@blamejs/pki 0.4.1 → 0.4.3

package/CHANGELOG.md

@@ -4,7 +4,45 @@ All notable changes to `@blamejs/pki` are documented here. The format
 follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## v0.4.1 — 2026-08-08
+## v0.4.3 — 2026-08-08
+
+pki.tls encodes and decodes RFC 8879 compressed certificate messages -- the largest payload a TLS handshake carries, and the one post-quantum chains grow by kilobytes -- with the two-sided decompression bound the specification requires. Alongside it, SHAKE128 and SHAKE256 join the digest surface, which brings the Ed448 composite signature arm into service.
+
+### Added
+
+- pki.tls.decompressCertificate and pki.tls.compressCertificate encode and decode an RFC 8879 CompressedCertificate. Decompression applies the bound RFC 8879 sec. 5 requires on both sides: the decompressor is capped at the message's own declared uncompressed length, so a decompression bomb is refused as its output would exceed that declaration rather than after the memory is committed, and the recovered length must then equal the declaration exactly. A caller's own cap applies independently and can only tighten the limit, never raise it. An algorithm outside the registry, one this runtime cannot decompress, or one absent from the caller's advertised set is refused before any decompressor runs; an empty compressed body is a framing violation; and trailing bytes are refused, so one chain has exactly one encoding. compressCertificate decodes its own output before returning it, so a message this toolkit produces cannot be one this toolkit refuses, and refuses to emit one whose own framing would exceed the handshake limit.
+- All three registered compression algorithms are implemented, and each is offered only where the running Node can decompress it safely. A decompressor is required to fault on a frame it could not finish; where one instead returns a short result and reports the whole input as consumed, a peer could cut a frame's tail and have the receiver process a prefix as if it were the entire message. Any algorithm whose decompressor behaves that way is dropped at startup and is then neither advertised nor accepted, rather than being offered with a truncation it cannot detect. On the current long-term-support Node this drops zstd, leaving zlib and brotli; it returns by itself on a runtime that reports the fault.
+- pki.tls.parseCertificateMessage decodes the RFC 8446 sec. 4.4.2 Certificate message itself, surfacing each entry's certificate DER exactly as it arrived -- ready for pki.schema.x509.parse and never re-serialized -- alongside its raw extensions and the certificate request context. The certificate type is negotiated by a separate extension and is not present in the message, so it is declared through an option rather than inferred from the bytes. The number of entries is bounded: a message's byte ceiling does not limit how many it declares, since the smallest legal entry is six bytes, so a message well inside the framing limit could otherwise declare hundreds of thousands and exhaust memory. The cap matches the longest chain the path validator will accept, and is exactly one under a negotiated RawPublicKey type, which RFC 8446 sec. 4.4.2 requires.
+- pki.webcrypto.subtle.digest computes SHAKE128 and SHAKE256, at the 32- and 64-byte lengths RFC 8702 sec. 4 fixes for message-digest use. The length follows from the name rather than being chosen by the caller, so a digest cannot be squeezed to a non-conforming width. The extendable-output functions are a digest route only: the signature, MAC and key-derivation operations continue to refuse them with the same typed error as before.
+- The composite signature arm id-MLDSA87-Ed448-SHAKE256 now verifies and signs. It was registered and parameter-guarded but failed closed as unsupported because its SHAKE256 pre-hash was unavailable; it is now checked byte-for-byte against the composite specification's own known-answer certificate, and both components must pass for the signature to be accepted. Sixteen of the eighteen arms now verify; the two remaining are the brainpool-curve arms.
+
+### Changed
+
+- pki.cms.sign and pki.cms.verify compute their message digests through the crypto engine rather than each holding a private digest table. Behaviour is unchanged; the digest algorithms a signer and a verifier accept are now defined in one place.
+
+### Fixed
+
+- pki.cms.decompress refuses a stream carrying bytes after the end of the compressed data. A decompressor stops at the end of the first complete frame and ignores whatever follows, so arbitrary bytes -- or a second entire frame -- could be appended and the same content still recovered. That gave one content unboundedly many encodings, so a digest over the compressed object no longer identified what it decompressed to. The whole octet string must now be exactly one frame, which is what the DER layer already required of its own encodings.
+- An unusable hash is now refused when a key is created rather than when it is first used. pki.webcrypto.subtle.importKey and generateKey recorded the requested hash without resolving it, so a name this engine cannot use produced a CryptoKey that failed only at its first sign, verify or wrap -- after the caller had already paid for the key generation. The name is now resolved at the entry point, through the same table the operations use, so what a key can be created with and what it can be used with cannot diverge.
+
+## v0.4.2 — 2026-08-07
+
+A NumericString attribute value no longer shares distinguished-name identity with a printable or UTF-8 value of the same characters -- the comparison that decides name chaining, revocation-issuer matching and name constraints. Alongside it, several C509 name-encoding conformance fixes and a move to Node 24.19.0.
+
+### Changed
+
+- The supported Node floor moves to 24.19.0, the current long-term-support release. Nothing is transpiled, so the supported version is the version the source runs on; the release is verified against that runtime.
+- pki.asn1.read.numericString reads a NumericString value, validated strictly to the digits and space the type permits. The shared string reader no longer accepts the type, so a caller that wants it asks for it by name.
+
+### Fixed
+
+- A NumericString attribute value no longer compares equal to a PrintableString or UTF8String attribute value carrying the same characters. RFC 5280 sec. 7.1 name comparison folds the directory-string types into one identity class, and NumericString is not one of them; because the previous release read it through the shared string reader, it entered that class and was treated as the same name by the comparison that decides certificate chaining, revocation-issuer matching and name-constraint evaluation. It now reads through its own reader and, as before, renders in the RFC 4514 hexadecimal form rather than as a plain string.
+- A natively signed C509 certificate is no longer accepted with, or built carrying, a negative attribute-type integer. The sign of that integer exists only to reproduce the string type of an original X.509 encoding, which a natively signed certificate does not have, so all of its integers are non-negative (draft-ietf-cose-cbor-encoded-cert-20 sec. 3.1.4); the toolkit previously read such a certificate and could also emit one that a conformant implementation must reject.
+- A country name or serial number attribute now keeps the string type its attribute integer's sign declares, and its restriction to the printable-string character subset is enforced on the characters instead. Both signs previously rebuilt the same certificate bytes, so two distinct compact encodings of one value produced one identical certificate under a single signature.
+- The rendered distinguished-name string now escapes its values (RFC 4514 sec. 2.4), so an attribute value containing a comma can no longer read as though the name held several attributes, and a control byte can no longer reach a log line unescaped.
+- An empty issuer name is now refused (RFC 5280 sec. 4.1.2.4 requires a non-empty issuer). It previously parsed and rebuilt a certificate that this toolkit's own certificate parser declines to load. An empty subject is still accepted; the profile pairs that with a subject alternative name, which this codec does not yet require.
+
+## v0.4.1 — 2026-08-07
 
 pki.schema.c509 encodes and decodes the compact subjectDirectoryAttributes value form -- a C509 certificate's subject directory attributes ride their draft-20 registry integers (or unwrapped OIDs) with their directory-string values, interoperating with a conformant C509 implementation rather than only this decoder.
 

package/README.md

@@ -63,7 +63,7 @@ Web Crypto API with its limits on streaming, opaque keys, and algorithm reach.
 npm i @blamejs/pki
 ```
 
-Requires Node.js 24.18+ (runs on the shipped runtime — no build step, no
+Requires Node.js 24.19+ (runs on the shipped runtime — no build step, no
 transpilation).
 
