@blamejs/pki 0.5.15 → 0.5.17

package/lib/guard-parsed.js

@@ -40,9 +40,41 @@
 
 var bytes = require("./guard-bytes");
 var time = require("./guard-time");
+// The array test, taken at load. Every shape check below asks it whether a field IS a list, and
+// one answering `false` makes each of those checks reject a well-formed parsed structure -- the
+// fail-closed direction, and still a caller deciding what this guard recognizes.
+var _isArray = require("./guard-intrinsic").isArray;
+// The copy that becomes the recorded provenance bytes. A replacement returning a buffer over the
+// caller's own memory would let those bytes change after they were recorded, which is the one
+// thing provenance exists to prevent.
+var _bufferFrom = require("./guard-intrinsic").bufferFrom;
+// The sentinel the chain walk below stops at. Reached as a property of a replaceable global, a
+// replacement makes the walk run past the top and report inherited names as the value's own.
+var _ObjectProto = require("./guard-intrinsic").ObjectProto;
+// The rest of what this module reads from the runtime, taken at load. The shape checks below ask
+// these what a value IS and how it is put together, so a replacement decides what this guard
+// recognizes as parser output. See guard-intrinsic for the whole captured set.
+var _isBuffer = require("./guard-intrinsic").isBuffer;
+var _create = require("./guard-intrinsic").create;
+var _assign = require("./guard-intrinsic").assign;
+var _getPrototypeOf = require("./guard-intrinsic").getPrototypeOf;
+var _getOwnPropertyNames = require("./guard-intrinsic").getOwnPropertyNames;
+// The array operations, uncurried. Each shape check below asks `every` whether a list's members
+// are all well formed, so one replaced to return true makes every malformed list pass.
+var _every = require("./guard-intrinsic").every;
+// The provenance store's own operations. This WeakMap is what says a value came out of this
+// toolkit's parser, so a `get` that answers for a key never stored hands the door a forged
+// provenance record, and a `has` that answers true admits an object the parser never produced.
+var _weakGet = require("./guard-intrinsic").weakGet;
+var _weakSet = require("./guard-intrinsic").weakSet;
+var _weakHas = require("./guard-intrinsic").weakHas;
+var _WeakMap = require("./guard-intrinsic").WeakMap;
+var _defineProperty = require("./guard-intrinsic").defineProperty;
+// Appended by index rather than through `push`, so the growth reads no prototype method at all.
+function _append(arr, v) { _defineProperty(arr, arr.length, { value: v, writable: true, enumerable: true, configurable: true }); }
 
 // Every form the toolkit calls "bytes": a Buffer, any typed-array view, a DataView, or a bare
-// ArrayBuffer. Testing `Buffer.isBuffer(x) || x instanceof Uint8Array` is narrower than what the
+// ArrayBuffer. Testing `_isBuffer(x) || x instanceof Uint8Array` is narrower than what the
 // verbs document, and the narrowness is invisible in the good case: an ArrayBuffer would fall
 // through to the object branch and be refused as a rebuilt structure, which reads to the caller as
 // "your certificate is malformed" when what happened is that their container was not recognized.
@@ -92,15 +124,15 @@ function _isAttributeTypeAndValue(a) {
   return !!a && typeof a.type === "string" && _isOptName(a.name) && typeof a.value === "string";
 }
 function _isRdnSequence(rdns) {
-  if (!Array.isArray(rdns)) return false;
+  if (!_isArray(rdns)) return false;
   for (var i = 0; i < rdns.length; i++) {
-    if (!Array.isArray(rdns[i]) || rdns[i].length === 0) return false;
-    if (!rdns[i].every(_isAttributeTypeAndValue)) return false;
+    if (!_isArray(rdns[i]) || rdns[i].length === 0) return false;
+    if (!_every(rdns[i], _isAttributeTypeAndValue)) return false;
   }
   return true;
 }
 function _isName(n) {
-  return !!n && _isRdnSequence(n.rdns) && Buffer.isBuffer(n.bytes) && typeof n.dn === "string";
+  return !!n && _isRdnSequence(n.rdns) && _isBuffer(n.bytes) && typeof n.dn === "string";
 }
 
 // `name` is the registry lookup of the OID and is null for an OID the registry does
@@ -109,11 +141,11 @@ function _isOptName(v) { return typeof v === "string" || v === null; }
 
 function _isAlgorithmIdentifier(a) {
   return !!a && typeof a.oid === "string" && _isOptName(a.name) &&
-    (Buffer.isBuffer(a.parameters) || a.parameters === null);
+    (_isBuffer(a.parameters) || a.parameters === null);
 }
 
 function _isBitString(b) {
-  return !!b && Buffer.isBuffer(b.bytes) && typeof b.unusedBits === "number";
+  return !!b && _isBuffer(b.bytes) && typeof b.unusedBits === "number";
 }
 
