@blamejs/core 0.15.12 → 0.15.14

package/lib/cose.js

@@ -55,6 +55,7 @@
 var nodeCrypto = require("node:crypto");
 var cbor = require("./cbor");
 var bCrypto = require("./crypto");
+var safeBuffer = require("./safe-buffer");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -109,11 +110,30 @@ function _algParamsFor(algId) {
   }
 }
 
+// RFC 9053 §2 binds each ECDSA alg to ONE curve. node:crypto will happily
+// verify a sha512 (ES512-shape) signature against a P-256 key as
+// self-consistent, so without this check a COSE_Sign1 declaring ES512 but
+// carrying a P-256 key passes when ES512 is allowlisted — an alg/curve
+// confusion (the COSE sibling of jwt-external._assertAlgKtyMatch). EdDSA /
+// ML-DSA carry their parameters in the KeyObject and need no binding.
+var _ES_ALG_CURVE = { ES256: "prime256v1", ES384: "secp384r1", ES512: "secp521r1" };
+function _assertEcAlgCurve(algName, key) {
+  var want = _ES_ALG_CURVE[algName];
+  if (want === undefined) return;                                                       // not an ECDSA alg — nothing to bind
+  var got = (key && key.asymmetricKeyDetails && key.asymmetricKeyDetails.namedCurve) || null;
+  if (key.asymmetricKeyType !== "ec" || got !== want) {
+    throw new CoseError("cose/alg-curve-mismatch",
+      "cose: alg '" + algName + "' requires an EC key on " + want +
+      ", got " + (key.asymmetricKeyType === "ec" ? got : key.asymmetricKeyType));
+  }
+}
+
 function _bstr(x) {
-  if (Buffer.isBuffer(x)) return x;
-  if (x instanceof Uint8Array) return Buffer.from(x);
-  if (typeof x === "string") return Buffer.from(x, "utf8");
-  throw new CoseError("cose/bad-bytes", "cose: expected bytes (Buffer / Uint8Array / string)");
+  return safeBuffer.toBuffer(x, {
+    errorFactory: function (code, msg) { return new CoseError(code, msg); },
+    typeCode:    "cose/bad-bytes",
+    typeMessage: "cose: expected bytes (Buffer / Uint8Array / string)",
+  });
 }
 
 // Sig_structure (RFC 9052 §4.4) for COSE_Sign1:
@@ -167,6 +187,7 @@ async function sign(payload, opts) {
   var algId = ALG_NAME_TO_ID[opts.alg];
   var params = _algParamsFor(algId);
   var key = _toKeyObject(opts.privateKey, "private");
+  _assertEcAlgCurve(opts.alg, key);                                                      // RFC 9053 alg↔curve binding — refuse e.g. ES512 over a P-256 key
 
   var protMap = new Map();
   protMap.set(HDR_ALG, algId);
@@ -350,6 +371,7 @@ async function verify(coseSign1, opts) {
   var key = opts.publicKey
     ? _toKeyObject(opts.publicKey, "public")
     : _toKeyObject(opts.keyResolver(protMap, unprotected), "public");
+  _assertEcAlgCurve(algName, key);                                                      // RFC 9053 alg↔curve binding
 
   var externalAad = opts.externalAad == null ? Buffer.alloc(0) : _bstr(opts.externalAad);
   var toBeSigned = _toBeSigned(protectedBstr, externalAad, payload);
@@ -753,11 +775,14 @@ var COSE_KEY_LABEL_KTY = 1;
 var COSE_KEY_LABEL_KID = 2;
 var COSE_KEY_LABEL_ALG = 3;
 
-function _coseKeyBytes(v, what) {
-  if (Buffer.isBuffer(v)) return v;
-  if (v instanceof Uint8Array) return Buffer.from(v);
-  throw new CoseError("cose/bad-cose-key", "cose.importKey: COSE_Key " + what + " must be a byte string");
-}
+// COSE_Key components are byte strings, never text (allowString:false).
+var _coseKeyBytes = safeBuffer.makeByteCoercer({
+  errorClass:    CoseError,
+  typeCode:      "cose/bad-cose-key",
+  messagePrefix: "cose.importKey: COSE_Key ",
+  messageSuffix: " must be a byte string",
+  allowString:   false,
+});
 