 ```js
@@ -202,6 +202,7 @@ is callable today; nothing below is a stub.
 | `pki.cbor` | Strict, bounded RFC 8949 deterministic CBOR codec — `decode` (zero-copy node tree) + `read.*` typed leaf readers incl. the keyed map lookup `read.mapGet` (text or COSE-label integer key, the map's major type asserted in the accessor), fail-closed on every non-canonical shape (indefinite length, non-minimal argument, unsorted / duplicate map keys, non-shortest float, trailing bytes) |
 | `pki.oid` | Two-way OID ↔ name registry — `name`, `byName`, `register`, `toArcs`/`fromArcs`, `toDER`/`fromDER`; seeded with RFC 5280 + NIST PQC arcs |
 | `pki.webcrypto` | A W3C WebCrypto (`SubtleCrypto`) engine over `node:crypto` — `sign`/`verify`/`encrypt`/`decrypt`/`deriveBits`/`digest`/`generateKey`/`importKey`/`exportKey` across RSA, ECDSA, ECDH, Ed25519/Ed448, AES, HMAC, HKDF, PBKDF2, SHA — **and** post-quantum ML-DSA-44/65/87 and SLH-DSA signatures, plus ML-KEM-512/768/1024 key generation and certificate/PKCS#8 import — the RFC 9935 seed / expandedKey / both private-key CHOICE is validated fail-closed, so an OpenSSL-legacy bare-seed or an internally inconsistent key is rejected with a typed error (KEM encapsulation lands with CMS KEM-decrypt). Zero-dependency, OpenSSL-interoperable |
+| `pki.tls` | RFC 8879 TLS certificate compression — `decompressCertificate` / `compressCertificate` decode and build a `CompressedCertificate` (zlib / brotli / zstd, each offered only where the runtime decompresses it safely) with the two-sided bound RFC 8879 §5 requires (capped at the message's own declared length, then compared to it exactly), and `parseCertificateMessage` decodes the RFC 8446 §4.4.2 Certificate message to per-entry certificate DER |
 | `pki.schema` | The schema family — `parse` detects which PKI format DER / PEM encodes and routes to the right parser, `all` enumerates the registered formats, and the engine + per-format members are grouped here |
 | `pki.schema.x509` | Parse DER / PEM certificates into structured, validated fields, with named + partly-decoded extensions — including the RFC 3739 / ETSI EN 319 412-5 qualified-certificate `qcStatements` (EU-qualified declaration, reliance limit, QSCD flag, certificate type, retention, PDS URLs, country of qualification; unknown statements preserved opaque) and the Microsoft Active Directory Certificate Services enrollment extensions (certificate template, CA version, previous-CA-certificate hash, application policies), fail-closed — `parse`, `pemDecode`, `pemEncode` |
 | `pki.schema.c509` | Parse **and encode** C509 CBOR-encoded certificates (draft-ietf-cose-cbor-encoded-cert) — the compact CBOR profile of X.509, decoded fail-closed under deterministic CBOR; an explicit `parse` call (CBOR, not DER, so not auto-routed). `encode(input)` is the byte-exact inverse: a DER X.509 v3 certificate forward-transforms to a compact type-3 C509 whose reconstruction reproduces the original DER byte for byte (so the original signature still verifies), or a `parse` result re-emits its native array — canonical deterministic CBOR with the registry integer shorthands, the C509 compressions, and the compact draft-20 per-extension value forms — the scalar extensions (keyUsage, basicConstraints, extended key usage, subject key identifier, and more), the general-name-bearing extensions (subjectAltName, issuer alt name, name constraints, CRL distribution points, authority/subject information access, and the full authority key identifier) over one shared GeneralNames value codec, certificate policies (registry-integer or OID policy identifiers with their CPS-URI and UserNotice qualifiers), and policy mappings and policy constraints, and subject directory attributes; a certificate outside the invertible set throws a typed `C509Error` |
@@ -236,6 +237,7 @@ is callable today; nothing below is a stub.
 | `pki.tsp` | RFC 3161 Time-Stamp Protocol — `sign(messageImprint, tsa, opts)` produces a TimeStampToken: a CMS SignedData (over `pki.cms.sign`) whose content is a `TSTInfo` carrying the timestamped message imprint, the TSA policy, a serial number, and `genTime` (with optional accuracy / nonce / ordering), plus the RFC 3161 §2.4.2 signing-certificate attribute binding the token to the TSA certificate (SHA-2 imprints, any `pki.cms.sign` TSA key). `request` / `parseRequest` build and parse the TimeStampReq a client sends (imprint, requested policy, nonce, certReq), `response` / `parseResponse` the TimeStampResp a TSA returns — a granted status wrapping a token, or a rejection with PKIStatus and failure info, the §2.4.2 status↔token coupling enforced in both directions. `verify(token, data, opts)` verifies a token fail-closed: the CMS signature over the exact signed bytes, the message imprint recomputed from the data, the TSTInfo content type, the ESSCertID(V2) binding to the TSA certificate, the §2.3 critical timeStamping-only extendedKeyUsage, the request nonce when used, and — with a trust anchor supplied — full certification-path validation of the TSA certificate at the token's `genTime`, returning `{ valid, genTime, serialNumber, tstInfo, … }` — `sign`, `request`, `parseRequest`, `response`, `parseResponse`, `verify` |
 | `pki.ocsp` | RFC 6960 Online Certificate Status Protocol — the responder and relying-party surface. `buildRequest(query, opts)` builds an OCSPRequest for one or more `{ cert, issuer }` pairs (CertID hashed under SHA-1 by default per the RFC 5019 lightweight profile, or SHA-2; optional RFC 9654 nonce, optional requestor signature). `sign(responseData, responder, opts)` produces a signed BasicOCSPResponse over the exact `ResponseData` DER — the issuing CA directly or a delegated responder, any `pki.cms.sign` key including the post-quantum ML-DSA / SLH-DSA sets, with `good` / `revoked` (reason + time) / `unknown` per-certificate status, and `buildErrorResponse(status)` the unsigned §2.3 error (`tryLater` / `unauthorized` / …). `verify(response, opts)` verifies a response fail-closed against the same hardened gates `pki.path.ocspChecker` runs: the CertID binding, responder authorization (the issuing CA or a CA-issued delegate bearing id-kp-OCSPSigning **and** id-pkix-ocsp-nocheck, passing the full out-of-path certificate gates), the signature over `tbsResponseDataBytes`, currency (`thisUpdate`/`nextUpdate`), and the request-nonce echo — returning `{ status: "good" / "revoked" / "unknown", … }`, never a silent accept. Transport-free — `buildRequest`, `sign`, `buildErrorResponse`, `verify` |