 // A parsed certificate extension entry: dispatched on `.oid`, gated on `.critical`,
@@ -124,7 +156,7 @@ function _isBitString(b) {
 // skipped iteration.
 function _isExtensionEntry(e) {
   return !!e && typeof e.oid === "string" && _isOptName(e.name) &&
-    typeof e.critical === "boolean" && Buffer.isBuffer(e.value);
+    typeof e.critical === "boolean" && _isBuffer(e.value);
 }
 
 // A parsed CRL extension entry. The CRL parser decodes the values it knows (a
@@ -147,7 +179,7 @@ function _isCrlExtensionEntry(e) {
 //   testing tbsBytes and returning the object is the re-inline this replaces.
 function isCert(o) {
   return !!o && typeof o === "object" &&
-    Buffer.isBuffer(o.tbsBytes) &&
+    _isBuffer(o.tbsBytes) &&
     typeof o.version === "number" &&
     typeof o.serialNumber === "bigint" &&
     typeof o.serialNumberHex === "string" &&
@@ -157,10 +189,10 @@ function isCert(o) {
     !!o.validity && time.isDate(o.validity.notBefore) && time.isDate(o.validity.notAfter) &&
     _isName(o.issuer) &&
     _isName(o.subject) &&
-    !!o.subjectPublicKeyInfo && Buffer.isBuffer(o.subjectPublicKeyInfo.bytes) &&
+    !!o.subjectPublicKeyInfo && _isBuffer(o.subjectPublicKeyInfo.bytes) &&
     _isAlgorithmIdentifier(o.subjectPublicKeyInfo.algorithm) &&
     _isBitString(o.subjectPublicKeyInfo.publicKey) &&
-    Array.isArray(o.extensions) && o.extensions.every(_isExtensionEntry);
+    _isArray(o.extensions) && _every(o.extensions, _isExtensionEntry);
 }
 
 // isCrl(o) -- the complete parsed-CertificateList shape. `crlExtensions` and each
@@ -173,19 +205,19 @@ function isCert(o) {
 // @enforced-by guard-shape-reinlined -- shares the `accept` shape below.
 function isCrl(o) {
   return !!o && typeof o === "object" &&
-    Buffer.isBuffer(o.tbsBytes) &&
+    _isBuffer(o.tbsBytes) &&
     typeof o.version === "number" &&
     _isAlgorithmIdentifier(o.signatureAlgorithm) &&
     _isBitString(o.signatureValue) &&
     _isName(o.issuer) &&
     time.isDate(o.thisUpdate) &&
     (o.nextUpdate === null || time.isDate(o.nextUpdate)) &&
-    Array.isArray(o.crlExtensions) && o.crlExtensions.every(_isCrlExtensionEntry) &&
-    Array.isArray(o.revokedCertificates) && o.revokedCertificates.every(function (e) {
+    _isArray(o.crlExtensions) && _every(o.crlExtensions, _isCrlExtensionEntry) &&
+    _isArray(o.revokedCertificates) && _every(o.revokedCertificates, function (e) {
       return !!e && typeof e.serialNumber === "bigint" &&
         typeof e.serialNumberHex === "string" &&
         time.isDate(e.revocationDate) &&
-        Array.isArray(e.crlEntryExtensions) && e.crlEntryExtensions.every(_isCrlExtensionEntry);
+        _isArray(e.crlEntryExtensions) && _every(e.crlEntryExtensions, _isCrlExtensionEntry);
     });
 }
 
@@ -207,7 +239,10 @@ function _safe(shape) {
 var certShape = _safe(isCert);
 var crlShape = _safe(isCrl);
 
-var _SHAPES = { certificate: certShape, crl: crlShape };
+// Null-prototype: this table decides which kinds are recognized, and the lookup below is what the
+// unknown-kind refusal rests on. Built on a `{}`, a planted `Object.prototype[kind]` supplies a
+// predicate for a kind the table never carried, and an unrecognized structure is then authorized.
+var _SHAPES = _assign(_create(null), { certificate: certShape, crl: crlShape });
 