 /**
  * @primitive b.cose.importKey
@@ -806,8 +831,11 @@ function importKey(coseKey) {
   } else {
     throw new CoseError("cose/unsupported-key", "cose.importKey: kty must be OKP (1) or EC2 (2), got " + kty);
   }
-  try { return nodeCrypto.createPublicKey({ key: jwk, format: "jwk" }); }
-  catch (e) { throw new CoseError("cose/bad-cose-key", "cose.importKey: could not import COSE_Key: " + ((e && e.message) || e)); }
+  return bCrypto.importPublicJwk(jwk, {
+    errorClass:    CoseError,
+    code:          "cose/bad-cose-key",
+    messagePrefix: "cose.importKey: could not import COSE_Key: ",
+  });
 }
 
 /**

package/lib/cra-report.js

@@ -70,7 +70,6 @@ function create(opts) {
   var enisaEndpoint = typeof opts.enisaEndpoint === "string" && opts.enisaEndpoint.length > 0
     ? opts.enisaEndpoint : null;
   var httpClient = opts.httpClient || null;
-  var auditOn = opts.audit !== false;
 
   // CRA Article 14 deadlines — operators don't override these without
   // documented regulatory justification (the deadlines are statutory,
@@ -89,16 +88,7 @@ function create(opts) {
     },
   });
 
-  function _emitAudit(action, outcome, metadata) {
-    if (!auditOn) return;
-    try {
-      audit().safeEmit({
-        action:   "cra.report." + action,
-        outcome:  outcome,
-        metadata: metadata || {},
-      });
-    } catch (_e) { /* drop-silent */ }
-  }
+  var _emitAudit = audit().namespaced("cra.report", opts.audit);
 
   async function _submitToEnisa(payload) {
     if (!enisaEndpoint || !httpClient) {

package/lib/crdt.js

@@ -41,6 +41,7 @@
 
 var bCrypto = require("./crypto");
 var safeJson = require("./safe-json");
+var numericBounds = require("./numeric-bounds");
 var { defineClass } = require("./framework-error");
 
 var CrdtError = defineClass("CrdtError", { alwaysPermanent: true });
@@ -52,7 +53,7 @@ function _replicaId(opts) {
   return id;
 }
 function _posInt(n, label) {
-  if (typeof n !== "number" || !isFinite(n) || n < 0 || Math.floor(n) !== n) throw new CrdtError("crdt/bad-value", "crdt: " + label + " must be a non-negative integer");
+  if (!numericBounds.isNonNegativeFiniteInt(n)) throw new CrdtError("crdt/bad-value", "crdt: " + label + " must be a non-negative integer");
   return n;
 }
 function _maxMerge(a, b) {

package/lib/crypto-field.js

@@ -56,12 +56,12 @@
  *   Per-column field-level encryption with AAD-bound envelopes.
  */
 var lazyRequire = require("./lazy-require");
+var boundedMap = require("./bounded-map");
 var vault = require("./vault");
 var vaultAad = require("./vault-aad");
 var validateOpts = require("./validate-opts");
 var numericBounds = require("./numeric-bounds");
 var safeJson = require("./safe-json");
-var frameworkSchema = require("./framework-schema");
 var sql = require("./sql");
 var { defineClass } = require("./framework-error");
 var { sha3Hash, kdf, generateBytes, encryptPacked, decryptPacked, generateToken } = require("./crypto");
@@ -225,14 +225,19 @@ var PER_ROW_KEYS_TABLE = "_blamejs_per_row_keys";   // allow:hand-rolled-sql
 var PER_ROW_KEYS_COLUMN = "wrappedKey";
 var PER_ROW_KEYS_SCHEMA_VERSION = "1";
 
-// The per-row-key registry is read/written against the LOCAL db() / dbHandle
-// handle directly (not clusterStorage), so SQL composed for it uses the
-// RESOLVED name (prefix-aware via frameworkSchema.tableName) and quoteName so
-// b.sql emits the quoted identifier the single-node path expects — the same
-// shape db-query.js's _sqlOpts and db.js's own local-handle b.sql calls use.
+// The per-row-key registry ALWAYS lives in the LOCAL sqlite — reconcile creates
+// it under its RAW schema name, and per-row keys are never dispatched to an
+// external backend (see _kRowOnce's db() fallback). It is read/written against
+// the local db() / dbHandle directly, NOT through clusterStorage, so it must use
+// the RAW table name. frameworkSchema.tableName() resolves to the cluster-mode
+// EXTERNAL prefixed name (the prefix applies only to the external backend, via
+// resolveTables — local DDL stays raw); under a custom tablePrefix that names a
+// table that does not exist locally, which SILENTLY breaks crypto-shred:
+// destroyPerRowKey deletes 0 rows and sealed cells stay decryptable after
+// eraseHard. quoteName so b.sql emits the quoted identifier the local path expects.
 var _PER_ROW_SQL_OPTS = { dialect: "sqlite", quoteName: true };
 function _perRowKeysTableName() {
-  return frameworkSchema.tableName(PER_ROW_KEYS_TABLE);
+  return PER_ROW_KEYS_TABLE;
 }
 