 | `pki.ct` | RFC 6962 Certificate Transparency SCTs — `parseSctList` decodes the `SignedCertificateTimestampList` a certificate or OCSP response carries in the SCT extension (a TLS-presentation-language payload inside the §3.3 double DER wrap) into per-SCT log id, exact `timestamp` (BigInt), named signature algorithm, and raw signature; `reconstructSignedData` rebuilds the exact `digitally-signed` preimage; `verifySct` verifies an SCT signature against a log's public key by reconstructing the signed data, routing an ECDSA signature through the strict DER-conformance gate, and verifying through the crypto engine — resolving true or false, and throwing a typed error on a structural fault. The producing side: `encodeSctList` builds the extension value byte-for-byte (the exact inverse of `parseSctList`) and `signSct` performs a log's signing step (rebuilding the same signed-data preimage the verifier hashes and signing it with the log's ECDSA-P-256 / RSA key). The trust surface: `parseLogList` ingests the CT log-list JSON into constraint-carrying trusted logs — recomputing each log's id as SHA-256 of its key and refusing a disagreeing id (a swapped key, §3.2), decoding the state + temporal-interval constraints — and `verifySctWithLogList` resolves the log key from an SCT's log id, enforces the state (usable/qualified/readonly trusted; retired only before retirement; pending/rejected refused) and the temporal-interval window, then delegates the signature check to `verifySct`. `verifyLogListSignature(json, signature, publicKey)` verifies the detached `log_list.sig` over the raw log-list bytes against a caller-pinned signer key (RSASSA-PKCS1-v1.5/SHA-256, EC P-256 arm; forgeable-key defenses fail closed) — cross-checked against `openssl dgst`, completing the offline log-list trust chain. `fetchLogList(opts)` turns that chain into a live client: it GETs the `log_list.json` and its detached `log_list.sig` over the shared `pki.transport`, verifies the detached signature over the raw fetched bytes against a caller-pinned distributor key **before** parsing (verify-before-parse — an unverified document is never parsed, read, cached, or surfaced), then ingests the same bytes through `parseLogList` and returns the trusted-log set plus the surfaced `version`/`timestamp`. No baked-in vendor URL or key (both caller-pinned); explicit TLS trust with `rejectUnauthorized` always on; each response is size-capped before the trust chain; the transport is dependency-injectable so it is fully testable offline. Structure decoded, crypto fail-closed — `parseSctList`, `reconstructSignedData`, `verifySct`, `encodeSctList`, `signSct`, `parseLogList`, `verifySctWithLogList`, `verifyLogListSignature`, `fetchLogList` |
+| `pki.tls` | RFC 8879 TLS certificate compression + the RFC 8446 Certificate message it carries -- the handshake's largest payload, and the one post-quantum chains grow by kilobytes. `decompressCertificate(bytes, opts)` decodes a `CompressedCertificate` and returns the algorithm, the declared uncompressed length, the recovered Certificate message raw, and that message already decoded to per-entry certificate DER. The decompression bound is the two-sided one sec. 5 requires: the decompressor is capped at the message's OWN declared length, so a bomb is refused mid-stream rather than allocated, and the recovered length must then equal that declaration exactly -- which catches the under-length direction a cap cannot see. An algorithm the receiver never advertised is refused before any decompressor runs, an empty compressed body is a framing violation, and trailing bytes -- after the message or after the compressed frame -- are refused, so one chain has exactly one encoding. `compressCertificate(message, opts)` is the producing inverse and verifies its own output round-trips before returning it. `parseCertificateMessage(bytes, opts)` decodes the RFC 8446 sec. 4.4.2 Certificate message on its own, surfacing each entry's certificate DER ready for `pki.schema.x509.parse` and its raw extensions; `certificate_type` is negotiated by a separate extension and so is declared, never guessed. All three registered algorithms (zlib, brotli, zstd) are implemented, and each is offered only where the running Node can decompress it safely -- one whose decompressor answers a truncated frame with a short result instead of a fault is dropped at startup rather than advertised with a truncation it cannot detect. Structure only -- no handshake is spoken and no certificate verified -- `decompressCertificate`, `compressCertificate`, `parseCertificateMessage` |
 | `pki.merkle` | RFC 6962 / RFC 9162 Merkle-tree proof verification — `leafHash` / `nodeHash` / `emptyRootHash` build the domain-separated (0x00 leaf / 0x01 node) SHA-256 tree hashes; `verifyInclusion` folds an audit proof back to a root and `verifyConsistency` reconstructs both the old and new root (the append-only guarantee), each constant-time-compared to a trusted checkpoint root. Fail-closed on bad geometry, sync hashing, transport-free — `leafHash`, `nodeHash`, `emptyRootHash`, `verifyInclusion`, `verifyConsistency` |
 | `pki.trust` | Mozilla / CCADB trust-store ingestion — `parseCertdata` reads the NSS `certdata.txt` object stream and `parseCcadbCsv` the CCADB CSV export into one identical constraint-carrying anchor shape: the per-purpose trust bits (only `CKT_NSS_TRUSTED_DELEGATOR` grants) and the per-purpose distrust-after dates the bare root list omits. Certificate and trust objects pair by byte-exact issuer + serial (never adjacency) and are cross-checked against the parsed DER, so metadata can never attach to the wrong root; `anchor()` hands an entry to `pki.path.validate({ trustAnchor, checkPurpose })`. Offline, fail-closed, bounded — `parseCertdata`, `parseCcadbCsv`, `anchor` |
 | `pki.shbs` | Stateful hash-based signature **verification** — HSS/LMS (RFC 8554), carried in X.509 by RFC 9802 and CMS by RFC 9708, profiled by NIST SP 800-208 (CNSA 2.0 firmware signing). `verify` checks an HSS signature (every level must pass) and `verifyLms` a single-tree LMS, over the raw public-key / signature blobs the parsers already surface. Pure public-input SHA-256 / SHAKE256 hashing, a data-driven typecode registry, bounds-before-slice reads; a malformed blob throws a typed `ShbsError`, a well-formed-but-wrong signature returns `false`. **Verify only by design** — stateful signing needs atomic one-time-key state that belongs in an HSM — `verify`, `verifyLms` |

