@blamejs/blamejs-shop 0.5.21 → 0.5.22

package/lib/vendor/blamejs/lib/vendor/blamejs-pki.cjs

@@ -1,4 +1,4 @@
-// @blamejs/pki v0.4.13 — vendored (Apache-2.0). Zero-dep pure CJS.
+// @blamejs/pki v0.4.14 — vendored (Apache-2.0). Zero-dep pure CJS.
 // https://github.com/blamejs/pki  Exports: x509, crl, pkcs12, key, webcrypto, schema, csr, cms, ...
 // Backs lib/mtls-engine-default.js (PQC-capable CA + PKCS#12 engine).
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -139,7 +139,7 @@ var require_package = __commonJS({
   "node_modules/@blamejs/pki/package.json"(exports2, module2) {
     module2.exports = {
       name: "@blamejs/pki",
-      version: "0.4.13",
+      version: "0.4.14",
       description: "Pure-JavaScript PKI toolkit that owns its stack \u2014 X.509, ASN.1/DER, CMS, PQC-first.",
       license: "Apache-2.0",
       author: "blamejs contributors",
@@ -3716,25 +3716,31 @@ var require_webcrypto = __commonJS({
         var iv = _toBuf(alg.iv, "AES-GCM iv");
         var aad = alg.additionalData ? _toBuf(alg.additionalData, "AES-GCM aad") : null;
         return _toArrayBuffer(_runCipher(function() {
-          var cipher = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-gcm", _secretBytes(key), iv, { authTagLength: (alg.tagLength || 128) / 8 });
-          if (aad) cipher.setAAD(aad);
-          var ct = Buffer.concat([cipher.update(buf), cipher.final()]);
-          return Buffer.concat([ct, cipher.getAuthTag()]);
+          return _withSecretBytes(key, function(kb) {
+            var cipher = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-gcm", kb, iv, { authTagLength: (alg.tagLength || 128) / 8 });
+            if (aad) cipher.setAAD(aad);
+            var ct = Buffer.concat([cipher.update(buf), cipher.final()]);
+            return Buffer.concat([ct, cipher.getAuthTag()]);
+          });
         }, "encrypt"));
       }
       if (name === "AES-CBC") {
         var cbcIv = _toBuf(alg.iv, "AES-CBC iv");
         return _toArrayBuffer(_runCipher(function() {
-          var c2 = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-cbc", _secretBytes(key), cbcIv);
-          return Buffer.concat([c2.update(buf), c2.final()]);
+          return _withSecretBytes(key, function(kb) {
+            var c2 = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-cbc", kb, cbcIv);
+            return Buffer.concat([c2.update(buf), c2.final()]);
+          });
         }, "encrypt"));
       }
       if (name === "AES-CTR") {
         _requireCtrLength128(alg);
         var ctrCounter = _toBuf(alg.counter, "AES-CTR counter");
         return _toArrayBuffer(_runCipher(function() {
-          var c3 = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-ctr", _secretBytes(key), ctrCounter);
-          return Buffer.concat([c3.update(buf), c3.final()]);
+          return _withSecretBytes(key, function(kb) {
+            var c3 = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-ctr", kb, ctrCounter);
+            return Buffer.concat([c3.update(buf), c3.final()]);
+          });
         }, "encrypt"));
       }
       throw new WebCryptoError("webcrypto/not-supported", "encrypt: unsupported algorithm " + JSON.stringify(name));
@@ -3747,12 +3753,17 @@ var require_webcrypto = __commonJS({
       if (!ENCRYPT_DECRYPT_NAMES[name]) throw new WebCryptoError("webcrypto/not-supported", "decrypt: unsupported algorithm " + JSON.stringify(name));
       _requireAlgMatch(alg, key, "decrypt");
       if (name === "RSA-OAEP") {
-        return _toArrayBuffer(nodeCrypto.privateDecrypt({
+        var oaepOut = nodeCrypto.privateDecrypt({
           key: key._handle,
           padding: nodeCrypto.constants.RSA_PKCS1_OAEP_PADDING,
           oaepHash: _hashNode(key.algorithm.hash, "decrypt"),
           oaepLabel: alg.label ? _toBuf(alg.label, "decrypt label") : void 0
-        }, buf));
+        }, buf);
+        try {
+          return _toArrayBuffer(oaepOut);
+        } finally {
+          guard.secret.zeroize(oaepOut, WebCryptoError, "webcrypto/operation", "the RSA-OAEP decryption output");
+        }
       }
       if (name === "AES-GCM") {
         var tagLen = (alg.tagLength || 128) / 8;
@@ -3762,31 +3773,57 @@ var require_webcrypto = __commonJS({
         var tag = buf.subarray(buf.length - tagLen);
         var gcmAad = alg.additionalData ? _toBuf(alg.additionalData, "AES-GCM aad") : null;
         return _toArrayBuffer(_runCipher(function() {
-          var d = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-gcm", _secretBytes(key), iv, { authTagLength: tagLen });
-          if (gcmAad) d.setAAD(gcmAad);
-          d.setAuthTag(tag);
-          return Buffer.concat([d.update(ct), d.final()]);
+          return _withSecretBytes(key, function(kb) {
+            var d = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-gcm", kb, iv, { authTagLength: tagLen });
+            if (gcmAad) d.setAAD(gcmAad);
+            d.setAuthTag(tag);
+            return Buffer.concat([d.update(ct), d.final()]);
+          });
         }, "decrypt"));
       }
       if (name === "AES-CBC") {
         var cbcIv2 = _toBuf(alg.iv, "AES-CBC iv");
         return _toArrayBuffer(_runCipher(function() {
-          var d2 = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-cbc", _secretBytes(key), cbcIv2);
-          return Buffer.concat([d2.update(buf), d2.final()]);
+          return _withSecretBytes(key, function(kb) {
+            var d2 = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-cbc", kb, cbcIv2);
+            return Buffer.concat([d2.update(buf), d2.final()]);
+          });
         }, "decrypt"));
       }
       if (name === "AES-CTR") {
         _requireCtrLength128(alg);
         var ctrCounter2 = _toBuf(alg.counter, "AES-CTR counter");
         return _toArrayBuffer(_runCipher(function() {
-          var d3 = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-ctr", _secretBytes(key), ctrCounter2);
-          return Buffer.concat([d3.update(buf), d3.final()]);
+          return _withSecretBytes(key, function(kb) {
+            var d3 = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-ctr", kb, ctrCounter2);
+            return Buffer.concat([d3.update(buf), d3.final()]);
+          });
         }, "decrypt"));
       }
       throw new WebCryptoError("webcrypto/not-supported", "decrypt: unsupported algorithm " + JSON.stringify(name));
     };
-    function _secretBytes(key) {
-      return key._handle.export();
+    function _withSecretBytes(key, fn) {
+      var kb = key._handle.export();
+      var deferred = false;
+      try {
+        var out = fn(kb);
+        if (out && typeof out.then === "function") {
+          deferred = true;
+          return out.then(function(v) {
+            _wipeExport(kb);
+            return v;
+          }, function(e) {
+            _wipeExport(kb);
+            throw e;
+          });
+        }
+        return out;
+      } finally {
+        if (!deferred) guard.secret.zeroize(kb, WebCryptoError, "webcrypto/operation", "the exported key material");
+      }
+    }
+    function _wipeExport(kb) {
+      guard.secret.zeroize(kb, WebCryptoError, "webcrypto/operation", "the exported key material");
     }
     function _requireCtrLength128(alg) {
       if (alg.length !== 128) {
@@ -3828,31 +3865,46 @@ var require_webcrypto = __commonJS({
         _requireAlgMatch(alg, alg.public, name + " public key");
         _requireOwnKey(alg.public, "deriveBits public key");
         var secret = nodeCrypto.diffieHellman({ privateKey: key._handle, publicKey: alg.public._handle });
-        if (length == null) return _toArrayBuffer(secret);
-        _requireDeriveLength(length, name);
-        if (length / 8 > secret.length) {
-          throw new WebCryptoError("webcrypto/operation", name + ": requested " + length + " bits but the shared secret has " + secret.length * 8);
+        try {
+          if (length == null) return _toArrayBuffer(secret);
+          _requireDeriveLength(length, name);
+          if (length / 8 > secret.length) {
+            throw new WebCryptoError("webcrypto/operation", name + ": requested " + length + " bits but the shared secret has " + secret.length * 8);
+          }
+          return _toArrayBuffer(secret.subarray(0, length / 8));
+        } finally {
+          guard.secret.zeroize(secret, WebCryptoError, "webcrypto/operation", "the raw key-agreement shared secret");
         }
-        return _toArrayBuffer(secret.subarray(0, length / 8));
       }
       if (name === "HKDF") {
         _requireDeriveLength(length, "HKDF");
-        var ikm = _secretBytes(key);
-        try {
+        return _withSecretBytes(key, function(ikm) {
           var derived = nodeCrypto.hkdfSync(_hashNode(alg.hash, "HKDF"), ikm, _toBuf(alg.salt, "HKDF salt"), _toBuf(alg.info || Buffer.alloc(0), "HKDF info"), length / 8);
           return derived instanceof ArrayBuffer ? derived : _toArrayBuffer(Buffer.from(derived));
-        } finally {
-          guard.secret.zeroize(ikm, WebCryptoError, "webcrypto/operation", "the HKDF input key material");
-        }
+        });
       }
       if (name === "PBKDF2") {
         _requireDeriveLength(length, "PBKDF2");