 // Build the canonical AAD parts for a row-secret wrap in
@@ -568,14 +573,9 @@ function computeNamespacedHash(ns, value, opts) {
       "(default) or 'hmac-shake256', got " + JSON.stringify(mode));
   }
   var truncateBytes = opts.truncateBytes;
-  if (truncateBytes !== undefined) {
-    if (typeof truncateBytes !== "number" || !isFinite(truncateBytes) ||
-        truncateBytes <= 0 || Math.floor(truncateBytes) !== truncateBytes) {
-      throw new CryptoFieldError("crypto-field/bad-truncate-bytes",
-        "computeNamespacedHash: opts.truncateBytes must be a " +
-        "positive integer (bytes), got " + JSON.stringify(truncateBytes));
-    }
-  }
+  numericBounds.requirePositiveFiniteIntIfPresent(truncateBytes,
+    "computeNamespacedHash: opts.truncateBytes", CryptoFieldError,
+    "crypto-field/bad-truncate-bytes");
   var hex = _computeDerivedHash({ mode: mode }, mode, ns, String(value));
   if (truncateBytes !== undefined) {
     return hex.slice(0, truncateBytes * 2);
@@ -918,8 +918,7 @@ function _rateNoteFailure(actor, table, column) {
   if (!_rateCap) return false;
   var nowMs = _rateCap.now();
   var key = _rateKey(actor, table, column);
-  var arr = _rateFailWindows.get(key);
-  if (!arr) { arr = []; _rateFailWindows.set(key, arr); }
+  var arr = boundedMap.getOrInsert(_rateFailWindows, key, function () { return []; });
   // Prune entries older than the window (sliding-window via timestamp
   // array — same shape as b.mail.server.rateLimit._pruneWindow).
   var cutoff = nowMs - _rateCap.windowMs;
@@ -1276,19 +1275,19 @@ function unsealRow(table, row, actor, dbHandle) {
           unsealed = out[field];
         }
       } catch (e) {
-        // A DB-write attacker who can write `vault:<crafted>` /
-        // `vault.aad:<crafted>` payloads to sealed columns can force
-        // KEM decapsulation / AEAD verify on attacker-controlled
-        // bytes via this read path. Surface the failure as a chain
-        // row so operators alert on burst patterns; null the field
-        // so downstream code sees "no value" instead of crashing the
-        // request. AAD-shape failures additionally indicate cross-
-        // row copy attempts — the audit metadata flags the shape so
-        // operators can write alert rules.
+        // A crypto-shredded (or never-materialized) per-row key is an EXPECTED
+        // absence, not a decryption-oracle attack: the wrapped secret is gone,
+        // so there is no oracle to brute-force. Reading such a row must read as
+        // "no value" WITHOUT counting against the rate cap — otherwise a bulk
+        // read over a table with many erased rows (GDPR eraseHard) trips the
+        // cap and DoS's the live rows (self-DoS, CWE-307 mis-applied). It is
+        // audited under a distinct, non-failure action so operators don't alert
+        // on routine post-erasure reads as forged-ciphertext bursts.
+        var _shredded = e && e.code === "crypto-field/row-key-unavailable";
         try {
           audit().safeEmit({
-            action:   "system.crypto.unseal_failed",
-            outcome:  "failure",
+            action:   _shredded ? "system.crypto.shredded_read" : "system.crypto.unseal_failed",
+            outcome:  _shredded ? "success" : "failure",
             metadata: {
               table:   table,
               field:   field,
@@ -1298,11 +1297,13 @@ function unsealRow(table, row, actor, dbHandle) {
             },
           });
         } catch (_e) { /* drop-silent */ }
-        // Default-on rate cap: account this failure against the (actor,
-        // table, column) tuple. When it trips the threshold, arm the
-        // cooldown + emit the distinct rate-exceeded audit once on the
-        // transition. No-op when the cap is disabled.
-        if (_rateNoteFailure(capActor, table, field)) {
+        // Default-on rate cap: account a genuine decryption / AEAD-verify /
+        // AAD-downgrade failure (a possible forged-ciphertext attack) against
+        // the (actor, table, column) tuple. A shredded-key read is exempt (see
+        // above). When the cap trips the threshold, arm the cooldown + emit the
+        // distinct rate-exceeded audit once on the transition. No-op when the
+        // cap is disabled.
+        if (!_shredded && _rateNoteFailure(capActor, table, field)) {
           _emitRateAudit({
             table: table, field: field, actor: capActor, shape: shape,
             threshold: _rateCap.threshold, windowMs: _rateCap.windowMs, cooldownMs: _rateCap.cooldownMs,