 // accept(input, kind, parse, E, code, label) -> the parsed structure | throws
 //
@@ -288,8 +323,8 @@ function accept(input, kind, parse, E, code, label) {
 //     answered for), so a Proxy could claim any mark and name any bytes. A WeakMap
 //     lookup is on identity: a Proxy is a different object from the parser's result
 //     and simply is not a key.
-//   - `Object.create(parsed)` is likewise a different object, so it inherits no
-//     record, while `Object.assign({}, parsed)` and `{...parsed}` are different
+//   - `_create(parsed)` is likewise a different object, so it inherits no
+//     record, while `_assign({}, parsed)` and `{...parsed}` are different
 //     objects too. All three, the ways a mixed structure is actually assembled,
 //     fall out of the same rule, with no need for three checks.
 //
@@ -301,7 +336,7 @@ function accept(input, kind, parse, E, code, label) {
 // This is not a signature check and does not pretend to be. It says only "verify the
 // bytes this object was parsed from", which is precisely the claim the three-part
 // check was resting on without ever asking for it.
-var PROVENANCE = new WeakMap();
+var PROVENANCE = new _WeakMap();
 
 // recordingParser(kind, parse) -> a parser that records what it parsed.
 //
@@ -340,7 +375,7 @@ function recordingParser(kind, parse, ErrorClass, code, label) {
     // re-derivation would faithfully reproduce whatever was written. A record the object can reach
     // is not a record of anything. This copy is never handed out and nothing aliases it.
     if (out && typeof out === "object") {
-      PROVENANCE.set(out, { kind: kind, source: isText ? snap : Buffer.from(snap),
+      _weakSet(PROVENANCE, out, { kind: kind, source: isText ? snap : _bufferFrom(snap),
         shape: _shapeOf(out) });
     }
     return out;
@@ -370,9 +405,9 @@ function recordingWalker(kind, walkNode, decodeBytes) {
   return function (node) {
     var out = walkNode(node);
     if (out && typeof out === "object" && node && _isBytes(node.bytes)) {
-      PROVENANCE.set(out, {
+      _weakSet(PROVENANCE, out, {
         kind: kind,
-        source: Buffer.from(node.bytes),
+        source: _bufferFrom(node.bytes),
         shape: _shapeOf(out),
         derive: function (src) { return walkNode(decodeBytes(src)); },
       });
@@ -385,7 +420,7 @@ function recordingWalker(kind, walkNode, decodeBytes) {
 // property of `obj` at all -- the lookup is on the object's identity.
 function _recordOf(obj, kind) {
   if (!obj || typeof obj !== "object") return undefined;
-  var rec = PROVENANCE.get(obj);
+  var rec = _weakGet(PROVENANCE, obj);
   return (rec && rec.kind === kind) ? rec : undefined;
 }
 
@@ -400,7 +435,7 @@ function _recordOf(obj, kind) {
 //   is the RED vector that passes a parsed certificate through a producing verb's spec and asserts
 //   the integrity door still accepts it, which fails the moment a copy is taken instead.
 function isRecorded(obj) {
-  return !!obj && typeof obj === "object" && PROVENANCE.has(obj);
+  return !!obj && typeof obj === "object" && _weakHas(PROVENANCE, obj);
 }
 
 // isRecordedAsProduced(obj) -> whether this is a recorded structure that still has the field set
@@ -423,7 +458,7 @@ function isRecorded(obj) {
 //   asserts the value the verb used is the one that was there at entry.
 function isRecordedAsProduced(obj) {
   if (!isRecorded(obj)) return false;
-  var shape = PROVENANCE.get(obj).shape;
+  var shape = _weakGet(PROVENANCE, obj).shape;
   var keys = _allNames(obj);
   for (var i = 0; i < keys.length; i++) {
     if (!shape[keys[i]]) return false;
@@ -432,7 +467,7 @@ function isRecordedAsProduced(obj) {
 }
 