package/index.js

@@ -36,6 +36,7 @@ var webcrypto = require("./lib/webcrypto");
 var schema    = require("./lib/schema-all");
 var path      = require("./lib/path-validate");
 var ct        = require("./lib/ct");
+var tls       = require("./lib/tls-cert-compress");
 var cms       = require("./lib/cms-verify");
 var smime     = require("./lib/smime");
 var tsp       = require("./lib/tsp-sign");
@@ -86,6 +87,10 @@ module.exports = {
   // SCT-list extension a certificate / OCSP response carries; the signature is
   // surfaced raw for external verification (pki.ct.reconstructSignedData).
   ct:        ct,
+  // 'tls' is TLS handshake structures that carry certificates -- RFC 8879 compressed
+  // certificate messages (zlib / brotli / zstd) and the RFC 8446 Certificate message
+  // inside them, decoded to per-entry certificate DER. Structure only; no handshake.
+  tls:       tls,
   cms:       cms,
   smime:     smime,
   tsp:       tsp,

package/lib/asn1-der.js

@@ -623,11 +623,20 @@ function _decodePrintable(buf) {
   return s;
 }
 
-// NumericString (X.680 sec. 41, Table 9) permits ONLY the digits and SPACE. It carries the X.520 syntax of
-// the x121Address and internationalISDNNumber directory attributes, so a value of this type must be readable
-// -- and strictly, since anything outside that alphabet is not a valid encoding of the type.
-function _decodeNumeric(buf) {
-  var s = buf.toString("latin1");
+// NumericString (X.680 sec. 41, Table 9) permits ONLY the digits and SPACE. It carries the X.520 syntax of the
+// x121Address and internationalISDNNumber directory attributes.
+//
+// It is read through its OWN reader, deliberately NOT through readString. Every type readString returns a
+// plain string for enters the RFC 5280 sec. 7.1 name-comparison identity class, and
+// guard.name.dnEqual -- the single choke point for name chaining, revocation-issuer matching and name
+// constraints -- compares the strings it returns. Admitting NumericString there would make a NumericString
+// attribute value compare EQUAL to a PrintableString / UTF8String one with the same characters, silently
+// widening distinguished-name identity across the whole toolkit. A caller that genuinely wants this type asks
+// for it by name.
+function readNumericString(node) {
+  _expectUniversal(node, TAGS.NUMERIC_STRING, "readNumericString");
+  _expectPrimitive(node, "readNumericString");
+  var s = node.content.toString("latin1");
   if (!NUMERIC_RE.test(s)) throw new Asn1Error("asn1/bad-numeric-string", "NumericString has characters outside the digits-and-space set");
   return s;
 }
@@ -647,7 +656,6 @@ function readString(node) {
   _expectPrimitive(node, "readString");
   switch (node.tagNumber) {
     case TAGS.UTF8_STRING:      return _decodeUtf8Strict(node.content);
-    case TAGS.NUMERIC_STRING:   return _decodeNumeric(node.content);
     case TAGS.PRINTABLE_STRING: return _decodePrintable(node.content);
     case TAGS.IA5_STRING:       return _decodeIa5(node.content);
     case TAGS.TELETEX_STRING:   return _decodeText(node.content, "latin1");
@@ -1079,6 +1087,7 @@ module.exports = {
     booleanImplicit: readBooleanImplicit,
     oid:          readOid,
     string:       readString,
+    numericString: readNumericString,
     time:         readTime,
   },
 };

package/lib/cms-compress.js

@@ -92,20 +92,18 @@ function _toDer(input) {
   throw _err("cms/bad-input", "input must be a DER Buffer, Uint8Array, or PEM string");
 }
 
-// Inflate an RFC 1950 ZLIB stream, bounding the output at `cap` bytes BEFORE it is materialized:
-// Node's maxOutputLength throws ERR_BUFFER_TOO_LARGE the moment the output would exceed the bound
-// (it does not first allocate the whole output), so a decompression bomb cannot exhaust memory
-// (CWE-409). The cap breach maps to cms/decompress-too-large; every other zlib fault (bad RFC-1950
-// header, truncated stream, corrupt DEFLATE, trailing garbage) collapses to the uniform
-// cms/decompress-failed -- a per-errno surface would be needless attack telemetry.
+// Inflate the RFC 1950 ZLIB stream through the shared bounded-decompression guard, which applies
+// the output cap at the decompressor (so a bomb is refused mid-stream rather than after it is
+// allocated) and requires the whole octet string to be exactly one compressed frame (so trailing
+// bytes cannot give one content a second encoding). This module keeps its own verdict codes: a cap
+// breach is cms/decompress-too-large, every other fault the uniform cms/decompress-failed.
+//
+// `_err` is a FACTORY, and the guard calls it as one -- handing it CmsError instead would throw
+// "class cannot be invoked without new" on the rejection path, turning a refusal into a crash.
 function _inflateBounded(stream, cap) {
   var view = guard.bytes.view(stream, CmsError, "cms/decompress-failed", "the compressed content");
-  try {
-    return zlib.inflateSync(view, { maxOutputLength: cap });
-  } catch (e) {
-    if (e && e.code === "ERR_BUFFER_TOO_LARGE") throw _err("cms/decompress-too-large", "the decompressed output exceeds the " + cap + "-byte cap (a decompression-bomb defense)", e);
-    throw _err("cms/decompress-failed", "the compressed content could not be decompressed", e);
-  }
+  return guard.compress.bounded("zlib", view, cap, _err,
+    { tooLarge: "cms/decompress-too-large", failed: "cms/decompress-failed" }, "the compressed content");
 }
 
 module.exports = { compress: compress, decompress: decompress };

package/lib/cms-sign.js

@@ -13,17 +13,19 @@
 // for ECDSA/EdDSA, the RSASSA-PSS params SEQUENCE), with the sign->verify round-trip (and OpenSSL
 // cms -verify) as the guard.
 
