName(key.algorithm));
   }
-  if (key.type !== "private") {
+  if (keyType !== "private") {
     throw _err("key/bad-input", "SEC1 encodes a private key; export the public half as SubjectPublicKeyInfo");
   }
   var node = asn1.decode(der);
@@ -1248,11 +1258,13 @@ function _toSec1(der, key) {
 }
 
 /** @internal The algorithm the wrapper names, read from whichever wrapper the key type produced:
- * a PrivateKeyInfo names it second, a SubjectPublicKeyInfo first. */
-function _wrappedAlgorithmOid(der, key) {
+ * a PrivateKeyInfo names it second, a SubjectPublicKeyInfo first. `keyType` is the one read the
+ * caller took, rather than a fresh one off the key, so every decision in an export comes from the
+ * same answer. */
+function _wrappedAlgorithmOid(der, keyType) {
   var node;
   try { node = asn1.decode(der); } catch (e) { throw _err("key/bad-input", "the exported key is not DER", e); }
-  var algSeq = key.type === "public" ? node.children[0] : node.children[1];
+  var algSeq = keyType === "public" ? node.children[0] : node.children[1];
   if (!algSeq || !algSeq.children || algSeq.children.length === 0) {
     throw _err("key/bad-input", "the exported key names no algorithm");
   }

package/lib/merkle.js

@@ -274,7 +274,7 @@ function emptyRootHash() {
  */
 var _INCLUSION_KEYS = _assign(_create(null), { leafIndex: 1, treeSize: 1, leafHash: 1, rootHash: 1, proof: 1 });
 function verifyInclusion(opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   guard.identifier.assertKnownKeys(opts, _INCLUSION_KEYS, function (c, m) { return new MerkleError(c, m); },
     "merkle/bad-input", "unknown verifyInclusion option ");
   var leafIndex = _coerceCoord(opts.leafIndex, "leafIndex");
@@ -346,7 +346,7 @@ function verifyInclusion(opts) {
  */
 var _CONSISTENCY_KEYS = _assign(_create(null), { oldSize: 1, newSize: 1, oldRoot: 1, newRoot: 1, proof: 1 });
 function verifyConsistency(opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   guard.identifier.assertKnownKeys(opts, _CONSISTENCY_KEYS, function (c, m) { return new MerkleError(c, m); },
     "merkle/bad-input", "unknown verifyConsistency option ");
   var oldSize = _coerceCoord(opts.oldSize, "oldSize");
@@ -456,7 +456,7 @@ function root(leafHashes) {
  */
 var _INCLUSION_PROOF_KEYS = _assign(_create(null), { leafHashes: 1, leafIndex: 1 });
 function inclusionProof(opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   guard.identifier.assertKnownKeys(opts, _INCLUSION_PROOF_KEYS, _merkleErr,
     "merkle/bad-input", "unknown inclusionProof option ");
   var leaves = _leafArray(opts.leafHashes, "leafHashes");
@@ -498,7 +498,7 @@ function inclusionProof(opts) {
  */
 var _CONSISTENCY_PROOF_KEYS = _assign(_create(null), { leafHashes: 1, oldSize: 1 });
 function consistencyProof(opts) {
-  opts = opts || {};
+  opts = opts || _create(null);
   guard.identifier.assertKnownKeys(opts, _CONSISTENCY_PROOF_KEYS, _merkleErr,
     "merkle/bad-input", "unknown consistencyProof option ");
   var leaves = _leafArray(opts.leafHashes, "leafHashes");

package/lib/ocsp.js

@@ -23,7 +23,6 @@
  * @card Build, sign, and verify RFC 6960 OCSP requests + responses (a responder + a relying party).
  */
 
