@blamejs/core 0.18.41 → 0.18.43

package/lib/vendor/blamejs-pki.cjs

@@ -1,4 +1,4 @@
-// @blamejs/pki v0.5.16 — vendored (Apache-2.0). Zero-dep pure CJS.
+// @blamejs/pki v0.5.17 — vendored (Apache-2.0). Zero-dep pure CJS.
 // https://github.com/blamejs/pki  Exports: x509, crl, pkcs12, key, webcrypto, schema, csr, cms, ...
 // Backs lib/mtls-engine-default.js (PQC-capable CA + PKCS#12 engine).
 var __getOwnPropNames = Object.getOwnPropertyNames;
@@ -141,7 +141,7 @@ var require_package = __commonJS({
   "node_modules/@blamejs/pki/package.json"(exports2, module2) {
     module2.exports = {
       name: "@blamejs/pki",
-      version: "0.5.16",
+      version: "0.5.17",
       description: "Pure-JavaScript PKI toolkit that owns its stack \u2014 X.509, ASN.1/DER, CMS, PQC-first.",
       license: "Apache-2.0",
       author: "blamejs contributors",
@@ -2512,7 +2512,7 @@ var require_webcrypto = __commonJS({
           return _withSecretBytes(key, function(kb) {
             var cipher = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-gcm", kb, iv, { authTagLength: (alg.tagLength || 128) / 8 });
             if (aad) cipher.setAAD(aad);
-            var ct = Buffer.concat([cipher.update(buf), cipher.final()]);
+            var ct = guard.secret.cipherFinish(cipher, buf, WebCryptoError, "webcrypto/operation", "an AES-GCM encrypt intermediate");
             return Buffer.concat([ct, cipher.getAuthTag()]);
           });
         }, "encrypt"));
@@ -2522,7 +2522,7 @@ var require_webcrypto = __commonJS({
         return _toArrayBuffer(_runCipher(function() {
           return _withSecretBytes(key, function(kb) {
             var c2 = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-cbc", kb, cbcIv);
-            return Buffer.concat([c2.update(buf), c2.final()]);
+            return guard.secret.cipherFinish(c2, buf, WebCryptoError, "webcrypto/operation", "an AES-CBC encrypt intermediate");
           });
         }, "encrypt"));
       }
@@ -2532,7 +2532,7 @@ var require_webcrypto = __commonJS({
         return _toArrayBuffer(_runCipher(function() {
           return _withSecretBytes(key, function(kb) {
             var c3 = nodeCrypto.createCipheriv("aes-" + key.algorithm.length + "-ctr", kb, ctrCounter);
-            return Buffer.concat([c3.update(buf), c3.final()]);
+            return guard.secret.cipherFinish(c3, buf, WebCryptoError, "webcrypto/operation", "an AES-CTR encrypt intermediate");
           });
         }, "encrypt"));
       }
@@ -2570,7 +2570,7 @@ var require_webcrypto = __commonJS({
             var d = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-gcm", kb, iv, { authTagLength: tagLen });
             if (gcmAad) d.setAAD(gcmAad);
             d.setAuthTag(tag);
-            return Buffer.concat([d.update(ct), d.final()]);
+            return guard.secret.cipherFinish(d, ct, WebCryptoError, "webcrypto/operation", "the recovered AES-GCM plaintext");
           });
         }, "decrypt"));
       }
@@ -2579,7 +2579,7 @@ var require_webcrypto = __commonJS({
         return _toArrayBuffer(_runCipher(function() {
           return _withSecretBytes(key, function(kb) {
             var d2 = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-cbc", kb, cbcIv2);
-            return Buffer.concat([d2.update(buf), d2.final()]);
+            return guard.secret.cipherFinish(d2, buf, WebCryptoError, "webcrypto/operation", "the recovered AES-CBC plaintext");
           });
         }, "decrypt"));
       }