-var nodeCrypto = require("crypto");
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
 var x509 = require("./schema-x509");
 var pkix = require("./schema-pkix");
 var frameworkError = require("./framework-error");
 
+var webcrypto = require("./webcrypto");
 var signScheme = require("./sign-scheme");
 var guard = require("./guard-all");
 var pkiBuild = require("./pki-build");
 var cms = require("./schema-cms");
+
+var subtle = webcrypto.webcrypto.subtle;
 var CmsError = frameworkError.CmsError;
 var b = asn1.build;
 function _err(code, message, cause) { return new CmsError(code, message, cause); }
@@ -32,20 +34,22 @@ function _err(code, message, cause) { return new CmsError(code, message, cause);
 function _signE(kind, message, cause) { return new CmsError("cms/" + kind, message, cause); }
 function O(name) { return oid.byName(name); }
 
-var NODE_DIGEST = { sha256: "sha256", sha384: "sha384", sha512: "sha512", shake128: "shake128", shake256: "shake256" };
-var SHAKE_OUT = { shake128: 32, shake256: 64 };   // SHAKE output lengths: SHAKE128 256-bit (RFC 9814 sec. 4), SHAKE256 512-bit (RFC 8419 sec. 2.3 / RFC 9814)
+// A digest-algorithm name -> the engine's hash name. The FIPS 202 extendable-output
+// functions are message digests here at the lengths RFC 8702 sec. 4 fixes for that use,
+// which the engine applies from the name alone.
+var DIGEST_HASH = {
+  sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512",
+  shake128: "SHAKE128", shake256: "SHAKE256",
+};
 
 var OID_DATA = O("data");
 var OID_SIGNED_DATA = O("signedData");
 var OID_SKI = O("subjectKeyIdentifier");
 
 
-// The message digest of the content under the digest algorithm (SHA-2 or SHAKE256).
+// The message digest of the content under the digest algorithm, resolved to a Buffer.
 function _digest(digestName, content) {
-  var h = SHAKE_OUT[digestName]
-    ? nodeCrypto.createHash(NODE_DIGEST[digestName], { outputLength: SHAKE_OUT[digestName] })
-    : nodeCrypto.createHash(NODE_DIGEST[digestName]);
-  return h.update(content).digest();
+  return subtle.digest(DIGEST_HASH[digestName], content).then(function (d) { return Buffer.from(d); });
 }
 
 
@@ -140,13 +144,15 @@ function _buildSignerInfo(signer, content, eContentType, opts) {
     if (opts.signedAttributes === false) return content;   // sign the content directly (no signed attributes)
     // Signed attributes (RFC 5652 sec. 5.3): content-type == eContentType, message-digest ==
     // digest(content), and (by default) signing-time, plus any caller-supplied attribute.
-    var pairs = [
-      { type: O("contentType"), values: [b.oid(eContentType)] },
-      { type: O("messageDigest"), values: [b.octetString(_digest(scheme.digest, content))] },
-    ];
-    if (opts.signingTime !== false) pairs.push({ type: O("signingTime"), values: [_timeValue(opts.signingTime)] });
-    pairs = pairs.concat(_resolveAttrPairs(opts.additionalSignedAttributes, "a signed attribute value"));
-    return _buildSignedAttrs(pairs);
+    return _digest(scheme.digest, content).then(function (md) {
+      var pairs = [
+        { type: O("contentType"), values: [b.oid(eContentType)] },
+        { type: O("messageDigest"), values: [b.octetString(md)] },
+      ];
+      if (opts.signingTime !== false) pairs.push({ type: O("signingTime"), values: [_timeValue(opts.signingTime)] });
+      pairs = pairs.concat(_resolveAttrPairs(opts.additionalSignedAttributes, "a signed attribute value"));
+      return _buildSignedAttrs(pairs);
+    });
   }).then(function (toSign) {
     var signedBytes = toSign.setOf ? toSign.setOf : toSign;   // SET-OF form for signing (sec. 5.4)
     return signScheme.signOverTbs(scheme, so.key, signedBytes, _signE).then(function (sig) {
@@ -272,11 +278,13 @@ function _buildCountersignature(targetSigOctets, countersigner, opts) {
   var sidv = _buildSid(cert, opts.sid === "ski");
   return Promise.resolve().then(function () {
     if (opts.signedAttributes === false) return null;   // sign the target signature octets directly
-    var pairs = [{ type: O("messageDigest"), values: [b.octetString(_digest(scheme.digest, targetSigOctets))] }];
-    if (opts.signingTime !== false) pairs.push({ type: O("signingTime"), values: [_timeValue(opts.signingTime)] });
-    var extra = _resolveAttrPairs(opts.additionalSignedAttributes, "a countersignature signed attribute value");
-    extra.forEach(function (p) { if (p.type === O("contentType")) throw _err("cms/bad-input", "a countersignature must not carry a content-type attribute (RFC 5652 sec. 11.4)"); });
-    return _buildSignedAttrs(pairs.concat(extra));
+    return _digest(scheme.digest, targetSigOctets).then(function (md) {
+      var pairs = [{ type: O("messageDigest"), values: [b.octetString(md)] }];
+      if (opts.signingTime !== false) pairs.push({ type: O("signingTime"), values: [_timeValue(opts.signingTime)] });
+      var extra = _resolveAttrPairs(opts.additionalSignedAttributes, "a countersignature signed attribute value");
+      extra.forEach(function (p) { if (p.type === O("contentType")) throw _err("cms/bad-input", "a countersignature must not carry a content-type attribute (RFC 5652 sec. 11.4)"); });
+      return _buildSignedAttrs(pairs.concat(extra));
+    });
   }).then(function (attrs) {
     return signScheme.signOverTbs(scheme, so.key, attrs ? attrs.setOf : targetSigOctets, _signE).then(function (sig) {
       var fields = [b.integer(BigInt(sidv.version)), sidv.sid, scheme.digestAlgId];

package/lib/cms-verify.js

@@ -26,7 +26,6 @@
  * @card Verify a CMS SignedData signature (S/MIME, timestamps, code signing).
  */
 
-var nodeCrypto = require("crypto");
 var asn1 = require("./asn1-der");
 var oid = require("./oid");
 var x509 = require("./schema-x509");
@@ -53,16 +52,26 @@ var OID_MESSAGE_DIGEST = oid.byName("messageDigest");
 var OID_CONTENT_TYPE = oid.byName("contentType");
 var OID_COUNTERSIGNATURE = oid.byName("countersignature");
 