-        var out = await _pbkdf2Async(_secretBytes(key), _toBuf(alg.salt, "PBKDF2 salt"), alg.iterations, length / 8, _hashNode(alg.hash, "PBKDF2"));
-        return _toArrayBuffer(out);
+        return _withSecretBytes(key, function(pw) {
+          return _pbkdf2Async(pw, _toBuf(alg.salt, "PBKDF2 salt"), alg.iterations, length / 8, _hashNode(alg.hash, "PBKDF2")).then(function(out) {
+            try {
+              return _toArrayBuffer(out);
+            } finally {
+              guard.secret.zeroize(out, WebCryptoError, "webcrypto/operation", "the PBKDF2 output");
+            }
+          });
+        });
       }
       if (name === "X963KDF") {
         _requireDeriveLength(length, "X963KDF");
-        return _toArrayBuffer(_x963Kdf(_hashNode(alg.hash, "X963KDF"), _secretBytes(key), _toBuf(alg.info || Buffer.alloc(0), "X963KDF SharedInfo"), length / 8));
+        return _withSecretBytes(key, function(z) {
+          var derived = _x963Kdf(_hashNode(alg.hash, "X963KDF"), z, _toBuf(alg.info || Buffer.alloc(0), "X963KDF SharedInfo"), length / 8);
+          try {
+            return _toArrayBuffer(derived);
+          } finally {
+            guard.secret.zeroize(derived, WebCryptoError, "webcrypto/operation", "the X9.63 KDF output");
+          }
+        });
       }
       throw new WebCryptoError("webcrypto/not-supported", "deriveBits: unsupported algorithm " + JSON.stringify(name));
     }
@@ -3867,7 +3919,12 @@ var require_webcrypto = __commonJS({
         got += h.length;
         counter += 1;
       }
-      return Buffer.concat(blocks).subarray(0, lenBytes);
+      var joined = Buffer.concat(blocks);
+      var exact = Buffer.alloc(lenBytes);
+      joined.copy(exact, 0, 0, lenBytes);
+      guard.secret.zeroize(joined, WebCryptoError, "webcrypto/operation", "the KDF accumulator");
+      for (var bi = 0; bi < blocks.length; bi++) guard.secret.zeroize(blocks[bi], WebCryptoError, "webcrypto/operation", "a KDF block");
+      return exact;
     }
     SubtleCrypto.prototype.deriveBits = async function deriveBits(algorithm, key, length) {
       var alg = _normalizeAlg(algorithm, "deriveBits");
@@ -3894,7 +3951,11 @@ var require_webcrypto = __commonJS({
         bits = dk.length != null ? dk.length : null;
       }
       var raw = await _deriveBitsRaw(alg, baseKey, bits);
-      return this.importKey("raw", raw, dk, extractable, keyUsages);
+      try {
+        return await this.importKey("raw", raw, dk, extractable, keyUsages);
+      } finally {
+        guard.secret.zeroize(new Uint8Array(raw), WebCryptoError, "webcrypto/operation", "the derived key material");
+      }
     };
     SubtleCrypto.prototype.encapsulateBits = async function encapsulateBits(algorithm, encapsulationKey) {
       var alg = _normalizeAlg(algorithm, "encapsulateBits");
@@ -3943,27 +4004,29 @@ var require_webcrypto = __commonJS({
     SubtleCrypto.prototype.wrapKey = async function wrapKey(format, key, wrappingKey, wrapAlgorithm) {
       var exported = await this.exportKey(format, key);
       var bytes = format === "jwk" ? Buffer.from(JSON.stringify(exported)) : Buffer.from(exported);
-      var alg = _normalizeAlg(wrapAlgorithm, "wrapKey");
-      _requireUsage(wrappingKey, "wrapKey");
-      if (alg.name !== "AES-KW" && !ENCRYPT_DECRYPT_NAMES[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "wrapKey: unsupported algorithm " + JSON.stringify(alg.name));
-      _requireAlgMatch(alg, wrappingKey, "wrapKey");
-      if (alg.name === "AES-KW") {
-        if (bytes.length < 16 || bytes.length % 8 !== 0) {
-          throw new WebCryptoError("webcrypto/operation", "wrapKey: AES-KW requires the serialized key be a multiple of 8 bytes (>= 16); got " + bytes.length + " -- format " + JSON.stringify(format) + " is not AES-KW-wrappable");
-        }
-        var wkBytes = null;
-        try {
-          wkBytes = _secretBytes(wrappingKey);
-          var c = nodeCrypto.createCipheriv("aes" + wrappingKey.algorithm.length + "-wrap", wkBytes, Buffer.from("A6A6A6A6A6A6A6A6", "hex"));
-          return _toArrayBuffer(Buffer.concat([c.update(bytes), c.final()]));
-        } catch (e) {
-          throw new WebCryptoError("webcrypto/operation", "wrapKey: AES-KW key wrap failed", e);
-        } finally {
-          guard.secret.zeroize(wkBytes, WebCryptoError, "webcrypto/operation", "the AES-KW wrapping key");
+      try {
+        var alg = _normalizeAlg(wrapAlgorithm, "wrapKey");
+        _requireUsage(wrappingKey, "wrapKey");
+        if (alg.name !== "AES-KW" && !ENCRYPT_DECRYPT_NAMES[alg.name]) throw new WebCryptoError("webcrypto/not-supported", "wrapKey: unsupported algorithm " + JSON.stringify(alg.name));
+        _requireAlgMatch(alg, wrappingKey, "wrapKey");
+        if (alg.name === "AES-KW") {
+          if (bytes.length < 16 || bytes.length % 8 !== 0) {
+            throw new WebCryptoError("webcrypto/operation", "wrapKey: AES-KW requires the serialized key be a multiple of 8 bytes (>= 16); got " + bytes.length + " -- format " + JSON.stringify(format) + " is not AES-KW-wrappable");
+          }
+          try {
+            return _withSecretBytes(wrappingKey, function(wkBytes) {
+              var c = nodeCrypto.createCipheriv("aes" + wrappingKey.algorithm.length + "-wrap", wkBytes, Buffer.from("A6A6A6A6A6A6A6A6", "hex"));
+              return _toArrayBuffer(Buffer.concat([c.update(bytes), c.final()]));
+            });
+          } catch (e) {
+            throw new WebCryptoError("webcrypto/operation", "wrapKey: AES-KW key wrap failed", e);
+          }
         }
+        var wrapKeyClone = _cloneWithUsage(wrappingKey, "encrypt");
+        return await this.encrypt(wrapAlgorithm, wrapKeyClone, bytes);
+      } finally {
+        guard.secret.zeroize(bytes, WebCryptoError, "webcrypto/operation", "the exported key being wrapped");
       }
-      var wrapKeyClone = _cloneWithUsage(wrappingKey, "encrypt");
-      return this.encrypt(wrapAlgorithm, wrapKeyClone, bytes);
     };
     SubtleCrypto.prototype.unwrapKey = async function unwrapKey(format, wrappedKey, unwrappingKey, unwrapAlgorithm, unwrappedKeyAlgorithm, extractable, keyUsages) {
       var alg = _normalizeAlg(unwrapAlgorithm, "unwrapKey");
@@ -3976,15 +4039,13 @@ var require_webcrypto = __commonJS({
         if (wrapped.length < 24 || wrapped.length % 8 !== 0) {
           throw new WebCryptoError("webcrypto/operation", "unwrapKey: AES-KW wrapped key must be a multiple of 8 bytes (>= 24); got " + wrapped.length);
         }
-        var kwBytes = null;
         try {
-          kwBytes = _secretBytes(unwrappingKey);
-          var d = nodeCrypto.createDecipheriv("aes" + unwrappingKey.algorithm.length + "-wrap", kwBytes, Buffer.from("A6A6A6A6A6A6A6A6", "hex"));
-          bytes = Buffer.concat([d.update(wrapped), d.final()]);
+          bytes = _withSecretBytes(unwrappingKey, function(kwBytes) {
+            var d = nodeCrypto.createDecipheriv("aes" + unwrappingKey.algorithm.length + "-wrap", kwBytes, Buffer.from("A6A6A6A6A6A6A6A6", "hex"));
+            return Buffer.concat([d.update(wrapped), d.final()]);
+          });
         } catch (e) {
           throw new WebCryptoError("webcrypto/operation", "unwrapKey: AES-KW key unwrap failed (integrity or length)", e);
-        } finally {
-          guard.secret.zeroize(kwBytes, WebCryptoError, "webcrypto/operation", "the AES-KW unwrapping key");
         }
       } else {
         var unwrapKeyClone = _cloneWithUsage(unwrappingKey, "decrypt");
@@ -4199,13 +4260,10 @@ var require_webcrypto = __commonJS({
       if (!key.extractable) throw new WebCryptoError("webcrypto/invalid-access", "key is not extractable");
       if (format === "jwk") return key._handle.export({ format: "jwk" });
       if (key.type === "secret") {
-        var raw = key._handle.export();
-        try {
+        return _withSecretBytes(key, function(raw) {
           if (format === "raw") return _toArrayBuffer(raw);
           throw new WebCryptoError("webcrypto/not-supported", "exportKey: secret keys support 'raw' / 'jwk' only");
-        } finally {
-          guard.secret.zeroize(raw, WebCryptoError, "webcrypto/operation", "the exported secret key");
-        }
+        });
       }
       if (format === "spki") return _toArrayBuffer(key._handle.export({ format: "der", type: "spki" }));
       if (format === "pkcs8") return _toArrayBuffer(key._handle.export({ format: "der", type: "pkcs8" }));
@@ -16326,9 +16384,12 @@ var require_pbes2 = __commonJS({
       CONTENT_MODE[O(r[0])] = r[2];
     });
     function passwordBytes(p, E, prefix) {
-      if (Buffer.isBuffer(p)) return p;
-      if (p instanceof Uint8Array) return Buffer.from(p);
-      if (typeof p === "string") return Buffer.from(p, "utf8");
+      return passwordBytesOwned(p, E, prefix).bytes;
+    }
+    function passwordBytesOwned(p, E, prefix) {
+      if (Buffer.isBuffer(p)) return { bytes: p, owned: false };
+      if (p instanceof Uint8Array) return { bytes: Buffer.from(p), owned: true };
+      if (typeof p === "string") return { bytes: Buffer.from(p, "utf8"), owned: true };
       throw E(prefix + "/bad-input", "a password must be a string, Buffer, or Uint8Array");
     }
     function assertIterations(n, E, prefix) {