@@ -2589,7 +2589,7 @@ var require_webcrypto = __commonJS({
         return _toArrayBuffer(_runCipher(function() {
           return _withSecretBytes(key, function(kb) {
             var d3 = nodeCrypto.createDecipheriv("aes-" + key.algorithm.length + "-ctr", kb, ctrCounter2);
-            return Buffer.concat([d3.update(buf), d3.final()]);
+            return guard.secret.cipherFinish(d3, buf, WebCryptoError, "webcrypto/operation", "the recovered AES-CTR plaintext");
           });
         }, "decrypt"));
       }
@@ -2809,7 +2809,7 @@ var require_webcrypto = __commonJS({
           try {
             return _withSecretBytes(wrappingKey, function(wkBytes) {
               var c = nodeCrypto.createCipheriv("aes" + wrappingKey.algorithm.length + "-wrap", wkBytes, Buffer.from("A6A6A6A6A6A6A6A6", "hex"));
-              return _toArrayBuffer(Buffer.concat([c.update(bytes), c.final()]));
+              return _toArrayBuffer(guard.secret.cipherFinish(c, bytes, WebCryptoError, "webcrypto/operation", "an AES-KW wrap intermediate"));
             });
           } catch (e) {
             throw new WebCryptoError("webcrypto/operation", "wrapKey: AES-KW key wrap failed", e);
@@ -2835,7 +2835,7 @@ var require_webcrypto = __commonJS({
         try {
           bytes = _withSecretBytes(unwrappingKey, function(kwBytes) {
             var d = nodeCrypto.createDecipheriv("aes" + unwrappingKey.algorithm.length + "-wrap", kwBytes, Buffer.from("A6A6A6A6A6A6A6A6", "hex"));
-            return Buffer.concat([d.update(wrapped), d.final()]);
+            return guard.secret.cipherFinish(d, wrapped, WebCryptoError, "webcrypto/operation", "the unwrapped key material");
           });
         } catch (e) {
           throw new WebCryptoError("webcrypto/operation", "unwrapKey: AES-KW key unwrap failed (integrity or length)", e);
@@ -3419,6 +3419,7 @@ var require_guard_secret = __commonJS({
     var bytes = require_guard_bytes();
     var intrinsic = require_guard_intrinsic();
     var _fill = intrinsic.uncurry(Uint8Array.prototype.fill);
+    var _concat = intrinsic.bufferConcat;
     function zeroize(value, ErrorClass, code, label) {
       if (value === null || value === void 0) return value;
       var view = bytes.view(value, ErrorClass, code, label);
@@ -3430,7 +3431,18 @@ var require_guard_secret = __commonJS({
       for (var i = 0; i < list.length; i++) zeroize(list[i], ErrorClass, code, label);
       return list;
     }
-    module2.exports = { zeroize, zeroizeAll };
+    function cipherFinish(transform, input, ErrorClass, code, label) {
+      var head = null, tail = null;
+      try {
+        head = transform.update(input);
+        tail = transform.final();
+        return _concat([head, tail]);
+      } finally {
+        zeroize(head, ErrorClass, code, label);
+        zeroize(tail, ErrorClass, code, label);
+      }
+    }
+    module2.exports = { zeroize, zeroizeAll, cipherFinish };
   }
 });
 
@@ -18943,13 +18955,13 @@ var require_pbes2 = __commonJS({
       }
       return { salt, iterations, prfNode };
     }
-    function cbcEncrypt(key, iv, plaintext, keyBits) {
+    function cbcEncrypt(key, iv, plaintext, keyBits, E, code) {
       var c = nodeCrypto.createCipheriv("aes-" + keyBits + "-cbc", key, iv);
-      return Buffer.concat([c.update(plaintext), c.final()]);
+      return guard.secret.cipherFinish(c, plaintext, E, code, "a content-encryption intermediate");
     }
-    function cbcDecrypt(key, iv, ct, keyBits) {