 function _shapeOf(obj) {
-  var shape = Object.create(null);
+  var shape = _create(null);
   var keys = _allNames(obj);
   for (var i = 0; i < keys.length; i++) shape[keys[i]] = true;
   return shape;
@@ -443,13 +478,13 @@ function _shapeOf(obj) {
 // `Object.keys` would miss a field added with defineProperty and call the object unchanged.
 function _allNames(obj) {
   var names = [];
-  var seen = Object.create(null);
-  for (var o = obj; o && o !== Object.prototype; o = Object.getPrototypeOf(o)) {
-    var own = Object.getOwnPropertyNames(o);
+  var seen = _create(null);
+  for (var o = obj; o && o !== _ObjectProto; o = _getPrototypeOf(o)) {
+    var own = _getOwnPropertyNames(o);
     for (var i = 0; i < own.length; i++) {
       if (seen[own[i]]) continue;
       seen[own[i]] = true;
-      names.push(own[i]);
+      _append(names, own[i]);
     }
   }
   return names;
@@ -516,22 +551,24 @@ function fromTrustedSource(input, kind, claimFields, parse, E, code, why) {
 // security-relevant field would therefore change no verdict. What the list decides is narrower: it
 // separates "an object claiming to be a parse result" from "bytes", so the first gets this domain's
 // typed refusal instead of being handed to a byte parser.
-var _CLAIMS = {
+// Null-prototype, for the same reason as _SHAPES: an inherited entry standing in for an absent one
+// makes an unrecognized kind look recognized, and the refusal keyed on its absence never fires.
+var _CLAIMS = _assign(_create(null), {
   certificate: ["tbsBytes", "subjectPublicKeyInfo", "serialNumberHex"],
   crl: ["tbsBytes", "revokedCertificates", "crlExtensions"],
   cms: ["signerInfos", "encapContentInfo"],
   csr: ["certificationRequestInfoBytes", "subjectPublicKeyInfo", "attributes"],
   crmf: ["messages"],
   attributeCertificate: ["tbsBytes", "holder", "attributes"],
-};
-var _WHY = {
+});
+var _WHY = _assign(_create(null), {
   certificate: "the signed byte range, the signature and the fields that range encodes are separate properties of a parsed object, so a rebuilt certificate (Object.assign, spread, a JSON round-trip) could have them describe different certificates: keep a real CA certificate's signed bytes and signature, replace only its public key, and every field is still well-formed",
   crl: "the signed byte range, the revocation list and the scope extensions are separate properties of a parsed object, so a rebuilt CRL could have them describe different CRLs: empty the revocation list and a correctly signed CRL reports a revoked certificate as good",
   cms: "the signed attribute bytes, the signature, the encapsulated content and the certificates that verify it are separate properties of a parsed object, so a rebuilt SignedData could have them describe different messages: keep a genuine signer's signature and signed attributes, put other content beside them, and every part of the check passes for content that signer never signed",
   csr: "the signed byte range, the key it proves possession of and the subject and requested extensions that range encodes are separate properties of a parsed object, so a rebuilt request could have them describe different requests: keep a genuine requester's signed bytes and signature, replace only the subject or the extensionRequest, and the proof of possession still verifies while the certificate a CA issues from those fields is for a name and a set of extensions nobody signed",
   crmf: "the byte range a proof of possession covers, the key that possession is proven for and the subject a CA will issue to are separate properties of a parsed object, so a rebuilt message set could have them describe different requests: keep a genuine requester's signed range and signature, replace only the certTemplate subject or public key, and the proof still verifies while the certificate is issued for a name and a key nobody proved anything about",
   attributeCertificate: "the signed byte range, the holder the privileges attach to and the attributes granting them are separate properties of a parsed object, so a rebuilt attribute certificate could have them describe different grants: keep a genuine issuer's signed bytes and signature, replace only the holder or an attribute, and the signature still verifies while the privileges are read for someone the issuer never granted them to",
-};
+});
 // @enforced-by guard-shape-reinlined -- shares the fromTrustedSource shape it composes: a door that
 //   tests the claim fields itself, instead of routing here, is the re-inline both replace.
 function acceptDerived(input, kind, parse, E, code, label) {

package/lib/guard-range.js

@@ -21,6 +21,19 @@
 // 2^31 - 1, the shared skip-cert / path-length / salt / iteration ceiling.
 // This literal lives only here (a re-inline anywhere else is flagged: the
 // guard-shape walk anchors on the literal). 2^53 - 1 is the safe-narrow ceiling.
+// The safe-integer test, taken at load. It decides whether a decoded value may be narrowed to a
+// Number at all, so one answering true for an unsafe magnitude reopens the precision loss this
+// guard exists to prevent. See guard-intrinsic for the whole captured set.
+var _isSafeInteger = require("./guard-intrinsic").isSafeInteger;
+// The narrow itself. This module exists to turn a bounded BigInt into a Number without losing the
+// bound, and `Number` is a writable property of globalThis, so a replacement returns whatever it
+// likes from a value this function has just certified as in range.
+var _Number = require("./guard-intrinsic").Number;
+// The widening half of the same job. A replacement returns a value the bound below is then applied
+// to instead of the caller's, so the number that passes the range test is not the number that came
+// in and is not the number handed back.
+var _BigInt = require("./guard-intrinsic").BigInt;
+
 var UINT31_MAX = 2147483647n;
 var SAFE_MAX   = 9007199254740991n;
 var SAFE_MIN   = -9007199254740991n;
@@ -61,7 +74,7 @@ function int(value, min, max, E, code, label) {
   if (typeof value !== "bigint" || value < min || value > max) {
     throw E(code, label + " must be an integer within " + min + ".." + max);
   }
-  return Number(value);
+  return _Number(value);
 }
 