-var nodeCrypto = require("crypto");
 var asn1 = require("./asn1-der");
 var pkiBuild = require("./pki-build");
 var _ocspIntrinsic = require("./guard-intrinsic");
@@ -245,7 +244,7 @@ function _buildRequest(query, opts) {
     _push(tbsChildren,b.sequence(requests));
     var reqExts = [];
     if (opts.nonce) {
-      var nonceBytes = opts.nonce === true ? nodeCrypto.randomBytes(32) : opts.nonce;
+      var nonceBytes = opts.nonce === true ? guard.crypto.randomBytes(32) : opts.nonce;
       _assertNonce(nonceBytes, REQUESTER_NONCE_FLOOR);
       _push(reqExts,_nonceExt(nonceBytes));
     }
@@ -351,7 +350,7 @@ function _sign(responseData, responder, opts) {
   opts = guard.identifier.optionsObject(opts, _err, "ocsp/bad-input", "pki.ocsp.sign options");
   guard.identifier.assertKnownKeys(opts, _SIGN_OPTS, _err, "ocsp/bad-input",
     "pki.ocsp.sign has an unknown option (the nonce to echo back is `nonce`): ");
-  responseData = responseData || {};
+  responseData = responseData || _ocspIntrinsic.create(null);
   if (typeof responseData !== "object") throw _err("ocsp/bad-input", "the responseData must be an object { responderID, responses, producedAt? }");
   guard.identifier.assertKnownKeys(responseData, _RESPONSE_DATA_KEYS, _err, "ocsp/bad-input", "unknown responseData field (accepted: responderID, responses, producedAt): ");
   if (!responder || typeof responder !== "object") throw _err("ocsp/bad-input", "a responder must be { cert, key }");
@@ -450,7 +449,7 @@ function _responderID(rid, respCert) {
   throw _err("ocsp/bad-input", "responderID must be \"byName\" or \"byKey\"");
 }
 function _buildSingleResponse(r, opts) {
-  r = r || {};
+  r = r || _ocspIntrinsic.create(null);
   var certIdP;
   if (typeof r !== "object") return _promiseReject(_Promise, _err("ocsp/bad-input", "each response entry must be an object"));
   try { guard.identifier.assertKnownKeys(r, _SINGLE_RESPONSE_KEYS, _err, "ocsp/bad-input", "unknown response entry field (accepted: cert, issuer, certID, hashAlgorithm, status, thisUpdate, nextUpdate, singleExtensions): "); }

package/lib/path-validate.js

@@ -1867,7 +1867,7 @@ async function _validate(path, opts, run, scope) {
   }
 
   if (opts.ctLogList != null) {
-    var ctCheck = await ctGateCheck(certs[n - 1], certs, anchor, opts.ctLogList, opts.ctPolicy || {}, n, opts.time);
+    var ctCheck = await ctGateCheck(certs[n - 1], certs, anchor, opts.ctLogList, opts.ctPolicy || intrinsic.create(null), n, opts.time);
     var target = null;
     for (var tr = 0; tr < state.results.length; tr++) { if (state.results[tr].index === n - 1) { target = state.results[tr]; break; } }
     if (target) guard.list.append(target.checks, ctCheck);
@@ -2599,7 +2599,7 @@ function _ocspFromBytes(response) {
 }
 
 function _verifyOcspParsed(parsedResponse, cert, issuerCert, time, opts) {
-  opts = opts || {};
+  opts = opts || intrinsic.create(null);
   /** @internal The captured finite test rather than a live `isNaN`: a valid Date's instant is always
    * finite and an invalid one's is not, so the two answer the same question, and the instant is read
    * ONCE into the value the test decides on. */
@@ -3356,7 +3356,7 @@ async function _aiaFetchOne(uri, aia) {
   var res = await guard.async.invoked(aia.transport,
     [{ method: "GET", url: uri, tls: aia.tls, timeout: aia.timeout, maxResponseBytes: aia.maxResponseBytes, blockPrivateAddresses: true }],
     E, "path/bad-input", "opts.transport");
-  res = res || {};
+  res = res || intrinsic.create(null);
   if (res.status !== 200) throw E("path/aia-status", "an AIA fetch returned HTTP " + res.status + " (only 200 is a cert source; no redirect following)");
   var body = guard.bytes.isByteSource(res.body)
     ? guard.bytes.source(res.body, PathError, "path/aia-bad-body", "the AIA response body")