@@ -16410,7 +16471,11 @@ var require_pbes2 = __commonJS({
       var salt = opts.salt != null ? assertSalt(opts.salt, E, prefix) : nodeCrypto.randomBytes(16);
       var iv = opts.iv != null ? opts.iv : nodeCrypto.randomBytes(16);
       var key = nodeCrypto.pbkdf2Sync(pwBytes, salt, iterations, keyBits / 8, prfNode);
-      return { algId: pbes2AlgId(salt, iterations, prf, cipherName, iv), ct: cbcEncrypt(key, iv, plaintext, keyBits) };
+      try {
+        return { algId: pbes2AlgId(salt, iterations, prf, cipherName, iv), ct: cbcEncrypt(key, iv, plaintext, keyBits) };
+      } finally {
+        guard.secret.zeroize(key, E, prefix + "/bad-input", "the password-derived encryption key");
+      }
     }
     function pbes2Decrypt(pwBytes, params, ciphertext, opts, E, prefix) {
       var keyBits, iv, pb;
@@ -16437,6 +16502,8 @@ var require_pbes2 = __commonJS({
         return cbcDecrypt(dk, iv, ciphertext, keyBits);
       } catch (_e) {
         throw E(prefix + "/decrypt-failed", "decryption failed");
+      } finally {
+        guard.secret.zeroize(dk, E, prefix + "/bad-input", "the password-derived decryption key");
       }
     }
     function _hmacAlgId(name) {
@@ -16453,8 +16520,11 @@ var require_pbes2 = __commonJS({
       return subtle.importKey("raw", pwBytes, { name: "PBKDF2" }, false, ["deriveBits"]).then(function(baseKey) {
         return subtle.deriveBits({ name: "PBKDF2", salt, iterations: iterationCount, hash: prfHash }, baseKey, keyLength * 8);
       }).then(function(bits) {
-        return subtle.importKey("raw", Buffer.from(bits), { name: "HMAC", hash: macHash }, false, ["sign"]).then(function(hmacKey) {
+        var mk = Buffer.from(bits);
+        return subtle.importKey("raw", mk, { name: "HMAC", hash: macHash }, false, ["sign"]).then(function(hmacKey) {
           return subtle.sign({ name: "HMAC" }, hmacKey, message);
+        }).finally(function() {
+          guard.secret.zeroize(mk, webcrypto.WebCryptoError, "webcrypto/operation", "the PBMAC1 key");
         });
       }).then(function(sig) {
         return Buffer.from(sig);
@@ -16462,6 +16532,7 @@ var require_pbes2 = __commonJS({
     }
     module2.exports = {
       passwordBytes,
+      passwordBytesOwned,
       assertIterations,
       assertSalt,
       prfNodeByName,
@@ -21047,52 +21118,56 @@ var require_cms_encrypt = __commonJS({
       var keyAlg = cert.subjectPublicKeyInfo.algorithm;
       var wrapName = _wrapOidForKek(cek.length);
       var ukm = opts.ukm ? guard.bytes.view(opts.ukm, CmsError, "cms/bad-input", "ukm") : null;
-      var ecdhPub, origKeyAlgId, kek;
-      if (keyAlg.oid === O("ecPublicKey")) {
-        var curveOid = asn1.read.oid(asn1.decode(keyAlg.parameters));
-        var ka = EC_KA[curveOid];
-        if (!ka) throw _err("cms/unsupported-algorithm", "unsupported recipient EC curve for kari");
-        var recipPub = await subtle.importKey("spki", cert.subjectPublicKeyInfo.bytes, { name: "ECDH", namedCurve: ka.curve }, false, []);
-        var eph = await subtle.generateKey({ name: "ECDH", namedCurve: ka.curve }, true, ["deriveBits"]);
-        origKeyAlgId = { spki: Buffer.from(await subtle.exportKey("spki", eph.publicKey)), scheme: ka.scheme };
-        var z = Buffer.from(await subtle.deriveBits({ name: "ECDH", public: recipPub }, eph.privateKey, null));
-        var zKey = await subtle.importKey("raw", z, { name: "X963KDF" }, false, ["deriveBits"]);
-        var sharedInfo = _eccSharedInfo(wrapName, ukm, cek.length);
-        kek = Buffer.from(await subtle.deriveBits({ name: "X963KDF", hash: ka.hash, info: sharedInfo }, zKey, cek.length * 8));
-        void ecdhPub;
-      } else if (MONT_KA[keyAlg.oid]) {
-        var mka = MONT_KA[keyAlg.oid];
-        var rPub = await subtle.importKey("spki", cert.subjectPublicKeyInfo.bytes, { name: mka.name }, false, []);
-        var meph = await subtle.generateKey({ name: mka.name }, true, ["deriveBits"]);
-        origKeyAlgId = { spki: Buffer.from(await subtle.exportKey("spki", meph.publicKey)), scheme: mka.scheme };
-        var mz = Buffer.from(await subtle.deriveBits({ name: mka.name, public: rPub }, meph.privateKey, null));
-        if (mz.every(function(x) {
-          return x === 0;
-        })) throw _err("cms/bad-input", "the X25519/X448 shared secret is all-zero (low-order point)");
-        var mzKey = await subtle.importKey("raw", mz, { name: "HKDF" }, false, ["deriveBits"]);
-        kek = Buffer.from(await subtle.deriveBits({ name: "HKDF", hash: mka.hkdf, salt: ukm || Buffer.alloc(0), info: _eccSharedInfo(wrapName, ukm, cek.length) }, mzKey, cek.length * 8));
-      } else {
-        throw _err("cms/unsupported-algorithm", "unsupported recipient key algorithm for kari");
-      }
-      var encryptedKey = await _aesKwWrap(kek, cek);
-      var origSpki = asn1.decode(origKeyAlgId.spki);
-      var origPubBits = origSpki.children[1];
-      var originatorKey = b.contextConstructed(1, Buffer.concat([origSpki.children[0].bytes, origPubBits.bytes]));
-      var ridNode;
-      _assertKeyIdentifier(opts.keyIdentifier);
-      if (opts.keyIdentifier === "subjectKeyIdentifier") {
-        var ski = _skiOf(cert);
-        if (!ski) throw _err("cms/bad-input", 'keyIdentifier: "subjectKeyIdentifier" requires the recipient certificate to carry a subjectKeyIdentifier extension');
-        ridNode = b.contextConstructed(0, b.octetString(ski));
-      } else {
-        ridNode = b.sequence([b.raw(cert.issuer.bytes), b.integer(cert.serialNumber)]);
+      var ecdhPub, origKeyAlgId, kek, z, mz;
+      try {
+        if (keyAlg.oid === O("ecPublicKey")) {
+          var curveOid = asn1.read.oid(asn1.decode(keyAlg.parameters));
+          var ka = EC_KA[curveOid];
+          if (!ka) throw _err("cms/unsupported-algorithm", "unsupported recipient EC curve for kari");
+          var recipPub = await subtle.importKey("spki", cert.subjectPublicKeyInfo.bytes, { name: "ECDH", namedCurve: ka.curve }, false, []);
+          var eph = await subtle.generateKey({ name: "ECDH", namedCurve: ka.curve }, true, ["deriveBits"]);
+          origKeyAlgId = { spki: Buffer.from(await subtle.exportKey("spki", eph.publicKey)), scheme: ka.scheme };
+          z = Buffer.from(await subtle.deriveBits({ name: "ECDH", public: recipPub }, eph.privateKey, null));
+          var zKey = await subtle.importKey("raw", z, { name: "X963KDF" }, false, ["deriveBits"]);
+          var sharedInfo = _eccSharedInfo(wrapName, ukm, cek.length);
+          kek = Buffer.from(await subtle.deriveBits({ name: "X963KDF", hash: ka.hash, info: sharedInfo }, zKey, cek.length * 8));
+          void ecdhPub;
+        } else if (MONT_KA[keyAlg.oid]) {
+          var mka = MONT_KA[keyAlg.oid];
+          var rPub = await subtle.importKey("spki", cert.subjectPublicKeyInfo.bytes, { name: mka.name }, false, []);
+          var meph = await subtle.generateKey({ name: mka.name }, true, ["deriveBits"]);
+          origKeyAlgId = { spki: Buffer.from(await subtle.exportKey("spki", meph.publicKey)), scheme: mka.scheme };
+          mz = Buffer.from(await subtle.deriveBits({ name: mka.name, public: rPub }, meph.privateKey, null));
+          if (mz.every(function(x) {
+            return x === 0;
+          })) throw _err("cms/bad-input", "the X25519/X448 shared secret is all-zero (low-order point)");
+          var mzKey = await subtle.importKey("raw", mz, { name: "HKDF" }, false, ["deriveBits"]);
+          kek = Buffer.from(await subtle.deriveBits({ name: "HKDF", hash: mka.hkdf, salt: ukm || Buffer.alloc(0), info: _eccSharedInfo(wrapName, ukm, cek.length) }, mzKey, cek.length * 8));
+        } else {
+          throw _err("cms/unsupported-algorithm", "unsupported recipient key algorithm for kari");
+        }
+        var encryptedKey = await _aesKwWrap(kek, cek);
+        var origSpki = asn1.decode(origKeyAlgId.spki);
+        var origPubBits = origSpki.children[1];
+        var originatorKey = b.contextConstructed(1, Buffer.concat([origSpki.children[0].bytes, origPubBits.bytes]));
+        var ridNode;
+        _assertKeyIdentifier(opts.keyIdentifier);
+        if (opts.keyIdentifier === "subjectKeyIdentifier") {
+          var ski = _skiOf(cert);
+          if (!ski) throw _err("cms/bad-input", 'keyIdentifier: "subjectKeyIdentifier" requires the recipient certificate to carry a subjectKeyIdentifier extension');
+          ridNode = b.contextConstructed(0, b.octetString(ski));
+        } else {
+          ridNode = b.sequence([b.raw(cert.issuer.bytes), b.integer(cert.serialNumber)]);
+        }
+        var rek = b.sequence([b.sequence([ridNode, b.octetString(encryptedKey)])]);
+        var kekAlg = b.sequence([b.oid(O(origKeyAlgId.scheme)), _algId(wrapName, "absent")]);
+        var kariKids = [b.integer(3n), b.explicit(0, originatorKey)];
+        if (ukm) kariKids.push(b.explicit(1, b.octetString(ukm)));
+        kariKids.push(kekAlg, rek);
+        return { tag: 1, node: b.sequence(kariKids) };
+      } finally {
+        guard.secret.zeroizeAll([z, mz, kek], CmsError, "cms/bad-input", "the key-agreement shared secret");
       }
-      var rek = b.sequence([b.sequence([ridNode, b.octetString(encryptedKey)])]);