 // uint31(value, E, code, label) -> Number in [0, 2^31-1]. The DER-INTEGER
@@ -88,8 +101,8 @@ function uint64(value, E, code, label) {
   var v;
   if (typeof value === "bigint") {
     v = value;
-  } else if (typeof value === "number" && Number.isSafeInteger(value) && value >= 0) {
-    v = BigInt(value);
+  } else if (typeof value === "number" && _isSafeInteger(value) && value >= 0) {
+    v = _BigInt(value);
   } else {
     throw E(code, label + " must be a non-negative safe-integer Number or a BigInt (a uint64)");
   }
@@ -114,7 +127,7 @@ function uint64(value, E, code, label) {
 // @guard-shape Number\.isSafeInteger\(\s*[A-Za-z_$][\w$]*\s*\)\s*\)\s*return BigInt
 function authoredInteger(value, E, code, label) {
   if (typeof value === "bigint") return value;
-  if (typeof value === "number" && Number.isSafeInteger(value)) return BigInt(value);
+  if (typeof value === "number" && _isSafeInteger(value)) return _BigInt(value);
   throw E(code, label + " must be an integer (a safe-integer number, or a bigint for a large value)");
 }
 

package/lib/guard-secret.js

@@ -30,6 +30,18 @@
 // reaches for first, so the call sites pass only their own intermediates.
 
 var bytes = require("./guard-bytes");
+var intrinsic = require("./guard-intrinsic");
+
+// The fill this guard performs, taken from the typed-array prototype at module load and uncurried
+// so the wipe site reads no property at all. Buffer overrides the fill with a writable
+// `Buffer.prototype.fill`, so reading the method off the value would let a caller decide what
+// wiping means; reading `call` off the captured function would let them decide it again, since
+// that function is still the one sitting on the prototype (see guard-intrinsic).
+var _fill = intrinsic.uncurry(Uint8Array.prototype.fill);
+// The join that produces the buffer cipherFinish hands back. Captured for the same reason as
+// the fill: a replaced `Buffer.concat` decides what the caller receives, and it would receive it
+// while the two intermediates this module is responsible for clearing were cleared as promised.
+var _concat = intrinsic.bufferConcat;
 
 // zeroize(value, ErrorClass, code, label) -> the same object, cleared.
 //   value      : a Buffer / TypedArray the TOOLKIT allocated, or null / undefined
@@ -62,7 +74,13 @@ function zeroize(value, ErrorClass, code, label) {
   // Re-view through the shared bytes guard: it is the single place that decides
   // what counts as a writable BufferSource and rejects a detached one typed.
   var view = bytes.view(value, ErrorClass, code, label);
-  view.fill(0);
+  // Through the fill captured at module load, never `view.fill(0)`. Buffer overrides the typed-array
+  // fill with its own, and that property is writable, so a caller who replaces it with a no-op turns
+  // every wipe in the toolkit into a silent nothing -- and nothing observable changes, because the
+  // wipe still runs, still walks the right buffer, and still returns. A secret that survives a call
+  // whose whole purpose was to clear it is the failure this guard exists to prevent, so the one
+  // operation it performs is the one operation a caller must not be able to reach.
+  _fill(view, 0);
   return value;
 }
 
@@ -80,4 +98,44 @@ function zeroizeAll(list, ErrorClass, code, label) {
   return list;
 }
 
-module.exports = { zeroize: zeroize, zeroizeAll: zeroizeAll };
+// cipherFinish(transform, input, ErrorClass, code, label) -> the output, as one fresh buffer
+//   transform : a node:crypto Cipher or Decipher the CALLER built and configured (key, iv, AAD,
+//               auth tag, padding mode). This guard performs the two calls and nothing else.
+//   input     : the bytes to feed it.
+//
+// The single place this toolkit runs a configured cipher to completion, because
+// `Buffer.concat([c.update(x), c.final()])` abandons a copy on BOTH of its exits and the leak is
+// invisible at the call site.
+//
+// On a DECIPHER the abandoned copy is plaintext. `update` returns the recovered plaintext while
+// `final` is what decides whether the message was authentic at all -- a GCM tag mismatch, a CBC
+// padding failure -- so on a forged message the whole plaintext exists before anything has judged
+// it, and the `concat` never runs: that buffer becomes unreferenced garbage holding readable
+// plaintext. RFC 5083 sec. 1 requires a receiver whose integrity check fails to destroy the
+// plaintext, and withholding it from the caller is not destroying it. On the success path `concat`
+// COPIES, so the update buffer is a second full copy the caller never receives and nothing else
+// will ever clear.
+//
+// It covers the ENCRYPT direction too, where the intermediates are ciphertext and clearing them
+// buys little. That is deliberate: any rule for which of the two directions must clear is a
+// judgment made at each call site, and the sites where it is wrong are the ones nobody re-reads.
+// One shape, cleared everywhere, needs no such judgment -- and the encrypt intermediates of a
+// key-wrap are not obviously worthless to an attacker either.
+//
+// @enforced-by guard-shape-reinlined
+// @guard-shape \.update\s*\([\s\S]{0,300}?\)\s*,\s*[A-Za-z_$][\w$]*\s*\.\s*final\s*\(\s*\)
+function cipherFinish(transform, input, ErrorClass, code, label) {
+  var head = null, tail = null;
+  try {
+    head = transform.update(input);
+    tail = transform.final();
+    // Always a fresh copy, never `head` itself: the returned buffer belongs to the caller and the
+    // two intermediates have to be clearable independently of it.
+    return _concat([head, tail]);
+  } finally {
+    zeroize(head, ErrorClass, code, label);
+    zeroize(tail, ErrorClass, code, label);
+  }
+}
+
+module.exports = { zeroize: zeroize, zeroizeAll: zeroizeAll, cipherFinish: cipherFinish };