-// A digest-algorithm name -> the WebCrypto hash.
-var DIGEST_HASH = { sha1: "SHA-1", sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" };
-// SHAKE256 (RFC 8419 sec. 2.3, the Ed448 message digest) has no WebCrypto hash, so it is computed
-// with node:crypto; its 512-bit (64-byte) output length is fixed by the profile.
-var SHAKE_OUT = { shake128: 32, shake256: 64 };   // SHAKE128 256-bit (RFC 9814 sec. 4), SHAKE256 512-bit
-// Is `name` a message-digest algorithm this verifier supports (SHA-2 family or SHAKE256)?
-function _supportedDigest(name) { return !!(DIGEST_HASH[name] || SHAKE_OUT[name]); }
+// A digest-algorithm name -> the engine's hash name, for computing a MESSAGE DIGEST (the
+// message-digest attribute and the content digest). The FIPS 202 extendable-output functions
+// belong here at the lengths RFC 8702 sec. 4 fixes for that use (SHAKE128 32 bytes, SHAKE256 64).
+var DIGEST_HASH = {
+  sha1: "SHA-1", sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512",
+  shake128: "SHAKE128", shake256: "SHAKE256",
+};
+// The SIGNATURE hash a bare-key-OID scheme (rsaEncryption, ecPublicKey) inherits from the
+// SignerInfo digestAlgorithm. Deliberately a SEPARATE table from DIGEST_HASH, and deliberately
+// without the extendable-output functions: RFC 8702 sec. 3.2 gives RSASSA-PKCS1-v1_5-with-SHAKE
+// and ECDSA-with-SHAKE their OWN signature OIDs and never pairs a bare key OID with a SHAKE
+// digestAlgorithm, so that combination is non-conformant and must keep its precise refusal.
+// Folding the two roles into one table would resolve a signature hash for it instead, letting
+// it past the fail-closed gate below and into the engine, where it surfaces as a relabeled
+// foreign fault rather than this module's own unsupported-algorithm verdict.
+var SIG_HASH = { sha1: "SHA-1", sha256: "SHA-256", sha384: "SHA-384", sha512: "SHA-512" };
+// Is `name` a message-digest algorithm this verifier supports?
+function _supportedDigest(name) { return !!DIGEST_HASH[name]; }
 // The digest of `content` under the named algorithm, resolved to a Buffer.
 function _computeDigest(name, content) {
-  if (SHAKE_OUT[name]) return Promise.resolve(nodeCrypto.createHash(name, { outputLength: SHAKE_OUT[name] }).update(content).digest());
   return subtle.digest(DIGEST_HASH[name], content).then(function (d) { return Buffer.from(d); });
 }
 // A signatureAlgorithm name -> its verify scheme. A combined OID (sha256WithRSAEncryption,
@@ -322,7 +331,7 @@ function _verifyOne(si, content, eContentType, parsedCerts, csTarget) {
   if (composite) return _verifyComposite(si, composite, content, eContentType, parsedCerts, csTarget);
   var scheme = SIG_SCHEME[si.signatureAlgorithm.name];
   if (!scheme) return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "unsupported signature algorithm " + JSON.stringify(si.signatureAlgorithm.name) });
-  var digestHash = DIGEST_HASH[si.digestAlgorithm.name];
+  var digestHash = SIG_HASH[si.digestAlgorithm.name];
   // RSASSA-PSS takes its signature hash and salt length from the RSASSA-PSS-params, not the
   // digestAlgorithm; a non-conformant parameter set is a fail-closed unsupported verdict.
   var pss = scheme.kind === "rsapss" ? _resolvePss(si.signatureAlgorithm.parameters) : null;
@@ -458,8 +467,8 @@ function _verifyComposite(si, comp, content, eContentType, parsedCerts, csTarget
   if (si.signatureAlgorithm.parameters !== null && si.signatureAlgorithm.parameters !== undefined) {
     return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "the composite signatureAlgorithm parameters must be absent (draft-ietf-lamps-cms-composite-sigs sec. 3.4)" });
   }
-  // The 3 arms Node's WebCrypto surface cannot verify (brainpool curves; the SHAKE256/64 pre-hash)
-  // fail closed -- never a silent single-component accept (the AND->OR downgrade this feature prevents).
+  // The 2 arms Node's WebCrypto surface cannot verify (the brainpool curves) fail closed --
+  // never a silent single-component accept (the AND->OR downgrade this feature prevents).
   if (comp.trad.unsupported) {
     return Promise.resolve({ ok: false, code: "cms/unsupported-algorithm", sid: si.sid, message: "composite " + comp.name + ": " + comp.trad.unsupported });
   }

package/lib/composite-sig.js

@@ -54,9 +54,9 @@ var PH_CMS = { "SHA-256": "sha256", "SHA-512": "sha512", "SHAKE256": "shake256"
 var COMPOSITE_ALGS = {};
 // _comp(name, mldsa, ph, label, trad). `trad` is exactly one component shape:
 //   { ec, hash } | { eddsa } | { rsaPss, hash, salt } | { rsaPkcs1, hash } |
-//   { unsupported } for the arms Node's WebCrypto surface cannot verify (brainpool
-//   curves; the SHAKE256/64 pre-hash) -- registered + params-guarded, deferred at
-//   verify to the caller's unsupported-algorithm code rather than silently accepted.
+//   { unsupported } for the arms Node's WebCrypto surface cannot verify (the two
+//   brainpool curves) -- registered + params-guarded, deferred at verify to the
+//   caller's unsupported-algorithm code rather than silently accepted.
 function _comp(name, mldsa, ph, label, trad) {
   var sz = MLDSA_COMPONENT[mldsa];
   COMPOSITE_ALGS[oid.byName(name)] = {
@@ -78,7 +78,7 @@ _comp("id-MLDSA65-ECDSA-brainpoolP256r1-SHA512", "ML-DSA-65", "SHA-512", "COMPSI
 _comp("id-MLDSA65-Ed25519-SHA512", "ML-DSA-65", "SHA-512", "COMPSIG-MLDSA65-Ed25519-SHA512", { eddsa: "Ed25519" });
 _comp("id-MLDSA87-ECDSA-P384-SHA512", "ML-DSA-87", "SHA-512", "COMPSIG-MLDSA87-ECDSA-P384-SHA512", { ec: "P-384", hash: "SHA-384" });
 _comp("id-MLDSA87-ECDSA-brainpoolP384r1-SHA512", "ML-DSA-87", "SHA-512", "COMPSIG-MLDSA87-ECDSA-BP384-SHA512", { unsupported: "brainpoolP384r1 is not in the WebCrypto ECDSA curve set" });
-_comp("id-MLDSA87-Ed448-SHAKE256", "ML-DSA-87", "SHAKE256", "COMPSIG-MLDSA87-Ed448-SHAKE256", { unsupported: "the SHAKE256/64 pre-hash is not in the WebCrypto digest set" });
+_comp("id-MLDSA87-Ed448-SHAKE256", "ML-DSA-87", "SHAKE256", "COMPSIG-MLDSA87-Ed448-SHAKE256", { eddsa: "Ed448" });
 _comp("id-MLDSA87-RSA3072-PSS-SHA512", "ML-DSA-87", "SHA-512", "COMPSIG-MLDSA87-RSA3072-PSS-SHA512", { rsaPss: true, hash: "SHA-256", salt: 32, rsaBits: 3072 });
 _comp("id-MLDSA87-RSA4096-PSS-SHA512", "ML-DSA-87", "SHA-512", "COMPSIG-MLDSA87-RSA4096-PSS-SHA512", { rsaPss: true, hash: "SHA-384", salt: 48, rsaBits: 4096 });
 _comp("id-MLDSA87-ECDSA-P521-SHA512", "ML-DSA-87", "SHA-512", "COMPSIG-MLDSA87-ECDSA-P521-SHA512", { ec: "P-521", hash: "SHA-512" });