+    function cbcDecrypt(key, iv, ct, keyBits, E, code) {
       var d = nodeCrypto.createDecipheriv("aes-" + keyBits + "-cbc", key, iv);
-      return Buffer.concat([d.update(ct), d.final()]);
+      return guard.secret.cipherFinish(d, ct, E, code, "the partially recovered plaintext");
     }
     function pbes2Encrypt(pwBytes, plaintext, opts, E, prefix) {
       opts = opts || {};
@@ -18963,7 +18975,7 @@ var require_pbes2 = __commonJS({
       var iv = opts.iv != null ? opts.iv : nodeCrypto.randomBytes(16);
       var key = nodeCrypto.pbkdf2Sync(pwBytes, salt, iterations, keyBits / 8, prfNode);
       try {
-        return { algId: pbes2AlgId(salt, iterations, prf, cipherName, iv), ct: cbcEncrypt(key, iv, plaintext, keyBits) };
+        return { algId: pbes2AlgId(salt, iterations, prf, cipherName, iv), ct: cbcEncrypt(key, iv, plaintext, keyBits, E, prefix + "/bad-input") };
       } finally {
         guard.secret.zeroize(key, E, prefix + "/bad-input", "the password-derived encryption key");
       }
@@ -18994,7 +19006,7 @@ var require_pbes2 = __commonJS({
       }
       var dk = nodeCrypto.pbkdf2Sync(pwBytes, pb.salt, pb.iterations, keyBits / 8, pb.prfNode);
       try {
-        return cbcDecrypt(dk, iv, ciphertext, keyBits);
+        return cbcDecrypt(dk, iv, ciphertext, keyBits, E, prefix + "/decrypt-failed");
       } catch (_e) {
         throw E(prefix + "/decrypt-failed", "decryption failed");
       } finally {
@@ -20495,7 +20507,7 @@ var require_cms_sign = __commonJS({
     function _buildSignedAttrs(pairs) {
       var seenTypes = {};
       var attrs = pairs.map(function(p) {
-        if (seenTypes[p.type]) throw _err("cms/bad-input", "signedAttrs must not repeat an attribute type (RFC 5652 sec. 5.3): " + p.type);
+        if (guard.intrinsic.hasOwn(seenTypes, p.type)) throw _err("cms/bad-input", "signedAttrs must not repeat an attribute type (RFC 5652 sec. 5.3): " + p.type);
         seenTypes[p.type] = 1;
         return b.sequence([b.oid(p.type), b.set(p.values)]);
       });
@@ -20524,8 +20536,8 @@ var require_cms_sign = __commonJS({
       var pairs = _resolveAttrPairs(list, "an unsigned attribute value");
       var seen = {};
       pairs.forEach(function(p) {
-        if (UNSIGNED_FORBIDDEN[p.type]) throw _err("cms/bad-input", "the " + UNSIGNED_FORBIDDEN[p.type] + " attribute must not appear as an unsigned attribute (RFC 5652 sec. 11)");
-        if (seen[p.type]) throw _err("cms/bad-input", "unsignedAttrs must not repeat an attribute type (RFC 5652 sec. 5.3): " + p.type);
+        if (guard.intrinsic.hasOwn(UNSIGNED_FORBIDDEN, p.type)) throw _err("cms/bad-input", "the " + UNSIGNED_FORBIDDEN[p.type] + " attribute must not appear as an unsigned attribute (RFC 5652 sec. 11)");
+        if (guard.intrinsic.hasOwn(seen, p.type)) throw _err("cms/bad-input", "unsignedAttrs must not repeat an attribute type (RFC 5652 sec. 5.3): " + p.type);
         seen[p.type] = 1;
       });
       var setOf = b.set(pairs.map(function(p) {
@@ -21187,11 +21199,11 @@ var require_cms_encrypt = __commonJS({
       try {
         var c1 = nodeCrypto.createCipheriv("aes-256-cbc", kek, iv);
         c1.setAutoPadding(false);
-        var pass1 = Buffer.concat([c1.update(wk), c1.final()]);
+        var pass1 = guard.secret.cipherFinish(c1, wk, CmsError, "cms/bad-input", "the PWRI first-pass ciphertext");
         var iv2 = pass1.subarray(pass1.length - 16);
         var c2 = nodeCrypto.createCipheriv("aes-256-cbc", kek, iv2);
         c2.setAutoPadding(false);