package/lib/guard-text.js

@@ -20,6 +20,31 @@
 // no boundary re-derives it (and drifts to cap-after, as some had).
 
 var bytes = require("./guard-bytes");
+var intrinsic = require("./guard-intrinsic");
+
+// Everything this guard does to a caller's input, taken at module load. Each name below is an
+// ordinary writable property of a global, so reading it at call time would let a caller decide what
+// the guard does at the moment it does it. Between them these four cover both of the guard's
+// contracts, and both of its input arms:
+//
+//   _toString / _decode  produce the guard's entire output on the Buffer arm. Replaced with a
+//                        function returning a constant, they hand a PEM header, a JOSE segment or a
+//                        DN attribute value a string the caller chose in place of the bytes that
+//                        were checked -- while the cap, the detached-view refusal and the strict
+//                        UTF-8 rule all still run and all still pass.
+//   _byteLength          measures the string arm against the cap. One returning 0 admits a string
+//                        of any size, which is the allocation-DoS this guard exists to bound.
+//   _isInteger           decides whether the cap itself is usable, and _isBuffer decides which arm
+//                        an input takes.
+// The two method captures are uncurried, so their call sites read no property of them; see
+// guard-intrinsic for why capturing a method and then reading `.call` on it reopens the hole.
+var _toString = intrinsic.uncurry(Buffer.prototype.toString);
+var _decode = intrinsic.uncurry(TextDecoder.prototype.decode);
+// Already plain functions rather than methods, so these are invoked directly.
+var _byteLength = Buffer.byteLength;
+var _isBuffer = Buffer.isBuffer;
+var _isInteger = Number.isInteger;
+var _TextDecoder = TextDecoder;
 
 var LATIN1 = "latin1";
 
@@ -43,27 +68,31 @@ function decode(input, maxBytes, ErrorClass, spec) {
   // the `length > maxBytes` comparison always false, silently disabling the size
   // cap on the guard whose whole contract is cap-before-copy. Config-time
   // TypeError (every composing boundary passes a C.LIMITS constant).
-  if (!Number.isInteger(maxBytes) || maxBytes < 0) {
+  if (!_isInteger(maxBytes) || maxBytes < 0) {
     throw new TypeError("guard.text.decode: maxBytes must be a non-negative integer");
   }
   var charset = spec.charset || LATIN1;
-  if (Buffer.isBuffer(input)) {
+  if (_isBuffer(input)) {
     // Re-view through the byte guard first so a detached backing ArrayBuffer (a
     // transferred / structuredClone'd Buffer, which reads as zero-length) fails
     // closed here -- the same detached-buffer defense the byte boundaries get --
     // instead of being decoded as an empty string. Then cap, then decode.
     input = bytes.view(input, ErrorClass, spec.badInput, spec.label);
-    if (input.length > maxBytes) throw new ErrorClass(spec.tooLarge, spec.label + " exceeds the size cap");
+    // Measured through the byte guard's captured intrinsic getter, never `input.length`. On a typed
+    // array `length` is an accessor on the prototype and it is configurable, so a replacement
+    // returning 0 lets a buffer of any size past the cap and straight into the decode -- the
+    // allocation this guard exists to bound, defeated by the one read that bounds it.
+    if (bytes.lengthOf(input) > maxBytes) throw new ErrorClass(spec.tooLarge, spec.label + " exceeds the size cap");
     if (spec.fatal) {
-      try { return new TextDecoder(charset, { fatal: true }).decode(input); }
+      try { return _decode(new _TextDecoder(charset, { fatal: true }), input); }
       catch (e) { throw new ErrorClass(spec.badDecode, spec.label + " is not valid " + charset, e); }
     }
-    return input.toString(charset);
+    return _toString(input, charset);
   }
   if (typeof input === "string") {
     // A latin1 string's char length equals its byte length; a UTF-8 string's
     // does not, so bound the encoded byte length.
-    var byteLen = charset === LATIN1 ? input.length : Buffer.byteLength(input, "utf8");
+    var byteLen = charset === LATIN1 ? input.length : _byteLength(input, "utf8");
     if (byteLen > maxBytes) throw new ErrorClass(spec.tooLarge, spec.label + " exceeds the size cap");
     return input;
   }

package/lib/guard-time.js

@@ -27,7 +27,12 @@
 // OCSP / CRL currency callers that treat out-of-window as a `continue` skip keep
 // their control flow while a NaN operand can never slip through as a false.
 