-      var kekAlg = b.sequence([b.oid(O(origKeyAlgId.scheme)), _algId(wrapName, "absent")]);
-      var kariKids = [b.integer(3n), b.explicit(0, originatorKey)];
-      if (ukm) kariKids.push(b.explicit(1, b.octetString(ukm)));
-      kariKids.push(kekAlg, rek);
-      return { tag: 1, node: b.sequence(kariKids) };
     }
     async function _buildKekri(cek, desc) {
       var kek = guard.bytes.view(desc.kek, CmsError, "cms/bad-input", "kek");
@@ -21103,19 +21178,26 @@ var require_cms_encrypt = __commonJS({
       return { tag: 2, node: b.sequence([b.integer(4n), kekid, _algId(wrapName, "absent"), b.octetString(encryptedKey)]) };
     }
     async function _buildPwri(cek, desc) {
-      var password = pbes2.passwordBytes(desc.password, _err, "cms");
       var iterations = pbes2.assertIterations(desc.iterations == null ? 6e5 : desc.iterations, _err, "cms");
       var salt = desc.salt ? pbes2.assertSalt(guard.bytes.view(desc.salt, CmsError, "cms/bad-input", "salt"), _err, "cms") : nodeCrypto.randomBytes(16);
       var prf = desc.prf || "hmacWithSHA256";
+      _prfHash(prf);
       var innerKeyBytes = 32;
+      var pwOwn = pbes2.passwordBytesOwned(desc.password, _err, "cms");
+      var password = pwOwn.bytes;
       var kekKey = await subtle.importKey("raw", password, { name: "PBKDF2" }, false, ["deriveBits"]);
       var kek = Buffer.from(await subtle.deriveBits({ name: "PBKDF2", hash: _prfHash(prf), salt, iterations }, kekKey, innerKeyBytes * 8));
-      var iv = nodeCrypto.randomBytes(16);
-      var encryptedKey = _pwriWrapIv(kek, cek, iv);
-      var kdfParams = pbes2.pbkdf2ParamsSeq(salt, iterations, prf);
-      var kdfAlg = b.contextConstructed(0, Buffer.concat([b.oid(O("pbkdf2")), kdfParams]));
-      var keyEncAlg = b.sequence([b.oid(O("id-alg-PWRI-KEK")), b.sequence([b.oid(O("aes256-CBC")), b.octetString(iv)])]);
-      return { tag: 3, node: b.sequence([b.integer(0n), kdfAlg, keyEncAlg, b.octetString(encryptedKey)]) };
+      if (pwOwn.owned) guard.secret.zeroize(password, CmsError, "cms/bad-input", "the password encoding");
+      try {
+        var iv = nodeCrypto.randomBytes(16);
+        var encryptedKey = _pwriWrapIv(kek, cek, iv);
+        var kdfParams = pbes2.pbkdf2ParamsSeq(salt, iterations, prf);
+        var kdfAlg = b.contextConstructed(0, Buffer.concat([b.oid(O("pbkdf2")), kdfParams]));
+        var keyEncAlg = b.sequence([b.oid(O("id-alg-PWRI-KEK")), b.sequence([b.oid(O("aes256-CBC")), b.octetString(iv)])]);
+        return { tag: 3, node: b.sequence([b.integer(0n), kdfAlg, keyEncAlg, b.octetString(encryptedKey)]) };
+      } finally {
+        guard.secret.zeroize(kek, CmsError, "cms/bad-input", "the password-derived key-encryption key");
+      }
     }
     var KEM_WRAP = {};
     KEM_WRAP[O("id-ml-kem-512")] = "aes128-wrap";
@@ -21175,17 +21257,23 @@ var require_cms_encrypt = __commonJS({
       var blk = 16;
       var padLen = body.length % blk === 0 ? 0 : blk - body.length % blk;
       if (body.length + padLen < 2 * blk) padLen += 2 * blk - (body.length + padLen);
-      return Buffer.concat([body, nodeCrypto.randomBytes(padLen)]);
+      var wrapped = Buffer.concat([body, nodeCrypto.randomBytes(padLen)]);
+      guard.secret.zeroizeAll([check, body], CmsError, "cms/bad-input", "a PWRI formatting intermediate");
+      return wrapped;
     }
     function _pwriWrapIv(kek, cek, iv) {
       var wk = _pwriFormat(cek);
-      var c1 = nodeCrypto.createCipheriv("aes-256-cbc", kek, iv);
-      c1.setAutoPadding(false);
-      var pass1 = Buffer.concat([c1.update(wk), c1.final()]);
-      var iv2 = pass1.subarray(pass1.length - 16);
-      var c2 = nodeCrypto.createCipheriv("aes-256-cbc", kek, iv2);
-      c2.setAutoPadding(false);
-      return Buffer.concat([c2.update(pass1), c2.final()]);
+      try {
+        var c1 = nodeCrypto.createCipheriv("aes-256-cbc", kek, iv);
+        c1.setAutoPadding(false);
+        var pass1 = Buffer.concat([c1.update(wk), c1.final()]);
+        var iv2 = pass1.subarray(pass1.length - 16);
+        var c2 = nodeCrypto.createCipheriv("aes-256-cbc", kek, iv2);
+        c2.setAutoPadding(false);
+        return Buffer.concat([c2.update(pass1), c2.final()]);
+      } finally {
+        guard.secret.zeroize(wk, CmsError, "cms/bad-input", "the PWRI plaintext block");
+      }
     }
     var PRF_HASH = { hmacWithSHA1: "SHA-1", hmacWithSHA256: "SHA-256", hmacWithSHA384: "SHA-384", hmacWithSHA512: "SHA-512" };
     function _prfHash(prf) {
@@ -21231,13 +21319,17 @@ var require_cms_encrypt = __commonJS({
       if (!ca) throw _err("cms/bad-input", "unsupported contentEncryptionAlgorithm " + JSON.stringify(algName));
       var contentType = opts.contentType || "data";
       var cek = nodeCrypto.randomBytes(ca.keyBits / 8);
-      if (!Array.isArray(recipients)) return _encryptedData(contentBytes, recipients, ca, contentType, opts, cek);
-      if (!recipients.length) throw _err("cms/bad-input", "at least one recipient is required (RFC 5652 sec. 6.1)");
-      var recips = [];
-      for (var i = 0; i < recipients.length; i++) recips.push(await _buildRecipient(cek, recipients[i], opts));
-      var riNodes = recips.map(_taggedRecipient);
-      if (ca.aead) return _emit(_authEnvelopedData(contentBytes, cek, ca, contentType, opts, riNodes, recips), "authEnvelopedData", opts);
-      return _emit(_envelopedData(contentBytes, cek, ca, contentType, riNodes, recips), "envelopedData", opts);
+      try {
+        if (!Array.isArray(recipients)) return _encryptedData(contentBytes, recipients, ca, contentType, opts, cek);
+        if (!recipients.length) throw _err("cms/bad-input", "at least one recipient is required (RFC 5652 sec. 6.1)");
+        var recips = [];
+        for (var i = 0; i < recipients.length; i++) recips.push(await _buildRecipient(cek, recipients[i], opts));
+        var riNodes = recips.map(_taggedRecipient);
+        if (ca.aead) return _emit(_authEnvelopedData(contentBytes, cek, ca, contentType, opts, riNodes, recips), "authEnvelopedData", opts);
+        return _emit(_envelopedData(contentBytes, cek, ca, contentType, riNodes, recips), "envelopedData", opts);
+      } finally {
+        guard.secret.zeroize(cek, CmsError, "cms/bad-input", "the content-encryption key");
+      }
     }
     function _emit(inner, ctName, opts) {
       var ci = b.sequence([b.oid(O(ctName)), b.explicit(0, inner)]);
@@ -21287,16 +21379,22 @@ var require_cms_encrypt = __commonJS({
       return _emit(inner, "encryptedData", opts);
     }
     function _encryptedDataPbes2(contentBytes, desc, ca, contentType, iv, opts) {
-      var password = pbes2.passwordBytes(desc.password, _err, "cms");
+      var pwOwn2 = pbes2.passwordBytesOwned(desc.password, _err, "cms");
+      var password = pwOwn2.bytes;
       var iterations = pbes2.assertIterations(desc.iterations == null ? 6e5 : desc.iterations, _err, "cms");
       var salt = desc.salt ? pbes2.assertSalt(guard.bytes.view(desc.salt, CmsError, "cms/bad-input", "salt"), _err, "cms") : nodeCrypto.randomBytes(16);
       var prf = desc.prf || "hmacWithSHA256";
       var key = nodeCrypto.pbkdf2Sync(password, salt, iterations, ca.keyBits / 8, pbes2.prfNodeByName(prf, _err, "cms"));
-      var enc = pbes2.cbcEncrypt(key, iv, contentBytes, ca.keyBits);
-      var contentAlg = pbes2.pbes2AlgId(salt, iterations, prf, ca.oid, iv);
-      var eci = b.sequence([b.oid(O(contentType)), contentAlg, b.contextPrimitive(0, enc)]);
-      var inner = b.sequence([b.integer(0n), eci]);
-      return _emit(inner, "encryptedData", { pem: opts && opts.pem != null ? opts.pem : desc.pem });
+      if (pwOwn2.owned) guard.secret.zeroize(password, CmsError, "cms/bad-input", "the password encoding");
+      try {
+        var enc = pbes2.cbcEncrypt(key, iv, contentBytes, ca.keyBits);
+        var contentAlg = pbes2.pbes2AlgId(salt, iterations, prf, ca.oid, iv);
+        var eci = b.sequence([b.oid(O(contentType)), contentAlg, b.contextPrimitive(0, enc)]);
+        var inner = b.sequence([b.integer(0n), eci]);
+        return _emit(inner, "encryptedData", { pem: opts && opts.pem != null ? opts.pem : desc.pem });
+      } finally {
+        guard.secret.zeroize(key, CmsError, "cms/bad-input", "the password-derived content-encryption key");
+      }
     }
     function _gcmEncrypt(key, nonce, plaintext, aad, keyBits, tagLen) {
       var c = nodeCrypto.createCipheriv("aes-" + keyBits + "-gcm", key, nonce, { authTagLength: tagLen });
@@ -21327,61 +21425,65 @@ var require_cms_encrypt = __commonJS({
       var withAttrs = opts.authenticatedAttributes !== false;
       if (contentType !== "data" && !withAttrs) throw _err("cms/bad-input", "AuthenticatedData with a non-data contentType requires authenticated attributes (RFC 5652 sec. 9.1)");
       var macKey = nodeCrypto.randomBytes(MAC_KEY_OCTETS);
-      var recips = [];
-      for (var i = 0; i < recipients.length; i++) recips.push(await _buildRecipient(macKey, recipients[i], opts));
-      var riNodes = recips.map(_taggedRecipient);
-      var digestName = opts.digestAlgorithm || mac.node;
-      var digestAlgTagged = null, authAttrsDer = null, preimage;
-      if (withAttrs) {