package/lib/crypto.js

@@ -49,6 +49,7 @@ var nodeFs = require("node:fs");
 var { pipeline } = require("node:stream/promises");
 var { xchacha20poly1305 } = require("./vendor/noble-ciphers.cjs");
 var C = require("./constants");
+var numericBounds = require("./numeric-bounds");
 // Circular: audit imports b.crypto for sha3Hash + envelope sign. Lazy-
 // load the audit module so the legacy-envelope decrypt path can emit
 // `system.crypto.decrypt.allow_legacy` events without an inline
@@ -337,8 +338,7 @@ function hashFilesParallel(filePaths, opts) {
   // override per-call.
   var maxBytesPerFile = opts.maxBytesPerFile !== undefined
     ? opts.maxBytesPerFile : C.BYTES.gib(1);
-  if (typeof maxBytesPerFile !== "number" || !isFinite(maxBytesPerFile) ||
-      maxBytesPerFile <= 0 || Math.floor(maxBytesPerFile) !== maxBytesPerFile) {
+  if (!numericBounds.isPositiveFiniteInt(maxBytesPerFile)) {
     return Promise.reject(new TypeError(
       "crypto.hashFilesParallel: opts.maxBytesPerFile must be a positive integer, got " + maxBytesPerFile
     ));
@@ -847,6 +847,74 @@ function fromBase64Url(s, opts) {
   return Buffer.from(s, "base64url");
 }
 
+/**
+ * @primitive b.crypto.makeBase64UrlDecoder
+ * @signature b.crypto.makeBase64UrlDecoder(opts)
+ * @since     0.15.13
+ * @status    stable
+ * @related   b.crypto.fromBase64Url, b.crypto.toBase64Url
+ *
+ * Bind the strict `fromBase64Url` decoder to one module's error contract,
+ * returning a `decode(s)` that translates the decoder's `TypeError` (bad
+ * type or non-canonical input) into the caller's typed error. Every
+ * base64url-carrying surface — JWT segments, DPoP / OAuth tokens, status
+ * lists, pagination cursors — wrapped `fromBase64Url` in the same
+ * `if (typeof s !== "string") throw new XError(...); try { return
+ * fromBase64Url(s); } catch { throw new XError(...); }` shape, differing
+ * only in error class, code, and the two messages; this owns that binding.
+ *
+ * `opts.badMessage` is thrown on any decode failure (non-canonical /
+ * malformed input — the strict decoder rejects the CWE-347 signature-
+ * canonicalization footgun). `opts.typeMessage` is optional: when set, a
+ * non-string input throws it directly (the common case names the field —
+ * "cursor must be a string"); when omitted, a non-string falls through to
+ * `badMessage` like any other decode failure.
+ *
+ * @opts
+ *   errorClass:  Function,  // required — (code, message) error constructor
+ *   code:        string,    // required — error code for both throws
+ *   badMessage:  string,    // required — message on a decode failure
+ *   typeMessage: string,    // optional — message on a non-string input
+ *
+ * @example
+ *   var b = require("blamejs");
+ *
+ *   function JwtError(code, message) { this.code = code; this.message = message; }
+ *   var decodeSeg = b.crypto.makeBase64UrlDecoder({
+ *     errorClass:  JwtError,
+ *     code:        "jwt/malformed",
+ *     typeMessage: "expected base64url string",
+ *     badMessage:  "JWT segment is not valid base64url",
+ *   });
+ *   decodeSeg("aGVsbG8");   // → <Buffer 68 65 6c 6c 6f>
+ *   // decodeSeg("!!!") throws JwtError("jwt/malformed", "JWT segment is not valid base64url")
+ */
+function makeBase64UrlDecoder(opts) {
+  if (!opts || typeof opts !== "object") {
+    throw new TypeError("crypto.makeBase64UrlDecoder: opts is required");
+  }
+  if (typeof opts.errorClass !== "function") {
+    throw new TypeError("crypto.makeBase64UrlDecoder: opts.errorClass must be a constructor");
+  }
+  if (typeof opts.badMessage !== "string") {
+    throw new TypeError("crypto.makeBase64UrlDecoder: opts.badMessage must be a string");
+  }
+  var ErrorClass = opts.errorClass;
+  var code = opts.code;
+  var typeMessage = opts.typeMessage;
+  var badMessage = opts.badMessage;
+  return function decode(s) {
+    if (typeMessage !== undefined && typeof s !== "string") {
+      throw new ErrorClass(code, typeMessage);
+    }
+    try {
+      return fromBase64Url(s);
+    } catch (_e) {
+      throw new ErrorClass(code, badMessage);
+    }
+  };
+}
+
 // ---- Subresource Integrity (W3C SRI 1.0) ----
 //
 // b.crypto.sri(content, { algorithm? }) — returns a `sha###-base64`
@@ -895,7 +963,7 @@ var SRI_ALGORITHMS = { "sha256": "sha256", "sha384": "sha384", "sha512": "sha512
 function sri(content, opts) {
   opts = opts || {};
   var algorithm = (opts.algorithm || "sha384").toLowerCase();
-  if (!SRI_ALGORITHMS[algorithm]) {
+  if (!Object.prototype.hasOwnProperty.call(SRI_ALGORITHMS, algorithm)) {
     throw new Error("crypto.sri: unsupported algorithm '" + algorithm +
       "' (W3C SRI 1.0 §3.2 supports sha256/sha384/sha512)");
   }
@@ -1024,6 +1092,53 @@ function verify(data, signature, publicKeyPem) {
   return nodeCrypto.verify(null, Buffer.from(data), publicKeyPem, signature);
 }
 