-var util = require("util");
+// The slot predicates and the NaN test, snapshotted at load. `util.types` is an ordinary object,
+// so a later `util.types.isDate = () => true` would otherwise decide what this guard calls a Date;
+// the global `isNaN` is writable, and one returning false makes an invalid Date pass the check
+// below, which is the fail-open direction.
+var util = { types: require("./guard-intrinsic").types };
+var _isNaN = Number.isNaN;
 
 // assertValid(value, E, code, label) -> the same Date, once proven valid.
 //   value : a Date (or an alleged one) from a caller boundary.
@@ -53,7 +58,11 @@ var util = require("util");
 // runs before this module is inside the trust boundary already and can reach further than this
 // one method, so there is no defense here to add; what the capture buys is immunity to every
 // replacement that happens afterwards, which is the case a caller's argument can reach.
-var _dateGetTime = Date.prototype.getTime;
+//
+// The capture is uncurried through guard-intrinsic, so `instantOf` reads no property of it either.
+// The captured function is still the one on `Date.prototype`, and an own `call` assigned to it
+// would shadow `Function.prototype.call` and decide every instant this toolkit evaluates against.
+var _dateGetTime = require("./guard-intrinsic").uncurry(Date.prototype.getTime);
 
 // instantOf(value) -> the epoch milliseconds a Date holds, read through the intrinsic.
 //
@@ -65,7 +74,7 @@ var _dateGetTime = Date.prototype.getTime;
 //
 // @enforced-by guard-shape-reinlined
 // @guard-shape \.getTime\s*\(
-function instantOf(value) { return _dateGetTime.call(value); }
+function instantOf(value) { return _dateGetTime(value); }
 
 // @enforced-by nan-date-comparison-unguarded
 function assertValid(value, E, code, label) {
@@ -73,7 +82,7 @@ function assertValid(value, E, code, label) {
   // `Object.create(Date.prototype)` inherits everything while holding no instant, so it passes
   // that test and `getTime()` then throws a raw TypeError out of this guard. `util.types.isDate`
   // reads the internal slot, which a caller cannot fake and which answers the same across realms.
-  if (!util.types.isDate(value) || isNaN(instantOf(value))) {
+  if (!util.types.isDate(value) || _isNaN(instantOf(value))) {
     throw E(code, (label || "value") + " must be a valid Date");
   }
   return value;

package/lib/hpke.js

@@ -5,6 +5,7 @@
  * @module pki.hpke
  * @nav        Protocols
  * @title      HPKE
+ * @fullname   HPKE (Hybrid Public Key Encryption, RFC 9180)
  * @intro Hybrid Public Key Encryption (RFC 9180) -- the standard construction
  *   behind TLS Encrypted Client Hello, MLS, and OHTTP that turns a recipient KEM
  *   public key into an encapsulated key plus an AEAD-encrypting context. This is
@@ -319,7 +320,7 @@ Context.prototype.seal = function (aad, pt) {
   var nonce = this._nonce();
   var c = nodeCrypto.createCipheriv(aead.cipher, this._key, nonce, { authTagLength: aead.Nt });
   if (aad && aad.length) c.setAAD(aad);
-  var body = concat([c.update(_buf(pt)), c.final()]);
+  var body = guard.secret.cipherFinish(c, _buf(pt), HpkeError, "hpke/bad-input", "a seal intermediate");
   var ct = concat([body, c.getAuthTag()]);
   this._inc();
   return ct;
@@ -335,7 +336,10 @@ Context.prototype.open = function (aad, ct) {
   if (aad && aad.length) d.setAAD(aad);
   d.setAuthTag(ct.subarray(ct.length - aead.Nt));
   var pt;
-  try { pt = concat([d.update(ct.subarray(0, ct.length - aead.Nt)), d.final()]); }
+  // Through the shared guard so the recovered plaintext is destroyed when the AEAD tag does not
+  // check out (RFC 9180 sec. 5.2 gives open one outcome on failure, and it is not a copy left in
+  // the heap), and so the success path's abandoned intermediate is cleared too.
+  try { pt = guard.secret.cipherFinish(d, ct.subarray(0, ct.length - aead.Nt), HpkeError, "hpke/bad-input", "the recovered plaintext"); }
   catch (e) { throw _err("hpke/open-failed", "AEAD authentication failed (RFC 9180 sec. 5.2)", e); }
   this._inc();
   return pt;