-        return Buffer.concat([c2.update(pass1), c2.final()]);
+        return guard.secret.cipherFinish(c2, pass1, CmsError, "cms/bad-input", "the PWRI wrapped key");
       } finally {
         guard.secret.zeroize(wk, CmsError, "cms/bad-input", "the PWRI plaintext block");
       }
@@ -21258,10 +21270,37 @@ var require_cms_encrypt = __commonJS({
     }
     function _envelopedData(contentBytes, cek, ca, contentType, riNodes, recips) {
       var iv = nodeCrypto.randomBytes(16);
-      var enc = pbes2.cbcEncrypt(cek, iv, contentBytes, ca.keyBits);
+      var enc = pbes2.cbcEncrypt(cek, iv, contentBytes, ca.keyBits, CmsError, "cms/bad-input");
       var eci = b.sequence([b.oid(O(contentType)), b.sequence([b.oid(O(ca.oid)), b.octetString(iv)]), b.contextPrimitive(0, enc)]);
       return b.sequence([b.integer(BigInt(_envelopedVersion(recips, false))), b.setOf(riNodes), eci]);
     }
+    function _assertAuthAttrs(pairs, forbidden) {
+      var seenTypes = {};
+      pairs.forEach(function(p) {
+        var node;
+        try {
+          node = asn1.decode(p);
+        } catch (e) {
+          throw _err("cms/bad-input", "an authenticated attribute is not well-formed DER", e);
+        }
+        if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children || node.children.length !== 2 || node.children[1].tagClass !== "universal" || node.children[1].tagNumber !== asn1.TAGS.SET || !node.children[1].children || node.children[1].children.length < 1) {
+          throw _err("cms/bad-input", "an authenticated attribute must be an Attribute SEQUENCE { type, non-empty SET OF value } (RFC 5652)");
+        }
+        var t;
+        try {
+          t = asn1.read.oid(node.children[0]);
+        } catch (e) {
+          throw _err("cms/bad-input", "an authenticated attribute type is not an OBJECT IDENTIFIER", e);
+        }
+        if (guard.intrinsic.hasOwn(seenTypes, t)) throw _err("cms/bad-input", "authenticated attributes must not repeat an attribute type (RFC 5652): " + t);
+        seenTypes[t] = 1;
+        if (forbidden && t === forbidden.oid) throw _err("cms/bad-input", forbidden.why);
+      });
+    }
+    var AUTH_ENVELOPED_FORBIDDEN = {
+      oid: O("messageDigest"),
+      why: "authAttrs must not carry the message-digest attribute in an AuthEnvelopedData: its value is the unencrypted hash of the plaintext, which enables content tracking and confirmation of a guessed plaintext (RFC 5083 sec. 2.1, sec. 5)"
+    };
     function _authEnvelopedData(contentBytes, cek, ca, contentType, opts, riNodes, recips) {
       var nonce = nodeCrypto.randomBytes(12);
       var authAttrsDer = null, aad = Buffer.alloc(0);
@@ -21269,6 +21308,7 @@ var require_cms_encrypt = __commonJS({
         throw _err("cms/bad-input", "AuthEnvelopedData with a non-data contentType requires authAttrs (RFC 5083 sec. 2.1)");
       }
       if (opts.authAttrs && opts.authAttrs.length) {
+        _assertAuthAttrs(opts.authAttrs, AUTH_ENVELOPED_FORBIDDEN);
         var setOf = b.setOf(opts.authAttrs);
         aad = setOf;
         authAttrsDer = b.contextConstructed(1, setOf.subarray(_tlvHeaderLen(setOf)));
@@ -21294,7 +21334,7 @@ var require_cms_encrypt = __commonJS({
       } else {
         throw _err("cms/bad-input", "EncryptedData needs a single { cek } or { password } descriptor");
       }
-      var enc = pbes2.cbcEncrypt(encKey, iv, contentBytes, ca.keyBits);
+      var enc = pbes2.cbcEncrypt(encKey, iv, contentBytes, ca.keyBits, CmsError, "cms/bad-input");