+/**
+ * @primitive b.crypto.importPublicJwk
+ * @signature b.crypto.importPublicJwk(jwk, opts?)
+ * @since     0.15.13
+ * @status    stable
+ * @related   b.crypto.verify
+ *
+ * Import a JWK as a public `KeyObject` via
+ * `crypto.createPublicKey({ key, format: "jwk" })`, translating the Node
+ * import failure into a caller-supplied typed error. Untrusted JWKs reach
+ * this from DID documents (`publicKeyJwk`), DNSKEY records, and COSE_Key
+ * structures — each module validates the `kty` / `crv` it accepts BEFORE
+ * calling, then hands the assembled JWK here for the final import + error
+ * translation that was otherwise hand-rolled identically in every one.
+ * Centralising it gives one place to harden untrusted-JWK import.
+ *
+ * On failure, when `opts.errorClass` is supplied the thrown error is
+ * `new opts.errorClass(opts.code, opts.messagePrefix + nodeFailureDetail)`
+ * so the operator sees the module's own code + a message naming the
+ * source; without it the original Node error propagates unchanged.
+ *
+ * @opts
+ *   errorClass:    Function,  // (code, message) error constructor
+ *   code:          string,    // error code passed to errorClass
+ *   messagePrefix: string,    // text before the Node failure detail. default: ""
+ *
+ * @example
+ *   var b = require("blamejs");
+ *
+ *   function KeyError(code, message) { this.code = code; this.message = message; }
+ *   var key = b.crypto.importPublicJwk(
+ *     { kty: "OKP", crv: "Ed25519", x: "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo" },
+ *     { errorClass: KeyError, code: "bad-key", messagePrefix: "bad key: " });
+ *   // → <KeyObject>  (or throws KeyError("bad-key", "bad key: <detail>"))
+ */
+function importPublicJwk(jwk, opts) {
+  opts = opts || {};
+  try {
+    return nodeCrypto.createPublicKey({ key: jwk, format: "jwk" });
+  } catch (e) {
+    if (typeof opts.errorClass === "function") {
+      throw new opts.errorClass(opts.code, (opts.messagePrefix || "") + ((e && e.message) || e));
+    }
+    throw e;
+  }
+}
+
 // Track whether the hybrid-disabled audit has been emitted at least
 // once per process, so a high-volume KEM-only deployment doesn't peg
 // the audit bus with one event per encrypt() call. Operators who want
@@ -1241,7 +1356,21 @@ function decrypt(ciphertext, privateKeys, opts) {
     opts && opts.raw === true ? { raw: true } : undefined);
 }
 