-        if (!SUPPORTED_DIGEST[digestName]) throw _err("cms/bad-input", "unsupported digestAlgorithm " + JSON.stringify(digestName) + " (sha256/384/512)");
-        var mdDigest = nodeCrypto.createHash(digestName).update(contentBytes).digest();
-        var pairs = [
-          b.sequence([b.oid(O("contentType")), b.setOf([b.oid(O(contentType))])]),
-          b.sequence([b.oid(O("messageDigest")), b.setOf([b.octetString(mdDigest)])])
-        ];
-        if (opts.authAttrs && opts.authAttrs.length) pairs = pairs.concat(opts.authAttrs);
-        var seenTypes = {};
-        pairs.forEach(function(p) {
-          var node;
-          try {
-            node = asn1.decode(p);
-          } catch (e) {
-            throw _err("cms/bad-input", "an authenticated attribute is not well-formed DER", e);
-          }
-          if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children || node.children.length !== 2 || node.children[1].tagClass !== "universal" || node.children[1].tagNumber !== asn1.TAGS.SET || !node.children[1].children || node.children[1].children.length < 1) {
-            throw _err("cms/bad-input", "an authenticated attribute must be an Attribute SEQUENCE { type, non-empty SET OF value } (RFC 5652)");
-          }
-          var t;
-          try {
-            t = asn1.read.oid(node.children[0]);
-          } catch (e) {
-            throw _err("cms/bad-input", "an authenticated attribute type is not an OBJECT IDENTIFIER", e);
-          }
-          if (seenTypes[t]) throw _err("cms/bad-input", "authenticated attributes must not repeat an attribute type (RFC 5652): " + t);
-          seenTypes[t] = 1;
-        });
-        var setOf = b.setOf(pairs);
-        preimage = setOf;
-        authAttrsDer = b.contextConstructed(2, setOf.subarray(_tlvHeaderLen(setOf)));
-        digestAlgTagged = b.contextConstructed(1, b.oid(O(digestName)));
-      } else {
-        preimage = contentBytes;
-      }
-      var hmacKey = await subtle.importKey("raw", macKey, { name: "HMAC", hash: mac.wc }, false, ["sign"]);
-      var macValue = Buffer.from(await subtle.sign({ name: "HMAC" }, hmacKey, preimage));
-      var eci = b.sequence([b.oid(O(contentType)), b.explicit(0, b.octetString(contentBytes))]);
-      var kids = [b.integer(0n), b.setOf(riNodes), _algId(mac.oid)];
-      if (digestAlgTagged) kids.push(digestAlgTagged);
-      kids.push(eci);
-      if (authAttrsDer) kids.push(authAttrsDer);
-      kids.push(b.octetString(macValue));
-      var ci = b.sequence([b.oid(O("authData")), b.explicit(0, b.sequence(kids))]);
       try {
-        schemaCms.parse(ci);
-      } catch (e) {
-        throw e instanceof CmsError ? e : _err("cms/bad-input", "the supplied authenticated attributes produced an invalid AuthenticatedData", e);
+        var recips = [];
+        for (var i = 0; i < recipients.length; i++) recips.push(await _buildRecipient(macKey, recipients[i], opts));
+        var riNodes = recips.map(_taggedRecipient);
+        var digestName = opts.digestAlgorithm || mac.node;
+        var digestAlgTagged = null, authAttrsDer = null, preimage;
+        if (withAttrs) {
+          if (!SUPPORTED_DIGEST[digestName]) throw _err("cms/bad-input", "unsupported digestAlgorithm " + JSON.stringify(digestName) + " (sha256/384/512)");
+          var mdDigest = nodeCrypto.createHash(digestName).update(contentBytes).digest();
+          var pairs = [
+            b.sequence([b.oid(O("contentType")), b.setOf([b.oid(O(contentType))])]),
+            b.sequence([b.oid(O("messageDigest")), b.setOf([b.octetString(mdDigest)])])
+          ];
+          if (opts.authAttrs && opts.authAttrs.length) pairs = pairs.concat(opts.authAttrs);
+          var seenTypes = {};
+          pairs.forEach(function(p) {
+            var node;
+            try {
+              node = asn1.decode(p);
+            } catch (e) {
+              throw _err("cms/bad-input", "an authenticated attribute is not well-formed DER", e);
+            }
+            if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children || node.children.length !== 2 || node.children[1].tagClass !== "universal" || node.children[1].tagNumber !== asn1.TAGS.SET || !node.children[1].children || node.children[1].children.length < 1) {
+              throw _err("cms/bad-input", "an authenticated attribute must be an Attribute SEQUENCE { type, non-empty SET OF value } (RFC 5652)");
+            }
+            var t;
+            try {
+              t = asn1.read.oid(node.children[0]);
+            } catch (e) {
+              throw _err("cms/bad-input", "an authenticated attribute type is not an OBJECT IDENTIFIER", e);
+            }
+            if (seenTypes[t]) throw _err("cms/bad-input", "authenticated attributes must not repeat an attribute type (RFC 5652): " + t);
+            seenTypes[t] = 1;
+          });
+          var setOf = b.setOf(pairs);
+          preimage = setOf;
+          authAttrsDer = b.contextConstructed(2, setOf.subarray(_tlvHeaderLen(setOf)));
+          digestAlgTagged = b.contextConstructed(1, b.oid(O(digestName)));
+        } else {
+          preimage = contentBytes;
+        }
+        var hmacKey = await subtle.importKey("raw", macKey, { name: "HMAC", hash: mac.wc }, false, ["sign"]);
+        var macValue = Buffer.from(await subtle.sign({ name: "HMAC" }, hmacKey, preimage));
+        var eci = b.sequence([b.oid(O(contentType)), b.explicit(0, b.octetString(contentBytes))]);
+        var kids = [b.integer(0n), b.setOf(riNodes), _algId(mac.oid)];
+        if (digestAlgTagged) kids.push(digestAlgTagged);
+        kids.push(eci);
+        if (authAttrsDer) kids.push(authAttrsDer);
+        kids.push(b.octetString(macValue));
+        var ci = b.sequence([b.oid(O("authData")), b.explicit(0, b.sequence(kids))]);
+        try {
+          schemaCms.parse(ci);
+        } catch (e) {
+          throw e instanceof CmsError ? e : _err("cms/bad-input", "the supplied authenticated attributes produced an invalid AuthenticatedData", e);
+        }
+        return opts.pem ? schemaCms.pemEncode(ci, "CMS") : ci;
+      } finally {
+        guard.secret.zeroize(macKey, CmsError, "cms/bad-input", "the message-authentication key");
       }
-      return opts.pem ? schemaCms.pemEncode(ci, "CMS") : ci;
     }
     module2.exports = { encrypt, authenticate };
   }
@@ -21439,16 +21541,20 @@ var require_cms_decrypt = __commonJS({
         try {
           _assertSupported(candidates[ci].ri, keyMaterial);
           var cek = await _acquireCek(candidates[ci].ri, keyMaterial, opts);
-          var content = await _openContent(parsed, eci, cek, ct);
-          return {
-            content,
-            contentType: eci.contentType,
-            contentTypeName: oid.name(eci.contentType) || eci.contentType,
-            recipientType: candidates[ci].ri.type,
-            recipientIndex: candidates[ci].index,
-            contentEncryptionAlgorithm: eci.contentEncryptionAlgorithm.name || eci.contentEncryptionAlgorithm.oid,
-            authenticated: ct === "authEnvelopedData"
-          };
+          try {
+            var content = await _openContent(parsed, eci, cek, ct);
+            return {
+              content,
+              contentType: eci.contentType,
+              contentTypeName: oid.name(eci.contentType) || eci.contentType,
+              recipientType: candidates[ci].ri.type,
+              recipientIndex: candidates[ci].index,
+              contentEncryptionAlgorithm: eci.contentEncryptionAlgorithm.name || eci.contentEncryptionAlgorithm.oid,
+              authenticated: ct === "authEnvelopedData"
+            };
+          } finally {
+            guard.secret.zeroize(cek, CmsError, "cms/bad-input", "the recovered content-encryption key");
+          }
         } catch (e) {
           if (candidates.length === 1) throw e;
         }
@@ -21590,31 +21696,35 @@ var require_cms_decrypt = __commonJS({
       var kekBytes = WRAP_KEK_LENGTHS[wrapAlg.oid];
       if (!kekBytes) throw _err("cms/unsupported-algorithm", "unsupported kari key-wrap");
       var ukm = ri.ukm || null;
-      var kek;
-      if (_isMont(origSpki)) {
-        var mont = _montName(origSpki);
-        var recipPriv = await subtle.importKey("pkcs8", keyDer, { name: mont.name }, false, ["deriveBits"]);
-        var origPub = await subtle.importKey("spki", origSpki, { name: mont.name }, false, []);
-        var mz = Buffer.from(await subtle.deriveBits({ name: mont.name, public: origPub }, recipPriv, null));
-        if (mz.every(function(x) {
-          return x === 0;
-        })) throw _fail();
-        var mzKey = await subtle.importKey("raw", mz, { name: "HKDF" }, false, ["deriveBits"]);
-        kek = Buffer.from(await subtle.deriveBits({ name: "HKDF", hash: mont.hkdf, salt: ukm || Buffer.alloc(0), info: _eccSharedInfo(wrapAlg.name, ukm, kekBytes) }, mzKey, kekBytes * 8));
-      } else {
-        var origAlg = asn1.decode(origSpki).children[0];
-        var origHasParams = origAlg.children.length > 1;
-        var curveOid = km.cert != null && _ecCurveFromCert(km.cert) || (origHasParams ? asn1.read.oid(origAlg.children[1]) : null);
-        var curve = curveOid ? CURVE[curveOid] : null;
-        if (!curve) throw _err("cms/unsupported-algorithm", "unsupported or missing originator EC curve");