       var eci = b.sequence([b.oid(O(contentType)), contentAlgNode, b.contextPrimitive(0, enc)]);
       var inner = b.sequence([b.integer(0n), eci]);
       return _emit(inner, "encryptedData", opts);
@@ -21308,7 +21348,7 @@ var require_cms_encrypt = __commonJS({
       var key = nodeCrypto.pbkdf2Sync(password, salt, iterations, ca.keyBits / 8, pbes2.prfNodeByName(prf, _err, "cms"));
       if (pwOwn2.owned) guard.secret.zeroize(password, CmsError, "cms/bad-input", "the password encoding");
       try {
-        var enc = pbes2.cbcEncrypt(key, iv, contentBytes, ca.keyBits);
+        var enc = pbes2.cbcEncrypt(key, iv, contentBytes, ca.keyBits, CmsError, "cms/bad-input");
         var contentAlg = pbes2.pbes2AlgId(salt, iterations, prf, ca.oid, iv);
         var eci = b.sequence([b.oid(O(contentType)), contentAlg, b.contextPrimitive(0, enc)]);
         var inner = b.sequence([b.integer(0n), eci]);
@@ -21320,7 +21360,7 @@ var require_cms_encrypt = __commonJS({
     function _gcmEncrypt(key, nonce, plaintext, aad, keyBits, tagLen) {
       var c = nodeCrypto.createCipheriv("aes-" + keyBits + "-gcm", key, nonce, { authTagLength: tagLen });
       if (aad && aad.length) c.setAAD(aad);
-      var ct = Buffer.concat([c.update(plaintext), c.final()]);
+      var ct = guard.secret.cipherFinish(c, plaintext, CmsError, "cms/bad-input", "a content-encryption intermediate");
       return { ct, tag: c.getAuthTag() };
     }
     function _tlvHeaderLen(der) {
@@ -21360,26 +21400,7 @@ var require_cms_encrypt = __commonJS({
             b.sequence([b.oid(O("messageDigest")), b.setOf([b.octetString(mdDigest)])])
           ];
           if (opts.authAttrs && opts.authAttrs.length) pairs = pairs.concat(opts.authAttrs);
-          var seenTypes = {};
-          pairs.forEach(function(p) {
-            var node;
-            try {
-              node = asn1.decode(p);
-            } catch (e) {
-              throw _err("cms/bad-input", "an authenticated attribute is not well-formed DER", e);
-            }
-            if (node.tagClass !== "universal" || node.tagNumber !== asn1.TAGS.SEQUENCE || !node.children || node.children.length !== 2 || node.children[1].tagClass !== "universal" || node.children[1].tagNumber !== asn1.TAGS.SET || !node.children[1].children || node.children[1].children.length < 1) {
-              throw _err("cms/bad-input", "an authenticated attribute must be an Attribute SEQUENCE { type, non-empty SET OF value } (RFC 5652)");
-            }
-            var t;
-            try {
-              t = asn1.read.oid(node.children[0]);
-            } catch (e) {
-              throw _err("cms/bad-input", "an authenticated attribute type is not an OBJECT IDENTIFIER", e);
-            }
-            if (seenTypes[t]) throw _err("cms/bad-input", "authenticated attributes must not repeat an attribute type (RFC 5652): " + t);
-            seenTypes[t] = 1;
-          });
+          _assertAuthAttrs(pairs, null);
           var setOf = b.setOf(pairs);
           preimage = setOf;
           authAttrsDer = b.contextConstructed(2, setOf.subarray(_tlvHeaderLen(setOf)));
@@ -21429,6 +21450,7 @@ var require_cms_decrypt = __commonJS({
     var CmsError = frameworkError.CmsError;
     var WRAP_KEK_LENGTHS = schemaCms.WRAP_KEK_LENGTHS;
     var KEM_CT_LENGTHS = schemaCms.KEM_CT_LENGTHS;
+    var AEAD_ALGS = schemaCms.AEAD_ALGS;
     function O(n) {
       return oid.byName(n);
     }
@@ -21724,16 +21746,24 @@ var require_cms_decrypt = __commonJS({