package/lib/constants.js

@@ -284,6 +284,19 @@ var LIMITS = {
   // output is materialized (a decompression-bomb / resource-exhaustion defense, CWE-409); a caller may
   // tighten it DOWNWARD via opts.maxOutputBytes, never loosen it.
   COMPRESS_MAX_BYTES: BYTES.mib(16),
+  // The largest TLS handshake message body. RFC 8446 sec. 4 frames every Handshake with a uint24
+  // length, so a Certificate message cannot exceed 2^24-1 bytes -- the ceiling RFC 8879 sec. 5
+  // requires a CompressedCertificate to respect ("they MUST apply the same limit as if no
+  // compression were used"). That section spells the number 16777216, which is one MORE than any
+  // uint24 can express; the field width governs, so this is deliberately not mib(16).
+  TLS_CERT_MSG_MAX_BYTES: BYTES.mib(16) - 1,
+  // The most CertificateEntry elements a TLS Certificate message may carry. The byte ceiling
+  // alone does not bound this: the smallest legal entry is 6 bytes (a uint24 length, one payload
+  // octet, an empty uint16 extensions vector), so a message inside the framing limit can declare
+  // millions of them and each costs far more heap than wire -- an allocation DoS (CWE-770) that
+  // terminates but exhausts memory. This matches PATH_MAX_CERTS: a chain longer than the path
+  // validator will ever accept has nothing to offer, so refusing it at the decoder is free.
+  TLS_CERT_MAX_ENTRIES: 100,
   // ACME challenge token entropy floor (RFC 8555 sec. 8, errata 6950): >= 128
   // bits of base64url is >= 22 characters. A shorter token is refused before use.
   ACME_TOKEN_MIN_CHARS: 22,

package/lib/framework-error.js

@@ -231,6 +231,15 @@ var SmimeError = defineClass("SmimeError", { withCause: true });
 // inner `asn1/*` decode error) as `.cause`.
 var CtError = defineClass("CtError", { withCause: true });
 
+// TlsError -- a byte sequence that is not a well-formed TLS handshake structure:
+// an RFC 8879 CompressedCertificate whose framing is violated (a lying vector
+// length, a field read past its bound, an empty compressed message), whose
+// compression algorithm this toolkit does not implement or the caller did not
+// offer, whose declared uncompressed length disagrees with what the stream
+// actually produces, or whose compressed body is a decompression bomb. Carries
+// the underlying leaf fault (the decompressor's own error) as `.cause`.
+var TlsError = defineClass("TlsError", { withCause: true });
+
 // C509Error -- a CBOR byte sequence that is not a well-formed C509 certificate
 // (draft-ietf-cose-cbor-encoded-cert): a root that is not the 11-element array, a
 // c509CertificateType outside {2,3}, a field encoded against its ~biguint/~time/~oid
@@ -359,6 +368,7 @@ module.exports = {
   CmpError:         CmpError,
   PathError:        PathError,
   CtError:          CtError,
+  TlsError:         TlsError,
   C509Error:        C509Error,
   ShbsError:        ShbsError,
   HpkeError:        HpkeError,

package/lib/guard-all.js

@@ -34,6 +34,9 @@
 //   guard.identifier.assertCanonicalOid
 //                                     -- canonical dotted-decimal OID string form
 //                                        (canonicalization-divergence defence)
+//   guard.compress.bounded            -- decompress an untrusted stream under a hard
+//                                        output cap, whole-input (decompression-bomb +
+//                                        trailing-frame malleability defence)
 //   guard.header.assertField          -- emitted MIME/RFC 5322 header field name +
 //                                        value integrity (CR/LF/NUL header-injection
 //                                        defence, CWE-93)
@@ -55,6 +58,7 @@ var encoding = require("./guard-encoding");
 var json   = require("./guard-json");
 var identifier = require("./guard-identifier");
 var header = require("./guard-header");
+var compress = require("./guard-compress");
 
 module.exports = {
   bytes:  bytes,
@@ -68,4 +72,5 @@ module.exports = {
   json:   json,
   identifier: identifier,
   header: header,
+  compress: compress,
 };