-        var origSpkiFull = origHasParams ? origSpki : _withEcCurveParams(origSpki, curveOid);
-        var recipEc = await subtle.importKey("pkcs8", keyDer, { name: "ECDH", namedCurve: curve.curve }, false, ["deriveBits"]);
-        var origEc = await subtle.importKey("spki", origSpkiFull, { name: "ECDH", namedCurve: curve.curve }, false, []);
-        var z = Buffer.from(await subtle.deriveBits({ name: "ECDH", public: origEc }, recipEc, null));
-        var zKey = await subtle.importKey("raw", z, { name: "X963KDF" }, false, ["deriveBits"]);
-        kek = Buffer.from(await subtle.deriveBits({ name: "X963KDF", hash: _x963Hash(scheme), info: _eccSharedInfo(wrapAlg.name, ukm, kekBytes) }, zKey, kekBytes * 8));
-      }
-      return await _aesKwUnwrap(kek, rek.encryptedKey);
+      var kek, z, mz;
+      try {
+        if (_isMont(origSpki)) {
+          var mont = _montName(origSpki);
+          var recipPriv = await subtle.importKey("pkcs8", keyDer, { name: mont.name }, false, ["deriveBits"]);
+          var origPub = await subtle.importKey("spki", origSpki, { name: mont.name }, false, []);
+          mz = Buffer.from(await subtle.deriveBits({ name: mont.name, public: origPub }, recipPriv, null));
+          if (mz.every(function(x) {
+            return x === 0;
+          })) throw _fail();
+          var mzKey = await subtle.importKey("raw", mz, { name: "HKDF" }, false, ["deriveBits"]);
+          kek = Buffer.from(await subtle.deriveBits({ name: "HKDF", hash: mont.hkdf, salt: ukm || Buffer.alloc(0), info: _eccSharedInfo(wrapAlg.name, ukm, kekBytes) }, mzKey, kekBytes * 8));
+        } else {
+          var origAlg = asn1.decode(origSpki).children[0];
+          var origHasParams = origAlg.children.length > 1;
+          var curveOid = km.cert != null && _ecCurveFromCert(km.cert) || (origHasParams ? asn1.read.oid(origAlg.children[1]) : null);
+          var curve = curveOid ? CURVE[curveOid] : null;
+          if (!curve) throw _err("cms/unsupported-algorithm", "unsupported or missing originator EC curve");
+          var origSpkiFull = origHasParams ? origSpki : _withEcCurveParams(origSpki, curveOid);
+          var recipEc = await subtle.importKey("pkcs8", keyDer, { name: "ECDH", namedCurve: curve.curve }, false, ["deriveBits"]);
+          var origEc = await subtle.importKey("spki", origSpkiFull, { name: "ECDH", namedCurve: curve.curve }, false, []);
+          z = Buffer.from(await subtle.deriveBits({ name: "ECDH", public: origEc }, recipEc, null));
+          var zKey = await subtle.importKey("raw", z, { name: "X963KDF" }, false, ["deriveBits"]);
+          kek = Buffer.from(await subtle.deriveBits({ name: "X963KDF", hash: _x963Hash(scheme), info: _eccSharedInfo(wrapAlg.name, ukm, kekBytes) }, zKey, kekBytes * 8));
+        }
+        return await _aesKwUnwrap(kek, rek.encryptedKey);
+      } finally {
+        guard.secret.zeroizeAll([z, mz, kek], CmsError, "cms/bad-input", "the key-agreement shared secret");
+      }
     }
     async function _kekriCek(ri, km) {
       var kek = guard.bytes.view(km.kek, CmsError, "cms/bad-input", "kek");
@@ -21632,8 +21742,18 @@ var require_cms_decrypt = __commonJS({
       var innerBits = CONTENT_KEYBITS[innerOid];
       if (!innerBits || CONTENT_MODE[innerOid] !== "cbc") throw _err("cms/unsupported-algorithm", "unsupported pwri inner cipher");
       var iv = asn1.read.octetString(inner.children[1]);
-      var kek = nodeCrypto.pbkdf2Sync(pbes2.passwordBytes(km.password, _err, "cms"), pb.salt, pb.iterations, innerBits / 8, pb.prfNode);
-      return _pwriUnwrap(kek, ri.encryptedKey, iv, innerBits);
+      var pw = pbes2.passwordBytesOwned(km.password, _err, "cms");
+      var kek;
+      try {
+        kek = nodeCrypto.pbkdf2Sync(pw.bytes, pb.salt, pb.iterations, innerBits / 8, pb.prfNode);
+      } finally {
+        if (pw.owned) guard.secret.zeroize(pw.bytes, CmsError, "cms/bad-input", "the password encoding");
+      }
+      try {
+        return _pwriUnwrap(kek, ri.encryptedKey, iv, innerBits);
+      } finally {
+        guard.secret.zeroize(kek, CmsError, "cms/bad-input", "the password-derived key-encryption key");
+      }
     }
     async function _kemriCek(ri, km) {
       var k = ri.kemri;
@@ -21677,7 +21797,11 @@ var require_cms_decrypt = __commonJS({
       var keyBits = CONTENT_KEYBITS[alg.oid];
       if (!keyBits) throw _err("cms/unsupported-algorithm", "unsupported contentEncryptionAlgorithm " + alg.oid);
       if (eci.encryptedContent == null) throw _err("cms/no-encrypted-content", "the message has no encryptedContent (detached; supply it out of band)");
-      if (cek == null || cek.length !== keyBits / 8) cek = nodeCrypto.randomBytes(keyBits / 8);
+      var substitute = null;
+      if (cek == null || cek.length !== keyBits / 8) {
+        substitute = nodeCrypto.randomBytes(keyBits / 8);
+        cek = substitute;
+      }
       try {
         if (ct === "authEnvelopedData") {
           var aad = parsed.authAttrsBytes != null ? _explicitSetOf(parsed.authAttrsBytes) : Buffer.alloc(0);
@@ -21689,6 +21813,8 @@ var require_cms_decrypt = __commonJS({
       } catch (e) {
         if (e instanceof CmsError && e.code !== "cms/decrypt-failed") throw e;
         throw _fail();
+      } finally {
+        guard.secret.zeroize(substitute, CmsError, "cms/bad-input", "the implicit-rejection substitute content key");
       }
     }
     function _gcmOpen(cek, nonce, ct, tag, aad, keyBits, icvLen) {
@@ -21732,11 +21858,19 @@ var require_cms_decrypt = __commonJS({
       }
       var keyBits = CONTENT_KEYBITS[encOid];
       if (!keyBits) throw _err("cms/unsupported-algorithm", "unsupported PBES2 content cipher " + encOid);
-      var key = nodeCrypto.pbkdf2Sync(pbes2.passwordBytes(km.password, _err, "cms"), pb.salt, pb.iterations, keyBits / 8, pb.prfNode);
+      var pwE = pbes2.passwordBytesOwned(km.password, _err, "cms");
+      var key;
+      try {
+        key = nodeCrypto.pbkdf2Sync(pwE.bytes, pb.salt, pb.iterations, keyBits / 8, pb.prfNode);
+      } finally {
+        if (pwE.owned) guard.secret.zeroize(pwE.bytes, CmsError, "cms/bad-input", "the password encoding");
+      }
       try {
         return { content: pbes2.cbcDecrypt(key, iv, eci.encryptedContent, keyBits), contentType: eci.contentType, contentTypeName: oid.name(eci.contentType) || eci.contentType, recipientType: "password", recipientIndex: -1, contentEncryptionAlgorithm: oid.name(encOid) || encOid, authenticated: false };
       } catch (_e) {
         throw _fail();
+      } finally {
+        guard.secret.zeroize(key, CmsError, "cms/bad-input", "the password-derived content-encryption key");
       }
     }
     async function _aesKwUnwrap(kek, wrapped) {
@@ -21780,13 +21914,17 @@ var require_cms_decrypt = __commonJS({
       var d2 = nodeCrypto.createDecipheriv(alg, kek, iv);
       d2.setAutoPadding(false);
       var body = Buffer.concat([d2.update(pass1), d2.final()]);
-      var count = body[0];
-      if (count < 1 || count + 4 > body.length) throw _fail();
-      var cek = body.subarray(4, 4 + count);
-      var bad = 0;
-      for (var j = 0; j < 3; j++) bad |= body[1 + j] ^ 255 ^ cek[j];
-      if (bad !== 0) throw _fail();
-      return Buffer.from(cek);
+      try {
+        var count = body[0];
+        if (count < 1 || count + 4 > body.length) throw _fail();
+        var cek = body.subarray(4, 4 + count);
+        var bad = 0;
+        for (var j = 0; j < 3; j++) bad |= body[1 + j] ^ 255 ^ cek[j];
+        if (bad !== 0) throw _fail();
+        return Buffer.from(cek);
+      } finally {
+        guard.secret.zeroizeAll([body, pass1], CmsError, "cms/bad-input", "the PWRI plaintext block");
+      }
     }
     function _oaepHashFromParams(paramsBytes) {
       if (paramsBytes == null) return "SHA-1";
@@ -21914,23 +22052,28 @@ var require_cms_decrypt = __commonJS({
         try {
           _assertSupported(candidates[ci].ri, km);
           var macKey = await _acquireCek(candidates[ci].ri, km, opts);
-          if (macKey == null || macKey.length < MAC_KEY_MIN_OCTETS) macKey = nodeCrypto.randomBytes(MAC_KEY_MIN_OCTETS);
-          var key = await subtle.importKey("raw", macKey, { name: "HMAC", hash }, false, ["verify"]);
-          if (!await subtle.verify({ name: "HMAC" }, key, Buffer.from(parsed.mac), preimage)) throw _fail();
-          if (mdCheck) {
-            var actual = Buffer.from(await subtle.digest(mdCheck.hash, content));
-            if (!actual.equals(mdCheck.declared)) throw _fail();
+          var macSubstitute = null;
+          if (macKey == null || macKey.length < MAC_KEY_MIN_OCTETS) macSubstitute = nodeCrypto.randomBytes(MAC_KEY_MIN_OCTETS);
+          try {
+            var key = await subtle.importKey("raw", macSubstitute || macKey, { name: "HMAC", hash }, false, ["verify"]);
+            if (!await subtle.verify({ name: "HMAC" }, key, Buffer.from(parsed.mac), preimage)) throw _fail();
+            if (mdCheck) {
+              var actual = Buffer.from(await subtle.digest(mdCheck.hash, content));
+              if (!actual.equals(mdCheck.declared)) throw _fail();
+            }
+            return {