     }
     function _assertContentCipherMode(eci, ct) {
       var oidStr = eci.contentEncryptionAlgorithm.oid;
-      if (!CONTENT_MODE[oidStr]) return;
-      var wantMode = ct === "authEnvelopedData" ? "gcm" : "cbc";
-      if (CONTENT_MODE[oidStr] !== wantMode) {
-        throw _err("cms/unsupported-algorithm", "contentEncryptionAlgorithm " + oidStr + " is not a " + wantMode.toUpperCase() + " cipher, which " + ct + " requires (RFC 5083 sec. 2.1 / RFC 5084 sec. 3)");
+      var isAead = guard.intrinsic.hasOwn(AEAD_ALGS, oidStr);
+      if (!isAead && !guard.intrinsic.hasOwn(CONTENT_MODE, oidStr)) return;
+      if (ct === "authEnvelopedData") {
+        if (isAead) return;
+        throw _err("cms/unsupported-algorithm", "contentEncryptionAlgorithm " + oidStr + " is not an authenticated encryption algorithm, which authEnvelopedData requires (RFC 5083 sec. 2)");
       }
+      if (!isAead) return;
+      throw _err("cms/unsupported-algorithm", "contentEncryptionAlgorithm " + oidStr + " is an authenticated encryption algorithm, which belongs in an authEnvelopedData rather than a " + ct + " (RFC 5083 sec. 2)");
     }
     async function _openContent(parsed, eci, cek, ct) {
       var alg = eci.contentEncryptionAlgorithm;
-      var keyBits = CONTENT_KEYBITS[alg.oid];
-      if (!keyBits) throw _err("cms/unsupported-algorithm", "unsupported contentEncryptionAlgorithm " + alg.oid);
+      var keyBits = guard.intrinsic.hasOwn(CONTENT_KEYBITS, alg.oid) ? CONTENT_KEYBITS[alg.oid] : 0;
+      if (!keyBits) {
+        if (guard.intrinsic.hasOwn(AEAD_ALGS, alg.oid) && AEAD_ALGS[alg.oid] === "ccm") {
+          throw _err("cms/unsupported-algorithm", "contentEncryptionAlgorithm " + alg.oid + " is AES-CCM. RFC 5084 sec. 3.1 permits it for this content type; this toolkit implements AES-GCM only for content encryption");
+        }
+        throw _err("cms/unsupported-algorithm", "unsupported contentEncryptionAlgorithm " + alg.oid);
+      }
       if (eci.encryptedContent == null) throw _err("cms/no-encrypted-content", "the message has no encryptedContent (detached; supply it out of band)");
       var substitute = null;
       if (cek == null || cek.length !== keyBits / 8) {
@@ -21747,7 +21777,7 @@ var require_cms_decrypt = __commonJS({
         }
         var iv = asn1.read.octetString(asn1.decode(alg.parameters));
         if (iv.length !== 16) throw _fail();
-        return pbes2.cbcDecrypt(cek, iv, eci.encryptedContent, keyBits);
+        return pbes2.cbcDecrypt(cek, iv, eci.encryptedContent, keyBits, CmsError, "cms/decrypt-failed");
       } catch (e) {
         if (e instanceof CmsError && e.code !== "cms/decrypt-failed") throw e;
         throw _fail();
@@ -21760,7 +21790,7 @@ var require_cms_decrypt = __commonJS({
       var d = nodeCrypto.createDecipheriv("aes-" + keyBits + "-gcm", cek, nonce, { authTagLength: icvLen });
       d.setAuthTag(tag);
       if (aad && aad.length) d.setAAD(aad);
-      return Buffer.concat([d.update(ct), d.final()]);
+      return guard.secret.cipherFinish(d, ct, CmsError, "cms/decrypt-failed", "the recovered content");
     }
     async function _decryptEncryptedData(parsed, km, opts) {
       var eci = parsed.encryptedContentInfo;
@@ -21774,7 +21804,7 @@ var require_cms_decrypt = __commonJS({
       if (cek.length !== keyBits / 8) throw _err("cms/bad-input", "the supplied cek length does not match the content algorithm");
       var iv = asn1.read.octetString(asn1.decode(alg.parameters));