+// Bounds-checked 2-byte length read — a bare _envU16(packed, pos) on a
+// truncated envelope throws a raw Node RangeError that escapes the documented
+// "Invalid envelope: ..." error contract (untrusted ciphertext must fail with
+// the typed envelope error, not a stack-trace-leaking RangeError).
+function _envU16(buf, at) {
+  if (at + 2 > buf.length) {
+    throw new Error("Invalid envelope: truncated (expected a 2-byte length at offset " + at + ")");
+  }
+  return buf.readUInt16BE(at);
+}
+
 function decryptEnvelope(packed, privateKeys, internalOpts) {
+  if (!Buffer.isBuffer(packed) || packed.length < 4) {
+    throw new Error("Invalid envelope: too short (need at least the 4-byte suite header)");
+  }
   var kemId = packed[1], cipherId = packed[2], kdfId = packed[3], pos = 4;
 
   // The legacy 0xE1 envelope predates the FixedInfo / suite-binding
@@ -1257,7 +1386,7 @@ function decryptEnvelope(packed, privateKeys, internalOpts) {
     throw new Error("Invalid envelope: unsupported KDF (only SHAKE256 supported)");
   }
 
-  var kemCtLen = packed.readUInt16BE(pos); pos += 2;
+  var kemCtLen = _envU16(packed, pos); pos += 2;
   var kemCt = packed.subarray(pos, pos + kemCtLen); pos += kemCtLen;
 
   var mlkemPriv = nodeCrypto.createPrivateKey(
@@ -1268,7 +1397,7 @@ function decryptEnvelope(packed, privateKeys, internalOpts) {
   var fixedInfo = omitFixedInfo ? Buffer.alloc(0) : _suiteFixedInfo(kemId, cipherId, kdfId);
 
   if (kemId === C.KEM_IDS.ML_KEM_1024_P384) {
-    var ecEphLen = packed.readUInt16BE(pos); pos += 2;
+    var ecEphLen = _envU16(packed, pos); pos += 2;
     var ecEphDer = packed.subarray(pos, pos + ecEphLen); pos += ecEphLen;
     var ecPrivPem = typeof privateKeys === "string" ? null : privateKeys.ecPrivateKey;
     if (!ecPrivPem) throw new Error("Hybrid KEM requires EC private key");
@@ -1285,7 +1414,7 @@ function decryptEnvelope(packed, privateKeys, internalOpts) {
     // the correct keypair via privateKeys when the envelope was sealed
     // with this algorithm. Same length-prefixed shape as the P-384
     // hybrid: 2-byte ec-eph-len + DER X25519 pubkey + nonce + ct.
-    var x25519EphLen = packed.readUInt16BE(pos); pos += 2;
+    var x25519EphLen = _envU16(packed, pos); pos += 2;
     var x25519EphDer = packed.subarray(pos, pos + x25519EphLen); pos += x25519EphLen;
     var x25519PrivPem = typeof privateKeys === "string" ? null : privateKeys.x25519PrivateKey;
     if (!x25519PrivPem) throw new Error("ML-KEM-768 + X25519 hybrid envelope requires x25519PrivateKey");
@@ -1768,7 +1897,7 @@ function _pemToDer(pemOrDer) {
   // for mTLS bootstrap / webhook verification / peer-cert pinning.
   // 64 KiB caps the largest plausible PEM (a P-384 cert + chain) at
   // ~3× margin while refusing pathological inputs outright.
-  if (pemOrDer.length > C.BYTES.kib(64)) {
+  if (safeBuffer.byteLengthOf(pemOrDer) > C.BYTES.kib(64)) {
     throw new TypeError(
       "crypto.hashCertFingerprint: PEM input exceeds 64 KiB (" +
       pemOrDer.length + " bytes); refuse oversized input to avoid " +
@@ -2022,6 +2151,8 @@ module.exports = {
   // Signatures
   sign:                        sign,
   verify:                      verify,
+  importPublicJwk:             importPublicJwk,
+  makeBase64UrlDecoder:        makeBase64UrlDecoder,
   // Envelope encrypt/decrypt
   encrypt:                     encrypt,
   decrypt:                     decrypt,