+              content: Buffer.from(content),
+              contentType: parsed.encapContentInfo.eContentType,
+              contentTypeName: oid.name(parsed.encapContentInfo.eContentType) || parsed.encapContentInfo.eContentType,
+              recipientType: candidates[ci].ri.type,
+              recipientIndex: candidates[ci].index,
+              macAlgorithm: macAlg.name || macAlg.oid,
+              digestAlgorithm: parsed.digestAlgorithm ? parsed.digestAlgorithm.name || parsed.digestAlgorithm.oid : null,
+              authenticated: true
+            };
+          } finally {
+            guard.secret.zeroizeAll([macKey, macSubstitute], CmsError, "cms/bad-input", "the message-authentication key");
           }
-          return {
-            content: Buffer.from(content),
-            contentType: parsed.encapContentInfo.eContentType,
-            contentTypeName: oid.name(parsed.encapContentInfo.eContentType) || parsed.encapContentInfo.eContentType,
-            recipientType: candidates[ci].ri.type,
-            recipientIndex: candidates[ci].index,
-            macAlgorithm: macAlg.name || macAlg.oid,
-            digestAlgorithm: parsed.digestAlgorithm ? parsed.digestAlgorithm.name || parsed.digestAlgorithm.oid : null,
-            authenticated: true
-          };
         } catch (e) {
           if (candidates.length === 1) throw e;
         }
@@ -25304,11 +25447,21 @@ var require_key = __commonJS({
       var iterations = pbes2.assertIterations(opts.iterations == null ? 6e5 : opts.iterations, _err, "key");
       var salt = opts.salt != null ? pbes2.assertSalt(guard.bytes.view(opts.salt, KeyError, "key/bad-input", "salt"), _err, "key") : nodeCrypto.randomBytes(16);
       var iv = nodeCrypto.randomBytes(16);
-      var dk = nodeCrypto.pbkdf2Sync(pbes2.passwordBytes(password, _err, "key"), salt, iterations, keyBits / 8, prfNode);
-      var ciphertext = pbes2.cbcEncrypt(dk, iv, der, keyBits);
-      var epki = b.sequence([pbes2.pbes2AlgId(salt, iterations, prf, cipherName, iv), b.octetString(ciphertext)]);
-      pkcs8.parseEncrypted(epki);
-      return opts.pem ? pkcs8.pemEncode(epki, "ENCRYPTED PRIVATE KEY") : epki;
+      var pwK = pbes2.passwordBytesOwned(password, _err, "key");
+      var dk;
+      try {
+        dk = nodeCrypto.pbkdf2Sync(pwK.bytes, salt, iterations, keyBits / 8, prfNode);
+      } finally {
+        if (pwK.owned) guard.secret.zeroize(pwK.bytes, KeyError, "key/bad-input", "the password encoding");
+      }
+      try {
+        var ciphertext = pbes2.cbcEncrypt(dk, iv, der, keyBits);
+        var epki = b.sequence([pbes2.pbes2AlgId(salt, iterations, prf, cipherName, iv), b.octetString(ciphertext)]);
+        pkcs8.parseEncrypted(epki);
+        return opts.pem ? pkcs8.pemEncode(epki, "ENCRYPTED PRIVATE KEY") : epki;
+      } finally {
+        guard.secret.zeroize(dk, KeyError, "key/bad-input", "the password-derived encryption key");
+      }
     }
     async function decrypt(encrypted, password, opts) {
       opts = opts || {};
@@ -25328,7 +25481,13 @@ var require_key = __commonJS({
       return opts.pem ? pkcs8.pemEncode(plaintext, "PRIVATE KEY") : plaintext;
     }
     function _decryptPbes2(encAlg, ciphertext, password, opts) {
-      var plaintext = pbes2.pbes2Decrypt(pbes2.passwordBytes(password, _err, "key"), encAlg.parameters, ciphertext, opts, _err, "key");
+      var pwD = pbes2.passwordBytesOwned(password, _err, "key");
+      var plaintext;
+      try {
+        plaintext = pbes2.pbes2Decrypt(pwD.bytes, encAlg.parameters, ciphertext, opts, _err, "key");
+      } finally {
+        if (pwD.owned) guard.secret.zeroize(pwD.bytes, KeyError, "key/bad-input", "the password encoding");
+      }
       try {
         pkcs8.parse(plaintext);
       } catch (_e) {
@@ -25860,7 +26019,11 @@ var require_pkcs12_build = __commonJS({
     var PRF_WC = { hmacWithSHA1: "SHA-1", hmacWithSHA256: "SHA-256", hmacWithSHA384: "SHA-384", hmacWithSHA512: "SHA-512" };
     var CIPHER_NAME = { "aes-128-cbc": "aes128-CBC", "aes-192-cbc": "aes192-CBC", "aes-256-cbc": "aes256-CBC" };
     var DIGEST_NAME = { sha1: "sha1", sha256: "sha256", sha384: "sha384", sha512: "sha512" };
-    function _p12Password(pw) {
+    function _p12PasswordOwned(pw) {
+      if (Buffer.isBuffer(pw)) return { bytes: pw, owned: false };
+      return { bytes: _p12Encode(pw), owned: true };
+    }
+    function _p12Encode(pw) {
       if (pw == null) pw = "";
       if (Buffer.isBuffer(pw)) return pw;
       if (pw instanceof Uint8Array) return Buffer.from(pw);
@@ -25891,16 +26054,31 @@ var require_pkcs12_build = __commonJS({
     function _p12Kdf(hashName, id, pwBytes, salt, iterations, nBytes) {
       var uv = P12_KDF_UV[hashName], u = uv.u, v = uv.v;
       var D = Buffer.alloc(v, id);
-      var I = Buffer.concat([_blockFill(salt, v), _blockFill(pwBytes, v)]);
+      var sFill = _blockFill(salt, v), pFill = _blockFill(pwBytes, v);
+      var I = Buffer.concat([sFill, pFill]);
+      guard.secret.zeroizeAll([sFill, pFill], Pkcs12Error, "pkcs12/bad-input", "a key-derivation fill");
       var c = Math.ceil(nBytes / u);
-      var out = Buffer.alloc(0);
+      var out = Buffer.alloc(c * u);
       for (var i = 0; i < c; i++) {
         var A = Buffer.concat([D, I]);
-        for (var r = 0; r < iterations; r++) A = nodeCrypto.createHash(hashName).update(A).digest();
-        out = Buffer.concat([out, A]);
-        if (i < c - 1) _kdfStepC(I, _blockFill(A, v), v);
+        for (var r = 0; r < iterations; r++) {
+          var prev = A;
+          A = nodeCrypto.createHash(hashName).update(A).digest();
+          guard.secret.zeroize(prev, Pkcs12Error, "pkcs12/bad-input", "a key-derivation intermediate");
+        }
+        A.copy(out, i * u);
+        if (i < c - 1) {
+          var B = _blockFill(A, v);
+          _kdfStepC(I, B, v);
+          guard.secret.zeroize(B, Pkcs12Error, "pkcs12/bad-input", "a key-derivation intermediate");
+        }
+        guard.secret.zeroize(A, Pkcs12Error, "pkcs12/bad-input", "a key-derivation block");
       }
-      return out.subarray(0, nBytes);
+      guard.secret.zeroize(I, Pkcs12Error, "pkcs12/bad-input", "the key-derivation input block");
+      var exact = Buffer.alloc(nBytes);
+      out.copy(exact, 0, 0, nBytes);
+      guard.secret.zeroize(out, Pkcs12Error, "pkcs12/bad-input", "the key-derivation accumulator");
+      return exact;
     }
     function _kdfStepC(I, B, v) {
       for (var j = 0; j < I.length; j += v) {
@@ -26067,10 +26245,16 @@ var require_pkcs12_build = __commonJS({
         var node = DIGEST_NAME[hash];
         if (!node || !P12_KDF_UV[node]) throw _err("pkcs12/unsupported-algorithm", "unsupported classic MAC hash " + JSON.stringify(hash) + " (sha1 / sha256 / sha384 / sha512)");
         var iter = _assertMacIter(macOpts.iterations == null ? DEFAULT_MAC_ITER : macOpts.iterations, CLASSIC_MAC_MAX_ITERATIONS);
-        var macKey = _p12Kdf(node, 3, _p12Password(password), salt, iter, P12_KDF_UV[node].u);
-        var digest = nodeCrypto.createHmac(node, macKey).update(authSafeDer).digest();
-        var digestInfo = b.sequence([b.sequence([b.oid(O(node)), b.nullValue()]), b.octetString(digest)]);
-        return b.sequence([digestInfo, b.octetString(salt), b.integer(BigInt(iter))]);
+        var macPw = _p12PasswordOwned(password);
+        var macKey = _p12Kdf(node, 3, macPw.bytes, salt, iter, P12_KDF_UV[node].u);
+        if (macPw.owned) guard.secret.zeroize(macPw.bytes, Pkcs12Error, "pkcs12/bad-input", "the password encoding");
+        try {
+          var digest = nodeCrypto.createHmac(node, macKey).update(authSafeDer).digest();
+          var digestInfo = b.sequence([b.sequence([b.oid(O(node)), b.nullValue()]), b.octetString(digest)]);
+          return b.sequence([digestInfo, b.octetString(salt), b.integer(BigInt(iter))]);
+        } finally {
+          guard.secret.zeroize(macKey, Pkcs12Error, "pkcs12/bad-input", "the password-derived MAC key");
+        }
       }
       if (algorithm === "pbmac1") {
         var prf = PBMAC1_PRF[hash];
@@ -26150,8 +26334,14 @@ var require_pkcs12_build = __commonJS({
         var node = (m.mac.hashName || "").toLowerCase();
         if (!P12_KDF_UV[node]) throw _err("pkcs12/unsupported-algorithm", "unsupported classic MAC hash " + m.mac.hashName);
         _capWork(m.mac.iterations, m.mac.macSalt, opts, void 0, CLASSIC_MAC_MAX_ITERATIONS);
-        var macKey = _p12Kdf(node, 3, _p12Password(password), m.mac.macSalt, m.mac.iterations, P12_KDF_UV[node].u);
-        computed = nodeCrypto.createHmac(node, macKey).update(m.macedBytes).digest();
+        var vMacPw = _p12PasswordOwned(password);
+        var macKey = _p12Kdf(node, 3, vMacPw.bytes, m.mac.macSalt, m.mac.iterations, P12_KDF_UV[node].u);
+        if (vMacPw.owned) guard.secret.zeroize(vMacPw.bytes, Pkcs12Error, "pkcs12/bad-input", "the password encoding");
+        try {
+          computed = nodeCrypto.createHmac(node, macKey).update(m.macedBytes).digest();
+        } finally {
+          guard.secret.zeroize(macKey, Pkcs12Error, "pkcs12/bad-input", "the password-derived MAC key");
+        }
       } else {
         var kdf = m.mac.pbmac1.kdf;
         var prfWc = PRF_WC[kdf.prfName];