       try {
-        return _originFields({ content: pbes2.cbcDecrypt(cek, iv, eci.encryptedContent, keyBits), contentType: eci.contentType, contentTypeName: oid.name(eci.contentType) || eci.contentType, recipientType: "cek", recipientIndex: -1, contentEncryptionAlgorithm: alg.name || alg.oid, authenticated: false }, null, null);
+        return _originFields({ content: pbes2.cbcDecrypt(cek, iv, eci.encryptedContent, keyBits, CmsError, "cms/decrypt-failed"), contentType: eci.contentType, contentTypeName: oid.name(eci.contentType) || eci.contentType, recipientType: "cek", recipientIndex: -1, contentEncryptionAlgorithm: alg.name || alg.oid, authenticated: false }, null, null);
       } catch (_e) {
         throw _fail();
       }
@@ -21804,7 +21834,7 @@ var require_cms_decrypt = __commonJS({
         if (pwE.owned) guard.secret.zeroize(pwE.bytes, CmsError, "cms/bad-input", "the password encoding");
       }
       try {
-        return _originFields({ content: pbes2.cbcDecrypt(key, iv, eci.encryptedContent, keyBits), contentType: eci.contentType, contentTypeName: oid.name(eci.contentType) || eci.contentType, recipientType: "password", recipientIndex: -1, contentEncryptionAlgorithm: oid.name(encOid) || encOid, authenticated: false }, null, null);
+        return _originFields({ content: pbes2.cbcDecrypt(key, iv, eci.encryptedContent, keyBits, CmsError, "cms/decrypt-failed"), contentType: eci.contentType, contentTypeName: oid.name(eci.contentType) || eci.contentType, recipientType: "password", recipientIndex: -1, contentEncryptionAlgorithm: oid.name(encOid) || encOid, authenticated: false }, null, null);
       } catch (_e) {
         throw _fail();
       } finally {
@@ -21841,18 +21871,19 @@ var require_cms_decrypt = __commonJS({
       var blk = 16, alg = "aes-" + keyBits + "-cbc";
       if (wrapped.length < 2 * blk || wrapped.length % blk !== 0) throw _fail();
       var n = wrapped.length;
-      var ecb = nodeCrypto.createDecipheriv("aes-" + keyBits + "-ecb", kek, Buffer.alloc(0));
-      ecb.setAutoPadding(false);
-      var lastDec = Buffer.concat([ecb.update(wrapped.subarray(n - blk)), ecb.final()]);
-      var iv2 = Buffer.alloc(blk);
-      for (var i = 0; i < blk; i++) iv2[i] = lastDec[i] ^ wrapped[n - 2 * blk + i];
-      var d1 = nodeCrypto.createDecipheriv(alg, kek, iv2);
-      d1.setAutoPadding(false);
-      var pass1 = Buffer.concat([d1.update(wrapped), d1.final()]);
-      var d2 = nodeCrypto.createDecipheriv(alg, kek, iv);
-      d2.setAutoPadding(false);
-      var body = Buffer.concat([d2.update(pass1), d2.final()]);
-      try {
+      var lastDec = null, pass1 = null, body = null;
+      try {
+        var ecb = nodeCrypto.createDecipheriv("aes-" + keyBits + "-ecb", kek, Buffer.alloc(0));
+        ecb.setAutoPadding(false);
+        lastDec = guard.secret.cipherFinish(ecb, wrapped.subarray(n - blk), CmsError, "cms/decrypt-failed", "the recovered CBC last block");
+        var iv2 = Buffer.alloc(blk);
+        for (var i = 0; i < blk; i++) iv2[i] = lastDec[i] ^ wrapped[n - 2 * blk + i];
+        var d1 = nodeCrypto.createDecipheriv(alg, kek, iv2);
+        d1.setAutoPadding(false);
+        pass1 = guard.secret.cipherFinish(d1, wrapped, CmsError, "cms/decrypt-failed", "the PWRI first-pass plaintext");
+        var d2 = nodeCrypto.createDecipheriv(alg, kek, iv);
+        d2.setAutoPadding(false);
+        body = guard.secret.cipherFinish(d2, pass1, CmsError, "cms/decrypt-failed", "the PWRI plaintext block");