package/lib/http-transport.js

@@ -5,6 +5,7 @@
  * @module     pki.transport
  * @nav        Protocols
  * @title      Transport
+ * @fullname   HTTP transport for OCSP, CRL, EST and ACME requests
  * @order      195
  * @slug       transport
  *

package/lib/inspect.js

@@ -5,6 +5,7 @@
  * @module pki.inspect
  * @nav        Tooling
  * @title      Inspect
+ * @fullname   Inspect: render any PKI structure as readable text
  * @intro Human-readable inspection of a parsed certificate: the pure-JS
  *   equivalent of `openssl x509 -text`. `certificate(input)` ingests a PEM string,
  *   a DER Buffer, or an already-parsed certificate and returns a familiar

package/lib/jose.js

@@ -5,6 +5,7 @@
  * @module     pki.jose
  * @nav        Protocols
  * @title      JOSE (JWS / JWK)
+ * @fullname   JOSE: JWS signatures and JWK keys
  * @order      10
  * @slug       jose
  *

package/lib/key.js

@@ -5,6 +5,7 @@
  * @module     pki.key
  * @nav        Signing
  * @title      Keys
+ * @fullname   Key generation, import and export (RSA, EC, EdDSA, ML-DSA)
  * @intro The key-material lifecycle: export / import a private key as PKCS#8 (`OneAsymmetricKey`,
  *   RFC 5958) or a public key as SPKI (RFC 5280 sec. 4.1.2.7), encrypt / decrypt a private key under
  *   RFC 8018 PBES2 (`EncryptedPrivateKeyInfo`, PBKDF2 + AES-CBC-Pad), and `generate` /
@@ -138,7 +139,7 @@ async function encrypt(privateKey, password, opts) {
   try { dk = nodeCrypto.pbkdf2Sync(pwK.bytes, salt, iterations, keyBits / 8, prfNode); }
   finally { if (pwK.owned) guard.secret.zeroize(pwK.bytes, KeyError, "key/bad-input", "the password encoding"); }
   try {
-    var ciphertext = pbes2.cbcEncrypt(dk, iv, der, keyBits);
+    var ciphertext = pbes2.cbcEncrypt(dk, iv, der, keyBits, KeyError, "key/bad-input");
     var epki = b.sequence([pbes2.pbes2AlgId(salt, iterations, prf, cipherName, iv), b.octetString(ciphertext)]);
     pkcs8.parseEncrypted(epki);   // self-check: the produced EncryptedPrivateKeyInfo re-parses
     return opts.pem ? pkcs8.pemEncode(epki, "ENCRYPTED PRIVATE KEY") : epki;

package/lib/lint.js

@@ -5,6 +5,7 @@
  * @module pki.lint
  * @nav        Tooling
  * @title      Lint
+ * @fullname   Certificate linting against CA/Browser Forum requirements
  * @intro The certificate LINTING engine -- the zlint / pkilint of JavaScript. It walks an
  *   ALREADY-PARSED certificate (from `pki.schema.x509.parse`, whose extension values it
  *   decodes with the shared RFC 5280 decoders) and emits graded, advisory FINDINGS: each

package/lib/merkle.js

@@ -5,6 +5,7 @@
  * @module     pki.merkle
  * @nav        Transparency
  * @title      Merkle
+ * @fullname   Merkle trees: inclusion and consistency proofs (RFC 6962)
  * @order      220
  * @slug       merkle
  *

package/lib/ocsp.js

@@ -5,6 +5,7 @@
  * @module pki.ocsp
  * @nav        Revocation
  * @title      OCSP
+ * @fullname   OCSP (Online Certificate Status Protocol) revocation checking
  * @intro The producing + client-facing half of RFC 6960 Online Certificate Status Protocol:
  *   build a status request over a certificate (`pki.ocsp.buildRequest`), build and sign a status
  *   response as an authorized responder (`pki.ocsp.sign`), emit an unsigned error response

package/lib/oid.js

@@ -5,6 +5,7 @@
  * @module     pki.oid
  * @nav        Core
  * @title      Object Identifiers
+ * @fullname   OID registry: resolve object identifiers by name or dotted form
  * @order      40
  * @slug       oid
  *

package/lib/path-validate.js

@@ -6,6 +6,7 @@
  * @module pki.path
  * @nav Path validation
  * @title Certification path validation (RFC 5280 6)
+ * @fullname Certificate chain validation (RFC 5280 sec. 6 path validation)
  * @intro
  * RFC 5280 6 certification-path validation as a pure, re-entrant algorithm
  * over already-parsed certificates. `pki.path.validate(path, opts)` runs the