@@ -26259,15 +26449,18 @@ var require_pkcs12_build = __commonJS({
       var u = P12_KDF_UV[scheme.hash].u;
       budget.rounds -= (Math.ceil(scheme.keyLen / u) + Math.ceil(scheme.ivLen / u)) * iterations;
       if (budget.rounds < 0) throw _err("pkcs12/iteration-limit", "the store's aggregate legacy PBE key-derivation work exceeds the budget (a hostile many-bag store)");
-      var p12pw = _p12Password(password);
-      var keyM = _p12Kdf(scheme.hash, 1, p12pw, salt, iterations, scheme.keyLen);
-      var iv = _p12Kdf(scheme.hash, 2, p12pw, salt, iterations, scheme.ivLen);
+      var p12pw = _p12PasswordOwned(password);
+      var keyM = _p12Kdf(scheme.hash, 1, p12pw.bytes, salt, iterations, scheme.keyLen);
+      var iv = _p12Kdf(scheme.hash, 2, p12pw.bytes, salt, iterations, scheme.ivLen);
+      if (p12pw.owned) guard.secret.zeroize(p12pw.bytes, Pkcs12Error, "pkcs12/bad-input", "the password encoding");
       try {
         if (scheme.rc2) return rc2.cbcDecrypt(keyM, scheme.rc2, iv, ct, _err, "pkcs12/decrypt-failed");
         var d = nodeCrypto.createDecipheriv(scheme.cipher, keyM, iv);
         return Buffer.concat([d.update(ct), d.final()]);
       } catch (_e) {
         throw _err("pkcs12/decrypt-failed", "decryption failed");
+      } finally {
+        guard.secret.zeroize(keyM, Pkcs12Error, "pkcs12/bad-input", "the password-derived decryption key");
       }
     }
     function _decryptBag(ea, ct, password, opts, budget) {
@@ -26780,13 +26973,25 @@ var require_hpke = __commonJS({
       if (len > 255 * Nh) throw _err("hpke/export-length", "requested length " + len + " exceeds 255*Nh");
       var out = [], t = Buffer.alloc(0), n = Math.ceil(len / Nh);
       for (var i = 1; i <= n; i++) {
-        t = nodeCrypto.createHmac(hash, prk).update(concat([t, info, Buffer.from([i])])).digest();
+        var fed = concat([t, info, Buffer.from([i])]);
+        t = nodeCrypto.createHmac(hash, prk).update(fed).digest();
+        guard.secret.zeroize(fed, HpkeError, "hpke/bad-input", "an expand feedback input");
         out.push(t);
       }
-      return concat(out).subarray(0, len);
+      var joined = concat(out);
+      var exact = Buffer.alloc(len);
+      joined.copy(exact, 0, 0, len);
+      guard.secret.zeroize(joined, HpkeError, "hpke/bad-input", "the KDF accumulator");
+      for (var oi = 0; oi < out.length; oi++) guard.secret.zeroize(out[oi], HpkeError, "hpke/bad-input", "a KDF block");
+      return exact;
     }
     function _labeledExtract(kdf, suiteId, salt, label, ikm) {
-      return _extract(kdf.hash, kdf.Nh, salt, concat([HPKE_V1, suiteId, L(label), ikm]));
+      var labeled = concat([HPKE_V1, suiteId, L(label), ikm]);
+      try {
+        return _extract(kdf.hash, kdf.Nh, salt, labeled);
+      } finally {
+        guard.secret.zeroize(labeled, HpkeError, "hpke/bad-input", "the labeled extract input");
+      }
     }
     function _labeledExpand(kdf, suiteId, prk, label, info, len) {
       return _expand(kdf.hash, kdf.Nh, prk, concat([i2osp(len, 2), HPKE_V1, suiteId, L(label), info]), len);
@@ -26850,7 +27055,11 @@ var require_hpke = __commonJS({
     function _extractAndExpand(kem, dh, kemContext) {
       var kdf = _kdf(kem.kdf), sid = _kemSuiteId(_kemId(kem));
       var eaePrk = _labeledExtract(kdf, sid, Buffer.alloc(0), "eae_prk", dh);
-      return _labeledExpand(kdf, sid, eaePrk, "shared_secret", kemContext, kem.Nsecret);
+      try {
+        return _labeledExpand(kdf, sid, eaePrk, "shared_secret", kemContext, kem.Nsecret);
+      } finally {
+        guard.secret.zeroize(eaePrk, HpkeError, "hpke/bad-input", "the KEM extract PRK");
+      }
     }
     function _kemId(kem) {
       for (var k in KEMS) if (KEMS[k] === kem) return Number(k);
@@ -26861,25 +27070,56 @@ var require_hpke = __commonJS({
       var kp = _generate(kem);
       return { skE: kp.privateKey, enc: _exportPublic(kem, kp.publicKey) };
     }
+    function _wipeDh(dh) {
+      guard.secret.zeroize(dh, HpkeError, "hpke/bad-input", "the KEM shared secret");
+    }
     function _encap(kem, pkR, pkRm, eph) {
       var e = _ephemeral(kem, eph);
-      var dh = _dh(e.skE, pkR);
-      return { sharedSecret: _extractAndExpand(kem, dh, concat([e.enc, pkRm])), enc: e.enc };
+      var dh = null;
+      try {
+        dh = _dh(e.skE, pkR);
+        return { sharedSecret: _extractAndExpand(kem, dh, concat([e.enc, pkRm])), enc: e.enc };
+      } finally {
+        _wipeDh(dh);
+      }
     }
     function _decap(kem, enc, skR, pkRm) {
       var pkE = _importPublic(kem, enc);
-      var dh = _dh(skR, pkE);
-      return _extractAndExpand(kem, dh, concat([enc, pkRm]));
+      var dh = null;
+      try {
+        dh = _dh(skR, pkE);
+        return _extractAndExpand(kem, dh, concat([enc, pkRm]));
+      } finally {
+        _wipeDh(dh);
+      }
     }
     function _authEncap(kem, pkR, pkRm, skS, pkSm, eph) {
       var e = _ephemeral(kem, eph);
-      var dh = concat([_dh(e.skE, pkR), _dh(skS, pkR)]);
-      return { sharedSecret: _extractAndExpand(kem, dh, concat([e.enc, pkRm, pkSm])), enc: e.enc };
+      var dh1 = null, dh2 = null, dh = null;
+      try {
+        dh1 = _dh(e.skE, pkR);
+        dh2 = _dh(skS, pkR);
+        dh = concat([dh1, dh2]);
+        return { sharedSecret: _extractAndExpand(kem, dh, concat([e.enc, pkRm, pkSm])), enc: e.enc };
+      } finally {
+        _wipeDh(dh1);
+        _wipeDh(dh2);
+        _wipeDh(dh);
+      }
     }
     function _authDecap(kem, enc, skR, pkRm, pkS, pkSm) {
       var pkE = _importPublic(kem, enc);
-      var dh = concat([_dh(skR, pkE), _dh(skR, pkS)]);
-      return _extractAndExpand(kem, dh, concat([enc, pkRm, pkSm]));
+      var dh1 = null, dh2 = null, dh = null;
+      try {
+        dh1 = _dh(skR, pkE);
+        dh2 = _dh(skR, pkS);
+        dh = concat([dh1, dh2]);
+        return _extractAndExpand(kem, dh, concat([enc, pkRm, pkSm]));
+      } finally {
+        _wipeDh(dh1);
+        _wipeDh(dh2);
+        _wipeDh(dh);
+      }
     }
     function _hpkeSuiteId(kemId, kdfId, aeadId) {
       return concat([L("HPKE"), i2osp(kemId, 2), i2osp(kdfId, 2), i2osp(aeadId, 2)]);
@@ -26897,13 +27137,17 @@ var require_hpke = __commonJS({
       var infoHash = _labeledExtract(kdf, sid, Buffer.alloc(0), "info_hash", info);
       var ksc = concat([Buffer.from([mode]), pskIdHash, infoHash]);
       var secret = _labeledExtract(kdf, sid, sharedSecret, "secret", psk);
-      var exporterSecret = _labeledExpand(kdf, sid, secret, "exp", ksc, kdf.Nh);
-      var key = null, baseNonce = null;
-      if (!aead.exportOnly) {
-        key = _labeledExpand(kdf, sid, secret, "key", ksc, aead.Nk);
-        baseNonce = _labeledExpand(kdf, sid, secret, "base_nonce", ksc, aead.Nn);
+      try {
+        var exporterSecret = _labeledExpand(kdf, sid, secret, "exp", ksc, kdf.Nh);
+        var key = null, baseNonce = null;
+        if (!aead.exportOnly) {
+          key = _labeledExpand(kdf, sid, secret, "key", ksc, aead.Nk);
+          baseNonce = _labeledExpand(kdf, sid, secret, "base_nonce", ksc, aead.Nn);
+        }
+        return new Context(suite, key, baseNonce, exporterSecret, role);
+      } finally {
+        guard.secret.zeroize(secret, HpkeError, "hpke/bad-input", "the key-schedule PRK");
       }
-      return new Context(suite, key, baseNonce, exporterSecret, role);
     }
     function Context(suite, key, baseNonce, exporterSecret, role) {
       this._suite = suite;
@@ -26913,6 +27157,9 @@ var require_hpke = __commonJS({
       this._seq = 0n;
       this._role = role;
     }
+    Context.prototype._dispose = function() {
+      guard.secret.zeroizeAll([this._key, this._baseNonce, this._exporterSecret], HpkeError, "hpke/bad-input", "the HPKE context key material");
+    };
     Context.prototype._nonce = function() {
       var aead = this._suite.aead;
       var seqBytes = i2osp(this._seq, aead.Nn);
@@ -27031,14 +27278,31 @@ var require_hpke = __commonJS({
       } else {
         ss = _decap(kem, _buf(enc), r.key, r.pkm);
       }
-      return _keySchedule(suite, mode, ss, _buf(opts.info), _buf(opts.psk), _buf(opts.pskId), "R");
+      try {
+        return _keySchedule(suite, mode, ss, _buf(opts.info), _buf(opts.psk), _buf(opts.pskId), "R");
+      } finally {
+        guard.secret.zeroize(ss, HpkeError, "hpke/bad-input", "the KEM shared secret");
+      }
     }
     function seal(ids, pkR, opts, aad, pt) {
-      var s = _setupS(ids, pkR, opts);
-      return { enc: s.enc, ct: s.context.seal(_buf(aad), _buf(pt)) };
+      var s = null;
+      try {
+        s = _setupS(ids, pkR, opts);
+        return { enc: s.enc, ct: s.context.seal(_buf(aad), _buf(pt)) };
+      } finally {
+        if (s) {
+          s.context._dispose();
+          guard.secret.zeroize(s.sharedSecret, HpkeError, "hpke/bad-input", "the KEM shared secret");
+        }
+      }
     }
     function open(ids, enc, skR, opts, aad, ct) {
-      return _setupR(ids, enc, skR, opts).open(_buf(aad), _buf(ct));
+      var ctx = _setupR(ids, enc, skR, opts);
+      try {
+        return ctx.open(_buf(aad), _buf(ct));
+      } finally {
+        ctx._dispose();
+      }
     }
     module2.exports = {
       suites,