         var count = body[0];
         if (count < 1 || count + 4 > body.length) throw _fail();
         var cek = body.subarray(4, 4 + count);
@@ -21861,7 +21892,7 @@ var require_cms_decrypt = __commonJS({
         if (bad !== 0) throw _fail();
         return Buffer.from(cek);
       } finally {
-        guard.secret.zeroizeAll([body, pass1], CmsError, "cms/bad-input", "the PWRI plaintext block");
+        guard.secret.zeroizeAll([body, pass1, lastDec], CmsError, "cms/bad-input", "the PWRI plaintext block");
       }
     }
     function _oaepHashFromParams(paramsBytes) {
@@ -30341,7 +30372,7 @@ var require_key = __commonJS({
         if (pwK.owned) guard.secret.zeroize(pwK.bytes, KeyError, "key/bad-input", "the password encoding");
       }
       try {
-        var ciphertext = pbes2.cbcEncrypt(dk, iv, der, keyBits);
+        var ciphertext = pbes2.cbcEncrypt(dk, iv, der, keyBits, KeyError, "key/bad-input");
         var epki = b.sequence([pbes2.pbes2AlgId(salt, iterations, prf, cipherName, iv), b.octetString(ciphertext)]);
         pkcs8.parseEncrypted(epki);
         return opts.pem ? pkcs8.pemEncode(epki, "ENCRYPTED PRIVATE KEY") : epki;
@@ -31434,7 +31465,7 @@ var require_pkcs12_build = __commonJS({
       try {
         if (scheme.rc2) return rc2.cbcDecrypt(keyM, scheme.rc2, iv, ct, _err, "pkcs12/decrypt-failed");
         var d = nodeCrypto.createDecipheriv(scheme.cipher, keyM, iv);
-        return Buffer.concat([d.update(ct), d.final()]);
+        return guard.secret.cipherFinish(d, ct, Pkcs12Error, "pkcs12/bad-input", "the recovered safe contents");
       } catch (_e) {
         throw _err("pkcs12/decrypt-failed", "decryption failed");
       } finally {
@@ -32183,7 +32214,7 @@ var require_hpke = __commonJS({
       var nonce = this._nonce();
       var c = nodeCrypto.createCipheriv(aead.cipher, this._key, nonce, { authTagLength: aead.Nt });
       if (aad && aad.length) c.setAAD(aad);
-      var body = concat([c.update(_buf(pt)), c.final()]);
+      var body = guard.secret.cipherFinish(c, _buf(pt), HpkeError, "hpke/bad-input", "a seal intermediate");
       var ct = concat([body, c.getAuthTag()]);
       this._inc();
       return ct;
@@ -32200,7 +32231,7 @@ var require_hpke = __commonJS({
       d.setAuthTag(ct.subarray(ct.length - aead.Nt));
       var pt;
       try {
-        pt = concat([d.update(ct.subarray(0, ct.length - aead.Nt)), d.final()]);
+        pt = guard.secret.cipherFinish(d, ct.subarray(0, ct.length - aead.Nt), HpkeError, "hpke/bad-input", "the recovered plaintext");
       } catch (e) {
         throw _err("hpke/open-failed", "AEAD authentication failed (RFC 9180 sec. 5.2)", e);
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.18.41",
+  "version": "0.18.43",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:a9c950dd-01b0-4088-b83e-2dfd36c75675",
+  "serialNumber": "urn:uuid:a214f954-8702-46e7-819d-20eb98e5ca08",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-08-20T14:26:30.885Z",
+    "timestamp": "2026-08-20T20:10:05.952Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.18.41",
+      "bom-ref": "@blamejs/core@0.18.43",
       "type": "application",
       "name": "blamejs",
-      "version": "0.18.41",
+      "version": "0.18.43",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.18.41",
+      "purl": "pkg:npm/%40blamejs/core@0.18.43",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.18.41",
+      "ref": "@blamejs/core@0.18.43",
       "dependsOn": []
     }
   ]