package/lib/guard-compress.js

@@ -0,0 +1,164 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+//
+// @internal -- no operator-facing namespace. The documented surface is the
+// consumers whose decompression composes this guard (pki.cms.decompress,
+// pki.tls.decompressCertificate).
+//
+// guard-compress -- bounded, non-malleable decompression of an untrusted stream.
+// Node's zlib / brotli / zstd decompressors are by default both UNBOUNDED and
+// PERMISSIVE, and each is a distinct vulnerability class:
+//
+//   * Unbounded output (CWE-409, decompression bomb) -- a few hundred bytes
+//     expand to gigabytes. `maxOutputLength` refuses the moment the output WOULD
+//     exceed the bound; it does not allocate the whole output and then measure.
+//     So the cap has to be applied AT the call and can never be a check on the
+//     returned value.
+//   * Trailing input silently ignored (CWE-20, canonicalization malleability) --
+//     all three stop at the end of the first complete frame and discard whatever
+//     follows, so a caller may append arbitrary bytes, or a second entire frame,
+//     and still recover byte-identical output. One content would then have
+//     unboundedly many encodings, and a digest over the compressed object would
+//     stop identifying what it decompresses to.
+//
+// Both defences are applied here, once, for every algorithm, so a new consumer
+// cannot pick up one and miss the other. Verified uniform across zlib, brotli
+// and zstd: each reports consumed input as `engine.bytesWritten` under
+// `info: true`, each raises ERR_BUFFER_TOO_LARGE on a cap breach, and each
+// accepts trailing bytes when left unchecked.
+//
+// E is the caller's (code, message, cause) typed-error FACTORY -- never an error
+// class. Passing a class here crashes on the error path ("class cannot be invoked
+// without new"), which converts a rejection into a fail-open. `codes` names the
+// two verdicts a caller distinguishes: `tooLarge` when the output would exceed
+// the cap, `failed` for every other fault. Every non-cap fault collapses to one
+// code deliberately -- a per-errno surface is attack telemetry.
+
+var zlib = require("zlib");
+
+// The decompressor per algorithm: a registry, so a new algorithm is a row rather
+// than a branch and an unrecognized name fails closed.
+var DECOMPRESS = {
+  zlib: zlib.inflateSync,               // RFC 1950
+  brotli: zlib.brotliDecompressSync,    // RFC 7932
+  zstd: zlib.zstdDecompressSync,        // RFC 8478
+};
+
+// The compressors, used ONLY by the truncation probe below. Producing a compressed stream is
+// not the guarded shape -- decompressing an untrusted one is.
+var _PROBE_COMPRESS = {
+  zlib: zlib.deflateSync,
+  brotli: zlib.brotliCompressSync,
+  zstd: zlib.zstdCompressSync,
+};
+
+// A decompressor must REPORT a frame it could not finish. Not all of them do: on some supported
+// runtimes the zstd binding returns a SHORT (often empty) result for a truncated frame instead
+// of faulting, and reports the entire input as consumed -- so neither the returned bytes nor the
+// consumed-length check below can see that the frame was cut. That is a silent truncation: a peer
+// strips a frame's tail and the receiver processes a prefix as though it were the whole message.
+//
+// An algorithm whose runtime cannot report this cannot be decompressed safely here, so it is
+// dropped from the advertised set at load rather than accepted with a defect. Consumers build
+// their wire registries by intersecting with algorithms(), so a protocol simply does not offer
+// or accept it, and it returns on its own once the runtime reports truncation.
+// Nothing here is enabled by an exception alone: an algorithm qualifies only by POSITIVE proof
+// that a whole frame round-trips AND that a cut frame is refused. Every other outcome -- a
+// missing function, a compressor fault, a wrong round-trip, an unrelated error -- leaves it out.
+//
+// Coverage residual: the early-return branches are reachable only on a runtime whose own
+// compression library is broken (a missing export, a compressor that throws on 46 ASCII bytes, a
+// round-trip that does not reproduce its input). The tables are captured at module load, so those
+// states cannot be induced from a test without replacing node:zlib beforehand -- and forcing them
+// would assert nothing about the property this function exists to establish. They stay because
+// their absence is what would make a broken runtime silently qualify an algorithm.
+function _reportsTruncation(name) {
+  var compress = _PROBE_COMPRESS[name];
+  var decompress = DECOMPRESS[name];
+  if (typeof compress !== "function" || typeof decompress !== "function") return false;
+  var sample = Buffer.from("0123456789abcdefghijklmnopqrstuvwxyz0123456789");
+  var frame, whole;
+  try { frame = compress(sample); }
+  catch (_e) { /* allow:swallow-unverified a compressor that cannot compress 46 ASCII bytes is a broken runtime; the algorithm simply does not qualify, which is the fail-closed direction */ return false; }
+  // A cut of 2 removes the frame's end marker; the sample is long enough that what remains is
+  // still a plausible frame head rather than nothing at all.
+  if (!Buffer.isBuffer(frame) || frame.length < 4) return false;
+  try { whole = decompress(frame, { maxOutputLength: 4096 }); }
+  catch (_e2) { /* allow:swallow-unverified a decompressor that rejects its own compressor's whole frame is a broken runtime; the algorithm does not qualify, again fail-closed */ return false; }
+  if (!Buffer.isBuffer(whole) || !whole.equals(sample)) return false;
+  // The cut frame must be REFUSED. A returned value of any length -- including the empty buffer
+  // some bindings hand back -- means a truncation would pass through unseen.
+  var cutAccepted = false;
+  try {
+    decompress(frame.subarray(0, frame.length - 2), { maxOutputLength: 4096 });
+    cutAccepted = true;
+  } catch (_e3) { /* refused, as a decompressor handed an unfinished frame must */ }
+  return !cutAccepted;
+}
+
+var SAFE = {};
+Object.keys(DECOMPRESS).forEach(function (n) { if (_reportsTruncation(n)) SAFE[n] = true; });
+
+// bounded(algorithm, stream, cap, E, codes, label) -> Buffer. Decompress `stream`
+// under `algorithm`, refusing any output that would exceed `cap` bytes and any
+// input carrying bytes past the end of the compressed frame.
+// The shape is the DECOMPRESSOR CALL ITSELF, not the presence of a cap: an
+// uncapped call is precisely the dangerous form, so keying on `maxOutputLength`
+// would fire on the safe re-inline and stay silent on the unsafe one. Every
+// decompression in lib/ therefore belongs to this module or routes through it.
+// @enforced-by guard-shape-reinlined
+// @guard-shape \bzlib\.(inflate|brotliDecompress|zstdDecompress)Sync\b
+// @guard-via \bguard\.compress\.bounded\s*\(
+function bounded(algorithm, stream, cap, E, codes, label) {
+  var decompress = DECOMPRESS[algorithm];
+  // An unknown algorithm -- or one this runtime cannot decompress safely -- is an authoring
+  // fault, not untrusted input: a caller resolves a wire value to a name against algorithms()
+  // and rejects one it does not find, before reaching here. Arriving with a name outside that
+  // set means the consumer skipped the step, so it faults loudly rather than silently.
+  if (!Object.prototype.hasOwnProperty.call(SAFE, algorithm) || !decompress) {
+    throw new TypeError("guard.compress.bounded: unknown or unsafe algorithm " + JSON.stringify(algorithm));
+  }
+  // The byte-source normalization is guard.bytes.view's job and belongs at the
+  // consumer's boundary; reaching here with anything else means it was skipped.
+  if (!Buffer.isBuffer(stream)) {
+    throw new TypeError("guard.compress.bounded: stream must be a Buffer (route the input through guard.bytes.view first)");
+  }
+  // The ceiling is an authoring input: an undefined / NaN / fractional / negative
+  // cap would silently disable the bomb defence. It must also be at least 1 --
+  // node rejects maxOutputLength 0 with a different fault than a cap breach, so a
+  // zero cap would surface as a malformed-stream verdict rather than a config error.
+  if (!Number.isInteger(cap) || cap < 1) {
+    throw new TypeError("guard.compress.bounded: cap must be a positive integer");
+  }
+  var what = label || "the compressed input";
+  var res;
+  try {
+    res = decompress(stream, { maxOutputLength: cap, info: true });
+  } catch (e) {
+    if (e && e.code === "ERR_BUFFER_TOO_LARGE") {
+      throw E(codes.tooLarge, what + " decompresses to more than the " + cap + "-byte cap (a decompression-bomb defense)", e);
+    }
+    throw E(codes.failed, what + " could not be decompressed", e);
+  }
+  // `bytesWritten` is the count of INPUT bytes the engine consumed. A frame that
+  // ends before the input does means the remainder was ignored -- the malleability
+  // above -- so the whole input must be exactly one frame.
+  var consumed = res.engine.bytesWritten;
+  if (consumed !== stream.length) {
+    throw E(codes.failed, what + " carries " + (stream.length - consumed) +
+      " trailing byte(s) after the end of the compressed stream");
+  }
+  return res.buffer;
+}
+
+// The algorithm names this guard can decompress SAFELY on this runtime -- the registry
+// minus any whose decompressor cannot report an unfinished frame. A consumer intersects
+// its protocol's algorithm registry with this, so it never advertises or accepts something
+// it could not refuse a truncation of.
+// @enforced-by behavioral -- a read-only list of the safe registry's keys has no
+// rename-proof code shape to re-inline; the guard's reject path is the contract,
+// and a consumer offering an algorithm this list omits fails closed at `bounded`.
+function algorithms() { return Object.keys(SAFE); }
+
+module.exports = { bounded: bounded, algorithms: algorithms };